source4/kdc/kpasswdd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    kpasswd Server implementation
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Andrew Tridgell        2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "smbd/service_task.h"
  25 #include "auth/gensec/gensec.h"
  26 #include "auth/credentials/credentials.h"
  27 #include "auth/auth.h"
  28 #include "dsdb/samdb/samdb.h"
  29 #include "../lib/util/util_ldb.h"
  30 #include "libcli/security/security.h"
  31 #include "param/param.h"
  32 #include "kdc/kdc-glue.h"
  33 #include "dsdb/common/util.h"
  34
  35 /* Return true if there is a valid error packet formed in the error_blob */
  36 static bool kpasswdd_make_error_reply(struct kdc_server *kdc,
  37                                      TALLOC_CTX *mem_ctx,
  38                                      uint16_t result_code,
  39                                      const char *error_string,
  40                                      DATA_BLOB *error_blob)
  41 {
  42         char *error_string_utf8;
  43         size_t len;
  44
  45         DEBUG(result_code ? 3 : 10, ("kpasswdd: %s\n", error_string));
  46
  47         if (!push_utf8_talloc(mem_ctx, &error_string_utf8, error_string, &len)) {
  48                 return false;
  49         }
  50
  51         *error_blob = data_blob_talloc(mem_ctx, NULL, 2 + len + 1);
  52         if (!error_blob->data) {
  53                 return false;
  54         }
  55         RSSVAL(error_blob->data, 0, result_code);
  56         memcpy(error_blob->data + 2, error_string_utf8, len + 1);
  57         return true;
  58 }
  59
  60 /* Return true if there is a valid error packet formed in the error_blob */
  61 static bool kpasswdd_make_unauth_error_reply(struct kdc_server *kdc,
  62                                             TALLOC_CTX *mem_ctx,
  63                                             uint16_t result_code,
  64                                             const char *error_string,
  65                                             DATA_BLOB *error_blob)
  66 {
  67         bool ret;
  68         int kret;
  69         DATA_BLOB error_bytes;
  70         krb5_data k5_error_bytes, k5_error_blob;
  71         ret = kpasswdd_make_error_reply(kdc, mem_ctx, result_code, error_string,
  72                                        &error_bytes);
  73         if (!ret) {
  74                 return false;
  75         }
  76         k5_error_bytes.data = error_bytes.data;
  77         k5_error_bytes.length = error_bytes.length;
  78         kret = krb5_mk_error(kdc->smb_krb5_context->krb5_context,
  79                              result_code, NULL, &k5_error_bytes,
  80                              NULL, NULL, NULL, NULL, &k5_error_blob);
  81         if (kret) {
  82                 return false;
  83         }
  84         *error_blob = data_blob_talloc(mem_ctx, k5_error_blob.data, k5_error_blob.length);
  85         krb5_data_free(&k5_error_blob);
  86         if (!error_blob->data) {
  87                 return false;
  88         }
  89         return true;
  90 }
  91
  92 static bool kpasswd_make_pwchange_reply(struct kdc_server *kdc,
  93                                         TALLOC_CTX *mem_ctx,
  94                                         NTSTATUS status,
  95                                         enum samPwdChangeReason reject_reason,
  96                                         struct samr_DomInfo1 *dominfo,
  97                                         DATA_BLOB *error_blob)
  98 {
  99         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
 100                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 101                                                 KRB5_KPASSWD_ACCESSDENIED,
 102                                                 "No such user when changing password",
 103                                                 error_blob);
 104         }
 105         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 106                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 107                                                 KRB5_KPASSWD_ACCESSDENIED,
 108                                                 "Not permitted to change password",
 109                                                 error_blob);
 110         }
 111         if (dominfo && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
 112                 const char *reject_string;
 113                 switch (reject_reason) {
 114                 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
 115                         reject_string = talloc_asprintf(mem_ctx, "Password too short, password must be at least %d characters long",
 116                                                         dominfo->min_password_length);
 117                         break;
 118                 case SAM_PWD_CHANGE_NOT_COMPLEX:
 119                         reject_string = "Password does not meet complexity requirements";
 120                         break;
 121                 case SAM_PWD_CHANGE_PWD_IN_HISTORY:
 122                         reject_string = "Password is already in password history";
 123                         break;
 124                 default:
 125                         reject_string = talloc_asprintf(mem_ctx, "Password must be at least %d characters long, and cannot match any of your %d previous passwords",
 126                                                         dominfo->min_password_length, dominfo->password_history_length);
 127                         break;
 128                 }
 129                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 130                                                 KRB5_KPASSWD_SOFTERROR,
