sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-25 17:57:42 +03:00
Code

s3:libsmb: let trust_pw_change() verify the new password at the end.

Browse Source 
We should notice problems as early as possible, it makes no
sense to keep things working for a while and later find out
the we lost our trust relationship with our domain.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12262

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
This commit is contained in:
Stefan Metzmacher 2017-02-09 22:53:52 +01:00 committed by Ralph Boehme
parent 4185689dbf
commit a287754168
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
source3/libsmb/trusts_util.c
View File

@ -290,6 +290,39 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
current_timestring(talloc_tos(), false),
__func__, domain, context_name));
ok = cli_credentials_set_password(creds, new_trust_passwd, CRED_SPECIFIED);
if (!ok) {
DEBUG(0, ("cli_credentials_set_password failed for domain %s!\n",
domain));
TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
current_nt_hash = cli_credentials_get_nt_hash(creds, frame);
if (current_nt_hash == NULL) {
DEBUG(0, ("cli_credentials_get_nt_hash failed for domain %s!\n",
domain));
TALLOC_FREE(frame);
return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
}
/*
* Now we verify the new password.
*/
status = netlogon_creds_cli_auth(context, b,
*current_nt_hash,
NULL); /* previous_nt_hash */
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0, ("netlogon_creds_cli_auth(%s) failed for new password - %s!\n",
context_name, nt_errstr(status)));
TALLOC_FREE(frame);
return status;
}
DEBUG(0,("%s : %s(%s): Verified new password remotely using %s\n",
current_timestring(talloc_tos(), false),
__func__, domain, context_name));
TALLOC_FREE(frame);
return NT_STATUS_OK;
}