Changeset 988 for vendor/current/source3/libsmb/trusts_util.c

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

File:

• vendor/current/source3/libsmb/trusts_util.c (modified) (3 diffs)

vendor/current/source3/libsmb/trusts_util.c

@@ -21 +21 @@
 #include "includes.h"
 #include "../libcli/auth/libcli_auth.h"
-#include "../librpc/gen_ndr/ndr_lsa_c.h"
-#include "rpc_client/cli_lsarpc.h"
+#include "../libcli/auth/netlogon_creds_cli.h"
 #include "rpc_client/cli_netlogon.h"
 #include "rpc_client/cli_pipe.h"
@@ -29 +28 @@
 #include "passdb.h"
 #include "libsmb/libsmb.h"
-
-/*********************************************************
- Change the domain password on the PDC.
- Store the password ourselves, but use the supplied password
- Caller must have already setup the connection to the NETLOGON pipe
-**********************************************************/
-
-NTSTATUS trust_pw_change_and_store_it(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, 
-                                      const char *domain,
-                                      const char *account_name,
-                                      unsigned char orig_trust_passwd_hash[16],
-                                      enum netr_SchannelType sec_channel_type)
-{
-        unsigned char new_trust_passwd_hash[16];
-        char *new_trust_passwd;
-        NTSTATUS nt_status;
-
-        switch (sec_channel_type) {
-        case SEC_CHAN_WKSTA:
-        case SEC_CHAN_DOMAIN:
-                break;
-        default:
-                return NT_STATUS_NOT_SUPPORTED;
-        }
-
-        /* Create a random machine account password */
-        new_trust_passwd = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
-
-        if (new_trust_passwd == NULL) {
-                DEBUG(0, ("talloc_strdup failed\n"));
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        E_md4hash(new_trust_passwd, new_trust_passwd_hash);
-
-        nt_status = rpccli_netlogon_set_trust_password(cli, mem_ctx,
-                                                       account_name,
-                                                       orig_trust_passwd_hash,
-                                                       new_trust_passwd,
-                                                       new_trust_passwd_hash,
-                                                       sec_channel_type);
-
-        if (NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n", 
-                         current_timestring(talloc_tos(), False)));
-                /*
-                 * Return the result of trying to write the new password
-                 * back into the trust account file.
-                 */
-
-                switch (sec_channel_type) {
-
-                case SEC_CHAN_WKSTA:
-                        if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
-                                nt_status = NT_STATUS_UNSUCCESSFUL;
-                        }
-                        break;
-
-                case SEC_CHAN_DOMAIN: {
-                        char *pwd;
-                        struct dom_sid sid;
-                        time_t pass_last_set_time;
-
-                        /* we need to get the sid first for the
-                         * pdb_set_trusteddom_pw call */
-
-                        if (!pdb_get_trusteddom_pw(domain, &pwd, &sid, &pass_last_set_time)) {
-                                nt_status = NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
-                        }
-                        if (!pdb_set_trusteddom_pw(domain, new_trust_passwd, &sid)) {
-                                nt_status = NT_STATUS_INTERNAL_DB_CORRUPTION;
-                        }
-                        break;
-                }
-                default:
-                        break;
-                }
-        }
-
-        return nt_status;
-}
+#include "source3/include/messages.h"
+#include "source3/include/g_lock.h"
 
 /*********************************************************
@@ -117 +37 @@
 **********************************************************/
 
