ADS_STATUS ads_krb5_set_password(const char *kdc_host, const char *principal,
const char *newpw, int time_offset)
{
ADS_STATUS aret;
krb5_error_code ret = 0;
krb5_context context = NULL;
krb5_principal princ = NULL;
krb5_ccache ccache = NULL;
int result_code;
krb5_data result_code_string = { 0 };
krb5_data result_string = { 0 };
initialize_krb5_error_table();
ret = krb5_init_context(&context);
if (ret) {
DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
if (principal) {
ret = smb_krb5_parse_name(context, principal, &princ);
if (ret) {
krb5_free_context(context);
DEBUG(1, ("Failed to parse %s (%s)\n", principal,
error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
}
if (time_offset != 0) {
krb5_set_real_time(context, time(NULL) + time_offset, 0);
}
ret = krb5_cc_default(context, &ccache);
if (ret) {
krb5_free_principal(context, princ);
krb5_free_context(context);
DEBUG(1,("Failed to get default creds (%s)\n", error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
ret = krb5_set_password_using_ccache(context,
ccache,
discard_const_p(char, newpw),
princ,
&result_code,
&result_code_string,
&result_string);
if (ret) {
DEBUG(1, ("krb5_set_password failed (%s)\n", error_message(ret)));
aret = ADS_ERROR_KRB5(ret);
goto done;
}
if (result_code != KRB5_KPASSWD_SUCCESS) {
ret = kpasswd_err_to_krb5_err(result_code);
DEBUG(1, ("krb5_set_password failed (%s)\n", error_message(ret)));
aret = ADS_ERROR_KRB5(ret);
goto done;
}
aret = ADS_SUCCESS;
done:
kerberos_free_data_contents(context, &result_code_string);
kerberos_free_data_contents(context, &result_string);
krb5_free_principal(context, princ);
krb5_cc_close(context, ccache);
krb5_free_context(context);
return aret;
}
static krb5_error_code parse_setpw_reply(krb5_context context,
bool use_tcp,
krb5_auth_context auth_context,
krb5_data *packet)
{
krb5_data ap_rep;
char *p;
int vnum, ret, res_code;
krb5_data cipherresult;
krb5_data clearresult;
krb5_ap_rep_enc_part *ap_rep_enc;
krb5_replay_data replay;
unsigned int msg_length = packet->length;
if (packet->length < (use_tcp ? 8 : 4)) {
return KRB5KRB_AP_ERR_MODIFIED;
}
p = (char *)packet->data;
/*
** see if it is an error
*/
if (krb5_is_krb_error(packet)) {
ret = handle_krberror_packet(context, packet);
if (ret) {
return ret;
}
}
/* tcp... */
if (use_tcp) {
msg_length -= 4;
if (RIVAL(p, 0) != msg_length) {
DEBUG(1,("Bad TCP packet length (%d/%d) from kpasswd server\n",
RIVAL(p, 0), msg_length));
return KRB5KRB_AP_ERR_MODIFIED;
}
p += 4;
}
if (RSVAL(p, 0) != msg_length) {
DEBUG(1,("Bad packet length (%d/%d) from kpasswd server\n",
RSVAL(p, 0), msg_length));
return KRB5KRB_AP_ERR_MODIFIED;
}
p += 2;
vnum = RSVAL(p, 0); p += 2;
/* FIXME: According to standard there is only one type of reply */
if (vnum != KRB5_KPASSWD_VERS_SETPW &&
vnum != KRB5_KPASSWD_VERS_SETPW_ALT &&
vnum != KRB5_KPASSWD_VERS_CHANGEPW) {
DEBUG(1,("Bad vnum (%d) from kpasswd server\n", vnum));
return KRB5KDC_ERR_BAD_PVNO;
}
ap_rep.length = RSVAL(p, 0); p += 2;
if (p + ap_rep.length >= (char *)packet->data + packet->length) {
DEBUG(1,("ptr beyond end of packet from kpasswd server\n"));
return KRB5KRB_AP_ERR_MODIFIED;
}
if (ap_rep.length == 0) {
DEBUG(1,("got unencrypted setpw result?!\n"));
return KRB5KRB_AP_ERR_MODIFIED;
}
/* verify ap_rep */
ap_rep.data = p;
p += ap_rep.length;
ret = krb5_rd_rep(context, auth_context, &ap_rep, &ap_rep_enc);
if (ret) {
DEBUG(1,("failed to rd setpw reply (%s)\n", error_message(ret)));
return KRB5KRB_AP_ERR_MODIFIED;
}
krb5_free_ap_rep_enc_part(context, ap_rep_enc);
cipherresult.data = p;
cipherresult.length = ((char *)packet->data + packet->length) - p;
ret = krb5_rd_priv(context, auth_context, &cipherresult, &clearresult,