 131                                                 reject_string,
 132                                                 error_blob);
 133         }
 134         if (!NT_STATUS_IS_OK(status)) {
 135                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 136                                                  KRB5_KPASSWD_HARDERROR,
 137                                                  talloc_asprintf(mem_ctx, "failed to set password: %s", nt_errstr(status)),
 138                                                  error_blob);
 139
 140         }
 141         return kpasswdd_make_error_reply(kdc, mem_ctx, KRB5_KPASSWD_SUCCESS,
 142                                         "Password changed",
 143                                         error_blob);
 144 }
 145
 146 /*
 147    A user password change
 148
 149    Return true if there is a valid error packet (or success) formed in
 150    the error_blob
 151 */
 152 static bool kpasswdd_change_password(struct kdc_server *kdc,
 153                                      TALLOC_CTX *mem_ctx,
 154                                      struct auth_session_info *session_info,
 155                                      const DATA_BLOB *password,
 156                                      DATA_BLOB *reply)
 157 {
 158         NTSTATUS status;
 159         enum samPwdChangeReason reject_reason;
 160         struct samr_DomInfo1 *dominfo;
 161         struct samr_Password *oldLmHash, *oldNtHash;
 162         struct ldb_context *samdb;
 163         const char * const attrs[] = { "dBCSPwd", "unicodePwd", NULL };
 164         struct ldb_message *msg;
 165         int ret;
 166
 167         /* Fetch the old hashes to get the old password in order to perform
 168          * the password change operation. Naturally it would be much better to
 169          * have a password hash from an authentication around but this doesn't
 170          * seem to be the case here. */
 171         ret = dsdb_search_one(kdc->samdb, mem_ctx, &msg, ldb_get_default_basedn(kdc->samdb),
 172                               LDB_SCOPE_SUBTREE,
 173                               attrs,
 174                               DSDB_SEARCH_NO_GLOBAL_CATALOG,
 175                               "(&(objectClass=user)(sAMAccountName=%s))",
 176                               session_info->info->account_name);
 177         if (ret != LDB_SUCCESS) {
 178                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 179                                                 KRB5_KPASSWD_ACCESSDENIED,
 180                                                 "No such user when changing password",
 181                                                 reply);
 182         }
 183
 184         status = samdb_result_passwords(mem_ctx, kdc->task->lp_ctx, msg,
 185                                         &oldLmHash, &oldNtHash);
 186         if (!NT_STATUS_IS_OK(status)) {
 187                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 188                                                 KRB5_KPASSWD_ACCESSDENIED,
 189                                                 "Not permitted to change password",
 190                                                 reply);
 191         }
 192
 193         /* Start a SAM with user privileges for the password change */
 194         samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx,
 195                               session_info, 0);
 196         if (!samdb) {
 197                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 198                                                 KRB5_KPASSWD_HARDERROR,
 199                                                 "Failed to open samdb",
 200                                                 reply);
 201         }
 202
 203         DEBUG(3, ("Changing password of %s\\%s (%s)\n",
 204                   session_info->info->domain_name,
 205                   session_info->info->account_name,
 206                   dom_sid_string(mem_ctx, &session_info->security_token->sids[PRIMARY_USER_SID_INDEX])));
 207
 208         /* Performs the password change */
 209         status = samdb_set_password_sid(samdb, mem_ctx,
 210                                         &session_info->security_token->sids[PRIMARY_USER_SID_INDEX],
 211                                         password, NULL, NULL,
 212                                         oldLmHash, oldNtHash, /* this is a user password change */
 213                                         &reject_reason,
 214                                         &dominfo);
 215         return kpasswd_make_pwchange_reply(kdc, mem_ctx,
 216                                            status,
 217                                            reject_reason,
 218                                            dominfo,
 219                                            reply);
 220
 221 }
 222
 223 static bool kpasswd_process_request(struct kdc_server *kdc,
 224                                     TALLOC_CTX *mem_ctx,
 225                                     struct gensec_security *gensec_security,
 226                                     uint16_t version,
 227                                     DATA_BLOB *input,
 228                                     DATA_BLOB *reply)
 229 {
 230         struct auth_session_info *session_info;
 231         size_t pw_len;
 232
 233         if (!NT_STATUS_IS_OK(gensec_session_info(gensec_security,
 234                                                  mem_ctx,
 235                                                  &session_info))) {
