?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
lib/util Split data_blob_hex_string() into upper and lower
[Samba/ekacnet.git] / source4 / dsdb / samdb / ldb_modules / password_hash.c
blob8791db2bc4fcd4d31cf223e25f2ae5af0b9fc1c9
1 /*
2 ldb database module
3
4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2006
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Stefan Metzmacher 2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 /*
24 * Name: ldb
25 *
26 * Component: ldb password_hash module
27 *
28 * Description: correctly update hash values based on changes to userPassword and friends
29 *
30 * Author: Andrew Bartlett
31 * Author: Stefan Metzmacher
32 */
33
34 #include "includes.h"
35 #include "libcli/ldap/ldap_ndr.h"
36 #include "ldb_module.h"
37 #include "librpc/gen_ndr/misc.h"
38 #include "librpc/gen_ndr/samr.h"
39 #include "libcli/auth/libcli_auth.h"
40 #include "libcli/security/security.h"
41 #include "system/kerberos.h"
42 #include "auth/kerberos/kerberos.h"
43 #include "system/time.h"
44 #include "dsdb/samdb/samdb.h"
45 #include "../libds/common/flags.h"
46 #include "dsdb/samdb/ldb_modules/password_modules.h"
47 #include "librpc/ndr/libndr.h"
48 #include "librpc/gen_ndr/ndr_drsblobs.h"
49 #include "../lib/crypto/crypto.h"
50 #include "param/param.h"
51
52 /* If we have decided there is reason to work on this request, then
53 * setup all the password hash types correctly.
54 *
55 * If the administrator doesn't want the userPassword stored (set in the
56 * domain and per-account policies) then we must strip that out before
57 * we do the first operation.
58 *
59 * Once this is done (which could update anything at all), we
60 * calculate the password hashes.
61 *
62 * This function must not only update the unicodePwd, dBCSPwd and
63 * supplementalCredentials fields, it must also atomicly increment the
64 * msDS-KeyVersionNumber. We should be in a transaction, so all this
65 * should be quite safe...
66 *
67 * Finally, if the administrator has requested that a password history
68 * be maintained, then this should also be written out.
69 *
70 */
71
72 struct ph_context {
73
74 struct ldb_module *module;
75 struct ldb_request *req;
76
77 struct ldb_request *dom_req;
78 struct ldb_reply *dom_res;
79
80 struct ldb_reply *search_res;
81
82 struct domain_data *domain;
83 };
84
85 struct domain_data {
86 bool store_cleartext;
87 uint_t pwdProperties;
88 uint_t pwdHistoryLength;
89 const char *netbios_domain;
90 const char *dns_domain;
91 const char *realm;
92 };
93
94 struct setup_password_fields_io {
95 struct ph_context *ac;
96 struct domain_data *domain;
97 struct smb_krb5_context *smb_krb5_context;
98
99 /* infos about the user account */
100 struct {
101 uint32_t user_account_control;
102 const char *sAMAccountName;
103 const char *user_principal_name;
104 bool is_computer;
105 } u;
106
107 /* new credentials */
108 struct {
109 const struct ldb_val *cleartext_utf8;
110 const struct ldb_val *cleartext_utf16;
111 struct ldb_val quoted_utf16;
112 struct samr_Password *nt_hash;
113 struct samr_Password *lm_hash;
114 } n;
115
116 /* old credentials */
117 struct {
118 uint32_t nt_history_len;
119 struct samr_Password *nt_history;
120 uint32_t lm_history_len;
121 struct samr_Password *lm_history;
122 const struct ldb_val *supplemental;
123 struct supplementalCredentialsBlob scb;
124 uint32_t kvno;
125 } o;
126
127 /* generated credentials */
128 struct {
129 struct samr_Password *nt_hash;
130 struct samr_Password *lm_hash;
131 uint32_t nt_history_len;
132 struct samr_Password *nt_history;
133 uint32_t lm_history_len;
134 struct samr_Password *lm_history;
135 const char *salt;
136 DATA_BLOB aes_256;
137 DATA_BLOB aes_128;
138 DATA_BLOB des_md5;
139 DATA_BLOB des_crc;
140 struct ldb_val supplemental;
141 NTTIME last_set;
142 uint32_t kvno;
143 } g;
144 };
145
146 /* Get the NT hash, and fill it in as an entry in the password history,
147 and specify it into io->g.nt_hash */
148
149 static int setup_nt_fields(struct setup_password_fields_io *io)
150 {
151 struct ldb_context *ldb;
152 uint32_t i;
153
154 io->g.nt_hash = io->n.nt_hash;
155 ldb = ldb_module_get_ctx(io->ac->module);
156
157 if (io->domain->pwdHistoryLength == 0) {
158 return LDB_SUCCESS;
159 }
160
161 /* We might not have an old NT password */
162 io->g.nt_history = talloc_array(io->ac,
163 struct samr_Password,
164 io->domain->pwdHistoryLength);
165 if (!io->g.nt_history) {
166 ldb_oom(ldb);
167 return LDB_ERR_OPERATIONS_ERROR;
168 }
169
170 for (i = 0; i < MIN(io->domain->pwdHistoryLength-1, io->o.nt_history_len); i++) {
171 io->g.nt_history[i+1] = io->o.nt_history[i];
172 }
173 io->g.nt_history_len = i + 1;
174
175 if (io->g.nt_hash) {
176 io->g.nt_history[0] = *io->g.nt_hash;
177 } else {
178 /*
179 * TODO: is this correct?
180 * the simular behavior is correct for the lm history case
181 */
182 E_md4hash("", io->g.nt_history[0].hash);
183 }
184
185 return LDB_SUCCESS;
186 }
187
188 /* Get the LANMAN hash, and fill it in as an entry in the password history,
189 and specify it into io->g.lm_hash */
190
191 static int setup_lm_fields(struct setup_password_fields_io *io)
192 {
193 struct ldb_context *ldb;
194 uint32_t i;
195
196 io->g.lm_hash = io->n.lm_hash;
197 ldb = ldb_module_get_ctx(io->ac->module);
198
199 if (io->domain->pwdHistoryLength == 0) {
200 return LDB_SUCCESS;
201 }
202
203 /* We might not have an old NT password */
204 io->g.lm_history = talloc_array(io->ac,
205 struct samr_Password,
206 io->domain->pwdHistoryLength);
207 if (!io->g.lm_history) {
208 ldb_oom(ldb);
209 return LDB_ERR_OPERATIONS_ERROR;
210 }
211
212 for (i = 0; i < MIN(io->domain->pwdHistoryLength-1, io->o.lm_history_len); i++) {
213 io->g.lm_history[i+1] = io->o.lm_history[i];
214 }
215 io->g.lm_history_len = i + 1;
216
217 if (io->g.lm_hash) {
218 io->g.lm_history[0] = *io->g.lm_hash;
219 } else {
220 E_deshash("", io->g.lm_history[0].hash);
221 }
222
223 return LDB_SUCCESS;
224 }
225
226 static int setup_kerberos_keys(struct setup_password_fields_io *io)
227 {
228 struct ldb_context *ldb;
229 krb5_error_code krb5_ret;
230 Principal *salt_principal;
231 krb5_salt salt;
232 krb5_keyblock key;
233 krb5_data cleartext_data;
234
235 ldb = ldb_module_get_ctx(io->ac->module);
236 cleartext_data.data = io->n.cleartext_utf8->data;
237 cleartext_data.length = io->n.cleartext_utf8->length;
238
239 /* Many, many thanks to lukeh@padl.com for this
240 * algorithm, described in his Nov 10 2004 mail to
241 * samba-technical@samba.org */
242
243 /*
244 * Determine a salting principal
245 */
246 if (io->u.is_computer) {
247 char *name;
248 char *saltbody;
249
250 name = strlower_talloc(io->ac, io->u.sAMAccountName);
251 if (!name) {
252 ldb_oom(ldb);
253 return LDB_ERR_OPERATIONS_ERROR;
254 }
255
256 if (name[strlen(name)-1] == '$') {
257 name[strlen(name)-1] = '\0';
258 }
259
260 saltbody = talloc_asprintf(io->ac, "%s.%s", name, io->domain->dns_domain);
261 if (!saltbody) {
262 ldb_oom(ldb);
263 return LDB_ERR_OPERATIONS_ERROR;
264 }
265
266 krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
267 &salt_principal,
268 io->domain->realm, "host",
269 saltbody, NULL);
270 } else if (io->u.user_principal_name) {
271 char *user_principal_name;
272 char *p;
273
274 user_principal_name = talloc_strdup(io->ac, io->u.user_principal_name);
275 if (!user_principal_name) {
276 ldb_oom(ldb);
277 return LDB_ERR_OPERATIONS_ERROR;
278 }
279
280 p = strchr(user_principal_name, '@');
281 if (p) {
282 p[0] = '\0';
283 }
284
285 krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
286 &salt_principal,
287 io->domain->realm, user_principal_name,
288 NULL);
289 } else {
290 krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
291 &salt_principal,
292 io->domain->realm, io->u.sAMAccountName,
293 NULL);
294 }
295 if (krb5_ret) {
296 ldb_asprintf_errstring(ldb,
297 "setup_kerberos_keys: "
298 "generation of a salting principal failed: %s",
299 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context, krb5_ret, io->ac));
300 return LDB_ERR_OPERATIONS_ERROR;
301 }
302
303 /*
304 * create salt from salt_principal
305 */
306 krb5_ret = krb5_get_pw_salt(io->smb_krb5_context->krb5_context,
307 salt_principal, &salt);
308 krb5_free_principal(io->smb_krb5_context->krb5_context, salt_principal);
309 if (krb5_ret) {
310 ldb_asprintf_errstring(ldb,
311 "setup_kerberos_keys: "
312 "generation of krb5_salt failed: %s",
313 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context, krb5_ret, io->ac));
314 return LDB_ERR_OPERATIONS_ERROR;
315 }
316 /* create a talloc copy */
317 io->g.salt = talloc_strndup(io->ac,
318 salt.saltvalue.data,
319 salt.saltvalue.length);
320 krb5_free_salt(io->smb_krb5_context->krb5_context, salt);
321 if (!io->g.salt) {
322 ldb_oom(ldb);
323 return LDB_ERR_OPERATIONS_ERROR;
324 }
325 salt.saltvalue.data = discard_const(io->g.salt);
326 salt.saltvalue.length = strlen(io->g.salt);
327
328 /*
329 * create ENCTYPE_AES256_CTS_HMAC_SHA1_96 key out of
330 * the salt and the cleartext password
331 */
332 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
333 ENCTYPE_AES256_CTS_HMAC_SHA1_96,
334 cleartext_data,
335 salt,
336 &key);
337 if (krb5_ret) {
338 ldb_asprintf_errstring(ldb,
339 "setup_kerberos_keys: "
340 "generation of a aes256-cts-hmac-sha1-96 key failed: %s",
341 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context, krb5_ret, io->ac));
342 return LDB_ERR_OPERATIONS_ERROR;
343 }
344 io->g.aes_256 = data_blob_talloc(io->ac,
345 key.keyvalue.data,
346 key.keyvalue.length);
347 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
348 if (!io->g.aes_256.data) {
349 ldb_oom(ldb);
350 return LDB_ERR_OPERATIONS_ERROR;
351 }
352
353 /*
354 * create ENCTYPE_AES128_CTS_HMAC_SHA1_96 key out of
355 * the salt and the cleartext password
356 */
