sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code
b098eb82bf
samba-mirror/source4/dsdb/samdb/ldb_modules/password_hash.c
Joseph Sutton bd05237de4 s4:dsdb: Prefer explicit initialization to ZERO_STRUCT() 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-14 21:35:29 +00:00

5221 lines
145 KiB
C
Raw Blame History

/*
ldb database module
Copyright (C) Simo Sorce 2004-2008
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2006
Copyright (C) Andrew Tridgell 2004
Copyright (C) Stefan Metzmacher 2007-2010
Copyright (C) Matthias Dieter Wallnöfer 2009-2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
* Name: ldb
*
* Component: ldb password_hash module
*
* Description: correctly handle AD password changes fields
*
* Author: Andrew Bartlett
* Author: Stefan Metzmacher
*/
#include "includes.h"
#include "ldb_module.h"
#include "libcli/auth/libcli_auth.h"
#include "libcli/security/dom_sid.h"
#include "system/kerberos.h"
#include "auth/kerberos/kerberos.h"
#include "dsdb/samdb/samdb.h"
#include "dsdb/samdb/ldb_modules/util.h"
#include "dsdb/samdb/ldb_modules/password_modules.h"
#include "librpc/gen_ndr/ndr_drsblobs.h"
#include "lib/crypto/md4.h"
#include "param/param.h"
#include "lib/krb5_wrap/krb5_samba.h"
#include "auth/auth_sam.h"
#include "auth/common_auth.h"
#include "lib/messaging/messaging.h"
#include "lib/param/loadparm.h"
#include "lib/crypto/gnutls_helpers.h"
#include <gnutls/crypto.h>
#include "kdc/db-glue.h"
#ifdef ENABLE_GPGME
#undef class
#include <gpgme.h>
/*
* 1.2.0 is what dpkg-shlibdeps generates, based on used symbols and
* libgpgme11.symbols
* https://salsa.debian.org/debian/gpgme/blob/debian/master/debian/libgpgme11.symbols
*/
#define MINIMUM_GPGME_VERSION "1.2.0"
#endif
#undef strncasecmp
#undef strcasecmp
/* If we have decided there is a reason to work on this request, then
* setup all the password hash types correctly.
*
* If we haven't the hashes yet but the password given as plain-text (attributes
* 'unicodePwd', 'userPassword' and 'clearTextPassword') we have to check for
* the constraints. Once this is done, we calculate the password hashes.
*
* Notice: unlike the real AD which only supports the UTF16 special based
* 'unicodePwd' and the UTF8 based 'userPassword' plaintext attribute we
* understand also a UTF16 based 'clearTextPassword' one.
* The latter is also accessible through LDAP so it can also be set by external
* tools and scripts. But be aware that this isn't portable on non SAMBA 4 ADs!
*
* Also when the module receives only the password hashes (possible through
* specifying an internal LDB control - for security reasons) some checks are
* performed depending on the operation mode (see below) (e.g. if the password
* has been in use before if the password memory policy was activated).
*
* Attention: There is a difference between "modify" and "reset" operations
* (see MS-ADTS 3.1.1.3.1.5). If the client sends a "add" and "remove"
* operation for a password attribute we thread this as a "modify"; if it sends
* only a "replace" one we have an (administrative) reset.
*
* Finally, if the administrator has requested that a password history
* be maintained, then this should also be written out.
*
*/
/* TODO: [consider always MS-ADTS 3.1.1.3.1.5]
* - Check for right connection encryption
*/
/* Notice: Definition of "dsdb_control_password_change_status" moved into
* "samdb.h" */
struct ph_context {
struct ldb_module *module;
struct ldb_request *req;
struct ldb_request *dom_req;
struct ldb_reply *dom_res;
struct ldb_reply *pso_res;
struct ldb_reply *search_res;
struct ldb_message *update_msg;
struct dsdb_control_password_change_status *status;
struct dsdb_control_password_change *change;
const char **gpg_key_ids;
bool pwd_reset;
bool change_status;
bool hash_values;
bool userPassword;
bool update_password;
bool update_lastset;
bool pwd_last_set_bypass;
bool pwd_last_set_default;
bool smartcard_reset;
const char **userPassword_schemes;
};
struct setup_password_fields_io {
struct ph_context *ac;
struct smb_krb5_context *smb_krb5_context;
/* info about the user account */
struct {
uint32_t userAccountControl;
NTTIME pwdLastSet;
const char *sAMAccountName;
const char *user_principal_name;
const char *displayName; /* full name */
bool is_krbtgt;
uint32_t restrictions;
struct dom_sid *account_sid;
bool store_nt_hash;
} u;
/* new credentials and old given credentials */
struct setup_password_fields_given {
const struct ldb_val *cleartext_utf8;
const struct ldb_val *cleartext_utf16;
struct samr_Password *nt_hash;
/*
* The AES256 kerberos key to confirm the previous password was
* not reused (for n) and to prove the old password was known
* (for og).
*
* We don't have any old salts, so we won't catch password reuse
* if said password was used prior to an account rename and
* another password change.
*/
DATA_BLOB aes_256;
} n, og;
/* old credentials */
struct {
struct samr_Password *nt_hash;
uint32_t nt_history_len;
struct samr_Password *nt_history;
const struct ldb_val *supplemental;
struct supplementalCredentialsBlob scb;
/*
* The AES256 kerberos key as stored in the DB.
* Used to confirm the given password was correct
* and in case the previous password was reused.
*/
DATA_BLOB aes_256;
DATA_BLOB salt;
uint32_t kvno;
} o;
/* generated credentials */
struct {
struct samr_Password *nt_hash;
uint32_t nt_history_len;
struct samr_Password *nt_history;
const char *salt;
DATA_BLOB aes_256;
DATA_BLOB aes_128;
DATA_BLOB des_md5;
DATA_BLOB des_crc;
struct ldb_val supplemental;
NTTIME last_set;
} g;
};
static int msg_find_old_and_new_pwd_val(const struct ldb_message *msg,
const char *name,
enum ldb_request_type operation,
const struct ldb_val **new_val,
const struct ldb_val **old_val);
static int password_hash_bypass(struct ldb_module *module, struct ldb_request *request)
{
struct ldb_context *ldb = ldb_module_get_ctx(module);
const struct ldb_message *msg;
struct ldb_message_element *nte;
struct ldb_message_element *lme;
struct ldb_message_element *nthe;
struct ldb_message_element *lmhe;
struct ldb_message_element *sce;
int ret;
switch (request->operation) {
case LDB_ADD:
msg = request->op.add.message;
break;
case LDB_MODIFY:
msg = request->op.mod.message;
break;
default:
return ldb_next_request(module, request);
}
/* nobody must touch password histories and 'supplementalCredentials' */
#define GET_VALUES(el, attr) do { \
ret = dsdb_get_expected_new_values(request, \
msg, \
attr, \
&el, \
request->operation); \
\
if (ret != LDB_SUCCESS) { \
return ret; \
} \
} while(0)
GET_VALUES(nte, "unicodePwd");
/*
* Even as Samba continues to ignore the LM hash, and reset it
* when practical, we keep the constraint that it must be a 16
* byte value if specified.
*/
GET_VALUES(lme, "dBCSPwd");
GET_VALUES(nthe, "ntPwdHistory");
GET_VALUES(lmhe, "lmPwdHistory");
GET_VALUES(sce, "supplementalCredentials");
#undef GET_VALUES
#define CHECK_HASH_ELEMENT(e, min, max) do {\
if (e && e->num_values) { \
unsigned int _count; \
if (e->num_values != 1) { \
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, \
"num_values != 1"); \
} \
if ((e->values[0].length % 16) != 0) { \
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, \
"length % 16 != 0"); \
} \
_count = e->values[0].length / 16; \
if (_count < min) { \
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, \
"count < min"); \
} \
if (_count > max) { \
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION, \
"count > max"); \
} \
} \
} while (0)
CHECK_HASH_ELEMENT(nte, 1, 1);
CHECK_HASH_ELEMENT(lme, 1, 1);
CHECK_HASH_ELEMENT(nthe, 1, INT32_MAX);
CHECK_HASH_ELEMENT(lmhe, 1, INT32_MAX);
if (sce && sce->num_values) {
enum ndr_err_code ndr_err;
struct supplementalCredentialsBlob *scb;
struct supplementalCredentialsPackage *scpp = NULL;
struct supplementalCredentialsPackage *scpk = NULL;
struct supplementalCredentialsPackage *scpkn = NULL;
struct supplementalCredentialsPackage *scpct = NULL;
DATA_BLOB scpbp = data_blob_null;
DATA_BLOB scpbk = data_blob_null;
DATA_BLOB scpbkn = data_blob_null;
DATA_BLOB scpbct = data_blob_null;
DATA_BLOB blob;
uint32_t i;
if (sce->num_values != 1) {
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"num_values != 1");
}
scb = talloc_zero(request, struct supplementalCredentialsBlob);
if (!scb) {
return ldb_module_oom(module);
}
ndr_err = ndr_pull_struct_blob_all(&sce->values[0], scb, scb,
(ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"ndr_pull_struct_blob_all");
}
if (scb->sub.num_packages < 2) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"num_packages < 2");
}
for (i=0; i < scb->sub.num_packages; i++) {
DATA_BLOB subblob;
subblob = strhex_to_data_blob(scb, scb->sub.packages[i].data);
if (subblob.data == NULL) {
talloc_free(scb);
return ldb_module_oom(module);
}
if (strcmp(scb->sub.packages[i].name, "Packages") == 0) {
if (scpp) {
talloc_free(scb);
return ldb_error(ldb,
LDB_ERR_CONSTRAINT_VIOLATION,
"Packages twice");
}
scpp = &scb->sub.packages[i];
scpbp = subblob;
continue;
}
if (strcmp(scb->sub.packages[i].name, "Primary:Kerberos") == 0) {
if (scpk) {
talloc_free(scb);
return ldb_error(ldb,
LDB_ERR_CONSTRAINT_VIOLATION,
"Primary:Kerberos twice");
}
scpk = &scb->sub.packages[i];
scpbk = subblob;
continue;
}
if (strcmp(scb->sub.packages[i].name, "Primary:Kerberos-Newer-Keys") == 0) {
if (scpkn) {
talloc_free(scb);
return ldb_error(ldb,
LDB_ERR_CONSTRAINT_VIOLATION,
"Primary:Kerberos-Newer-Keys twice");
}
scpkn = &scb->sub.packages[i];
scpbkn = subblob;
continue;
}
if (strcmp(scb->sub.packages[i].name, "Primary:CLEARTEXT") == 0) {
if (scpct) {
talloc_free(scb);
return ldb_error(ldb,
LDB_ERR_CONSTRAINT_VIOLATION,
"Primary:CLEARTEXT twice");
}
scpct = &scb->sub.packages[i];
scpbct = subblob;
continue;
}
data_blob_free(&subblob);
}
if (scpp == NULL) {
talloc_free(scb);
return ldb_error(ldb,
LDB_ERR_CONSTRAINT_VIOLATION,
"Primary:Packages missing");
}
if (scpk == NULL) {
/*
* If Primary:Kerberos is missing w2k8r2 reboots
* when a password is changed.
*/
talloc_free(scb);
return ldb_error(ldb,
LDB_ERR_CONSTRAINT_VIOLATION,
"Primary:Kerberos missing");
}
if (scpp) {
struct package_PackagesBlob *p;
uint32_t n;
p = talloc_zero(scb, struct package_PackagesBlob);
if (p == NULL) {
talloc_free(scb);
return ldb_module_oom(module);
}
ndr_err = ndr_pull_struct_blob(&scpbp, p, p,
(ndr_pull_flags_fn_t)ndr_pull_package_PackagesBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"ndr_pull_struct_blob Packages");
}
if (p->names == NULL) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"Packages names == NULL");
}
for (n = 0; p->names[n]; n++) {
/* noop */
}
if (scb->sub.num_packages != (n + 1)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"Packages num_packages != num_names + 1");
}
talloc_free(p);
}
if (scpk) {
struct package_PrimaryKerberosBlob *k;
k = talloc_zero(scb, struct package_PrimaryKerberosBlob);
if (k == NULL) {
talloc_free(scb);
return ldb_module_oom(module);
}
ndr_err = ndr_pull_struct_blob(&scpbk, k, k,
(ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"ndr_pull_struct_blob PrimaryKerberos");
}
if (k->version != 3) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos version != 3");
}
if (k->ctr.ctr3.salt.string == NULL) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos salt == NULL");
}
if (strlen(k->ctr.ctr3.salt.string) == 0) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos strlen(salt) == 0");
}
if (k->ctr.ctr3.num_keys != 2) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos num_keys != 2");
}
if (k->ctr.ctr3.num_old_keys > k->ctr.ctr3.num_keys) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos num_old_keys > num_keys");
}
if (k->ctr.ctr3.keys[0].keytype != ENCTYPE_DES_CBC_MD5) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos key[0] != DES_CBC_MD5");
}
if (k->ctr.ctr3.keys[1].keytype != ENCTYPE_DES_CBC_CRC) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos key[1] != DES_CBC_CRC");
}
if (k->ctr.ctr3.keys[0].value_len != 8) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos key[0] value_len != 8");
}
if (k->ctr.ctr3.keys[1].value_len != 8) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos key[1] value_len != 8");
}
for (i = 0; i < k->ctr.ctr3.num_old_keys; i++) {
if (k->ctr.ctr3.old_keys[i].keytype ==
k->ctr.ctr3.keys[i].keytype &&
k->ctr.ctr3.old_keys[i].value_len ==
k->ctr.ctr3.keys[i].value_len) {
continue;
}
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryKerberos old_keys type/value_len doesn't match");
}
talloc_free(k);
}
if (scpkn) {
struct package_PrimaryKerberosBlob *k;
k = talloc_zero(scb, struct package_PrimaryKerberosBlob);
if (k == NULL) {
talloc_free(scb);
return ldb_module_oom(module);
}
ndr_err = ndr_pull_struct_blob(&scpbkn, k, k,
(ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"ndr_pull_struct_blob PrimaryKerberosNeverKeys");
}
if (k->version != 4) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNerverKeys version != 4");
}
if (k->ctr.ctr4.salt.string == NULL) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys salt == NULL");
}
if (strlen(k->ctr.ctr4.salt.string) == 0) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys strlen(salt) == 0");
}
if (k->ctr.ctr4.num_keys != 4) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys num_keys != 4");
}
if (k->ctr.ctr4.num_old_keys > k->ctr.ctr4.num_keys) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys num_old_keys > num_keys");
}
if (k->ctr.ctr4.num_older_keys > k->ctr.ctr4.num_old_keys) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys num_older_keys > num_old_keys");
}
if (k->ctr.ctr4.keys[0].keytype != ENCTYPE_AES256_CTS_HMAC_SHA1_96) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[0] != AES256");
}
if (k->ctr.ctr4.keys[1].keytype != ENCTYPE_AES128_CTS_HMAC_SHA1_96) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[1] != AES128");
}
if (k->ctr.ctr4.keys[2].keytype != ENCTYPE_DES_CBC_MD5) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[2] != DES_CBC_MD5");
}
if (k->ctr.ctr4.keys[3].keytype != ENCTYPE_DES_CBC_CRC) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[3] != DES_CBC_CRC");
}
if (k->ctr.ctr4.keys[0].value_len != 32) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[0] value_len != 32");
}
if (k->ctr.ctr4.keys[1].value_len != 16) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[1] value_len != 16");
}
if (k->ctr.ctr4.keys[2].value_len != 8) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[2] value_len != 8");
}
if (k->ctr.ctr4.keys[3].value_len != 8) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"KerberosNewerKeys key[3] value_len != 8");
}
/*
* TODO:
* Maybe we can check old and older keys here.
* But we need to do some tests, if the old keys
* can be taken from the PrimaryKerberos blob
* (with only des keys), when the domain was upgraded
* from w2k3 to w2k8.
*/
talloc_free(k);
}
if (scpct) {
struct package_PrimaryCLEARTEXTBlob *ct;
ct = talloc_zero(scb, struct package_PrimaryCLEARTEXTBlob);
if (ct == NULL) {
talloc_free(scb);
return ldb_module_oom(module);
}
ndr_err = ndr_pull_struct_blob(&scpbct, ct, ct,
(ndr_pull_flags_fn_t)ndr_pull_package_PrimaryCLEARTEXTBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"ndr_pull_struct_blob PrimaryCLEARTEXT");
}
if ((ct->cleartext.length % 2) != 0) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"PrimaryCLEARTEXT length % 2 != 0");
}
talloc_free(ct);
}
ndr_err = ndr_push_struct_blob(&blob, scb, scb,
(ndr_push_flags_fn_t)ndr_push_supplementalCredentialsBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"ndr_pull_struct_blob_all");
}
if (sce->values[0].length != blob.length) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"supplementalCredentialsBlob length differ");
}
if (!mem_equal_const_time(sce->values[0].data, blob.data, blob.length)) {
talloc_free(scb);
return ldb_error(ldb, LDB_ERR_CONSTRAINT_VIOLATION,
"supplementalCredentialsBlob memcmp differ");
}
talloc_free(scb);
}
ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_bypass - validated\n");
return ldb_next_request(module, request);
}
/* Get the NT hash, and fill it in as an entry in the password history,
and specify it into io->g.nt_hash */
static int setup_nt_fields(struct setup_password_fields_io *io)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
uint32_t i;
if (io->u.store_nt_hash) {
io->g.nt_hash = io->n.nt_hash;
}
if (io->ac->status->domain_data.pwdHistoryLength == 0) {
return LDB_SUCCESS;
}
/* We might not have an old NT password */
if (io->g.nt_hash == NULL) {
/*
* If there was not an NT hash specified, then don't
* store the NT password history.
*
* While the NTLM code on a Windows DC will cope with
* a missing unicodePwd, if it finds a last password
* in the ntPwdHistory, even if the bytes are zero ,
* it will (quite reasonably) treat it as a valid NT
* hash. NTLM logins with the previous password are
* allowed for a short time after the password is
* changed to allow for password propagation delays.