 236                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 237                                                 KRB5_KPASSWD_HARDERROR,
 238                                                 "gensec_session_info failed!",
 239                                                 reply);
 240         }
 241
 242         switch (version) {
 243         case KRB5_KPASSWD_VERS_CHANGEPW:
 244         {
 245                 DATA_BLOB password;
 246                 if (!convert_string_talloc_handle(mem_ctx, lpcfg_iconv_handle(kdc->task->lp_ctx),
 247                                                CH_UTF8, CH_UTF16,
 248                                                (const char *)input->data,
 249                                                input->length,
 250                                                (void **)&password.data, &pw_len)) {
 251                         return false;
 252                 }
 253                 password.length = pw_len;
 254
 255                 return kpasswdd_change_password(kdc, mem_ctx, session_info,
 256                                                 &password, reply);
 257         }
 258         case KRB5_KPASSWD_VERS_SETPW:
 259         {
 260                 NTSTATUS status;
 261                 enum samPwdChangeReason reject_reason = SAM_PWD_CHANGE_NO_ERROR;
 262                 struct samr_DomInfo1 *dominfo = NULL;
 263                 struct ldb_context *samdb;
 264                 krb5_context context = kdc->smb_krb5_context->krb5_context;
 265
 266                 ChangePasswdDataMS chpw;
 267                 DATA_BLOB password;
 268
 269                 krb5_principal principal;
 270                 char *set_password_on_princ;
 271                 struct ldb_dn *set_password_on_dn;
 272                 bool service_principal_name = false;
 273
 274                 size_t len;
 275                 int ret;
 276
 277                 ret = decode_ChangePasswdDataMS(input->data, input->length,
 278                                                 &chpw, &len);
 279                 if (ret) {
 280                         return kpasswdd_make_error_reply(kdc, mem_ctx,
 281                                                         KRB5_KPASSWD_MALFORMED,
 282                                                         "failed to decode password change structure",
 283                                                         reply);
 284                 }
 285
 286                 if (!convert_string_talloc_handle(mem_ctx, lpcfg_iconv_handle(kdc->task->lp_ctx),
 287                                                CH_UTF8, CH_UTF16,
 288                                                (const char *)chpw.newpasswd.data,
 289                                                chpw.newpasswd.length,
 290                                                (void **)&password.data, &pw_len)) {
 291                         free_ChangePasswdDataMS(&chpw);
 292                         return false;
 293                 }
 294
 295                 password.length = pw_len;
 296
 297                 if ((chpw.targname && !chpw.targrealm)
 298                     || (!chpw.targname && chpw.targrealm)) {
 299                         free_ChangePasswdDataMS(&chpw);
 300                         return kpasswdd_make_error_reply(kdc, mem_ctx,
 301                                                         KRB5_KPASSWD_MALFORMED,
 302                                                         "Realm and principal must be both present, or neither present",
 303                                                         reply);
 304                 }
 305                 if (chpw.targname && chpw.targrealm) {
 306                         ret = krb5_build_principal_ext(kdc->smb_krb5_context->krb5_context,
 307                                                        &principal,
 308                                                        strlen(*chpw.targrealm),
 309                                                        *chpw.targrealm, 0);
 310                         if (ret) {
 311                                 free_ChangePasswdDataMS(&chpw);
 312                                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 313                                                                 KRB5_KPASSWD_MALFORMED,
 314                                                                 "failed to get principal",
 315                                                                 reply);
 316                         }
 317                         if (copy_PrincipalName(chpw.targname, &principal->name)) {
 318                                 free_ChangePasswdDataMS(&chpw);
 319                                 krb5_free_principal(context, principal);
 320                                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 321                                                                 KRB5_KPASSWD_MALFORMED,
 322                                                                 "failed to extract principal to set",
 323                                                                 reply);
 324                         }
 325                 } else {
 326                         free_ChangePasswdDataMS(&chpw);
 327                         return kpasswdd_change_password(kdc, mem_ctx, session_info,
 328                                                         &password, reply);
 329                 }
 330                 free_ChangePasswdDataMS(&chpw);
 331
 332                 if (principal->name.name_string.len >= 2) {
 333                         service_principal_name = true;
 334
 335                         /* We use this, rather than 'no realm' flag,
 336                          * as we don't want to accept a password