357 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
358 ENCTYPE_AES128_CTS_HMAC_SHA1_96,
359 cleartext_data,
360 salt,
361 &key);
362 if (krb5_ret) {
363 ldb_asprintf_errstring(ldb,
364 "setup_kerberos_keys: "
365 "generation of a aes128-cts-hmac-sha1-96 key failed: %s",
366 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context, krb5_ret, io->ac));
367 return LDB_ERR_OPERATIONS_ERROR;
368 }
369 io->g.aes_128 = data_blob_talloc(io->ac,
370 key.keyvalue.data,
371 key.keyvalue.length);
372 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
373 if (!io->g.aes_128.data) {
374 ldb_oom(ldb);
375 return LDB_ERR_OPERATIONS_ERROR;
376 }
377
378 /*
379 * create ENCTYPE_DES_CBC_MD5 key out of
380 * the salt and the cleartext password
381 */
382 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
383 ENCTYPE_DES_CBC_MD5,
384 cleartext_data,
385 salt,
386 &key);
387 if (krb5_ret) {
388 ldb_asprintf_errstring(ldb,
389 "setup_kerberos_keys: "
390 "generation of a des-cbc-md5 key failed: %s",
391 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context, krb5_ret, io->ac));
392 return LDB_ERR_OPERATIONS_ERROR;
393 }
394 io->g.des_md5 = data_blob_talloc(io->ac,
395 key.keyvalue.data,
396 key.keyvalue.length);
397 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
398 if (!io->g.des_md5.data) {
399 ldb_oom(ldb);
400 return LDB_ERR_OPERATIONS_ERROR;
401 }
402
403 /*
404 * create ENCTYPE_DES_CBC_CRC key out of
405 * the salt and the cleartext password
406 */
407 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
408 ENCTYPE_DES_CBC_CRC,
409 cleartext_data,
410 salt,
411 &key);
412 if (krb5_ret) {
413 ldb_asprintf_errstring(ldb,
414 "setup_kerberos_keys: "
415 "generation of a des-cbc-crc key failed: %s",
416 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context, krb5_ret, io->ac));
417 return LDB_ERR_OPERATIONS_ERROR;
418 }
419 io->g.des_crc = data_blob_talloc(io->ac,
420 key.keyvalue.data,
421 key.keyvalue.length);
422 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
423 if (!io->g.des_crc.data) {
424 ldb_oom(ldb);
425 return LDB_ERR_OPERATIONS_ERROR;
426 }
427
428 return LDB_SUCCESS;
429 }
430
431 static int setup_primary_kerberos(struct setup_password_fields_io *io,
432 const struct supplementalCredentialsBlob *old_scb,
433 struct package_PrimaryKerberosBlob *pkb)
434 {
435 struct ldb_context *ldb;
436 struct package_PrimaryKerberosCtr3 *pkb3 = &pkb->ctr.ctr3;
437 struct supplementalCredentialsPackage *old_scp = NULL;
438 struct package_PrimaryKerberosBlob _old_pkb;
439 struct package_PrimaryKerberosCtr3 *old_pkb3 = NULL;
440 uint32_t i;
441 enum ndr_err_code ndr_err;
442
443 ldb = ldb_module_get_ctx(io->ac->module);
444
445 /*
446 * prepare generation of keys
447 *
448 * ENCTYPE_DES_CBC_MD5
449 * ENCTYPE_DES_CBC_CRC
450 */
451 pkb->version = 3;
452 pkb3->salt.string = io->g.salt;
453 pkb3->num_keys = 2;
454 pkb3->keys = talloc_array(io->ac,
455 struct package_PrimaryKerberosKey3,
456 pkb3->num_keys);
457 if (!pkb3->keys) {
458 ldb_oom(ldb);
459 return LDB_ERR_OPERATIONS_ERROR;
460 }
461
462 pkb3->keys[0].keytype = ENCTYPE_DES_CBC_MD5;
463 pkb3->keys[0].value = &io->g.des_md5;
464 pkb3->keys[1].keytype = ENCTYPE_DES_CBC_CRC;
465 pkb3->keys[1].value = &io->g.des_crc;
466
467 /* initialize the old keys to zero */
468 pkb3->num_old_keys = 0;
469 pkb3->old_keys = NULL;
470
471 /* if there're no old keys, then we're done */
472 if (!old_scb) {
473 return LDB_SUCCESS;
474 }
475
476 for (i=0; i < old_scb->sub.num_packages; i++) {
477 if (strcmp("Primary:Kerberos", old_scb->sub.packages[i].name) != 0) {
478 continue;
479 }
480
481 if (!old_scb->sub.packages[i].data || !old_scb->sub.packages[i].data[0]) {
482 continue;
483 }
484
485 old_scp = &old_scb->sub.packages[i];
486 break;
487 }
488 /* Primary:Kerberos element of supplementalCredentials */
489 if (old_scp) {
490 DATA_BLOB blob;
491
492 blob = strhex_to_data_blob(io->ac, old_scp->data);
493 if (!blob.data) {
494 ldb_oom(ldb);
495 return LDB_ERR_OPERATIONS_ERROR;
496 }
497
498 /* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
499 ndr_err = ndr_pull_struct_blob(&blob, io->ac, lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), &_old_pkb,
500 (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
501 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
502 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
503 ldb_asprintf_errstring(ldb,
504 "setup_primary_kerberos: "
505 "failed to pull old package_PrimaryKerberosBlob: %s",
506 nt_errstr(status));
507 return LDB_ERR_OPERATIONS_ERROR;
508 }
509
510 if (_old_pkb.version != 3) {
511 ldb_asprintf_errstring(ldb,
512 "setup_primary_kerberos: "
513 "package_PrimaryKerberosBlob version[%u] expected[3]",
514 _old_pkb.version);
515 return LDB_ERR_OPERATIONS_ERROR;
516 }
517
518 old_pkb3 = &_old_pkb.ctr.ctr3;
519 }
520
521 /* if we didn't found the old keys we're done */
522 if (!old_pkb3) {
523 return LDB_SUCCESS;
524 }
525
526 /* fill in the old keys */
527 pkb3->num_old_keys = old_pkb3->num_keys;
528 pkb3->old_keys = old_pkb3->keys;
529
530 return LDB_SUCCESS;
531 }
532
533 static int setup_primary_kerberos_newer(struct setup_password_fields_io *io,
534 const struct supplementalCredentialsBlob *old_scb,
535 struct package_PrimaryKerberosBlob *pkb)
536 {
537 struct ldb_context *ldb;
538 struct package_PrimaryKerberosCtr4 *pkb4 = &pkb->ctr.ctr4;
539 struct supplementalCredentialsPackage *old_scp = NULL;
540 struct package_PrimaryKerberosBlob _old_pkb;
541 struct package_PrimaryKerberosCtr4 *old_pkb4 = NULL;
542 uint32_t i;
543 enum ndr_err_code ndr_err;
544
545 ldb = ldb_module_get_ctx(io->ac->module);
546
547 /*
548 * prepare generation of keys
549 *
550 * ENCTYPE_AES256_CTS_HMAC_SHA1_96
551 * ENCTYPE_AES128_CTS_HMAC_SHA1_96
552 * ENCTYPE_DES_CBC_MD5
553 * ENCTYPE_DES_CBC_CRC
554 */
555 pkb->version = 4;
556 pkb4->salt.string = io->g.salt;
557 pkb4->default_iteration_count = 4096;
558 pkb4->num_keys = 4;
559
560 pkb4->keys = talloc_array(io->ac,
561 struct package_PrimaryKerberosKey4,
562 pkb4->num_keys);
563 if (!pkb4->keys) {
564 ldb_oom(ldb);
565 return LDB_ERR_OPERATIONS_ERROR;
566 }
567
568 pkb4->keys[0].iteration_count = 4096;
569 pkb4->keys[0].keytype = ENCTYPE_AES256_CTS_HMAC_SHA1_96;
570 pkb4->keys[0].value = &io->g.aes_256;
571 pkb4->keys[1].iteration_count = 4096;
572 pkb4->keys[1].keytype = ENCTYPE_AES128_CTS_HMAC_SHA1_96;
573 pkb4->keys[1].value = &io->g.aes_128;
574 pkb4->keys[2].iteration_count = 4096;
575 pkb4->keys[2].keytype = ENCTYPE_DES_CBC_MD5;
576 pkb4->keys[2].value = &io->g.des_md5;
577 pkb4->keys[3].iteration_count = 4096;
578 pkb4->keys[3].keytype = ENCTYPE_DES_CBC_CRC;
579 pkb4->keys[3].value = &io->g.des_crc;
580
581 /* initialize the old keys to zero */
582 pkb4->num_old_keys = 0;
583 pkb4->old_keys = NULL;
584 pkb4->num_older_keys = 0;
585 pkb4->older_keys = NULL;
586
587 /* if there're no old keys, then we're done */
588 if (!old_scb) {
589 return LDB_SUCCESS;
590 }
591
592 for (i=0; i < old_scb->sub.num_packages; i++) {
593 if (strcmp("Primary:Kerberos-Newer-Keys", old_scb->sub.packages[i].name) != 0) {
594 continue;
595 }
596
597 if (!old_scb->sub.packages[i].data || !old_scb->sub.packages[i].data[0]) {
598 continue;
599 }
600
601 old_scp = &old_scb->sub.packages[i];
602 break;
603 }
604 /* Primary:Kerberos-Newer-Keys element of supplementalCredentials */
605 if (old_scp) {
606 DATA_BLOB blob;
607
608 blob = strhex_to_data_blob(io->ac, old_scp->data);
609 if (!blob.data) {
610 ldb_oom(ldb);
611 return LDB_ERR_OPERATIONS_ERROR;
612 }
613
614 /* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
615 ndr_err = ndr_pull_struct_blob(&blob, io->ac,
616 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
617 &_old_pkb,
618 (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
619 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
620 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
621 ldb_asprintf_errstring(ldb,
622 "setup_primary_kerberos_newer: "
623 "failed to pull old package_PrimaryKerberosBlob: %s",
624 nt_errstr(status));
625 return LDB_ERR_OPERATIONS_ERROR;
626 }
627
628 if (_old_pkb.version != 4) {
629 ldb_asprintf_errstring(ldb,
630 "setup_primary_kerberos_newer: "
631 "package_PrimaryKerberosBlob version[%u] expected[4]",
632 _old_pkb.version);
633 return LDB_ERR_OPERATIONS_ERROR;
634 }
635
636 old_pkb4 = &_old_pkb.ctr.ctr4;
637 }
638
639 /* if we didn't found the old keys we're done */
640 if (!old_pkb4) {
641 return LDB_SUCCESS;
642 }
643
644 /* fill in the old keys */
645 pkb4->num_old_keys = old_pkb4->num_keys;
646 pkb4->old_keys = old_pkb4->keys;
647 pkb4->num_older_keys = old_pkb4->num_old_keys;
648 pkb4->older_keys = old_pkb4->old_keys;
649
650 return LDB_SUCCESS;
651 }
652
653 static int setup_primary_wdigest(struct setup_password_fields_io *io,
654 const struct supplementalCredentialsBlob *old_scb,
655 struct package_PrimaryWDigestBlob *pdb)
656 {
657 struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
658 DATA_BLOB sAMAccountName;
659 DATA_BLOB sAMAccountName_l;
660 DATA_BLOB sAMAccountName_u;
661 const char *user_principal_name = io->u.user_principal_name;
662 DATA_BLOB userPrincipalName;
663 DATA_BLOB userPrincipalName_l;
664 DATA_BLOB userPrincipalName_u;
665 DATA_BLOB netbios_domain;
666 DATA_BLOB netbios_domain_l;
667 DATA_BLOB netbios_domain_u;
668 DATA_BLOB dns_domain;
669 DATA_BLOB dns_domain_l;
670 DATA_BLOB dns_domain_u;
671 DATA_BLOB digest;
672 DATA_BLOB delim;
673 DATA_BLOB backslash;
674 uint8_t i;
675 struct {
676 DATA_BLOB *user;
677 DATA_BLOB *realm;
678 DATA_BLOB *nt4dom;
679 } wdigest[] = {
680 /*
681 * See
682 * http://technet2.microsoft.com/WindowsServer/en/library/717b450c-f4a0-4cc9-86f4-cc0633aae5f91033.mspx?mfr=true
683 * for what precalculated hashes are supposed to be stored...