*/
return LDB_SUCCESS;
}
io->g.nt_history = talloc_array(io->ac,
struct samr_Password,
io->ac->status->domain_data.pwdHistoryLength);
if (!io->g.nt_history) {
return ldb_oom(ldb);
}
for (i = 0; i < MIN(io->ac->status->domain_data.pwdHistoryLength-1,
io->o.nt_history_len); i++) {
io->g.nt_history[i+1] = io->o.nt_history[i];
}
io->g.nt_history_len = i + 1;
io->g.nt_history[0] = *io->g.nt_hash;
return LDB_SUCCESS;
}
static int setup_kerberos_keys(struct setup_password_fields_io *io)
{
struct ldb_context *ldb;
krb5_error_code krb5_ret;
krb5_principal salt_principal = NULL;
krb5_data salt_data;
krb5_data salt;
krb5_keyblock key;
krb5_data cleartext_data;
uint32_t uac_flags = 0;
ldb = ldb_module_get_ctx(io->ac->module);
cleartext_data.data = (char *)io->n.cleartext_utf8->data;
cleartext_data.length = io->n.cleartext_utf8->length;
uac_flags = io->u.userAccountControl & UF_ACCOUNT_TYPE_MASK;
krb5_ret = smb_krb5_salt_principal(io->smb_krb5_context->krb5_context,
io->ac->status->domain_data.realm,
io->u.sAMAccountName,
io->u.user_principal_name,
uac_flags,
&salt_principal);
if (krb5_ret) {
ldb_asprintf_errstring(ldb,
"setup_kerberos_keys: "
"generation of a salting principal failed: %s",
smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
krb5_ret, io->ac));
return LDB_ERR_OPERATIONS_ERROR;
}
/*
* create salt from salt_principal
*/
krb5_ret = smb_krb5_get_pw_salt(io->smb_krb5_context->krb5_context,
salt_principal, &salt_data);
krb5_free_principal(io->smb_krb5_context->krb5_context, salt_principal);
if (krb5_ret) {
ldb_asprintf_errstring(ldb,
"setup_kerberos_keys: "
"generation of krb5_salt failed: %s",
smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
krb5_ret, io->ac));
return LDB_ERR_OPERATIONS_ERROR;
}
/* now use the talloced copy of the salt */
salt.data = talloc_strndup(io->ac,
(char *)salt_data.data,
salt_data.length);
smb_krb5_free_data_contents(io->smb_krb5_context->krb5_context,
&salt_data);
if (salt.data == NULL) {
return ldb_oom(ldb);
}
io->g.salt = salt.data;
salt.length = strlen(io->g.salt);
/*
* create ENCTYPE_AES256_CTS_HMAC_SHA1_96 key out of
* the salt and the cleartext password
*/
krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
NULL,
&salt,
&cleartext_data,
ENCTYPE_AES256_CTS_HMAC_SHA1_96,
&key);
if (krb5_ret) {
ldb_asprintf_errstring(ldb,
"setup_kerberos_keys: "
"generation of a aes256-cts-hmac-sha1-96 key failed: %s",
smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
krb5_ret, io->ac));
return LDB_ERR_OPERATIONS_ERROR;
}
io->g.aes_256 = data_blob_talloc(io->ac,
KRB5_KEY_DATA(&key),
KRB5_KEY_LENGTH(&key));
krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
if (!io->g.aes_256.data) {
return ldb_oom(ldb);
}
/*
* create ENCTYPE_AES128_CTS_HMAC_SHA1_96 key out of
* the salt and the cleartext password
*/
krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
NULL,
&salt,
&cleartext_data,
ENCTYPE_AES128_CTS_HMAC_SHA1_96,
&key);
if (krb5_ret) {
ldb_asprintf_errstring(ldb,
"setup_kerberos_keys: "
"generation of a aes128-cts-hmac-sha1-96 key failed: %s",
smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
krb5_ret, io->ac));
return LDB_ERR_OPERATIONS_ERROR;
}
io->g.aes_128 = data_blob_talloc(io->ac,
KRB5_KEY_DATA(&key),
KRB5_KEY_LENGTH(&key));
krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
if (!io->g.aes_128.data) {
return ldb_oom(ldb);
}
/*
* As per RFC-6649 single DES encryption types are no longer considered
* secure to be used in Kerberos, we store random keys instead of the
* ENCTYPE_DES_CBC_MD5 and ENCTYPE_DES_CBC_CRC keys.
*/
io->g.des_md5 = data_blob_talloc(io->ac, NULL, 8);
if (!io->g.des_md5.data) {
return ldb_oom(ldb);
}
generate_secret_buffer(io->g.des_md5.data, 8);
io->g.des_crc = data_blob_talloc(io->ac, NULL, 8);
if (!io->g.des_crc.data) {
return ldb_oom(ldb);
}
generate_secret_buffer(io->g.des_crc.data, 8);
return LDB_SUCCESS;
}
static int setup_kerberos_key_hash(struct setup_password_fields_io *io,
struct setup_password_fields_given *g)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
krb5_error_code krb5_ret;
krb5_data salt;
krb5_keyblock key;
krb5_data cleartext_data;
if (io->ac->search_res == NULL) {
/* No old data so nothing to do */
return LDB_SUCCESS;
}
if (io->o.salt.data == NULL) {
/* We didn't fetch the salt in setup_io(), so nothing to do */
return LDB_SUCCESS;
}
salt.data = (char *)io->o.salt.data;
salt.length = io->o.salt.length;
cleartext_data.data = (char *)g->cleartext_utf8->data;
cleartext_data.length = g->cleartext_utf8->length;
/*
* create ENCTYPE_AES256_CTS_HMAC_SHA1_96 key out of the salt
* and the cleartext password
*/
krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
NULL,
&salt,
&cleartext_data,
ENCTYPE_AES256_CTS_HMAC_SHA1_96,
&key);
if (krb5_ret) {
ldb_asprintf_errstring(ldb,
"setup_kerberos_key_hash: "
"generation of a aes256-cts-hmac-sha1-96 key failed: %s",
smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
krb5_ret, io->ac));
return LDB_ERR_OPERATIONS_ERROR;
}
g->aes_256 = data_blob_talloc(io->ac,
KRB5_KEY_DATA(&key),
KRB5_KEY_LENGTH(&key));
krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
if (g->aes_256.data == NULL) {
return ldb_oom(ldb);
}
talloc_keep_secret(g->aes_256.data);
return LDB_SUCCESS;
}
static int setup_primary_kerberos(struct setup_password_fields_io *io,
const struct supplementalCredentialsBlob *old_scb,
struct package_PrimaryKerberosBlob *pkb)
{
struct ldb_context *ldb;
struct package_PrimaryKerberosCtr3 *pkb3 = &pkb->ctr.ctr3;
struct supplementalCredentialsPackage *old_scp = NULL;
struct package_PrimaryKerberosBlob _old_pkb;
struct package_PrimaryKerberosCtr3 *old_pkb3 = NULL;
uint32_t i;
enum ndr_err_code ndr_err;
ldb = ldb_module_get_ctx(io->ac->module);
/*
* prepare generation of keys
*
* ENCTYPE_DES_CBC_MD5
* ENCTYPE_DES_CBC_CRC
*/
pkb->version = 3;
pkb3->salt.string = io->g.salt;
pkb3->num_keys = 2;
pkb3->keys = talloc_array(io->ac,
struct package_PrimaryKerberosKey3,
pkb3->num_keys);
if (!pkb3->keys) {
return ldb_oom(ldb);
}
pkb3->keys[0].keytype = ENCTYPE_DES_CBC_MD5;
pkb3->keys[0].value = &io->g.des_md5;
pkb3->keys[1].keytype = ENCTYPE_DES_CBC_CRC;
pkb3->keys[1].value = &io->g.des_crc;
/* initialize the old keys to zero */
pkb3->num_old_keys = 0;
pkb3->old_keys = NULL;
/* if there're no old keys, then we're done */
if (!old_scb) {
return LDB_SUCCESS;
}
for (i=0; i < old_scb->sub.num_packages; i++) {
if (strcmp("Primary:Kerberos", old_scb->sub.packages[i].name) != 0) {
continue;
}
if (!old_scb->sub.packages[i].data || !old_scb->sub.packages[i].data[0]) {
continue;
}
old_scp = &old_scb->sub.packages[i];
break;
}
/* Primary:Kerberos element of supplementalCredentials */
if (old_scp) {
DATA_BLOB blob;
blob = strhex_to_data_blob(io->ac, old_scp->data);
if (!blob.data) {
return ldb_oom(ldb);
}
/* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
ndr_err = ndr_pull_struct_blob(&blob, io->ac, &_old_pkb,
(ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(ldb,
"setup_primary_kerberos: "
"failed to pull old package_PrimaryKerberosBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
if (_old_pkb.version != 3) {
ldb_asprintf_errstring(ldb,
"setup_primary_kerberos: "
"package_PrimaryKerberosBlob version[%u] expected[3]",
_old_pkb.version);
return LDB_ERR_OPERATIONS_ERROR;
}
old_pkb3 = &_old_pkb.ctr.ctr3;
}
/* if we didn't found the old keys we're done */
if (!old_pkb3) {
return LDB_SUCCESS;
}
/* fill in the old keys */
pkb3->num_old_keys = old_pkb3->num_keys;
pkb3->old_keys = old_pkb3->keys;
return LDB_SUCCESS;
}
static int setup_primary_kerberos_newer(struct setup_password_fields_io *io,
const struct supplementalCredentialsBlob *old_scb,
struct package_PrimaryKerberosBlob *pkb)
{
struct ldb_context *ldb;
struct package_PrimaryKerberosCtr4 *pkb4 = &pkb->ctr.ctr4;
struct supplementalCredentialsPackage *old_scp = NULL;
struct package_PrimaryKerberosBlob _old_pkb;
struct package_PrimaryKerberosCtr4 *old_pkb4 = NULL;
uint32_t i;
enum ndr_err_code ndr_err;
ldb = ldb_module_get_ctx(io->ac->module);
/*
* prepare generation of keys
*
* ENCTYPE_AES256_CTS_HMAC_SHA1_96
* ENCTYPE_AES128_CTS_HMAC_SHA1_96
* ENCTYPE_DES_CBC_MD5
* ENCTYPE_DES_CBC_CRC
*/
pkb->version = 4;
pkb4->salt.string = io->g.salt;
pkb4->default_iteration_count = 4096;
pkb4->num_keys = 4;
pkb4->keys = talloc_array(io->ac,
struct package_PrimaryKerberosKey4,
pkb4->num_keys);
if (!pkb4->keys) {
return ldb_oom(ldb);
}
pkb4->keys[0].iteration_count = 4096;
pkb4->keys[0].keytype = ENCTYPE_AES256_CTS_HMAC_SHA1_96;
pkb4->keys[0].value = &io->g.aes_256;
pkb4->keys[1].iteration_count = 4096;
pkb4->keys[1].keytype = ENCTYPE_AES128_CTS_HMAC_SHA1_96;
pkb4->keys[1].value = &io->g.aes_128;
pkb4->keys[2].iteration_count = 4096;
pkb4->keys[2].keytype = ENCTYPE_DES_CBC_MD5;
pkb4->keys[2].value = &io->g.des_md5;
pkb4->keys[3].iteration_count = 4096;
pkb4->keys[3].keytype = ENCTYPE_DES_CBC_CRC;
pkb4->keys[3].value = &io->g.des_crc;
/* initialize the old keys to zero */
pkb4->num_old_keys = 0;
pkb4->old_keys = NULL;
pkb4->num_older_keys = 0;
pkb4->older_keys = NULL;
/* if there're no old keys, then we're done */
if (!old_scb) {
return LDB_SUCCESS;
}
for (i=0; i < old_scb->sub.num_packages; i++) {
if (strcmp("Primary:Kerberos-Newer-Keys", old_scb->sub.packages[i].name) != 0) {
continue;
}
if (!old_scb->sub.packages[i].data || !old_scb->sub.packages[i].data[0]) {
continue;
}
old_scp = &old_scb->sub.packages[i];
break;
}
/* Primary:Kerberos-Newer-Keys element of supplementalCredentials */
if (old_scp) {
DATA_BLOB blob;
blob = strhex_to_data_blob(io->ac, old_scp->data);
if (!blob.data) {
return ldb_oom(ldb);
}
/* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
ndr_err = ndr_pull_struct_blob(&blob, io->ac,
&_old_pkb,
(ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(ldb,
"setup_primary_kerberos_newer: "
"failed to pull old package_PrimaryKerberosBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
if (_old_pkb.version != 4) {
ldb_asprintf_errstring(ldb,
"setup_primary_kerberos_newer: "
"package_PrimaryKerberosBlob version[%u] expected[4]",
_old_pkb.version);
return LDB_ERR_OPERATIONS_ERROR;
}
old_pkb4 = &_old_pkb.ctr.ctr4;
}
/* if we didn't found the old keys we're done */
if (!old_pkb4) {
return LDB_SUCCESS;
}
/* fill in the old keys */
pkb4->num_old_keys = old_pkb4->num_keys;
pkb4->old_keys = old_pkb4->keys;
pkb4->num_older_keys = old_pkb4->num_old_keys;
pkb4->older_keys = old_pkb4->old_keys;
return LDB_SUCCESS;
}
static int setup_primary_wdigest(struct setup_password_fields_io *io,
const struct supplementalCredentialsBlob *old_scb,
struct package_PrimaryWDigestBlob *pdb)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
DATA_BLOB sAMAccountName;
DATA_BLOB sAMAccountName_l;
DATA_BLOB sAMAccountName_u;
const char *user_principal_name = io->u.user_principal_name;
DATA_BLOB userPrincipalName;
DATA_BLOB userPrincipalName_l;
DATA_BLOB userPrincipalName_u;
DATA_BLOB netbios_domain;
DATA_BLOB netbios_domain_l;
DATA_BLOB netbios_domain_u;
DATA_BLOB dns_domain;
DATA_BLOB dns_domain_l;
DATA_BLOB dns_domain_u;
DATA_BLOB digest;
DATA_BLOB delim;
DATA_BLOB backslash;
uint8_t i;
struct {
DATA_BLOB *user;
DATA_BLOB *realm;
DATA_BLOB *nt4dom;
} wdigest[] = {
/*
* See 3.1.1.8.11.3.1 WDIGEST_CREDENTIALS Construction
* https://msdn.microsoft.com/en-us/library/cc245680.aspx
* for what precalculated hashes are supposed to be stored...
*
* I can't reproduce all values which should contain "Digest" as realm,
* am I doing something wrong or is w2k3 just broken...?
*
* W2K3 fills in following for a user:
*
* dn: CN=NewUser,OU=newtop,DC=sub1,DC=w2k3,DC=vmnet1,DC=vm,DC=base
* sAMAccountName: NewUser2Sam
* userPrincipalName: NewUser2Princ@sub1.w2k3.vmnet1.vm.base
*
* 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
* b7ec9da91062199aee7d121e6710fe23 => newuser2sam:sub1:TestPwd2007
* 17d290bc5c9f463fac54c37a8cea134d => NEWUSER2SAM:SUB1:TestPwd2007
* 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
* 5d57e7823938348127322e08cd81bcb5 => NewUser2Sam:sub1:TestPwd2007
* 07dd701bf8a011ece585de3d47237140 => NEWUSER2SAM:sub1:TestPwd2007
* e14fb0eb401498d2cb33c9aae1cc7f37 => newuser2sam:SUB1:TestPwd2007
* 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* f52da1266a6bdd290ffd48b2c823dda7 => newuser2sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* d2b42f171248cec37a3c5c6b55404062 => NEWUSER2SAM:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
* fff8d790ff6c152aaeb6ebe17b4021de => NewUser2Sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
* 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* 2a7563c3715bc418d626dabef378c008 => NEWUSER2SAM:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* c8e9557a87cd4200fda0c11d2fa03f96 => newuser2sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
* 221c55284451ae9b3aacaa2a3c86f10f => NewUser2Princ@sub1.w2k3.vmnet1.vm.base::TestPwd2007
* 74e1be668853d4324d38c07e2acfb8ea => (w2k3 has a bug here!) newuser2princ@sub1.w2k3.vmnet1.vm.base::TestPwd2007
* e1e244ab7f098e3ae1761be7f9229bbb => NEWUSER2PRINC@SUB1.W2K3.VMNET1.VM.BASE::TestPwd2007
* 86db637df42513039920e605499c3af6 => SUB1\NewUser2Sam::TestPwd2007
* f5e43474dfaf067fee8197a253debaa2 => sub1\newuser2sam::TestPwd2007
* 2ecaa8382e2518e4b77a52422b279467 => SUB1\NEWUSER2SAM::TestPwd2007
* 31dc704d3640335b2123d4ee28aa1f11 => ??? changes with NewUser2Sam => NewUser1Sam
* 36349f5cecd07320fb3bb0e119230c43 => ??? changes with NewUser2Sam => NewUser1Sam
* 12adf019d037fb535c01fd0608e78d9d => ??? changes with NewUser2Sam => NewUser1Sam
* 6feecf8e724906f3ee1105819c5105a1 => ??? changes with NewUser2Princ => NewUser1Princ
* 6c6911f3de6333422640221b9c51ff1f => ??? changes with NewUser2Princ => NewUser1Princ
* 4b279877e742895f9348ac67a8de2f69 => ??? changes with NewUser2Princ => NewUser1Princ
* db0c6bff069513e3ebb9870d29b57490 => ??? changes with NewUser2Sam => NewUser1Sam
* 45072621e56b1c113a4e04a8ff68cd0e => ??? changes with NewUser2Sam => NewUser1Sam
* 11d1220abc44a9c10cf91ef4a9c1de02 => ??? changes with NewUser2Sam => NewUser1Sam
*
* dn: CN=NewUser,OU=newtop,DC=sub1,DC=w2k3,DC=vmnet1,DC=vm,DC=base
* sAMAccountName: NewUser2Sam
*
* 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
* b7ec9da91062199aee7d121e6710fe23 => newuser2sam:sub1:TestPwd2007
* 17d290bc5c9f463fac54c37a8cea134d => NEWUSER2SAM:SUB1:TestPwd2007
* 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
* 5d57e7823938348127322e08cd81bcb5 => NewUser2Sam:sub1:TestPwd2007
* 07dd701bf8a011ece585de3d47237140 => NEWUSER2SAM:sub1:TestPwd2007
* e14fb0eb401498d2cb33c9aae1cc7f37 => newuser2sam:SUB1:TestPwd2007
* 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* f52da1266a6bdd290ffd48b2c823dda7 => newuser2sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* d2b42f171248cec37a3c5c6b55404062 => NEWUSER2SAM:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
* fff8d790ff6c152aaeb6ebe17b4021de => NewUser2Sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
* 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* 2a7563c3715bc418d626dabef378c008 => NEWUSER2SAM:sub1.w2k3.vmnet1.vm.base:TestPwd2007
* c8e9557a87cd4200fda0c11d2fa03f96 => newuser2sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
* 8a140d30b6f0a5912735dc1e3bc993b4 => NewUser2Sam@sub1.w2k3.vmnet1.vm.base::TestPwd2007
* 86d95b2faae6cae4ec261e7fbaccf093 => (here w2k3 is correct) newuser2sam@sub1.w2k3.vmnet1.vm.base::TestPwd2007
* dfeff1493110220efcdfc6362e5f5450 => NEWUSER2SAM@SUB1.W2K3.VMNET1.VM.BASE::TestPwd2007
* 86db637df42513039920e605499c3af6 => SUB1\NewUser2Sam::TestPwd2007
* f5e43474dfaf067fee8197a253debaa2 => sub1\newuser2sam::TestPwd2007
* 2ecaa8382e2518e4b77a52422b279467 => SUB1\NEWUSER2SAM::TestPwd2007
* 31dc704d3640335b2123d4ee28aa1f11 => ???M1 changes with NewUser2Sam => NewUser1Sam
* 36349f5cecd07320fb3bb0e119230c43 => ???M1.L changes with newuser2sam => newuser1sam
* 12adf019d037fb535c01fd0608e78d9d => ???M1.U changes with NEWUSER2SAM => NEWUSER1SAM
* 569b4533f2d9e580211dd040e5e360a8 => ???M2 changes with NewUser2Princ => NewUser1Princ
* 52528bddf310a587c5d7e6a9ae2cbb20 => ???M2.L changes with newuser2princ => newuser1princ
* 4f629a4f0361289ca4255ab0f658fcd5 => ???M3 changes with NewUser2Princ => NewUser1Princ (doesn't depend on case of userPrincipal )
* db0c6bff069513e3ebb9870d29b57490 => ???M4 changes with NewUser2Sam => NewUser1Sam
* 45072621e56b1c113a4e04a8ff68cd0e => ???M5 changes with NewUser2Sam => NewUser1Sam (doesn't depend on case of sAMAccountName)
* 11d1220abc44a9c10cf91ef4a9c1de02 => ???M4.U changes with NEWUSER2SAM => NEWUSER1SAM
*/
/*
* sAMAccountName, netbios_domain
*/
{
.user = &sAMAccountName,
.realm = &netbios_domain,
},
{
.user = &sAMAccountName_l,
.realm = &netbios_domain_l,
},
{
.user = &sAMAccountName_u,
.realm = &netbios_domain_u,
},
{
.user = &sAMAccountName,
.realm = &netbios_domain_u,
},
{
.user = &sAMAccountName,
.realm = &netbios_domain_l,
},
{
.user = &sAMAccountName_u,
.realm = &netbios_domain_l,
},
{
.user = &sAMAccountName_l,
.realm = &netbios_domain_u,
},
/*
* sAMAccountName, dns_domain
*
* TODO:
* Windows preserves the case of the DNS domain,
* Samba lower cases the domain at provision time
* This means that for mixed case Domains, the WDigest08 hash
* calculated by Samba differs from that calculated by Windows.
