2 * Unix SMB/CIFS implementation.
3 * Routines to operate on various trust relationships
4 * Copyright (C) Andrew Bartlett 2001
5 * Copyright (C) Rafal Szczesniak 2003
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "../libcli/auth/libcli_auth.h"
23 #include "../libcli/auth/netlogon_creds_cli.h"
24 #include "rpc_client/cli_netlogon.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../librpc/gen_ndr/ndr_netlogon.h"
29 #include "libsmb/libsmb.h"
30 #include "source3/include/messages.h"
31 #include "source3/include/g_lock.h"
33 /*********************************************************
34 Change the domain password on the PDC.
35 Do most of the legwork ourselfs. Caller must have
36 already setup the connection to the NETLOGON pipe
37 **********************************************************/
39 struct trust_pw_change_state {
40 struct g_lock_ctx *g_ctx;
44 static int trust_pw_change_state_destructor(struct trust_pw_change_state *state)
46 g_lock_unlock(state->g_ctx, state->g_lock_key);
50 char *trust_pw_new_value(TALLOC_CTX *mem_ctx,
51 enum netr_SchannelType sec_channel_type,
55 * use secure defaults.
60 switch (sec_channel_type) {
63 if (security == SEC_DOMAIN) {
65 * The maximum length of a trust account password.
66 * Used when we randomly create it, 15 char passwords
67 * exceed NT4's max password length.
73 case SEC_CHAN_DNS_DOMAIN:
75 * new_len * 2 = 498 bytes is the largest possible length
76 * NL_PASSWORD_VERSION consumes the rest of the possible 512 bytes
77 * and a confounder with at least 2 bytes is required.
79 * Windows uses new_len = 120 => 240 bytes (utf16)
87 * The maximum length of a trust account password.
88 * Used when we randomly create it, 15 char passwords
89 * exceed NT4's max password length.
99 * Create a random machine account password
100 * We create a random buffer and convert that to utf8.
101 * This is similar to what windows is doing.
103 return generate_random_machine_password(mem_ctx, min, max);
106 NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
107 struct messaging_context *msg_ctx,
108 struct dcerpc_binding_handle *b,
113 TALLOC_CTX *frame = talloc_stackframe();
114 const char *context_name = NULL;
115 struct trust_pw_change_state *state;
116 struct cli_credentials *creds = NULL;
117 const struct samr_Password *current_nt_hash = NULL;
118 uint8_t num_nt_hashes = 0;
119 const struct samr_Password *nt_hashes[1] = { NULL, };
120 uint8_t idx_nt_hashes = 0;
121 enum netr_SchannelType sec_channel_type = SEC_CHAN_NULL;
122 time_t pass_last_set_time;
123 uint32_t old_version = 0;
124 struct pdb_trusted_domain *td = NULL;
125 struct timeval g_timeout = { 0, };
127 struct timeval tv = { 0, };
128 char *new_trust_pw_str = NULL;
130 DATA_BLOB new_trust_pw_blob = data_blob_null;
131 uint32_t new_version = 0;
132 uint32_t *new_trust_version = NULL;
136 state = talloc_zero(frame, struct trust_pw_change_state);
139 return NT_STATUS_NO_MEMORY;
142 state->g_ctx = g_lock_ctx_init(state, msg_ctx);
143 if (state->g_ctx == NULL) {
145 return NT_STATUS_NO_MEMORY;
148 state->g_lock_key = talloc_asprintf(state,
149 "trust_password_change_%s",
151 if (state->g_lock_key == NULL) {
153 return NT_STATUS_NO_MEMORY;
156 g_timeout = timeval_current_ofs(10, 0);
157 status = g_lock_lock(state->g_ctx,
159 G_LOCK_WRITE, g_timeout);
160 if (!NT_STATUS_IS_OK(status)) {
161 DEBUG(1, ("could not get g_lock on [%s]!\n",
167 talloc_set_destructor(state, trust_pw_change_state_destructor);
169 status = pdb_get_trust_credentials(domain, NULL, frame, &creds);
170 if (!NT_STATUS_IS_OK(status)) {
171 DEBUG(0, ("could not fetch domain creds for domain %s - %s!\n",
172 domain, nt_errstr(status)));
174 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
177 current_nt_hash = cli_credentials_get_nt_hash(creds, frame);
178 if (current_nt_hash == NULL) {
179 DEBUG(0, ("cli_credentials_get_nt_hash failed for domain %s!\n",
182 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
185 old_version = cli_credentials_get_kvno(creds);
186 pass_last_set_time = cli_credentials_get_password_last_changed_time(creds);
187 sec_channel_type = cli_credentials_get_secure_channel_type(creds);
189 new_version = old_version + 1;
191 switch (sec_channel_type) {
195 case SEC_CHAN_DNS_DOMAIN:
196 case SEC_CHAN_DOMAIN:
197 status = pdb_get_trusted_domain(frame, domain, &td);
198 if (!NT_STATUS_IS_OK(status)) {
199 DEBUG(0, ("pdb_get_trusted_domain() failed for domain %s - %s!\n",
200 domain, nt_errstr(status)));
205 new_trust_version = &new_version;
209 return NT_STATUS_NOT_SUPPORTED;
212 timeout = lp_machine_password_timeout();
215 DEBUG(10,("machine password never expires\n"));
221 tv.tv_sec = pass_last_set_time;
222 DEBUG(10, ("password last changed %s\n",
223 timeval_string(talloc_tos(), &tv, false)));
224 tv.tv_sec += timeout;
225 DEBUGADD(10, ("password valid until %s\n",
226 timeval_string(talloc_tos(), &tv, false)));
228 if (!force && !timeval_expired(&tv)) {
233 context_name = netlogon_creds_cli_debug_string(context, talloc_tos());
234 if (context_name == NULL) {
236 return NT_STATUS_NO_MEMORY;
240 * Create a random machine account password
241 * We create a random buffer and convert that to utf8.