684 *
685 * I can't reproduce all values which should contain "Digest" as realm,
686 * am I doing something wrong or is w2k3 just broken...?
687 *
688 * W2K3 fills in following for a user:
689 *
690 * dn: CN=NewUser,OU=newtop,DC=sub1,DC=w2k3,DC=vmnet1,DC=vm,DC=base
691 * sAMAccountName: NewUser2Sam
692 * userPrincipalName: NewUser2Princ@sub1.w2k3.vmnet1.vm.base
693 *
694 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
695 * b7ec9da91062199aee7d121e6710fe23 => newuser2sam:sub1:TestPwd2007
696 * 17d290bc5c9f463fac54c37a8cea134d => NEWUSER2SAM:SUB1:TestPwd2007
697 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
698 * 5d57e7823938348127322e08cd81bcb5 => NewUser2Sam:sub1:TestPwd2007
699 * 07dd701bf8a011ece585de3d47237140 => NEWUSER2SAM:sub1:TestPwd2007
700 * e14fb0eb401498d2cb33c9aae1cc7f37 => newuser2sam:SUB1:TestPwd2007
701 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
702 * f52da1266a6bdd290ffd48b2c823dda7 => newuser2sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
703 * d2b42f171248cec37a3c5c6b55404062 => NEWUSER2SAM:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
704 * fff8d790ff6c152aaeb6ebe17b4021de => NewUser2Sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
705 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
706 * 2a7563c3715bc418d626dabef378c008 => NEWUSER2SAM:sub1.w2k3.vmnet1.vm.base:TestPwd2007
707 * c8e9557a87cd4200fda0c11d2fa03f96 => newuser2sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
708 * 221c55284451ae9b3aacaa2a3c86f10f => NewUser2Princ@sub1.w2k3.vmnet1.vm.base::TestPwd2007
709 * 74e1be668853d4324d38c07e2acfb8ea => (w2k3 has a bug here!) newuser2princ@sub1.w2k3.vmnet1.vm.base::TestPwd2007
710 * e1e244ab7f098e3ae1761be7f9229bbb => NEWUSER2PRINC@SUB1.W2K3.VMNET1.VM.BASE::TestPwd2007
711 * 86db637df42513039920e605499c3af6 => SUB1\NewUser2Sam::TestPwd2007
712 * f5e43474dfaf067fee8197a253debaa2 => sub1\newuser2sam::TestPwd2007
713 * 2ecaa8382e2518e4b77a52422b279467 => SUB1\NEWUSER2SAM::TestPwd2007
714 * 31dc704d3640335b2123d4ee28aa1f11 => ??? changes with NewUser2Sam => NewUser1Sam
715 * 36349f5cecd07320fb3bb0e119230c43 => ??? changes with NewUser2Sam => NewUser1Sam
716 * 12adf019d037fb535c01fd0608e78d9d => ??? changes with NewUser2Sam => NewUser1Sam
717 * 6feecf8e724906f3ee1105819c5105a1 => ??? changes with NewUser2Princ => NewUser1Princ
718 * 6c6911f3de6333422640221b9c51ff1f => ??? changes with NewUser2Princ => NewUser1Princ
719 * 4b279877e742895f9348ac67a8de2f69 => ??? changes with NewUser2Princ => NewUser1Princ
720 * db0c6bff069513e3ebb9870d29b57490 => ??? changes with NewUser2Sam => NewUser1Sam
721 * 45072621e56b1c113a4e04a8ff68cd0e => ??? changes with NewUser2Sam => NewUser1Sam
722 * 11d1220abc44a9c10cf91ef4a9c1de02 => ??? changes with NewUser2Sam => NewUser1Sam
723 *
724 * dn: CN=NewUser,OU=newtop,DC=sub1,DC=w2k3,DC=vmnet1,DC=vm,DC=base
725 * sAMAccountName: NewUser2Sam
726 *
727 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
728 * b7ec9da91062199aee7d121e6710fe23 => newuser2sam:sub1:TestPwd2007
729 * 17d290bc5c9f463fac54c37a8cea134d => NEWUSER2SAM:SUB1:TestPwd2007
730 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
731 * 5d57e7823938348127322e08cd81bcb5 => NewUser2Sam:sub1:TestPwd2007
732 * 07dd701bf8a011ece585de3d47237140 => NEWUSER2SAM:sub1:TestPwd2007
733 * e14fb0eb401498d2cb33c9aae1cc7f37 => newuser2sam:SUB1:TestPwd2007
734 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
735 * f52da1266a6bdd290ffd48b2c823dda7 => newuser2sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
736 * d2b42f171248cec37a3c5c6b55404062 => NEWUSER2SAM:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
737 * fff8d790ff6c152aaeb6ebe17b4021de => NewUser2Sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
738 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
739 * 2a7563c3715bc418d626dabef378c008 => NEWUSER2SAM:sub1.w2k3.vmnet1.vm.base:TestPwd2007
740 * c8e9557a87cd4200fda0c11d2fa03f96 => newuser2sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
741 * 8a140d30b6f0a5912735dc1e3bc993b4 => NewUser2Sam@sub1.w2k3.vmnet1.vm.base::TestPwd2007
742 * 86d95b2faae6cae4ec261e7fbaccf093 => (here w2k3 is correct) newuser2sam@sub1.w2k3.vmnet1.vm.base::TestPwd2007
743 * dfeff1493110220efcdfc6362e5f5450 => NEWUSER2SAM@SUB1.W2K3.VMNET1.VM.BASE::TestPwd2007
744 * 86db637df42513039920e605499c3af6 => SUB1\NewUser2Sam::TestPwd2007
745 * f5e43474dfaf067fee8197a253debaa2 => sub1\newuser2sam::TestPwd2007
746 * 2ecaa8382e2518e4b77a52422b279467 => SUB1\NEWUSER2SAM::TestPwd2007
747 * 31dc704d3640335b2123d4ee28aa1f11 => ???M1 changes with NewUser2Sam => NewUser1Sam
748 * 36349f5cecd07320fb3bb0e119230c43 => ???M1.L changes with newuser2sam => newuser1sam
749 * 12adf019d037fb535c01fd0608e78d9d => ???M1.U changes with NEWUSER2SAM => NEWUSER1SAM
750 * 569b4533f2d9e580211dd040e5e360a8 => ???M2 changes with NewUser2Princ => NewUser1Princ
751 * 52528bddf310a587c5d7e6a9ae2cbb20 => ???M2.L changes with newuser2princ => newuser1princ
752 * 4f629a4f0361289ca4255ab0f658fcd5 => ???M3 changes with NewUser2Princ => NewUser1Princ (doesn't depend on case of userPrincipal )
753 * db0c6bff069513e3ebb9870d29b57490 => ???M4 changes with NewUser2Sam => NewUser1Sam
754 * 45072621e56b1c113a4e04a8ff68cd0e => ???M5 changes with NewUser2Sam => NewUser1Sam (doesn't depend on case of sAMAccountName)
755 * 11d1220abc44a9c10cf91ef4a9c1de02 => ???M4.U changes with NEWUSER2SAM => NEWUSER1SAM
756 */
757
758 /*
759 * sAMAccountName, netbios_domain
760 */
761 {
762 .user = &sAMAccountName,
763 .realm = &netbios_domain,
764 },
765 {
766 .user = &sAMAccountName_l,
767 .realm = &netbios_domain_l,
768 },
769 {
770 .user = &sAMAccountName_u,
771 .realm = &netbios_domain_u,
772 },
773 {
774 .user = &sAMAccountName,
775 .realm = &netbios_domain_u,
776 },
777 {
778 .user = &sAMAccountName,
779 .realm = &netbios_domain_l,
780 },
781 {
782 .user = &sAMAccountName_u,
783 .realm = &netbios_domain_l,
784 },
785 {
786 .user = &sAMAccountName_l,
787 .realm = &netbios_domain_u,
788 },
789 /*
790 * sAMAccountName, dns_domain
791 */
792 {
793 .user = &sAMAccountName,
794 .realm = &dns_domain,
795 },
796 {
797 .user = &sAMAccountName_l,
798 .realm = &dns_domain_l,
799 },
800 {
801 .user = &sAMAccountName_u,
802 .realm = &dns_domain_u,
803 },
804 {
805 .user = &sAMAccountName,
806 .realm = &dns_domain_u,
807 },
808 {
809 .user = &sAMAccountName,
810 .realm = &dns_domain_l,
811 },
812 {
813 .user = &sAMAccountName_u,
814 .realm = &dns_domain_l,
815 },
816 {
817 .user = &sAMAccountName_l,
818 .realm = &dns_domain_u,
819 },
820 /*
821 * userPrincipalName, no realm
822 */
823 {
824 .user = &userPrincipalName,
825 },
826 {
827 /*
828 * NOTE: w2k3 messes this up, if the user has a real userPrincipalName,
829 * the fallback to the sAMAccountName based userPrincipalName is correct
830 */
831 .user = &userPrincipalName_l,
832 },
833 {
834 .user = &userPrincipalName_u,
835 },
836 /*
837 * nt4dom\sAMAccountName, no realm
838 */
839 {
840 .user = &sAMAccountName,
841 .nt4dom = &netbios_domain
842 },
843 {
844 .user = &sAMAccountName_l,
845 .nt4dom = &netbios_domain_l
846 },
847 {
848 .user = &sAMAccountName_u,
849 .nt4dom = &netbios_domain_u
850 },
851
852 /*
853 * the following ones are guessed depending on the technet2 article
854 * but not reproducable on a w2k3 server
855 */
856 /* sAMAccountName with "Digest" realm */
857 {
858 .user = &sAMAccountName,
859 .realm = &digest