* Until we get a real world use case this will remain a known
* bug, as changing the case could have unforeseen impacts.
*
*/
{
.user = &sAMAccountName,
.realm = &dns_domain,
},
{
.user = &sAMAccountName_l,
.realm = &dns_domain_l,
},
{
.user = &sAMAccountName_u,
.realm = &dns_domain_u,
},
{
.user = &sAMAccountName,
.realm = &dns_domain_u,
},
{
.user = &sAMAccountName,
.realm = &dns_domain_l,
},
{
.user = &sAMAccountName_u,
.realm = &dns_domain_l,
},
{
.user = &sAMAccountName_l,
.realm = &dns_domain_u,
},
/*
* userPrincipalName, no realm
*/
{
.user = &userPrincipalName,
},
{
/*
* NOTE: w2k3 messes this up, if the user has a real userPrincipalName,
* the fallback to the sAMAccountName based userPrincipalName is correct
*/
.user = &userPrincipalName_l,
},
{
.user = &userPrincipalName_u,
},
/*
* nt4dom\sAMAccountName, no realm
*/
{
.user = &sAMAccountName,
.nt4dom = &netbios_domain
},
{
.user = &sAMAccountName_l,
.nt4dom = &netbios_domain_l
},
{
.user = &sAMAccountName_u,
.nt4dom = &netbios_domain_u
},
/*
* the following ones are guessed depending on the technet2 article
* but not reproducible on a w2k3 server
*/
/* sAMAccountName with "Digest" realm */
{
.user = &sAMAccountName,
.realm = &digest
},
{
.user = &sAMAccountName_l,
.realm = &digest
},
{
.user = &sAMAccountName_u,
.realm = &digest
},
/* userPrincipalName with "Digest" realm */
{
.user = &userPrincipalName,
.realm = &digest
},
{
.user = &userPrincipalName_l,
.realm = &digest
},
{
.user = &userPrincipalName_u,
.realm = &digest
},
/* nt4dom\\sAMAccountName with "Digest" realm */
{
.user = &sAMAccountName,
.nt4dom = &netbios_domain,
.realm = &digest
},
{
.user = &sAMAccountName_l,
.nt4dom = &netbios_domain_l,
.realm = &digest
},
{
.user = &sAMAccountName_u,
.nt4dom = &netbios_domain_u,
.realm = &digest
},
};
int rc = LDB_ERR_OTHER;
/* prepare DATA_BLOB's used in the combinations array */
sAMAccountName = data_blob_string_const(io->u.sAMAccountName);
sAMAccountName_l = data_blob_string_const(strlower_talloc(io->ac, io->u.sAMAccountName));
if (!sAMAccountName_l.data) {
return ldb_oom(ldb);
}
sAMAccountName_u = data_blob_string_const(strupper_talloc(io->ac, io->u.sAMAccountName));
if (!sAMAccountName_u.data) {
return ldb_oom(ldb);
}
/* if the user doesn't have a userPrincipalName, create one (with lower case realm) */
if (!user_principal_name) {
user_principal_name = talloc_asprintf(io->ac, "%s@%s",
io->u.sAMAccountName,
io->ac->status->domain_data.dns_domain);
if (!user_principal_name) {
return ldb_oom(ldb);
}
}
userPrincipalName = data_blob_string_const(user_principal_name);
userPrincipalName_l = data_blob_string_const(strlower_talloc(io->ac, user_principal_name));
if (!userPrincipalName_l.data) {
return ldb_oom(ldb);
}
userPrincipalName_u = data_blob_string_const(strupper_talloc(io->ac, user_principal_name));
if (!userPrincipalName_u.data) {
return ldb_oom(ldb);
}
netbios_domain = data_blob_string_const(io->ac->status->domain_data.netbios_domain);
netbios_domain_l = data_blob_string_const(strlower_talloc(io->ac,
io->ac->status->domain_data.netbios_domain));
if (!netbios_domain_l.data) {
return ldb_oom(ldb);
}
netbios_domain_u = data_blob_string_const(strupper_talloc(io->ac,
io->ac->status->domain_data.netbios_domain));
if (!netbios_domain_u.data) {
return ldb_oom(ldb);
}
dns_domain = data_blob_string_const(io->ac->status->domain_data.dns_domain);
dns_domain_l = data_blob_string_const(io->ac->status->domain_data.dns_domain);
dns_domain_u = data_blob_string_const(io->ac->status->domain_data.realm);
digest = data_blob_string_const("Digest");
delim = data_blob_string_const(":");
backslash = data_blob_string_const("\\");
pdb->num_hashes = ARRAY_SIZE(wdigest);
pdb->hashes = talloc_array(io->ac, struct package_PrimaryWDigestHash,
pdb->num_hashes);
if (!pdb->hashes) {
return ldb_oom(ldb);
}
for (i=0; i < ARRAY_SIZE(wdigest); i++) {
gnutls_hash_hd_t hash_hnd = NULL;
rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
if (rc < 0) {
rc = ldb_oom(ldb);
goto out;
}
if (wdigest[i].nt4dom) {
rc = gnutls_hash(hash_hnd,
wdigest[i].nt4dom->data,
wdigest[i].nt4dom->length);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
rc = LDB_ERR_UNWILLING_TO_PERFORM;
goto out;
}
rc = gnutls_hash(hash_hnd,
backslash.data,
backslash.length);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
rc = LDB_ERR_UNWILLING_TO_PERFORM;
goto out;
}
}
rc = gnutls_hash(hash_hnd,
wdigest[i].user->data,
wdigest[i].user->length);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
rc = LDB_ERR_UNWILLING_TO_PERFORM;
goto out;
}
rc = gnutls_hash(hash_hnd, delim.data, delim.length);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
rc = LDB_ERR_UNWILLING_TO_PERFORM;
goto out;
}
if (wdigest[i].realm) {
rc = gnutls_hash(hash_hnd,
wdigest[i].realm->data,
wdigest[i].realm->length);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
rc = LDB_ERR_UNWILLING_TO_PERFORM;
goto out;
}
}
rc = gnutls_hash(hash_hnd, delim.data, delim.length);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
rc = LDB_ERR_UNWILLING_TO_PERFORM;
goto out;
}
rc = gnutls_hash(hash_hnd,
io->n.cleartext_utf8->data,
io->n.cleartext_utf8->length);
if (rc < 0) {
gnutls_hash_deinit(hash_hnd, NULL);
rc = LDB_ERR_UNWILLING_TO_PERFORM;
goto out;
}
gnutls_hash_deinit(hash_hnd, pdb->hashes[i].hash);
}
rc = LDB_SUCCESS;
out:
return rc;
}
#define SHA_SALT_PERMITTED_CHARS "abcdefghijklmnopqrstuvwxyz" \
"ABCDEFGHIJKLMNOPQRSTUVWXYZ" \
"0123456789./"
#define SHA_SALT_SIZE 16
#define SHA_256_SCHEME "CryptSHA256"
#define SHA_512_SCHEME "CryptSHA512"
#define CRYPT "{CRYPT}"
#define SHA_ID_LEN 3
#define SHA_256_ALGORITHM_ID 5
#define SHA_512_ALGORITHM_ID 6
#define ROUNDS_PARAMETER "rounds="
/*
* Extract the crypt (3) algorithm number and number of hash rounds from the
* supplied scheme string
*/
static bool parse_scheme(const char *scheme, int *algorithm, int *rounds) {
const char *rp = NULL; /* Pointer to the 'rounds=' option */
char digits[21]; /* digits extracted from the rounds option */
int i = 0; /* loop index variable */
if (strncasecmp(SHA_256_SCHEME, scheme, strlen(SHA_256_SCHEME)) == 0) {
*algorithm = SHA_256_ALGORITHM_ID;
} else if (strncasecmp(SHA_512_SCHEME, scheme, strlen(SHA_256_SCHEME))
== 0) {
*algorithm = SHA_512_ALGORITHM_ID;
} else {
return false;
}
rp = strcasestr(scheme, ROUNDS_PARAMETER);
if (rp == NULL) {
/* No options specified, use crypt default number of rounds */
*rounds = 0;
return true;
}
rp += strlen(ROUNDS_PARAMETER);
for (i = 0; isdigit(rp[i]) && i < (sizeof(digits) - 1); i++) {
digits[i] = rp[i];
}
digits[i] = '\0';
*rounds = atoi(digits);
return true;
}
/*
* Calculate the password hash specified by scheme, and return it in
* hash_value
*/
static int setup_primary_userPassword_hash(
TALLOC_CTX *ctx,
struct setup_password_fields_io *io,
const char* scheme,
struct package_PrimaryUserPasswordValue *hash_value)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
const char *salt = NULL; /* Randomly generated salt */
const char *cmd = NULL; /* command passed to crypt */
const char *hash = NULL; /* password hash generated by crypt */
int algorithm = 0; /* crypt hash algorithm number */
int rounds = 0; /* The number of hash rounds */
DATA_BLOB *hash_blob = NULL;
TALLOC_CTX *frame = talloc_stackframe();
#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN)
struct crypt_data crypt_data = {
.initialized = 0 /* working storage used by crypt */
};
#endif
/* Generate a random password salt */
salt = generate_random_str_list(frame,
SHA_SALT_SIZE,
SHA_SALT_PERMITTED_CHARS);
if (salt == NULL) {
TALLOC_FREE(frame);
return ldb_oom(ldb);
}
/* determine the hashing algorithm and number of rounds*/
if (!parse_scheme(scheme, &algorithm, &rounds)) {
ldb_asprintf_errstring(
ldb,
"setup_primary_userPassword: Invalid scheme of [%s] "
"specified for 'password hash userPassword schemes' in "
"samba.conf",
scheme);
TALLOC_FREE(frame);
return LDB_ERR_OPERATIONS_ERROR;
}
hash_value->scheme = talloc_strdup(ctx, CRYPT);
if (hash_value->scheme == NULL) {
TALLOC_FREE(frame);
return ldb_oom(ldb);
}
hash_value->scheme_len = strlen(CRYPT) + 1;
/* generate the id/salt parameter used by crypt */
if (rounds) {
cmd = talloc_asprintf(frame,
"$%d$rounds=%d$%s",
algorithm,
rounds,
salt);
if (cmd == NULL) {
TALLOC_FREE(frame);
return ldb_oom(ldb);
}
} else {
cmd = talloc_asprintf(frame, "$%d$%s", algorithm, salt);
if (cmd == NULL) {
TALLOC_FREE(frame);
return ldb_oom(ldb);
}
}
/*
* Relies on the assertion that cleartext_utf8->data is a zero
* terminated UTF-8 string
*/
/*
* crypt_r() and crypt() may return a null pointer upon error
* depending on how libcrypt was configured, so we prefer
* crypt_rn() from libcrypt / libxcrypt which always returns
* NULL on error.
*
* POSIX specifies returning a null pointer and setting
* errno.
*
* RHEL 7 (which does not use libcrypt / libxcrypt) returns a
* non-NULL pointer from crypt_r() on success but (always?)
* sets errno during internal processing in the NSS crypto
* subsystem.
*
* By preferring crypt_rn we avoid the 'return non-NULL but
* set-errno' that we otherwise cannot tell apart from the
* RHEL 7 behaviour.
*/
errno = 0;
#ifdef HAVE_CRYPT_RN
hash = crypt_rn((char *)io->n.cleartext_utf8->data,
cmd,
&crypt_data,
sizeof(crypt_data));
#elif HAVE_CRYPT_R
hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data);
#else
/*
* No crypt_r falling back to crypt, which is NOT thread safe
* Thread safety MT-Unsafe race:crypt
*/
hash = crypt((char *)io->n.cleartext_utf8->data, cmd);
#endif
/*
* On error, crypt() and crypt_r() may return a null pointer,
* or a pointer to an invalid hash beginning with a '*'.
*/
if (hash == NULL || hash[0] == '*') {
char buf[1024];
const char *reason = NULL;
if (errno == ERANGE) {
reason = "Password exceeds maximum length allowed for crypt() hashing";
} else {
int err = strerror_r(errno, buf, sizeof(buf));
if (err == 0) {
reason = buf;
} else {
reason = "Unknown error";
}
}
ldb_asprintf_errstring(
ldb,
"setup_primary_userPassword: generation of a %s "
"password hash failed: (%s)",
scheme,
reason);
TALLOC_FREE(frame);
return LDB_ERR_OPERATIONS_ERROR;
}
hash_blob = talloc_zero(ctx, DATA_BLOB);
if (hash_blob == NULL) {
TALLOC_FREE(frame);
return ldb_oom(ldb);
}
*hash_blob = data_blob_talloc(hash_blob,
(const uint8_t *)hash,
strlen(hash));
if (hash_blob->data == NULL) {
TALLOC_FREE(frame);
return ldb_oom(ldb);
}
hash_value->value = hash_blob;
TALLOC_FREE(frame);
return LDB_SUCCESS;
}
/*
* Calculate the desired extra password hashes
*/
static int setup_primary_userPassword(
struct setup_password_fields_io *io,
const struct supplementalCredentialsBlob *old_scb,
struct package_PrimaryUserPasswordBlob *p_userPassword_b)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
TALLOC_CTX *frame = talloc_stackframe();
int i;
int ret;
/*
* Save the current nt_hash, use this to determine if the password
* has been changed by windows. Which will invalidate the userPassword
* hash. Note once NTLM-Strong-NOWTF becomes available it should be
* used in preference to the NT password hash
*/
if (io->g.nt_hash == NULL) {
/*
* When the NT hash is not available, we use this field to store
* the first 16 bytes of the AES256 key instead. This allows
* 'samba-tool user' to verify that the user's password is in
* sync with the userPassword package.
*/
uint8_t hash_len = MIN(16, io->g.aes_256.length);
ZERO_STRUCT(p_userPassword_b->current_nt_hash);
memcpy(p_userPassword_b->current_nt_hash.hash,
io->g.aes_256.data,
hash_len);
} else {
p_userPassword_b->current_nt_hash = *io->g.nt_hash;
}
/*
* Determine the number of hashes
* Note: that currently there is no limit on the number of hashes
* no checking is done on the number of schemes specified
* or for uniqueness.