 337                          * change on a principal from another realm */
 338
 339                         if (krb5_unparse_name_short(context, principal, &set_password_on_princ) != 0) {
 340                                 krb5_free_principal(context, principal);
 341                                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 342                                                                  KRB5_KPASSWD_MALFORMED,
 343                                                                  "krb5_unparse_name failed!",
 344                                                                  reply);
 345                         }
 346                 } else {
 347                         if (krb5_unparse_name(context, principal, &set_password_on_princ) != 0) {
 348                                 krb5_free_principal(context, principal);
 349                                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 350                                                                  KRB5_KPASSWD_MALFORMED,
 351                                                                  "krb5_unparse_name failed!",
 352                                                                  reply);
 353                         }
 354                 }
 355                 krb5_free_principal(context, principal);
 356
 357                 samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx, session_info, 0);
 358                 if (!samdb) {
 359                         free(set_password_on_princ);
 360                         return kpasswdd_make_error_reply(kdc, mem_ctx,
 361                                                          KRB5_KPASSWD_HARDERROR,
 362                                                          "Unable to open database!",
 363                                                          reply);
 364                 }
 365
 366                 DEBUG(3, ("%s\\%s (%s) is changing password of %s\n",
 367                           session_info->info->domain_name,
 368                           session_info->info->account_name,
 369                           dom_sid_string(mem_ctx, &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
 370                           set_password_on_princ));
 371                 ret = ldb_transaction_start(samdb);
 372                 if (ret != LDB_SUCCESS) {
 373                         free(set_password_on_princ);
 374                         status = NT_STATUS_TRANSACTION_ABORTED;
 375                         return kpasswd_make_pwchange_reply(kdc, mem_ctx,
 376                                                            status,
 377                                                            SAM_PWD_CHANGE_NO_ERROR,
 378                                                            NULL,
 379                                                            reply);
 380                 }
 381
 382                 if (service_principal_name) {
 383                         status = crack_service_principal_name(samdb, mem_ctx,
 384                                                               set_password_on_princ,
 385                                                               &set_password_on_dn, NULL);
 386                 } else {
 387                         status = crack_user_principal_name(samdb, mem_ctx,
 388                                                            set_password_on_princ,
 389                                                            &set_password_on_dn, NULL);
 390                 }
 391                 free(set_password_on_princ);
 392                 if (!NT_STATUS_IS_OK(status)) {
 393                         ldb_transaction_cancel(samdb);
 394                         return kpasswd_make_pwchange_reply(kdc, mem_ctx,
 395                                                            status,
 396                                                            SAM_PWD_CHANGE_NO_ERROR,
 397                                                            NULL,
 398                                                            reply);
 399                 }
 400
 401                 if (NT_STATUS_IS_OK(status)) {
 402                         /* Admin password set */
 403                         status = samdb_set_password(samdb, mem_ctx,
 404                                                     set_password_on_dn, NULL,
 405                                                     &password, NULL, NULL,
 406                                                     NULL, NULL, /* this is not a user password change */
 407                                                     &reject_reason, &dominfo);
 408                 }
 409
 410                 if (NT_STATUS_IS_OK(status)) {
 411                         ret = ldb_transaction_commit(samdb);
 412                         if (ret != LDB_SUCCESS) {
 413                                 DEBUG(1,("Failed to commit transaction to set password on %s: %s\n",
 414                                          ldb_dn_get_linearized(set_password_on_dn),
 415                                          ldb_errstring(samdb)));
 416                                 status = NT_STATUS_TRANSACTION_ABORTED;
 417                         }
 418                 } else {
 419                         ldb_transaction_cancel(samdb);
 420                 }
 421                 return kpasswd_make_pwchange_reply(kdc, mem_ctx,
 422                                                    status,
 423                                                    reject_reason,
 424                                                    dominfo,
 425                                                    reply);
