source3/rpc_client/cli_samr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4    Copyright (C) Tim Potter                        2000-2001,
   5    Copyright (C) Andrew Tridgell              1992-1997,2000,
   6    Copyright (C) Rafal Szczesniak                       2002.
   7    Copyright (C) Jeremy Allison                         2005.
   8    Copyright (C) Guenther Deschner                      2008.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "../libcli/auth/libcli_auth.h"
  26 #include "../librpc/gen_ndr/cli_samr.h"
  27 #include "rpc_client/cli_samr.h"
  28 #include "../lib/crypto/arcfour.h"
  29 #include "rpc_client/init_lsa.h"
  30
  31 /* User change password */
  32
  33 NTSTATUS dcerpc_samr_chgpasswd_user(struct dcerpc_binding_handle *h,
  34                                     TALLOC_CTX *mem_ctx,
  35                                     struct policy_handle *user_handle,
  36                                     const char *newpassword,
  37                                     const char *oldpassword,
  38                                     NTSTATUS *presult)
  39 {
  40         NTSTATUS status;
  41         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
  42
  43         uchar old_nt_hash[16];
  44         uchar old_lm_hash[16];
  45         uchar new_nt_hash[16];
  46         uchar new_lm_hash[16];
  47
  48         ZERO_STRUCT(old_nt_hash);
  49         ZERO_STRUCT(old_lm_hash);
  50         ZERO_STRUCT(new_nt_hash);
  51         ZERO_STRUCT(new_lm_hash);
  52
  53         DEBUG(10,("rpccli_samr_chgpasswd_user\n"));
  54
  55         E_md4hash(oldpassword, old_nt_hash);
  56         E_md4hash(newpassword, new_nt_hash);
  57
  58         E_deshash(oldpassword, old_lm_hash);
  59         E_deshash(newpassword, new_lm_hash);
  60
  61         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
  62         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
  63         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
  64         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
  65         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
  66         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
  67
  68         status = dcerpc_samr_ChangePasswordUser(h,
  69                                                 mem_ctx,
  70                                                 user_handle,
  71                                                 true,
  72                                                 &hash1,
  73                                                 &hash2,
  74                                                 true,
  75                                                 &hash3,
  76                                                 &hash4,
  77                                                 true,
  78                                                 &hash5,
  79                                                 true,
  80                                                 &hash6,
  81                                                 presult);
  82
  83         return status;
  84 }
  85
  86 NTSTATUS rpccli_samr_chgpasswd_user(struct rpc_pipe_client *cli,
  87                                     TALLOC_CTX *mem_ctx,
  88                                     struct policy_handle *user_handle,
  89                                     const char *newpassword,
  90                                     const char *oldpassword)
  91 {
  92         NTSTATUS status;
  93         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  94
  95         status = dcerpc_samr_chgpasswd_user(cli->binding_handle,
  96                                             mem_ctx,
  97                                             user_handle,
  98                                             newpassword,
  99                                             oldpassword,
 100                                             &result);
 101         if (!NT_STATUS_IS_OK(status)) {
 102                 return status;
 103         }
 104
 105         return result;
 106 }
 107
 108 /* User change password */
 109
 110 NTSTATUS dcerpc_samr_chgpasswd_user2(struct dcerpc_binding_handle *h,
 111                                      TALLOC_CTX *mem_ctx,
 112                                      const char *srv_name_slash,
 113                                      const char *username,
 114                                      const char *newpassword,
 115                                      const char *oldpassword,
 116                                      NTSTATUS *presult)
 117 {
 118         NTSTATUS status;
 119         struct samr_CryptPassword new_nt_password;
 120         struct samr_CryptPassword new_lm_password;
 121         struct samr_Password old_nt_hash_enc;
 122         struct samr_Password old_lanman_hash_enc;
 123
 124         uint8_t old_nt_hash[16];
 125         uint8_t old_lanman_hash[16];
 126         uint8_t new_nt_hash[16];
 127         uint8_t new_lanman_hash[16];
 128         struct lsa_String server, account;
 129
 130         DEBUG(10,("rpccli_samr_chgpasswd_user2\n"));