*/
p_userPassword_b->num_hashes = 0;
for (i = 0; io->ac->userPassword_schemes[i]; i++) {
p_userPassword_b->num_hashes++;
}
p_userPassword_b->hashes
= talloc_array(io->ac,
struct package_PrimaryUserPasswordValue,
p_userPassword_b->num_hashes);
if (p_userPassword_b->hashes == NULL) {
TALLOC_FREE(frame);
return ldb_oom(ldb);
}
for (i = 0; io->ac->userPassword_schemes[i]; i++) {
ret = setup_primary_userPassword_hash(
p_userPassword_b->hashes,
io,
io->ac->userPassword_schemes[i],
&p_userPassword_b->hashes[i]);
if (ret != LDB_SUCCESS) {
TALLOC_FREE(frame);
return ret;
}
}
TALLOC_FREE(frame);
return LDB_SUCCESS;
}
static int setup_primary_samba_gpg(struct setup_password_fields_io *io,
struct package_PrimarySambaGPGBlob *pgb)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
#ifdef ENABLE_GPGME
gpgme_error_t gret;
gpgme_ctx_t ctx = NULL;
size_t num_keys = str_list_length(io->ac->gpg_key_ids);
gpgme_key_t keys[num_keys+1];
size_t ki = 0;
size_t kr = 0;
gpgme_data_t plain_data = NULL;
gpgme_data_t crypt_data = NULL;
size_t crypt_length = 0;
char *crypt_mem = NULL;
gret = gpgme_new(&ctx);
if (gret != GPG_ERR_NO_ERROR) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"%s:%s: gret[%u] %s\n",
__location__, __func__,
gret, gpgme_strerror(gret));
return ldb_module_operr(io->ac->module);
}
gpgme_set_armor(ctx, 1);
gret = gpgme_data_new_from_mem(&plain_data,
(const char *)io->n.cleartext_utf16->data,
io->n.cleartext_utf16->length,
0 /* no copy */);
if (gret != GPG_ERR_NO_ERROR) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"%s:%s: gret[%u] %s\n",
__location__, __func__,
gret, gpgme_strerror(gret));
gpgme_release(ctx);
return ldb_module_operr(io->ac->module);
}
gret = gpgme_data_new(&crypt_data);
if (gret != GPG_ERR_NO_ERROR) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"%s:%s: gret[%u] %s\n",
__location__, __func__,
gret, gpgme_strerror(gret));
gpgme_data_release(plain_data);
gpgme_release(ctx);
return ldb_module_operr(io->ac->module);
}
for (ki = 0; ki < num_keys; ki++) {
const char *key_id = io->ac->gpg_key_ids[ki];
size_t len = strlen(key_id);
keys[ki] = NULL;
if (len < 16) {
ldb_debug(ldb, LDB_DEBUG_FATAL,
"%s:%s: ki[%zu] key_id[%s] strlen < 16, "
"please specify at least the 64bit key id\n",
__location__, __func__,
ki, key_id);
for (kr = 0; keys[kr] != NULL; kr++) {
gpgme_key_release(keys[kr]);
}
gpgme_data_release(crypt_data);
gpgme_data_release(plain_data);
gpgme_release(ctx);
return ldb_module_operr(io->ac->module);
}
gret = gpgme_get_key(ctx, key_id, &keys[ki], 0 /* public key */);
if (gret != GPG_ERR_NO_ERROR) {
keys[ki] = NULL;
if (gpg_err_source(gret) == GPG_ERR_SOURCE_GPGME
&& gpg_err_code(gret) == GPG_ERR_EOF) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"Invalid "
"'password hash gpg key ids': "
"Public Key ID [%s] "
"not found in keyring\n",
key_id);
} else {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"%s:%s: ki[%zu] key_id[%s] "
"gret[%u] %s\n",
__location__, __func__,
ki, key_id,
gret, gpgme_strerror(gret));
}
for (kr = 0; keys[kr] != NULL; kr++) {
gpgme_key_release(keys[kr]);
}
gpgme_data_release(crypt_data);
gpgme_data_release(plain_data);
gpgme_release(ctx);
return ldb_module_operr(io->ac->module);
}
}
keys[ki] = NULL;
gret = gpgme_op_encrypt(ctx, keys,
GPGME_ENCRYPT_ALWAYS_TRUST,
plain_data, crypt_data);
gpgme_data_release(plain_data);
plain_data = NULL;
for (kr = 0; keys[kr] != NULL; kr++) {
gpgme_key_release(keys[kr]);
keys[kr] = NULL;
}
gpgme_release(ctx);
ctx = NULL;
if (gret != GPG_ERR_NO_ERROR) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"%s:%s: gret[%u] %s\n",
__location__, __func__,
gret, gpgme_strerror(gret));
gpgme_data_release(crypt_data);
return ldb_module_operr(io->ac->module);
}
crypt_mem = gpgme_data_release_and_get_mem(crypt_data, &crypt_length);
crypt_data = NULL;
if (crypt_mem == NULL) {
return ldb_module_oom(io->ac->module);
}
pgb->gpg_blob = data_blob_talloc(io->ac,
(const uint8_t *)crypt_mem,
crypt_length);
gpgme_free(crypt_mem);
crypt_mem = NULL;
crypt_length = 0;
if (pgb->gpg_blob.data == NULL) {
return ldb_module_oom(io->ac->module);
}
return LDB_SUCCESS;
#else /* ENABLE_GPGME */
ldb_debug_set(ldb, LDB_DEBUG_FATAL,
"You configured 'password hash gpg key ids', "
"but GPGME support is missing. (%s:%d)",
__FILE__, __LINE__);
return LDB_ERR_UNWILLING_TO_PERFORM;
#endif /* else ENABLE_GPGME */
}
#define NUM_PACKAGES 6
static int setup_supplemental_field(struct setup_password_fields_io *io)
{
struct ldb_context *ldb;
struct supplementalCredentialsBlob scb = {};
struct supplementalCredentialsBlob *old_scb = NULL;
/*
* Packages +
* ( Kerberos-Newer-Keys, Kerberos,
* WDigest, CLEARTEXT, userPassword, SambaGPG)
*/
uint32_t num_names = 0;
const char *names[1+NUM_PACKAGES] = {};
uint32_t num_packages = 0;
struct supplementalCredentialsPackage packages[1+NUM_PACKAGES] = {};
struct supplementalCredentialsPackage *pp = packages;
int ret;
enum ndr_err_code ndr_err;
bool do_newer_keys = false;
bool do_cleartext = false;
bool do_samba_gpg = false;
struct loadparm_context *lp_ctx = NULL;
ldb = ldb_module_get_ctx(io->ac->module);
lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
struct loadparm_context);
if (!io->n.cleartext_utf8) {
/*
* when we don't have a cleartext password
* we can't setup a supplementalCredentials value
*/
return LDB_SUCCESS;
}
/* if there's an old supplementalCredentials blob then use it */
if (io->o.supplemental) {
if (io->o.scb.sub.signature == SUPPLEMENTAL_CREDENTIALS_SIGNATURE) {
old_scb = &io->o.scb;
} else {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"setup_supplemental_field: "
"supplementalCredentialsBlob "
"signature[0x%04X] expected[0x%04X]",
io->o.scb.sub.signature,
SUPPLEMENTAL_CREDENTIALS_SIGNATURE);
}
}
/* Per MS-SAMR 3.1.1.8.11.6 we create AES keys if our domain functionality level is 2008 or higher */
/*
* The ordering is this
*
* Primary:Kerberos-Newer-Keys (optional)
* Primary:Kerberos
* Primary:WDigest
* Primary:CLEARTEXT (optional)
* Primary:userPassword
* Primary:SambaGPG (optional)
*
* And the 'Packages' package is insert before the last
* other package.
*
* Note: it's important that Primary:SambaGPG is added as
* the last element. This is the indication that it matches
* the current password. When a password change happens on
* a Windows DC, it will keep the old Primary:SambaGPG value,
* but as the first element.
*/
do_newer_keys = (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008);
if (do_newer_keys) {
struct package_PrimaryKerberosBlob pknb;
DATA_BLOB pknb_blob;
char *pknb_hexstr;
/*
* setup 'Primary:Kerberos-Newer-Keys' element
*/
names[num_names++] = "Kerberos-Newer-Keys";
ret = setup_primary_kerberos_newer(io, old_scb, &pknb);
if (ret != LDB_SUCCESS) {
return ret;
}
ndr_err = ndr_push_struct_blob(
&pknb_blob, io->ac,
&pknb,
(ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(
ldb,
"setup_supplemental_field: "
"failed to push "
"package_PrimaryKerberosNeverBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
pknb_hexstr = data_blob_hex_string_upper(io->ac, &pknb_blob);
if (!pknb_hexstr) {
return ldb_oom(ldb);
}
pp->name = "Primary:Kerberos-Newer-Keys";
pp->reserved = 1;
pp->data = pknb_hexstr;
pp++;
num_packages++;
}
{
/*
* setup 'Primary:Kerberos' element
*/
/* Primary:Kerberos */
struct package_PrimaryKerberosBlob pkb;
DATA_BLOB pkb_blob;
char *pkb_hexstr;
names[num_names++] = "Kerberos";
ret = setup_primary_kerberos(io, old_scb, &pkb);
if (ret != LDB_SUCCESS) {
return ret;
}
ndr_err = ndr_push_struct_blob(
&pkb_blob, io->ac,
&pkb,
(ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(
ldb,
"setup_supplemental_field: "
"failed to push package_PrimaryKerberosBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
pkb_hexstr = data_blob_hex_string_upper(io->ac, &pkb_blob);
if (!pkb_hexstr) {
return ldb_oom(ldb);
}
pp->name = "Primary:Kerberos";
pp->reserved = 1;
pp->data = pkb_hexstr;
pp++;
num_packages++;
}
if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_ALLOWED) {
/*
* setup 'Primary:WDigest' element
*/
struct package_PrimaryWDigestBlob pdb;
DATA_BLOB pdb_blob;
char *pdb_hexstr;
names[num_names++] = "WDigest";
ret = setup_primary_wdigest(io, old_scb, &pdb);
if (ret != LDB_SUCCESS) {
return ret;
}
ndr_err = ndr_push_struct_blob(
&pdb_blob, io->ac,
&pdb,
(ndr_push_flags_fn_t)ndr_push_package_PrimaryWDigestBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(
ldb,
"setup_supplemental_field: "
"failed to push package_PrimaryWDigestBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
pdb_hexstr = data_blob_hex_string_upper(io->ac, &pdb_blob);
if (!pdb_hexstr) {
return ldb_oom(ldb);
}
pp->name = "Primary:WDigest";
pp->reserved = 1;
pp->data = pdb_hexstr;
pp++;
num_packages++;
}
/*
* setup 'Primary:CLEARTEXT' element
*/
if (io->ac->status->domain_data.store_cleartext &&
(io->u.userAccountControl & UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED)) {
do_cleartext = true;
}
if (do_cleartext) {
struct package_PrimaryCLEARTEXTBlob pcb;
DATA_BLOB pcb_blob;
char *pcb_hexstr;
names[num_names++] = "CLEARTEXT";
pcb.cleartext = *io->n.cleartext_utf16;
ndr_err = ndr_push_struct_blob(
&pcb_blob, io->ac,
&pcb,
(ndr_push_flags_fn_t)ndr_push_package_PrimaryCLEARTEXTBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(
ldb,
"setup_supplemental_field: "
"failed to push package_PrimaryCLEARTEXTBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
pcb_hexstr = data_blob_hex_string_upper(io->ac, &pcb_blob);
if (!pcb_hexstr) {
return ldb_oom(ldb);
}
pp->name = "Primary:CLEARTEXT";
pp->reserved = 1;
pp->data = pcb_hexstr;
pp++;
num_packages++;
}
/*
* Don't generate crypt() or similar password for the krbtgt account.
* It's unnecessary, and the length of the cleartext in UTF-8 form
* exceeds the maximum (CRYPT_MAX_PASSPHRASE_SIZE) allowed by crypt().
*/
if (io->ac->userPassword_schemes && !io->u.is_krbtgt) {
/*
* setup 'Primary:userPassword' element
*/
struct package_PrimaryUserPasswordBlob
p_userPassword_b;
DATA_BLOB p_userPassword_b_blob;
char *p_userPassword_b_hexstr;
names[num_names++] = "userPassword";
ret = setup_primary_userPassword(io,
old_scb,
&p_userPassword_b);
if (ret != LDB_SUCCESS) {
return ret;
}
ndr_err = ndr_push_struct_blob(
&p_userPassword_b_blob,
io->ac,
&p_userPassword_b,
(ndr_push_flags_fn_t)
ndr_push_package_PrimaryUserPasswordBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(
ldb,
"setup_supplemental_field: failed to push "
"package_PrimaryUserPasswordBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
p_userPassword_b_hexstr
= data_blob_hex_string_upper(
io->ac,
&p_userPassword_b_blob);
if (!p_userPassword_b_hexstr) {
return ldb_oom(ldb);
}
pp->name = "Primary:userPassword";
pp->reserved = 1;
pp->data = p_userPassword_b_hexstr;
pp++;
num_packages++;
}
/*
* setup 'Primary:SambaGPG' element
*/
if (io->ac->gpg_key_ids != NULL) {
do_samba_gpg = true;
}
if (do_samba_gpg) {
struct package_PrimarySambaGPGBlob pgb;
DATA_BLOB pgb_blob;
char *pgb_hexstr;
names[num_names++] = "SambaGPG";
ret = setup_primary_samba_gpg(io, &pgb);
if (ret != LDB_SUCCESS) {
return ret;
}
ndr_err = ndr_push_struct_blob(&pgb_blob, io->ac, &pgb,
(ndr_push_flags_fn_t)ndr_push_package_PrimarySambaGPGBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(ldb,
"setup_supplemental_field: failed to "
"push package_PrimarySambaGPGBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
pgb_hexstr = data_blob_hex_string_upper(io->ac, &pgb_blob);
if (!pgb_hexstr) {
return ldb_oom(ldb);
}
pp->name = "Primary:SambaGPG";
pp->reserved = 1;
pp->data = pgb_hexstr;
pp++;
num_packages++;
}
/*
* setup 'Packages' element
*/
{
struct package_PackagesBlob pb;
DATA_BLOB pb_blob;
char *pb_hexstr;
pb.names = names;
ndr_err = ndr_push_struct_blob(
&pb_blob, io->ac,
&pb,
(ndr_push_flags_fn_t)ndr_push_package_PackagesBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(
ldb,
"setup_supplemental_field: "
"failed to push package_PackagesBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
pb_hexstr = data_blob_hex_string_upper(io->ac, &pb_blob);
if (!pb_hexstr) {
return ldb_oom(ldb);
}
pp->name = "Packages";
pp->reserved = 2;
pp->data = pb_hexstr;
num_packages++;
/*
* We don't increment pp so it's pointing to the last package
*/
}
/*
* setup 'supplementalCredentials' value
*/
{
/*
* The 'Packages' element needs to be the second last element
* in supplementalCredentials
*/
struct supplementalCredentialsPackage temp;
struct supplementalCredentialsPackage *prev;
prev = pp-1;
temp = *prev;
*prev = *pp;
*pp = temp;
scb.sub.signature = SUPPLEMENTAL_CREDENTIALS_SIGNATURE;
scb.sub.num_packages = num_packages;
scb.sub.packages = packages;
ndr_err = ndr_push_struct_blob(
&io->g.supplemental, io->ac,
&scb,
(ndr_push_flags_fn_t)ndr_push_supplementalCredentialsBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(
ldb,
"setup_supplemental_field: "
"failed to push supplementalCredentialsBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
}
return LDB_SUCCESS;
}
static int setup_last_set_field(struct setup_password_fields_io *io)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
const struct ldb_message *msg = NULL;
struct timeval tv = { .tv_sec = 0 };
const struct ldb_val *old_val = NULL;
const struct ldb_val *new_val = NULL;
int ret;
switch (io->ac->req->operation) {
case LDB_ADD:
msg = io->ac->req->op.add.message;
break;
case LDB_MODIFY:
msg = io->ac->req->op.mod.message;
break;
default:
return LDB_ERR_OPERATIONS_ERROR;
break;
}
if (io->ac->pwd_last_set_bypass) {
struct ldb_message_element *el = NULL;
size_t i;
size_t count = 0;
/*
* This is a message from pdb_samba_dsdb_replace_by_sam()
*
* We want to ensure there is only one pwdLastSet element, and
* it isn't deleting.
*/
if (msg == NULL) {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
for (i = 0; i < msg->num_elements; i++) {
if (ldb_attr_cmp(msg->elements[i].name,
"pwdLastSet") == 0) {
count++;
el = &msg->elements[i];
}
}
if (count != 1) {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
io->g.last_set = samdb_result_nttime(msg, "pwdLastSet", 0);
return LDB_SUCCESS;
}
ret = msg_find_old_and_new_pwd_val(msg, "pwdLastSet",
io->ac->req->operation,
&new_val, &old_val);
if (ret != LDB_SUCCESS) {
return ret;
}
if (old_val != NULL && new_val == NULL) {
ldb_set_errstring(ldb,
"'pwdLastSet' deletion is not allowed!");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
io->g.last_set = UINT64_MAX;
if (new_val != NULL) {
struct ldb_message *tmp_msg = NULL;
tmp_msg = ldb_msg_new(io->ac);
if (tmp_msg == NULL) {
return ldb_module_oom(io->ac->module);
}
if (old_val != NULL) {
NTTIME old_last_set = 0;
ret = ldb_msg_add_value(tmp_msg, "oldval",
old_val, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
old_last_set = samdb_result_nttime(tmp_msg,
"oldval",
1);
if (io->u.pwdLastSet != old_last_set) {
return dsdb_module_werror(io->ac->module,
LDB_ERR_NO_SUCH_ATTRIBUTE,
WERR_DS_CANT_REM_MISSING_ATT_VAL,
"setup_last_set_field: old pwdLastSet "
"value not found!");
}
}
ret = ldb_msg_add_value(tmp_msg, "newval",
new_val, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
io->g.last_set = samdb_result_nttime(tmp_msg,
"newval",
1);
} else if (ldb_msg_find_element(msg, "pwdLastSet")) {
ldb_set_errstring(ldb,
"'pwdLastSet' deletion is not allowed!");
return LDB_ERR_UNWILLING_TO_PERFORM;
} else if (io->ac->smartcard_reset) {
/*
* adding UF_SMARTCARD_REQUIRED doesn't update
* pwdLastSet implicitly.
*/
io->ac->update_lastset = false;
}
/* only 0 or -1 (0xFFFFFFFFFFFFFFFF) are allowed */
switch (io->g.last_set) {
case 0:
if (!io->ac->pwd_last_set_default) {
break;
}
if (!io->ac->update_password) {
break;
}
FALL_THROUGH;
case UINT64_MAX:
if (!io->ac->update_password &&
io->u.pwdLastSet != 0 &&
io->u.pwdLastSet != UINT64_MAX)
{
/*
* Just setting pwdLastSet to -1, while not changing
* any password field has no effect if pwdLastSet
* is already non-zero.
*/
io->ac->update_lastset = false;
break;
}
/* -1 means set it as now */
GetTimeOfDay(&tv);
io->g.last_set = timeval_to_nttime(&tv);
break;
default:
return dsdb_module_werror(io->ac->module,
LDB_ERR_OTHER,
WERR_INVALID_PARAMETER,
"setup_last_set_field: "
"pwdLastSet must be 0 or -1 only!");
}
if (io->ac->req->operation == LDB_ADD) {
/*
* We always need to store the value on add
* operations.
*/
return LDB_SUCCESS;
}
if (io->g.last_set == io->u.pwdLastSet) {
/*
* Just setting pwdLastSet to 0, is no-op if it's already 0.