&replay);
if (ret) {
DEBUG(1,("failed to decrypt setpw reply (%s)\n", error_message(ret)));
return KRB5KRB_AP_ERR_MODIFIED;
}
if (clearresult.length < 2) {
free(clearresult.data);
ret = KRB5KRB_AP_ERR_MODIFIED;
return KRB5KRB_AP_ERR_MODIFIED;
}
p = (char *)clearresult.data;
res_code = RSVAL(p, 0);
free(clearresult.data);
if ((res_code < KRB5_KPASSWD_SUCCESS) ||
(res_code > KRB5_KPASSWD_ETYPE_NOSUPP)) {
return KRB5KRB_AP_ERR_MODIFIED;
}
if (res_code == KRB5_KPASSWD_SUCCESS) {
return 0;
} else {
const char *errstr;
setpw_result_code_string(context, res_code, &errstr);
DEBUG(1, ("Error changing password: %s (%d)\n", errstr, res_code));
return kpasswd_err_to_krb5_err(res_code);
}
}
static ADS_STATUS ads_krb5_chg_password(const char *kdc_host,
const char *principal,
const char *oldpw,
const char *newpw,
int time_offset)
{
ADS_STATUS aret;
krb5_error_code ret;
krb5_context context = NULL;
krb5_principal princ;
krb5_get_init_creds_opt opts;
krb5_creds creds;
char *chpw_princ = NULL, *password;
char *realm = NULL;
int result_code;
krb5_data result_code_string = { 0 };
krb5_data result_string = { 0 };
smb_krb5_addresses *addr = NULL;
initialize_krb5_error_table();
ret = krb5_init_context(&context);
if (ret) {
DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
if ((ret = smb_krb5_parse_name(context, principal,
&princ))) {
krb5_free_context(context);
DEBUG(1,("Failed to parse %s (%s)\n", principal, error_message(ret)));
return ADS_ERROR_KRB5(ret);
}
krb5_get_init_creds_opt_init(&opts);
krb5_get_init_creds_opt_set_tkt_life(&opts, 5*60);
krb5_get_init_creds_opt_set_renew_life(&opts, 0);
krb5_get_init_creds_opt_set_forwardable(&opts, 0);
krb5_get_init_creds_opt_set_proxiable(&opts, 0);
/* note that heimdal will fill in the local addresses if the addresses
* in the creds_init_opt are all empty and then later fail with invalid
* address, sending our local netbios krb5 address - just like windows
* - avoids this - gd */
ret = smb_krb5_gen_netbios_krb5_address(&addr, lp_netbios_name());
if (ret) {
krb5_free_principal(context, princ);
krb5_free_context(context);
return ADS_ERROR_KRB5(ret);
}
krb5_get_init_creds_opt_set_address_list(&opts, addr->addrs);
realm = smb_krb5_principal_get_realm(context, princ);
/* We have to obtain an INITIAL changepw ticket for changing password */
if (asprintf(&chpw_princ, "kadmin/changepw@%s", realm) == -1) {
krb5_free_context(context);
free(realm);
DEBUG(1,("ads_krb5_chg_password: asprintf fail\n"));
return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
}
free(realm);
password = SMB_STRDUP(oldpw);
ret = krb5_get_init_creds_password(context, &creds, princ, password,
kerb_prompter, NULL,
0, chpw_princ, &opts);
SAFE_FREE(chpw_princ);
SAFE_FREE(password);
if (ret) {
if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY)
DEBUG(1,("Password incorrect while getting initial ticket"));
else
DEBUG(1,("krb5_get_init_creds_password failed (%s)\n", error_message(ret)));
krb5_free_principal(context, princ);
krb5_free_context(context);
return ADS_ERROR_KRB5(ret);
}
ret = krb5_change_password(context,
&creds,
discard_const_p(char, newpw),
&result_code,
&result_code_string,
&result_string);
if (ret) {
DEBUG(1, ("krb5_change_password failed (%s)\n", error_message(ret)));
aret = ADS_ERROR_KRB5(ret);
goto done;
}
if (result_code != KRB5_KPASSWD_SUCCESS) {
ret = kpasswd_err_to_krb5_err(result_code);
DEBUG(1, ("krb5_change_password failed (%s)\n", error_message(ret)));
aret = ADS_ERROR_KRB5(ret);
goto done;
}
aret = ADS_SUCCESS;
done:
kerberos_free_data_contents(context, &result_code_string);
kerberos_free_data_contents(context, &result_string);
krb5_free_principal(context, princ);
krb5_free_context(context);
return aret;
}
