Attachment 17453 Details for Bug 14611 – patch for master v8

[patch] patch for master v8

auth-bug-14611-master-v8.patch (text/plain), 245.87 KB, created by Jennifer Sutton on 2022-08-02 08:24:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jennifer Sutton

Created: 2022-08-02 08:24:01 UTC

Size: 245.87 KB

patch

obsolete

>From 7a7e31136746b29d14df421abdf4663431544f4b Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:01:59 +1200
>Subject: [PATCH 01/40] s3:rpc_server: Fix typo in error message
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source3/rpc_server/samr/srv_samr_nt.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
>index 4f8605eb576..ac40cbc418b 100644
>--- a/source3/rpc_server/samr/srv_samr_nt.c
>+++ b/source3/rpc_server/samr/srv_samr_nt.c
>@@ -5066,7 +5066,7 @@ set_user_info_pw_aes(DATA_BLOB *pw_data, const char *rhost, struct samu *pwd)
> 
> 			username = pdb_get_username(pwd);
> 			if (username == NULL) {
>-				DBG_WARNING("User unkown\n");
>+				DBG_WARNING("User unknown\n");
> 				return false;
> 			}
> 
>-- 
>2.35.0
>
>
>From be64f77879aa43a325e3eda80aa1b6e8f67856da Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 15:19:02 +1200
>Subject: [PATCH 02/40] lib:crypto: Zero auth_tag array in encryption test
>
>If samba_gnutls_aead_aes_256_cbc_hmac_sha512_encrypt() does not fill the
>array completely, we may be comparing uninitialised bytes.
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> lib/crypto/tests/test_gnutls_aead_aes_256_cbc_hmac_sha512.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/lib/crypto/tests/test_gnutls_aead_aes_256_cbc_hmac_sha512.c b/lib/crypto/tests/test_gnutls_aead_aes_256_cbc_hmac_sha512.c
>index 51f125f42d6..bc6a191cd90 100644
>--- a/lib/crypto/tests/test_gnutls_aead_aes_256_cbc_hmac_sha512.c
>+++ b/lib/crypto/tests/test_gnutls_aead_aes_256_cbc_hmac_sha512.c
>@@ -187,7 +187,7 @@ static void torture_encrypt(void **state)
> 		.length = sizeof(salt_data),
> 	};
> 	DATA_BLOB ctext;
>-	uint8_t auth_tag[64];
>+	uint8_t auth_tag[64] = {0};
> 
> 	assert_int_equal(iv.length, 16);
> 
>-- 
>2.35.0
>
>
>From 7f2ed717f126a980b2edd98041fd24d2443bbb5e Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 15:21:43 +1200
>Subject: [PATCH 03/40] s4:torture: Zero samr_UserInfo union in password set
> test
>
>If init_samr_CryptPasswordAES() does not fill the
>u.info31.password.auth_data array completely, we may be comparing
>uninitialised bytes.
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/torture/rpc/samr.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
>index 5fe51e51022..de354659067 100644
>--- a/source4/torture/rpc/samr.c
>+++ b/source4/torture/rpc/samr.c
>@@ -920,6 +920,8 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t
> 	s.in.info = &u;
> 	s.in.level = 31;
> 
>+	ZERO_STRUCT(u);
>+
> 	u.info31.password_expired = 0;
> 
> 	status = dcerpc_fetch_session_key(p, &session_key);
>-- 
>2.35.0
>
>
>From 46ded6119650341c456f9175837d60a5ba4a2372 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:34:26 +1200
>Subject: [PATCH 04/40] lib:crypto: Check for overflow before filling pauth_tag
> array
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
>diff --git a/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c b/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c
>index a05aa8a323c..fc4d21f4ec5 100644
>--- a/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c
>+++ b/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c
>@@ -124,6 +124,14 @@ samba_gnutls_aead_aes_256_cbc_hmac_sha512_encrypt(TALLOC_CTX *mem_ctx,
> 	 * TODO: Use gnutls_cipher_encrypt3()
> 	 */
> 
>+	if (hmac_size > 64) {
>+		/*
>+		 * We don't want to overflow 'pauth_tag', which is 64 bytes in
>+		 * size.
>+		 */
>+		return NT_STATUS_INVALID_BUFFER_SIZE;
>+	}
>+
> 	if (plaintext->length + aes_block_size < plaintext->length) {
> 		return NT_STATUS_INVALID_BUFFER_SIZE;
> 	}
>-- 
>2.35.0
>
>
>From 368b34e9fbd238fa4bd5d2d0578599bccbb98014 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:34:55 +1200
>Subject: [PATCH 05/40] lib:crypto: Use constant time memory comparison to
> check HMAC
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c b/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c
>index fc4d21f4ec5..e0877a03f52 100644
>--- a/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c
>+++ b/lib/crypto/gnutls_aead_aes_256_cbc_hmac_sha512.c
>@@ -282,7 +282,7 @@ samba_gnutls_aead_aes_256_cbc_hmac_sha512_decrypt(TALLOC_CTX *mem_ctx,
> 	uint8_t padding;
> 	size_t i;
> 	NTSTATUS status;
>-	int cmp;
>+	bool equal;
> 	int rc;
> 
> 	if (cdk->length == 0 || ciphertext->length == 0 ||
>@@ -333,8 +333,8 @@ samba_gnutls_aead_aes_256_cbc_hmac_sha512_decrypt(TALLOC_CTX *mem_ctx,
> 	}
> 	gnutls_hmac_deinit(hmac_hnd, auth_data);
> 
>-	cmp = memcmp(auth_data, auth_tag, sizeof(auth_data));
>-	if (cmp != 0) {
>+	equal = mem_equal_const_time(auth_data, auth_tag, sizeof(auth_data));
>+	if (!equal) {
> 		return NT_STATUS_DECRYPTION_FAILED;
> 	}
> 
>-- 
>2.35.0
>
>
>From 44da814e3c3f3aeeac70df8828f7d7cd705528c8 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Wed, 6 Jul 2022 15:36:26 +1200
>Subject: [PATCH 06/40] CVE-2021-20251 lib:crypto: Add des_crypt_blob_16() for
> encrypting data with DES
>
>This lets us access single-DES from Python. This function is used in a
>following commit for encrypting an NT hash to obtain the verifier for a
>SAMR password change.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> lib/crypto/py_crypto.c | 65 ++++++++++++++++++++++++++++++++++++++++++
> lib/crypto/wscript     |  2 +-
> 2 files changed, 66 insertions(+), 1 deletion(-)
>
>diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c
>index ad18d3ada0f..6753d3d8e9c 100644
>--- a/lib/crypto/py_crypto.c
>+++ b/lib/crypto/py_crypto.c
>@@ -25,6 +25,7 @@
> #include <gnutls/gnutls.h>
> #include <gnutls/crypto.h>
> #include "lib/crypto/gnutls_helpers.h"
>+#include "libcli/auth/libcli_auth.h"
> 
> static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
> {
>@@ -100,13 +101,77 @@ static PyObject *py_crypto_set_strict_mode(PyObject *module)
> 	Py_RETURN_NONE;
> }
> 
>+static PyObject *py_crypto_des_crypt_blob_16(PyObject *self, PyObject *args)
>+{
>+	PyObject *py_data = NULL;
>+	uint8_t *data = NULL;
>+	Py_ssize_t data_size;
>+
>+	PyObject *py_key = NULL;
>+	uint8_t *key = NULL;
>+	Py_ssize_t key_size;
>+
>+	uint8_t result[16];
>+
>+	bool ok;
>+	int ret;
>+
>+	ok = PyArg_ParseTuple(args, "SS",
>+			      &py_data, &py_key);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ret = PyBytes_AsStringAndSize(py_data,
>+				      (char **)&data,
>+				      &data_size);
>+	if (ret != 0) {
>+		return NULL;
>+	}
>+
>+	ret = PyBytes_AsStringAndSize(py_key,
>+				      (char **)&key,
>+				      &key_size);
>+	if (ret != 0) {
>+		return NULL;
>+	}
>+
>+	if (data_size != 16) {
>+		return PyErr_Format(PyExc_ValueError,
>+				    "Expected data size of 16 bytes; got %zd",
>+				    data_size);
>+	}
>+
>+	if (key_size != 14) {
>+		return PyErr_Format(PyExc_ValueError,
>+				    "Expected key size of 14 bytes; got %zd",
>+				    key_size);
>+	}
>+
>+	ret = des_crypt112_16(result, data, key,
>+			      SAMBA_GNUTLS_ENCRYPT);
>+	if (ret != 0) {
>+		return PyErr_Format(PyExc_RuntimeError,
>+				    "des_crypt112_16() failed: %d",
>+				    ret);
>+	}
>+
>+	return PyBytes_FromStringAndSize((const char *)result,
>+					 sizeof(result));
>+}
>+
> static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n"
> 					 "Encrypt the data with RC4 algorithm using the key";
> 
>+static const char py_crypto_des_crypt_blob_16_doc[] = "des_crypt_blob_16(data, key) -> bytes\n"
>+						      "Encrypt the 16-byte data with DES using "
>+						      "the 14-byte key";
>+
> static PyMethodDef py_crypto_methods[] = {
> 	{ "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc },
> 	{ "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" },
> 	{ "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" },
>+	{ "des_crypt_blob_16", (PyCFunction)py_crypto_des_crypt_blob_16, METH_VARARGS, py_crypto_des_crypt_blob_16_doc },
> 	{0},
> };
> 
>diff --git a/lib/crypto/wscript b/lib/crypto/wscript
>index 78927437e37..acf5cb8e731 100644
>--- a/lib/crypto/wscript
>+++ b/lib/crypto/wscript
>@@ -81,7 +81,7 @@ def build(bld):
> 
>     bld.SAMBA_PYTHON('python_crypto',
>                      source='py_crypto.c',
>-                     deps='gnutls talloc',
>+                     deps='gnutls talloc LIBCLI_AUTH',
>                      realname='samba/crypto.so')
> 
>     bld.SAMBA_BINARY('test_gnutls_aead_aes_256_cbc_hmac_sha512',
>-- 
>2.35.0
>
>
>From 0eba8821beef74fea9ea9d682990e0200687dd15 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Wed, 13 Jul 2022 14:20:59 +1200
>Subject: [PATCH 07/40] CVE-2021-20251 lib:crypto: Add md4_hash_blob() for
> hashing data with MD4
>
>This lets us access MD4, which might not be available in hashlib, from
>Python. This function is used in a following commit for hashing a
>password to obtain the verifier for a SAMR password change.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> lib/crypto/py_crypto.c | 35 +++++++++++++++++++++++++++++++++++
> 1 file changed, 35 insertions(+)
>
>diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c
>index 6753d3d8e9c..40b0cb9e9c0 100644
>--- a/lib/crypto/py_crypto.c
>+++ b/lib/crypto/py_crypto.c
>@@ -25,6 +25,7 @@
> #include <gnutls/gnutls.h>
> #include <gnutls/crypto.h>
> #include "lib/crypto/gnutls_helpers.h"
>+#include "lib/crypto/md4.h"
> #include "libcli/auth/libcli_auth.h"
> 
> static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
>@@ -160,6 +161,36 @@ static PyObject *py_crypto_des_crypt_blob_16(PyObject *self, PyObject *args)
> 					 sizeof(result));
> }
> 
>+static PyObject *py_crypto_md4_hash_blob(PyObject *self, PyObject *args)
>+{
>+	PyObject *py_data = NULL;
>+	uint8_t *data = NULL;
>+	Py_ssize_t data_size;
>+
>+	uint8_t result[16];
>+
>+	bool ok;
>+	int ret;
>+
>+	ok = PyArg_ParseTuple(args, "S",
>+			      &py_data);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ret = PyBytes_AsStringAndSize(py_data,
>+				      (char **)&data,
>+				      &data_size);
>+	if (ret != 0) {
>+		return NULL;
>+	}
>+
>+	mdfour(result, data, data_size);
>+
>+	return PyBytes_FromStringAndSize((const char *)result,
>+					 sizeof(result));
>+}
>+
> static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n"
> 					 "Encrypt the data with RC4 algorithm using the key";
> 
>@@ -167,11 +198,15 @@ static const char py_crypto_des_crypt_blob_16_doc[] = "des_crypt_blob_16(data, k
> 						      "Encrypt the 16-byte data with DES using "
> 						      "the 14-byte key";
> 
>+static const char py_crypto_md4_hash_blob_doc[] = "md4_hash_blob(data) -> bytes\n"
>+						  "Hash the data with MD4 algorithm";
>+
> static PyMethodDef py_crypto_methods[] = {
> 	{ "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc },
> 	{ "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" },
> 	{ "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" },
> 	{ "des_crypt_blob_16", (PyCFunction)py_crypto_des_crypt_blob_16, METH_VARARGS, py_crypto_des_crypt_blob_16_doc },
>+	{ "md4_hash_blob", (PyCFunction)py_crypto_md4_hash_blob, METH_VARARGS, py_crypto_md4_hash_blob_doc },
> 	{0},
> };
> 
>-- 
>2.35.0
>
>
>From 458dcc338e85cc04389657b6fadc3afaedd6badf Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:35:19 +1200
>Subject: [PATCH 08/40] CVE-2021-20251 lib:crypto: Add Python functions for AES
> SAMR password change
>
>These functions allow us to perform key derivation and AES256 encryption
>in Python. They will be used in a following commit.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> lib/crypto/py_crypto.c | 221 +++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 221 insertions(+)
>
>diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c
>index 40b0cb9e9c0..11659556884 100644
>--- a/lib/crypto/py_crypto.c
>+++ b/lib/crypto/py_crypto.c
>@@ -27,6 +27,51 @@
> #include "lib/crypto/gnutls_helpers.h"
> #include "lib/crypto/md4.h"
> #include "libcli/auth/libcli_auth.h"
>+#include "libcli/util/pyerrors.h"
>+
>+#ifdef HAVE_GNUTLS_PBKDF2
>+static bool samba_gnutls_datum_from_PyObject(PyObject *py_obj,
>+					     gnutls_datum_t *datum)
>+{
>+	uint8_t *data = NULL;
>+	Py_ssize_t size;
>+
>+	int ret;
>+
>+	ret = PyBytes_AsStringAndSize(py_obj,
>+				      (char **)&data,
>+				      &size);
>+	if (ret != 0) {
>+		return false;
>+	}
>+
>+	datum->data = data;
>+	datum->size = size;
>+
>+	return true;
>+}
>+#endif /* HAVE_GNUTLS_PBKDF2 */
>+
>+static bool samba_DATA_BLOB_from_PyObject(PyObject *py_obj,
>+					  DATA_BLOB *blob)
>+{
>+	uint8_t *data = NULL;
>+	Py_ssize_t size;
>+
>+	int ret;
>+
>+	ret = PyBytes_AsStringAndSize(py_obj,
>+				      (char **)&data,
>+				      &size);
>+	if (ret != 0) {
>+		return false;
>+	}
>+
>+	blob->data = data;
>+	blob->length = size;
>+
>+	return true;
>+}
> 
> static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args)
> {
>@@ -191,6 +236,165 @@ static PyObject *py_crypto_md4_hash_blob(PyObject *self, PyObject *args)
> 					 sizeof(result));
> }
> 
>+static PyObject *py_crypto_sha512_pbkdf2(PyObject *self, PyObject *args)
>+{
>+#ifdef HAVE_GNUTLS_PBKDF2
>+	PyObject *py_key = NULL;
>+	uint8_t *key = NULL;
>+	gnutls_datum_t key_datum = {0};
>+
>+	PyObject *py_salt = NULL;
>+	gnutls_datum_t salt_datum = {0};
>+
>+	uint8_t result[16];
>+
>+	unsigned iterations = 0;
>+
>+	bool ok;
>+	int ret;
>+	NTSTATUS status;
>+
>+	ok = PyArg_ParseTuple(args, "SSI",
>+			      &py_key, &py_salt, &iterations);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ok = samba_gnutls_datum_from_PyObject(py_key, &key_datum);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ok = samba_gnutls_datum_from_PyObject(py_salt, &salt_datum);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ret = gnutls_pbkdf2(GNUTLS_MAC_SHA512,
>+			    &key_datum,
>+			    &salt_datum,
>+			    iterations,
>+			    result,
>+			    sizeof(result));
>+	BURN_DATA(key);
>+	if (ret < 0) {
>+		status = gnutls_error_to_ntstatus(ret, NT_STATUS_CRYPTO_SYSTEM_INVALID);
>+		PyErr_SetNTSTATUS(status);
>+		return NULL;
>+	}
>+
>+	return PyBytes_FromStringAndSize((const char *)result,
>+					 sizeof(result));
>+#else /* HAVE_GNUTLS_PBKDF2 */
>+	PyErr_SetString(PyExc_NotImplementedError, "gnutls_pbkdf2() is not available");
>+	return NULL;
>+#endif /* HAVE_GNUTLS_PBKDF2 */
>+}
>+
>+static PyObject *py_crypto_aead_aes_256_cbc_hmac_sha512_blob(PyObject *self, PyObject *args)
>+{
>+	TALLOC_CTX *ctx = NULL;
>+
>+	PyObject *py_ciphertext = NULL;
>+	DATA_BLOB ciphertext_blob = {0};
>+
>+	PyObject *py_auth_data = NULL;
>+	PyObject *py_result = NULL;
>+
>+	PyObject *py_plaintext = NULL;
>+	DATA_BLOB plaintext_blob = {0};
>+	PyObject *py_cek = NULL;
>+	DATA_BLOB cek_blob = {0};
>+	PyObject *py_key_salt = NULL;
>+	DATA_BLOB key_salt_blob = {0};
>+	PyObject *py_mac_salt = NULL;
>+	DATA_BLOB mac_salt_blob = {0};
>+	PyObject *py_iv = NULL;
>+	DATA_BLOB iv_blob = {0};
>+
>+	uint8_t auth_data[64];
>+
>+	bool ok;
>+	NTSTATUS status;
>+
>+	ok = PyArg_ParseTuple(args, "SSSSS",
>+			      &py_plaintext,
>+			      &py_cek,
>+			      &py_key_salt,
>+			      &py_mac_salt,
>+			      &py_iv);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	/* Create data blobs from the contents of the function parameters. */
>+
>+	ok = samba_DATA_BLOB_from_PyObject(py_plaintext, &plaintext_blob);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ok = samba_DATA_BLOB_from_PyObject(py_cek, &cek_blob);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ok = samba_DATA_BLOB_from_PyObject(py_key_salt, &key_salt_blob);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ok = samba_DATA_BLOB_from_PyObject(py_mac_salt, &mac_salt_blob);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ok = samba_DATA_BLOB_from_PyObject(py_iv, &iv_blob);
>+	if (!ok) {
>+		return NULL;
>+	}
>+
>+	ctx = talloc_new(NULL);
>+	if (ctx == NULL) {
>+		return PyErr_NoMemory();
>+	}
>+
>+	/* Encrypt the plaintext. */
>+	status = samba_gnutls_aead_aes_256_cbc_hmac_sha512_encrypt(ctx,
>+								   &plaintext_blob,
>+								   &cek_blob,
>+								   &key_salt_blob,
>+								   &mac_salt_blob,
>+								   &iv_blob,
>+								   &ciphertext_blob,
>+								   auth_data);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		PyErr_SetNTSTATUS(status);
>+		talloc_free(ctx);
>+		return NULL;
>+	}
>+
>+	/* Convert the output into Python 'bytes' objects. */
>+	py_ciphertext = PyBytes_FromStringAndSize((const char *)ciphertext_blob.data,
>+						  ciphertext_blob.length);
>+	talloc_free(ctx);
>+	if (py_ciphertext == NULL) {
>+		return NULL;
>+	}
>+	py_auth_data = PyBytes_FromStringAndSize((const char *)auth_data,
>+						 sizeof(auth_data));
>+	if (py_auth_data == NULL) {
>+		return NULL;
>+	}
>+
>+	/* Steal ciphertext and auth_data into a new tuple. */
>+	py_result = Py_BuildValue("(NN)", py_ciphertext, py_auth_data);
>+
>+	return py_result;
>+}
>+
>+
>+
> static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n"
> 					 "Encrypt the data with RC4 algorithm using the key";
> 
>@@ -201,12 +405,29 @@ static const char py_crypto_des_crypt_blob_16_doc[] = "des_crypt_blob_16(data, k
> static const char py_crypto_md4_hash_blob_doc[] = "md4_hash_blob(data) -> bytes\n"
> 						  "Hash the data with MD4 algorithm";
> 
>+static const char py_crypto_sha512_pbkdf2_doc[] = "sha512_pbkdf2(key, salt, iterations) -> bytes\n"
>+						  "Derive a key from an existing one with SHA512 "
>+						  "algorithm";
>+
>+static const char py_crypto_aead_aes_256_cbc_hmac_sha512_blob_doc[] =
>+	"aead_aes_256_cbc_hmac_sha512_blob(plaintext, cek, key_salt, "
>+	"mac_salt, iv) -> ciphertext, auth_data\n"
>+	"Encrypt the plaintext with AES256 as specified in "
>+	"[MS-SAMR] 3.2.2.4 AES Cipher Usage";
>+
> static PyMethodDef py_crypto_methods[] = {
> 	{ "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc },
> 	{ "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" },
> 	{ "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" },
> 	{ "des_crypt_blob_16", (PyCFunction)py_crypto_des_crypt_blob_16, METH_VARARGS, py_crypto_des_crypt_blob_16_doc },
> 	{ "md4_hash_blob", (PyCFunction)py_crypto_md4_hash_blob, METH_VARARGS, py_crypto_md4_hash_blob_doc },
>+	{ "sha512_pbkdf2", (PyCFunction)py_crypto_sha512_pbkdf2, METH_VARARGS, py_crypto_sha512_pbkdf2_doc },
>+	{
>+		"aead_aes_256_cbc_hmac_sha512_blob",
>+		(PyCFunction)py_crypto_aead_aes_256_cbc_hmac_sha512_blob,
>+		METH_VARARGS,
>+		py_crypto_aead_aes_256_cbc_hmac_sha512_blob_doc
>+	},
> 	{0},
> };
> 
>-- 
>2.35.0
>
>
>From 03e7c81f119878e1fee8593741e495310bfbef84 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Mon, 4 Jul 2022 20:48:48 +1200
>Subject: [PATCH 09/40] CVE-2021-20251 tests/krb5: Add tests for password
> lockout race
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> python/samba/tests/krb5/lockout_tests.py     | 1088 ++++++++++++++++++
> python/samba/tests/krb5/raw_testcase.py      |    3 +-
> python/samba/tests/krb5/rfc4120_constants.py |    1 +
> python/samba/tests/usage.py                  |    1 +
> selftest/flapping.d/ldap-pwd-change-race     |    5 +
> selftest/knownfail_heimdal_kdc               |   10 +
> selftest/knownfail_mit_kdc                   |   14 +
> source4/selftest/tests.py                    |    4 +
> 8 files changed, 1125 insertions(+), 1 deletion(-)
> create mode 100755 python/samba/tests/krb5/lockout_tests.py
> create mode 100644 selftest/flapping.d/ldap-pwd-change-race
>
>diff --git a/python/samba/tests/krb5/lockout_tests.py b/python/samba/tests/krb5/lockout_tests.py
>new file mode 100755
>index 00000000000..fb77bd3c78c
>--- /dev/null
>+++ b/python/samba/tests/krb5/lockout_tests.py
>@@ -0,0 +1,1088 @@
>+#!/usr/bin/env python3
>+# Unix SMB/CIFS implementation.