*/
io->ac->update_lastset = false;
}
return LDB_SUCCESS;
}
static int setup_given_passwords(struct setup_password_fields_io *io,
struct setup_password_fields_given *g)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
if (g->cleartext_utf8) {
struct ldb_val *cleartext_utf16_blob;
cleartext_utf16_blob = talloc(io->ac, struct ldb_val);
if (!cleartext_utf16_blob) {
return ldb_oom(ldb);
}
if (!convert_string_talloc(io->ac,
CH_UTF8, CH_UTF16,
g->cleartext_utf8->data,
g->cleartext_utf8->length,
&cleartext_utf16_blob->data,
&cleartext_utf16_blob->length)) {
if (g->cleartext_utf8->length != 0) {
talloc_free(cleartext_utf16_blob);
ldb_asprintf_errstring(ldb,
"setup_password_fields: "
"failed to generate UTF16 password from cleartext UTF8 one for user '%s'!",
io->u.sAMAccountName);
return LDB_ERR_CONSTRAINT_VIOLATION;
} else {
/* passwords with length "0" are valid! */
cleartext_utf16_blob->data = NULL;
cleartext_utf16_blob->length = 0;
}
}
g->cleartext_utf16 = cleartext_utf16_blob;
} else if (g->cleartext_utf16) {
struct ldb_val *cleartext_utf8_blob;
cleartext_utf8_blob = talloc(io->ac, struct ldb_val);
if (!cleartext_utf8_blob) {
return ldb_oom(ldb);
}
if (!convert_string_talloc(io->ac,
CH_UTF16MUNGED, CH_UTF8,
g->cleartext_utf16->data,
g->cleartext_utf16->length,
&cleartext_utf8_blob->data,
&cleartext_utf8_blob->length)) {
if (g->cleartext_utf16->length != 0) {
/* We must bail out here, the input wasn't even
* a multiple of 2 bytes */
talloc_free(cleartext_utf8_blob);
ldb_asprintf_errstring(ldb,
"setup_password_fields: "
"failed to generate UTF8 password from cleartext UTF 16 one for user '%s' - the latter had odd length (length must be a multiple of 2)!",
io->u.sAMAccountName);
return LDB_ERR_CONSTRAINT_VIOLATION;
} else {
/* passwords with length "0" are valid! */
cleartext_utf8_blob->data = NULL;
cleartext_utf8_blob->length = 0;
}
}
g->cleartext_utf8 = cleartext_utf8_blob;
}
if (g->cleartext_utf16) {
struct samr_Password *nt_hash;
nt_hash = talloc(io->ac, struct samr_Password);
if (!nt_hash) {
return ldb_oom(ldb);
}
g->nt_hash = nt_hash;
/* compute the new nt hash */
mdfour(nt_hash->hash,
g->cleartext_utf16->data,
g->cleartext_utf16->length);
}
/*
* We need to build one more hash, so we can compare with what might
* have been stored in the old password (for the LDAP password change)
*
* We don't have any old salts, so we won't catch password reuse if said
* password was used prior to an account rename and another password
* change.
*
* We don't have to store the 'opaque' (string2key iterations)
* as Heimdal doesn't allow that to be changed.
*/
if (g->cleartext_utf8 != NULL) {
int ret = setup_kerberos_key_hash(io, g);
if (ret != LDB_SUCCESS) {
return ret;
}
}
return LDB_SUCCESS;
}
static int setup_password_fields(struct setup_password_fields_io *io)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
int ret;
ret = setup_last_set_field(io);
if (ret != LDB_SUCCESS) {
return ret;
}
if (!io->ac->update_password) {
return LDB_SUCCESS;
}
if (io->u.is_krbtgt) {
size_t min = 196;
size_t max = 255;
size_t diff = max - min;
size_t len = max;
struct ldb_val *krbtgt_utf16 = NULL;
if (!io->ac->pwd_reset) {
return dsdb_module_werror(io->ac->module,
LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS,
WERR_DS_ATT_ALREADY_EXISTS,
"Password change on krbtgt not permitted!");
}
if (io->n.cleartext_utf16 == NULL) {
return dsdb_module_werror(io->ac->module,
LDB_ERR_UNWILLING_TO_PERFORM,
WERR_DS_INVALID_ATTRIBUTE_SYNTAX,
"Password reset on krbtgt requires UTF16!");
}
/*
* Instead of taking the callers value,
* we just generate a new random value here.
*
* Include null termination in the array.
*/
if (diff > 0) {
size_t tmp;
generate_random_buffer((uint8_t *)&tmp, sizeof(tmp));
tmp %= diff;
len = min + tmp;
}
krbtgt_utf16 = talloc_zero(io->ac, struct ldb_val);
if (krbtgt_utf16 == NULL) {
return ldb_oom(ldb);
}
*krbtgt_utf16 = data_blob_talloc_zero(krbtgt_utf16,
(len+1)*2);
if (krbtgt_utf16->data == NULL) {
return ldb_oom(ldb);
}
krbtgt_utf16->length = len * 2;
generate_secret_buffer(krbtgt_utf16->data,
krbtgt_utf16->length);
io->n.cleartext_utf16 = krbtgt_utf16;
}
/* transform the old password (for password changes) */
ret = setup_given_passwords(io, &io->og);
if (ret != LDB_SUCCESS) {
return ret;
}
/* transform the new password */
ret = setup_given_passwords(io, &io->n);
if (ret != LDB_SUCCESS) {
return ret;
}
if (io->n.cleartext_utf8) {
ret = setup_kerberos_keys(io);
if (ret != LDB_SUCCESS) {
return ret;
}
}
/*
* This relies on setup_kerberos_keys to make a NT-hash-like
* value for password history purposes
*/
ret = setup_nt_fields(io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = setup_supplemental_field(io);
if (ret != LDB_SUCCESS) {
return ret;
}
return LDB_SUCCESS;
}
static int setup_smartcard_reset(struct setup_password_fields_io *io)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
struct supplementalCredentialsBlob scb = { .__ndr_size = 0 };
enum ndr_err_code ndr_err;
if (!io->ac->smartcard_reset) {
return LDB_SUCCESS;
}
io->g.nt_hash = talloc(io->ac, struct samr_Password);
if (io->g.nt_hash == NULL) {
return ldb_module_oom(io->ac->module);
}
generate_secret_buffer(io->g.nt_hash->hash,
sizeof(io->g.nt_hash->hash));
io->g.nt_history_len = 0;
/*
* We take the "old" value and store it
* with num_packages = 0.
*
* On "add" we have scb.sub.signature == 0, which
* results in:
*
* [0000] 00 00 00 00 00 00 00 00 00 00 00 00 00
*
* On modify it's likely to be scb.sub.signature ==
* SUPPLEMENTAL_CREDENTIALS_SIGNATURE (0x0050), which results in
* something like:
*
* [0000] 00 00 00 00 62 00 00 00 00 00 00 00 20 00 20 00
* [0010] 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00
* [0020] 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00
* [0030] 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00
* [0040] 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00
* [0050] 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00
* [0060] 20 00 20 00 20 00 20 00 20 00 20 00 50 00 00
*
* See https://bugzilla.samba.org/show_bug.cgi?id=11441
* and ndr_{push,pull}_supplementalCredentialsSubBlob().
*/
scb = io->o.scb;
scb.sub.num_packages = 0;
/*
* setup 'supplementalCredentials' value without packages
*/
ndr_err = ndr_push_struct_blob(&io->g.supplemental, io->ac,
&scb,
(ndr_push_flags_fn_t)ndr_push_supplementalCredentialsBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(ldb,
"setup_smartcard_reset: "
"failed to push supplementalCredentialsBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
io->ac->update_password = true;
return LDB_SUCCESS;
}
static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io, WERROR *werror)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
struct ldb_message *mod_msg = NULL;
struct ldb_message *pso_msg = NULL;
struct ldb_message *current = NULL;
NTSTATUS status = NT_STATUS_OK;
int ret; /* The errors we will actually return */
int dbg_ret; /* The errors we can only complain about in logs */
/*
* OK, horrible semantics ahead.
*
* - We need to abort any existing transaction
* - create a transaction around the badPwdCount update
* - re-open the transaction so the upper layer
* doesn't know what happened.
*
* This is needed because returning an error to the upper
* layer will cancel the transaction and undo the badPwdCount
* update.
*/
/*
* Checking errors here is a bit pointless.
* What can we do if we can't end the transaction?
*/
dbg_ret = ldb_next_del_trans(io->ac->module);
if (dbg_ret != LDB_SUCCESS) {
ldb_debug(ldb, LDB_DEBUG_FATAL,
"Failed to abort transaction prior to update of badPwdCount of %s: %s",
ldb_dn_get_linearized(io->ac->search_res->message->dn),
ldb_errstring(ldb));
/*
* just return the original error
*/
goto done;
}
/* Likewise, what should we do if we can't open a new transaction? */
dbg_ret = ldb_next_start_trans(io->ac->module);
if (dbg_ret != LDB_SUCCESS) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"Failed to open transaction to update badPwdCount of %s: %s",
ldb_dn_get_linearized(io->ac->search_res->message->dn),
ldb_errstring(ldb));
/*
* just return the original error
*/
goto done;
}
/*
* Re-read the account details, using the GUID in case the DN
* is being changed.
*/
status = authsam_reread_user_logon_data(
ldb, io->ac,
io->ac->search_res->message,
&current);
if (!NT_STATUS_IS_OK(status)) {
/* The re-read can return account locked out, as well
* as an internal error
*/
goto end_transaction;
}
/* PSO search result is optional (NULL if no PSO applies) */
if (io->ac->pso_res != NULL) {
pso_msg = io->ac->pso_res->message;
}
status = dsdb_update_bad_pwd_count(io->ac, ldb,
current,
io->ac->dom_res->message,
pso_msg,
&mod_msg);
if (!NT_STATUS_IS_OK(status)) {
goto end_transaction;
}
if (mod_msg == NULL) {
goto end_transaction;
}
dbg_ret = dsdb_module_modify(io->ac->module, mod_msg,
DSDB_FLAG_NEXT_MODULE,
io->ac->req);
if (dbg_ret != LDB_SUCCESS) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"Failed to update badPwdCount of %s: %s",
ldb_dn_get_linearized(io->ac->search_res->message->dn),
ldb_errstring(ldb));
/*
* We can only ignore this...
*/
}
end_transaction:
dbg_ret = ldb_next_end_trans(io->ac->module);
if (dbg_ret != LDB_SUCCESS) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"Failed to close transaction to update badPwdCount of %s: %s",
ldb_dn_get_linearized(io->ac->search_res->message->dn),
ldb_errstring(ldb));
/*
* We can only ignore this...
*/
}
dbg_ret = ldb_next_start_trans(io->ac->module);
if (dbg_ret != LDB_SUCCESS) {
ldb_debug(ldb, LDB_DEBUG_ERROR,
"Failed to open transaction after update of badPwdCount of %s: %s",
ldb_dn_get_linearized(io->ac->search_res->message->dn),
ldb_errstring(ldb));
/*
* We can only ignore this...
*/
}
done:
ret = LDB_ERR_CONSTRAINT_VIOLATION;
if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
*werror = WERR_ACCOUNT_LOCKED_OUT;
} else {
*werror = WERR_INVALID_PASSWORD;
}
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"The old password specified doesn't match!",
W_ERROR_V(*werror),
ldb_strerror(ret));
return ret;
}
static int check_password_restrictions(struct setup_password_fields_io *io, WERROR *werror)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
int ret;
uint32_t i;
struct loadparm_context *lp_ctx =
talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
struct loadparm_context);
struct dsdb_encrypted_connection_state *opaque_connection_state =
ldb_get_opaque(ldb,DSDB_OPAQUE_ENCRYPTED_CONNECTION_STATE_NAME);
*werror = WERR_INVALID_PARAMETER;
if (!io->ac->update_password) {
return LDB_SUCCESS;
}
/*
* Prevent update password on an insecure connection.
* The opaque is added in the ldap backend init.
*/
if (opaque_connection_state != NULL &&
!opaque_connection_state->using_encrypted_connection) {
ret = LDB_ERR_UNWILLING_TO_PERFORM;
*werror = WERR_GEN_FAILURE;
ldb_asprintf_errstring(ldb,
"%08X: SvcErr: DSID-031A126C, "
"problem 5003 (WILL_NOT_PERFORM), "
"data 0\n"
"Password modification over LDAP "
"must be over an encrypted connection",
W_ERROR_V(*werror));
return ret;
}
/*
* First check the old password is correct, for password
* changes when this hasn't already been checked by a
* trustworthy layer above
*/
if (!io->ac->pwd_reset && !(io->ac->change
&& io->ac->change->old_password_checked == DSDB_PASSWORD_CHECKED_AND_CORRECT)) {
bool hash_checked = false;
/*
* we need the old nt hash given by the client (this
* is for the plaintext over LDAP password change,
* Kpasswd and SAMR supply the control)
*/
if (io->og.nt_hash == NULL && io->og.aes_256.length == 0) {
ldb_asprintf_errstring(ldb,
"check_password_restrictions: "
"You need to provide the old password in order "
"to change it!");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/*
* First compare the ENCTYPE_AES256_CTS_HMAC_SHA1_96 password and see if we have a match
*/
if (io->og.aes_256.length > 0 && io->o.aes_256.length) {
hash_checked = data_blob_equal_const_time(&io->og.aes_256, &io->o.aes_256);
}
/* The password modify through the NT hash is encouraged and
has no problems at all */
if (!hash_checked && io->og.nt_hash && io->o.nt_hash) {
hash_checked = mem_equal_const_time(io->og.nt_hash->hash, io->o.nt_hash->hash, 16);
}
if (!hash_checked) {
return make_error_and_update_badPwdCount(io, werror);
}
}
if (io->u.restrictions == 0) {
/* FIXME: Is this right? */
return LDB_SUCCESS;
}
/* Password minimum age: yes, this is a minus. The ages are in negative 100nsec units! */
if ((io->u.pwdLastSet - io->ac->status->domain_data.minPwdAge > io->g.last_set) &&
!io->ac->pwd_reset)
{
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"password is too young to change!",
W_ERROR_V(*werror),
ldb_strerror(ret));
return ret;
}
/*
* Fundamental password checks done by the call
* "samdb_check_password".
* It is also in use by "dcesrv_samr_ValidatePassword".
*/
if (io->n.cleartext_utf8 != NULL) {
enum samr_ValidationStatus vstat;
vstat = samdb_check_password(io->ac, lp_ctx,
io->u.sAMAccountName,
io->u.user_principal_name,
io->u.displayName,
io->n.cleartext_utf8,
io->ac->status->domain_data.pwdProperties,
io->ac->status->domain_data.minPwdLength);
switch (vstat) {
case SAMR_VALIDATION_STATUS_SUCCESS:
/* perfect -> proceed! */
break;
case SAMR_VALIDATION_STATUS_PWD_TOO_SHORT:
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"the password is too short. It should be equal to or longer than %u characters!",
W_ERROR_V(*werror),
ldb_strerror(ret),
io->ac->status->domain_data.minPwdLength);
io->ac->status->reject_reason = SAM_PWD_CHANGE_PASSWORD_TOO_SHORT;
return ret;
case SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH:
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"the password does not meet the complexity criteria!",
W_ERROR_V(*werror),
ldb_strerror(ret));
io->ac->status->reject_reason = SAM_PWD_CHANGE_NOT_COMPLEX;
return ret;
default:
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"the password doesn't fit due to a miscellaneous restriction!",
W_ERROR_V(*werror),
ldb_strerror(ret));
return ret;
}
}
if (io->ac->pwd_reset) {
*werror = WERR_OK;
return LDB_SUCCESS;
}
/*
* This check works by using the current Kerberos password to
* make up a password history. We already did the salted hash
* creation to pass the password change check.
*
* We check the pwdHistoryLength to ensure we honour the
* policy on if the history should be checked
*/
if (io->ac->status->domain_data.pwdHistoryLength > 0
&& io->g.aes_256.length && io->o.aes_256.length)
{
bool equal = data_blob_equal_const_time(&io->g.aes_256,
&io->o.aes_256);
if (equal) {
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"the password was already used (previous password)!",
W_ERROR_V(*werror),
ldb_strerror(ret));
io->ac->status->reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
return ret;
}
}
if (io->n.nt_hash) {
/*
* checks the NT hash password history, against the
* generated NT hash
*/
for (i = 0; i < io->o.nt_history_len; i++) {
bool pw_cmp = mem_equal_const_time(io->n.nt_hash, io->o.nt_history[i].hash, 16);
if (pw_cmp) {
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"the password was already used (in history)!",
W_ERROR_V(*werror),
ldb_strerror(ret));
io->ac->status->reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
return ret;
}
}
}
/*
* This check works by using the old Kerberos passwords
* (old and older) to make up a password history.
*
* We check the pwdHistoryLength to ensure we honour the
* policy on if the history should be checked
*/
for (i = 1;
i <= io->o.kvno && i < MIN(3, io->ac->status->domain_data.pwdHistoryLength);
i++)
{
krb5_error_code krb5_ret;
const uint32_t request_kvno = io->o.kvno - i;
DATA_BLOB db_key_blob;
bool pw_equal;
if (io->n.cleartext_utf8 == NULL) {
/*
* No point checking history if we don't have
* a cleartext password.
*/
break;
}
if (io->ac->search_res == NULL) {
/*
* This is an ADD, no existing history to check
*/
break;
}
/*
* If this account requires a smartcard for login, we don't
* attempt a comparison with the old password.
*/
if (io->u.userAccountControl & UF_SMARTCARD_REQUIRED) {
break;
}
/*
* Extract the old ENCTYPE_AES256_CTS_HMAC_SHA1_96 value from
* the supplementalCredentials.
*/
krb5_ret = dsdb_extract_aes_256_key(io->smb_krb5_context->krb5_context,
io->ac,
io->ac->search_res->message,
io->u.userAccountControl,
&request_kvno, /* kvno */
NULL, /* kvno_out */
&db_key_blob,
NULL); /* salt */
if (krb5_ret == ENOENT) {
/*
* If there is no old AES hash (perhaps an imported DB with
* just unicodePwd) then we just won't have an old
* password to compare to if there is no NT hash
*/
break;
} else if (krb5_ret) {
ldb_asprintf_errstring(ldb,
"check_password_restrictions: "
"extraction of old[%u - %d = %d] aes256-cts-hmac-sha1-96 key failed: %s",
io->o.kvno, i, io->o.kvno - i,
smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
krb5_ret, io->ac));
return LDB_ERR_OPERATIONS_ERROR;
}
/* This is the actual history check */
pw_equal = data_blob_equal_const_time(&io->n.aes_256,
&db_key_blob);
if (pw_equal) {
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"the password was already used (in history)!",
W_ERROR_V(*werror),
ldb_strerror(ret));
io->ac->status->reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
return ret;
}
}
/* are all password changes disallowed? */
if (io->ac->status->domain_data.pwdProperties & DOMAIN_REFUSE_PASSWORD_CHANGE) {
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"password changes disabled!",
W_ERROR_V(*werror),
ldb_strerror(ret));
return ret;
}
/* can this user change the password? */
if (io->u.userAccountControl & UF_PASSWD_CANT_CHANGE) {
ret = LDB_ERR_CONSTRAINT_VIOLATION;
*werror = WERR_PASSWORD_RESTRICTION;
ldb_asprintf_errstring(ldb,
"%08X: %s - check_password_restrictions: "
"password can't be changed on this account!",
W_ERROR_V(*werror),
ldb_strerror(ret));
return ret;
}
return LDB_SUCCESS;
}
static int check_password_restrictions_and_log(struct setup_password_fields_io *io)
{
WERROR werror;
int ret = check_password_restrictions(io, &werror);
struct ph_context *ac = io->ac;
/*
* Password resets are not authentication events, and if the
* upper layer checked the password and supplied the hash
* values as proof, then this is also not an authentication
* even at this layer (already logged). This is to log LDAP
* password changes.