-NTSTATUS trust_pw_find_change_and_store_it(struct rpc_pipe_client *cli, 
-                                           TALLOC_CTX *mem_ctx, 
-                                           const char *domain) 
+struct trust_pw_change_state {
+        struct g_lock_ctx *g_ctx;
+        char *g_lock_key;
+};
+
+static int trust_pw_change_state_destructor(struct trust_pw_change_state *state)
 {
-        unsigned char old_trust_passwd_hash[16];
+        g_lock_unlock(state->g_ctx, state->g_lock_key);
+        return 0;
+}
+
+NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
+                         struct messaging_context *msg_ctx,
+                         struct dcerpc_binding_handle *b,
+                         const char *domain,
+                         bool force)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct trust_pw_change_state *state;
+        struct cli_credentials *creds = NULL;
+        const struct samr_Password *current_nt_hash = NULL;
+        const struct samr_Password *previous_nt_hash = NULL;
         enum netr_SchannelType sec_channel_type = SEC_CHAN_NULL;
-        const char *account_name;
-
-        if (!get_trust_pw_hash(domain, old_trust_passwd_hash, &account_name,
-                               &sec_channel_type)) {
-                DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-
-        return trust_pw_change_and_store_it(cli, mem_ctx, domain,
-                                            account_name,
-                                            old_trust_passwd_hash,
-                                            sec_channel_type);
+        time_t pass_last_set_time;
+        uint32_t old_version = 0;
+        struct pdb_trusted_domain *td = NULL;
+        struct timeval g_timeout = { 0, };
+        int timeout = 0;
+        struct timeval tv = { 0, };
+        size_t new_len = DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH;
+        uint8_t new_password_buffer[256 * 2] = { 0, };
+        char *new_trust_passwd = NULL;
+        size_t len = 0;
+        uint32_t new_version = 0;
+        uint32_t *new_trust_version = NULL;
+        NTSTATUS status;
+        bool ok;
+
+        state = talloc_zero(frame, struct trust_pw_change_state);
+        if (state == NULL) {
+                TALLOC_FREE(frame);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        state->g_ctx = g_lock_ctx_init(state, msg_ctx);
+        if (state->g_ctx == NULL) {
+                TALLOC_FREE(frame);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        state->g_lock_key = talloc_asprintf(state,
+                                "trust_password_change_%s",
+                                domain);
+        if (state->g_lock_key == NULL) {
+                TALLOC_FREE(frame);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        g_timeout = timeval_current_ofs(10, 0);
+        status = g_lock_lock(state->g_ctx,
+                             state->g_lock_key,
+                             G_LOCK_WRITE, g_timeout);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("could not get g_lock on [%s]!\n",
+                          state->g_lock_key));
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        talloc_set_destructor(state, trust_pw_change_state_destructor);
+
+        status = pdb_get_trust_credentials(domain, NULL, frame, &creds);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("could not fetch domain creds for domain %s - %s!\n",
+                          domain, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
+        }
+
+        current_nt_hash = cli_credentials_get_nt_hash(creds, frame);
+        if (current_nt_hash == NULL) {
+                DEBUG(0, ("cli_credentials_get_nt_hash failed for domain %s!\n",
+                          domain));
+                TALLOC_FREE(frame);
+                return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
+        }
+
+        old_version = cli_credentials_get_kvno(creds);
+        pass_last_set_time = cli_credentials_get_password_last_changed_time(creds);
+        sec_channel_type = cli_credentials_get_secure_channel_type(creds);
+
+        new_version = old_version + 1;
+
+        switch (sec_channel_type) {
+        case SEC_CHAN_WKSTA:
+        case SEC_CHAN_BDC:
+                break;
+        case SEC_CHAN_DNS_DOMAIN:
+                /*
+                 * new_len * 2 = 498 bytes is the largest possible length
+                 * NL_PASSWORD_VERSION consumes the rest of the possible 512 bytes
+                 * and a confounder with at least 2 bytes is required.
+                 *
+                 * Windows uses new_len = 120 => 240 bytes.
+                 */
+                new_len = 120;
+
+                /* fall through */
+        case SEC_CHAN_DOMAIN:
+                status = pdb_get_trusted_domain(frame, domain, &td);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0, ("pdb_get_trusted_domain() failed for domain %s - %s!\n",
+                                  domain, nt_errstr(status)));
+                        TALLOC_FREE(frame);
+                        return status;
+                }
+
+                new_trust_version = &new_version;
+                break;
+        default:
+                TALLOC_FREE(frame);
+                return NT_STATUS_NOT_SUPPORTED;
+        }
+
+        timeout = lp_machine_password_timeout();
