+ auth_status = authsam_password_ok(auth_context, tmp_ctx,
+ acct_flags,
+ lm_pwd, nt_pwd,
+ user_info,
+ user_sess_key, lm_sess_key);
+ if (NT_STATUS_IS_OK(auth_status)) {
+ if (user_sess_key->data) {
+ talloc_steal(mem_ctx, user_sess_key->data);
+ }
+ if (lm_sess_key->data) {
+ talloc_steal(mem_ctx, lm_sess_key->data);
+ }
+ TALLOC_FREE(tmp_ctx);
+ return NT_STATUS_OK;
+ }
+ *user_sess_key = data_blob_null;
+ *lm_sess_key = data_blob_null;
+
+ if (!NT_STATUS_EQUAL(auth_status, NT_STATUS_WRONG_PASSWORD)) {
+ TALLOC_FREE(tmp_ctx);
+ return auth_status;
+ }
+
+ /*
+ * We only continue if this was a wrong password
+ * and we'll always return NT_STATUS_WRONG_PASSWORD
+ * no matter what error happens.
+ */
+
+ /* pull the domain password property attributes */
+ ret = dsdb_search_one(sam_ctx, tmp_ctx, &dom_msg, domain_dn, LDB_SCOPE_BASE,
+ attrs, 0, "objectClass=domain");
+ if (ret == LDB_SUCCESS) {
+ history_len = ldb_msg_find_attr_as_uint(dom_msg, "pwdHistoryLength", 0);
+ } else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+ DEBUG(3,("Couldn't find domain %s: %s!\n",
+ ldb_dn_get_linearized(domain_dn),
+ ldb_errstring(sam_ctx)));
+ } else {
+ DEBUG(3,("error finding domain %s: %s!\n",
+ ldb_dn_get_linearized(domain_dn),
+ ldb_errstring(sam_ctx)));
+ }
+
+ for (i = 1; i < MIN(history_len, 3); i++) {
+ static const struct samr_Password zero_hash;
+ struct samr_Password zero_string_hash;
+ struct samr_Password zero_string_des_hash;
+ struct samr_Password *nt_history_pwd = NULL;
+ struct samr_Password *lm_history_pwd = NULL;
+ NTTIME pwdLastSet;
+ struct timeval tv_now;
+ NTTIME now;
+ int allowed_period_mins;
+ NTTIME allowed_period;
+
+ nt_status = samdb_result_passwords_from_history(tmp_ctx,
+ auth_context->lp_ctx,
+ msg, i,
+ &lm_history_pwd,
+ &nt_history_pwd);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ /*
+ * If we don't find element 'i' we won't find
+ * 'i+1' ...
+ */
+ break;
+ }
+
+ /*
+ * We choose to avoid any issues
+ * around different LM and NT history
+ * lengths by only checking the NT
+ * history
+ */
+ if (nt_history_pwd == NULL) {
+ /*
+ * If we don't find element 'i' we won't find
+ * 'i+1' ...
+ */
+ break;
+ }
+
+ /* Skip over all-zero hashes in the history */
+ if (memcmp(nt_history_pwd->hash, zero_hash.hash,
+ sizeof(zero_hash.hash)) == 0) {
+ continue;
+ }
+
+ /*
+ * This looks odd, but the password_hash module writes this in if
+ * (somehow) we didn't have an old NT hash
+ */
+
+ E_md4hash("", zero_string_hash.hash);
+ if (memcmp(nt_history_pwd->hash, zero_string_hash.hash, 16) == 0) {
+ continue;
+ }
+
+ E_deshash("", zero_string_des_hash.hash);
+ if (!lm_history_pwd || memcmp(lm_history_pwd->hash, zero_string_des_hash.hash, 16) == 0) {
+ lm_history_pwd = NULL;
+ }
+
+ auth_status = authsam_password_ok(auth_context, tmp_ctx,
+ acct_flags,
+ lm_history_pwd,
+ nt_history_pwd,
+ user_info,
+ user_sess_key,
+ lm_sess_key);
+ if (!NT_STATUS_IS_OK(auth_status)) {
+ /*
+ * If this was not a correct password, try the next
+ * one from the history
+ */
+ *user_sess_key = data_blob_null;
+ *lm_sess_key = data_blob_null;
+ continue;
+ }
+
+ if (i != 1) {
+ /*
+ * The authentication was OK, but not against
+ * the previous password, which is stored at index 1.