*/
/* Do not record a failure in the auth log below in the success case */
if (ret == LDB_SUCCESS) {
werror = WERR_OK;
}
if (ac->pwd_reset == false && ac->change == NULL) {
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
struct imessaging_context *msg_ctx;
struct loadparm_context *lp_ctx
= talloc_get_type_abort(ldb_get_opaque(ldb, "loadparm"),
struct loadparm_context);
NTSTATUS status = werror_to_ntstatus(werror);
const char *domain_name = lpcfg_sam_name(lp_ctx);
void *opaque_remote_address = NULL;
/*
* Forcing this via the NTLM auth structure is not ideal, but
* it is the most practical option right now, and ensures the
* logs are consistent, even if some elements are always NULL.
*/
struct auth_usersupplied_info ui = {
.was_mapped = true,
.client = {
.account_name = io->u.sAMAccountName,
.domain_name = domain_name,
},
.mapped = {
.account_name = io->u.sAMAccountName,
.domain_name = domain_name,
},
.service_description = "LDAP Password Change",
.auth_description = "LDAP Modify",
.password_type = "plaintext"
};
opaque_remote_address = ldb_get_opaque(ldb,
"remoteAddress");
if (opaque_remote_address == NULL) {
ldb_asprintf_errstring(ldb,
"Failed to obtain remote address for "
"the LDAP client while changing the "
"password");
return LDB_ERR_OPERATIONS_ERROR;
}
ui.remote_host = talloc_get_type(opaque_remote_address,
struct tsocket_address);
msg_ctx = imessaging_client_init(ac, lp_ctx,
ldb_get_event_context(ldb));
if (!msg_ctx) {
ldb_asprintf_errstring(ldb,
"Failed to generate client messaging context in %s",
lpcfg_imessaging_path(ac, lp_ctx));
return LDB_ERR_OPERATIONS_ERROR;
}
log_authentication_event(msg_ctx,
lp_ctx,
NULL,
&ui,
status,
domain_name,
io->u.sAMAccountName,
io->u.account_sid,
NULL /* client_audit_info */,
NULL /* server_audit_info */);
}
return ret;
}
static int update_final_msg(struct setup_password_fields_io *io)
{
struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
int ret;
int el_flags = 0;
bool update_password = io->ac->update_password;
bool update_scb = io->ac->update_password;
/*
* If we add a user without initial password,
* we need to add replication meta data for
* following attributes:
* - unicodePwd
* - dBCSPwd
* - ntPwdHistory
* - lmPwdHistory
*
* If we add a user with initial password or a
* password is changed of an existing user,
* we need to replace the following attributes
* with a forced meta data update, e.g. also
* when updating an empty attribute with an empty value:
* - unicodePwd
* - dBCSPwd
* - ntPwdHistory
* - lmPwdHistory
* - supplementalCredentials
*/
switch (io->ac->req->operation) {
case LDB_ADD:
update_password = true;
el_flags |= DSDB_FLAG_INTERNAL_FORCE_META_DATA;
break;
case LDB_MODIFY:
el_flags |= LDB_FLAG_MOD_REPLACE;
el_flags |= DSDB_FLAG_INTERNAL_FORCE_META_DATA;
break;
default:
return ldb_module_operr(io->ac->module);
}
if (update_password) {
ret = ldb_msg_add_empty(io->ac->update_msg,
"unicodePwd",
el_flags, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
/*
* This wipes any old LM password after any password
* update operation.
*
* This is the same as the previous default behaviour
* of 'lanman auth = no'
*/
ret = ldb_msg_add_empty(io->ac->update_msg,
"dBCSPwd",
el_flags, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = ldb_msg_add_empty(io->ac->update_msg,
"ntPwdHistory",
el_flags, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
/*
* This wipes any LM password history after any password
* update operation.
*
* This is the same as the previous default behaviour
* of 'lanman auth = no'
*/
ret = ldb_msg_add_empty(io->ac->update_msg,
"lmPwdHistory",
el_flags, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
}
if (update_scb) {
ret = ldb_msg_add_empty(io->ac->update_msg,
"supplementalCredentials",
el_flags, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
}
if (io->ac->update_lastset) {
ret = ldb_msg_add_empty(io->ac->update_msg,
"pwdLastSet",
el_flags, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
}
if (io->g.nt_hash != NULL) {
ret = samdb_msg_add_hash(ldb, io->ac,
io->ac->update_msg,
"unicodePwd",
io->g.nt_hash);
if (ret != LDB_SUCCESS) {
return ret;
}
}
if (io->g.nt_history_len > 0) {
ret = samdb_msg_add_hashes(ldb, io->ac,
io->ac->update_msg,
"ntPwdHistory",
io->g.nt_history,
io->g.nt_history_len);
if (ret != LDB_SUCCESS) {
return ret;
}
}
if (io->g.supplemental.length > 0) {
ret = ldb_msg_add_value(io->ac->update_msg,
"supplementalCredentials",
&io->g.supplemental, NULL);
if (ret != LDB_SUCCESS) {
return ret;
}
}
if (io->ac->update_lastset) {
ret = samdb_msg_add_uint64(ldb, io->ac,
io->ac->update_msg,
"pwdLastSet",
io->g.last_set);
if (ret != LDB_SUCCESS) {
return ret;
}
}
return LDB_SUCCESS;
}
/*
* This is intended for use by the "password_hash" module since there
* password changes can be specified through one message element with the
* new password (to set) and another one with the old password (to unset).
*
* The first which sets a password (new value) can have flags
* (LDB_FLAG_MOD_ADD, LDB_FLAG_MOD_REPLACE) but also none (on "add" operations
* for entries). The latter (old value) has always specified
* LDB_FLAG_MOD_DELETE.
*
* Returns LDB_ERR_CONSTRAINT_VIOLATION and LDB_ERR_UNWILLING_TO_PERFORM if
* matching message elements are malformed in respect to the set/change rules.
* Otherwise it returns LDB_SUCCESS.
*/
static int msg_find_old_and_new_pwd_val(const struct ldb_message *msg,
const char *name,
enum ldb_request_type operation,
const struct ldb_val **new_val,
const struct ldb_val **old_val)
{
unsigned int i;
*new_val = NULL;
*old_val = NULL;
if (msg == NULL) {
return LDB_SUCCESS;
}
for (i = 0; i < msg->num_elements; i++) {
if (ldb_attr_cmp(msg->elements[i].name, name) != 0) {
continue;
}
if ((operation == LDB_MODIFY) &&
(LDB_FLAG_MOD_TYPE(msg->elements[i].flags) == LDB_FLAG_MOD_DELETE)) {
/* 0 values are allowed */
if (msg->elements[i].num_values == 1) {
*old_val = &msg->elements[i].values[0];
} else if (msg->elements[i].num_values > 1) {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
} else if ((operation == LDB_MODIFY) &&
(LDB_FLAG_MOD_TYPE(msg->elements[i].flags) == LDB_FLAG_MOD_REPLACE)) {
if (msg->elements[i].num_values > 0) {
*new_val = &msg->elements[i].values[msg->elements[i].num_values - 1];
} else {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
} else {
/* Add operations and LDB_FLAG_MOD_ADD */
if (msg->elements[i].num_values > 0) {
*new_val = &msg->elements[i].values[msg->elements[i].num_values - 1];
} else {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
}
}
return LDB_SUCCESS;
}
static int setup_io(struct ph_context *ac,
const struct ldb_message *client_msg,
const struct ldb_message *existing_msg,
struct setup_password_fields_io *io)
{
const struct ldb_val *quoted_utf16, *old_quoted_utf16, *lm_hash, *old_lm_hash;
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
struct loadparm_context *lp_ctx = talloc_get_type(
ldb_get_opaque(ldb, "loadparm"), struct loadparm_context);
enum store_nt_hash store_hash_setting =
lpcfg_nt_hash_store(lp_ctx);
int ret;
const struct ldb_message *info_msg = NULL;
struct dom_sid *account_sid = NULL;
int rodc_krbtgt = 0;
*io = (struct setup_password_fields_io) {};
/* Some operations below require kerberos contexts */
if (existing_msg != NULL) {
/*
* This is a modify operation
*/
info_msg = existing_msg;
} else {
/*
* This is an add operation
*/
info_msg = client_msg;
}
ret = smb_krb5_init_context(ac,
(struct loadparm_context *)ldb_get_opaque(ldb, "loadparm"),
&io->smb_krb5_context);
if (ret != 0) {
/*
* In the special case of mit krb5.conf vs heimdal, the includedir
* statement causes ret == 22 (KRB5_CONFIG_BADFORMAT) to be returned.
* We look for this case so that we can give a more instructional
* message to the administrator.
*/
if (ret == KRB5_CONFIG_BADFORMAT || ret == EINVAL) {
ldb_asprintf_errstring(ldb, "Failed to setup krb5_context: %s - "
"This could be due to an invalid krb5 configuration. "
"Please check your system's krb5 configuration is correct.",
error_message(ret));
} else {
ldb_asprintf_errstring(ldb, "Failed to setup krb5_context: %s",
error_message(ret));
}
return LDB_ERR_OPERATIONS_ERROR;
}
io->ac = ac;
io->u.userAccountControl = ldb_msg_find_attr_as_uint(info_msg,
"userAccountControl", 0);
if (info_msg == existing_msg) {
/*
* We only take pwdLastSet from the existing object
* otherwise we leave it as 0.
*
* If no attribute is available, e.g. on deleted objects
* we remember that as UINT64_MAX.
*/
io->u.pwdLastSet = samdb_result_nttime(info_msg, "pwdLastSet",
UINT64_MAX);
}
io->u.sAMAccountName = ldb_msg_find_attr_as_string(info_msg,
"sAMAccountName", NULL);
io->u.user_principal_name = ldb_msg_find_attr_as_string(info_msg,
"userPrincipalName", NULL);
io->u.displayName = ldb_msg_find_attr_as_string(info_msg,
"displayName", NULL);
/* Ensure it has an objectSID too */
io->u.account_sid = samdb_result_dom_sid(ac, info_msg, "objectSid");
if (io->u.account_sid != NULL) {
NTSTATUS status;
uint32_t rid = 0;
status = dom_sid_split_rid(account_sid, io->u.account_sid, NULL, &rid);
if (NT_STATUS_IS_OK(status)) {
if (rid == DOMAIN_RID_KRBTGT) {
io->u.is_krbtgt = true;
}
}
}
rodc_krbtgt = ldb_msg_find_attr_as_int(info_msg,
"msDS-SecondaryKrbTgtNumber", 0);
if (rodc_krbtgt != 0) {
io->u.is_krbtgt = true;
}
if (io->u.sAMAccountName == NULL) {
ldb_asprintf_errstring(ldb,
"setup_io: sAMAccountName attribute is missing on %s for attempted password set/change",
ldb_dn_get_linearized(info_msg->dn));
return LDB_ERR_CONSTRAINT_VIOLATION;
}
if (io->u.userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT) {
struct ldb_control *permit_trust = ldb_request_get_control(ac->req,
DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID);
if (permit_trust == NULL) {
ret = LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
ldb_asprintf_errstring(ldb,
"%08X: %s - setup_io: changing the interdomain trust password "
"on %s not allowed via LDAP. Use LSA or NETLOGON",
W_ERROR_V(WERR_ACCESS_DENIED),
ldb_strerror(ret),
ldb_dn_get_linearized(info_msg->dn));
return ret;
}
}
/* Only non-trust accounts have restrictions (possibly this test is the
* wrong way around, but we like to be restrictive if possible */
io->u.restrictions = !(io->u.userAccountControl & UF_TRUST_ACCOUNT_MASK);
if (io->u.is_krbtgt) {
io->u.restrictions = 0;
io->ac->status->domain_data.pwdHistoryLength =
MAX(io->ac->status->domain_data.pwdHistoryLength, 3);
}
/*
* Machine accounts need the NT hash to operate the NETLOGON
* ServerAuthenticate{,2,3} logic
*/
if (!(io->u.userAccountControl & UF_NORMAL_ACCOUNT)) {
store_hash_setting = NT_HASH_STORE_ALWAYS;
}
switch (store_hash_setting) {
case NT_HASH_STORE_ALWAYS:
io->u.store_nt_hash = true;
break;
case NT_HASH_STORE_NEVER:
io->u.store_nt_hash = false;
break;
case NT_HASH_STORE_AUTO:
if (lpcfg_ntlm_auth(lp_ctx) == NTLM_AUTH_DISABLED) {
io->u.store_nt_hash = false;
break;
}
io->u.store_nt_hash = true;
break;
}
if (ac->userPassword) {
ret = msg_find_old_and_new_pwd_val(client_msg, "userPassword",
ac->req->operation,
&io->n.cleartext_utf8,
&io->og.cleartext_utf8);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the old password once!");
return ret;
}
}
if (io->n.cleartext_utf8 != NULL) {
struct ldb_val *cleartext_utf8_blob;
char *p;
cleartext_utf8_blob = talloc(io->ac, struct ldb_val);
if (!cleartext_utf8_blob) {
return ldb_oom(ldb);
}
*cleartext_utf8_blob = *io->n.cleartext_utf8;
/* make sure we have a null terminated string */
p = talloc_strndup(cleartext_utf8_blob,
(const char *)io->n.cleartext_utf8->data,
io->n.cleartext_utf8->length);
if ((p == NULL) && (io->n.cleartext_utf8->length > 0)) {
return ldb_oom(ldb);
}
cleartext_utf8_blob->data = (uint8_t *)p;
io->n.cleartext_utf8 = cleartext_utf8_blob;
}
ret = msg_find_old_and_new_pwd_val(client_msg, "clearTextPassword",
ac->req->operation,
&io->n.cleartext_utf16,
&io->og.cleartext_utf16);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the old password once!");
return ret;
}
/* this rather strange looking piece of code is there to
handle a ldap client setting a password remotely using the
unicodePwd ldap field. The syntax is that the password is
in UTF-16LE, with a " at either end. Unfortunately the
unicodePwd field is also used to store the nt hashes
internally in Samba, and is used in the nt hash format on
the wire in DRS replication, so we have a single name for
two distinct values. The code below leaves us with a small
chance (less than 1 in 2^32) of a mixup, if someone manages
to create a MD4 hash which starts and ends in 0x22 0x00, as
that would then be treated as a UTF16 password rather than
a nthash */
ret = msg_find_old_and_new_pwd_val(client_msg, "unicodePwd",
ac->req->operation,
&quoted_utf16,
&old_quoted_utf16);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the old password once!");
return ret;
}
/* Checks and converts the actual "unicodePwd" attribute */
if (!ac->hash_values &&
quoted_utf16 &&
quoted_utf16->length >= 4 &&
quoted_utf16->data[0] == '"' &&
quoted_utf16->data[1] == 0 &&
quoted_utf16->data[quoted_utf16->length-2] == '"' &&
quoted_utf16->data[quoted_utf16->length-1] == 0) {
struct ldb_val *quoted_utf16_2;
if (io->n.cleartext_utf16) {
/* refuse the change if someone wants to change with
with both UTF16 possibilities at the same time... */
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the cleartext password as 'unicodePwd' or as 'clearTextPassword'");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/*
* adapt the quoted UTF16 string to be a real
* cleartext one
*/
quoted_utf16_2 = talloc(io->ac, struct ldb_val);
if (quoted_utf16_2 == NULL) {
return ldb_oom(ldb);
}
quoted_utf16_2->data = quoted_utf16->data + 2;
quoted_utf16_2->length = quoted_utf16->length-4;
io->n.cleartext_utf16 = quoted_utf16_2;
io->n.nt_hash = NULL;
} else if (quoted_utf16) {
/* We have only the hash available -> so no plaintext here */
if (!ac->hash_values) {
/* refuse the change if someone wants to change
the hash without control specified... */
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's not allowed to set the NT hash password directly'");
/* this looks odd but this is what Windows does:
returns "UNWILLING_TO_PERFORM" on wrong
password sets and "CONSTRAINT_VIOLATION" on
wrong password changes. */
if (old_quoted_utf16 == NULL) {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
return LDB_ERR_CONSTRAINT_VIOLATION;
}
io->n.nt_hash = talloc(io->ac, struct samr_Password);
if (io->n.nt_hash == NULL) {
return ldb_oom(ldb);
}
memcpy(io->n.nt_hash->hash, quoted_utf16->data,
MIN(quoted_utf16->length, sizeof(io->n.nt_hash->hash)));
}
/* Checks and converts the previous "unicodePwd" attribute */
if (!ac->hash_values &&
old_quoted_utf16 &&
old_quoted_utf16->length >= 4 &&
old_quoted_utf16->data[0] == '"' &&
old_quoted_utf16->data[1] == 0 &&
old_quoted_utf16->data[old_quoted_utf16->length-2] == '"' &&
old_quoted_utf16->data[old_quoted_utf16->length-1] == 0) {
struct ldb_val *old_quoted_utf16_2;
if (io->og.cleartext_utf16) {
/* refuse the change if someone wants to change with
both UTF16 possibilities at the same time... */
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the cleartext password as 'unicodePwd' or as 'clearTextPassword'");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/*
* adapt the quoted UTF16 string to be a real
* cleartext one
*/
old_quoted_utf16_2 = talloc(io->ac, struct ldb_val);
if (old_quoted_utf16_2 == NULL) {
return ldb_oom(ldb);
}
old_quoted_utf16_2->data = old_quoted_utf16->data + 2;
old_quoted_utf16_2->length = old_quoted_utf16->length-4;
io->og.cleartext_utf16 = old_quoted_utf16_2;
io->og.nt_hash = NULL;
} else if (old_quoted_utf16) {
/* We have only the hash available -> so no plaintext here */
if (!ac->hash_values) {
/* refuse the change if someone wants to change
the hash without control specified... */
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's not allowed to set the NT hash password directly'");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
io->og.nt_hash = talloc(io->ac, struct samr_Password);
if (io->og.nt_hash == NULL) {
return ldb_oom(ldb);
}
memcpy(io->og.nt_hash->hash, old_quoted_utf16->data,
MIN(old_quoted_utf16->length, sizeof(io->og.nt_hash->hash)));
}
/* Handles the "dBCSPwd" attribute (LM hash) */
ret = msg_find_old_and_new_pwd_val(client_msg, "dBCSPwd",
ac->req->operation,
&lm_hash, &old_lm_hash);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the old password once!");
return ret;
}
if (((lm_hash != NULL) || (old_lm_hash != NULL))) {
/* refuse the change if someone wants to change the LM hash */
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's not allowed to set the LM hash password (dBCSPwd)'");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/*
* Handles the password change control if it's specified. It has the
* precedence and overrides already specified old password values of
* change requests (but that shouldn't happen since the control is
* fully internal and only used in conjunction with replace requests!).
