Changeset 860 for vendor/current/source3/smbd/lanman.c
- Timestamp:
- May 12, 2014, 8:58:38 PM (11 years ago)
- File:
-
- 1 edited
-
vendor/current/source3/smbd/lanman.c (modified) (3 diffs)
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/source3/smbd/lanman.c
r746 r860 2629 2629 goto close_domain; 2630 2630 } 2631 if (rid.count != 1) { 2632 status = NT_STATUS_INVALID_NETWORK_RESPONSE; 2633 goto close_domain; 2634 } 2635 if (type.count != 1) { 2636 status = NT_STATUS_INVALID_NETWORK_RESPONSE; 2637 goto close_domain; 2638 } 2631 2639 2632 2640 if (type.ids[0] != SID_NAME_USER) { … … 2937 2945 2938 2946 return True; 2939 }2940 2941 /****************************************************************************2942 Set the user password.2943 *****************************************************************************/2944 2945 static bool api_SetUserPassword(struct smbd_server_connection *sconn,2946 connection_struct *conn,uint16 vuid,2947 char *param, int tpscnt,2948 char *data, int tdscnt,2949 int mdrcnt,int mprcnt,2950 char **rdata,char **rparam,2951 int *rdata_len,int *rparam_len)2952 {2953 char *np = get_safe_str_ptr(param,tpscnt,param,2);2954 char *p = NULL;2955 fstring user;2956 fstring pass1,pass2;2957 TALLOC_CTX *mem_ctx = talloc_tos();2958 NTSTATUS status, result;2959 struct rpc_pipe_client *cli = NULL;2960 struct policy_handle connect_handle, domain_handle, user_handle;2961 struct lsa_String domain_name;2962 struct dom_sid2 *domain_sid;2963 struct lsa_String names;2964 struct samr_Ids rids;2965 struct samr_Ids types;2966 struct samr_Password old_lm_hash;2967 struct samr_Password new_lm_hash;2968 int errcode = NERR_badpass;2969 uint32_t rid;2970 int encrypted;2971 int min_pwd_length;2972 struct dcerpc_binding_handle *b = NULL;2973 2974 /* Skip 2 strings. */2975 p = skip_string(param,tpscnt,np);2976 p = skip_string(param,tpscnt,p);2977 2978 if (!np || !p) {2979 return False;2980 }2981 2982 /* Do we have a string ? */2983 if (skip_string(param,tpscnt,p) == NULL) {2984 return False;2985 }2986 pull_ascii_fstring(user,p);2987 2988 p = skip_string(param,tpscnt,p);2989 if (!p) {2990 return False;2991 }2992 2993 memset(pass1,'\0',sizeof(pass1));2994 memset(pass2,'\0',sizeof(pass2));2995 /*2996 * We use 31 here not 32 as we're checking2997 * the last byte we want to access is safe.2998 */2999 if (!is_offset_safe(param,tpscnt,p,31)) {3000 return False;3001 }3002 memcpy(pass1,p,16);3003 memcpy(pass2,p+16,16);3004 3005 encrypted = get_safe_SVAL(param,tpscnt,p+32,0,-1);3006 if (encrypted == -1) {3007 errcode = W_ERROR_V(WERR_INVALID_PARAM);3008 goto out;3009 }3010 3011 min_pwd_length = get_safe_SVAL(param,tpscnt,p+34,0,-1);3012 if (min_pwd_length == -1) {3013 errcode = W_ERROR_V(WERR_INVALID_PARAM);3014 goto out;3015 }3016 3017 *rparam_len = 4;3018 *rparam = smb_realloc_limit(*rparam,*rparam_len);3019 if (!*rparam) {3020 return False;3021 }3022 3023 *rdata_len = 0;3024 3025 DEBUG(3,("Set password for <%s> (encrypted: %d, min_pwd_length: %d)\n",3026 user, encrypted, min_pwd_length));3027 3028 ZERO_STRUCT(connect_handle);3029 ZERO_STRUCT(domain_handle);3030 ZERO_STRUCT(user_handle);3031 3032 status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr.syntax_id,3033 conn->session_info,3034 &conn->sconn->client_id,3035 conn->sconn->msg_ctx,3036 &cli);3037 if (!NT_STATUS_IS_OK(status)) {3038 DEBUG(0,("api_SetUserPassword: could not connect to samr: %s\n",3039 nt_errstr(status)));3040 errcode = W_ERROR_V(ntstatus_to_werror(status));3041 goto out;3042 }3043 3044 b = cli->binding_handle;3045 3046 status = dcerpc_samr_Connect2(b, mem_ctx,3047 global_myname(),3048 SAMR_ACCESS_CONNECT_TO_SERVER |3049 SAMR_ACCESS_ENUM_DOMAINS |3050 SAMR_ACCESS_LOOKUP_DOMAIN,3051 &connect_handle,3052 &result);3053 if (!NT_STATUS_IS_OK(status)) {3054 errcode = W_ERROR_V(ntstatus_to_werror(status));3055 goto out;3056 }3057 if (!NT_STATUS_IS_OK(result)) {3058 errcode = W_ERROR_V(ntstatus_to_werror(result));3059 goto out;3060 }3061 3062 init_lsa_String(&domain_name, get_global_sam_name());3063 3064 status = dcerpc_samr_LookupDomain(b, mem_ctx,3065 &connect_handle,3066 &domain_name,3067 &domain_sid,3068 &result);3069 if (!NT_STATUS_IS_OK(status)) {3070 errcode = W_ERROR_V(ntstatus_to_werror(status));3071 goto out;3072 }3073 if (!NT_STATUS_IS_OK(result)) {3074 errcode = W_ERROR_V(ntstatus_to_werror(result));3075 goto out;3076 }3077 3078 status = dcerpc_samr_OpenDomain(b, mem_ctx,3079 &connect_handle,3080 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,3081 domain_sid,3082 &domain_handle,3083 &result);3084 if (!NT_STATUS_IS_OK(status)) {3085 errcode = W_ERROR_V(ntstatus_to_werror(status));3086 goto out;3087 }3088 if (!NT_STATUS_IS_OK(result)) {3089 errcode = W_ERROR_V(ntstatus_to_werror(result));3090 goto out;3091 }3092 3093 init_lsa_String(&names, user);3094 3095 status = dcerpc_samr_LookupNames(b, mem_ctx,3096 &domain_handle,3097 1,3098 &names,3099 &rids,3100 &types,3101 &result);3102 if (!NT_STATUS_IS_OK(status)) {3103 errcode = W_ERROR_V(ntstatus_to_werror(status));3104 goto out;3105 }3106 if (!NT_STATUS_IS_OK(result)) {3107 errcode = W_ERROR_V(ntstatus_to_werror(result));3108 goto out;3109 }3110 3111 if (rids.count != 1) {3112 errcode = W_ERROR_V(WERR_NO_SUCH_USER);3113 goto out;3114 }3115 if (rids.count != types.count) {3116 errcode = W_ERROR_V(WERR_INVALID_PARAM);3117 goto out;3118 }3119 if (types.ids[0] != SID_NAME_USER) {3120 errcode = W_ERROR_V(WERR_INVALID_PARAM);3121 goto out;3122 }3123 3124 rid = rids.ids[0];3125 3126 status = dcerpc_samr_OpenUser(b, mem_ctx,3127 &domain_handle,3128 SAMR_USER_ACCESS_CHANGE_PASSWORD,3129 rid,3130 &user_handle,3131 &result);3132 if (!NT_STATUS_IS_OK(status)) {3133 errcode = W_ERROR_V(ntstatus_to_werror(status));3134 goto out;3135 }3136 if (!NT_STATUS_IS_OK(result)) {3137 errcode = W_ERROR_V(ntstatus_to_werror(result));3138 goto out;3139 }3140 3141 if (encrypted == 0) {3142 E_deshash(pass1, old_lm_hash.hash);3143 E_deshash(pass2, new_lm_hash.hash);3144 } else {3145 ZERO_STRUCT(old_lm_hash);3146 ZERO_STRUCT(new_lm_hash);3147 memcpy(old_lm_hash.hash, pass1, MIN(strlen(pass1), 16));3148 memcpy(new_lm_hash.hash, pass1, MIN(strlen(pass2), 16));3149 }3150 3151 status = dcerpc_samr_ChangePasswordUser(b, mem_ctx,3152 &user_handle,3153 true, /* lm_present */3154 &old_lm_hash,3155 &new_lm_hash,3156 false, /* nt_present */3157 NULL, /* old_nt_crypted */3158 NULL, /* new_nt_crypted */3159 false, /* cross1_present */3160 NULL, /* nt_cross */3161 false, /* cross2_present */3162 NULL, /* lm_cross */3163 &result);3164 if (!NT_STATUS_IS_OK(status)) {3165 errcode = W_ERROR_V(ntstatus_to_werror(status));3166 goto out;3167 }3168 if (!NT_STATUS_IS_OK(result)) {3169 errcode = W_ERROR_V(ntstatus_to_werror(result));3170 goto out;3171 }3172 3173 errcode = NERR_Success;3174 out:3175 3176 if (b && is_valid_policy_hnd(&user_handle)) {3177 dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);3178 }3179 if (b && is_valid_policy_hnd(&domain_handle)) {3180 dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);3181 }3182 if (b && is_valid_policy_hnd(&connect_handle)) {3183 dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);3184 }3185 3186 memset((char *)pass1,'\0',sizeof(fstring));3187 memset((char *)pass2,'\0',sizeof(fstring));3188 3189 SSVAL(*rparam,0,errcode);3190 SSVAL(*rparam,2,0); /* converter word */3191 return(True);3192 2947 } 3193 2948 … … 5785 5540 {"NetServerEnum3", RAP_NetServerEnum3, api_RNetServerEnum3}, /* anon OK */ 5786 5541 {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms}, 5787 {"SetUserPassword", RAP_WUserPasswordSet2, api_SetUserPassword},5788 5542 {"WWkstaUserLogon", RAP_WWkstaUserLogon, api_WWkstaUserLogon}, 5789 5543 {"PrintJobInfo", RAP_WPrintJobSetInfo, api_PrintJobInfo},
Note:
See TracChangeset
for help on using the changeset viewer.