 131
 132         init_lsa_String(&server, srv_name_slash);
 133         init_lsa_String(&account, username);
 134
 135         /* Calculate the MD4 hash (NT compatible) of the password */
 136         E_md4hash(oldpassword, old_nt_hash);
 137         E_md4hash(newpassword, new_nt_hash);
 138
 139         if (lp_client_lanman_auth() &&
 140             E_deshash(newpassword, new_lanman_hash) &&
 141             E_deshash(oldpassword, old_lanman_hash)) {
 142                 /* E_deshash returns false for 'long' passwords (> 14
 143                    DOS chars).  This allows us to match Win2k, which
 144                    does not store a LM hash for these passwords (which
 145                    would reduce the effective password length to 14) */
 146
 147                 encode_pw_buffer(new_lm_password.data, newpassword, STR_UNICODE);
 148
 149                 arcfour_crypt(new_lm_password.data, old_nt_hash, 516);
 150                 E_old_pw_hash(new_nt_hash, old_lanman_hash, old_lanman_hash_enc.hash);
 151         } else {
 152                 ZERO_STRUCT(new_lm_password);
 153                 ZERO_STRUCT(old_lanman_hash_enc);
 154         }
 155
 156         encode_pw_buffer(new_nt_password.data, newpassword, STR_UNICODE);
 157
 158         arcfour_crypt(new_nt_password.data, old_nt_hash, 516);
 159         E_old_pw_hash(new_nt_hash, old_nt_hash, old_nt_hash_enc.hash);
 160
 161         status = dcerpc_samr_ChangePasswordUser2(h,
 162                                                  mem_ctx,
 163                                                  &server,
 164                                                  &account,
 165                                                  &new_nt_password,
 166                                                  &old_nt_hash_enc,
 167                                                  true,
 168                                                  &new_lm_password,
 169                                                  &old_lanman_hash_enc,
 170                                                  presult);
 171
 172         return status;
 173 }
 174
 175 NTSTATUS rpccli_samr_chgpasswd_user2(struct rpc_pipe_client *cli,
 176                                      TALLOC_CTX *mem_ctx,
 177                                      const char *username,
 178                                      const char *newpassword,
 179                                      const char *oldpassword)
 180 {
 181         NTSTATUS status;
 182         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 183
 184         status = dcerpc_samr_chgpasswd_user2(cli->binding_handle,
 185                                              mem_ctx,
 186                                              cli->srv_name_slash,
 187                                              username,
 188                                              newpassword,
 189                                              oldpassword,
 190                                              &result);
 191         if (!NT_STATUS_IS_OK(status)) {
 192                 return status;
 193         }
 194
 195         return result;
 196 }
 197
 198 /* User change password given blobs */
 199
 200 NTSTATUS dcerpc_samr_chng_pswd_auth_crap(struct dcerpc_binding_handle *h,
 201                                          TALLOC_CTX *mem_ctx,
 202                                          const char *srv_name_slash,
 203                                          const char *username,
 204                                          DATA_BLOB new_nt_password_blob,
 205                                          DATA_BLOB old_nt_hash_enc_blob,
 206                                          DATA_BLOB new_lm_password_blob,
 207                                          DATA_BLOB old_lm_hash_enc_blob,
 208                                          NTSTATUS *presult)
 209 {
 210         NTSTATUS status;
 211         struct samr_CryptPassword new_nt_password;
 212         struct samr_CryptPassword new_lm_password;
 213         struct samr_Password old_nt_hash_enc;
 214         struct samr_Password old_lm_hash_enc;
 215         struct lsa_String server, account;
 216
 217         DEBUG(10,("rpccli_samr_chng_pswd_auth_crap\n"));
 218
 219         init_lsa_String(&server, srv_name_slash);
 220         init_lsa_String(&account, username);
 221
 222         if (new_nt_password_blob.length > 0) {
 223                 memcpy(&new_nt_password.data, new_nt_password_blob.data, 516);
 224         } else {
 225                 ZERO_STRUCT(new_nt_password_blob);
 226         }
 227
 228         if (new_lm_password_blob.length > 0) {
 229                 memcpy(&new_lm_password.data, new_lm_password_blob.data, 516);
 230         } else {
 231                 ZERO_STRUCT(new_lm_password);
 232         }
 233
 234         if (old_nt_hash_enc_blob.length > 0) {
 235                 memcpy(&old_nt_hash_enc.hash, old_nt_hash_enc_blob.data, 16);
 236         } else {
 237                 ZERO_STRUCT(old_nt_hash_enc);
 238         }
 239
 240         if (old_lm_hash_enc_blob.length > 0) {