242 * This is similar to what windows is doing.
244 new_trust_pw_str = trust_pw_new_value(frame, sec_channel_type,
246 if (new_trust_pw_str == NULL) {
247 DEBUG(0, ("trust_pw_new_value() failed\n"));
249 return NT_STATUS_NO_MEMORY;
252 len = strlen(new_trust_pw_str);
253 ok = convert_string_talloc(frame, CH_UNIX, CH_UTF16,
254 new_trust_pw_str, len,
255 (void **)&new_trust_pw_blob.data,
256 &new_trust_pw_blob.length);
258 status = NT_STATUS_UNMAPPABLE_CHARACTER;
259 if (errno == ENOMEM) {
260 status = NT_STATUS_NO_MEMORY;
262 DBG_ERR("convert_string_talloc(CH_UTF16MUNGED, CH_UNIX) "
263 "failed for of %s - %s\n",
264 domain, nt_errstr(status));
269 nt_hashes[0] = current_nt_hash;
273 * We could use cli_credentials_get_old_nt_hash(creds, frame) to
274 * set previous_nt_hash.
276 * But we want to check if the dc has our current password and only do
277 * a change if that's the case. So we keep previous_nt_hash = NULL.
280 * If the previous password is the only password in common with the dc,
281 * we better skip the password change, or use something like
282 * ServerTrustPasswordsGet() or netr_ServerGetTrustInfo() to fix our
283 * local secrets before doing the change.
285 status = netlogon_creds_cli_auth(context, b,
289 if (!NT_STATUS_IS_OK(status)) {
290 DEBUG(0, ("netlogon_creds_cli_auth(%s) failed for old password - %s!\n",
291 context_name, nt_errstr(status)));
296 DEBUG(0,("%s : %s(%s): Verified old password remotely using %s\n",
297 current_timestring(talloc_tos(), false),
298 __func__, domain, context_name));
301 * Return the result of trying to write the new password
302 * back into the trust account file.
305 switch (sec_channel_type) {
309 ok = secrets_store_machine_password(new_trust_pw_str,
313 DEBUG(0, ("secrets_store_machine_password failed for domain %s!\n",
316 return NT_STATUS_INTERNAL_DB_CORRUPTION;
318 TALLOC_FREE(new_trust_pw_str);
321 case SEC_CHAN_DNS_DOMAIN:
322 case SEC_CHAN_DOMAIN:
324 * we need to get the sid first for the
325 * pdb_set_trusteddom_pw call
327 ok = pdb_set_trusteddom_pw(domain, new_trust_pw_str,
328 &td->security_identifier);
330 DEBUG(0, ("pdb_set_trusteddom_pw() failed for domain %s!\n",
333 return NT_STATUS_INTERNAL_DB_CORRUPTION;
335 TALLOC_FREE(new_trust_pw_str);
339 smb_panic("Unsupported secure channel type");
343 DEBUG(0,("%s : %s(%s): Changed password locally\n",
344 current_timestring(talloc_tos(), false), __func__, domain));
346 status = netlogon_creds_cli_ServerPasswordSet(context, b,
349 if (!NT_STATUS_IS_OK(status)) {
350 DEBUG(0,("%s : %s(%s) remote password change set with %s failed - %s\n",
351 current_timestring(talloc_tos(), false),
352 __func__, domain, context_name,
358 DEBUG(0,("%s : %s(%s): Changed password remotely using %s\n",
359 current_timestring(talloc_tos(), false),
360 __func__, domain, context_name));
362 ok = cli_credentials_set_utf16_password(creds,
366 DEBUG(0, ("cli_credentials_set_password failed for domain %s!\n",
369 return NT_STATUS_NO_MEMORY;
372 current_nt_hash = cli_credentials_get_nt_hash(creds, frame);
373 if (current_nt_hash == NULL) {
374 DEBUG(0, ("cli_credentials_get_nt_hash failed for domain %s!\n",
377 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
381 * Now we verify the new password.
383 nt_hashes[0] = current_nt_hash;
385 status = netlogon_creds_cli_auth(context, b,
389 if (!NT_STATUS_IS_OK(status)) {
390 DEBUG(0, ("netlogon_creds_cli_auth(%s) failed for new password - %s!\n",
391 context_name, nt_errstr(status)));
396 DEBUG(0,("%s : %s(%s): Verified new password remotely using %s\n",
397 current_timestring(talloc_tos(), false),
398 __func__, domain, context_name));