860 },
861 {
862 .user = &sAMAccountName_l,
863 .realm = &digest
864 },
865 {
866 .user = &sAMAccountName_u,
867 .realm = &digest
868 },
869 /* userPrincipalName with "Digest" realm */
870 {
871 .user = &userPrincipalName,
872 .realm = &digest
873 },
874 {
875 .user = &userPrincipalName_l,
876 .realm = &digest
877 },
878 {
879 .user = &userPrincipalName_u,
880 .realm = &digest
881 },
882 /* nt4dom\\sAMAccountName with "Digest" realm */
883 {
884 .user = &sAMAccountName,
885 .nt4dom = &netbios_domain,
886 .realm = &digest
887 },
888 {
889 .user = &sAMAccountName_l,
890 .nt4dom = &netbios_domain_l,
891 .realm = &digest
892 },
893 {
894 .user = &sAMAccountName_u,
895 .nt4dom = &netbios_domain_u,
896 .realm = &digest
897 },
898 };
899
900 /* prepare DATA_BLOB's used in the combinations array */
901 sAMAccountName = data_blob_string_const(io->u.sAMAccountName);
902 sAMAccountName_l = data_blob_string_const(strlower_talloc(io->ac, io->u.sAMAccountName));
903 if (!sAMAccountName_l.data) {
904 ldb_oom(ldb);
905 return LDB_ERR_OPERATIONS_ERROR;
906 }
907 sAMAccountName_u = data_blob_string_const(strupper_talloc(io->ac, io->u.sAMAccountName));
908 if (!sAMAccountName_u.data) {
909 ldb_oom(ldb);
910 return LDB_ERR_OPERATIONS_ERROR;
911 }
912
913 /* if the user doesn't have a userPrincipalName, create one (with lower case realm) */
914 if (!user_principal_name) {
915 user_principal_name = talloc_asprintf(io->ac, "%s@%s",
916 io->u.sAMAccountName,
917 io->domain->dns_domain);
918 if (!user_principal_name) {
919 ldb_oom(ldb);
920 return LDB_ERR_OPERATIONS_ERROR;
921 }
922 }
923 userPrincipalName = data_blob_string_const(user_principal_name);
924 userPrincipalName_l = data_blob_string_const(strlower_talloc(io->ac, user_principal_name));
925 if (!userPrincipalName_l.data) {
926 ldb_oom(ldb);
927 return LDB_ERR_OPERATIONS_ERROR;
928 }
929 userPrincipalName_u = data_blob_string_const(strupper_talloc(io->ac, user_principal_name));
930 if (!userPrincipalName_u.data) {
931 ldb_oom(ldb);
932 return LDB_ERR_OPERATIONS_ERROR;
933 }
934
935 netbios_domain = data_blob_string_const(io->domain->netbios_domain);
936 netbios_domain_l = data_blob_string_const(strlower_talloc(io->ac, io->domain->netbios_domain));
937 if (!netbios_domain_l.data) {
938 ldb_oom(ldb);
939 return LDB_ERR_OPERATIONS_ERROR;
940 }
941 netbios_domain_u = data_blob_string_const(strupper_talloc(io->ac, io->domain->netbios_domain));
942 if (!netbios_domain_u.data) {
943 ldb_oom(ldb);
944 return LDB_ERR_OPERATIONS_ERROR;
945 }
946
947 dns_domain = data_blob_string_const(io->domain->dns_domain);
948 dns_domain_l = data_blob_string_const(io->domain->dns_domain);
949 dns_domain_u = data_blob_string_const(io->domain->realm);
950
951 digest = data_blob_string_const("Digest");
952
953 delim = data_blob_string_const(":");
954 backslash = data_blob_string_const("\\");
955
956 pdb->num_hashes = ARRAY_SIZE(wdigest);
957 pdb->hashes = talloc_array(io->ac, struct package_PrimaryWDigestHash, pdb->num_hashes);
958 if (!pdb->hashes) {
959 ldb_oom(ldb);
960 return LDB_ERR_OPERATIONS_ERROR;
961 }
962
963 for (i=0; i < ARRAY_SIZE(wdigest); i++) {
964 struct MD5Context md5;
965 MD5Init(&md5);
966 if (wdigest[i].nt4dom) {
967 MD5Update(&md5, wdigest[i].nt4dom->data, wdigest[i].nt4dom->length);
968 MD5Update(&md5, backslash.data, backslash.length);
969 }
970 MD5Update(&md5, wdigest[i].user->data, wdigest[i].user->length);
971 MD5Update(&md5, delim.data, delim.length);
972 if (wdigest[i].realm) {
973 MD5Update(&md5, wdigest[i].realm->data, wdigest[i].realm->length);
974 }
975 MD5Update(&md5, delim.data, delim.length);
976 MD5Update(&md5, io->n.cleartext_utf8->data, io->n.cleartext_utf8->length);
977 MD5Final(pdb->hashes[i].hash, &md5);
978 }
979
980 return LDB_SUCCESS;
981 }
982
983 static int setup_supplemental_field(struct setup_password_fields_io *io)
984 {
985 struct ldb_context *ldb;
986 struct supplementalCredentialsBlob scb;
987 struct supplementalCredentialsBlob _old_scb;
988 struct supplementalCredentialsBlob *old_scb = NULL;
989 /* Packages + (Kerberos-Newer-Keys, Kerberos, WDigest and CLEARTEXT) */
990 uint32_t num_names = 0;
991 const char *names[1+4];
992 uint32_t num_packages = 0;
993 struct supplementalCredentialsPackage packages[1+4];
994 /* Packages */
995 struct supplementalCredentialsPackage *pp = NULL;
996 struct package_PackagesBlob pb;
997 DATA_BLOB pb_blob;
998 char *pb_hexstr;
999 /* Primary:Kerberos-Newer-Keys */
1000 const char **nkn = NULL;
1001 struct supplementalCredentialsPackage *pkn = NULL;
1002 struct package_PrimaryKerberosBlob pknb;
1003 DATA_BLOB pknb_blob;
1004 char *pknb_hexstr;
1005 /* Primary:Kerberos */
1006 const char **nk = NULL;
1007 struct supplementalCredentialsPackage *pk = NULL;
1008 struct package_PrimaryKerberosBlob pkb;
1009 DATA_BLOB pkb_blob;
1010 char *pkb_hexstr;
1011 /* Primary:WDigest */
1012 const char **nd = NULL;
1013 struct supplementalCredentialsPackage *pd = NULL;
1014 struct package_PrimaryWDigestBlob pdb;
1015 DATA_BLOB pdb_blob;
1016 char *pdb_hexstr;
1017 /* Primary:CLEARTEXT */
1018 const char **nc = NULL;
1019 struct supplementalCredentialsPackage *pc = NULL;
1020 struct package_PrimaryCLEARTEXTBlob pcb;
1021 DATA_BLOB pcb_blob;
1022 char *pcb_hexstr;
1023 int ret;
1024 enum ndr_err_code ndr_err;
1025 uint8_t zero16[16];
1026 bool do_newer_keys = false;
1027 bool do_cleartext = false;
1028 int *domainFunctionality;
1029
1030 ZERO_STRUCT(zero16);
1031 ZERO_STRUCT(names);
1032
1033 ldb = ldb_module_get_ctx(io->ac->module);
1034
1035 if (!io->n.cleartext_utf8) {
1036 /*
1037 * when we don't have a cleartext password
1038 * we can't setup a supplementalCredential value
1039 */
1040 return LDB_SUCCESS;
1041 }
1042
1043 /* if there's an old supplementaCredentials blob then parse it */
1044 if (io->o.supplemental) {
1045 ndr_err = ndr_pull_struct_blob_all(io->o.supplemental, io->ac,
1046 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1047 &_old_scb,
1048 (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
1049 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1050 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1051 ldb_asprintf_errstring(ldb,
1052 "setup_supplemental_field: "
1053 "failed to pull old supplementalCredentialsBlob: %s",
1054 nt_errstr(status));
1055 return LDB_ERR_OPERATIONS_ERROR;
1056 }
1057
1058 if (_old_scb.sub.signature == SUPPLEMENTAL_CREDENTIALS_SIGNATURE) {
1059 old_scb = &_old_scb;
1060 } else {
1061 ldb_debug(ldb, LDB_DEBUG_ERROR,
1062 "setup_supplemental_field: "
1063 "supplementalCredentialsBlob signature[0x%04X] expected[0x%04X]",
1064 _old_scb.sub.signature, SUPPLEMENTAL_CREDENTIALS_SIGNATURE);
1065 }
1066 }
1067 /* Per MS-SAMR 3.1.1.8.11.6 we create AES keys if our domain functionality level is 2008 or higher */
1068 domainFunctionality = talloc_get_type(ldb_get_opaque(ldb, "domainFunctionality"), int);
1069
1070 do_newer_keys = *domainFunctionality &&
1071 (*domainFunctionality >= DS_DOMAIN_FUNCTION_2008);
1072
1073 if (io->domain->store_cleartext &&
1074 (io->u.user_account_control & UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED)) {
1075 do_cleartext = true;
1076 }
1077
1078 /*
1079 * The ordering is this
1080 *
1081 * Primary:Kerberos-Newer-Keys (optional)
1082 * Primary:Kerberos
1083 * Primary:WDigest
1084 * Primary:CLEARTEXT (optional)
1085 *
1086 * And the 'Packages' package is insert before the last
1087 * other package.
