+ struct ldb_context *sam_ctx = NULL;
+ struct ldb_message *msg = NULL;
+ struct ldb_dn *dn = NULL;
+ const char *samAccountName = NULL;
+ struct dom_sid *objectSid = NULL;
+ struct samr_Password *nt_pwd = NULL;
+ gnutls_datum_t nt_key;
+ gnutls_datum_t salt = {
+ .data = r->in.password->salt,
+ .size = sizeof(r->in.password->salt),
+ };
+ uint8_t cdk_data[16] = {0};
+ DATA_BLOB cdk = {
+ .data = cdk_data,
+ .length = sizeof(cdk_data),
+ };
+ struct auth_session_info *call_session_info = NULL;
+ struct auth_session_info *old_session_info = NULL;
+ NTSTATUS status = NT_STATUS_WRONG_PASSWORD;
+ int rc;
+
+ r->out.result = NT_STATUS_WRONG_PASSWORD;
+
+ if (r->in.password == NULL) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (r->in.password->PBKDF2Iterations < 5000 ||
+ r->in.password->PBKDF2Iterations > 1000000) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ /*
+ * Connect to a SAMDB with system privileges for fetching the old
+ * password hashes.
+ */
+ sam_ctx = samdb_connect(mem_ctx,
+ dce_call->event_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ system_session(dce_call->conn->dce_ctx->lp_ctx),
+ dce_call->conn->remote_address,
+ 0);
+ if (sam_ctx == NULL) {
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
+ }
+
+ rc = ldb_transaction_start(sam_ctx);
+ if (rc != LDB_SUCCESS) {
+ DBG_WARNING("Failed to start transaction: %s\n",
+ ldb_errstring(sam_ctx));
+ return NT_STATUS_TRANSACTION_ABORTED;
+ }
+
+ /*
+ * We use authsam_search_account() to be consistent with the
+ * other callers in the bad password and audit log handling
+ * systems. It ensures we get DSDB_SEARCH_SHOW_EXTENDED_DN.
+ */
+ status = authsam_search_account(mem_ctx,
+ sam_ctx,
+ r->in.account->string,
+ ldb_get_default_basedn(sam_ctx),
+ &msg);
+ if (!NT_STATUS_IS_OK(status)) {
+ ldb_transaction_cancel(sam_ctx);
+ goto done;
+ }
+
+ dn = msg->dn;
+ samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
+ objectSid = samdb_result_dom_sid(msg, msg, "objectSid");
+
+ status = samdb_result_passwords(mem_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ msg,
+ &nt_pwd);
+ if (!NT_STATUS_IS_OK(status)) {
+ ldb_transaction_cancel(sam_ctx);
+ goto done;
+ }
+
+ if (nt_pwd == NULL) {
+ ldb_transaction_cancel(sam_ctx);
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto done;
+ }
+
+ nt_key = (gnutls_datum_t){
+ .data = nt_pwd->hash,
+ .size = sizeof(nt_pwd->hash),
+ };
+
+ rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512,
+ &nt_key,
+ &salt,
+ r->in.password->PBKDF2Iterations,
+ cdk.data,
+ cdk.length);
+ if (rc < 0) {
+ ldb_transaction_cancel(sam_ctx);
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto done;
+ }
+
+ /* Drop to user privileges for the password change */
+
+ old_session_info = ldb_get_opaque(sam_ctx, DSDB_SESSION_INFO);
+ call_session_info = dcesrv_call_session_info(dce_call);
+
+ rc = ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, call_session_info);
+ if (rc != LDB_SUCCESS) {
+ ldb_transaction_cancel(sam_ctx);
+ status = NT_STATUS_INVALID_SYSTEM_SERVICE;
+ goto done;
+ }
+
+ status = samr_set_password_aes(dce_call,
+ mem_ctx,
+ &cdk,
+ sam_ctx,
+ dn,
+ NULL,
+ r->in.password,
+ DSDB_PASSWORD_CHECKED_AND_CORRECT);
+ BURN_DATA(cdk_data);
+
+ /* Restore our privileges to system level */
+ if (old_session_info != NULL) {
+ ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, old_session_info);
+ }
+
+ if (!NT_STATUS_IS_OK(status)) {
+ ldb_transaction_cancel(sam_ctx);
+ goto done;
+ }
+
+ /* And this confirms it in a transaction commit */
+ rc = ldb_transaction_commit(sam_ctx);
+ if (rc != LDB_SUCCESS) {
+ DBG_WARNING("Failed to commit transaction to change password "
+ "on %s: %s\n",
+ ldb_dn_get_linearized(dn),
+ ldb_errstring(sam_ctx));
+ status = NT_STATUS_TRANSACTION_ABORTED;
+ goto done;
+ }
+
+ status = NT_STATUS_OK;
+done:
+ {
+ struct imessaging_context *imsg_ctx =
+ dcesrv_imessaging_context(dce_call->conn);
+
+ log_password_change_event(imsg_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ dce_call->conn->remote_address,
+ dce_call->conn->local_address,
+ "samr_ChangePasswordUser4",
+ "AES using NTLM-hash",
+ r->in.account->string,
+ samAccountName,
+ status,
+ objectSid);
+ }
+
+ /* Only update the badPwdCount if we found the user */
+ if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
+ authsam_update_bad_pwd_count(sam_ctx,
+ msg,
+ ldb_get_default_basedn(sam_ctx));
+ } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
+ /*
+ * Don't give the game away: (don't allow anonymous users to
+ * prove the existence of usernames)
+ */
+ status = NT_STATUS_WRONG_PASSWORD;
+ }
+
+ return status;