>+# Copyright (C) Stefan Metzmacher 2020
>+# Copyright (C) Catalyst.Net Ltd
>+#
>+# This program is free software; you can redistribute it and/or modify
>+# it under the terms of the GNU General Public License as published by
>+# the Free Software Foundation; either version 3 of the License, or
>+# (at your option) any later version.
>+#
>+# This program is distributed in the hope that it will be useful,
>+# but WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>+# GNU General Public License for more details.
>+#
>+# You should have received a copy of the GNU General Public License
>+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
>+#
>+
>+from concurrent import futures
>+from enum import Enum
>+from functools import partial
>+from multiprocessing import Pipe
>+import os
>+import sys
>+import time
>+
>+from cryptography.hazmat.backends import default_backend
>+from cryptography.hazmat.primitives.ciphers.base import Cipher
>+from cryptography.hazmat.primitives.ciphers import algorithms
>+
>+import ldb
>+
>+from samba import (
>+    NTSTATUSError,
>+    dsdb,
>+    generate_random_bytes,
>+    generate_random_password,
>+    ntstatus,
>+    unix2nttime,
>+    werror,
>+)
>+from samba.credentials import DONT_USE_KERBEROS, MUST_USE_KERBEROS
>+from samba.crypto import (
>+    aead_aes_256_cbc_hmac_sha512_blob,
>+    des_crypt_blob_16,
>+    md4_hash_blob,
>+    sha512_pbkdf2,
>+)
>+from samba.dcerpc import lsa, samr
>+from samba.samdb import SamDB
>+
>+from samba.tests import connect_samdb, env_get_var_value, env_loadparm
>+
>+from samba.tests.krb5.as_req_tests import AsReqBaseTest
>+from samba.tests.krb5 import kcrypto
>+from samba.tests.krb5.kdc_base_test import KDCBaseTest
>+from samba.tests.krb5.raw_testcase import KerberosCredentials
>+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1
>+from samba.tests.krb5.rfc4120_constants import (
>+    KDC_ERR_CLIENT_REVOKED,
>+    KDC_ERR_PREAUTH_FAILED,
>+    KRB_AS_REP,
>+    KRB_ERROR,
>+    NT_PRINCIPAL,
>+    NT_SRV_INST,
>+)
>+
>+sys.path.insert(0, 'bin/python')
>+os.environ['PYTHONUNBUFFERED'] = '1'
>+
>+global_asn1_print = False
>+global_hexdump = False
>+
>+
>+class ConnectionResult(Enum):
>+    LOCKED_OUT = 1
>+    WRONG_PASSWORD = 2
>+    SUCCESS = 3
>+
>+
>+def connect_kdc(pipe,
>+                url,
>+                hostname,
>+                username,
>+                password,
>+                domain,
>+                realm,
>+                workstation,
>+                dn,
>+                expect_error=True):
>+    AsReqBaseTest.setUpClass()
>+    as_req_base = AsReqBaseTest()
>+    as_req_base.setUp()
>+
>+    user_creds = KerberosCredentials()
>+    user_creds.set_username(username)
>+    user_creds.set_password(password)
>+    user_creds.set_domain(domain)
>+    user_creds.set_realm(realm)
>+    user_creds.set_workstation(workstation)
>+    user_creds.set_kerberos_state(DONT_USE_KERBEROS)
>+
>+    user_name = user_creds.get_username()
>+    cname = as_req_base.PrincipalName_create(name_type=NT_PRINCIPAL,
>+                                             names=user_name.split('/'))
>+
>+    krbtgt_creds = as_req_base.get_krbtgt_creds()
>+    krbtgt_supported_etypes = krbtgt_creds.tgs_supported_enctypes
>+    realm = krbtgt_creds.get_realm()
>+
>+    krbtgt_account = krbtgt_creds.get_username()
>+    sname = as_req_base.PrincipalName_create(name_type=NT_SRV_INST,
>+                                             names=[krbtgt_account, realm])
>+
>+    expected_salt = user_creds.get_salt()
>+
>+    till = as_req_base.get_KerberosTime(offset=36000)
>+
>+    kdc_options = krb5_asn1.KDCOptions('postdated')
>+
>+    preauth_key = as_req_base.PasswordKey_from_creds(user_creds,
>+                                                     kcrypto.Enctype.AES256)
>+
>+    ts_enc_padata = as_req_base.get_enc_timestamp_pa_data_from_key(preauth_key)
>+    padata = [ts_enc_padata]
>+
>+    krbtgt_decryption_key = (
>+        as_req_base.TicketDecryptionKey_from_creds(krbtgt_creds))
>+
>+    etypes = as_req_base.get_default_enctypes()
>+
>+    if expect_error:
>+        expected_error_modes = (KDC_ERR_CLIENT_REVOKED,
>+                                KDC_ERR_PREAUTH_FAILED)
>+    else:
>+        expected_error_modes = 0
>+
>+    # Remove the LDAP connection.
>+    del type(as_req_base)._ldb
>+
>+    # Indicate that we're ready. This ensures we hit the right transaction
>+    # lock.
>+    pipe.send_bytes(b'0')
>+
>+    # Wait for the main process to take out a transaction lock.
>+    if not pipe.poll(timeout=5):
>+        raise AssertionError('main process failed to indicate readiness')
>+
>+    # Try making a Kerberos AS-REQ to the KDC. This should fail, either due to
>+    # the user's account being locked out or due to using the wrong password.
>+    as_rep, kdc_exchange_dict = as_req_base._test_as_exchange(
>+        cname=cname,
>+        realm=realm,
>+        sname=sname,
>+        till=till,
>+        client_as_etypes=etypes,
>+        expected_error_mode=expected_error_modes,
>+        expected_crealm=realm,
>+        expected_cname=cname,
>+        expected_srealm=realm,
>+        expected_sname=sname,
>+        expected_salt=expected_salt,
>+        etypes=etypes,
>+        padata=padata,
>+        kdc_options=kdc_options,
>+        expected_supported_etypes=krbtgt_supported_etypes,
>+        expected_account_name=user_name,
>+        preauth_key=preauth_key,
>+        ticket_decryption_key=krbtgt_decryption_key,
>+        pac_request=True)
>+    as_req_base.assertIsNotNone(as_rep)
>+
>+    msg_type = as_rep['msg-type']
>+    if expect_error and msg_type != KRB_ERROR or (
>+            not expect_error and msg_type != KRB_AS_REP):
>+        raise AssertionError(f'wrong message type {msg_type}')
>+
>+    if not expect_error:
>+        return ConnectionResult.SUCCESS
>+
>+    error_code = as_rep['error-code']
>+    if error_code == KDC_ERR_CLIENT_REVOKED:
>+        return ConnectionResult.LOCKED_OUT
>+    elif error_code == KDC_ERR_PREAUTH_FAILED:
>+        return ConnectionResult.WRONG_PASSWORD
>+    else:
>+        raise AssertionError(f'wrong error code {error_code}')
>+
>+
>+def connect_ntlm(pipe,
>+                 url,
>+                 hostname,
>+                 username,
>+                 password,
>+                 domain,
>+                 realm,
>+                 workstation,
>+                 dn):
>+    user_creds = KerberosCredentials()
>+    user_creds.set_username(username)
>+    user_creds.set_password(password)
>+    user_creds.set_domain(domain)
>+    user_creds.set_workstation(workstation)
>+    user_creds.set_kerberos_state(DONT_USE_KERBEROS)
>+
>+    # Indicate that we're ready. This ensures we hit the right transaction
>+    # lock.
>+    pipe.send_bytes(b'0')
>+
>+    # Wait for the main process to take out a transaction lock.
>+    if not pipe.poll(timeout=5):
>+        raise AssertionError('main process failed to indicate readiness')
>+
>+    # Keep trying until we get a connection.
>+    for i in range(3):
>+        try:
>+            # Try connecting to SamDB. This should fail, either due to our
>+            # account being locked out or due to using the wrong password.
>+            SamDB(url=url,
>+                  credentials=user_creds,
>+                  lp=env_loadparm())
>+        except ldb.LdbError as err:
>+            num, estr = err.args
>+            if num == ldb.ERR_OPERATIONS_ERROR and (
>+                    f'NT_STATUS_ADDRESS_ALREADY_ASSOCIATED' in estr):
>+                # This error can occur when we make connection attempts too
>+                # rapidly and use an address that was just disconnected
>+                # from. Try again.
>+                continue
>+
>+            if num != ldb.ERR_INVALID_CREDENTIALS:
>+                raise AssertionError(f'connection raised wrong error code '
>+                                     f'({err})')
>+
>+            if f'data {werror.WERR_ACCOUNT_LOCKED_OUT:x},' in estr:
>+                return ConnectionResult.LOCKED_OUT
>+            elif f'data {werror.WERR_LOGON_FAILURE:x},' in estr:
>+                return ConnectionResult.WRONG_PASSWORD
>+            else:
>+                raise AssertionError(f'connection raised wrong error code '
>+                                     f'({estr})')
>+        else:
>+            return ConnectionResult.SUCCESS
>+
>+    raise RuntimeError('failed to connect to SamDB')
>+
>+
>+def connect_samr(pipe,
>+                 url,
>+                 hostname,
>+                 username,
>+                 password,
>+                 domain,
>+                 realm,
>+                 workstation,
>+                 dn):
>+    # Get the user's NT hash.
>+    user_creds = KerberosCredentials()
>+    user_creds.set_password(password)
>+    nt_hash = user_creds.get_nt_hash()
>+
>+    # Generate a new UTF-16 password.
>+    new_password = generate_random_password(32, 32)
>+    new_password = new_password.encode('utf-16le')
>+
>+    # Generate the MD4 hash of the password.
>+    new_password_md4 = md4_hash_blob(new_password)
>+
>+    # Prefix the password with padding so it is 512 bytes long.
>+    new_password_len = len(new_password)
>+    remaining_len = 512 - new_password_len
>+    new_password = bytes(remaining_len) + new_password
>+
>+    # Append the 32-bit length of the password..
>+    new_password += int.to_bytes(new_password_len,
>+                                 length=4,
>+                                 byteorder='little')
>+
>+    # Encrypt the password with RC4 and the existing NT hash.
>+    encryptor = Cipher(algorithms.ARC4(nt_hash),
>+                       None,
>+                       default_backend()).encryptor()
>+    new_password = encryptor.update(new_password)
>+
>+    # Create a key from the MD4 hash of the new password.
>+    key = new_password_md4[:14]
>+
>+    # Encrypt the old NT hash with DES to obtain the verifier.
>+    verifier = des_crypt_blob_16(nt_hash, key)
>+
>+    server = lsa.String()
>+    server.string = hostname
>+
>+    account = lsa.String()
>+    account.string = username
>+
>+    nt_password = samr.CryptPassword()
>+    nt_password.data = list(new_password)
>+
>+    nt_verifier = samr.Password()
>+    nt_verifier.hash = list(verifier)
>+
>+    conn = samr.samr(f'ncacn_np:{hostname}[krb5,seal,smb2]')
>+
>+    # Indicate that we're ready. This ensures we hit the right transaction
>+    # lock.
>+    pipe.send_bytes(b'0')
>+
>+    # Wait for the main process to take out a transaction lock.
>+    if not pipe.poll(timeout=5):
>+        raise AssertionError('main process failed to indicate readiness')
>+
>+    try:
>+        # Try changing the password. This should fail, either due to our
>+        # account being locked out or due to using the wrong password.
>+        conn.ChangePasswordUser3(server=server,
>+                                 account=account,
>+                                 nt_password=nt_password,
>+                                 nt_verifier=nt_verifier,
>+                                 lm_change=True,
>+                                 lm_password=None,
>+                                 lm_verifier=None,
>+                                 password3=None)
>+    except NTSTATUSError as err:
>+        num, estr = err.args
>+
>+        if num == ntstatus.NT_STATUS_ACCOUNT_LOCKED_OUT:
>+            return ConnectionResult.LOCKED_OUT
>+        elif num == ntstatus.NT_STATUS_WRONG_PASSWORD:
>+            return ConnectionResult.WRONG_PASSWORD
>+        else:
>+            raise AssertionError(f'pwd change raised wrong error code '
>+                                 f'({num:08X})')
>+    else:
>+        return ConnectionResult.SUCCESS
>+
>+
>+def connect_samr_aes(pipe,
>+                     url,
>+                     hostname,
>+                     username,
>+                     password,
>+                     domain,
>+                     realm,
>+                     workstation,
>+                     dn):
>+    # Get the user's NT hash.
>+    user_creds = KerberosCredentials()
>+    user_creds.set_password(password)
>+    nt_hash = user_creds.get_nt_hash()
>+
>+    # Generate a new UTF-16 password.
>+    new_password = generate_random_password(32, 32)
>+    new_password = new_password.encode('utf-16le')
>+
>+    # Prepend the 16-bit length of the password..
>+    new_password_len = int.to_bytes(len(new_password),
>+                                    length=2,
>+                                    byteorder='little')
>+    new_password = new_password_len + new_password
>+
>+    server = lsa.String()
>+    server.string = hostname
>+
>+    account = lsa.String()
>+    account.string = username
>+
>+    # Derive a key from the user's NT hash.
>+    iv = generate_random_bytes(16)
>+    iterations = 5555
>+    cek = sha512_pbkdf2(nt_hash, iv, iterations)
>+
>+    enc_key_salt = (b'Microsoft SAM encryption key '
>+                    b'AEAD-AES-256-CBC-HMAC-SHA512 16\0')
>+    mac_key_salt = (b'Microsoft SAM MAC key '
>+                    b'AEAD-AES-256-CBC-HMAC-SHA512 16\0')
>+
>+    # Encrypt the new password.
>+    ciphertext, auth_data = aead_aes_256_cbc_hmac_sha512_blob(new_password,
>+                                                              cek,
>+                                                              enc_key_salt,
>+                                                              mac_key_salt,
>+                                                              iv)
>+
>+    # Create the new password structure
>+    pwd_buf = samr.EncryptedPasswordAES()
>+    pwd_buf.auth_data = list(auth_data)
>+    pwd_buf.salt = list(iv)
>+    pwd_buf.cipher_len = len(ciphertext)
>+    pwd_buf.cipher = list(ciphertext)
>+    pwd_buf.PBKDF2Iterations = iterations
>+
>+    conn = samr.samr(f'ncacn_np:{hostname}[krb5,seal,smb2]')
>+
>+    # Indicate that we're ready. This ensures we hit the right transaction
>+    # lock.
>+    pipe.send_bytes(b'0')
>+
>+    # Wait for the main process to take out a transaction lock.
>+    if not pipe.poll(timeout=5):
>+        raise AssertionError('main process failed to indicate readiness')
>+
>+    try:
>+        # Try changing the password. This should fail, either due to our
>+        # account being locked out or due to using the wrong password.
>+        conn.ChangePasswordUser4(server=server,
>+                                 account=account,
>+                                 password=pwd_buf)
>+    except NTSTATUSError as err:
>+        num, estr = err.args
>+
>+        if num == ntstatus.NT_STATUS_ACCOUNT_LOCKED_OUT:
>+            return ConnectionResult.LOCKED_OUT
>+        elif num == ntstatus.NT_STATUS_WRONG_PASSWORD:
>+            return ConnectionResult.WRONG_PASSWORD
>+        else:
>+            raise AssertionError(f'pwd change raised wrong error code '
>+                                 f'({num:08X})')
>+    else:
>+        return ConnectionResult.SUCCESS
>+
>+
>+def ldap_pwd_change(pipe,
>+                    url,
>+                    hostname,
>+                    username,
>+                    password,
>+                    domain,
>+                    realm,
>+                    workstation,
>+                    dn):
>+    lp = env_loadparm()
>+
>+    admin_creds = KerberosCredentials()
>+    admin_creds.guess(lp)
>+    admin_creds.set_username(env_get_var_value('ADMIN_USERNAME'))
>+    admin_creds.set_password(env_get_var_value('ADMIN_PASSWORD'))
>+    admin_creds.set_kerberos_state(MUST_USE_KERBEROS)
>+
>+    samdb = SamDB(url=url,
>+                  credentials=admin_creds,
>+                  lp=lp)
>+
>+    old_utf16pw = f'"{password}"'.encode('utf-16le')
>+
>+    new_password = generate_random_password(32, 32)
>+    new_utf16pw = f'"{new_password}"'.encode('utf-16le')
>+
>+    msg = ldb.Message(ldb.Dn(samdb, dn))
>+    msg['0'] = ldb.MessageElement(old_utf16pw,
>+                                  ldb.FLAG_MOD_DELETE,
>+                                  'unicodePwd')
>+    msg['1'] = ldb.MessageElement(new_utf16pw,
>+                                  ldb.FLAG_MOD_ADD,
>+                                  'unicodePwd')
>+
>+    # Indicate that we're ready. This ensures we hit the right transaction
>+    # lock.
>+    pipe.send_bytes(b'0')
>+
>+    # Wait for the main process to take out a transaction lock.
>+    if not pipe.poll(timeout=5):
>+        raise AssertionError('main process failed to indicate readiness')
>+
>+    # Try changing the user's password. This should fail, either due to the
>+    # user's account being locked out or due to specifying the wrong password.
>+    try:
>+        samdb.modify(msg)
>+    except ldb.LdbError as err:
>+        num, estr = err.args
>+        if num != ldb.ERR_CONSTRAINT_VIOLATION:
>+            raise AssertionError(f'pwd change raised wrong error code ({err})')
>+
>+        if f'<{werror.WERR_ACCOUNT_LOCKED_OUT:08X}:' in estr:
>+            return ConnectionResult.LOCKED_OUT
>+        elif f'<{werror.WERR_INVALID_PASSWORD:08X}:' in estr:
>+            return ConnectionResult.WRONG_PASSWORD
>+        else:
>+            raise AssertionError(f'pwd change raised wrong error code '
>+                                 f'({estr})')
>+    else:
>+        return ConnectionResult.SUCCESS
>+
>+
>+class LockoutTests(KDCBaseTest):
>+
>+    def setUp(self):
>+        super().setUp()
>+        self.do_asn1_print = global_asn1_print
>+        self.do_hexdump = global_hexdump
>+
>+        samdb = self.get_samdb()
>+        base_dn = ldb.Dn(samdb, samdb.domain_dn())
>+
>+        def modify_attr(attr, value):
>+            if value is None:
>+                value = []
>+                flag = ldb.FLAG_MOD_DELETE
>+            else:
>+                value = str(value)
>+                flag = ldb.FLAG_MOD_REPLACE
>+
>+                msg = ldb.Message(base_dn)
>+                msg[attr] = ldb.MessageElement(
>+                    value, flag, attr)
>+                samdb.modify(msg)
>+
>+        res = samdb.search(base_dn,
>+                           scope=ldb.SCOPE_BASE,
>+                           attrs=['lockoutDuration',
>+                                  'lockoutThreshold',
>+                                  'msDS-LogonTimeSyncInterval'])
>+        self.assertEqual(1, len(res))
>+
>+        # Reset the lockout duration as it was before.
>+        lockout_duration = res[0].get('lockoutDuration', idx=0)
>+        self.addCleanup(modify_attr, 'lockoutDuration', lockout_duration)
>+
>+        # Set the new lockout duration: locked out accounts now stay locked
>+        # out.
>+        modify_attr('lockoutDuration', 0)
>+
>+        # Reset the lockout threshold as it was before.
>+        lockout_threshold = res[0].get('lockoutThreshold', idx=0)
>+        self.addCleanup(modify_attr, 'lockoutThreshold', lockout_threshold)
>+
>+        # Set the new lockout threshold.
>+        self.lockout_threshold = 3
>+        modify_attr('lockoutThreshold', self.lockout_threshold)
>+
>+        # Reset the logon time sync interval as it was before.
>+        sync_interval = res[0].get('msDS-LogonTimeSyncInterval', idx=0)
>+        self.addCleanup(modify_attr,
>+                        'msDS-LogonTimeSyncInterval',
>+                        sync_interval)
>+
>+        # Set the new logon time sync interval. Setting it to 0 eliminates the
>+        # need for this attribute to be updated on logon, and thus the
>+        # requirement to take out a transaction.
>+        modify_attr('msDS-LogonTimeSyncInterval', 0)
>+
>+        # Get the old 'minPwdAge'.
>+        minPwdAge = samdb.get_minPwdAge()
>+
>+        # Reset the 'minPwdAge' as it was before.
>+        self.addCleanup(samdb.set_minPwdAge, minPwdAge)
>+
>+        # Set it temporarily to '0'.
>+        samdb.set_minPwdAge('0')
>+
>+    def assertLocalSamDB(self, samdb):
>+        if samdb.url.startswith('tdb://'):
>+            return
>+        if samdb.url.startswith('mdb://'):
>+            return
>+
>+        self.fail(f'connection to {samdb.url} is not local!')
>+
>+    def wait_for_ready(self, pipe, future):
>+        if pipe.poll(timeout=5):
>+            return
>+
>+        # We failed to read a response from the pipe, so see if the test raised
>+        # an exception with more information.
>+        if future.done():
>+            exception = future.exception(timeout=0)
>+            if exception is not None:
>+                raise exception
>+
>+        self.fail('test failed to indicate readiness')
>+
>+    def test_lockout_transaction_kdc(self):
>+        self.do_lockout_transaction(connect_kdc)
>+
>+    def test_lockout_transaction_ntlm(self):
>+        self.do_lockout_transaction(connect_ntlm)
>+
>+    def test_lockout_transaction_samr(self):
>+        self.do_lockout_transaction(connect_samr)
>+
>+    def test_lockout_transaction_samr_aes(self):
>+        self.do_lockout_transaction(connect_samr_aes)
>+
>+    def test_lockout_transaction_ldap_pw_change(self):
>+        self.do_lockout_transaction(ldap_pwd_change)
>+
>+    # Tests to ensure we can handle the account being renamed. We do not test
>+    # renames with SAMR password changes, because in that case the entire
>+    # process happens inside a transaction, and the password change method only
>+    # receives the account username. By the time it searches for the account,
>+    # it will have already been renamed, and so it will always fail to find the
>+    # account.