 426         }
 427         default:
 428                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 429                                                  KRB5_KPASSWD_BAD_VERSION,
 430                                                  talloc_asprintf(mem_ctx,
 431                                                                  "Protocol version %u not supported",
 432                                                                  version),
 433                                                  reply);
 434         }
 435 }
 436
 437 enum kdc_process_ret kpasswdd_process(struct kdc_server *kdc,
 438                                       TALLOC_CTX *mem_ctx,
 439                                       DATA_BLOB *input,
 440                                       DATA_BLOB *reply,
 441                                       struct tsocket_address *peer_addr,
 442                                       struct tsocket_address *my_addr,
 443                                       int datagram_reply)
 444 {
 445         bool ret;
 446         const uint16_t header_len = 6;
 447         uint16_t len;
 448         uint16_t ap_req_len;
 449         uint16_t krb_priv_len;
 450         uint16_t version;
 451         NTSTATUS nt_status;
 452         DATA_BLOB ap_req, krb_priv_req;
 453         DATA_BLOB krb_priv_rep = data_blob(NULL, 0);
 454         DATA_BLOB ap_rep = data_blob(NULL, 0);
 455         DATA_BLOB kpasswd_req, kpasswd_rep;
 456         struct cli_credentials *server_credentials;
 457         struct gensec_security *gensec_security;
 458         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 459
 460         char *keytab_name;
 461
 462         if (!tmp_ctx) {
 463                 return KDC_PROCESS_FAILED;
 464         }
 465
 466         if (kdc->am_rodc) {
 467                 talloc_free(tmp_ctx);
 468                 return KDC_PROCESS_PROXY;
 469         }
 470
 471         /* Be parinoid.  We need to ensure we don't just let the
 472          * caller lead us into a buffer overflow */
 473         if (input->length <= header_len) {
 474                 talloc_free(tmp_ctx);
 475                 return KDC_PROCESS_FAILED;
 476         }
 477
 478         len = RSVAL(input->data, 0);
 479         if (input->length != len) {
 480                 talloc_free(tmp_ctx);
 481                 return KDC_PROCESS_FAILED;
 482         }
 483
 484         /* There are two different versions of this protocol so far,
 485          * plus others in the standards pipe.  Fortunetly they all
 486          * take a very similar framing */
 487         version = RSVAL(input->data, 2);
 488         ap_req_len = RSVAL(input->data, 4);
 489         if ((ap_req_len >= len) || (ap_req_len + header_len) >= len) {
 490                 talloc_free(tmp_ctx);
 491                 return KDC_PROCESS_FAILED;
 492         }
 493
 494         krb_priv_len = len - ap_req_len;
 495         ap_req = data_blob_const(&input->data[header_len], ap_req_len);
 496         krb_priv_req = data_blob_const(&input->data[header_len + ap_req_len], krb_priv_len);
 497
 498         server_credentials = cli_credentials_init(tmp_ctx);
 499         if (!server_credentials) {
 500                 DEBUG(1, ("Failed to init server credentials\n"));
 501                 talloc_free(tmp_ctx);
 502                 return KDC_PROCESS_FAILED;
 503         }
 504
 505         /* We want the credentials subsystem to use the krb5 context
 506          * we already have, rather than a new context */
 507         cli_credentials_set_krb5_context(server_credentials, kdc->smb_krb5_context);
 508         cli_credentials_set_conf(server_credentials, kdc->task->lp_ctx);
 509
 510         keytab_name = talloc_asprintf(server_credentials, "HDB:samba4&%p", kdc->base_ctx);
 511
 512         cli_credentials_set_username(server_credentials, "kadmin/changepw", CRED_SPECIFIED);
 513         ret = cli_credentials_set_keytab_name(server_credentials, kdc->task->lp_ctx, keytab_name, CRED_SPECIFIED);
 514         if (ret != 0) {
 515                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 516                                                        KRB5_KPASSWD_HARDERROR,
 517                                                        talloc_asprintf(mem_ctx,
 518                                                                        "Failed to obtain server credentials for kadmin/changepw!"),
 519                                                        &krb_priv_rep);
 520                 ap_rep.length = 0;
 521                 if (ret) {
 522                         goto reply;
 523                 }
 524                 talloc_free(tmp_ctx);
 525                 return ret;
 526         }
 527
 528         /* We don't strictly need to call this wrapper, and could call
 529          * gensec_server_start directly, as we have no need for NTLM
 530          * and we have a PAC, but this ensures that the wrapper can be
 531          * safely extended for other helpful things in future */
 532         nt_status = samba_server_gensec_start(tmp_ctx, kdc->task->event_ctx,
 533                                               kdc->task->msg_ctx,
 534                                               kdc->task->lp_ctx,
 535                                               server_credentials,
 536                                               "kpasswd",
 537                                               &gensec_security);
 538         if (!NT_STATUS_IS_OK(nt_status)) {
 539                 talloc_free(tmp_ctx);
 540                 return KDC_PROCESS_FAILED;
 541         }
 542