+        if (timeout == 0) {
+                if (!force) {
+                        DEBUG(10,("machine password never expires\n"));
+                        TALLOC_FREE(frame);
+                        return NT_STATUS_OK;
+                }
+        }
+
+        tv.tv_sec = pass_last_set_time;
+        DEBUG(10, ("password last changed %s\n",
+                   timeval_string(talloc_tos(), &tv, false)));
+        tv.tv_sec += timeout;
+        DEBUGADD(10, ("password valid until %s\n",
+                      timeval_string(talloc_tos(), &tv, false)));
+
+        if (!force && !timeval_expired(&tv)) {
+                TALLOC_FREE(frame);
+                return NT_STATUS_OK;
+        }
+
+        /*
+         * Create a random machine account password
+         * We create a random buffer and convert that to utf8.
+         * This is similar to what windows is doing.
+         */
+        generate_secret_buffer(new_password_buffer, new_len * 2);
+        ok = convert_string_talloc(frame,
+                                   CH_UTF16MUNGED, CH_UTF8,
+                                   new_password_buffer, new_len * 2,
+                                   (void *)&new_trust_passwd, &len);
+        ZERO_STRUCT(new_password_buffer);
+        if (!ok) {
+                DEBUG(0, ("convert_string_talloc failed\n"));
+                TALLOC_FREE(frame);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        /*
+         * We could use cli_credentials_get_old_nt_hash(creds, frame) to
+         * set previous_nt_hash.
+         *
+         * But we want to check if the dc has our current password and only do
+         * a change if that's the case. So we keep previous_nt_hash = NULL.
+         *
+         * TODO:
+         * If the previous password is the only password in common with the dc,
+         * we better skip the password change, or use something like
+         * ServerTrustPasswordsGet() or netr_ServerGetTrustInfo() to fix our
+         * local secrets before doing the change.
+         */
+        status = netlogon_creds_cli_auth(context, b,
+                                         *current_nt_hash,
+                                         previous_nt_hash);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("netlogon_creds_cli_auth for domain %s - %s!\n",
+                          domain, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        /*
+         * Return the result of trying to write the new password
+         * back into the trust account file.
+         */
+
+        switch (sec_channel_type) {
+
+        case SEC_CHAN_WKSTA:
+        case SEC_CHAN_BDC:
+                ok = secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type);
+                if (!ok) {
+                        DEBUG(0, ("secrets_store_machine_password failed for domain %s!\n",
+                                  domain));
+                        TALLOC_FREE(frame);
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+                break;
+
+        case SEC_CHAN_DNS_DOMAIN:
+        case SEC_CHAN_DOMAIN:
+                /*
+                 * we need to get the sid first for the
+                 * pdb_set_trusteddom_pw call
+                 */
+                ok = pdb_set_trusteddom_pw(domain, new_trust_passwd,
+                                           &td->security_identifier);
+                if (!ok) {
+                        DEBUG(0, ("pdb_set_trusteddom_pw() failed for domain %s!\n",
+                                  domain));
+                        TALLOC_FREE(frame);
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+                break;
+
+        default:
+                smb_panic("Unsupported secure channel type");
+                break;
+        }
+
+        DEBUG(1,("%s : %s(%s): Changed password locally\n",
+                 current_timestring(talloc_tos(), false), __func__, domain));
+
+        status = netlogon_creds_cli_ServerPasswordSet(context, b,
+                                                      new_trust_passwd,
+                                                      new_trust_version);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("%s : %s(%s) remote password change set failed - %s\n",
+                         current_timestring(talloc_tos(), false), __func__,
+                         domain, nt_errstr(status)));
+                TALLOC_FREE(frame);
+                return status;
+        }
+
+        DEBUG(1,("%s : %s(%s): Changed password remotely.\n",
+                 current_timestring(talloc_tos(), false), __func__, domain));
+
+        TALLOC_FREE(frame);
+        return NT_STATUS_OK;
 }
-
-/*********************************************************************
- Enumerate the list of trusted domains from a DC
-*********************************************************************/
-
-bool enumerate_domain_trusts( TALLOC_CTX *mem_ctx, const char *domain,
-                                     char ***domain_names, uint32 *num_domains,
-                                     struct dom_sid **sids )
-{
-        struct policy_handle    pol;
-        NTSTATUS status, result;
-        fstring         dc_name;
-        struct sockaddr_storage dc_ss;
-        uint32          enum_ctx = 0;
-        struct cli_state *cli = NULL;
-        struct rpc_pipe_client *lsa_pipe = NULL;
-        struct lsa_DomainList dom_list;
-        int i;