>+
>+    def test_lockout_transaction_rename_kdc(self):
>+        self.do_lockout_transaction(connect_kdc, rename=True)
>+
>+    def test_lockout_transaction_rename_ntlm(self):
>+        self.do_lockout_transaction(connect_ntlm, rename=True)
>+
>+    def test_lockout_transaction_rename_ldap_pw_change(self):
>+        self.do_lockout_transaction(ldap_pwd_change, rename=True)
>+
>+    def test_lockout_transaction_bad_pwd_kdc(self):
>+        self.do_lockout_transaction(connect_kdc, correct_pw=False)
>+
>+    def test_lockout_transaction_bad_pwd_ntlm(self):
>+        self.do_lockout_transaction(connect_ntlm, correct_pw=False)
>+
>+    def test_lockout_transaction_bad_pwd_samr(self):
>+        self.do_lockout_transaction(connect_samr, correct_pw=False)
>+
>+    def test_lockout_transaction_bad_pwd_samr_aes(self):
>+        self.do_lockout_transaction(connect_samr_aes, correct_pw=False)
>+
>+    def test_lockout_transaction_bad_pwd_ldap_pw_change(self):
>+        self.do_lockout_transaction(ldap_pwd_change, correct_pw=False)
>+
>+    def test_bad_pwd_count_transaction_kdc(self):
>+        self.do_bad_pwd_count_transaction(connect_kdc)
>+
>+    def test_bad_pwd_count_transaction_ntlm(self):
>+        self.do_bad_pwd_count_transaction(connect_ntlm)
>+
>+    def test_bad_pwd_count_transaction_samr(self):
>+        self.do_bad_pwd_count_transaction(connect_samr)
>+
>+    def test_bad_pwd_count_transaction_samr_aes(self):
>+        self.do_bad_pwd_count_transaction(connect_samr_aes)
>+
>+    def test_bad_pwd_count_transaction_ldap_pw_change(self):
>+        self.do_bad_pwd_count_transaction(ldap_pwd_change)
>+
>+    def test_bad_pwd_count_transaction_rename_kdc(self):
>+        self.do_bad_pwd_count_transaction(connect_kdc, rename=True)
>+
>+    def test_bad_pwd_count_transaction_rename_ntlm(self):
>+        self.do_bad_pwd_count_transaction(connect_ntlm, rename=True)
>+
>+    def test_bad_pwd_count_transaction_rename_ldap_pw_change(self):
>+        self.do_bad_pwd_count_transaction(ldap_pwd_change, rename=True)
>+
>+    def test_lockout_race_kdc(self):
>+        self.do_lockout_race(connect_kdc)
>+
>+    def test_lockout_race_ntlm(self):
>+        self.do_lockout_race(connect_ntlm)
>+
>+    def test_lockout_race_samr(self):
>+        self.do_lockout_race(connect_samr)
>+
>+    def test_lockout_race_samr_aes(self):
>+        self.do_lockout_race(connect_samr_aes)
>+
>+    def test_lockout_race_ldap_pw_change(self):
>+        self.do_lockout_race(ldap_pwd_change)
>+
>+    def test_logon_without_transaction_ntlm(self):
>+        self.do_logon_without_transaction(connect_ntlm)
>+
>+    # Tests to ensure that the connection functions work correctly in the happy
>+    # path.
>+
>+    def test_logon_kdc(self):
>+        self.do_logon(partial(connect_kdc, expect_error=False))
>+
>+    def test_logon_ntlm(self):
>+        self.do_logon(connect_ntlm)
>+
>+    def test_logon_samr(self):
>+        self.do_logon(connect_samr)
>+
>+    def test_logon_samr_aes(self):
>+        self.do_logon(connect_samr_aes)
>+
>+    def test_logon_ldap_pw_change(self):
>+        self.do_logon(ldap_pwd_change)
>+
>+    # Test that connection without a correct password works.
>+    def do_logon(self, connect_fn):
>+        # Create the user account for testing.
>+        user_creds = self.get_cached_creds(account_type=self.AccountType.USER,
>+                                           use_cache=False)
>+        user_dn = user_creds.get_dn()
>+
>+        admin_creds = self.get_admin_creds()
>+        lp = self.get_lp()
>+
>+        # Get a connection to our local SamDB.
>+        samdb = connect_samdb(samdb_url=lp.samdb_url(), lp=lp,
>+                              credentials=admin_creds)
>+        self.assertLocalSamDB(samdb)
>+
>+        password = user_creds.get_password()
>+
>+        # Prepare to connect to the server with a valid password.
>+        our_pipe, their_pipe = Pipe(duplex=True)
>+
>+        # Inform the test function that it may proceed.
>+        our_pipe.send_bytes(b'0')
>+
>+        result = connect_fn(pipe=their_pipe,
>+                            url=f'ldap://{samdb.host_dns_name()}',
>+                            hostname=samdb.host_dns_name(),
>+                            username=user_creds.get_username(),
>+                            password=password,
>+                            domain=user_creds.get_domain(),
>+                            realm=user_creds.get_realm(),
>+                            workstation=user_creds.get_workstation(),
>+                            dn=str(user_dn))
>+
>+        # The connection should succeed.
>+        self.assertEqual(result, ConnectionResult.SUCCESS)
>+
>+    # Lock out the account while holding a transaction lock, then release the
>+    # lock. A logon attempt already in progress should reread the account
>+    # details and recognise the account is locked out. The account can
>+    # additionally be renamed within the transaction to ensure that, by using
>+    # the GUID, rereading the account's details still succeeds.
>+    def do_lockout_transaction(self, connect_fn,
>+                               rename=False,
>+                               correct_pw=True):
>+        # Create the user account for testing.
>+        user_creds = self.get_cached_creds(account_type=self.AccountType.USER,
>+                                           use_cache=False)
>+        user_dn = user_creds.get_dn()
>+
>+        admin_creds = self.get_admin_creds()
>+        lp = self.get_lp()
>+
>+        # Get a connection to our local SamDB.
>+        samdb = connect_samdb(samdb_url=lp.samdb_url(), lp=lp,
>+                              credentials=admin_creds)
>+        self.assertLocalSamDB(samdb)
>+
>+        password = user_creds.get_password()
>+        if not correct_pw:
>+            password = password[:-1]
>+
>+        # Prepare to connect to the server.
>+        with futures.ProcessPoolExecutor(max_workers=1) as executor:
>+            our_pipe, their_pipe = Pipe(duplex=True)
>+            connect_future = executor.submit(
>+                connect_fn,
>+                pipe=their_pipe,
>+                url=f'ldap://{samdb.host_dns_name()}',
>+                hostname=samdb.host_dns_name(),
>+                username=user_creds.get_username(),
>+                password=password,
>+                domain=user_creds.get_domain(),
>+                realm=user_creds.get_realm(),
>+                workstation=user_creds.get_workstation(),
>+                dn=str(user_dn))
>+
>+            # Wait until the test process indicates it's ready.
>+            self.wait_for_ready(our_pipe, connect_future)
>+
>+            # Take out a transaction.
>+            samdb.transaction_start()
>+            try:
>+                # Lock out the account. We must do it using an actual password
>+                # check like so, rather than directly with a database
>+                # modification, so that the account is also added to the
>+                # auxiliary bad password database.
>+
>+                old_utf16pw = f'"Secret007"'.encode('utf-16le')  # invalid pwd
>+                new_utf16pw = f'"Secret008"'.encode('utf-16le')
>+
>+                msg = ldb.Message(user_dn)
>+                msg['0'] = ldb.MessageElement(old_utf16pw,
>+                                              ldb.FLAG_MOD_DELETE,
>+                                              'unicodePwd')
>+                msg['1'] = ldb.MessageElement(new_utf16pw,
>+                                              ldb.FLAG_MOD_ADD,
>+                                              'unicodePwd')
>+
>+                for i in range(self.lockout_threshold):
>+                    try:
>+                        samdb.modify(msg)
>+                    except ldb.LdbError as err:
>+                        num, estr = err.args
>+
>+                        # We get an error, but the bad password count should
>+                        # still be updated.
>+                        self.assertEqual(num, ldb.ERR_OPERATIONS_ERROR)
>+                        self.assertEqual('Failed to obtain remote address for '
>+                                         'the LDAP client while changing the '
>+                                         'password',
>+                                         estr)
>+                    else:
>+                        self.fail('pwd change should have failed')
>+
>+                # Ensure the account is locked out.
>+
>+                res = samdb.search(
>+                    user_dn, scope=ldb.SCOPE_BASE,
>+                    attrs=['msDS-User-Account-Control-Computed'])
>+                self.assertEqual(1, len(res))
>+
>+                uac = int(res[0].get('msDS-User-Account-Control-Computed',
>+                                     idx=0))
>+                self.assertTrue(uac & dsdb.UF_LOCKOUT)
>+
>+                # Now the bad password database has been updated, inform the
>+                # test process that it may proceed.
>+                our_pipe.send_bytes(b'0')
>+
>+                # Wait one second to ensure the test process hits the
>+                # transaction lock.
>+                time.sleep(1)
>+
>+                if rename:
>+                    # While we're at it, rename the account to ensure that is
>+                    # also safe if a race occurs.
>+                    msg = ldb.Message(user_dn)
>+                    new_username = self.get_new_username()
>+                    msg['sAMAccountName'] = ldb.MessageElement(
>+                        new_username,
>+                        ldb.FLAG_MOD_REPLACE,
>+                        'sAMAccountName')
>+                    samdb.modify(msg)
>+
>+            except Exception:
>+                samdb.transaction_cancel()
>+                raise
>+
>+            # Commit the local transaction.
>+            samdb.transaction_commit()
>+
>+            result = connect_future.result(timeout=5)
>+            self.assertEqual(result, ConnectionResult.LOCKED_OUT)
>+
>+    # Update the bad password count while holding a transaction lock, then
>+    # release the lock. A logon attempt already in progress should reread the
>+    # account details and ensure the bad password count is atomically
>+    # updated. The account can additionally be renamed within the transaction
>+    # to ensure that, by using the GUID, rereading the account's details still
>+    # succeeds.
>+    def do_bad_pwd_count_transaction(self, connect_fn, rename=False):
>+        # Create the user account for testing.
>+        user_creds = self.get_cached_creds(account_type=self.AccountType.USER,
>+                                           use_cache=False)
>+        user_dn = user_creds.get_dn()
>+
>+        admin_creds = self.get_admin_creds()
>+        lp = self.get_lp()
>+
>+        # Get a connection to our local SamDB.
>+        samdb = connect_samdb(samdb_url=lp.samdb_url(), lp=lp,
>+                              credentials=admin_creds)
>+        self.assertLocalSamDB(samdb)
>+
>+        # Prepare to connect to the server with an invalid password.
>+        with futures.ProcessPoolExecutor(max_workers=1) as executor:
>+            our_pipe, their_pipe = Pipe(duplex=True)
>+            connect_future = executor.submit(
>+                connect_fn,
>+                pipe=their_pipe,
>+                url=f'ldap://{samdb.host_dns_name()}',
>+                hostname=samdb.host_dns_name(),
>+                username=user_creds.get_username(),
>+                password=user_creds.get_password()[:-1],  # invalid password
>+                domain=user_creds.get_domain(),
>+                realm=user_creds.get_realm(),
>+                workstation=user_creds.get_workstation(),
>+                dn=str(user_dn))
>+
>+            # Wait until the test process indicates it's ready.
>+            self.wait_for_ready(our_pipe, connect_future)
>+
>+            # Take out a transaction.
>+            samdb.transaction_start()
>+            try:
>+                # Inform the test process that it may proceed.
>+                our_pipe.send_bytes(b'0')
>+
>+                # Wait one second to ensure the test process hits the
>+                # transaction lock.
>+                time.sleep(1)
>+
>+                # Set badPwdCount to 1.
>+                msg = ldb.Message(user_dn)
>+                now = int(time.time())
>+                bad_pwd_time = unix2nttime(now)
>+                msg['badPwdCount'] = ldb.MessageElement(
>+                    '1',
>+                    ldb.FLAG_MOD_REPLACE,
>+                    'badPwdCount')
>+                msg['badPasswordTime'] = ldb.MessageElement(
>+                    str(bad_pwd_time),
>+                    ldb.FLAG_MOD_REPLACE,
>+                    'badPasswordTime')
>+                if rename:
>+                    # While we're at it, rename the account to ensure that is
>+                    # also safe if a race occurs.
>+                    new_username = self.get_new_username()
>+                    msg['sAMAccountName'] = ldb.MessageElement(
>+                        new_username,
>+                        ldb.FLAG_MOD_REPLACE,
>+                        'sAMAccountName')
>+                samdb.modify(msg)
>+
>+                # Ensure the account is not yet locked out.
>+
>+                res = samdb.search(
>+                    user_dn, scope=ldb.SCOPE_BASE,
>+                    attrs=['msDS-User-Account-Control-Computed'])
>+                self.assertEqual(1, len(res))
>+
>+                uac = int(res[0].get('msDS-User-Account-Control-Computed',
>+                                     idx=0))
>+                self.assertFalse(uac & dsdb.UF_LOCKOUT)
>+            except Exception:
>+                samdb.transaction_cancel()
>+                raise
>+
>+            # Commit the local transaction.
>+            samdb.transaction_commit()
>+
>+            result = connect_future.result(timeout=5)
>+            self.assertEqual(result, ConnectionResult.WRONG_PASSWORD, result)
>+
>+        # Check that badPwdCount has now increased to 2.
>+
>+        res = samdb.search(user_dn,
>+                           scope=ldb.SCOPE_BASE,
>+                           attrs=['badPwdCount'])
>+        self.assertEqual(1, len(res))
>+
>+        bad_pwd_count = int(res[0].get('badPwdCount', idx=0))
>+        self.assertEqual(2, bad_pwd_count)
>+
>+    # Attempt to log in to the account with an incorrect password, using
>+    # lockoutThreshold+1 simultaneous attempts. We should get three 'wrong
>+    # password' errors and one 'locked out' error, showing that the bad
>+    # password count is checked and incremented atomically.
>+    def do_lockout_race(self, connect_fn):
>+        # Create the user account for testing.
>+        user_creds = self.get_cached_creds(account_type=self.AccountType.USER,
>+                                           use_cache=False)
>+        user_dn = user_creds.get_dn()
>+
>+        admin_creds = self.get_admin_creds()
>+        lp = self.get_lp()
>+
>+        # Get a connection to our local SamDB.
>+        samdb = connect_samdb(samdb_url=lp.samdb_url(), lp=lp,
>+                              credentials=admin_creds)
>+        self.assertLocalSamDB(samdb)
>+
>+        # Prepare to connect to the server with an invalid password, using four
>+        # simultaneous requests. Only three of those attempts should get
>+        # through before the account is locked out.
>+        num_attempts = self.lockout_threshold + 1
>+        with futures.ProcessPoolExecutor(max_workers=num_attempts) as executor:
>+            connect_futures = []
>+            our_pipes = []
>+            for i in range(num_attempts):
>+                our_pipe, their_pipe = Pipe(duplex=True)
>+                our_pipes.append(our_pipe)
>+
>+                connect_future = executor.submit(
>+                    connect_fn,
>+                    pipe=their_pipe,
>+                    url=f'ldap://{samdb.host_dns_name()}',
>+                    hostname=samdb.host_dns_name(),
>+                    username=user_creds.get_username(),
>+                    password=user_creds.get_password()[:-1],  # invalid pw
>+                    domain=user_creds.get_domain(),
>+                    realm=user_creds.get_realm(),
>+                    workstation=user_creds.get_workstation(),
>+                    dn=str(user_dn))
>+                connect_futures.append(connect_future)
>+
>+                # Wait until the test process indicates it's ready.
>+                self.wait_for_ready(our_pipe, connect_future)
>+
>+            # Take out a transaction.
>+            samdb.transaction_start()
>+            try:
>+                # Inform the test processes that they may proceed.
>+                for our_pipe in our_pipes:
>+                    our_pipe.send_bytes(b'0')
>+
>+                # Wait one second to ensure the test processes hit the
>+                # transaction lock.
>+                time.sleep(1)
>+            except Exception:
>+                samdb.transaction_cancel()
>+                raise
>+
>+            # Commit the local transaction.
>+            samdb.transaction_commit()
>+
>+            lockouts = 0
>+            wrong_passwords = 0
>+            for i, connect_future in enumerate(connect_futures):
>+                result = connect_future.result(timeout=5)
>+                if result == ConnectionResult.LOCKED_OUT:
>+                    lockouts += 1
>+                elif result == ConnectionResult.WRONG_PASSWORD:
>+                    wrong_passwords += 1
>+                else:
>+                    self.fail(f'process {i} gave an unexpected result '
>+                              f'{result}')
>+
>+            self.assertEqual(wrong_passwords, self.lockout_threshold)
>+            self.assertEqual(lockouts, num_attempts - self.lockout_threshold)
>+
>+        # Ensure the account is now locked out.
>+
>+        res = samdb.search(
>+            user_dn, scope=ldb.SCOPE_BASE,
>+            attrs=['badPwdCount',
>+                   'msDS-User-Account-Control-Computed'])
>+        self.assertEqual(1, len(res))
>+
>+        bad_pwd_count = int(res[0].get('badPwdCount', idx=0))
>+        self.assertEqual(self.lockout_threshold, bad_pwd_count)
>+
>+        uac = int(res[0].get('msDS-User-Account-Control-Computed',
>+                             idx=0))
>+        self.assertTrue(uac & dsdb.UF_LOCKOUT)
>+
>+    # Test that logon is possible even while we locally hold a transaction
>+    # lock. This test only works with NTLM authentication; Kerberos
>+    # authentication must take out a transaction to update the logonCount
>+    # attribute, and LDAP and SAMR password changes both take out a transaction
>+    # to effect the password change. NTLM is the only logon method that does
>+    # not require a transaction, and can thus be performed while we're holding
>+    # the lock.
>+    def do_logon_without_transaction(self, connect_fn):
>+        # Create the user account for testing.
>+        user_creds = self.get_cached_creds(account_type=self.AccountType.USER,
>+                                           use_cache=False)
>+        user_dn = user_creds.get_dn()
>+
>+        admin_creds = self.get_admin_creds()
>+        lp = self.get_lp()
>+
>+        # Get a connection to our local SamDB.
>+        samdb = connect_samdb(samdb_url=lp.samdb_url(), lp=lp,
>+                              credentials=admin_creds)
>+        self.assertLocalSamDB(samdb)
>+
>+        password = user_creds.get_password()
>+
>+        # Prepare to connect to the server with a valid password.
>+        with futures.ProcessPoolExecutor(max_workers=1) as executor:
>+            our_pipe, their_pipe = Pipe(duplex=True)
>+            connect_future = executor.submit(
>+                connect_fn,
>+                pipe=their_pipe,
>+                url=f'ldap://{samdb.host_dns_name()}',
>+                hostname=samdb.host_dns_name(),
>+                username=user_creds.get_username(),
>+                password=password,
>+                domain=user_creds.get_domain(),
>+                realm=user_creds.get_realm(),
>+                workstation=user_creds.get_workstation(),
>+                dn=str(user_dn))
>+
>+            # Wait until the test process indicates it's ready.
>+            self.wait_for_ready(our_pipe, connect_future)
>+
>+            # Take out a transaction.
>+            samdb.transaction_start()
>+            try:
>+                # Inform the test process that it may proceed.
>+                our_pipe.send_bytes(b'0')
>+
>+                # The connection should succeed, despite our holding a
>+                # transaction.
>+                result = connect_future.result(timeout=5)
>+                self.assertEqual(result, ConnectionResult.SUCCESS)
>+            except Exception:
>+                samdb.transaction_cancel()
>+                raise
>+
>+            # Commit the local transaction.
>+            samdb.transaction_commit()
>+
>+
>+if __name__ == '__main__':
>+    global_asn1_print = False
>+    global_hexdump = False
>+    import unittest
>+    unittest.main()
>diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py
>index a7e3add60b7..7013ed96306 100644
>--- a/python/samba/tests/krb5/raw_testcase.py
>+++ b/python/samba/tests/krb5/raw_testcase.py
>@@ -50,6 +50,7 @@ from samba.tests.krb5.rfc4120_constants import (
>     AD_IF_RELEVANT,
>     AD_WIN2K_PAC,
>     FX_FAST_ARMOR_AP_REQUEST,
>+    KDC_ERR_CLIENT_REVOKED,
>     KDC_ERR_GENERIC,
>     KDC_ERR_POLICY,
>     KDC_ERR_PREAUTH_FAILED,
>@@ -3489,7 +3490,7 @@ class RawKerberosTest(TestCaseInTempDir):
>                 expected_patypes += (PADATA_ETYPE_INFO2,)
> 
>             if error_code not in (KDC_ERR_PREAUTH_FAILED, KDC_ERR_SKEW,
>-                                  KDC_ERR_POLICY):
>+                                  KDC_ERR_POLICY, KDC_ERR_CLIENT_REVOKED):
>                 if sent_fast:
>                     expected_patypes += (PADATA_ENCRYPTED_CHALLENGE,)
>                 else:
>diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py
>index 7d20093f97d..16527f13593 100644
>--- a/python/samba/tests/krb5/rfc4120_constants.py
>+++ b/python/samba/tests/krb5/rfc4120_constants.py
>@@ -88,6 +88,7 @@ KDC_ERR_POLICY = 12
> KDC_ERR_BADOPTION = 13
> KDC_ERR_ETYPE_NOSUPP = 14
> KDC_ERR_SUMTYPE_NOSUPP = 15
>+KDC_ERR_CLIENT_REVOKED = 18
> KDC_ERR_TGT_REVOKED = 20
> KDC_ERR_PREAUTH_FAILED = 24
> KDC_ERR_PREAUTH_REQUIRED = 25
>diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py
>index 15ff97764e0..e6845b52e1b 100644
>--- a/python/samba/tests/usage.py
>+++ b/python/samba/tests/usage.py
>@@ -113,6 +113,7 @@ EXCLUDE_USAGE = {
>     'python/samba/tests/krb5/protected_users_tests.py',
>     'python/samba/tests/krb5/nt_hash_tests.py',
>     'python/samba/tests/krb5/kpasswd_tests.py',
>+    'python/samba/tests/krb5/lockout_tests.py',
> }
> 
> EXCLUDE_HELP = {
>diff --git a/selftest/flapping.d/ldap-pwd-change-race b/selftest/flapping.d/ldap-pwd-change-race
>new file mode 100644
>index 00000000000..54ed56c1134
>--- /dev/null
>+++ b/selftest/flapping.d/ldap-pwd-change-race
>@@ -0,0 +1,5 @@
>+# This test currently depends on a race. The password_hash dsdb module
>+# relinquishes and immediately reacquires a transaction lock, and another
>+# process may be able to acquire it during the short period of time in which it
>+# is not held.