1088 */
1089 if (do_newer_keys) {
1090 /* Primary:Kerberos-Newer-Keys */
1091 nkn = &names[num_names++];
1092 pkn = &packages[num_packages++];
1093 }
1094
1095 /* Primary:Kerberos */
1096 nk = &names[num_names++];
1097 pk = &packages[num_packages++];
1098
1099 if (!do_cleartext) {
1100 /* Packages */
1101 pp = &packages[num_packages++];
1102 }
1103
1104 /* Primary:WDigest */
1105 nd = &names[num_names++];
1106 pd = &packages[num_packages++];
1107
1108 if (do_cleartext) {
1109 /* Packages */
1110 pp = &packages[num_packages++];
1111
1112 /* Primary:CLEARTEXT */
1113 nc = &names[num_names++];
1114 pc = &packages[num_packages++];
1115 }
1116
1117 if (pkn) {
1118 /*
1119 * setup 'Primary:Kerberos-Newer-Keys' element
1120 */
1121 *nkn = "Kerberos-Newer-Keys";
1122
1123 ret = setup_primary_kerberos_newer(io, old_scb, &pknb);
1124 if (ret != LDB_SUCCESS) {
1125 return ret;
1126 }
1127
1128 ndr_err = ndr_push_struct_blob(&pknb_blob, io->ac,
1129 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1130 &pknb,
1131 (ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
1132 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1133 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1134 ldb_asprintf_errstring(ldb,
1135 "setup_supplemental_field: "
1136 "failed to push package_PrimaryKerberosNeverBlob: %s",
1137 nt_errstr(status));
1138 return LDB_ERR_OPERATIONS_ERROR;
1139 }
1140 pknb_hexstr = data_blob_hex_string_upper(io->ac, &pknb_blob);
1141 if (!pknb_hexstr) {
1142 ldb_oom(ldb);
1143 return LDB_ERR_OPERATIONS_ERROR;
1144 }
1145 pkn->name = "Primary:Kerberos-Newer-Keys";
1146 pkn->reserved = 1;
1147 pkn->data = pknb_hexstr;
1148 }
1149
1150 /*
1151 * setup 'Primary:Kerberos' element
1152 */
1153 *nk = "Kerberos";
1154
1155 ret = setup_primary_kerberos(io, old_scb, &pkb);
1156 if (ret != LDB_SUCCESS) {
1157 return ret;
1158 }
1159
1160 ndr_err = ndr_push_struct_blob(&pkb_blob, io->ac,
1161 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1162 &pkb,
1163 (ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
1164 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1165 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1166 ldb_asprintf_errstring(ldb,
1167 "setup_supplemental_field: "
1168 "failed to push package_PrimaryKerberosBlob: %s",
1169 nt_errstr(status));
1170 return LDB_ERR_OPERATIONS_ERROR;
1171 }
1172 pkb_hexstr = data_blob_hex_string_upper(io->ac, &pkb_blob);
1173 if (!pkb_hexstr) {
1174 ldb_oom(ldb);
1175 return LDB_ERR_OPERATIONS_ERROR;
1176 }
1177 pk->name = "Primary:Kerberos";
1178 pk->reserved = 1;
1179 pk->data = pkb_hexstr;
1180
1181 /*
1182 * setup 'Primary:WDigest' element
1183 */
1184 *nd = "WDigest";
1185
1186 ret = setup_primary_wdigest(io, old_scb, &pdb);
1187 if (ret != LDB_SUCCESS) {
1188 return ret;
1189 }
1190
1191 ndr_err = ndr_push_struct_blob(&pdb_blob, io->ac,
1192 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1193 &pdb,
1194 (ndr_push_flags_fn_t)ndr_push_package_PrimaryWDigestBlob);
1195 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1196 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1197 ldb_asprintf_errstring(ldb,
1198 "setup_supplemental_field: "
1199 "failed to push package_PrimaryWDigestBlob: %s",
1200 nt_errstr(status));
1201 return LDB_ERR_OPERATIONS_ERROR;
1202 }
1203 pdb_hexstr = data_blob_hex_string_upper(io->ac, &pdb_blob);
1204 if (!pdb_hexstr) {
1205 ldb_oom(ldb);
1206 return LDB_ERR_OPERATIONS_ERROR;
1207 }
1208 pd->name = "Primary:WDigest";
1209 pd->reserved = 1;
1210 pd->data = pdb_hexstr;
1211
1212 /*
1213 * setup 'Primary:CLEARTEXT' element
1214 */
1215 if (pc) {
1216 *nc = "CLEARTEXT";
1217
1218 pcb.cleartext = *io->n.cleartext_utf16;
1219
1220 ndr_err = ndr_push_struct_blob(&pcb_blob, io->ac,
1221 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1222 &pcb,
1223 (ndr_push_flags_fn_t)ndr_push_package_PrimaryCLEARTEXTBlob);
1224 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1225 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1226 ldb_asprintf_errstring(ldb,
1227 "setup_supplemental_field: "
1228 "failed to push package_PrimaryCLEARTEXTBlob: %s",
1229 nt_errstr(status));
1230 return LDB_ERR_OPERATIONS_ERROR;
1231 }
1232 pcb_hexstr = data_blob_hex_string_upper(io->ac, &pcb_blob);
1233 if (!pcb_hexstr) {
1234 ldb_oom(ldb);
1235 return LDB_ERR_OPERATIONS_ERROR;
1236 }
1237 pc->name = "Primary:CLEARTEXT";
1238 pc->reserved = 1;
1239 pc->data = pcb_hexstr;
1240 }
1241
1242 /*
1243 * setup 'Packages' element
1244 */
1245 pb.names = names;
1246 ndr_err = ndr_push_struct_blob(&pb_blob, io->ac,
1247 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1248 &pb,
1249 (ndr_push_flags_fn_t)ndr_push_package_PackagesBlob);
1250 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1251 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1252 ldb_asprintf_errstring(ldb,
1253 "setup_supplemental_field: "
1254 "failed to push package_PackagesBlob: %s",
1255 nt_errstr(status));
1256 return LDB_ERR_OPERATIONS_ERROR;
1257 }
1258 pb_hexstr = data_blob_hex_string_upper(io->ac, &pb_blob);
1259 if (!pb_hexstr) {
1260 ldb_oom(ldb);
1261 return LDB_ERR_OPERATIONS_ERROR;
1262 }
1263 pp->name = "Packages";
1264 pp->reserved = 2;
1265 pp->data = pb_hexstr;
1266
1267 /*
1268 * setup 'supplementalCredentials' value
1269 */
1270 ZERO_STRUCT(scb);
1271 scb.sub.num_packages = num_packages;
1272 scb.sub.packages = packages;
1273
1274 ndr_err = ndr_push_struct_blob(&io->g.supplemental, io->ac,
1275 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1276 &scb,
1277 (ndr_push_flags_fn_t)ndr_push_supplementalCredentialsBlob);
1278 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1279 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1280 ldb_asprintf_errstring(ldb,
1281 "setup_supplemental_field: "
1282 "failed to push supplementalCredentialsBlob: %s",
1283 nt_errstr(status));
1284 return LDB_ERR_OPERATIONS_ERROR;
1285 }
1286
1287 return LDB_SUCCESS;
1288 }
1289
1290 static int setup_last_set_field(struct setup_password_fields_io *io)
1291 {
1292 /* set it as now */
1293 unix_to_nt_time(&io->g.last_set, time(NULL));
1294
1295 return LDB_SUCCESS;
1296 }
1297
1298 static int setup_kvno_field(struct setup_password_fields_io *io)
1299 {
1300 /* increment by one */
1301 io->g.kvno = io->o.kvno + 1;
1302
1303 return LDB_SUCCESS;
1304 }
1305
1306 static int setup_password_fields(struct setup_password_fields_io *io)
1307 {
1308 struct ldb_context *ldb;
1309 bool ok;
1310 int ret;
1311 size_t converted_pw_len;
1312
1313 ldb = ldb_module_get_ctx(io->ac->module);
1314
1315 /*
1316 * refuse the change if someone want to change the cleartext
1317 * and supply his own hashes at the same time...
1318 */
1319 if ((io->n.cleartext_utf8 || io->n.cleartext_utf16) && (io->n.nt_hash || io->n.lm_hash)) {
1320 ldb_asprintf_errstring(ldb,
1321 "setup_password_fields: "
1322 "it's only allowed to set the cleartext password or the password hashes");
1323 return LDB_ERR_UNWILLING_TO_PERFORM;
1324 }
1325
1326 if (io->n.cleartext_utf8 && io->n.cleartext_utf16) {
1327 ldb_asprintf_errstring(ldb,
1328 "setup_password_fields: "
1329 "it's only allowed to set the cleartext password as userPassword or clearTextPasssword, not both at once");
1330 return LDB_ERR_UNWILLING_TO_PERFORM;
1331 }
1332
1333 if (io->n.cleartext_utf8) {
1334 char **cleartext_utf16_str;
1335 struct ldb_val *cleartext_utf16_blob;
1336 io->n.cleartext_utf16 = cleartext_utf16_blob = talloc(io->ac, struct ldb_val);
1337 if (!io->n.cleartext_utf16) {
1338 ldb_oom(ldb);
1339 return LDB_ERR_OPERATIONS_ERROR;
1340 }
1341 if (!convert_string_talloc_convenience(io->ac, lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1342 CH_UTF8, CH_UTF16, io->n.cleartext_utf8->data, io->n.cleartext_utf8->length,
1343 (void **)&cleartext_utf16_str, &converted_pw_len, false)) {
1344 ldb_asprintf_errstring(ldb,
1345 "setup_password_fields: "
1346 "failed to generate UTF16 password from cleartext UTF8 password");
1347 return LDB_ERR_OPERATIONS_ERROR;
1348 }
1349 *cleartext_utf16_blob = data_blob_const(cleartext_utf16_str, converted_pw_len);
1350 } else if (io->n.cleartext_utf16) {
1351 char *cleartext_utf8_str;
1352 struct ldb_val *cleartext_utf8_blob;
1353 io->n.cleartext_utf8 = cleartext_utf8_blob = talloc(io->ac, struct ldb_val);
1354 if (!io->n.cleartext_utf8) {
1355 ldb_oom(ldb);
1356 return LDB_ERR_OPERATIONS_ERROR;
1357 }
1358 if (!convert_string_talloc_convenience(io->ac, lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1359 CH_UTF16MUNGED, CH_UTF8, io->n.cleartext_utf16->data, io->n.cleartext_utf16->length,
1360 (void **)&cleartext_utf8_str, &converted_pw_len, false)) {
1361 /* We can't bail out entirely, as these unconvertable passwords are frustratingly valid */
1362 io->n.cleartext_utf8 = NULL;
1363 talloc_free(cleartext_utf8_blob);
1364 }
1365 *cleartext_utf8_blob = data_blob_const(cleartext_utf8_str, converted_pw_len);
