r21359: remove the rid encryption before storing the password hashes

We decided to store them plain in our ldb

metze
(This used to be commit ff13b21102641a308bd48a8efa6b94a98f567e15)

diff --git a/source4/dsdb/repl/replicated_objects.c b/source4/dsdb/repl/replicated_objects.c
index 2184f3256782bc31e42efe08b658ac551ec6a107..b8456a05567443093420299eaee7a54bd7f1d110 100644 (file)
--- a/source4/dsdb/repl/replicated_objects.c
+++ b/source4/dsdb/repl/replicated_objects.c
@@ -28,9 +28,12 @@
 #include "librpc/gen_ndr/ndr_drsuapi.h"
 #include "librpc/gen_ndr/ndr_drsblobs.h"
 #include "lib/crypto/crypto.h"
+#include "libcli/auth/libcli_auth.h"
 
 static WERROR dsdb_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
                                           const DATA_BLOB *gensec_skey,
+                                          bool rid_crypt,
+                                          uint32_t rid,
                                           DATA_BLOB *in,
                                           DATA_BLOB *out)
 {
@@ -49,6 +52,13 @@ static WERROR dsdb_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
 
        DATA_BLOB plain_buffer;
 
+       /*
+        * users with rid == 0 should not exist
+        */
+       if (rid_crypt && rid == 0) {
+               return WERR_DS_DRA_INVALID_PARAMETER;
+       }
+
        /* 
         * the first 16 bytes at the beginning are the confounder
         * followed by the 4 byte crc32 checksum
@@ -90,12 +100,21 @@ static WERROR dsdb_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
        }
        checked_buffer = data_blob_const(dec_buffer.data + 4, dec_buffer.length - 4);
 
-       if (checked_buffer.length) {
-               plain_buffer = data_blob_talloc(mem_ctx, checked_buffer.data, checked_buffer.length);
-               memset(checked_buffer.data, 0x00, checked_buffer.length);
-               W_ERROR_HAVE_NO_MEMORY(plain_buffer.data);
-       } else {
-               plain_buffer = data_blob_const(NULL, 0);
+       plain_buffer = data_blob_talloc(mem_ctx, checked_buffer.data, checked_buffer.length);
+       W_ERROR_HAVE_NO_MEMORY(plain_buffer.data);
+
+       if (rid_crypt) {
+               uint32_t i, num_hashes;
+
+               if ((checked_buffer.length % 16) != 0) {
+                       return WERR_DS_DRA_INVALID_PARAMETER;
+               }
+
+               num_hashes = plain_buffer.length / 16;
+               for (i = 0; i < num_hashes; i++) {
+                       uint32_t offset = i * 16;
+                       sam_rid_crypt(rid, checked_buffer.data + offset, plain_buffer.data + offset, 0);
+               }
        }
 
        *out = plain_buffer;
@@ -103,12 +122,14 @@ static WERROR dsdb_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
 }
 
 static WERROR dsdb_decrypt_attribute(const DATA_BLOB *gensec_skey,
+                                    uint32_t rid,
                                     struct drsuapi_DsReplicaAttribute *attr)
 {
        WERROR status;
        TALLOC_CTX *mem_ctx;
        DATA_BLOB *enc_data;
        DATA_BLOB plain_data;
+       bool rid_crypt = false;
 
        if (attr->value_ctr.num_values == 0) {
                return WERR_OK;
@@ -119,6 +140,8 @@ static WERROR dsdb_decrypt_attribute(const DATA_BLOB *gensec_skey,
        case DRSUAPI_ATTRIBUTE_unicodePwd:
        case DRSUAPI_ATTRIBUTE_ntPwdHistory:
        case DRSUAPI_ATTRIBUTE_lmPwdHistory:
+               rid_crypt = true;
+               break;
        case DRSUAPI_ATTRIBUTE_supplementalCredentials:
        case DRSUAPI_ATTRIBUTE_priorValue:
        case DRSUAPI_ATTRIBUTE_currentValue:
@@ -144,6 +167,8 @@ static WERROR dsdb_decrypt_attribute(const DATA_BLOB *gensec_skey,
 
        status = dsdb_decrypt_attribute_value(mem_ctx,
                                              gensec_skey,
+                                             rid_crypt,
+                                             rid,
                                              enc_data,
                                              &plain_data);
        W_ERROR_NOT_OK_RETURN(status);
@@ -178,6 +203,8 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
        struct drsuapi_DsReplicaAttribute *name_a = NULL;
        struct drsuapi_DsReplicaMetaData *name_d = NULL;
        struct replPropertyMetaData1 *rdn_m = NULL;
+       struct dom_sid *sid = NULL;
+       uint32_t rid = 0;
        int ret;
 
        if (!in->object.identifier) {
@@ -196,6 +223,11 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
                return WERR_FOOBAR;
        }
 
+       sid = &in->object.identifier->sid;
+       if (sid->num_auths > 0) {
+               rid = sid->sub_auths[sid->num_auths - 1];
+       }
+
        msg = ldb_msg_new(mem_ctx);
        W_ERROR_HAVE_NO_MEMORY(msg);
 
@@ -238,7 +270,7 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
                m = &md->ctr.ctr1.array[i];
                e = &msg->elements[i];
 
-               status = dsdb_decrypt_attribute(gensec_skey, a);
+               status = dsdb_decrypt_attribute(gensec_skey, rid, a);
                W_ERROR_NOT_OK_RETURN(status);
 
                status = dsdb_attribute_drsuapi_to_ldb(schema, a, msg->elements, e);