 241                 memcpy(&old_lm_hash_enc.hash, old_lm_hash_enc_blob.data, 16);
 242         } else {
 243                 ZERO_STRUCT(old_lm_hash_enc);
 244         }
 245
 246         status = dcerpc_samr_ChangePasswordUser2(h,
 247                                                  mem_ctx,
 248                                                  &server,
 249                                                  &account,
 250                                                  &new_nt_password,
 251                                                  &old_nt_hash_enc,
 252                                                  true,
 253                                                  &new_lm_password,
 254                                                  &old_lm_hash_enc,
 255                                                  presult);
 256
 257         return status;
 258 }
 259
 260 NTSTATUS rpccli_samr_chng_pswd_auth_crap(struct rpc_pipe_client *cli,
 261                                          TALLOC_CTX *mem_ctx,
 262                                          const char *username,
 263                                          DATA_BLOB new_nt_password_blob,
 264                                          DATA_BLOB old_nt_hash_enc_blob,
 265                                          DATA_BLOB new_lm_password_blob,
 266                                          DATA_BLOB old_lm_hash_enc_blob)
 267 {
 268         NTSTATUS status;
 269         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 270
 271         status = dcerpc_samr_chng_pswd_auth_crap(cli->binding_handle,
 272                                                  mem_ctx,
 273                                                  cli->srv_name_slash,
 274                                                  username,
 275                                                  new_nt_password_blob,
 276                                                  old_nt_hash_enc_blob,
 277                                                  new_lm_password_blob,
 278                                                  old_lm_hash_enc_blob,
 279                                                  &result);
 280         if (!NT_STATUS_IS_OK(status)) {
 281                 return status;
 282         }
 283
 284         return result;
 285 }
 286
 287 /* change password 3 */
 288
 289 NTSTATUS dcerpc_samr_chgpasswd_user3(struct dcerpc_binding_handle *h,
 290                                      TALLOC_CTX *mem_ctx,
 291                                      const char *srv_name_slash,
 292                                      const char *username,
 293                                      const char *newpassword,
 294                                      const char *oldpassword,
 295                                      struct samr_DomInfo1 **dominfo1,
 296                                      struct userPwdChangeFailureInformation **reject,
 297                                      NTSTATUS *presult)
 298 {
 299         NTSTATUS status;
 300
 301         struct samr_CryptPassword new_nt_password;
 302         struct samr_CryptPassword new_lm_password;
 303         struct samr_Password old_nt_hash_enc;
 304         struct samr_Password old_lanman_hash_enc;
 305
 306         uint8_t old_nt_hash[16];
 307         uint8_t old_lanman_hash[16];
 308         uint8_t new_nt_hash[16];
 309         uint8_t new_lanman_hash[16];
 310
 311         struct lsa_String server, account;
 312
 313         DEBUG(10,("rpccli_samr_chgpasswd_user3\n"));
 314
 315         init_lsa_String(&server, srv_name_slash);
 316         init_lsa_String(&account, username);
 317
 318         /* Calculate the MD4 hash (NT compatible) of the password */
 319         E_md4hash(oldpassword, old_nt_hash);
 320         E_md4hash(newpassword, new_nt_hash);
 321
 322         if (lp_client_lanman_auth() &&
 323             E_deshash(newpassword, new_lanman_hash) &&
 324             E_deshash(oldpassword, old_lanman_hash)) {
 325                 /* E_deshash returns false for 'long' passwords (> 14
 326                    DOS chars).  This allows us to match Win2k, which
 327                    does not store a LM hash for these passwords (which
 328                    would reduce the effective password length to 14) */
 329
 330                 encode_pw_buffer(new_lm_password.data, newpassword, STR_UNICODE);
 331
 332                 arcfour_crypt(new_lm_password.data, old_nt_hash, 516);
 333                 E_old_pw_hash(new_nt_hash, old_lanman_hash, old_lanman_hash_enc.hash);
 334         } else {
 335                 ZERO_STRUCT(new_lm_password);
 336                 ZERO_STRUCT(old_lanman_hash_enc);
 337         }
 338
 339         encode_pw_buffer(new_nt_password.data, newpassword, STR_UNICODE);
 340
 341         arcfour_crypt(new_nt_password.data, old_nt_hash, 516);
 342         E_old_pw_hash(new_nt_hash, old_nt_hash, old_nt_hash_enc.hash);
 343
 344         status = dcerpc_samr_ChangePasswordUser3(h,
 345                                                  mem_ctx,
 346                                                  &server,