 543         /* The kerberos PRIV packets include these addresses.  MIT
 544          * clients check that they are present */
 545 #if 0
 546         /* Skip this part for now, it breaks with a NetAPP filer and
 547          * in any case where the client address is behind NAT.  If
 548          * older MIT clients need this, we might have to insert more
 549          * complex code */
 550
 551         nt_status = gensec_set_local_address(gensec_security, peer_addr);
 552         if (!NT_STATUS_IS_OK(nt_status)) {
 553                 talloc_free(tmp_ctx);
 554                 return KDC_PROCESS_FAILED;
 555         }
 556 #endif
 557
 558         nt_status = gensec_set_local_address(gensec_security, my_addr);
 559         if (!NT_STATUS_IS_OK(nt_status)) {
 560                 talloc_free(tmp_ctx);
 561                 return KDC_PROCESS_FAILED;
 562         }
 563
 564         /* We want the GENSEC wrap calls to generate PRIV tokens */
 565         gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
 566
 567         nt_status = gensec_start_mech_by_name(gensec_security, "krb5");
 568         if (!NT_STATUS_IS_OK(nt_status)) {
 569                 talloc_free(tmp_ctx);
 570                 return KDC_PROCESS_FAILED;
 571         }
 572
 573         /* Accept the AP-REQ and generate teh AP-REP we need for the reply */
 574         nt_status = gensec_update(gensec_security, tmp_ctx, kdc->task->event_ctx, ap_req, &ap_rep);
 575         if (!NT_STATUS_IS_OK(nt_status) && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 576
 577                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 578                                                        KRB5_KPASSWD_HARDERROR,
 579                                                        talloc_asprintf(mem_ctx,
 580                                                                        "gensec_update failed: %s",
 581                                                                        nt_errstr(nt_status)),
 582                                                        &krb_priv_rep);
 583                 ap_rep.length = 0;
 584                 if (ret) {
 585                         goto reply;
 586                 }
 587                 talloc_free(tmp_ctx);
 588                 return KDC_PROCESS_FAILED;
 589         }
 590
 591         /* Extract the data from the KRB-PRIV half of the message */
 592         nt_status = gensec_unwrap(gensec_security, tmp_ctx, &krb_priv_req, &kpasswd_req);
 593         if (!NT_STATUS_IS_OK(nt_status)) {
 594                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 595                                                        KRB5_KPASSWD_HARDERROR,
 596                                                        talloc_asprintf(mem_ctx,
 597                                                                        "gensec_unwrap failed: %s",
 598                                                                        nt_errstr(nt_status)),
 599                                                        &krb_priv_rep);
 600                 ap_rep.length = 0;
 601                 if (ret) {
 602                         goto reply;
 603                 }
 604                 talloc_free(tmp_ctx);
 605                 return KDC_PROCESS_FAILED;
 606         }
 607
 608         /* Figure out something to do with it (probably changing a password...) */
 609         ret = kpasswd_process_request(kdc, tmp_ctx,
 610                                       gensec_security,
 611                                       version,
 612                                       &kpasswd_req, &kpasswd_rep);
 613         if (!ret) {
 614                 /* Argh! */
 615                 talloc_free(tmp_ctx);
 616                 return KDC_PROCESS_FAILED;
 617         }
 618
 619         /* And wrap up the reply: This ensures that the error message
 620          * or success can be verified by the client */
 621         nt_status = gensec_wrap(gensec_security, tmp_ctx,
 622                                 &kpasswd_rep, &krb_priv_rep);
 623         if (!NT_STATUS_IS_OK(nt_status)) {
 624                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 625                                                        KRB5_KPASSWD_HARDERROR,
 626                                                        talloc_asprintf(mem_ctx,
 627                                                                        "gensec_wrap failed: %s",
 628                                                                        nt_errstr(nt_status)),
 629                                                        &krb_priv_rep);
 630                 ap_rep.length = 0;
 631                 if (ret) {
 632                         goto reply;
 633                 }
 634                 talloc_free(tmp_ctx);
 635                 return KDC_PROCESS_FAILED;
 636         }
 637
 638 reply:
 639         *reply = data_blob_talloc(mem_ctx, NULL, krb_priv_rep.length + ap_rep.length + header_len);
 640         if (!reply->data) {
 641                 talloc_free(tmp_ctx);
 642                 return KDC_PROCESS_FAILED;
 643         }
 644
 645         RSSVAL(reply->data, 0, reply->length);
 646         RSSVAL(reply->data, 2, 1); /* This is a version 1 reply, MS change/set or otherwise */
 647         RSSVAL(reply->data, 4, ap_rep.length);
 648         memcpy(reply->data + header_len,
 649                ap_rep.data,
 650                ap_rep.length);
 651         memcpy(reply->data + header_len + ap_rep.length,
 652                krb_priv_rep.data,
 653                krb_priv_rep.length);
 654
 655         talloc_free(tmp_ctx);
 656         return KDC_PROCESS_OK;
 657 }
 658