1366 }
1367 if (io->n.cleartext_utf16) {
1368 struct samr_Password *nt_hash;
1369 nt_hash = talloc(io->ac, struct samr_Password);
1370 if (!nt_hash) {
1371 ldb_oom(ldb);
1372 return LDB_ERR_OPERATIONS_ERROR;
1373 }
1374 io->n.nt_hash = nt_hash;
1375
1376 /* compute the new nt hash */
1377 mdfour(nt_hash->hash, io->n.cleartext_utf16->data, io->n.cleartext_utf16->length);
1378 }
1379
1380 if (io->n.cleartext_utf8) {
1381 struct samr_Password *lm_hash;
1382 char *cleartext_unix;
1383 if (lp_lanman_auth(ldb_get_opaque(ldb, "loadparm")) &&
1384 convert_string_talloc_convenience(io->ac, lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1385 CH_UTF8, CH_UNIX, io->n.cleartext_utf8->data, io->n.cleartext_utf8->length,
1386 (void **)&cleartext_unix, &converted_pw_len, false)) {
1387 lm_hash = talloc(io->ac, struct samr_Password);
1388 if (!lm_hash) {
1389 ldb_oom(ldb);
1390 return LDB_ERR_OPERATIONS_ERROR;
1391 }
1392
1393 /* compute the new lm hash. */
1394 ok = E_deshash((char *)cleartext_unix, lm_hash->hash);
1395 if (ok) {
1396 io->n.lm_hash = lm_hash;
1397 } else {
1398 talloc_free(lm_hash->hash);
1399 }
1400 }
1401
1402 ret = setup_kerberos_keys(io);
1403 if (ret != LDB_SUCCESS) {
1404 return ret;
1405 }
1406 }
1407
1408 ret = setup_nt_fields(io);
1409 if (ret != LDB_SUCCESS) {
1410 return ret;
1411 }
1412
1413 ret = setup_lm_fields(io);
1414 if (ret != LDB_SUCCESS) {
1415 return ret;
1416 }
1417
1418 ret = setup_supplemental_field(io);
1419 if (ret != LDB_SUCCESS) {
1420 return ret;
1421 }
1422
1423 ret = setup_last_set_field(io);
1424 if (ret != LDB_SUCCESS) {
1425 return ret;
1426 }
1427
1428 ret = setup_kvno_field(io);
1429 if (ret != LDB_SUCCESS) {
1430 return ret;
1431 }
1432
1433 return LDB_SUCCESS;
1434 }
1435
1436 static int setup_io(struct ph_context *ac,
1437 const struct ldb_message *new_msg,
1438 const struct ldb_message *searched_msg,
1439 struct setup_password_fields_io *io)
1440 {
1441 const struct ldb_val *quoted_utf16;
1442 struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
1443
1444 ZERO_STRUCTP(io);
1445
1446 /* Some operations below require kerberos contexts */
1447 if (smb_krb5_init_context(ac,
1448 ldb_get_event_context(ldb),
1449 (struct loadparm_context *)ldb_get_opaque(ldb, "loadparm"),
1450 &io->smb_krb5_context) != 0) {
1451 return LDB_ERR_OPERATIONS_ERROR;
1452 }
1453
1454 io->ac = ac;
1455 io->domain = ac->domain;
1456
1457 io->u.user_account_control = samdb_result_uint(searched_msg, "userAccountControl", 0);
1458 io->u.sAMAccountName = samdb_result_string(searched_msg, "samAccountName", NULL);
1459 io->u.user_principal_name = samdb_result_string(searched_msg, "userPrincipalName", NULL);
1460 io->u.is_computer = ldb_msg_check_string_attribute(searched_msg, "objectClass", "computer");
1461
1462 io->n.cleartext_utf8 = ldb_msg_find_ldb_val(new_msg, "userPassword");
1463 io->n.cleartext_utf16 = ldb_msg_find_ldb_val(new_msg, "clearTextPassword");
1464
1465 /* this rather strange looking piece of code is there to
1466 handle a ldap client setting a password remotely using the
1467 unicodePwd ldap field. The syntax is that the password is
1468 in UTF-16LE, with a " at either end. Unfortunately the
1469 unicodePwd field is also used to store the nt hashes
1470 internally in Samba, and is used in the nt hash format on
1471 the wire in DRS replication, so we have a single name for
1472 two distinct values. The code below leaves us with a small
1473 chance (less than 1 in 2^32) of a mixup, if someone manages
1474 to create a MD4 hash which starts and ends in 0x22 0x00, as
1475 that would then be treated as a UTF16 password rather than
1476 a nthash */
1477 quoted_utf16 = ldb_msg_find_ldb_val(new_msg, "unicodePwd");
1478 if (quoted_utf16 &&
1479 quoted_utf16->length >= 4 &&
1480 quoted_utf16->data[0] == '"' &&
1481 quoted_utf16->data[1] == 0 &&
1482 quoted_utf16->data[quoted_utf16->length-2] == '"' &&
1483 quoted_utf16->data[quoted_utf16->length-1] == 0) {
1484 io->n.quoted_utf16.data = talloc_memdup(io->ac, quoted_utf16->data+2, quoted_utf16->length-4);
1485 io->n.quoted_utf16.length = quoted_utf16->length-4;
1486 io->n.cleartext_utf16 = &io->n.quoted_utf16;
1487 io->n.nt_hash = NULL;
1488 } else {
1489 io->n.nt_hash = samdb_result_hash(io->ac, new_msg, "unicodePwd");
1490 }
1491
1492 io->n.lm_hash = samdb_result_hash(io->ac, new_msg, "dBCSPwd");
1493
1494 return LDB_SUCCESS;
1495 }
1496
1497 static struct ph_context *ph_init_context(struct ldb_module *module,
1498 struct ldb_request *req)
1499 {
1500 struct ldb_context *ldb;
1501 struct ph_context *ac;
1502
1503 ldb = ldb_module_get_ctx(module);
1504
1505 ac = talloc_zero(req, struct ph_context);
1506 if (ac == NULL) {
1507 ldb_set_errstring(ldb, "Out of Memory");
1508 return NULL;
1509 }
1510
1511 ac->module = module;
1512 ac->req = req;
1513
1514 return ac;
1515 }
1516
1517 static int ph_op_callback(struct ldb_request *req, struct ldb_reply *ares)
1518 {
1519 struct ph_context *ac;
1520
1521 ac = talloc_get_type(req->context, struct ph_context);
1522
1523 if (!ares) {
1524 return ldb_module_done(ac->req, NULL, NULL,
1525 LDB_ERR_OPERATIONS_ERROR);
1526 }
1527 if (ares->error != LDB_SUCCESS) {
1528 return ldb_module_done(ac->req, ares->controls,
1529 ares->response, ares->error);
1530 }
1531
1532 if (ares->type != LDB_REPLY_DONE) {
1533 talloc_free(ares);
1534 return ldb_module_done(ac->req, NULL, NULL,
1535 LDB_ERR_OPERATIONS_ERROR);
1536 }
1537
1538 return ldb_module_done(ac->req, ares->controls,
1539 ares->response, ares->error);
1540 }
1541
1542 static int password_hash_add_do_add(struct ph_context *ac);
1543 static int ph_modify_callback(struct ldb_request *req, struct ldb_reply *ares);
1544 static int password_hash_mod_search_self(struct ph_context *ac);
1545 static int ph_mod_search_callback(struct ldb_request *req, struct ldb_reply *ares);
1546 static int password_hash_mod_do_mod(struct ph_context *ac);
1547
1548 static int get_domain_data_callback(struct ldb_request *req,
1549 struct ldb_reply *ares)
1550 {
1551 struct ldb_context *ldb;
1552 struct domain_data *data;
1553 struct ph_context *ac;
1554 struct loadparm_context *lp_ctx;
1555 int ret;
1556
1557 ac = talloc_get_type(req->context, struct ph_context);
1558 ldb = ldb_module_get_ctx(ac->module);
1559
1560 if (!ares) {
1561 return ldb_module_done(ac->req, NULL, NULL,
1562 LDB_ERR_OPERATIONS_ERROR);
1563 }
1564 if (ares->error != LDB_SUCCESS) {
1565 return ldb_module_done(ac->req, ares->controls,
1566 ares->response, ares->error);
1567 }
1568
1569 switch (ares->type) {
1570 case LDB_REPLY_ENTRY:
1571 if (ac->domain != NULL) {
1572 ldb_set_errstring(ldb, "Too many results");
1573 return ldb_module_done(ac->req, NULL, NULL,
1574 LDB_ERR_OPERATIONS_ERROR);
1575 }
1576
1577 data = talloc_zero(ac, struct domain_data);
1578 if (data == NULL) {
1579 return ldb_module_done(ac->req, NULL, NULL,
1580 LDB_ERR_OPERATIONS_ERROR);
1581 }
1582
1583 data->pwdProperties = samdb_result_uint(ares->message, "pwdProperties", 0);
1584 data->store_cleartext = data->pwdProperties & DOMAIN_PASSWORD_STORE_CLEARTEXT;
1585 data->pwdHistoryLength = samdb_result_uint(ares->message, "pwdHistoryLength", 0);
1586
1587 /* For a domain DN, this puts things in dotted notation */
1588 /* For builtin domains, this will give details for the host,
1589 * but that doesn't really matter, as it's just used for salt
1590 * and kerberos principals, which don't exist here */
1591
1592 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
1593 struct loadparm_context);
1594
1595 data->dns_domain = lp_dnsdomain(lp_ctx);
1596 data->realm = lp_realm(lp_ctx);
1597 data->netbios_domain = lp_sam_name(lp_ctx);
1598
1599 ac->domain = data;
1600 break;
1601
1602 case LDB_REPLY_DONE:
1603
1604 /* call the next step */
1605 switch (ac->req->operation) {
1606 case LDB_ADD:
1607 ret = password_hash_add_do_add(ac);
1608 break;
1609
1610 case LDB_MODIFY:
1611 ret = password_hash_mod_do_mod(ac);
1612 break;
1613
1614 default:
1615 ret = LDB_ERR_OPERATIONS_ERROR;
1616 break;
1617 }
1618 if (ret != LDB_SUCCESS) {
1619 return ldb_module_done(ac->req, NULL, NULL, ret);
1620 }
1621 break;
1622
1623 case LDB_REPLY_REFERRAL:
1624 /* ignore */
1625 break;
1626 }
1627
1628 talloc_free(ares);
1629 return LDB_SUCCESS;
1630 }
1631
1632 static int build_domain_data_request(struct ph_context *ac)
1633 {
1634 /* attrs[] is returned from this function in
1635 ac->dom_req->op.search.attrs, so it must be static, as
1636 otherwise the compiler can put it on the stack */
1637 struct ldb_context *ldb;
1638 static const char * const attrs[] = { "pwdProperties", "pwdHistoryLength", NULL };
1639
1640 ldb = ldb_module_get_ctx(ac->module);
1641
1642 return ldb_build_search_req(&ac->dom_req, ldb, ac,
1643 ldb_get_default_basedn(ldb),
1644 LDB_SCOPE_BASE,
1645 NULL, attrs,
1646 NULL,
1647 ac, get_domain_data_callback,