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ldap_pw_change.ad_dc:local
>diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
>index 4ae27eacb09..ef913b04952 100644
>--- a/selftest/knownfail_heimdal_kdc
>+++ b/selftest/knownfail_heimdal_kdc
>@@ -54,3 +54,13 @@
> ^samba.tests.krb5.protected_users_tests.samba.tests.krb5.protected_users_tests.ProtectedUsersTests.test_proxiable_as_protected.ad_dc
> #
> ^samba.tests.krb5.protected_users_tests.samba.tests.krb5.protected_users_tests.ProtectedUsersTests.test_samr_change_password_protected.ad_dc
>+#
>+# Lockout tests
>+#
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_ntlm.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_ntlm.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_samr.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ntlm.ad_dc:local
>diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc
>index 8601da3d79a..6ece892767a 100644
>--- a/selftest/knownfail_mit_kdc
>+++ b/selftest/knownfail_mit_kdc
>@@ -439,3 +439,17 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
> ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
> ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
> ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
>+#
>+# Lockout tests
>+#
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_ntlm.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_ntlm.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_samr.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ntlm.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_transaction_bad_pwd_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_transaction_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_transaction_rename_kdc.ad_dc:local
>+^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_logon_kdc.ad_dc:local
>diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
>index df712ec0020..97320dacbe8 100755
>--- a/source4/selftest/tests.py
>+++ b/source4/selftest/tests.py
>@@ -1726,6 +1726,10 @@ planoldpythontestsuite(
>     'ad_dc',
>     'samba.tests.krb5.kpasswd_tests',
>     environ=krb5_environ)
>+planoldpythontestsuite(
>+    'ad_dc:local',
>+    'samba.tests.krb5.lockout_tests',
>+    environ=krb5_environ)
> 
> for env in [
>         'vampire_dc',
>-- 
>2.35.0
>
>
>From 9f727e63e93ce37ffb1f17e72789b9a40c55c86e Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 30 Mar 2021 10:51:26 +1300
>Subject: [PATCH 10/40] CVE-2021-20251 s4-rpc_server: Use
> authsam_search_account() to find the user
>
>This helps the bad password and audit log handling code as it
>allows assumptions to be made about the attributes found in
>the variable "msg", such as that DSDB_SEARCH_SHOW_EXTENDED_DN
>was used.
>
>This ensures we can re-search on the DN via the embedded GUID,
>which in in turn rename-proof.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/rpc_server/samr/samr_password.c | 40 +++++++++++--------------
> 1 file changed, 17 insertions(+), 23 deletions(-)
>
>diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
>index da22ab7484b..09d7501d474 100644
>--- a/source4/rpc_server/samr/samr_password.c
>+++ b/source4/rpc_server/samr/samr_password.c
>@@ -312,13 +312,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 	struct ldb_context *sam_ctx = NULL;
> 	struct ldb_dn *user_dn = NULL;
> 	int ret;
>-	struct ldb_result *res = NULL;
>-	const char * const attrs[] = { "unicodePwd", "dBCSPwd",
>-				       "userAccountControl",
>-				       "msDS-ResultantPSO",
>-				       "msDS-User-Account-Control-Computed",
>-				       "badPwdCount", "badPasswordTime",
>-				       "objectSid", NULL };
>+	struct ldb_message *msg = NULL;
> 	struct samr_Password *nt_pwd;
> 	struct samr_DomInfo1 *dominfo = NULL;
> 	struct userPwdChangeFailureInformation *reject = NULL;
>@@ -356,26 +350,26 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 		return NT_STATUS_INVALID_SYSTEM_SERVICE;
> 	}
> 
>-	/* we need the users dn and the domain dn (derived from the
>-	   user SID). We also need the current lm and nt password hashes
>-	   in order to decrypt the incoming passwords */
>-	ret = dsdb_search(sam_ctx, mem_ctx, &res,
>-			  ldb_get_default_basedn(sam_ctx),
>-			  LDB_SCOPE_SUBTREE, attrs,
>-			  DSDB_SEARCH_SHOW_EXTENDED_DN,
>-			  "(&(sAMAccountName=%s)(objectclass=user))",
>-			  ldb_binary_encode_string(mem_ctx, r->in.account->string));
>-	if (ret != LDB_SUCCESS || res->count != 1) {
>-		status = NT_STATUS_NO_SUCH_USER; /* Converted to WRONG_PASSWORD below */
>+	/*
>+	 * We use authsam_search_account() to be consistent with the
>+	 * other callers in the bad password and audit log handling
>+	 * systems.  It ensures we get DSDB_SEARCH_SHOW_EXTENDED_DN.
>+	 */
>+	status = authsam_search_account(mem_ctx,
>+					sam_ctx,
>+					r->in.account->string,
>+					ldb_get_default_basedn(sam_ctx),
>+					&msg);
>+	if (!NT_STATUS_IS_OK(status)) {
> 		goto failed;
> 	}
> 
>-	user_dn = res->msgs[0]->dn;
>-	user_samAccountName = ldb_msg_find_attr_as_string(res->msgs[0], "samAccountName", NULL);
>-	user_objectSid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
>+	user_dn = msg->dn;
>+	user_samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
>+	user_objectSid = samdb_result_dom_sid(mem_ctx, msg, "objectSid");
> 
> 	status = samdb_result_passwords(mem_ctx, lp_ctx,
>-					res->msgs[0], &nt_pwd);
>+					msg, &nt_pwd);
> 	if (!NT_STATUS_IS_OK(status) ) {
> 		goto failed;
> 	}
>@@ -491,7 +485,7 @@ failed:
> 
> 	/* Only update the badPwdCount if we found the user */
> 	if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
>-		authsam_update_bad_pwd_count(sam_ctx, res->msgs[0], ldb_get_default_basedn(sam_ctx));
>+		authsam_update_bad_pwd_count(sam_ctx, msg, ldb_get_default_basedn(sam_ctx));
> 	} else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
> 		/* Don't give the game away:  (don't allow anonymous users to prove the existence of usernames) */
> 		status = NT_STATUS_WRONG_PASSWORD;
>-- 
>2.35.0
>
>
>From 77a6f20b8c55dd5883c384884850e09ea4215412 Mon Sep 17 00:00:00 2001
>From: Gary Lockyer <gary@catalyst.net.nz>
>Date: Tue, 16 Mar 2021 10:52:58 +1300
>Subject: [PATCH 11/40] CVE-2021-20251 auth4: split
> samdb_result_msds_LockoutObservationWindow() out
>
>samdb_result_msds_LockoutObservationWindow() is split out of
>samdb_result_effective_badPwdCount()
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/dsdb/common/util.c | 45 +++++++++++++++++++++++++++-----------
> 1 file changed, 32 insertions(+), 13 deletions(-)
>
>diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
>index 88b05555b96..451495fe4c5 100644
>--- a/source4/dsdb/common/util.c
>+++ b/source4/dsdb/common/util.c
>@@ -5363,9 +5363,9 @@ int dsdb_create_partial_replica_NC(struct ldb_context *ldb,  struct ldb_dn *dn)
>  * This also requires that the domain_msg have (if present):
>  *  - lockOutObservationWindow
>  */
>-static int dsdb_effective_badPwdCount(const struct ldb_message *user_msg,
>-				      int64_t lockOutObservationWindow,
>-				      NTTIME now)
>+int dsdb_effective_badPwdCount(const struct ldb_message *user_msg,
>+			       int64_t lockOutObservationWindow,
>+			       NTTIME now)
> {
> 	int64_t badPasswordTime;
> 	badPasswordTime = ldb_msg_find_attr_as_int64(user_msg, "badPasswordTime", 0);
>@@ -5412,25 +5412,24 @@ static struct ldb_result *lookup_user_pso(struct ldb_context *sam_ldb,
> }
> 
> /*
>- * Return the effective badPwdCount
>+ * Return the msDS-LockoutObservationWindow for a user message
>  *
>  * This requires that the user_msg have (if present):
>- *  - badPasswordTime
>- *  - badPwdCount
>  *  - msDS-ResultantPSO
>  */
>-int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb,
>-				       TALLOC_CTX *mem_ctx,
>-				       struct ldb_dn *domain_dn,
>-				       const struct ldb_message *user_msg)
>+int64_t samdb_result_msds_LockoutObservationWindow(
>+	struct ldb_context *sam_ldb,
>+	TALLOC_CTX *mem_ctx,
>+	struct ldb_dn *domain_dn,
>+	const struct ldb_message *user_msg)
> {
>-	struct timeval tv_now = timeval_current();
>-	NTTIME now = timeval_to_nttime(&tv_now);
> 	int64_t lockOutObservationWindow;
> 	struct ldb_result *res = NULL;
> 	const char *attrs[] = { "msDS-LockoutObservationWindow",
> 				NULL };
>-
>+	if (domain_dn == NULL) {
>+		smb_panic("domain dn is NULL");
>+	}
> 	res = lookup_user_pso(sam_ldb, mem_ctx, user_msg, attrs);
> 
> 	if (res != NULL) {
>@@ -5446,7 +5445,27 @@ int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb,
> 			 samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn,
> 					    "lockOutObservationWindow", NULL);
> 	}
>+	return lockOutObservationWindow;
>+}
> 
>+/*
>+ * Return the effective badPwdCount
>+ *
>+ * This requires that the user_msg have (if present):
>+ *  - badPasswordTime
>+ *  - badPwdCount
>+ *  - msDS-ResultantPSO
>+ */
>+int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb,
>+				       TALLOC_CTX *mem_ctx,
>+				       struct ldb_dn *domain_dn,
>+				       const struct ldb_message *user_msg)
>+{
>+	struct timeval tv_now = timeval_current();
>+	NTTIME now = timeval_to_nttime(&tv_now);
>+	int64_t lockOutObservationWindow =
>+		samdb_result_msds_LockoutObservationWindow(
>+			sam_ldb, mem_ctx, domain_dn, user_msg);
> 	return dsdb_effective_badPwdCount(user_msg, lockOutObservationWindow, now);
> }
> 
>-- 
>2.35.0
>
>
>From 1a5fa77ee54e2d0236f86f1730e1209d9bf7facb Mon Sep 17 00:00:00 2001
>From: Gary Lockyer <gary@catalyst.net.nz>
>Date: Wed, 27 Jan 2021 14:24:58 +1300
>Subject: [PATCH 12/40] CVE-2021-20251 s4 auth: Prepare to make bad password
> count increment atomic
>
>To ensure that the bad password count is incremented atomically,
>and that the successful logon accounting data is updated atomically,
>without always opening a transaction, we will need to make a note
>of all bad and successful passwords in a side-DB outside the
>transaction lock.
>
>This provides the functions needed for that and hooks them in
>(future commits will handle errors and use the results).
>
>Based on patches by Gary Lockyer <gary@catalyst.net.nz>
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/auth/sam.c | 187 +++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 187 insertions(+)
>
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index 420b165446a..33f2c561805 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -31,6 +31,8 @@
> #include "libcli/ldap/ldap_ndr.h"
> #include "param/param.h"
> #include "librpc/gen_ndr/ndr_winbind_c.h"
>+#include "lib/dbwrap/dbwrap.h"
>+#include "cluster/cluster.h"
> 
> #undef DBGC_CLASS
> #define DBGC_CLASS DBGC_AUTH
>@@ -825,6 +827,177 @@ static int authsam_get_user_pso(struct ldb_context *sam_ctx,
> 	return LDB_SUCCESS;
> }
> 
>+static struct db_context *authsam_get_bad_password_db(
>+	TALLOC_CTX *mem_ctx,
>+	struct ldb_context *sam_ctx)
>+{
>+	struct loadparm_context *lp_ctx = NULL;
>+	const char *db_name = "bad_password";
>+	struct db_context *db_ctx =  NULL;
>+
>+	lp_ctx = ldb_get_opaque(sam_ctx, "loadparm");
>+	if (lp_ctx == NULL) {
>+		DBG_ERR("Unable to get loadparm_context\n");
>+		return NULL;
>+	}
>+
>+	db_ctx = cluster_db_tmp_open(mem_ctx, lp_ctx, db_name, TDB_DEFAULT);
>+	if (db_ctx == NULL) {
>+		DBG_ERR("Unable to open bad password attempts database\n");
>+		return NULL;
>+	}
>+	return db_ctx;
>+}
>+
>+static NTSTATUS get_object_sid_as_tdb_data(
>+	TALLOC_CTX *mem_ctx,
>+	const struct ldb_message *msg,
>+	struct dom_sid_buf *buf,
>+	TDB_DATA *key)
>+{
>+	struct dom_sid *objectsid = NULL;
>+
>+	/*
>+	 * Convert the objectSID to a human readable form to
>+	 * make debugging easier
>+	 */
>+	objectsid = samdb_result_dom_sid(mem_ctx, msg, "objectSID");
>+	if (objectsid == NULL) {
>+		DBG_ERR("Unable to extract objectSID\n");
>+		return NT_STATUS_INTERNAL_ERROR;
>+	}
>+	dom_sid_str_buf(objectsid, buf);
>+	key->dptr = (unsigned char *)buf->buf;
>+	key->dsize = strlen(buf->buf);
>+
>+	talloc_free(objectsid);
>+
>+	return NT_STATUS_OK;
>+}
>+
>+/*
>+ * Add the users objectSID to the bad password attempt database
>+ * to indicate that last authentication failed due to a bad password
>+ */
>+static NTSTATUS authsam_set_bad_password_indicator(
>+	struct ldb_context *sam_ctx,
>+	TALLOC_CTX *mem_ctx,
>+	const struct ldb_message *msg)
>+{
>+	NTSTATUS status = NT_STATUS_OK;
>+	struct dom_sid_buf buf;
>+	TDB_DATA key = {0};
>+	TDB_DATA value = {0};
>+	struct db_context *db = NULL;
>+
>+	TALLOC_CTX *ctx = talloc_new(mem_ctx);
>+	if (ctx == NULL) {
>+		return NT_STATUS_NO_MEMORY;
>+	}
>+
>+	db = authsam_get_bad_password_db(ctx, sam_ctx);
>+	if (db == NULL) {
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto exit;
>+	}
>+
>+	status = get_object_sid_as_tdb_data(ctx, msg, &buf, &key);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		goto exit;
>+	}
>+
>+	status = dbwrap_store(db, key, value, 0);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		DBG_ERR("Unable to store bad password indicator\n");
>+	}
>+exit:
>+	talloc_free(ctx);
>+	return status;
>+}
>+
>+/*
>+ * see if the users objectSID is in the bad password attempt database
>+ */
>+static NTSTATUS authsam_check_bad_password_indicator(
>+	struct ldb_context *sam_ctx,
>+	TALLOC_CTX *mem_ctx,
>+	bool *exists,
>+	const struct ldb_message *msg)
>+{
>+	NTSTATUS status = NT_STATUS_OK;
>+	struct dom_sid_buf buf;
>+	TDB_DATA key = {0};
>+	struct db_context *db = NULL;
>+
>+	TALLOC_CTX *ctx = talloc_new(mem_ctx);
>+	if (ctx == NULL) {
>+		return NT_STATUS_NO_MEMORY;
>+	}
>+
>+	db = authsam_get_bad_password_db(ctx, sam_ctx);
>+	if (db == NULL) {
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto exit;
>+	}
>+
>+	status = get_object_sid_as_tdb_data(ctx, msg, &buf, &key);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		goto exit;
>+	}
>+
>+	*exists = dbwrap_exists(db, key);
>+exit:
>+	talloc_free(ctx);
>+	return status;
>+}
>+
>+/*
>+ * Remove the users objectSID to the bad password attempt database
>+ * to indicate that last authentication succeeded.
>+ */
>+static NTSTATUS authsam_clear_bad_password_indicator(
>+	struct ldb_context *sam_ctx,
>+	TALLOC_CTX *mem_ctx,
>+	const struct ldb_message *msg)
>+{
>+	NTSTATUS status = NT_STATUS_OK;
>+	struct dom_sid_buf buf;
>+	TDB_DATA key = {0};
>+	struct db_context *db = NULL;
>+
>+	TALLOC_CTX *ctx = talloc_new(mem_ctx);
>+	if (ctx == NULL) {
>+		return NT_STATUS_NO_MEMORY;
>+	}
>+
>+	db = authsam_get_bad_password_db(ctx, sam_ctx);
>+	if (db == NULL) {
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto exit;
>+	}
>+
>+	status = get_object_sid_as_tdb_data(ctx, msg, &buf, &key);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		goto exit;
>+	}
>+
>+	status = dbwrap_delete(db, key);
>+	if (NT_STATUS_EQUAL(NT_STATUS_NOT_FOUND, status)) {
>+		/*
>+		 * Ok there was no bad password indicator this is expected
>+		 */
>+		status = NT_STATUS_OK;
>+	}
>+	if (NT_STATUS_IS_ERR(status)) {
>+		DBG_ERR("Unable to delete bad password indicator, %s %s\n",
>+			nt_errstr(status),
>+			get_friendly_nt_error_msg(status));
>+	}
>+exit:
>+	talloc_free(ctx);
>+	return status;
>+}
>+
> NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
> 				      struct ldb_message *msg,
> 				      struct ldb_dn *domain_dn)
>@@ -894,6 +1067,10 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
> 
> 		ret = dsdb_autotransaction_request(sam_ctx, req);
> 		talloc_free(req);
>+
>+		status = authsam_set_bad_password_indicator(
>+			sam_ctx, mem_ctx, msg);
>+		/* Failure is ignored for now */
> 	}
> 
> done:
>@@ -1057,12 +1234,19 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 	NTTIME now;
> 	NTTIME lastLogonTimestamp;
> 	bool am_rodc = false;
>+	bool need_db_reread;
> 
> 	mem_ctx = talloc_new(msg);
> 	if (mem_ctx == NULL) {
> 		return NT_STATUS_NO_MEMORY;
> 	}
> 
>+	status = authsam_check_bad_password_indicator(
>+		sam_ctx, mem_ctx, &need_db_reread, msg);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		return status;
>+	}
>+
> 	lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0);
> 	dbBadPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0);
> 	if (interactive_or_kerberos) {
>@@ -1197,6 +1381,9 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		talloc_free(req);
> 	}
> 
>+	status = authsam_clear_bad_password_indicator(sam_ctx, mem_ctx, msg);
>+	/* Failure is ignored for now */
>+
> done:
> 	if (ret != LDB_SUCCESS) {
> 		DEBUG(0, ("Failed to set badPwdCount and lockoutTime "
>-- 
>2.35.0
>
>
>From 1ad82649e162d6cac882ff7cf7e7b5f437767f85 Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 30 Mar 2021 17:57:10 +1300
>Subject: [PATCH 13/40] CVE-2021-20251 auth4: Reread the user record if a bad
> password is noticed.
>
>As is, this is pointless, as we need a transaction to make this
>any less of a race, but this provides the steps towards that goal.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/auth/sam.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 82 insertions(+)
>
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index 33f2c561805..3b1bb8d7dc1 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -827,6 +827,68 @@ static int authsam_get_user_pso(struct ldb_context *sam_ctx,
> 	return LDB_SUCCESS;
> }
> 
>+/*
>+ * Re-read the bad password and successful logon data for a user.
>+ *
>+ * the passed user record, must contain the "objectGUID", as this is
>+ * used as the re-read key
>+ */
>+NTSTATUS authsam_reread_user_logon_data(
>+	struct ldb_context *sam_ctx,
>+	TALLOC_CTX *mem_ctx,
>+	const struct ldb_message *user_msg,
>+	struct ldb_message **current)
>+{
>+	const struct ldb_val *v = NULL;
>+	struct ldb_result *res = NULL;
>+	uint16_t acct_flags = 0;
>+	const char *attr_name = "msDS-User-Account-Control-Computed";
>+
>+	int ret;
>+
>+	/*
>+	 * Re-read the account details, using the GUID in case the DN
>+	 * is being changed (this is automatic in LDB because the
>+	 * original search also used DSDB_SEARCH_SHOW_EXTENDED_DN)
>+	 *
>+	 * We re read all the attributes in user_attrs, rather than using a
>+	 * subset to ensure that we can reuse existing validation code.
>+	 */
>+	ret = dsdb_search_dn(sam_ctx,
>+			     mem_ctx,
>+			     &res,
>+			     user_msg->dn,
>+			     user_attrs,
>+			     DSDB_SEARCH_SHOW_EXTENDED_DN);
>+	if (ret != LDB_SUCCESS) {
>+		DBG_ERR("Unable to re-read account control data for %s\n",
>+			ldb_dn_get_linearized(user_msg->dn));
>+		return NT_STATUS_INTERNAL_ERROR;
>+	}
>+
>+	/*
>+	 * Ensure the account has not been locked out by another request
>+	 */
>+	v = ldb_msg_find_ldb_val(res->msgs[0], attr_name);
>+	if (v == NULL || v->data == NULL) {
>+		DBG_ERR("No %s attribute for %s\n",
>+			attr_name,
>+			ldb_dn_get_linearized(user_msg->dn));
>+		TALLOC_FREE(res);
>+		return NT_STATUS_INTERNAL_ERROR;
>+	}
>+	acct_flags = samdb_result_acct_flags(res->msgs[0], attr_name);
>+	if (acct_flags & ACB_AUTOLOCK) {
>+		DBG_WARNING(
>+			"Account for user %s was locked out.\n",
>+			ldb_dn_get_linearized(user_msg->dn));
>+		TALLOC_FREE(res);
>+		return NT_STATUS_ACCOUNT_LOCKED_OUT;
>+	}
>+	*current = res->msgs[0];
>+	return NT_STATUS_OK;
>+}
>+
> static struct db_context *authsam_get_bad_password_db(
> 	TALLOC_CTX *mem_ctx,
> 	struct ldb_context *sam_ctx)
>@@ -1247,6 +1309,26 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		return status;
> 	}
> 
>+	if (need_db_reread) {
>+		struct ldb_message *current = NULL;
>+
>+		/*
>+		 * Re-read the account details, using the GUID
>+		 * embedded in DN so this is safe against a race where
>+		 * it is being renamed.