*/
if (ac->change != NULL) {
io->og.nt_hash = NULL;
}
/* refuse the change if someone wants to change the clear-
text and supply his own hashes at the same time... */
if ((io->n.cleartext_utf8 || io->n.cleartext_utf16)
&& (io->n.nt_hash)) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the password in form of cleartext attributes or as hashes");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/* refuse the change if someone wants to change the password
using both plaintext methods (UTF8 and UTF16) at the same time... */
if (io->n.cleartext_utf8 && io->n.cleartext_utf16) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to set the cleartext password as 'unicodePwd' or as 'userPassword' or as 'clearTextPassword'");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/* refuse the change if someone tries to set/change the password by
* any method that would leave us without a password! */
if (io->ac->update_password
&& (!io->n.cleartext_utf8) && (!io->n.cleartext_utf16)
&& (!io->n.nt_hash)) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"It's not possible to delete the password (changes using the LAN Manager hash alone could be deactivated)!");
/* on "userPassword" and "clearTextPassword" we've to return
* something different, since these are virtual attributes */
if ((ldb_msg_find_element(client_msg, "userPassword") != NULL) ||
(ldb_msg_find_element(client_msg, "clearTextPassword") != NULL)) {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/*
* refuse the change if someone wants to compare against a
* plaintext or dsdb_control_password_change at the same time
* for a "password modify" operation...
*/
if ((io->og.cleartext_utf8 || io->og.cleartext_utf16)
&& ac->change) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to provide the old password in form of cleartext attributes or as the dsdb_control_password_change");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/* refuse the change if someone wants to compare against both
* plaintexts at the same time for a "password modify" operation... */
if (io->og.cleartext_utf8 && io->og.cleartext_utf16) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"it's only allowed to provide the old cleartext password as 'unicodePwd' or as 'userPassword' or as 'clearTextPassword'");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/* Decides if we have a password modify or password reset operation */
if (ac->req->operation == LDB_ADD) {
/* On "add" we have only "password reset" */
ac->pwd_reset = true;
} else if (ac->req->operation == LDB_MODIFY) {
struct ldb_control *pav_ctrl = NULL;
struct dsdb_control_password_acl_validation *pav = NULL;
pav_ctrl = ldb_request_get_control(ac->req,
DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OID);
if (pav_ctrl != NULL) {
pav = talloc_get_type_abort(pav_ctrl->data,
struct dsdb_control_password_acl_validation);
}
if (pav == NULL && ac->update_password) {
bool ok;
/*
* If the DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OID
* control is missing, we require system access!
*/
ok = dsdb_module_am_system(ac->module);
if (!ok) {
return ldb_module_operr(ac->module);
}
}
if (pav != NULL) {
/*
* We assume what the acl module has validated.
*/
ac->pwd_reset = pav->pwd_reset;
} else if (io->og.cleartext_utf8 || io->og.cleartext_utf16
|| ac->change) {
/*
* If we have an old password specified or the
* dsdb_control_password_change then for sure
* it is a user "password change"
*/
ac->pwd_reset = false;
} else {
/* Otherwise we have also here a "password reset" */
ac->pwd_reset = true;
}
} else {
/* this shouldn't happen */
return ldb_operr(ldb);
}
if (existing_msg != NULL) {
NTSTATUS status;
krb5_error_code krb5_ret;
DATA_BLOB key_blob;
DATA_BLOB salt_blob;
uint32_t kvno;
if (ac->pwd_reset) {
/* Get the old password from the database */
status = samdb_result_passwords_no_lockout(ac,
lp_ctx,
existing_msg,
&io->o.nt_hash);
} else {
/* Get the old password from the database */
status = samdb_result_passwords(ac,
lp_ctx,
existing_msg,
&io->o.nt_hash);
}
if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
return dsdb_module_werror(ac->module,
LDB_ERR_CONSTRAINT_VIOLATION,
WERR_ACCOUNT_LOCKED_OUT,
"Password change not permitted,"
" account locked out!");
}
if (!NT_STATUS_IS_OK(status)) {
/*
* This only happens if the database has gone weird,
* not if we are just missing the passwords
*/
return ldb_operr(ldb);
}
io->o.nt_history_len = samdb_result_hashes(ac, existing_msg,
"ntPwdHistory",
&io->o.nt_history);
io->o.supplemental = ldb_msg_find_ldb_val(existing_msg,
"supplementalCredentials");
if (io->o.supplemental != NULL) {
enum ndr_err_code ndr_err;
ndr_err = ndr_pull_struct_blob_all(io->o.supplemental, io->ac,
&io->o.scb,
(ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
ldb_asprintf_errstring(ldb,
"setup_io: failed to pull "
"old supplementalCredentialsBlob: %s",
nt_errstr(status));
return LDB_ERR_OPERATIONS_ERROR;
}
}
/*
* If this account requires a smartcard for login, we don't
* attempt a comparison with the old password.
*/
if (io->u.userAccountControl & UF_SMARTCARD_REQUIRED) {
return LDB_SUCCESS;
}
/*
* Extract the old ENCTYPE_AES256_CTS_HMAC_SHA1_96
* value from the supplementalCredentials.
*/
krb5_ret = dsdb_extract_aes_256_key(io->smb_krb5_context->krb5_context,
io->ac,
existing_msg,
io->u.userAccountControl,
NULL, /* kvno */
&kvno, /* kvno_out */
&key_blob,
&salt_blob);
if (krb5_ret == ENOENT) {
/*
* If there is no old AES hash (perhaps an imported DB with
* just unicodePwd) then we just won't have an old
* password to compare to if there is no NT hash
*/
return LDB_SUCCESS;
}
if (krb5_ret) {
ldb_asprintf_errstring(ldb,
"setup_io: "
"extraction of salt for old aes256-cts-hmac-sha1-96 key failed: %s",
smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
krb5_ret, io->ac));
return LDB_ERR_OPERATIONS_ERROR;
}
io->o.salt = salt_blob;
io->o.aes_256 = key_blob;
io->o.kvno = kvno;
}
return LDB_SUCCESS;
}
static struct ph_context *ph_init_context(struct ldb_module *module,
struct ldb_request *req,
bool userPassword,
bool update_password)
{
struct ldb_context *ldb;
struct ph_context *ac;
struct loadparm_context *lp_ctx = NULL;
ldb = ldb_module_get_ctx(module);
ac = talloc_zero(req, struct ph_context);
if (ac == NULL) {
ldb_set_errstring(ldb, "Out of Memory");
return NULL;
}
ac->module = module;
ac->req = req;
ac->userPassword = userPassword;
ac->update_password = update_password;
ac->update_lastset = true;
lp_ctx = talloc_get_type_abort(ldb_get_opaque(ldb, "loadparm"),
struct loadparm_context);
ac->gpg_key_ids = lpcfg_password_hash_gpg_key_ids(lp_ctx);
ac->userPassword_schemes
= lpcfg_password_hash_userpassword_schemes(lp_ctx);
return ac;
}
static void ph_apply_controls(struct ph_context *ac)
{
struct ldb_control *ctrl;
ac->change_status = false;
ctrl = ldb_request_get_control(ac->req,
DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID);
if (ctrl != NULL) {
ac->change_status = true;
/* Mark the "change status" control as uncritical (done) */
ctrl->critical = false;
}
ac->hash_values = false;
ctrl = ldb_request_get_control(ac->req,
DSDB_CONTROL_PASSWORD_HASH_VALUES_OID);
if (ctrl != NULL) {
ac->hash_values = true;
/* Mark the "hash values" control as uncritical (done) */
ctrl->critical = false;
}
ctrl = ldb_request_get_control(ac->req,
DSDB_CONTROL_PASSWORD_CHANGE_OLD_PW_CHECKED_OID);
if (ctrl != NULL) {
ac->change = talloc_get_type_abort(ctrl->data, struct dsdb_control_password_change);
/* Mark the "change" control as uncritical (done) */
ctrl->critical = false;
}
ac->pwd_last_set_bypass = false;
ctrl = ldb_request_get_control(ac->req,
DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID);
if (ctrl != NULL) {
ac->pwd_last_set_bypass = true;
/* Mark the "bypass pwdLastSet" control as uncritical (done) */
ctrl->critical = false;
}
ac->pwd_last_set_default = false;
ctrl = ldb_request_get_control(ac->req,
DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID);
if (ctrl != NULL) {
ac->pwd_last_set_default = true;
/* Mark the "bypass pwdLastSet" control as uncritical (done) */
ctrl->critical = false;
}
ac->smartcard_reset = false;
ctrl = ldb_request_get_control(ac->req,
DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID);
if (ctrl != NULL) {
struct dsdb_control_password_user_account_control *uac = NULL;
uint32_t added_flags = 0;
uac = talloc_get_type_abort(ctrl->data,
struct dsdb_control_password_user_account_control);
added_flags = uac->new_flags & ~uac->old_flags;
if (added_flags & UF_SMARTCARD_REQUIRED) {
ac->smartcard_reset = true;
}
/* Mark the "smartcard required" control as uncritical (done) */
ctrl->critical = false;
}
}
static int ph_op_callback(struct ldb_request *req, struct ldb_reply *ares)
{
struct ph_context *ac;
ac = talloc_get_type(req->context, struct ph_context);
if (!ares) {
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
if (ares->type == LDB_REPLY_REFERRAL) {
return ldb_module_send_referral(ac->req, ares->referral);
}
if ((ares->error != LDB_ERR_OPERATIONS_ERROR) && (ac->change_status)) {
/* On success and trivial errors a status control is being
* added (used for example by the "samdb_set_password" call) */
ldb_reply_add_control(ares,
DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID,
false,
ac->status);
}
if (ares->error != LDB_SUCCESS) {
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
}
if (ares->type != LDB_REPLY_DONE) {
talloc_free(ares);
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
}
static int password_hash_add_do_add(struct ph_context *ac);
static int ph_modify_callback(struct ldb_request *req, struct ldb_reply *ares);
static int password_hash_mod_search_self(struct ph_context *ac);
static int ph_mod_search_callback(struct ldb_request *req, struct ldb_reply *ares);
static int password_hash_mod_do_mod(struct ph_context *ac);
/*
* LDB callback handler for searching for a user's PSO. Once we have all the
* Password Settings that apply to the user, we can continue with the modify
* operation
*/
static int get_pso_data_callback(struct ldb_request *req,
struct ldb_reply *ares)
{
struct ldb_context *ldb = NULL;
struct ph_context *ac = NULL;
bool domain_complexity = true;
bool pso_complexity = true;
struct dsdb_user_pwd_settings *settings = NULL;
int ret = LDB_SUCCESS;
ac = talloc_get_type(req->context, struct ph_context);
ldb = ldb_module_get_ctx(ac->module);
if (!ares) {
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
if (ares->error != LDB_SUCCESS) {
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
}
switch (ares->type) {
case LDB_REPLY_ENTRY:
/* check status was initialized by the domain query */
if (ac->status == NULL) {
talloc_free(ares);
ldb_set_errstring(ldb, "Uninitialized status");
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
/*
* use the PSO's values instead of the domain defaults (the PSO
* attributes should always exist, but use the domain default
* values as a fallback).
*/
settings = &ac->status->domain_data;
settings->store_cleartext =
ldb_msg_find_attr_as_bool(ares->message,
"msDS-PasswordReversibleEncryptionEnabled",
settings->store_cleartext);
settings->pwdHistoryLength =
ldb_msg_find_attr_as_uint(ares->message,
"msDS-PasswordHistoryLength",
settings->pwdHistoryLength);
settings->maxPwdAge =
ldb_msg_find_attr_as_int64(ares->message,
"msDS-MaximumPasswordAge",
settings->maxPwdAge);
settings->minPwdAge =
ldb_msg_find_attr_as_int64(ares->message,
"msDS-MinimumPasswordAge",
settings->minPwdAge);
settings->minPwdLength =
ldb_msg_find_attr_as_uint(ares->message,
"msDS-MinimumPasswordLength",
settings->minPwdLength);
domain_complexity =
(settings->pwdProperties & DOMAIN_PASSWORD_COMPLEX);
pso_complexity =
ldb_msg_find_attr_as_bool(ares->message,
"msDS-PasswordComplexityEnabled",
domain_complexity);
/* set or clear the complexity bit if required */
if (pso_complexity && !domain_complexity) {
settings->pwdProperties |= DOMAIN_PASSWORD_COMPLEX;
} else if (domain_complexity && !pso_complexity) {
settings->pwdProperties &= ~DOMAIN_PASSWORD_COMPLEX;
}
if (ac->pso_res != NULL) {
DBG_ERR("Too many PSO results for %s\n",
ldb_dn_get_linearized(ac->search_res->message->dn));
talloc_free(ac->pso_res);
}
/* store the PSO result (we may need its lockout settings) */
ac->pso_res = talloc_steal(ac, ares);
ret = LDB_SUCCESS;
break;
case LDB_REPLY_REFERRAL:
/* ignore */
talloc_free(ares);
ret = LDB_SUCCESS;
break;
case LDB_REPLY_DONE:
talloc_free(ares);
/*
* perform the next step of the modify operation (this code
* shouldn't get called in the 'user add' case)
*/
if (ac->req->operation == LDB_MODIFY) {
ret = password_hash_mod_do_mod(ac);
} else {
ret = LDB_ERR_OPERATIONS_ERROR;
}
break;
}
done:
if (ret != LDB_SUCCESS) {
struct ldb_reply *new_ares;
new_ares = talloc_zero(ac->req, struct ldb_reply);
if (new_ares == NULL) {
ldb_oom(ldb);
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
new_ares->error = ret;
if ((ret != LDB_ERR_OPERATIONS_ERROR) && (ac->change_status)) {
/* On success and trivial errors a status control is being
* added (used for example by the "samdb_set_password" call) */
ldb_reply_add_control(new_ares,
DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID,
false,
ac->status);
}
return ldb_module_done(ac->req, new_ares->controls,
new_ares->response, new_ares->error);
}
return LDB_SUCCESS;
}
/*
* Builds and returns a search request to lookup up the PSO that applies to
* the user in question. Returns NULL if no PSO applies, or could not be found
*/
static struct ldb_request * build_pso_data_request(struct ph_context *ac)
{
/* attrs[] is returned from this function in
pso_req->op.search.attrs, so it must be static, as
otherwise the compiler can put it on the stack */
static const char * const attrs[] = { "msDS-PasswordComplexityEnabled",
"msDS-PasswordReversibleEncryptionEnabled",
"msDS-PasswordHistoryLength",
"msDS-MaximumPasswordAge",
"msDS-MinimumPasswordAge",
"msDS-MinimumPasswordLength",
"msDS-LockoutThreshold",
"msDS-LockoutObservationWindow",
NULL };
struct ldb_context *ldb = NULL;
struct ldb_request *pso_req = NULL;
struct ldb_dn *pso_dn = NULL;
TALLOC_CTX *mem_ctx = ac;
int ret;
ldb = ldb_module_get_ctx(ac->module);
/* if a PSO applies to the user, we need to lookup the PSO as well */
pso_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, ac->search_res->message,
"msDS-ResultantPSO");
if (pso_dn == NULL) {
return NULL;
}
ret = ldb_build_search_req(&pso_req, ldb, mem_ctx, pso_dn,
LDB_SCOPE_BASE, NULL, attrs, NULL,
ac, get_pso_data_callback,
ac->dom_req);
/* log errors, but continue with the default domain settings */
if (ret != LDB_SUCCESS) {
DBG_ERR("Error %d constructing PSO query for user %s\n", ret,
ldb_dn_get_linearized(ac->search_res->message->dn));
}
LDB_REQ_SET_LOCATION(pso_req);
return pso_req;
}
static int get_domain_data_callback(struct ldb_request *req,
struct ldb_reply *ares)
{
struct ldb_context *ldb;
struct ph_context *ac;
struct loadparm_context *lp_ctx;
struct ldb_request *pso_req = NULL;
int ret = LDB_SUCCESS;
ac = talloc_get_type(req->context, struct ph_context);
ldb = ldb_module_get_ctx(ac->module);
if (!ares) {
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
if (ares->error != LDB_SUCCESS) {
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
}
switch (ares->type) {
case LDB_REPLY_ENTRY:
if (ac->status != NULL) {
talloc_free(ares);
ldb_set_errstring(ldb, "Too many results");
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
/* Setup the "status" structure (used as control later) */
ac->status = talloc_zero(ac->req,
struct dsdb_control_password_change_status);
if (ac->status == NULL) {
talloc_free(ares);
ldb_oom(ldb);
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
/* Setup the "domain data" structure */
ac->status->domain_data.pwdProperties =
ldb_msg_find_attr_as_uint(ares->message, "pwdProperties", -1);
ac->status->domain_data.pwdHistoryLength =
ldb_msg_find_attr_as_uint(ares->message, "pwdHistoryLength", -1);
ac->status->domain_data.maxPwdAge =
ldb_msg_find_attr_as_int64(ares->message, "maxPwdAge", -1);
ac->status->domain_data.minPwdAge =
ldb_msg_find_attr_as_int64(ares->message, "minPwdAge", -1);
ac->status->domain_data.minPwdLength =
ldb_msg_find_attr_as_uint(ares->message, "minPwdLength", -1);
ac->status->domain_data.store_cleartext =
ac->status->domain_data.pwdProperties & DOMAIN_PASSWORD_STORE_CLEARTEXT;
/* For a domain DN, this puts things in dotted notation */
/* For builtin domains, this will give details for the host,
* but that doesn't really matter, as it's just used for salt
* and kerberos principals, which don't exist here */
lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
struct loadparm_context);
ac->status->domain_data.dns_domain = lpcfg_dnsdomain(lp_ctx);
ac->status->domain_data.realm = lpcfg_realm(lp_ctx);
ac->status->domain_data.netbios_domain = lpcfg_sam_name(lp_ctx);
ac->status->reject_reason = SAM_PWD_CHANGE_NO_ERROR;
if (ac->dom_res != NULL) {
talloc_free(ares);
ldb_set_errstring(ldb, "Too many results");
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
ac->dom_res = talloc_steal(ac, ares);
ret = LDB_SUCCESS;
break;
case LDB_REPLY_REFERRAL:
/* ignore */
talloc_free(ares);
ret = LDB_SUCCESS;
break;
case LDB_REPLY_DONE:
talloc_free(ares);
/* call the next step */
switch (ac->req->operation) {
case LDB_ADD:
ret = password_hash_add_do_add(ac);
break;
case LDB_MODIFY:
/*
* The user may have an optional PSO applied. If so,
* query the PSO to get the Fine-Grained Password Policy
* for the user, before we perform the modify
*/
pso_req = build_pso_data_request(ac);
if (pso_req != NULL) {
ret = ldb_next_request(ac->module, pso_req);
} else {
/* no PSO, so we can perform the modify now */
ret = password_hash_mod_do_mod(ac);
}
break;
default:
ret = LDB_ERR_OPERATIONS_ERROR;
break;
}
break;
}
done:
if (ret != LDB_SUCCESS) {
struct ldb_reply *new_ares;
new_ares = talloc_zero(ac->req, struct ldb_reply);
if (new_ares == NULL) {
ldb_oom(ldb);
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
new_ares->error = ret;
if ((ret != LDB_ERR_OPERATIONS_ERROR) && (ac->change_status)) {
/* On success and trivial errors a status control is being
* added (used for example by the "samdb_set_password" call) */
ldb_reply_add_control(new_ares,
DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID,
false,
ac->status);
}
return ldb_module_done(ac->req, new_ares->controls,
new_ares->response, new_ares->error);
}
return LDB_SUCCESS;
}
static int build_domain_data_request(struct ph_context *ac)
{
/* attrs[] is returned from this function in
ac->dom_req->op.search.attrs, so it must be static, as
otherwise the compiler can put it on the stack */
struct ldb_context *ldb;
static const char * const attrs[] = { "pwdProperties",
"pwdHistoryLength",
"maxPwdAge",
"minPwdAge",
"minPwdLength",
"lockoutThreshold",
"lockOutObservationWindow",
NULL };
int ret;
ldb = ldb_module_get_ctx(ac->module);
ret = ldb_build_search_req(&ac->dom_req, ldb, ac,
ldb_get_default_basedn(ldb),
LDB_SCOPE_BASE,
NULL, attrs,
NULL,
ac, get_domain_data_callback,
ac->req);
LDB_REQ_SET_LOCATION(ac->dom_req);
return ret;
}
static int password_hash_needed(struct ldb_module *module,
struct ldb_request *req,
struct ph_context **_ac)
{
struct ldb_context *ldb = ldb_module_get_ctx(module);
const char *operation = NULL;
const struct ldb_message *msg = NULL;
struct ph_context *ac = NULL;
const char *passwordAttrs[] = {
DSDB_PASSWORD_ATTRIBUTES,
NULL
};
const char **a = NULL;
unsigned int attr_cnt = 0;
struct ldb_control *bypass = NULL;
struct ldb_control *uac_ctrl = NULL;
bool userPassword = dsdb_user_password_support(module, req, req);
bool update_password = false;
bool processing_needed = false;
*_ac = NULL;
ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_needed\n");
switch (req->operation) {
case LDB_ADD:
operation = "add";
msg = req->op.add.message;
break;
case LDB_MODIFY:
operation = "modify";
msg = req->op.mod.message;
break;
default:
return ldb_next_request(module, req);
}
if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
return ldb_next_request(module, req);
}
bypass = ldb_request_get_control(req,
DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID);
if (bypass != NULL) {
/* Mark the "bypass" control as uncritical (done) */
bypass->critical = false;
ldb_debug(ldb, LDB_DEBUG_TRACE,
"password_hash_needed(%s) (bypassing)\n",
operation);
return password_hash_bypass(module, req);
}
/* nobody must touch password histories and 'supplementalCredentials' */
if (ldb_msg_find_element(msg, "ntPwdHistory")) {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
if (ldb_msg_find_element(msg, "lmPwdHistory")) {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
if (ldb_msg_find_element(msg, "supplementalCredentials")) {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
/*
* If no part of this touches the 'userPassword' OR 'clearTextPassword'
* OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes.
