Changeset 228 for branches/samba-3.2.x/source/libnet

Timestamp:

May 26, 2009, 9:44:50 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.6

Location:

branches/samba-3.2.x/source/libnet

Files:

• libnet_join.c (modified) (4 diffs)
• libnet_proto.h (modified) (1 diff)
• libnet_samsync.c (modified) (7 diffs)

branches/samba-3.2.x/source/libnet/libnet_join.c

@@ -358 +358 @@
         spn_array[0] = spn;
 
-        if (name_to_fqdn(my_fqdn, r->in.machine_name) &&
-            !strequal(my_fqdn, r->in.machine_name)) {
-
-                strlower_m(my_fqdn);
+        if (!name_to_fqdn(my_fqdn, r->in.machine_name)
+            || (strchr(my_fqdn, '.') == NULL)) {
+                fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
+                        r->out.dns_domain_name);
+        }
+
+        strlower_m(my_fqdn);
+
+        if (!strequal(my_fqdn, r->in.machine_name)) {
                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
                 if (!spn) {
@@ -730 +735 @@
         uint32_t user_rid;
         uint32_t acct_flags = ACB_WSTRUST;
-        uchar pwbuf[532];
-        struct MD5Context md5ctx;
-        uchar md5buffer[16];
-        DATA_BLOB digested_session_key;
-        uchar md4_trust_password[16];
         struct samr_Ids user_rids;
         struct samr_Ids name_types;
         union samr_UserInfo user_info;
+
+        struct samr_CryptPassword crypt_pwd;
+        struct samr_CryptPasswordEx crypt_pwd_ex;
 
         ZERO_STRUCT(sam_pol);
@@ -866 +869 @@
         }
 
-        /* Create a random machine account password and generate the hash */
-
-        E_md4hash(r->in.machine_password, md4_trust_password);
-        encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
-
-        generate_random_buffer((uint8_t*)md5buffer, sizeof(md5buffer));
-        digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
-
-        MD5Init(&md5ctx);
-        MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
-        MD5Update(&md5ctx, cli->user_session_key.data,
-                  cli->user_session_key.length);
-        MD5Final(digested_session_key.data, &md5ctx);
-
-        SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
-        memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
-
         /* Fill in the additional account flags now */
 
@@ -893 +879 @@
         }
 
-        /* Set password and account flags on machine account */
-
-        ZERO_STRUCT(user_info.info25);
-
-        user_info.info25.info.fields_present = ACCT_NT_PWD_SET |
-                                               ACCT_LM_PWD_SET |
-                                               SAMR_FIELD_ACCT_FLAGS;
-
-        user_info.info25.info.acct_flags = acct_flags;
-        memcpy(&user_info.info25.password.data, pwbuf, sizeof(pwbuf));
+        /* Set account flags on machine account */
+        ZERO_STRUCT(user_info.info16);
+        user_info.info16.acct_flags = acct_flags;
 
         status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
                                          &user_pol,
-                                         25,
+                                         16,
                                          &user_info);
 
+        if (!NT_STATUS_IS_OK(status)) {
+
+                rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
+                                       &user_pol);
+
+                libnet_join_set_error_string(mem_ctx, r,
+                        "Failed to set account flags for machine account (%s)\n",
+                        nt_errstr(status));
+                goto done;
+        }
+
+        /* Set password on machine account - first try level 26 */
+
+        init_samr_CryptPasswordEx(r->in.machine_password,
+                                  &cli->user_session_key,
+                                  &crypt_pwd_ex);
+
+        init_samr_user_info26(&user_info.info26, &crypt_pwd_ex,
+                              PASS_DONT_CHANGE_AT_NEXT_LOGON);
+
+        status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
+                                          &user_pol,
+                                          26,
+                                          &user_info);
+
         if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
 
-                uchar pwbuf2[516];
-
-                encode_pw_buffer(pwbuf2, r->in.machine_password, STR_UNICODE);
-
                 /* retry with level 24 */
-                init_samr_user_info24(&user_info.info24, pwbuf2, 24);
-
-                SamOEMhashBlob(user_info.info24.password.data, 516,
-                               &cli->user_session_key);
+
+                init_samr_CryptPassword(r->in.machine_password,
+                                        &cli->user_session_key,
+                                        &crypt_pwd);
+
+                init_samr_user_info24(&user_info.info24, &crypt_pwd,
+                                      PASS_DONT_CHANGE_AT_NEXT_LOGON);
 