>+		 */
>+		status = authsam_reread_user_logon_data(
>+			sam_ctx, mem_ctx, msg, &current);
>+		if (!NT_STATUS_IS_OK(status)) {
>+			/*
>+			 * The re-read can return account locked out, as well
>+			 * as an internal error
>+			 */
>+			return status;
>+		}
>+		msg = current;
>+	}
>+
> 	lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0);
> 	dbBadPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0);
> 	if (interactive_or_kerberos) {
>-- 
>2.35.0
>
>
>From eacf0c00bf59d28cfc32080dec1d0b7430ccf239 Mon Sep 17 00:00:00 2001
>From: Gary Lockyer <gary@catalyst.net.nz>
>Date: Tue, 9 Feb 2021 11:59:05 +1300
>Subject: [PATCH 14/40] CVE-2021-20251 s4 auth test: Unit tests for
> source4/auth/sam.c
>
>cmocka unit tests for the authsam_reread_user_logon_data in
>source4/auth/sam.c
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
>---
> selftest/knownfail.d/auth-sam |   25 +
> selftest/tests.py             |    2 +
> source4/auth/tests/sam.c      | 2746 +++++++++++++++++++++++++++++++++
> source4/auth/wscript_build    |   11 +
> 4 files changed, 2784 insertions(+)
> create mode 100644 selftest/knownfail.d/auth-sam
> create mode 100644 source4/auth/tests/sam.c
>
>diff --git a/selftest/knownfail.d/auth-sam b/selftest/knownfail.d/auth-sam
>new file mode 100644
>index 00000000000..e87e43d509b
>--- /dev/null
>+++ b/selftest/knownfail.d/auth-sam
>@@ -0,0 +1,25 @@
>+^samba.unittests.auth.sam.test_reread_account_not_locked.none
>+^samba.unittests.auth.sam.test_success_accounting_add_control_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_build_mod_req_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_commit_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_ldb_msg_new_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_ldb_request_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_ldb_wait_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_reread_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_rollback_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_samdb_rodc_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_spurious_bad_pwd_indicator.none
>+^samba.unittests.auth.sam.test_success_accounting_start_txn_failed.none
>+^samba.unittests.auth.sam.test_success_accounting_update_lastlogon_failed.none
>+^samba.unittests.auth.sam.test_update_bad_add_control_failed.none
>+^samba.unittests.auth.sam.test_update_bad_build_mod_request_failed.none
>+^samba.unittests.auth.sam.test_update_bad_commit_failed.none
>+^samba.unittests.auth.sam.test_update_bad_get_pso_failed.none
>+^samba.unittests.auth.sam.test_update_bad_ldb_request_failed.none
>+^samba.unittests.auth.sam.test_update_bad_ldb_wait_failed.none
>+^samba.unittests.auth.sam.test_update_bad_no_update_required.none
>+^samba.unittests.auth.sam.test_update_bad_reread_failed.none
>+^samba.unittests.auth.sam.test_update_bad_reread_locked_out.none
>+^samba.unittests.auth.sam.test_update_bad_start_txn_failed.none
>+^samba.unittests.auth.sam.test_update_bad_txn_cancel_failed.none
>+^samba.unittests.auth.sam.test_update_bad_update_count_failed.none
>diff --git a/selftest/tests.py b/selftest/tests.py
>index a3780da0615..b5e418cca3b 100644
>--- a/selftest/tests.py
>+++ b/selftest/tests.py
>@@ -446,6 +446,8 @@ plantestsuite("samba.unittests.test_registry_regfio", "none",
>               [os.path.join(bindir(), "default/source3/test_registry_regfio")])
> plantestsuite("samba.unittests.test_oLschema2ldif", "none",
>               [os.path.join(bindir(), "default/source4/utils/oLschema2ldif/test_oLschema2ldif")])
>+plantestsuite("samba.unittests.auth.sam", "none",
>+              [os.path.join(bindir(), "test_auth_sam")])
> if with_elasticsearch_backend:
>     plantestsuite("samba.unittests.mdsparser_es", "none",
>                   [os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration])
>diff --git a/source4/auth/tests/sam.c b/source4/auth/tests/sam.c
>new file mode 100644
>index 00000000000..56501f3d4cc
>--- /dev/null
>+++ b/source4/auth/tests/sam.c
>@@ -0,0 +1,2746 @@
>+/*
>+ * Unit tests for source4/auth/sam.c
>+ *
>+ * Copyright (C) Catalyst.NET Ltd 2021
>+ *
>+ * This program is free software; you can redistribute it and/or modify
>+ * it under the terms of the GNU General Public License as published by
>+ * the Free Software Foundation; either version 3 of the License, or
>+ * (at your option) any later version.
>+ *
>+ * This program is distributed in the hope that it will be useful,
>+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
>+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
>+ * GNU General Public License for more details.
>+ *
>+ * You should have received a copy of the GNU General Public License
>+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
>+ *
>+ */
>+
>+/*
>+ * from cmocka.c:
>+ * These headers or their equivalents should be included prior to
>+ * including
>+ * this header file.
>+ *
>+ * #include <stdarg.h>
>+ * #include <stddef.h>
>+ * #include <setjmp.h>
>+ *
>+ * This allows test applications to use custom definitions of C standard
>+ * library functions and types.
>+ *
>+ */
>+
>+#include <time.h>
>+#include <stdlib.h>
>+#include <stdarg.h>
>+#include <stddef.h>
>+#include <setjmp.h>
>+#include <stdint.h>
>+#include <cmocka.h>
>+
>+#include "includes.h"
>+#include "auth/sam.c"
>+#include "ldb.h"
>+#include "ntstatus.h"
>+#include "librpc/gen_ndr/ndr_security.h"
>+
>+/*****************************************************************************
>+ * wrapped functions
>+ *
>+ *****************************************************************************/
>+int __wrap_samdb_msg_add_int64(
>+	struct ldb_context *sam_ldb,
>+	TALLOC_CTX *mem_ctx,
>+	struct ldb_message *msg,
>+	const char *attr_name,
>+	int64_t v);
>+int __real_samdb_msg_add_int64(
>+	struct ldb_context *sam_ldb,
>+	TALLOC_CTX *mem_ctx,
>+	struct ldb_message *msg,
>+	const char *attr_name,
>+	int64_t v);
>+int __wrap_samdb_msg_add_int64(
>+	struct ldb_context *sam_ldb,
>+	TALLOC_CTX *mem_ctx,
>+	struct ldb_message *msg,
>+	const char *attr_name,
>+	int64_t v)
>+{
>+
>+	int ret;
>+	ret = (int)mock();
>+	if (ret != LDB_SUCCESS) {
>+		return ret;
>+	}
>+	return __real_samdb_msg_add_int64(sam_ldb, mem_ctx, msg, attr_name, v);
>+}
>+/*****************************************************************************
>+ * Mock implementations
>+ *****************************************************************************/
>+
>+static int check_dn(const LargestIntegralType left_value,
>+		    const LargestIntegralType right_value)
>+{
>+	/*
>+	 *We have to cast away const so we can get the linearized form with
>+	 * ldb_dn_get_extended_linearized().
>+	 */
>+	struct ldb_dn *left_dn = (void *)left_value;
>+	struct ldb_dn *right_dn = (void *)right_value;
>+	char *left_dn_string = NULL;
>+	char *right_dn_string = NULL;
>+	bool ok;
>+
>+	if (left_dn == NULL && right_dn == NULL) {
>+		return true;
>+	}
>+
>+	if (left_dn != NULL) {
>+		left_dn_string = ldb_dn_get_extended_linearized(NULL, left_dn, 1);
>+		assert_non_null(left_dn_string);
>+	}
>+
>+	if (right_dn != NULL) {
>+		right_dn_string = ldb_dn_get_extended_linearized(NULL, right_dn, 1);
>+		assert_non_null(right_dn_string);
>+	}
>+
>+	if (left_dn_string == NULL || right_dn_string == NULL) {
>+		ok = false;
>+		print_error("\"%s\" != \"%s\"\n",
>+			    left_dn_string != NULL ? left_dn_string : "<NULL>",
>+			    right_dn_string != NULL ? right_dn_string : "<NULL>");
>+	} else {
>+		ok = (strcmp(left_dn_string, right_dn_string) == 0);
>+		if (!ok) {
>+			print_error("\"%s\" != \"%s\"\n",
>+				    left_dn_string,
>+				    right_dn_string);
>+		}
>+
>+	}
>+
>+	TALLOC_FREE(right_dn_string);
>+	TALLOC_FREE(left_dn_string);
>+
>+	return ok;
>+}
>+
>+int __wrap_dsdb_search_dn(struct ldb_context *ldb,
>+			  TALLOC_CTX *mem_ctx,
>+			  struct ldb_result **_result,
>+			  struct ldb_dn *basedn,
>+			  const char * const *attrs,
>+			  uint32_t dsdb_flags);
>+int __wrap_dsdb_search_dn(struct ldb_context *ldb,
>+			  TALLOC_CTX *mem_ctx,
>+			  struct ldb_result **_result,
>+			  struct ldb_dn *basedn,
>+			  const char * const *attrs,
>+			  uint32_t dsdb_flags)
>+{
>+	check_expected(basedn);
>+
>+	*_result = talloc_steal(mem_ctx, mock_ptr_type(struct ldb_result *));
>+
>+	return mock();
>+}
>+
>+int ldb_transaction_start_ret = LDB_SUCCESS;
>+bool in_transaction = false;
>+int ldb_transaction_start(struct ldb_context *ldb) {
>+	assert_false(in_transaction);
>+	if (ldb_transaction_start_ret == LDB_SUCCESS) {
>+		in_transaction = true;
>+	}
>+	return ldb_transaction_start_ret;
>+}
>+
>+int ldb_transaction_cancel_ret = LDB_SUCCESS;
>+bool transaction_cancelled = false;
>+int ldb_transaction_cancel(struct ldb_context *ldb) {
>+	assert_true(in_transaction);
>+	if (ldb_transaction_cancel_ret == LDB_SUCCESS) {
>+		in_transaction = false;
>+		transaction_cancelled = true;
>+	}
>+	return ldb_transaction_cancel_ret;
>+}
>+
>+int ldb_transaction_commit_ret = LDB_SUCCESS;
>+bool transaction_committed = false;
>+int ldb_transaction_commit(struct ldb_context *ldb) {
>+	assert_true(in_transaction);
>+	if (ldb_transaction_commit_ret == LDB_SUCCESS) {
>+		in_transaction = false;
>+		transaction_committed = true;
>+	}
>+	return ldb_transaction_commit_ret;
>+}
>+
>+NTSTATUS dsdb_update_bad_pwd_count_ret = NT_STATUS_OK;
>+struct ldb_message *dsdb_update_bad_pwd_count_res = NULL;
>+NTSTATUS dsdb_update_bad_pwd_count(TALLOC_CTX *mem_ctx,
>+				   struct ldb_context *sam_ctx,
>+				   struct ldb_message *user_msg,
>+				   struct ldb_message *domain_msg,
>+				   struct ldb_message *pso_msg,
>+				   struct ldb_message **_mod_msg) {
>+
>+	*_mod_msg = talloc_move(mem_ctx, &dsdb_update_bad_pwd_count_res);
>+	return dsdb_update_bad_pwd_count_ret;
>+}
>+
>+int ldb_build_mod_req_ret = LDB_SUCCESS;
>+struct ldb_request *ldb_build_mod_req_res = NULL;
>+int ldb_build_mod_req(struct ldb_request **ret_req,
>+			struct ldb_context *ldb,
>+			TALLOC_CTX *mem_ctx,
>+			const struct ldb_message *message,
>+			struct ldb_control **controls,
>+			void *context,
>+			ldb_request_callback_t callback,
>+			struct ldb_request *parent)
>+{
>+	*ret_req = talloc_move(mem_ctx, &ldb_build_mod_req_res);
>+	return ldb_build_mod_req_ret;
>+}
>+
>+int ldb_request_add_control_ret = LDB_SUCCESS;
>+int ldb_request_add_control(struct ldb_request *req,
>+			    const char *oid,
>+			    bool critical,
>+			    void *data)
>+{
>+	return ldb_request_add_control_ret;
>+}
>+
>+int ldb_request_ret = LDB_SUCCESS;
>+int ldb_request(struct ldb_context *ldb,
>+		struct ldb_request *req)
>+{
>+	return ldb_request_ret;
>+}
>+
>+int ldb_wait_ret = LDB_SUCCESS;
>+int ldb_wait(struct ldb_handle *handle,
>+	     enum ldb_wait_type type)
>+{
>+	return ldb_wait_ret;
>+}
>+bool ldb_msg_new_fail = false;
>+struct ldb_message *ldb_msg_new(TALLOC_CTX *mem_ctx)
>+{
>+	if (ldb_msg_new_fail) {
>+		return NULL;
>+	} else {
>+		return talloc_zero(mem_ctx, struct ldb_message);
>+	}
>+}
>+
>+int samdb_rodc_ret = LDB_SUCCESS;
>+bool samdb_rodc_res = false;
>+
>+int samdb_rodc(
>+	struct ldb_context *sam_ctx,
>+	bool *am_rodc)
>+{
>+
>+	*am_rodc = samdb_rodc_res;
>+	return samdb_rodc_ret;
>+}
>+
>+struct loadparm_context *ldb_get_opaque_ret = NULL;
>+void *ldb_get_opaque(struct ldb_context *ldb, const char *name)
>+{
>+	return ldb_get_opaque_ret;
>+}
>+
>+struct db_context {};
>+struct db_context *cluster_db_tmp_open_ret = NULL;
>+struct db_context *cluster_db_tmp_open(
>+	TALLOC_CTX *mem_ctx,
>+	struct loadparm_context *lp_ctx,
>+	const char *dbbase,
>+	int flags)
>+{
>+	return cluster_db_tmp_open_ret;
>+}
>+
>+NTSTATUS dbwrap_store_ret = NT_STATUS_OK;
>+NTSTATUS dbwrap_store(struct db_context *db, TDB_DATA key,
>+		      TDB_DATA data, int flags)
>+{
>+	return dbwrap_store_ret;
>+}
>+bool dbwrap_exists_ret = true;
>+
>+bool dbwrap_exists(struct db_context *db, TDB_DATA key)
>+{
>+	return dbwrap_exists_ret;
>+}
>+
>+NTSTATUS dbwrap_delete_ret = NT_STATUS_OK;
>+NTSTATUS dbwrap_delete(struct db_context *db, TDB_DATA key)
>+{
>+	return dbwrap_delete_ret;
>+}
>+
>+/*
>+ * Set the globals used by the mocked functions to a known and consistent state
>+ *
>+ */
>+static void init_mock_results(TALLOC_CTX *mem_ctx)
>+{
>+	ldb_transaction_start_ret = LDB_SUCCESS;
>+	in_transaction = false;
>+
>+	ldb_transaction_cancel_ret = LDB_SUCCESS;
>+	transaction_cancelled = false;
>+
>+	ldb_transaction_commit_ret = LDB_SUCCESS;
>+	transaction_committed = false;
>+
>+	dsdb_update_bad_pwd_count_ret = NT_STATUS_OK;
>+	dsdb_update_bad_pwd_count_res = NULL;
>+
>+	ldb_build_mod_req_ret = LDB_SUCCESS;
>+	ldb_build_mod_req_res = NULL;
>+
>+	ldb_request_add_control_ret = LDB_SUCCESS;
>+	ldb_request_ret = LDB_SUCCESS;
>+	ldb_wait_ret = LDB_SUCCESS;
>+
>+	ldb_msg_new_fail = false;
>+
>+	samdb_rodc_ret = LDB_SUCCESS;
>+	samdb_rodc_res = false;
>+
>+	ldb_get_opaque_ret = loadparm_init(mem_ctx);
>+
>+	cluster_db_tmp_open_ret = talloc_zero(mem_ctx, struct db_context);
>+
>+	dbwrap_store_ret = NT_STATUS_OK;
>+
>+	dbwrap_exists_ret = true;
>+
>+	dbwrap_delete_ret = NT_STATUS_OK;
>+
>+}
>+
>+/*****************************************************************************
>+ * Unit test set up and tear down
>+ *****************************************************************************/
>+struct context {
>+};
>+
>+static int setup(void **state) {
>+	struct context *ctx = talloc_zero(NULL, struct context);
>+	init_mock_results(ctx);
>+
>+	*state = ctx;
>+	return 0;
>+}
>+
>+static int teardown(void **state) {
>+	struct context *ctx = *state;
>+	TALLOC_FREE(ctx);
>+	return 0;
>+}
>+
>+/******************************************************************************
>+ * Helper functions
>+ ******************************************************************************/
>+
>+/*
>+ * Build the "Original" user details record, i.e. the user being
>+ * authenticated
>+ */
>+static struct ldb_message* create_message(TALLOC_CTX *ctx)
>+{
>+
>+	int ret;
>+	struct timeval tv_now = timeval_current();
>+	NTTIME now = timeval_to_nttime(&tv_now);
>+
>+	struct ldb_message* msg = ldb_msg_new(ctx);
>+
>+	assert_non_null(msg);
>+	ret = samdb_msg_add_int(ctx, msg, msg, "badPwdCount", 10);
>+	assert_int_equal(LDB_SUCCESS, ret);
>+	ret = __real_samdb_msg_add_int64(ctx, msg, msg, "badPasswordTime", now);
>+	assert_int_equal(LDB_SUCCESS, ret);
>+	ret = __real_samdb_msg_add_int64(ctx, msg, msg, "lockoutTime", now);
>+	assert_int_equal(LDB_SUCCESS, ret);
>+	return msg;
>+}
>+
>+/*
>+ * Add an objectSID in string form to the supplied message
>+ *
>+ *
>+ */
>+static void add_sid(
>+	struct ldb_message *msg,
>+	const char *sid_str)
>+{
>+	struct ldb_val v;
>+	enum ndr_err_code ndr_err;
>+	struct dom_sid *sid = NULL;
>+
>+	sid = talloc_zero(msg, struct dom_sid);
>+	assert_non_null(sid);
>+	assert_true(string_to_sid(sid, sid_str));
>+	ndr_err = ndr_push_struct_blob(
>+		&v, msg, sid, (ndr_push_flags_fn_t)ndr_push_dom_sid);
>+	assert_true(NDR_ERR_CODE_IS_SUCCESS(ndr_err));
>+	assert_int_equal(0, ldb_msg_add_value(msg, "objectSID", &v, NULL));
>+}
>+
>+/*
>+ * Build an ldb_result, for the re-reading of a user record
>+ *
>+ * if account_control < 0 then the msDS-User-Account-Control-Computed
>+ * element is not included
>+ * otherwise it is set to the value passed in account_control.
>+ *
>+ */
>+static struct ldb_result *build_reread_result(
>+	struct ldb_context *ldb,
>+	TALLOC_CTX *ctx,
>+	int account_control)
>+{
>+	struct ldb_message *msg = NULL;
>+	int ret;
>+
>+	struct ldb_result *res = talloc_zero(ctx, struct ldb_result);
>+
>+	assert_non_null(res);
>+	res->count = 1;
>+	res->msgs = talloc_array(res, struct ldb_message *, 1);
>+
>+	msg = create_message(res);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+	if (account_control >= 0) {
>+		ret = samdb_msg_add_int(
>+			ldb,
>+			msg,
>+			msg,
>+			"msDS-User-Account-Control-Computed",
>+			account_control);
>+		assert_int_equal(LDB_SUCCESS, ret);
>+	}
>+
>+	res->msgs[0] = msg;
>+	return res;
>+}
>+
>+/*
>+ * Build a mock domain pso ldb_result
>+ */
>+static struct ldb_result *build_domain_pso_result(
>+	struct ldb_context *ldb,
>+	TALLOC_CTX *ctx)
>+{
>+	struct ldb_message *msg = NULL;
>+	struct ldb_result *res = talloc_zero(ctx, struct ldb_result);
>+
>+	assert_non_null(res);
>+	res->count = 1;
>+	res->msgs = talloc_array(res, struct ldb_message *, 1);
>+	assert_non_null(res->msgs);
>+	msg = talloc_zero(res, struct ldb_message);
>+	assert_non_null(msg);
>+	res->msgs[0] = msg;
>+	return res;
>+}
>+
>+/*****************************************************************************
>+ * authsam_reread_user_logon_data unit tests
>+ *****************************************************************************/
>+/*
>+ * authsam_reread_user_logon_data unable to re-read the user record.
>+ *
>+ */
>+static void test_reread_read_failure(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_message *cur = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, NULL);
>+	will_return(__wrap_dsdb_search_dn, LDB_ERR_NO_SUCH_OBJECT);
>+
>+	status = authsam_reread_user_logon_data(ldb, ctx, msg, &cur);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_reread_user_logon_data account control flags missing from
>+ * re-read data
>+ *
>+ */
>+static void test_reread_missing_account_control(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_message *cur = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, -1));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	status = authsam_reread_user_logon_data(ldb, ctx, msg, &cur);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_reread_user_logon_data account locked
>+ * re-read data
>+ *
>+ */
>+static void test_reread_account_locked(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_message *cur = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, UF_LOCKOUT));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	status = authsam_reread_user_logon_data(ldb, ctx, msg, &cur);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_reread_user_logon_data account is not locked
>+ * re-read data
>+ *
>+ */
>+static void test_reread_account_not_locked(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_message *cur = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	size_t result_size = 0;
>+	NTSTATUS status;
>+	struct ldb_result *res = NULL;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	/*
>+	 * authsam_reread_user_logon_data returns the ldb_message portion
>+	 * of the ldb_result created by build_reread_result.
>+	 * So the tests for memory leaks will need to adjust for that
>+	 */
>+	res = build_reread_result(ldb, ctx, 0);
>+	will_return(__wrap_dsdb_search_dn, res);
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	result_size = talloc_total_size(res) -
>+		      talloc_total_size(res->msgs[0]);
>+	before = talloc_total_size(ctx) - result_size;
>+
>+	status = authsam_reread_user_logon_data(ldb, ctx, msg, &cur);
>+	assert_true(NT_STATUS_IS_OK(status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+
>+/*****************************************************************************
>+ * authsam_update_bad_pwd_count unit tests
>+ *****************************************************************************/
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * Unable to read the domain_dn record
>+ *
>+ */
>+static void test_update_bad_domain_dn_search_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = talloc_zero(ctx, struct ldb_message);
>+	assert_non_null(msg);
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, NULL);
>+	will_return(__wrap_dsdb_search_dn, LDB_ERR_NO_SUCH_OBJECT);
>+
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * authsam_get_user_pso failure
>+ *
>+ */
>+static void test_update_bad_get_pso_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	struct ldb_dn *pso_dn = NULL;
>+	const char *pso_dn_str = "CN=PSO";
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+	int ret;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	pso_dn = ldb_dn_new(ctx, ldb, pso_dn_str);
>+	assert_non_null(pso_dn);
>+
>+	msg = talloc_zero(ctx, struct ldb_message);
>+	assert_non_null(msg);
>+	ret = ldb_msg_add_string(msg, "msDS-ResultantPSO", pso_dn_str);
>+	assert_int_equal(LDB_SUCCESS, ret);
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, pso_dn);
>+	will_return(__wrap_dsdb_search_dn, NULL);
>+	will_return(__wrap_dsdb_search_dn, LDB_ERR_NO_SUCH_OBJECT);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_IS_OK(status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * start_transaction failure
>+ *
>+ */
>+static void test_update_bad_start_txn_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = talloc_zero(ctx, struct ldb_message);
>+	assert_non_null(msg);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_transaction_start_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * User details re-read failed
>+ *
>+ */
>+static void test_update_bad_reread_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = talloc_zero(ctx, struct ldb_message);
>+	assert_non_null(msg);
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, NULL);
>+	will_return(__wrap_dsdb_search_dn, LDB_ERR_NO_SUCH_OBJECT);
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * User details re-read reported locked out.
