From 786c41b0954b541518d1096019e1ce7ca11e5e98 Mon Sep 17 00:00:00 2001
From: Matthias Dieter Wallnöfer <mdw@samba.org>
Date: Sun, 15 Aug 2010 21:51:14 +0200
Subject: s4:netlogon RPC server - "ServerPasswordSet" operations - introduce
 also here the new password change syntax

---
 source4/rpc_server/netlogon/dcerpc_netlogon.c | 45 +++++++++++++++++++++++++--
 1 file changed, 43 insertions(+), 2 deletions(-)

(limited to 'source4/rpc_server/netlogon/dcerpc_netlogon.c')

diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 5893bd4821..a599822d9e 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -32,6 +32,7 @@
 #include "param/param.h"
 #include "lib/messaging/irpc.h"
 #include "librpc/gen_ndr/ndr_irpc.h"
+#include "../libcli/ldap/ldap_ndr.h"
 #include "cldap_server/cldap_server.h"
 #include "lib/tsocket/tsocket.h"
 
@@ -384,7 +385,11 @@ static NTSTATUS dcesrv_netr_ServerPasswordSet(struct dcesrv_call_state *dce_call
 {
 	struct netlogon_creds_CredentialState *creds;
 	struct ldb_context *sam_ctx;
+	const char * const attrs[] = { "unicodePwd", NULL };
+	struct ldb_message **res;
+	struct samr_Password *oldNtHash;
 	NTSTATUS nt_status;
+	int ret;
 
 	nt_status = dcesrv_netr_creds_server_step_check(dce_call,
 							mem_ctx,
@@ -400,12 +405,28 @@ static NTSTATUS dcesrv_netr_ServerPasswordSet(struct dcesrv_call_state *dce_call
 
 	netlogon_creds_des_decrypt(creds, r->in.new_password);
 
+	/* fetch the old password hashes (the NT hash has to exist) */
+
+	ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
+			   "(&(objectClass=user)(objectSid=%s))",
+			   ldap_encode_ndr_dom_sid(mem_ctx, creds->sid));
+	if (ret != 1) {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	nt_status = samdb_result_passwords(mem_ctx,
+					   dce_call->conn->dce_ctx->lp_ctx,
+					   res[0], NULL, &oldNtHash);
+	if (!NT_STATUS_IS_OK(nt_status) || !oldNtHash) {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
 	/* Using the sid for the account as the key, set the password */
 	nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
 					   creds->sid,
 					   NULL, /* Don't have plaintext */
 					   NULL, r->in.new_password,
-					   true, /* Password change */
+					   NULL, oldNtHash, /* Password change */
 					   NULL, NULL);
 	return nt_status;
 }
@@ -419,8 +440,12 @@ static NTSTATUS dcesrv_netr_ServerPasswordSet2(struct dcesrv_call_state *dce_cal
 {
 	struct netlogon_creds_CredentialState *creds;
 	struct ldb_context *sam_ctx;
+	const char * const attrs[] = { "dBCSPwd", "unicodePwd", NULL };
+	struct ldb_message **res;
+	struct samr_Password *oldLmHash, *oldNtHash;
 	NTSTATUS nt_status;
 	DATA_BLOB new_password;
+	int ret;
 
 	struct samr_CryptPassword password_buf;
 
@@ -445,12 +470,28 @@ static NTSTATUS dcesrv_netr_ServerPasswordSet2(struct dcesrv_call_state *dce_cal
 		return NT_STATUS_WRONG_PASSWORD;
 	}
 
+	/* fetch the old password hashes (at least one of both has to exist) */
+
+	ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
+			   "(&(objectClass=user)(objectSid=%s))",
+			   ldap_encode_ndr_dom_sid(mem_ctx, creds->sid));
+	if (ret != 1) {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
+	nt_status = samdb_result_passwords(mem_ctx,
+					   dce_call->conn->dce_ctx->lp_ctx,
+					   res[0], &oldLmHash, &oldNtHash);
+	if (!NT_STATUS_IS_OK(nt_status) || (!oldLmHash && !oldNtHash)) {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+
 	/* Using the sid for the account as the key, set the password */
 	nt_status = samdb_set_password_sid(sam_ctx, mem_ctx,
 					   creds->sid,
 					   &new_password, /* we have plaintext */
 					   NULL, NULL,
-					   true, /* Password change */
+					   oldLmHash, oldNtHash, /* Password change */
 					   NULL, NULL);
 	return nt_status;
 }
-- 
cgit