-        struct dcerpc_binding_handle *b = NULL;
-
-        *domain_names = NULL;
-        *num_domains = 0;
-        *sids = NULL;
-
-        /* lookup a DC first */
-
-        if ( !get_dc_name(domain, NULL, dc_name, &dc_ss) ) {
-                DEBUG(3,("enumerate_domain_trusts: can't locate a DC for domain %s\n",
-                        domain));
-                return False;
-        }
-
-        /* setup the anonymous connection */
-
-        status = cli_full_connection( &cli, global_myname(), dc_name, &dc_ss, 0, "IPC$", "IPC",
-                "", "", "", 0, Undefined);
-        if ( !NT_STATUS_IS_OK(status) )
-                goto done;
-
-        /* open the LSARPC_PIPE */
-
-        status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
-                                          &lsa_pipe);
-        if (!NT_STATUS_IS_OK(status)) {
-                goto done;
-        }
-
-        b = lsa_pipe->binding_handle;
-
-        /* get a handle */
-
-        status = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, True,
-                LSA_POLICY_VIEW_LOCAL_INFORMATION, &pol);
-        if ( !NT_STATUS_IS_OK(status) )
-                goto done;
-
-        /* Lookup list of trusted domains */
-
-        status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
-                                         &pol,
-                                         &enum_ctx,
-                                         &dom_list,
-                                         (uint32_t)-1,
-                                         &result);
-        if ( !NT_STATUS_IS_OK(status) )
-                goto done;
-        if (!NT_STATUS_IS_OK(result)) {
-                status = result;
-                goto done;
-        }
-
-        *num_domains = dom_list.count;
-
-        *domain_names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_domains);
-        if (!*domain_names) {
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        *sids = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, *num_domains);
-        if (!*sids) {
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        for (i=0; i< *num_domains; i++) {
-                (*domain_names)[i] = CONST_DISCARD(char *, dom_list.domains[i].name.string);
-                (*sids)[i] = *dom_list.domains[i].sid;
-        }
-
-done:
-        /* cleanup */
-        if (cli) {
-                DEBUG(10,("enumerate_domain_trusts: shutting down connection...\n"));
-                cli_shutdown( cli );
-        }
-
-        return NT_STATUS_IS_OK(status);
-}
-
-NTSTATUS change_trust_account_password( const char *domain, const char *remote_machine)
-{
-        NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
-        struct sockaddr_storage pdc_ss;
-        fstring dc_name;
-        struct cli_state *cli = NULL;
-        struct rpc_pipe_client *netlogon_pipe = NULL;
-
-        DEBUG(5,("change_trust_account_password: Attempting to change trust account password in domain %s....\n",
-                domain));
-
-        if (remote_machine == NULL || !strcmp(remote_machine, "*")) {
-                /* Use the PDC *only* for this */
-
-                if ( !get_pdc_ip(domain, &pdc_ss) ) {
-                        DEBUG(0,("Can't get IP for PDC for domain %s\n", domain));
-                        goto failed;
-                }
-
-                if ( !name_status_find( domain, 0x1b, 0x20, &pdc_ss, dc_name) )
-                        goto failed;
-        } else {
-                /* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */
-                fstrcpy( dc_name, remote_machine );
-        }
-
-        /* if this next call fails, then give up.  We can't do
-           password changes on BDC's  --jerry */
-
-        if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), dc_name,
-                                           NULL, 0,
-                                           "IPC$", "IPC",
-                                           "", "",
-                                           "", 0, Undefined))) {
-                DEBUG(0,("modify_trust_password: Connection to %s failed!\n", dc_name));
-                nt_status = NT_STATUS_UNSUCCESSFUL;
-                goto failed;
-        }
-
-        /*
-         * Ok - we have an anonymous connection to the IPC$ share.
-         * Now start the NT Domain stuff :-).
-         */
-
-        /* Shouldn't we open this with schannel ? JRA. */
-
-        nt_status = cli_rpc_pipe_open_noauth(
-                cli, &ndr_table_netlogon.syntax_id, &netlogon_pipe);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(0,("modify_trust_password: unable to open the domain client session to machine %s. Error was : %s.\n",
-                        dc_name, nt_errstr(nt_status)));
-                cli_shutdown(cli);
-                cli = NULL;
-                goto failed;
-        }
-
-        nt_status = trust_pw_find_change_and_store_it(
-                netlogon_pipe, netlogon_pipe, domain);
-
-        cli_shutdown(cli);
-        cli = NULL;
-
-failed:
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(0,("%s : change_trust_account_password: Failed to change password for domain %s.\n",
-                        current_timestring(talloc_tos(), False), domain));
-        }
-        else
-                DEBUG(5,("change_trust_account_password: sucess!\n"));
-
-        return nt_status;
-}