>+ *
>+ */
>+static void test_update_bad_reread_locked_out(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, UF_LOCKOUT));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT));
>+	assert_false(transaction_cancelled);
>+	assert_true(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * Transaction cancel failure
>+ */
>+static void test_update_bad_txn_cancel_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = talloc_zero(ctx, struct ldb_message);
>+	assert_non_null(msg);
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, NULL);
>+	will_return(__wrap_dsdb_search_dn, LDB_ERR_NO_SUCH_OBJECT);
>+
>+	ldb_transaction_cancel_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(in_transaction);
>+	assert_false(transaction_cancelled);
>+	assert_false(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * The following tests all expect the same setup, that is a normal
>+ * good user object and empty domain object.
>+ *
>+ * returns the talloc size after result array setup for leak tests
>+ */
>+static size_t setup_bad_password_search_results(TALLOC_CTX *ctx,
>+						struct ldb_context *ldb,
>+						struct ldb_dn *domain_dn,
>+						struct ldb_dn *user_dn)
>+{
>+	size_t before = 0;
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, user_dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	return before;
>+}
>+
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * dsdb_update_bad_pwd_count failure
>+ *
>+ */
>+static void test_update_bad_update_count_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = setup_bad_password_search_results(ctx, ldb,
>+						   domain_dn,
>+						   msg->dn);
>+
>+	dsdb_update_bad_pwd_count_ret = NT_STATUS_INTERNAL_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * No need to update the bad password stats
>+ *
>+ */
>+static void test_update_bad_no_update_required(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = setup_bad_password_search_results(ctx, ldb,
>+						   domain_dn,
>+						   msg->dn);
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_IS_OK(status));
>+	assert_true(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * Transaction commit failure
>+ *
>+ */
>+static void test_update_bad_commit_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = setup_bad_password_search_results(ctx, ldb,
>+						   domain_dn,
>+						   msg->dn);
>+
>+	ldb_transaction_commit_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(in_transaction);
>+	assert_false(transaction_cancelled);
>+	assert_false(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * ldb_build_mod_req failed building the user update details
>+ *
>+ */
>+static void test_update_bad_build_mod_request_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = setup_bad_password_search_results(ctx, ldb,
>+						   domain_dn,
>+						   msg->dn);
>+
>+	dsdb_update_bad_pwd_count_res = talloc_zero(ctx, struct ldb_message);
>+	ldb_build_mod_req_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * ldb_request_add_control failed to add DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE
>+ * to the user update record.
>+ *
>+ */
>+static void test_update_bad_add_control_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = setup_bad_password_search_results(ctx, ldb,
>+						   domain_dn,
>+						   msg->dn);
>+
>+	dsdb_update_bad_pwd_count_res = talloc_zero(ctx, struct ldb_message);
>+	ldb_build_mod_req_res = talloc_zero(ctx, struct ldb_request);
>+	ldb_request_add_control_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * call to ldb_request failed
>+ *
>+ */
>+static void test_update_bad_ldb_request_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = setup_bad_password_search_results(ctx, ldb,
>+						   domain_dn,
>+						   msg->dn);
>+
>+	dsdb_update_bad_pwd_count_res = talloc_zero(ctx, struct ldb_message);
>+	ldb_build_mod_req_res = talloc_zero(ctx, struct ldb_request);
>+	ldb_request_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_update_bad_pwd_account
>+ *
>+ * call to ldb_wait failed
>+ *
>+ */
>+static void test_update_bad_ldb_wait_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = setup_bad_password_search_results(ctx, ldb,
>+						   domain_dn,
>+						   msg->dn);
>+
>+	dsdb_update_bad_pwd_count_res = talloc_zero(ctx, struct ldb_message);
>+	ldb_build_mod_req_res = talloc_zero(ctx, struct ldb_request);
>+	ldb_wait_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_update_bad_pwd_count(ldb, msg, domain_dn);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*****************************************************************************
>+ * authsam_logon_success_accounting unit tests
>+ *****************************************************************************/
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * start_transaction failure
>+ *
>+ */
>+static void test_success_accounting_start_txn_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_transaction_start_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * User details re-read failed
>+ *
>+ */
>+static void test_success_accounting_reread_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, NULL);
>+	will_return(__wrap_dsdb_search_dn, LDB_ERR_NO_SUCH_OBJECT);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * ldb_msg_new failed
>+ *
>+ */
>+static void test_success_accounting_ldb_msg_new_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_msg_new_fail = true;
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * samdb_rodc failed
>+ *
>+ */
>+static void test_success_accounting_samdb_rodc_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	samdb_rodc_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_false(in_transaction);
>+	assert_false(transaction_cancelled);
>+	assert_false(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * authsam_update_lastlogon_timestamp failed
>+ *
>+ */
>+static void test_success_accounting_update_lastlogon_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	ldb_build_mod_req_res = talloc_zero(ctx, struct ldb_request);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	will_return(__wrap_samdb_msg_add_int64, LDB_ERR_OPERATIONS_ERROR);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * ldb_build_mod_req failed
>+ *
>+ */
>+static void test_success_accounting_build_mod_req_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_build_mod_req_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * ldb_request_add_control failed
>+ *
>+ */
>+static void test_success_accounting_add_control_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_build_mod_req_res = talloc_zero(ldb, struct ldb_request);
>+	ldb_request_add_control_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * ldb_request failed
>+ *
>+ */
>+static void test_success_accounting_ldb_request_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_build_mod_req_res = talloc_zero(ldb, struct ldb_request);
>+	ldb_request_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * ldb_wait failed
>+ *
>+ */
>+static void test_success_accounting_ldb_wait_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_build_mod_req_res = talloc_zero(ldb, struct ldb_request);
>+	ldb_wait_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(transaction_cancelled);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * ldb_transaction_commit failed
>+ *
>+ */
>+static void test_success_accounting_commit_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_build_mod_req_res = talloc_zero(ldb, struct ldb_request);
>+	ldb_transaction_commit_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(in_transaction);
>+	assert_false(transaction_cancelled);
>+	assert_false(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * ldb_wait failed and then ldb_transaction_cancel failed
>+ *
>+ */
>+static void test_success_accounting_rollback_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	ldb_build_mod_req_res = talloc_zero(ldb, struct ldb_request);
>+	ldb_wait_ret = LDB_ERR_OPERATIONS_ERROR;
>+	ldb_transaction_cancel_ret = LDB_ERR_OPERATIONS_ERROR;
>+
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+	will_return(__wrap_samdb_msg_add_int64, LDB_SUCCESS);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_ERROR));
>+	assert_true(in_transaction);
>+	assert_false(transaction_cancelled);
>+	assert_false(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * authsam_logon_success_accounting
>+ *
>+ * The bad password indicator is set, but the account is not locked out.
>+ *
>+ */
>+static void test_success_accounting_spurious_bad_pwd_indicator(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	struct ldb_dn *domain_dn = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+	NTSTATUS status;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	domain_dn = ldb_dn_new(ctx, ldb, "CN=Domain");
>+	assert_non_null(domain_dn);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1000");
>+
>+	msg->dn = ldb_dn_new(ctx, ldb, "CN=User");
>+	assert_non_null(msg->dn);
>+
>+	before = talloc_total_size(ctx);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, domain_dn);
>+	will_return(__wrap_dsdb_search_dn, build_domain_pso_result(ldb, ctx));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	expect_check(__wrap_dsdb_search_dn, basedn, check_dn, msg->dn);
>+	will_return(__wrap_dsdb_search_dn, build_reread_result(ldb, ctx, 0));
>+	will_return(__wrap_dsdb_search_dn, LDB_SUCCESS);
>+
>+	will_return_count(__wrap_samdb_msg_add_int64, LDB_SUCCESS, 2);
>+
>+        /*
>+         * Set the bad password indicator.
>+	 */
>+	status = authsam_set_bad_password_indicator(ldb, ctx, msg);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_OK, status));
>+
>+	ldb_build_mod_req_res = talloc_zero(ctx, struct ldb_request);
>+
>+	status = authsam_logon_success_accounting(
>+		ldb, msg, domain_dn, true, NULL);
>+	assert_true(NT_STATUS_EQUAL(status, NT_STATUS_OK));
>+	assert_false(in_transaction);
>+	assert_false(transaction_cancelled);
>+	assert_true(transaction_committed);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * get_bad_password_db
>+ *
>+ * ldb_get_opaque failure.
>+ */
>+static void test_get_bad_password_get_opaque_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	struct db_context *db = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * clear the mock ldb_get_opaque return value, so that we get a null
>+	 * response.
>+	 */
>+	TALLOC_FREE(ldb_get_opaque_ret);
>+
>+	before = talloc_total_size(ctx);
>+
>+	db = authsam_get_bad_password_db(ctx, ldb);
>+	assert_null(db);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * get_bad_password_db
>+ *
>+ * cluster_db_tmp_open failure.
>+ */
>+static void test_get_bad_password_db_open_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	struct db_context *db = NULL;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * Clear the mock cluster_db_tmp_open return value so that
>+	 * it returns NULL
>+	 */
>+	TALLOC_FREE(cluster_db_tmp_open_ret);
>+	before = talloc_total_size(ctx);
>+
>+	db = authsam_get_bad_password_db(ctx, ldb);
>+	assert_null(db);
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * set_bad_password_indicator
>+ *
>+ * set_bad_password_indicator failure.
>+ */
>+static void test_set_bad_password_indicator_get_db_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * Clear the mock cluster_db_tmp_open return value so that
>+	 * it returns NULL
>+	 */
>+	TALLOC_FREE(cluster_db_tmp_open_ret);
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_set_bad_password_indicator(ldb, ctx, NULL);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_ERROR, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * set_bad_password_indicator
>+ *
>+ * get_object_sid_as_tdb_data failure.
>+ */
>+static void test_set_bad_password_indicator_get_object_sid_failed(
>+	void **state)
>+{
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * The created message does not contain an objectSid, so
>+	 * get_object_sid_as_tdb_data will fail.
>+	 */
>+	msg = create_message(ctx);
>+
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_set_bad_password_indicator(ldb, ctx, msg);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_ERROR, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * set_bad_password_indicator
>+ *
>+ * dbwrap_store failure.
>+ */
>+static void test_set_bad_password_indicator_dbwrap_store_failed(
>+	void **state)
>+{
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1010");
>+
>+	dbwrap_store_ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
>+
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_set_bad_password_indicator(ldb, ctx, msg);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_DB_CORRUPTION, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * check_bad_password_indicator
>+ *
>+ * set_bad_password_indicator failure.
>+ */
>+static void test_check_bad_password_indicator_get_db_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+	bool exists = false;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * Clear the mock cluster_db_tmp_open return value so that
>+	 * it returns NULL
>+	 */
>+	TALLOC_FREE(cluster_db_tmp_open_ret);
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_check_bad_password_indicator(ldb, ctx, &exists, NULL);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_ERROR, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * check_bad_password_indicator
>+ *
>+ * get_object_sid_as_tdb_data failure.
>+ */
>+static void test_check_bad_password_indicator_get_object_sid_failed(
>+	void **state)
>+{
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+	bool exists = false;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * The created message does not contain an objectSid, so
>+	 * get_object_sid_as_tdb_data will fail.
>+	 */
>+	msg = create_message(ctx);
>+
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_check_bad_password_indicator(ldb, ctx, &exists, msg);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_ERROR, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * clear_bad_password_indicator
>+ *
>+ * set_bad_password_indicator failure.
>+ */
>+static void test_clear_bad_password_indicator_get_db_failed(void **state) {
>+	struct ldb_context *ldb = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * Clear the mock cluster_db_tmp_open return value so that
>+	 * it returns NULL
>+	 */
>+	TALLOC_FREE(cluster_db_tmp_open_ret);
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_clear_bad_password_indicator(ldb, ctx, NULL);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_ERROR, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * clear_bad_password_indicator
>+ *
>+ * get_object_sid_as_tdb_data failure.
>+ */
>+static void test_clear_bad_password_indicator_get_object_sid_failed(
>+	void **state)
>+{
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	/*
>+	 * The created message does not contain an objectSid, so
>+	 * get_object_sid_as_tdb_data will fail.
>+	 */
>+	msg = create_message(ctx);
>+
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_clear_bad_password_indicator(ldb, ctx, msg);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_ERROR, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * clear_bad_password_indicator
>+ *
>+ * dbwrap_delete failure.
>+ */
>+static void test_clear_bad_password_indicator_dbwrap_store_failed(
>+	void **state)
>+{
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1010");
>+
>+	dbwrap_delete_ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
>+
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_clear_bad_password_indicator(ldb, ctx, msg);
>+	assert_true(NT_STATUS_EQUAL(NT_STATUS_INTERNAL_DB_CORRUPTION, status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+/*
>+ * clear_bad_password_indicator
>+ *
>+ * dbwrap_delete returns NT_STATUS_NOT_FOUND.
>+ */
>+static void test_clear_bad_pwd_indicator_dbwrap_store_not_found(
>+	void **state)
>+{
>+	struct ldb_context *ldb = NULL;
>+	struct ldb_message *msg = NULL;
>+	TALLOC_CTX *ctx = NULL;
>+	NTSTATUS status;
>+	size_t before = 0;
>+	size_t after = 0;
>+
>+	ctx = talloc_new(*state);
>+	assert_non_null(ctx);
>+
>+	ldb = ldb_init(ctx, NULL);
>+	assert_non_null(ldb);
>+
>+	msg = create_message(ctx);
>+	add_sid(msg, "S-1-5-21-2470180966-3899876309-2637894779-1010");
>+
>+	dbwrap_delete_ret = NT_STATUS_NOT_FOUND;
>+
>+	before = talloc_total_size(ctx);
>+
>+	status = authsam_clear_bad_password_indicator(ldb, ctx, msg);
>+	assert_true(NT_STATUS_IS_OK(status));
>+
>+	/*
>+	 * Check that all allocated memory was freed
>+	 */
>+	after = talloc_total_size(ctx);
>+	assert_int_equal(before, after);
>+
>+	/*
>+	 * Clean up
>+	 */
>+	TALLOC_FREE(ctx);
>+}
>+
>+int main(int argc, const char **argv)
>+{
>+	const struct CMUnitTest tests[] = {
>+		cmocka_unit_test_setup_teardown(
>+			test_reread_read_failure, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_reread_missing_account_control, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_reread_account_locked, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_reread_account_not_locked, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_domain_dn_search_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_get_pso_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_start_txn_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_reread_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_reread_locked_out, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_update_count_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_no_update_required, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_build_mod_request_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_add_control_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_ldb_request_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_ldb_wait_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_txn_cancel_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_update_bad_commit_failed, setup, teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_start_txn_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_reread_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_ldb_msg_new_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_samdb_rodc_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_update_lastlogon_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_build_mod_req_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_add_control_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_ldb_request_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_ldb_wait_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_commit_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_rollback_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_success_accounting_spurious_bad_pwd_indicator,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_get_bad_password_get_opaque_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_get_bad_password_db_open_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_set_bad_password_indicator_get_db_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_set_bad_password_indicator_get_object_sid_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_set_bad_password_indicator_dbwrap_store_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_check_bad_password_indicator_get_db_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_check_bad_password_indicator_get_object_sid_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_clear_bad_password_indicator_get_db_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_clear_bad_password_indicator_get_object_sid_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_clear_bad_password_indicator_dbwrap_store_failed,
>+			setup,
>+			teardown),
>+		cmocka_unit_test_setup_teardown(
>+			test_clear_bad_pwd_indicator_dbwrap_store_not_found,
>+			setup,
>+			teardown),
>+	};
>+
>+	cmocka_set_message_output(CM_OUTPUT_SUBUNIT);
>+	return cmocka_run_group_tests(tests, NULL, NULL);
>+}
>diff --git a/source4/auth/wscript_build b/source4/auth/wscript_build
>index 381a7b19bf0..ff1a61a9566 100644
>--- a/source4/auth/wscript_build
>+++ b/source4/auth/wscript_build
>@@ -49,6 +49,17 @@ bld.SAMBA_BINARY('test_kerberos',
>         for_selftest=True
>         )
> 
>+bld.SAMBA_BINARY('test_auth_sam',
>+        source='tests/sam.c',
>+        deps='cmocka samdb samba-security ldb tevent',
>+        local_include=False,
>+        for_selftest=True,
>+        ldflags='''
>+            -Wl,--wrap,dsdb_search_dn
>+            -Wl,--wrap,samdb_msg_add_int64
>+        '''
>+        )
>+
> pytalloc_util = bld.pyembed_libname('pytalloc-util')
> pyparam_util = bld.pyembed_libname('pyparam_util')
> pyldb_util = bld.pyembed_libname('pyldb-util')
>-- 
>2.35.0
>
>
>From f40bf194eb53417323c648a007cf5c6dfc1322fd Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 5 Jul 2022 20:17:49 +1200
>Subject: [PATCH 15/40] CVE-2021-20251 auth4: Detect ACCOUNT_LOCKED_OUT error
> for password change
>
>This is more specific than NT_STATUS_UNSUCCESSFUL, and for the SAMR
>password change, matches the result the call to samdb_result_passwords()
>would give.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/dsdb/common/util.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
>diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
>index 451495fe4c5..aff31ac8651 100644
>--- a/source4/dsdb/common/util.c
>+++ b/source4/dsdb/common/util.c
>@@ -2301,7 +2301,8 @@ int samdb_set_password_callback(struct ldb_request *req, struct ldb_reply *ares)
>  * change failed.
>  *
>  * Results: NT_STATUS_OK, NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
>- *   NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION
>+ *   NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION,
>+ *   NT_STATUS_ACCESS_DENIED, NT_STATUS_ACCOUNT_LOCKED_OUT, NT_STATUS_NO_MEMORY
>  */
> static NTSTATUS samdb_set_password_internal(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
> 			    struct ldb_dn *user_dn, struct ldb_dn *domain_dn,
>@@ -2474,6 +2475,9 @@ static NTSTATUS samdb_set_password_internal(struct ldb_context *ldb, TALLOC_CTX
> 			if (W_ERROR_EQUAL(werr, WERR_PASSWORD_RESTRICTION)) {
> 				status = NT_STATUS_PASSWORD_RESTRICTION;
> 			}
>+			if (W_ERROR_EQUAL(werr, WERR_ACCOUNT_LOCKED_OUT)) {
>+				status = NT_STATUS_ACCOUNT_LOCKED_OUT;
>+			}
> 		}
> 	} else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
> 		/* don't let the caller know if an account doesn't exist */
>@@ -2523,6 +2527,7 @@ NTSTATUS samdb_set_password(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
>  * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
>  *   NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
>  *   NT_STATUS_WRONG_PASSWORD, NT_STATUS_PASSWORD_RESTRICTION,
>+ *   NT_STATUS_ACCESS_DENIED, NT_STATUS_ACCOUNT_LOCKED_OUT, NT_STATUS_NO_MEMORY
>  *   NT_STATUS_TRANSACTION_ABORTED, NT_STATUS_NO_SUCH_USER
>  */
> NTSTATUS samdb_set_password_sid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
>-- 
>2.35.0
>
>
>From 0fdccd20bafcc3f7b59c343cd7e9126ab27f124a Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 30 Mar 2021 18:01:39 +1300
>Subject: [PATCH 16/40] CVE-2021-20251 s4 auth: make bad password count
> increment atomic
>
>Ensure that the bad password count is incremented atomically,
>and that the successful logon accounting data is updated atomically.
>
>Use bad password indicator (in a distinct TDB) to determine if to open a transaction
>
>We open a transaction when we have seen the hint that this user
>has recorded a bad password.  This allows us to avoid always
>needing one, while not missing a possible lockout.
>
>We also go back and get a transation if we did not take out
>one out but we chose to do a write (eg for lastLogonTimestamp)
>
>Based on patches by Gary Lockyer <gary@catalyst.net.nz>
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> selftest/knownfail.d/auth-sam  |  12 --
> selftest/knownfail_heimdal_kdc |   5 -
> selftest/knownfail_mit_kdc     |   3 -
> source4/auth/sam.c             | 296 +++++++++++++++++++++++++++------
> 4 files changed, 246 insertions(+), 70 deletions(-)
>
>diff --git a/selftest/knownfail.d/auth-sam b/selftest/knownfail.d/auth-sam
>index e87e43d509b..048459e6555 100644
>--- a/selftest/knownfail.d/auth-sam
>+++ b/selftest/knownfail.d/auth-sam
>@@ -11,15 +11,3 @@
> ^samba.unittests.auth.sam.test_success_accounting_spurious_bad_pwd_indicator.none
> ^samba.unittests.auth.sam.test_success_accounting_start_txn_failed.none
> ^samba.unittests.auth.sam.test_success_accounting_update_lastlogon_failed.none
>-^samba.unittests.auth.sam.test_update_bad_add_control_failed.none
>-^samba.unittests.auth.sam.test_update_bad_build_mod_request_failed.none
>-^samba.unittests.auth.sam.test_update_bad_commit_failed.none
>-^samba.unittests.auth.sam.test_update_bad_get_pso_failed.none
>-^samba.unittests.auth.sam.test_update_bad_ldb_request_failed.none
>-^samba.unittests.auth.sam.test_update_bad_ldb_wait_failed.none
>-^samba.unittests.auth.sam.test_update_bad_no_update_required.none
>-^samba.unittests.auth.sam.test_update_bad_reread_failed.none
>-^samba.unittests.auth.sam.test_update_bad_reread_locked_out.none
>-^samba.unittests.auth.sam.test_update_bad_start_txn_failed.none
>-^samba.unittests.auth.sam.test_update_bad_txn_cancel_failed.none
>-^samba.unittests.auth.sam.test_update_bad_update_count_failed.none
>diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
>index ef913b04952..c0335bf4b52 100644
>--- a/selftest/knownfail_heimdal_kdc
>+++ b/selftest/knownfail_heimdal_kdc
>@@ -57,10 +57,5 @@
> #
> # Lockout tests
> #
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_kdc.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_ntlm.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_kdc.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_ntlm.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_samr.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ntlm.ad_dc:local
>diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc
>index 6ece892767a..0af1f02142d 100644
>--- a/selftest/knownfail_mit_kdc
>+++ b/selftest/knownfail_mit_kdc
>@@ -443,10 +443,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
> # Lockout tests
> #
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_kdc.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_ntlm.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_kdc.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_ntlm.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_samr.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ntlm.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_transaction_bad_pwd_kdc.ad_dc:local
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index 3b1bb8d7dc1..d0040bf293d 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -1073,7 +1073,9 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
> 	NTSTATUS status;
> 	struct ldb_result *domain_res;
> 	struct ldb_message *msg_mod = NULL;
>+	struct ldb_message *current = NULL;
> 	struct ldb_message *pso_msg = NULL;
>+	bool txn_active = false;
> 	TALLOC_CTX *mem_ctx;
> 
> 	mem_ctx = talloc_new(msg);
>@@ -1098,14 +1100,65 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
> 			ret, ldb_dn_get_linearized(msg->dn));
> 	}
> 
>-	status = dsdb_update_bad_pwd_count(mem_ctx, sam_ctx,
>-					   msg, domain_res->msgs[0], pso_msg,
>-					   &msg_mod);
>+	/*
>+	 * To ensure that the bad password count is updated atomically,
>+	 * we need to:
>+	 *    begin a transaction
>+	 *       re-read the account details,
>+	 *         using the <GUID= part of the DN
>+	 *       update the bad password count
>+	 *    commit the transaction.