 347                                                  &account,
 348                                                  &new_nt_password,
 349                                                  &old_nt_hash_enc,
 350                                                  true,
 351                                                  &new_lm_password,
 352                                                  &old_lanman_hash_enc,
 353                                                  NULL,
 354                                                  dominfo1,
 355                                                  reject,
 356                                                  presult);
 357
 358         return status;
 359 }
 360
 361 NTSTATUS rpccli_samr_chgpasswd_user3(struct rpc_pipe_client *cli,
 362                                      TALLOC_CTX *mem_ctx,
 363                                      const char *username,
 364                                      const char *newpassword,
 365                                      const char *oldpassword,
 366                                      struct samr_DomInfo1 **dominfo1,
 367                                      struct userPwdChangeFailureInformation **reject)
 368 {
 369         NTSTATUS status;
 370         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 371
 372         status = dcerpc_samr_chgpasswd_user3(cli->binding_handle,
 373                                              mem_ctx,
 374                                              cli->srv_name_slash,
 375                                              username,
 376                                              newpassword,
 377                                              oldpassword,
 378                                              dominfo1,
 379                                              reject,
 380                                              &result);
 381         if (!NT_STATUS_IS_OK(status)) {
 382                 return status;
 383         }
 384
 385         return result;
 386 }
 387
 388 /* This function returns the bizzare set of (max_entries, max_size) required
 389    for the QueryDisplayInfo RPC to actually work against a domain controller
 390    with large (10k and higher) numbers of users.  These values were
 391    obtained by inspection using ethereal and NT4 running User Manager. */
 392
 393 void dcerpc_get_query_dispinfo_params(int loop_count,
 394                                       uint32_t *max_entries,
 395                                       uint32_t *max_size)
 396 {
 397         switch(loop_count) {
 398         case 0:
 399                 *max_entries = 512;
 400                 *max_size = 16383;
 401                 break;
 402         case 1:
 403                 *max_entries = 1024;
 404                 *max_size = 32766;
 405                 break;
 406         case 2:
 407                 *max_entries = 2048;
 408                 *max_size = 65532;
 409                 break;
 410         case 3:
 411                 *max_entries = 4096;
 412                 *max_size = 131064;
 413                 break;
 414         default:              /* loop_count >= 4 */
 415                 *max_entries = 4096;
 416                 *max_size = 131071;
 417                 break;
 418         }
 419 }
 420
 421 NTSTATUS rpccli_try_samr_connects(struct rpc_pipe_client *cli,
 422                                   TALLOC_CTX *mem_ctx,
 423                                   uint32_t access_mask,
 424                                   struct policy_handle *connect_pol)
 425 {
 426         NTSTATUS status;
 427         union samr_ConnectInfo info_in, info_out;
 428         struct samr_ConnectInfo1 info1;
 429         uint32_t lvl_out = 0;
 430
 431         ZERO_STRUCT(info1);
 432
 433         info1.client_version = SAMR_CONNECT_W2K;
 434         info_in.info1 = info1;
 435
 436         status = rpccli_samr_Connect5(cli, mem_ctx,
 437                                       cli->srv_name_slash,
 438                                       access_mask,
 439                                       1,
 440                                       &info_in,
 441                                       &lvl_out,
 442                                       &info_out,
 443                                       connect_pol);
 444         if (NT_STATUS_IS_OK(status)) {
 445                 return status;
 446         }
 447
 448         status = rpccli_samr_Connect4(cli, mem_ctx,
 449                                       cli->srv_name_slash,
 450                                       SAMR_CONNECT_W2K,
 451                                       access_mask,
 452                                       connect_pol);
 453         if (NT_STATUS_IS_OK(status)) {
 454                 return status;
 455         }
 456
 457         status = rpccli_samr_Connect2(cli, mem_ctx,
 458                                       cli->srv_name_slash,
 459                                       access_mask,
 460                                       connect_pol);
 461         return status;
 462 }
 463