1648 ac->req);
1649 }
1650
1651 static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
1652 {
1653 struct ldb_context *ldb;
1654 struct ph_context *ac;
1655 struct ldb_message_element *sambaAttr;
1656 struct ldb_message_element *clearTextPasswordAttr;
1657 struct ldb_message_element *ntAttr;
1658 struct ldb_message_element *lmAttr;
1659 int ret;
1660
1661 ldb = ldb_module_get_ctx(module);
1662
1663 ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_add\n");
1664
1665 if (ldb_dn_is_special(req->op.add.message->dn)) { /* do not manipulate our control entries */
1666 return ldb_next_request(module, req);
1667 }
1668
1669 /* If the caller is manipulating the local passwords directly, let them pass */
1670 if (ldb_dn_compare_base(ldb_dn_new(req, ldb, LOCAL_BASE),
1671 req->op.add.message->dn) == 0) {
1672 return ldb_next_request(module, req);
1673 }
1674
1675 /* nobody must touch these fields */
1676 if (ldb_msg_find_element(req->op.add.message, "ntPwdHistory")) {
1677 return LDB_ERR_UNWILLING_TO_PERFORM;
1678 }
1679 if (ldb_msg_find_element(req->op.add.message, "lmPwdHistory")) {
1680 return LDB_ERR_UNWILLING_TO_PERFORM;
1681 }
1682 if (ldb_msg_find_element(req->op.add.message, "supplementalCredentials")) {
1683 return LDB_ERR_UNWILLING_TO_PERFORM;
1684 }
1685
1686 /* If no part of this ADD touches the userPassword, or the NT
1687 * or LM hashes, then we don't need to make any changes. */
1688
1689 sambaAttr = ldb_msg_find_element(req->op.mod.message, "userPassword");
1690 clearTextPasswordAttr = ldb_msg_find_element(req->op.mod.message, "clearTextPassword");
1691 ntAttr = ldb_msg_find_element(req->op.mod.message, "unicodePwd");
1692 lmAttr = ldb_msg_find_element(req->op.mod.message, "dBCSPwd");
1693
1694 if ((!sambaAttr) && (!clearTextPasswordAttr) && (!ntAttr) && (!lmAttr)) {
1695 return ldb_next_request(module, req);
1696 }
1697
1698 /* if it is not an entry of type person its an error */
1699 /* TODO: remove this when userPassword will be in schema */
1700 if (!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "person")) {
1701 ldb_set_errstring(ldb, "Cannot set a password on entry that does not have objectClass 'person'");
1702 return LDB_ERR_OBJECT_CLASS_VIOLATION;
1703 }
1704
1705 /* check userPassword is single valued here */
1706 /* TODO: remove this when userPassword will be single valued in schema */
1707 if (sambaAttr && sambaAttr->num_values > 1) {
1708 ldb_set_errstring(ldb, "mupltiple values for userPassword not allowed!\n");
1709 return LDB_ERR_CONSTRAINT_VIOLATION;
1710 }
1711 if (clearTextPasswordAttr && clearTextPasswordAttr->num_values > 1) {
1712 ldb_set_errstring(ldb, "mupltiple values for clearTextPassword not allowed!\n");
1713 return LDB_ERR_CONSTRAINT_VIOLATION;
1714 }
1715
1716 if (ntAttr && (ntAttr->num_values > 1)) {
1717 ldb_set_errstring(ldb, "mupltiple values for unicodePwd not allowed!\n");
1718 return LDB_ERR_CONSTRAINT_VIOLATION;
1719 }
1720 if (lmAttr && (lmAttr->num_values > 1)) {
1721 ldb_set_errstring(ldb, "mupltiple values for dBCSPwd not allowed!\n");
1722 return LDB_ERR_CONSTRAINT_VIOLATION;
1723 }
1724
1725 if (sambaAttr && sambaAttr->num_values == 0) {
1726 ldb_set_errstring(ldb, "userPassword must have a value!\n");
1727 return LDB_ERR_CONSTRAINT_VIOLATION;
1728 }
1729
1730 if (clearTextPasswordAttr && clearTextPasswordAttr->num_values == 0) {
1731 ldb_set_errstring(ldb, "clearTextPassword must have a value!\n");
1732 return LDB_ERR_CONSTRAINT_VIOLATION;
1733 }
1734
1735 if (ntAttr && (ntAttr->num_values == 0)) {
1736 ldb_set_errstring(ldb, "unicodePwd must have a value!\n");
1737 return LDB_ERR_CONSTRAINT_VIOLATION;
1738 }
1739 if (lmAttr && (lmAttr->num_values == 0)) {
1740 ldb_set_errstring(ldb, "dBCSPwd must have a value!\n");
1741 return LDB_ERR_CONSTRAINT_VIOLATION;
1742 }
1743
1744 ac = ph_init_context(module, req);
1745 if (ac == NULL) {
1746 return LDB_ERR_OPERATIONS_ERROR;
1747 }
1748
1749 /* get user domain data */
1750 ret = build_domain_data_request(ac);
1751 if (ret != LDB_SUCCESS) {
1752 return ret;
1753 }
1754
1755 return ldb_next_request(module, ac->dom_req);
1756 }
1757
1758 static int password_hash_add_do_add(struct ph_context *ac)
1759 {
1760 struct ldb_context *ldb;
1761 struct ldb_request *down_req;
1762 struct ldb_message *msg;
1763 struct setup_password_fields_io io;
1764 int ret;
1765
1766 /* Prepare the internal data structure containing the passwords */
1767 ret = setup_io(ac, ac->req->op.add.message, ac->req->op.add.message, &io);
1768 if (ret != LDB_SUCCESS) {
1769 return ret;
1770 }
1771
1772 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
1773 if (msg == NULL) {
1774 return LDB_ERR_OPERATIONS_ERROR;
1775 }
1776
1777 /* remove attributes that we just read into 'io' */
1778 ldb_msg_remove_attr(msg, "userPassword");
1779 ldb_msg_remove_attr(msg, "clearTextPassword");
1780 ldb_msg_remove_attr(msg, "unicodePwd");
1781 ldb_msg_remove_attr(msg, "dBCSPwd");
1782 ldb_msg_remove_attr(msg, "pwdLastSet");
1783 io.o.kvno = samdb_result_uint(msg, "msDs-KeyVersionNumber", 1) - 1;
1784 ldb_msg_remove_attr(msg, "msDs-KeyVersionNumber");
1785
1786 ldb = ldb_module_get_ctx(ac->module);
1787
1788 ret = setup_password_fields(&io);
1789 if (ret != LDB_SUCCESS) {
1790 return ret;
1791 }
1792
1793 if (io.g.nt_hash) {
1794 ret = samdb_msg_add_hash(ldb, ac, msg,
1795 "unicodePwd", io.g.nt_hash);
1796 if (ret != LDB_SUCCESS) {
1797 return ret;
1798 }
1799 }
1800 if (io.g.lm_hash) {
1801 ret = samdb_msg_add_hash(ldb, ac, msg,
1802 "dBCSPwd", io.g.lm_hash);
1803 if (ret != LDB_SUCCESS) {
1804 return ret;
1805 }
1806 }
1807 if (io.g.nt_history_len > 0) {
1808 ret = samdb_msg_add_hashes(ac, msg,
1809 "ntPwdHistory",
1810 io.g.nt_history,
1811 io.g.nt_history_len);
1812 if (ret != LDB_SUCCESS) {
1813 return ret;
1814 }
1815 }
1816 if (io.g.lm_history_len > 0) {
1817 ret = samdb_msg_add_hashes(ac, msg,
1818 "lmPwdHistory",
1819 io.g.lm_history,
1820 io.g.lm_history_len);
1821 if (ret != LDB_SUCCESS) {
1822 return ret;
1823 }
1824 }
1825 if (io.g.supplemental.length > 0) {
1826 ret = ldb_msg_add_value(msg, "supplementalCredentials",
1827 &io.g.supplemental, NULL);
1828 if (ret != LDB_SUCCESS) {
1829 return ret;
1830 }
1831 }
1832 ret = samdb_msg_add_uint64(ldb, ac, msg,
1833 "pwdLastSet",
1834 io.g.last_set);
1835 if (ret != LDB_SUCCESS) {
1836 return ret;
1837 }
1838 ret = samdb_msg_add_uint(ldb, ac, msg,
1839 "msDs-KeyVersionNumber",
1840 io.g.kvno);
1841 if (ret != LDB_SUCCESS) {
1842 return ret;
1843 }
1844
1845 ret = ldb_build_add_req(&down_req, ldb, ac,
1846 msg,
1847 ac->req->controls,
1848 ac, ph_op_callback,
1849 ac->req);
1850 if (ret != LDB_SUCCESS) {
1851 return ret;
1852 }
1853
1854 return ldb_next_request(ac->module, down_req);
1855 }
1856
1857 static int password_hash_modify(struct ldb_module *module, struct ldb_request *req)
1858 {
1859 struct ldb_context *ldb;
1860 struct ph_context *ac;
1861 struct ldb_message_element *sambaAttr;
1862 struct ldb_message_element *clearTextAttr;
1863 struct ldb_message_element *ntAttr;
1864 struct ldb_message_element *lmAttr;
1865 struct ldb_message *msg;
1866 struct ldb_request *down_req;
1867 int ret;
1868
1869 ldb = ldb_module_get_ctx(module);
1870
1871 ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_modify\n");
1872
1873 if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
1874 return ldb_next_request(module, req);
1875 }
1876
1877 /* If the caller is manipulating the local passwords directly, let them pass */
1878 if (ldb_dn_compare_base(ldb_dn_new(req, ldb, LOCAL_BASE),
1879 req->op.mod.message->dn) == 0) {
1880 return ldb_next_request(module, req);
1881 }
1882
1883 /* nobody must touch password Histories */
1884 if (ldb_msg_find_element(req->op.add.message, "ntPwdHistory")) {
1885 return LDB_ERR_UNWILLING_TO_PERFORM;
1886 }
1887 if (ldb_msg_find_element(req->op.add.message, "lmPwdHistory")) {
1888 return LDB_ERR_UNWILLING_TO_PERFORM;
1889 }
1890 if (ldb_msg_find_element(req->op.add.message, "supplementalCredentials")) {
1891 return LDB_ERR_UNWILLING_TO_PERFORM;
1892 }
1893
1894 sambaAttr = ldb_msg_find_element(req->op.mod.message, "userPassword");
1895 clearTextAttr = ldb_msg_find_element(req->op.mod.message, "clearTextPassword");
1896 ntAttr = ldb_msg_find_element(req->op.mod.message, "unicodePwd");
1897 lmAttr = ldb_msg_find_element(req->op.mod.message, "dBCSPwd");
1898
1899 /* If no part of this touches the userPassword OR
1900 * clearTextPassword OR unicodePwd and/or dBCSPwd, then we
1901 * don't need to make any changes. For password changes/set
1902 * there should be a 'delete' or a 'modify' on this
1903 * attribute. */
1904 if ((!sambaAttr) && (!clearTextAttr) && (!ntAttr) && (!lmAttr)) {
1905 return ldb_next_request(module, req);
1906 }
1907
1908 /* check passwords are single valued here */
1909 /* TODO: remove this when passwords will be single valued in schema */