>+	 */
>+
>+	/*
>+	 * Start a new transaction
>+	 */
>+	ret = ldb_transaction_start(sam_ctx);
>+	if (ret != LDB_SUCCESS) {
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto error;
>+	}
>+	txn_active = true;
>+
>+	/*
>+	 * Re-read the account details, using the GUID in case the DN
>+	 * is being changed.
>+	 */
>+	status = authsam_reread_user_logon_data(
>+		sam_ctx, mem_ctx, msg, &current);
> 	if (!NT_STATUS_IS_OK(status)) {
>-		TALLOC_FREE(mem_ctx);
>-		return status;
>+		/* The re-read can return account locked out, as well
>+		 * as an internal error
>+		 */
>+		if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
>+			/*
>+			 * For NT_STATUS_ACCOUNT_LOCKED_OUT we want to commit
>+			 * the transaction. Again to avoid cluttering the
>+			 * audit logs with spurious errors
>+			 */
>+			goto exit;
>+		}
>+		goto error;
> 	}
> 
>+	/*
>+	 * Update the bad password count and if required lock the account
>+	 */
>+	status = dsdb_update_bad_pwd_count(
>+		mem_ctx,
>+		sam_ctx,
>+		current,
>+		domain_res->msgs[0],
>+		pso_msg,
>+		&msg_mod);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto error;
>+	}
>+
>+	/*
>+	 * Write the data back to disk if required.
>+	 */
> 	if (msg_mod != NULL) {
> 		struct ldb_request *req;
> 
>@@ -1116,7 +1169,9 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
> 					ldb_op_default_callback,
> 					NULL);
> 		if (ret != LDB_SUCCESS) {
>-			goto done;
>+			TALLOC_FREE(msg_mod);
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
> 		}
> 
> 		ret = ldb_request_add_control(req,
>@@ -1124,31 +1179,72 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
> 					      false, NULL);
> 		if (ret != LDB_SUCCESS) {
> 			talloc_free(req);
>-			goto done;
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
> 		}
> 
>-		ret = dsdb_autotransaction_request(sam_ctx, req);
>+		/*
>+		 * As we're in a transaction, make the ldb request directly
>+		 * to avoid the nested transaction that would result if we
>+		 * called dsdb_autotransaction_request
>+		 */
>+		ret = ldb_request(sam_ctx, req);
>+		if (ret == LDB_SUCCESS) {
>+			ret = ldb_wait(req->handle, LDB_WAIT_ALL);
>+		}
> 		talloc_free(req);
>-
>+		if (ret != LDB_SUCCESS) {
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
>+		}
> 		status = authsam_set_bad_password_indicator(
> 			sam_ctx, mem_ctx, msg);
>-		/* Failure is ignored for now */
>+		if (!NT_STATUS_IS_OK(status)) {
>+			goto error;
>+		}
> 	}
>-
>-done:
>+	/*
>+	 * Note that we may not have updated the user record, but
>+	 * committing the transaction in that case is still the correct
>+	 * thing to do.
>+	 * If the transaction was cancelled, this would be logged by
>+	 * the dsdb audit log as a failure. When in fact it is expected
>+	 * behaviour.
>+	 */
>+exit:
>+	TALLOC_FREE(mem_ctx);
>+	ret = ldb_transaction_commit(sam_ctx);
> 	if (ret != LDB_SUCCESS) {
>-		DBG_ERR("Failed to update badPwdCount, badPasswordTime or "
>-			"set lockoutTime on %s: %s\n",
>-			ldb_dn_get_linearized(msg->dn),
>-			ldb_errstring(sam_ctx));
>-		TALLOC_FREE(mem_ctx);
>+		DBG_ERR("Error (%d) %s, committing transaction,"
>+			" while updating bad password count"
>+			" for (%s)\n",
>+			ret,
>+			ldb_errstring(sam_ctx),
>+			ldb_dn_get_linearized(msg->dn));
> 		return NT_STATUS_INTERNAL_ERROR;
> 	}
>+	return status;
> 
>+error:
>+	DBG_ERR("Failed to update badPwdCount, badPasswordTime or "
>+		"set lockoutTime on %s: %s\n",
>+		ldb_dn_get_linearized(msg->dn),
>+		ldb_errstring(sam_ctx) != NULL ?
>+			ldb_errstring(sam_ctx) :nt_errstr(status));
>+	if (txn_active) {
>+		ret = ldb_transaction_cancel(sam_ctx);
>+		if (ret != LDB_SUCCESS) {
>+			DBG_ERR("Error rolling back transaction,"
>+				" while updating bad password count"
>+				" on %s: %s\n",
>+				ldb_dn_get_linearized(msg->dn),
>+				ldb_errstring(sam_ctx));
>+		}
>+	}
> 	TALLOC_FREE(mem_ctx);
>-	return NT_STATUS_OK;
>-}
>+	return status;
> 
>+}
> 
> static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
> 					    struct ldb_message *msg_mod,
>@@ -1296,6 +1392,7 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 	NTTIME now;
> 	NTTIME lastLogonTimestamp;
> 	bool am_rodc = false;
>+	bool txn_active = false;
> 	bool need_db_reread;
> 
> 	mem_ctx = talloc_new(msg);
>@@ -1303,15 +1400,41 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		return NT_STATUS_NO_MEMORY;
> 	}
> 
>+	/*
>+	 * Any update of the last logon data, needs to be done inside a
>+	 * transaction.
>+	 * And the user data needs to be re-read, and the account re-checked
>+	 * for lockout.
>+	 *
>+	 * Howevver we have long-running transactions like replication
>+	 * that could otherwise grind the system to a halt so we first
>+	 * determine if *this* account has seen a bad password,
>+	 * otherwise we only start a transaction if there was a need
>+	 * (because a change was to be made).
>+	 */
>+
> 	status = authsam_check_bad_password_indicator(
> 		sam_ctx, mem_ctx, &need_db_reread, msg);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		return status;
> 	}
> 
>+get_transaction:
>+
> 	if (need_db_reread) {
> 		struct ldb_message *current = NULL;
> 
>+		/*
>+		 * Start a new transaction
>+		 */
>+		ret = ldb_transaction_start(sam_ctx);
>+		if (ret != LDB_SUCCESS) {
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
>+		}
>+
>+		txn_active = true;
>+
> 		/*
> 		 * Re-read the account details, using the GUID
> 		 * embedded in DN so this is safe against a race where
>@@ -1324,7 +1447,15 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 			 * The re-read can return account locked out, as well
> 			 * as an internal error
> 			 */
>-			return status;
>+			if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
>+				/*
>+				 * For NT_STATUS_ACCOUNT_LOCKED_OUT we want to commit
>+				 * the transaction. Again to avoid cluttering the
>+				 * audit logs with spurious errors
>+				 */
>+				goto exit;
>+			}
>+			goto error;
> 		}
> 		msg = current;
> 	}
>@@ -1345,9 +1476,15 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 
> 	msg_mod = ldb_msg_new(mem_ctx);
> 	if (msg_mod == NULL) {
>-		TALLOC_FREE(mem_ctx);
>-		return NT_STATUS_NO_MEMORY;
>+		status = NT_STATUS_NO_MEMORY;
>+		goto error;
> 	}
>+
>+	/*
>+	 * By using the DN from msg->dn directly, we allow LDB to
>+	 * prefer the embedded GUID form, so this is actually quite
>+	 * safe even in the case where DN has been changed
>+	 */
> 	msg_mod->dn = msg->dn;
> 
> 	if (lockoutTime != 0) {
>@@ -1356,14 +1493,14 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		 */
> 		ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "lockoutTime", 0);
> 		if (ret != LDB_SUCCESS) {
>-			TALLOC_FREE(mem_ctx);
>-			return NT_STATUS_NO_MEMORY;
>+			status = NT_STATUS_NO_MEMORY;
>+			goto error;
> 		}
> 	} else if (badPwdCount != 0) {
> 		ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "badPwdCount", 0);
> 		if (ret != LDB_SUCCESS) {
>-			TALLOC_FREE(mem_ctx);
>-			return NT_STATUS_NO_MEMORY;
>+			status = NT_STATUS_NO_MEMORY;
>+			goto error;
> 		}
> 	}
> 
>@@ -1375,8 +1512,8 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod,
> 					  "lastLogon", now);
> 		if (ret != LDB_SUCCESS) {
>-			TALLOC_FREE(mem_ctx);
>-			return NT_STATUS_NO_MEMORY;
>+			status = NT_STATUS_NO_MEMORY;
>+			goto error;
> 		}
> 	}
> 
>@@ -1390,8 +1527,8 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod,
> 					"logonCount", logonCount);
> 		if (ret != LDB_SUCCESS) {
>-			TALLOC_FREE(mem_ctx);
>-			return NT_STATUS_NO_MEMORY;
>+			status = NT_STATUS_NO_MEMORY;
>+			goto error;
> 		}
> 	} else {
> 		/* Set an unset logonCount to 0 on first successful login */
>@@ -1407,16 +1544,16 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 
> 	ret = samdb_rodc(sam_ctx, &am_rodc);
> 	if (ret != LDB_SUCCESS) {
>-		TALLOC_FREE(mem_ctx);
>-		return NT_STATUS_INTERNAL_ERROR;
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto error;
> 	}
> 
> 	if (!am_rodc) {
> 		status = authsam_update_lastlogon_timestamp(sam_ctx, msg_mod, domain_dn,
> 							    lastLogonTimestamp, now);
> 		if (!NT_STATUS_IS_OK(status)) {
>-			TALLOC_FREE(mem_ctx);
>-			return NT_STATUS_NO_MEMORY;
>+			status = NT_STATUS_NO_MEMORY;
>+			goto error;
> 		}
> 	} else {
> 		/* Perform the (async) SendToSAM calls for MS-SAMS */
>@@ -1436,6 +1573,16 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		unsigned int i;
> 		struct ldb_request *req;
> 
>+		/*
>+		 * If it turns out we are going to update the DB, go
>+		 * back to the start, get a transaction and the
>+		 * current DB state and try again
>+		 */
>+		if (txn_active == false) {
>+			need_db_reread = true;
>+			goto get_transaction;
>+		}
>+
> 		/* mark all the message elements as LDB_FLAG_MOD_REPLACE */
> 		for (i=0;i<msg_mod->num_elements;i++) {
> 			msg_mod->elements[i].flags = LDB_FLAG_MOD_REPLACE;
>@@ -1448,35 +1595,84 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 					ldb_op_default_callback,
> 					NULL);
> 		if (ret != LDB_SUCCESS) {
>-			goto done;
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
> 		}
> 
> 		ret = ldb_request_add_control(req,
> 					      DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE,
> 					      false, NULL);
> 		if (ret != LDB_SUCCESS) {
>-			talloc_free(req);
>-			goto done;
>+			TALLOC_FREE(req);
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
> 		}
>-
>-		ret = dsdb_autotransaction_request(sam_ctx, req);
>-		talloc_free(req);
>+		/*
>+		 * As we're in a transaction, make the ldb request directly
>+		 * to avoid the nested transaction that would result if we
>+		 * called dsdb_autotransaction_request
>+		 */
>+		ret = ldb_request(sam_ctx, req);
>+		if (ret == LDB_SUCCESS) {
>+			ret = ldb_wait(req->handle, LDB_WAIT_ALL);
>+		}
>+		TALLOC_FREE(req);
>+		if (ret != LDB_SUCCESS) {
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
>+		}
>+	}
>+	status = authsam_clear_bad_password_indicator(sam_ctx, mem_ctx, msg);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		goto error;
> 	}
> 
>-	status = authsam_clear_bad_password_indicator(sam_ctx, mem_ctx, msg);
>-	/* Failure is ignored for now */
>+	/*
>+	 * Note that we may not have updated the user record, but
>+	 * committing the transaction in that case is still the correct
>+	 * thing to do.
>+	 * If the transaction was cancelled, this would be logged by
>+	 * the dsdb audit log as a failure. When in fact it is expected
>+	 * behaviour.
>+	 *
>+	 * Thankfully both TDB and LMDB seem to optimise for the empty
>+	 * transaction case
>+	 */
>+exit:
>+	TALLOC_FREE(mem_ctx);
> 
>-done:
>+	if (txn_active == false) {
>+		return status;
>+	}
>+
>+	ret = ldb_transaction_commit(sam_ctx);
> 	if (ret != LDB_SUCCESS) {
>-		DEBUG(0, ("Failed to set badPwdCount and lockoutTime "
>-			  "to 0 and/or  lastlogon to now (%lld) "
>-			  "%s: %s\n", (long long int)now,
>-			  ldb_dn_get_linearized(msg_mod->dn),
>-			  ldb_errstring(sam_ctx)));
>-		TALLOC_FREE(mem_ctx);
>+		DBG_ERR("Error (%d) %s, committing transaction,"
>+			" while updating successful logon accounting"
>+			" for (%s)\n",
>+			ret,
>+			ldb_errstring(sam_ctx),
>+			ldb_dn_get_linearized(msg->dn));
> 		return NT_STATUS_INTERNAL_ERROR;
> 	}
>+	return status;
> 
>+error:
>+	DBG_ERR("Failed to update badPwdCount, badPasswordTime or "
>+		"set lockoutTime on %s: %s\n",
>+		ldb_dn_get_linearized(msg->dn),
>+		ldb_errstring(sam_ctx) != NULL ?
>+			ldb_errstring(sam_ctx) :nt_errstr(status));
>+	if (txn_active) {
>+		ret = ldb_transaction_cancel(sam_ctx);
>+		if (ret != LDB_SUCCESS) {
>+			DBG_ERR("Error rolling back transaction,"
>+				" while updating bad password count"
>+				" on %s: %s\n",
>+				ldb_dn_get_linearized(msg->dn),
>+				ldb_errstring(sam_ctx));
>+		}
>+	}
> 	TALLOC_FREE(mem_ctx);
>-	return NT_STATUS_OK;
>+	return status;
> }
>-- 
>2.35.0
>
>
>From 056c89e42d62cf60c2d8eea6799a75a0ed9987bc Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 30 Mar 2021 16:35:44 +1300
>Subject: [PATCH 17/40] CVE-2021-20251 auth4: Add missing newline to debug
> message on PSO read failure
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/auth/sam.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index d0040bf293d..5d74186e2ca 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -1096,7 +1096,7 @@ NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
> 		 * fallback to using the domain defaults so that we still
> 		 * record the bad password attempt
> 		 */
>-		DBG_ERR("Error (%d) checking PSO for %s",
>+		DBG_ERR("Error (%d) checking PSO for %s\n",
> 			ret, ldb_dn_get_linearized(msg->dn));
> 	}
> 
>-- 
>2.35.0
>
>
>From fa65f14b3f6ece0153cc08ed079e55ba8b837d6d Mon Sep 17 00:00:00 2001
>From: Gary Lockyer <gary@catalyst.net.nz>
>Date: Thu, 25 Mar 2021 11:30:59 +1300
>Subject: [PATCH 18/40] CVE-2021-20251 auth4: Return only the result message
> and free the surrounding result
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> selftest/knownfail.d/auth-sam | 1 -
> source4/auth/sam.c            | 3 ++-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/selftest/knownfail.d/auth-sam b/selftest/knownfail.d/auth-sam
>index 048459e6555..438cea46415 100644
>--- a/selftest/knownfail.d/auth-sam
>+++ b/selftest/knownfail.d/auth-sam
>@@ -1,4 +1,3 @@
>-^samba.unittests.auth.sam.test_reread_account_not_locked.none
> ^samba.unittests.auth.sam.test_success_accounting_add_control_failed.none
> ^samba.unittests.auth.sam.test_success_accounting_build_mod_req_failed.none
> ^samba.unittests.auth.sam.test_success_accounting_commit_failed.none
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index 5d74186e2ca..b0b4416e49b 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -885,7 +885,8 @@ NTSTATUS authsam_reread_user_logon_data(
> 		TALLOC_FREE(res);
> 		return NT_STATUS_ACCOUNT_LOCKED_OUT;
> 	}
>-	*current = res->msgs[0];
>+	*current = talloc_steal(mem_ctx, res->msgs[0]);
>+	TALLOC_FREE(res);
> 	return NT_STATUS_OK;
> }
> 
>-- 
>2.35.0
>
>
>From 9b2f2fcd3540caf4eede89b29281e182d4578f5a Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Thu, 25 Mar 2021 14:42:39 +1300
>Subject: [PATCH 19/40] CVE-2021-20251 auth4: Split
> authsam_calculate_lastlogon_sync_interval() out
>
>authsam_calculate_lastlogon_sync_interval() is split out of authsam_update_lastlogon_timestamp()
>
>Based on work by Gary Lockyer <gary@catalyst.net.nz>
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/auth/sam.c | 115 ++++++++++++++++++++++++++++-----------------
> 1 file changed, 73 insertions(+), 42 deletions(-)
>
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index b0b4416e49b..71c6fecb244 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -1247,40 +1247,36 @@ error:
> 
> }
> 
>-static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
>-					    struct ldb_message *msg_mod,
>-					    struct ldb_dn *domain_dn,
>-					    NTTIME old_timestamp,
>-					    NTTIME now)
>+/*
>+ * msDS-LogonTimeSyncInterval is an int32_t number of days.
>+ *
>+ * The docs say: "the initial update, after the domain functional
>+ * level is raised to DS_BEHAVIOR_WIN2003 or higher, is calculated as
>+ * 14 days minus a random percentage of 5 days", but we aren't doing
>+ * that. The blogosphere seems to think that this randomised update
>+ * happens everytime, but [MS-ADA1] doesn't agree.
>+ *
>+ * Dochelp referred us to the following blog post:
>+ * http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx
>+ *
>+ * when msDS-LogonTimeSyncInterval is zero, the lastLogonTimestamp is
>+ * not changed.
>+ */
>+
>+static NTSTATUS authsam_calculate_lastlogon_sync_interval(
>+	struct ldb_context *sam_ctx,
>+	TALLOC_CTX *ctx,
>+	struct ldb_dn *domain_dn,
>+	NTTIME *sync_interval_nt)
> {
>-	/*
>-	 * We only set lastLogonTimestamp if the current value is older than
>-	 * now - msDS-LogonTimeSyncInterval days.
>-	 *
>-	 * msDS-LogonTimeSyncInterval is an int32_t number of days, while
>-	 * lastLogonTimestamp is in the 64 bit 100ns NTTIME format.
>-	 *
>-	 * The docs say: "the initial update, after the domain functional
>-	 * level is raised to DS_BEHAVIOR_WIN2003 or higher, is calculated as
>-	 * 14 days minus a random percentage of 5 days", but we aren't doing
>-	 * that. The blogosphere seems to think that this randomised update
>-	 * happens everytime, but [MS-ADA1] doesn't agree.
>-	 *
>-	 * Dochelp referred us to the following blog post:
>-	 * http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx
>-	 *
>-	 * en msDS-LogonTimeSyncInterval is zero, the lastLogonTimestamp is
>-	 * not changed.
>-	 */
> 	static const char *attrs[] = { "msDS-LogonTimeSyncInterval",
> 					NULL };
> 	int ret;
> 	struct ldb_result *domain_res = NULL;
> 	TALLOC_CTX *mem_ctx = NULL;
>-	int32_t sync_interval;
>-	NTTIME sync_interval_nt;
>+	uint32_t sync_interval;
> 
>-	mem_ctx = talloc_new(msg_mod);
>+	mem_ctx = talloc_new(ctx);
> 	if (mem_ctx == NULL) {
> 		return NT_STATUS_NO_MEMORY;
> 	}
>@@ -1296,15 +1292,7 @@ static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
> 						 "msDS-LogonTimeSyncInterval",
> 						 14);
> 	DEBUG(5, ("sync interval is %d\n", sync_interval));
>-	if (sync_interval == 0){
>-		/*
>-		 * Setting msDS-LogonTimeSyncInterval to zero is how you ask
>-		 * that nothing happens here.
>-		 */
>-		TALLOC_FREE(mem_ctx);
>-		return NT_STATUS_OK;
>-	}
>-	else if (sync_interval >= 5){
>+	if (sync_interval >= 5){
> 		/*
> 		 * Subtract "a random percentage of 5" days. Presumably this
> 		 * percentage is between 0 and 100, and modulus is accurate
>@@ -1312,17 +1300,47 @@ static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
> 		 */
> 		uint32_t r = generate_random() % 6;
> 		sync_interval -= r;
>-		DEBUG(5, ("randomised sync interval is %d (-%d)\n", sync_interval, r));
>+		DBG_INFO("randomised sync interval is %d (-%d)\n", sync_interval, r);
> 	}
> 	/* In the case where sync_interval < 5 there is no randomisation */
> 
>-	sync_interval_nt = sync_interval * 24LL * 3600LL * 10000000LL;
>+	/*
>+	 * msDS-LogonTimeSyncInterval is an int32_t number of days,
>+	 * while lastLogonTimestamp (to be updated) is in the 64 bit
>+	 * 100ns NTTIME format so we must convert.
>+	 */
>+	*sync_interval_nt = sync_interval * 24LL * 3600LL * 10000000LL;
>+	TALLOC_FREE(mem_ctx);
>+	return NT_STATUS_OK;
>+}
> 
>+
>+/*
>+ * We only set lastLogonTimestamp if the current value is older than
>+ * now - msDS-LogonTimeSyncInterval days.
>+ *
>+ * lastLogonTimestamp is in the 64 bit 100ns NTTIME format
>+ */
>+static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
>+						   struct ldb_message *msg_mod,
>+						   struct ldb_dn *domain_dn,
>+						   NTTIME old_timestamp,
>+						   NTTIME now,
>+						   NTTIME sync_interval_nt)
>+{
>+	int ret;
> 	DEBUG(5, ("old timestamp is %lld, threshold %lld, diff %lld\n",
> 		  (long long int)old_timestamp,
> 		  (long long int)(now - sync_interval_nt),
> 		  (long long int)(old_timestamp - now + sync_interval_nt)));
> 
>+	if (sync_interval_nt == 0){
>+		/*
>+		 * Setting msDS-LogonTimeSyncInterval to zero is how you ask
>+		 * that nothing happens here.