                 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,

branches/samba-3.2.x/source/libnet/libnet_proto.h

@@ -25 +25 @@
 NTSTATUS samsync_fix_delta_array(TALLOC_CTX *mem_ctx,
                                  DATA_BLOB *session_key,
-                                 bool rid_crypt,
                                  enum netr_SamDatabaseID database_id,
                                  struct netr_DELTA_ENUM_ARRAY *r);

branches/samba-3.2.x/source/libnet/libnet_samsync.c

@@ -33 +33 @@
 static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
                          DATA_BLOB *session_key,
-                         bool rid_crypt,
                          enum netr_SamDatabaseID database_id,
                          struct netr_DELTA_ENUM *delta)
@@ -42 +41 @@
         struct samr_Password lm_hash;
         struct samr_Password nt_hash;
+        unsigned char zero_buf[16];
 
-        if (rid_crypt) {
-                if (user->lm_password_present) {
+        memset(zero_buf, '\0', sizeof(zero_buf));
+
+        /* Note that win2000 may send us all zeros
+         * for the hashes if it doesn't
+         * think this channel is secure enough. */
+        if (user->lm_password_present) {
+                if (memcmp(user->lmpassword.hash, zero_buf, 16) != 0) {
                         sam_pwd_hash(rid, user->lmpassword.hash, lm_hash.hash, 0);
-                        user->lmpassword = lm_hash;
+                } else {
+                        memset(lm_hash.hash, '\0', sizeof(lm_hash.hash));
                 }
+                user->lmpassword = lm_hash;
+        }
 
-                if (user->nt_password_present) {
+        if (user->nt_password_present) {
+                if (memcmp(user->ntpassword.hash, zero_buf, 16) != 0) {
                         sam_pwd_hash(rid, user->ntpassword.hash, nt_hash.hash, 0);
-                        user->ntpassword = nt_hash;
+                } else {
+                        memset(nt_hash.hash, '\0', sizeof(nt_hash.hash));
                 }
+                user->ntpassword = nt_hash;
         }
 
@@ -72 +83 @@
                 }
 
+                /* Note that win2000 may send us all zeros
+                 * for the hashes if it doesn't
+                 * think this channel is secure enough. */
                 if (keys.keys.keys2.lmpassword.length == 16) {
-                        if (rid_crypt) {
+                        if (memcmp(keys.keys.keys2.lmpassword.pwd.hash,
+                                                zero_buf, 16) != 0) {
                                 sam_pwd_hash(rid,
                                              keys.keys.keys2.lmpassword.pwd.hash,
                                              lm_hash.hash, 0);
-                                user->lmpassword = lm_hash;
                         } else {
-                                user->lmpassword = keys.keys.keys2.lmpassword.pwd;
+                                memset(lm_hash.hash, '\0', sizeof(lm_hash.hash));
                         }
+                        user->lmpassword = lm_hash;
                         user->lm_password_present = true;
                 }
                 if (keys.keys.keys2.ntpassword.length == 16) {
-                        if (rid_crypt) {
+                        if (memcmp(keys.keys.keys2.ntpassword.pwd.hash,
+                                                zero_buf, 16) != 0) {
                                 sam_pwd_hash(rid,
-                                             keys.keys.keys2.ntpassword.pwd.hash,
-                                             nt_hash.hash, 0);
-                                user->ntpassword = nt_hash;
+                                        keys.keys.keys2.ntpassword.pwd.hash,
+                                        nt_hash.hash, 0);
                         } else {
-                                user->ntpassword = keys.keys.keys2.ntpassword.pwd;
+                                memset(nt_hash.hash, '\0', sizeof(nt_hash.hash));
                         }
+                        user->ntpassword = nt_hash;
                         user->nt_password_present = true;
                 }
@@ -129 +145 @@
 static NTSTATUS samsync_fix_delta(TALLOC_CTX *mem_ctx,
                                   DATA_BLOB *session_key,
-                                  bool rid_crypt,
                                   enum netr_SamDatabaseID database_id,
                                   struct netr_DELTA_ENUM *delta)
@@ -140 +155 @@
                         status = fix_user(mem_ctx,
                                           session_key,
-                                          rid_crypt,
                                           database_id,
                                           delta);
@@ -165 +179 @@
 NTSTATUS samsync_fix_delta_array(TALLOC_CTX *mem_ctx,
                                  DATA_BLOB *session_key,
-                                 bool rid_crypt,
                                  enum netr_SamDatabaseID database_id,
                                  struct netr_DELTA_ENUM_ARRAY *r)
@@ -176 +189 @@
                 status = samsync_fix_delta(mem_ctx,
                                            session_key,
-                                           rid_crypt,
                                            database_id,
                                            &r->delta_enum[i]);