1910 if (sambaAttr && (sambaAttr->num_values > 1)) {
1911 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
1912 return LDB_ERR_CONSTRAINT_VIOLATION;
1913 }
1914 if (clearTextAttr && (clearTextAttr->num_values > 1)) {
1915 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
1916 return LDB_ERR_CONSTRAINT_VIOLATION;
1917 }
1918 if (ntAttr && (ntAttr->num_values > 1)) {
1919 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
1920 return LDB_ERR_CONSTRAINT_VIOLATION;
1921 }
1922 if (lmAttr && (lmAttr->num_values > 1)) {
1923 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
1924 return LDB_ERR_CONSTRAINT_VIOLATION;
1925 }
1926
1927 ac = ph_init_context(module, req);
1928 if (!ac) {
1929 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
1930 return LDB_ERR_OPERATIONS_ERROR;
1931 }
1932
1933 /* use a new message structure so that we can modify it */
1934 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
1935 if (msg == NULL) {
1936 ldb_oom(ldb);
1937 return LDB_ERR_OPERATIONS_ERROR;
1938 }
1939
1940 /* - remove any modification to the password from the first commit
1941 * we will make the real modification later */
1942 if (sambaAttr) ldb_msg_remove_attr(msg, "userPassword");
1943 if (clearTextAttr) ldb_msg_remove_attr(msg, "clearTextPassword");
1944 if (ntAttr) ldb_msg_remove_attr(msg, "unicodePwd");
1945 if (lmAttr) ldb_msg_remove_attr(msg, "dBCSPwd");
1946
1947 /* if there was nothing else to be modified skip to next step */
1948 if (msg->num_elements == 0) {
1949 return password_hash_mod_search_self(ac);
1950 }
1951
1952 ret = ldb_build_mod_req(&down_req, ldb, ac,
1953 msg,
1954 req->controls,
1955 ac, ph_modify_callback,
1956 req);
1957 if (ret != LDB_SUCCESS) {
1958 return ret;
1959 }
1960
1961 return ldb_next_request(module, down_req);
1962 }
1963
1964 static int ph_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
1965 {
1966 struct ph_context *ac;
1967 int ret;
1968
1969 ac = talloc_get_type(req->context, struct ph_context);
1970
1971 if (!ares) {
1972 return ldb_module_done(ac->req, NULL, NULL,
1973 LDB_ERR_OPERATIONS_ERROR);
1974 }
1975 if (ares->error != LDB_SUCCESS) {
1976 return ldb_module_done(ac->req, ares->controls,
1977 ares->response, ares->error);
1978 }
1979
1980 if (ares->type != LDB_REPLY_DONE) {
1981 talloc_free(ares);
1982 return ldb_module_done(ac->req, NULL, NULL,
1983 LDB_ERR_OPERATIONS_ERROR);
1984 }
1985
1986 ret = password_hash_mod_search_self(ac);
1987 if (ret != LDB_SUCCESS) {
1988 return ldb_module_done(ac->req, NULL, NULL, ret);
1989 }
1990
1991 talloc_free(ares);
1992 return LDB_SUCCESS;
1993 }
1994
1995 static int ph_mod_search_callback(struct ldb_request *req, struct ldb_reply *ares)
1996 {
1997 struct ldb_context *ldb;
1998 struct ph_context *ac;
1999 int ret;
2000
2001 ac = talloc_get_type(req->context, struct ph_context);
2002 ldb = ldb_module_get_ctx(ac->module);
2003
2004 if (!ares) {
2005 return ldb_module_done(ac->req, NULL, NULL,
2006 LDB_ERR_OPERATIONS_ERROR);
2007 }
2008 if (ares->error != LDB_SUCCESS) {
2009 return ldb_module_done(ac->req, ares->controls,
2010 ares->response, ares->error);
2011 }
2012
2013 /* we are interested only in the single reply (base search) */
2014 switch (ares->type) {
2015 case LDB_REPLY_ENTRY:
2016
2017 if (ac->search_res != NULL) {
2018 ldb_set_errstring(ldb, "Too many results");
2019 talloc_free(ares);
2020 return ldb_module_done(ac->req, NULL, NULL,
2021 LDB_ERR_OPERATIONS_ERROR);
2022 }
2023
2024 /* if it is not an entry of type person this is an error */
2025 /* TODO: remove this when sambaPassword will be in schema */
2026 if (!ldb_msg_check_string_attribute(ares->message, "objectClass", "person")) {
2027 ldb_set_errstring(ldb, "Object class violation");
2028 talloc_free(ares);
2029 return ldb_module_done(ac->req, NULL, NULL,
2030 LDB_ERR_OBJECT_CLASS_VIOLATION);
2031 }
2032
2033 ac->search_res = talloc_steal(ac, ares);
2034 return LDB_SUCCESS;
2035
2036 case LDB_REPLY_DONE:
2037
2038 /* get user domain data */
2039 ret = build_domain_data_request(ac);
2040 if (ret != LDB_SUCCESS) {
2041 return ldb_module_done(ac->req, NULL, NULL,ret);
2042 }
2043
2044 return ldb_next_request(ac->module, ac->dom_req);
2045
2046 case LDB_REPLY_REFERRAL:
2047 /*ignore anything else for now */
2048 break;
2049 }
2050
2051 talloc_free(ares);
2052 return LDB_SUCCESS;
2053 }
2054
2055 static int password_hash_mod_search_self(struct ph_context *ac)
2056 {
2057 struct ldb_context *ldb;
2058 static const char * const attrs[] = { "userAccountControl", "lmPwdHistory",
2059 "ntPwdHistory",
2060 "objectSid", "msDS-KeyVersionNumber",
2061 "objectClass", "userPrincipalName",
2062 "sAMAccountName",
2063 "dBCSPwd", "unicodePwd",
2064 "supplementalCredentials",
2065 NULL };
2066 struct ldb_request *search_req;
2067 int ret;
2068
2069 ldb = ldb_module_get_ctx(ac->module);
2070
2071 ret = ldb_build_search_req(&search_req, ldb, ac,
2072 ac->req->op.mod.message->dn,
2073 LDB_SCOPE_BASE,
2074 "(objectclass=*)",
2075 attrs,
2076 NULL,
2077 ac, ph_mod_search_callback,
2078 ac->req);
2079
2080 if (ret != LDB_SUCCESS) {
2081 return ret;
2082 }
2083
2084 return ldb_next_request(ac->module, search_req);
2085 }
2086
2087 static int password_hash_mod_do_mod(struct ph_context *ac)
2088 {
2089 struct ldb_context *ldb;
2090 struct ldb_request *mod_req;
2091 struct ldb_message *msg;
2092 const struct ldb_message *searched_msg;
2093 struct setup_password_fields_io io;
2094 int ret;
2095
2096 ldb = ldb_module_get_ctx(ac->module);
2097
2098 /* use a new message structure so that we can modify it */
2099 msg = ldb_msg_new(ac);
2100 if (msg == NULL) {
2101 return LDB_ERR_OPERATIONS_ERROR;
2102 }
2103
2104 /* modify dn */
2105 msg->dn = ac->req->op.mod.message->dn;
2106
2107 /* Prepare the internal data structure containing the passwords */
2108 ret = setup_io(ac,
2109 ac->req->op.mod.message,
2110 ac->search_res->message,
2111 &io);
2112 if (ret != LDB_SUCCESS) {
2113 return ret;
2114 }
2115
2116 searched_msg = ac->search_res->message;
2117
2118 /* Fill in some final details (only relevent once the password has been set) */
2119 io.o.kvno = samdb_result_uint(searched_msg, "msDs-KeyVersionNumber", 0);
2120 io.o.nt_history_len = samdb_result_hashes(io.ac, searched_msg, "ntPwdHistory", &io.o.nt_history);
2121 io.o.lm_history_len = samdb_result_hashes(io.ac, searched_msg, "lmPwdHistory", &io.o.lm_history);
2122 io.o.supplemental = ldb_msg_find_ldb_val(searched_msg, "supplementalCredentials");
2123
2124 ret = setup_password_fields(&io);
2125 if (ret != LDB_SUCCESS) {
2126 return ret;
2127 }
2128
2129 /* make sure we replace all the old attributes */
2130 ret = ldb_msg_add_empty(msg, "unicodePwd", LDB_FLAG_MOD_REPLACE, NULL);
2131 ret = ldb_msg_add_empty(msg, "dBCSPwd", LDB_FLAG_MOD_REPLACE, NULL);
2132 ret = ldb_msg_add_empty(msg, "ntPwdHistory", LDB_FLAG_MOD_REPLACE, NULL);
2133 ret = ldb_msg_add_empty(msg, "lmPwdHistory", LDB_FLAG_MOD_REPLACE, NULL);
2134 ret = ldb_msg_add_empty(msg, "supplementalCredentials", LDB_FLAG_MOD_REPLACE, NULL);
2135 ret = ldb_msg_add_empty(msg, "pwdLastSet", LDB_FLAG_MOD_REPLACE, NULL);
2136 ret = ldb_msg_add_empty(msg, "msDs-KeyVersionNumber", LDB_FLAG_MOD_REPLACE, NULL);
2137
2138 if (io.g.nt_hash) {
2139 ret = samdb_msg_add_hash(ldb, ac, msg,
2140 "unicodePwd", io.g.nt_hash);
2141 if (ret != LDB_SUCCESS) {
2142 return ret;
2143 }
2144 }
2145 if (io.g.lm_hash) {
2146 ret = samdb_msg_add_hash(ldb, ac, msg,
2147 "dBCSPwd", io.g.lm_hash);
2148 if (ret != LDB_SUCCESS) {
2149 return ret;
2150 }
2151 }
2152 if (io.g.nt_history_len > 0) {
2153 ret = samdb_msg_add_hashes(ac, msg,
2154 "ntPwdHistory",
2155 io.g.nt_history,
2156 io.g.nt_history_len);
2157 if (ret != LDB_SUCCESS) {
2158 return ret;
2159 }
2160 }
2161 if (io.g.lm_history_len > 0) {
2162 ret = samdb_msg_add_hashes(ac, msg,
2163 "lmPwdHistory",
2164 io.g.lm_history,
2165 io.g.lm_history_len);
2166 if (ret != LDB_SUCCESS) {
2167 return ret;
2168 }
2169 }
2170 if (io.g.supplemental.length > 0) {
2171 ret = ldb_msg_add_value(msg, "supplementalCredentials",
2172 &io.g.supplemental, NULL);
2173 if (ret != LDB_SUCCESS) {
2174 return ret;
2175 }
2176 }
2177 ret = samdb_msg_add_uint64(ldb, ac, msg,
2178 "pwdLastSet",
2179 io.g.last_set);
2180 if (ret != LDB_SUCCESS) {
2181 return ret;
2182 }
2183 ret = samdb_msg_add_uint(ldb, ac, msg,
2184 "msDs-KeyVersionNumber",
2185 io.g.kvno);
2186 if (ret != LDB_SUCCESS) {
2187 return ret;
2188 }
2189
2190 ret = ldb_build_mod_req(&mod_req, ldb, ac,
2191 msg,
2192 ac->req->controls,
2193 ac, ph_op_callback,
2194 ac->req);
2195 if (ret != LDB_SUCCESS) {
2196 return ret;
2197 }
2198
2199 return ldb_next_request(ac->module, mod_req);
2200 }
2201
2202 _PUBLIC_ const struct ldb_module_ops ldb_password_hash_module_ops = {
2203 .name = "password_hash",
2204 .add = password_hash_add,
2205 .modify = password_hash_modify,
2206 };