* For password changes/set there should be a 'delete' or a 'modify'
* on these attributes.
*/
for (a = passwordAttrs; *a != NULL; a++) {
if ((!userPassword) && (ldb_attr_cmp(*a, "userPassword") == 0)) {
continue;
}
if (ldb_msg_find_element(msg, *a) != NULL) {
/* MS-ADTS 3.1.1.3.1.5.2 */
if ((ldb_attr_cmp(*a, "userPassword") == 0) &&
(dsdb_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003)) {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
++attr_cnt;
}
}
if (attr_cnt > 0) {
update_password = true;
processing_needed = true;
}
if (ldb_msg_find_element(msg, "pwdLastSet")) {
processing_needed = true;
}
uac_ctrl = ldb_request_get_control(req,
DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID);
if (uac_ctrl != NULL) {
struct dsdb_control_password_user_account_control *uac = NULL;
uint32_t added_flags = 0;
uac = talloc_get_type_abort(uac_ctrl->data,
struct dsdb_control_password_user_account_control);
added_flags = uac->new_flags & ~uac->old_flags;
if (added_flags & UF_SMARTCARD_REQUIRED) {
processing_needed = true;
}
}
if (!processing_needed) {
return ldb_next_request(module, req);
}
ac = ph_init_context(module, req, userPassword, update_password);
if (!ac) {
DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
return ldb_operr(ldb);
}
ph_apply_controls(ac);
/*
* Make a copy in order to apply our modifications
* to the final update
*/
ac->update_msg = ldb_msg_copy_shallow(ac, msg);
if (ac->update_msg == NULL) {
return ldb_oom(ldb);
}
/*
* Remove all password related attributes.
*/
if (ac->userPassword) {
ldb_msg_remove_attr(ac->update_msg, "userPassword");
}
ldb_msg_remove_attr(ac->update_msg, "clearTextPassword");
ldb_msg_remove_attr(ac->update_msg, "unicodePwd");
ldb_msg_remove_attr(ac->update_msg, "ntPwdHistory");
ldb_msg_remove_attr(ac->update_msg, "dBCSPwd");
ldb_msg_remove_attr(ac->update_msg, "lmPwdHistory");
ldb_msg_remove_attr(ac->update_msg, "supplementalCredentials");
ldb_msg_remove_attr(ac->update_msg, "pwdLastSet");
*_ac = ac;
return LDB_SUCCESS;
}
static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
{
struct ldb_context *ldb = ldb_module_get_ctx(module);
struct ph_context *ac = NULL;
int ret;
ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_add\n");
ret = password_hash_needed(module, req, &ac);
if (ret != LDB_SUCCESS) {
return ret;
}
if (ac == NULL) {
return ret;
}
/* Make sure we are performing the password set action on a (for us)
* valid object. Those are instances of either "user" and/or
* "inetOrgPerson". Otherwise continue with the submodules. */
if ((!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "user"))
&& (!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "inetOrgPerson"))) {
TALLOC_FREE(ac);
if (ldb_msg_find_element(req->op.add.message, "clearTextPassword") != NULL) {
ldb_set_errstring(ldb,
"'clearTextPassword' is only allowed on objects of class 'user' and/or 'inetOrgPerson'!");
return LDB_ERR_NO_SUCH_ATTRIBUTE;
}
return ldb_next_request(module, req);
}
/* get user domain data */
ret = build_domain_data_request(ac);
if (ret != LDB_SUCCESS) {
return ret;
}
return ldb_next_request(module, ac->dom_req);
}
static int password_hash_add_do_add(struct ph_context *ac)
{
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
struct ldb_request *down_req;
struct setup_password_fields_io io;
int ret;
/* Prepare the internal data structure containing the passwords */
ret = setup_io(ac, ac->req->op.add.message, NULL, &io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = setup_password_fields(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = check_password_restrictions_and_log(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = setup_smartcard_reset(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = update_final_msg(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = ldb_build_add_req(&down_req, ldb, ac,
ac->update_msg,
ac->req->controls,
ac, ph_op_callback,
ac->req);
LDB_REQ_SET_LOCATION(down_req);
if (ret != LDB_SUCCESS) {
return ret;
}
return ldb_next_request(ac->module, down_req);
}
static int password_hash_modify(struct ldb_module *module, struct ldb_request *req)
{
struct ldb_context *ldb = ldb_module_get_ctx(module);
struct ph_context *ac = NULL;
const char *passwordAttrs[] = {DSDB_PASSWORD_ATTRIBUTES, NULL}, **l;
unsigned int del_attr_cnt, add_attr_cnt, rep_attr_cnt;
struct ldb_message_element *passwordAttr;
struct ldb_message *msg;
struct ldb_request *down_req;
struct ldb_control *restore = NULL;
int ret;
unsigned int i = 0;
ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_modify\n");
ret = password_hash_needed(module, req, &ac);
if (ret != LDB_SUCCESS) {
return ret;
}
if (ac == NULL) {
return ret;
}
/* use a new message structure so that we can modify it */
msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
if (msg == NULL) {
return ldb_oom(ldb);
}
/* - check for single-valued password attributes
* (if not return "CONSTRAINT_VIOLATION")
* - check that for a password change operation one add and one delete
* operation exists
* (if not return "CONSTRAINT_VIOLATION" or "UNWILLING_TO_PERFORM")
* - check that a password change and a password set operation cannot
* be mixed
* (if not return "UNWILLING_TO_PERFORM")
* - remove all password attributes modifications from the first change
* operation (anything without the passwords) - we will make the real
* modification later */
del_attr_cnt = 0;
add_attr_cnt = 0;
rep_attr_cnt = 0;
for (l = passwordAttrs; *l != NULL; l++) {
if ((!ac->userPassword) &&
(ldb_attr_cmp(*l, "userPassword") == 0)) {
continue;
}
while ((passwordAttr = ldb_msg_find_element(msg, *l)) != NULL) {
unsigned int mtype = LDB_FLAG_MOD_TYPE(passwordAttr->flags);
unsigned int nvalues = passwordAttr->num_values;
if (mtype == LDB_FLAG_MOD_DELETE) {
++del_attr_cnt;
}
if (mtype == LDB_FLAG_MOD_ADD) {
++add_attr_cnt;
}
if (mtype == LDB_FLAG_MOD_REPLACE) {
++rep_attr_cnt;
}
if ((nvalues != 1) && (mtype == LDB_FLAG_MOD_ADD)) {
talloc_free(ac);
ldb_asprintf_errstring(ldb,
"'%s' attribute must have exactly one value on add operations!",
*l);
return LDB_ERR_CONSTRAINT_VIOLATION;
}
if ((nvalues > 1) && (mtype == LDB_FLAG_MOD_DELETE)) {
talloc_free(ac);
ldb_asprintf_errstring(ldb,
"'%s' attribute must have zero or one value(s) on delete operations!",
*l);
return LDB_ERR_CONSTRAINT_VIOLATION;
}
ldb_msg_remove_element(msg, passwordAttr);
}
}
if ((del_attr_cnt == 0) && (add_attr_cnt > 0)) {
talloc_free(ac);
ldb_set_errstring(ldb,
"Only the add action for a password change specified!");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
if ((del_attr_cnt > 1) || (add_attr_cnt > 1)) {
talloc_free(ac);
ldb_set_errstring(ldb,
"Only one delete and one add action for a password change allowed!");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
if ((rep_attr_cnt > 0) && ((del_attr_cnt > 0) || (add_attr_cnt > 0))) {
talloc_free(ac);
ldb_set_errstring(ldb,
"Either a password change or a password set operation is allowed!");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
restore = ldb_request_get_control(req,
DSDB_CONTROL_RESTORE_TOMBSTONE_OID);
if (restore == NULL) {
/*
* A tombstone reanimation generates a double update
* of pwdLastSet.
*
* So we only remove it without the
* DSDB_CONTROL_RESTORE_TOMBSTONE_OID control.
*/
ldb_msg_remove_attr(msg, "pwdLastSet");
}
/* if there was nothing else to be modified skip to next step */
if (msg->num_elements == 0) {
return password_hash_mod_search_self(ac);
}
/*
* Now we apply all changes remaining in msg
* and remove them from our final update_msg
*/
for (i = 0; i < msg->num_elements; i++) {
ldb_msg_remove_attr(ac->update_msg,
msg->elements[i].name);
}
ret = ldb_build_mod_req(&down_req, ldb, ac,
msg,
req->controls,
ac, ph_modify_callback,
req);
LDB_REQ_SET_LOCATION(down_req);
if (ret != LDB_SUCCESS) {
return ret;
}
return ldb_next_request(module, down_req);
}
static int ph_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
{
struct ph_context *ac;
ac = talloc_get_type(req->context, struct ph_context);
if (!ares) {
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
if (ares->type == LDB_REPLY_REFERRAL) {
return ldb_module_send_referral(ac->req, ares->referral);
}
if (ares->error != LDB_SUCCESS) {
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
}
if (ares->type != LDB_REPLY_DONE) {
talloc_free(ares);
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
talloc_free(ares);
return password_hash_mod_search_self(ac);
}
static int ph_mod_search_callback(struct ldb_request *req, struct ldb_reply *ares)
{
struct ldb_context *ldb;
struct ph_context *ac;
int ret = LDB_SUCCESS;
ac = talloc_get_type(req->context, struct ph_context);
ldb = ldb_module_get_ctx(ac->module);
if (!ares) {
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
if (ares->error != LDB_SUCCESS) {
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
}
/* we are interested only in the single reply (base search) */
switch (ares->type) {
case LDB_REPLY_ENTRY:
/* Make sure we are performing the password change action on a
* (for us) valid object. Those are instances of either "user"
* and/or "inetOrgPerson". Otherwise continue with the
* submodules. */
if ((!ldb_msg_check_string_attribute(ares->message, "objectClass", "user"))
&& (!ldb_msg_check_string_attribute(ares->message, "objectClass", "inetOrgPerson"))) {
talloc_free(ares);
if (ldb_msg_find_element(ac->req->op.mod.message, "clearTextPassword") != NULL) {
ldb_set_errstring(ldb,
"'clearTextPassword' is only allowed on objects of class 'user' and/or 'inetOrgPerson'!");
ret = LDB_ERR_NO_SUCH_ATTRIBUTE;
goto done;
}
ret = ldb_next_request(ac->module, ac->req);
goto done;
}
if (ac->search_res != NULL) {
talloc_free(ares);
ldb_set_errstring(ldb, "Too many results");
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
ac->search_res = talloc_steal(ac, ares);
ret = LDB_SUCCESS;
break;
case LDB_REPLY_REFERRAL:
/* ignore anything else for now */
talloc_free(ares);
ret = LDB_SUCCESS;
break;
case LDB_REPLY_DONE:
talloc_free(ares);
/* get user domain data */
ret = build_domain_data_request(ac);
if (ret != LDB_SUCCESS) {
return ldb_module_done(ac->req, NULL, NULL, ret);
}
ret = ldb_next_request(ac->module, ac->dom_req);
break;
}
done:
if (ret != LDB_SUCCESS) {
return ldb_module_done(ac->req, NULL, NULL, ret);
}
return LDB_SUCCESS;
}
static int password_hash_mod_search_self(struct ph_context *ac)
{
struct ldb_context *ldb;
static const char * const attrs[] = { "objectClass",
"userAccountControl",
"msDS-ResultantPSO",
"msDS-User-Account-Control-Computed",
"pwdLastSet",
"sAMAccountName",
"objectSid",
"userPrincipalName",
"displayName",
"supplementalCredentials",
"lmPwdHistory",
"ntPwdHistory",
"dBCSPwd",
"unicodePwd",
"badPasswordTime",
"badPwdCount",
"lockoutTime",
"msDS-KeyVersionNumber",
"msDS-SecondaryKrbTgtNumber",
NULL };
struct ldb_request *search_req;
int ret;
ldb = ldb_module_get_ctx(ac->module);
ret = ldb_build_search_req(&search_req, ldb, ac,
ac->req->op.mod.message->dn,
LDB_SCOPE_BASE,
"(objectclass=*)",
attrs,
NULL,
ac, ph_mod_search_callback,
ac->req);
LDB_REQ_SET_LOCATION(search_req);
if (ret != LDB_SUCCESS) {
return ret;
}
return ldb_next_request(ac->module, search_req);
}
static int password_hash_mod_do_mod(struct ph_context *ac)
{
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
struct ldb_request *mod_req;
struct setup_password_fields_io io;
int ret;
/* Prepare the internal data structure containing the passwords */
ret = setup_io(ac, ac->req->op.mod.message,
ac->search_res->message, &io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = setup_password_fields(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = check_password_restrictions_and_log(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = setup_smartcard_reset(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = update_final_msg(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = ldb_build_mod_req(&mod_req, ldb, ac,
ac->update_msg,
ac->req->controls,
ac, ph_op_callback,
ac->req);
LDB_REQ_SET_LOCATION(mod_req);
if (ret != LDB_SUCCESS) {
return ret;
}
return ldb_next_request(ac->module, mod_req);
}
static const struct ldb_module_ops ldb_password_hash_module_ops = {
.name = "password_hash",
.add = password_hash_add,
.modify = password_hash_modify
};
int ldb_password_hash_module_init(const char *version)
{
#ifdef ENABLE_GPGME
const char *gversion = NULL;
#endif /* ENABLE_GPGME */
LDB_MODULE_CHECK_VERSION(version);
#ifdef ENABLE_GPGME
/*
* Note: this sets a SIGPIPE handler
* if none is active already. See:
* https://www.gnupg.org/documentation/manuals/gpgme/Signal-Handling.html#Signal-Handling
*/
gversion = gpgme_check_version(MINIMUM_GPGME_VERSION);
if (gversion == NULL) {
fprintf(stderr, "%s() in %s version[%s]: "
"gpgme_check_version(%s) not available, "
"gpgme_check_version(NULL) => '%s'\n",
__func__, __FILE__, version,
MINIMUM_GPGME_VERSION, gpgme_check_version(NULL));
return LDB_ERR_UNAVAILABLE;
}
#endif /* ENABLE_GPGME */
return ldb_register_module(&ldb_password_hash_module_ops);
}
View Git Blame Copy Permalink