+ *
+ * We just return the original wrong password.
+ * This skips the update of the bad pwd count,
+ * because this is almost certainly user error
+ * (or automatic login on a computer using a cached
+ * password from before the password change),
+ * not an attack.
+ */
+ TALLOC_FREE(tmp_ctx);
+ return NT_STATUS_WRONG_PASSWORD;
+ }
+
+ if (user_info->password_state != AUTH_PASSWORD_RESPONSE) {
+ /*
+ * The authentication was OK against the previous password,
+ * but it's not a NTLM network authentication.
+ *
+ * We just return the original wrong password.
+ * This skips the update of the bad pwd count,
+ * because this is almost certainly user error
+ * (or automatic login on a computer using a cached
+ * password from before the password change),
+ * not an attack.
+ */
+ TALLOC_FREE(tmp_ctx);
+ return NT_STATUS_WRONG_PASSWORD;
+ }
+
+ /*
+ * If the password was OK, it's a NTLM network authentication
+ * and it was the previous password.
+ *
+ * Now we see if it is within the grace period,
+ * so that we don't break cached sessions on other computers
+ * before the user can lock and unlock their other screens
+ * (resetting their cached password).
+ *
+ * See http://support.microsoft.com/kb/906305
+ * OldPasswordAllowedPeriod ("old password allowed period")
+ * is specified in minutes. The default is 60.
+ */
+ allowed_period_mins = lpcfg_old_password_allowed_period(auth_context->lp_ctx);
+ /*
+ * NTTIME uses 100ns units
+ */
+ allowed_period = allowed_period_mins * 60 * 1000*1000*10;
+ pwdLastSet = samdb_result_nttime(msg, "pwdLastSet", 0);
+ tv_now = timeval_current();
+ now = timeval_to_nttime(&tv_now);
+
+ if (now < pwdLastSet) {
+ /*
+ * time jump?
+ *
+ * We just return the original wrong password.
+ * This skips the update of the bad pwd count,
+ * because this is almost certainly user error
+ * (or automatic login on a computer using a cached
+ * password from before the password change),
+ * not an attack.
+ */
+ TALLOC_FREE(tmp_ctx);
+ return NT_STATUS_WRONG_PASSWORD;
+ }
+
+ if ((now - pwdLastSet) >= allowed_period) {
+ /*
+ * The allowed period is over.
+ *
+ * We just return the original wrong password.
+ * This skips the update of the bad pwd count,
+ * because this is almost certainly user error
+ * (or automatic login on a computer using a cached
+ * password from before the password change),
+ * not an attack.
+ */
+ TALLOC_FREE(tmp_ctx);
+ return NT_STATUS_WRONG_PASSWORD;
+ }
+
+ /*
+ * We finally allow the authentication with the
+ * previous password within the allowed period.
+ */
+ if (user_sess_key->data) {
+ talloc_steal(mem_ctx, user_sess_key->data);
+ }
+ if (lm_sess_key->data) {
+ talloc_steal(mem_ctx, lm_sess_key->data);
+ }
+
+ TALLOC_FREE(tmp_ctx);
+ return auth_status;
+ }
+
+ /*
+ * If we are not in the allowed period or match an old password,
+ * we didn't return early. Now update the badPwdCount et al.
+ */
+ nt_status = authsam_update_bad_pwd_count(auth_context->sam_ctx,
+ msg, domain_dn);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ /*
+ * We need to return the original
+ * NT_STATUS_WRONG_PASSWORD error, so there isn't
+ * anything more we can do than write something into
+ * the log
+ */
+ DEBUG(0, ("Failed to note bad password for user [%s]: %s\n",
+ user_info->mapped.account_name,
+ nt_errstr(nt_status)));
+ }
+
+ TALLOC_FREE(tmp_ctx);
+ return NT_STATUS_WRONG_PASSWORD;
+}