>+		 */
>+		return NT_STATUS_OK;
>+	}
> 	if (old_timestamp > now){
> 		DEBUG(0, ("lastLogonTimestamp is in the future! (%lld > %lld)\n",
> 			  (long long int)old_timestamp, (long long int)now));
>@@ -1337,11 +1355,9 @@ static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
> 					  "lastLogonTimestamp", now);
> 
> 		if (ret != LDB_SUCCESS) {
>-			TALLOC_FREE(mem_ctx);
> 			return NT_STATUS_NO_MEMORY;
> 		}
> 	}
>-	TALLOC_FREE(mem_ctx);
> 	return NT_STATUS_OK;
> }
> 
>@@ -1550,8 +1566,23 @@ get_transaction:
> 	}
> 
> 	if (!am_rodc) {
>-		status = authsam_update_lastlogon_timestamp(sam_ctx, msg_mod, domain_dn,
>-							    lastLogonTimestamp, now);
>+		NTTIME sync_interval_nt;
>+
>+		status = authsam_calculate_lastlogon_sync_interval(
>+			sam_ctx, mem_ctx, domain_dn, &sync_interval_nt);
>+
>+		if (!NT_STATUS_IS_OK(status)) {
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
>+		}
>+
>+		status = authsam_update_lastlogon_timestamp(
>+			sam_ctx,
>+			msg_mod,
>+			domain_dn,
>+			lastLogonTimestamp,
>+			now,
>+			sync_interval_nt);
> 		if (!NT_STATUS_IS_OK(status)) {
> 			status = NT_STATUS_NO_MEMORY;
> 			goto error;
>-- 
>2.35.0
>
>
>From d786bb01fd928196b5f60bbaf12caff813d3ebc3 Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Thu, 25 Mar 2021 15:33:08 +1300
>Subject: [PATCH 20/40] CVE-2021-20251 auth4: Inline
> samdb_result_effective_badPwdCount() in authsam_logon_success_accounting()
>
>By bringing this function inline it can then be split out in a
>subsequent commit.
>
>Based on work by Gary Lockyer <gary@catalyst.net.nz>
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/auth/sam.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index 71c6fecb244..e754849d214 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -1479,11 +1479,17 @@ get_transaction:
> 
> 	lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0);
> 	dbBadPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0);
>+	tv_now = timeval_current();
>+	now = timeval_to_nttime(&tv_now);
>+
> 	if (interactive_or_kerberos) {
> 		badPwdCount = dbBadPwdCount;
> 	} else {
>-		badPwdCount = samdb_result_effective_badPwdCount(sam_ctx, mem_ctx,
>-								 domain_dn, msg);
>+		int64_t lockOutObservationWindow =
>+			samdb_result_msds_LockoutObservationWindow(
>+				sam_ctx, mem_ctx, domain_dn, msg);
>+		badPwdCount = dsdb_effective_badPwdCount(
>+			msg, lockOutObservationWindow, now);
> 	}
> 	lastLogonTimestamp =
> 		ldb_msg_find_attr_as_int64(msg, "lastLogonTimestamp", 0);
>@@ -1521,9 +1527,6 @@ get_transaction:
> 		}
> 	}
> 
>-	tv_now = timeval_current();
>-	now = timeval_to_nttime(&tv_now);
>-
> 	if (interactive_or_kerberos ||
> 	    (badPwdCount != 0 && lockoutTime == 0)) {
> 		ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod,
>-- 
>2.35.0
>
>
>From 39daefbabf03bc2d548ec96fa2d86cdaa6b6b5aa Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 30 Mar 2021 16:48:31 +1300
>Subject: [PATCH 21/40] CVE-2021-20251 auth4: Avoid reading the database twice
> by precaculating some variables
>
>These variables are not important to protect against a race with
>and a double-read can easily be avoided by moving them up the file
>a little.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> selftest/knownfail.d/auth-sam | 12 --------
> source4/auth/sam.c            | 55 +++++++++++++++++++++++------------
> 2 files changed, 36 insertions(+), 31 deletions(-)
> delete mode 100644 selftest/knownfail.d/auth-sam
>
>diff --git a/selftest/knownfail.d/auth-sam b/selftest/knownfail.d/auth-sam
>deleted file mode 100644
>index 438cea46415..00000000000
>--- a/selftest/knownfail.d/auth-sam
>+++ /dev/null
>@@ -1,12 +0,0 @@
>-^samba.unittests.auth.sam.test_success_accounting_add_control_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_build_mod_req_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_commit_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_ldb_msg_new_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_ldb_request_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_ldb_wait_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_reread_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_rollback_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_samdb_rodc_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_spurious_bad_pwd_indicator.none
>-^samba.unittests.auth.sam.test_success_accounting_start_txn_failed.none
>-^samba.unittests.auth.sam.test_success_accounting_update_lastlogon_failed.none
>diff --git a/source4/auth/sam.c b/source4/auth/sam.c
>index e754849d214..c52d6f425fa 100644
>--- a/source4/auth/sam.c
>+++ b/source4/auth/sam.c
>@@ -1408,6 +1408,8 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 	struct timeval tv_now;
> 	NTTIME now;
> 	NTTIME lastLogonTimestamp;
>+	int64_t lockOutObservationWindow;
>+	NTTIME sync_interval_nt = 0;
> 	bool am_rodc = false;
> 	bool txn_active = false;
> 	bool need_db_reread;
>@@ -1436,6 +1438,36 @@ NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
> 		return status;
> 	}
> 
>+	if (interactive_or_kerberos == false) {
>+		/*
>+		 * Avoid calculating this twice, it reads the PSO.  A
>+		 * race on this is unimportant.
>+		 */
>+		lockOutObservationWindow
>+			= samdb_result_msds_LockoutObservationWindow(
>+				sam_ctx, mem_ctx, domain_dn, msg);
>+	}
>+
>+	ret = samdb_rodc(sam_ctx, &am_rodc);
>+	if (ret != LDB_SUCCESS) {
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto error;
>+	}
>+
>+	if (!am_rodc) {
>+		/*
>+		 * Avoid reading the main domain DN twice.  A race on
>+		 * this is unimportant.
>+		 */
>+		status = authsam_calculate_lastlogon_sync_interval(
>+			sam_ctx, mem_ctx, domain_dn, &sync_interval_nt);
>+
>+		if (!NT_STATUS_IS_OK(status)) {
>+			status = NT_STATUS_INTERNAL_ERROR;
>+			goto error;
>+		}
>+	}
>+
> get_transaction:
> 
> 	if (need_db_reread) {
>@@ -1485,9 +1517,10 @@ get_transaction:
> 	if (interactive_or_kerberos) {
> 		badPwdCount = dbBadPwdCount;
> 	} else {
>-		int64_t lockOutObservationWindow =
>-			samdb_result_msds_LockoutObservationWindow(
>-				sam_ctx, mem_ctx, domain_dn, msg);
>+		/*
>+		 * We get lockOutObservationWindow above, before the
>+		 * transaction
>+		 */
> 		badPwdCount = dsdb_effective_badPwdCount(
> 			msg, lockOutObservationWindow, now);
> 	}
>@@ -1562,23 +1595,7 @@ get_transaction:
> 		}
> 	}
> 
>-	ret = samdb_rodc(sam_ctx, &am_rodc);
>-	if (ret != LDB_SUCCESS) {
>-		status = NT_STATUS_INTERNAL_ERROR;
>-		goto error;
>-	}
>-
> 	if (!am_rodc) {
>-		NTTIME sync_interval_nt;
>-
>-		status = authsam_calculate_lastlogon_sync_interval(
>-			sam_ctx, mem_ctx, domain_dn, &sync_interval_nt);
>-
>-		if (!NT_STATUS_IS_OK(status)) {
>-			status = NT_STATUS_INTERNAL_ERROR;
>-			goto error;
>-		}
>-
> 		status = authsam_update_lastlogon_timestamp(
> 			sam_ctx,
> 			msg_mod,
>-- 
>2.35.0
>
>
>From afd2f89dca9a2b6099facf249882d42f46757ed0 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Sat, 9 Jul 2022 15:53:51 +1200
>Subject: [PATCH 22/40] CVE-2021-20251 s4-auth: Pass through error code from
> badPwdCount update
>
>The error code may be NT_STATUS_ACCOUNT_LOCKED_OUT, which we use in
>preference to NT_STATUS_WRONG_PASSWORD.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> selftest/knownfail_heimdal_kdc | 1 -
> selftest/knownfail_mit_kdc     | 1 -
> source4/auth/ntlm/auth_sam.c   | 6 +++++-
> 3 files changed, 5 insertions(+), 3 deletions(-)
>
>diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
>index c0335bf4b52..eefa125b70f 100644
>--- a/selftest/knownfail_heimdal_kdc
>+++ b/selftest/knownfail_heimdal_kdc
>@@ -58,4 +58,3 @@
> # Lockout tests
> #
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ntlm.ad_dc:local
>diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc
>index 0af1f02142d..9b6baa4bd71 100644
>--- a/selftest/knownfail_mit_kdc
>+++ b/selftest/knownfail_mit_kdc
>@@ -445,7 +445,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_kdc.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_bad_pwd_count_transaction_rename_kdc.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ntlm.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_transaction_bad_pwd_kdc.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_transaction_kdc.ad_dc:local
> ^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_transaction_rename_kdc.ad_dc:local
>diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c
>index 1077762c70e..882d92e26ed 100644
>--- a/source4/auth/ntlm/auth_sam.c
>+++ b/source4/auth/ntlm/auth_sam.c
>@@ -716,7 +716,11 @@ static NTSTATUS authsam_password_check_and_record(struct auth4_context *auth_con
> 	}
> 
> 	TALLOC_FREE(tmp_ctx);
>-	return NT_STATUS_WRONG_PASSWORD;
>+
>+	if (NT_STATUS_IS_OK(nt_status)) {
>+		nt_status = NT_STATUS_WRONG_PASSWORD;
>+	}
>+	return nt_status;
> }
> 
> static NTSTATUS authsam_authenticate(struct auth4_context *auth_context,
>-- 
>2.35.0
>
>
>From 25137766a8fd87b45faf987ac7b72a7a4130ebf9 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Sat, 9 Jul 2022 15:44:21 +1200
>Subject: [PATCH 23/40] CVE-2021-20251 s4:dsdb: Update bad password count
> inside transaction
>
>Previously, there was a gap between calling dsdb_update_bad_pwd_count()
>and dsdb_module_modify() where no transaction was in effect. Another
>process could slip in and modify badPwdCount, only for our update to
>immediately overwrite it. Doing the update inside the transaction will
>help for the following commit when we make it atomic.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> .../dsdb/samdb/ldb_modules/password_hash.c    | 37 ++++++++++---------
> 1 file changed, 19 insertions(+), 18 deletions(-)
>
>diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
>index e90482df63e..b9f7fb77e6f 100644
>--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
>+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
>@@ -2733,24 +2733,6 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io
> 	int ret; /* The errors we will actually return */
> 	int dbg_ret; /* The errors we can only complain about in logs */
> 
>-	/* PSO search result is optional (NULL if no PSO applies) */
>-	if (io->ac->pso_res != NULL) {
>-		pso_msg = io->ac->pso_res->message;
>-	}
>-
>-	status = dsdb_update_bad_pwd_count(io->ac, ldb,
>-					   io->ac->search_res->message,
>-					   io->ac->dom_res->message,
>-					   pso_msg,
>-					   &mod_msg);
>-	if (!NT_STATUS_IS_OK(status)) {
>-		goto done;
>-	}
>-
>-	if (mod_msg == NULL) {
>-		goto done;
>-	}
>-
> 	/*
> 	 * OK, horrible semantics ahead.
> 	 *
>@@ -2793,6 +2775,24 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io
> 		goto done;
> 	}
> 
>+	/* PSO search result is optional (NULL if no PSO applies) */
>+	if (io->ac->pso_res != NULL) {
>+		pso_msg = io->ac->pso_res->message;
>+	}
>+
>+	status = dsdb_update_bad_pwd_count(io->ac, ldb,
>+					   io->ac->search_res->message,
>+					   io->ac->dom_res->message,
>+					   pso_msg,
>+					   &mod_msg);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		goto end_transaction;
>+	}
>+
>+	if (mod_msg == NULL) {
>+		goto end_transaction;
>+	}
>+
> 	dbg_ret = dsdb_module_modify(io->ac->module, mod_msg,
> 				 DSDB_FLAG_NEXT_MODULE,
> 				 io->ac->req);
>@@ -2806,6 +2806,7 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io
> 		 */
> 	}
> 
>+end_transaction:
> 	dbg_ret = ldb_next_end_trans(io->ac->module);
> 	if (dbg_ret != LDB_SUCCESS) {
> 		ldb_debug(ldb, LDB_DEBUG_ERROR,
>-- 
>2.35.0
>
>
>From cdd041382214a4467e29a3ad517b09c9995b8319 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Sat, 9 Jul 2022 15:54:12 +1200
>Subject: [PATCH 24/40] CVE-2021-20251 s4:dsdb: Make badPwdCount update atomic
>
>We reread the account details inside the transaction in case the account
>has been locked out in the meantime. If it has, we return the
>appropriate error code.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> selftest/flapping.d/ldap-pwd-change-race      |  5 ----
> .../dsdb/samdb/ldb_modules/password_hash.c    | 27 ++++++++++++++++---
> 2 files changed, 24 insertions(+), 8 deletions(-)
> delete mode 100644 selftest/flapping.d/ldap-pwd-change-race
>
>diff --git a/selftest/flapping.d/ldap-pwd-change-race b/selftest/flapping.d/ldap-pwd-change-race
>deleted file mode 100644
>index 54ed56c1134..00000000000
>--- a/selftest/flapping.d/ldap-pwd-change-race
>+++ /dev/null
>@@ -1,5 +0,0 @@
>-# This test currently depends on a race. The password_hash dsdb module
>-# relinquishes and immediately reacquires a transaction lock, and another
>-# process may be able to acquire it during the short period of time in which it
>-# is not held.
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_ldap_pw_change.ad_dc:local
>diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
>index b9f7fb77e6f..b308226a9f9 100644
>--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
>+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
>@@ -45,6 +45,7 @@
> #include "lib/crypto/md4.h"
> #include "param/param.h"
> #include "lib/krb5_wrap/krb5_samba.h"
>+#include "auth/auth_sam.h"
> #include "auth/common_auth.h"
> #include "lib/messaging/messaging.h"
> #include "lib/param/loadparm.h"
>@@ -2729,7 +2730,8 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io
> 	struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
> 	struct ldb_message *mod_msg = NULL;
> 	struct ldb_message *pso_msg = NULL;
>-	NTSTATUS status;
>+	struct ldb_message *current = NULL;
>+	NTSTATUS status = NT_STATUS_OK;
> 	int ret; /* The errors we will actually return */
> 	int dbg_ret; /* The errors we can only complain about in logs */
> 
>@@ -2775,13 +2777,28 @@ static int make_error_and_update_badPwdCount(struct setup_password_fields_io *io
> 		goto done;
> 	}
> 
>+	/*
>+	 * Re-read the account details, using the GUID in case the DN
>+	 * is being changed.
>+	 */
>+	status = authsam_reread_user_logon_data(
>+		ldb, io->ac,
>+		io->ac->search_res->message,
>+		&current);
>+	if (!NT_STATUS_IS_OK(status)) {
>+		/* The re-read can return account locked out, as well
>+		 * as an internal error
>+		 */
>+		goto end_transaction;
>+	}
>+
> 	/* PSO search result is optional (NULL if no PSO applies) */
> 	if (io->ac->pso_res != NULL) {
> 		pso_msg = io->ac->pso_res->message;
> 	}
> 
> 	status = dsdb_update_bad_pwd_count(io->ac, ldb,
>-					   io->ac->search_res->message,
>+					   current,
> 					   io->ac->dom_res->message,
> 					   pso_msg,
> 					   &mod_msg);
>@@ -2831,7 +2848,11 @@ end_transaction:
> 
> done:
> 	ret = LDB_ERR_CONSTRAINT_VIOLATION;
>-	*werror = WERR_INVALID_PASSWORD;
>+	if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
>+		*werror = WERR_ACCOUNT_LOCKED_OUT;
>+	} else {
>+		*werror = WERR_INVALID_PASSWORD;
>+	}
> 	ldb_asprintf_errstring(ldb,
> 			       "%08X: %s - check_password_restrictions: "
> 			       "The old password specified doesn't match!",
>-- 
>2.35.0
>
>
>From 32fd4f1e04d3b7b828bee0370d8a45c68c3300fb Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Wed, 6 Jul 2022 11:11:43 +1200
>Subject: [PATCH 25/40] CVE-2021-20251 s4:kdc: Move logon success accounting
> code into existing branch
>
>This simplifies the code for the following commit.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/kdc/hdb-samba4.c | 33 +++++++++++++--------------------
> 1 file changed, 13 insertions(+), 20 deletions(-)
>
>diff --git a/source4/kdc/hdb-samba4.c b/source4/kdc/hdb-samba4.c
>index 13c3a8bd265..dcfbb07f9fb 100644
>--- a/source4/kdc/hdb-samba4.c
>+++ b/source4/kdc/hdb-samba4.c
>@@ -601,26 +601,6 @@ static krb5_error_code hdb_samba4_audit(krb5_context context,
> 	}
> 
> 	switch (hdb_auth_status) {
>-	case KDC_AUTH_EVENT_CLIENT_AUTHORIZED:
>-	{
>-		TALLOC_CTX *frame = talloc_stackframe();
>-		struct samba_kdc_entry *p = talloc_get_type(entry->context,
>-							    struct samba_kdc_entry);
>-		struct netr_SendToSamBase *send_to_sam = NULL;
>-
>-		/*
>-		 * TODO: We could log the AS-REQ authorization success here as
>-		 * well.  However before we do that, we need to pass
>-		 * in the PAC here or re-calculate it.
>-		 */
>-		authsam_logon_success_accounting(kdc_db_ctx->samdb, p->msg,
>-						 domain_dn, true, &send_to_sam);
>-		if (kdc_db_ctx->rodc && send_to_sam != NULL) {
>-			reset_bad_password_netlogon(frame, kdc_db_ctx, send_to_sam);
>-		}
>-		talloc_free(frame);
>-	}
>-	FALL_THROUGH;
> 	default:
> 	{
> 		TALLOC_CTX *frame = talloc_stackframe();
>@@ -662,6 +642,19 @@ static krb5_error_code hdb_samba4_audit(krb5_context context,
> 		ui.auth_description = auth_description;
> 
> 		if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_AUTHORIZED) {
>+			struct netr_SendToSamBase *send_to_sam = NULL;
>+
>+			/*
>+			 * TODO: We could log the AS-REQ authorization success here as
>+			 * well.  However before we do that, we need to pass
>+			 * in the PAC here or re-calculate it.
>+			 */
>+			authsam_logon_success_accounting(kdc_db_ctx->samdb, p->msg,
>+							 domain_dn, true, &send_to_sam);
>+			if (kdc_db_ctx->rodc && send_to_sam != NULL) {
>+				reset_bad_password_netlogon(frame, kdc_db_ctx, send_to_sam);
>+			}
>+
> 			/* This is the final sucess */
> 			status = NT_STATUS_OK;
> 		} else if (hdb_auth_status == KDC_AUTH_EVENT_VALIDATED_LONG_TERM_KEY) {
>-- 
>2.35.0
>
>
>From d6d0abeb0741422f2ac2fdae322de7ea986e046e Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Fri, 1 Jul 2022 15:04:41 +1200
>Subject: [PATCH 26/40] CVE-2021-20251 s4:kdc: Check return status of
> authsam_logon_success_accounting()
>
>If we find that the user has been locked out sometime during the request
>(due to a race), we will now return an error code.
>
>Note that we cannot avoid the MIT KDC aspect of the issue by checking
>the return status of mit_samba_zero_bad_password_count(), because
>kdb_vftabl::audit_as_req() returning void means we cannot pass on the
>result.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/kdc/hdb-samba4.c | 15 +++++++++++----
> 1 file changed, 11 insertions(+), 4 deletions(-)
>
>diff --git a/source4/kdc/hdb-samba4.c b/source4/kdc/hdb-samba4.c
>index dcfbb07f9fb..7ac5842bc4d 100644
>--- a/source4/kdc/hdb-samba4.c
>+++ b/source4/kdc/hdb-samba4.c
>@@ -649,14 +649,21 @@ static krb5_error_code hdb_samba4_audit(krb5_context context,
> 			 * well.  However before we do that, we need to pass
> 			 * in the PAC here or re-calculate it.
> 			 */
>-			authsam_logon_success_accounting(kdc_db_ctx->samdb, p->msg,
>-							 domain_dn, true, &send_to_sam);
>-			if (kdc_db_ctx->rodc && send_to_sam != NULL) {
>+			status = authsam_logon_success_accounting(kdc_db_ctx->samdb, p->msg,
>+								  domain_dn, true, &send_to_sam);
>+			if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
>+				final_ret = KRB5KDC_ERR_CLIENT_REVOKED;
>+				r->error_code = final_ret;
>+				rwdc_fallback = kdc_db_ctx->rodc;
>+			} else if (!NT_STATUS_IS_OK(status)) {
>+				final_ret = KRB5KRB_ERR_GENERIC;
>+				r->error_code = final_ret;
>+				rwdc_fallback = kdc_db_ctx->rodc;
>+			} else if (kdc_db_ctx->rodc && send_to_sam != NULL) {
> 				reset_bad_password_netlogon(frame, kdc_db_ctx, send_to_sam);
> 			}
> 
> 			/* This is the final sucess */
>-			status = NT_STATUS_OK;
> 		} else if (hdb_auth_status == KDC_AUTH_EVENT_VALIDATED_LONG_TERM_KEY) {
> 			/*
> 			 * This was only a pre-authentication success,
>-- 
>2.35.0
>
>
>From d4f01f1bb0c4b366383f399c4827801378fe20e1 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Sat, 9 Jul 2022 15:54:52 +1200
>Subject: [PATCH 27/40] CVE-2021-20251 s4:kdc: Check badPwdCount update return
> status
>
>If the account has been locked out in the meantime (indicated by
>NT_STATUS_ACCOUNT_LOCKED_OUT), we should return the appropriate error
>code.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> selftest/knownfail_heimdal_kdc | 4 ----
> source4/kdc/hdb-samba4.c       | 9 +++++++--
> 2 files changed, 7 insertions(+), 6 deletions(-)
>
>diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
>index eefa125b70f..4ae27eacb09 100644
>--- a/selftest/knownfail_heimdal_kdc
>+++ b/selftest/knownfail_heimdal_kdc
>@@ -54,7 +54,3 @@
> ^samba.tests.krb5.protected_users_tests.samba.tests.krb5.protected_users_tests.ProtectedUsersTests.test_proxiable_as_protected.ad_dc
> #
> ^samba.tests.krb5.protected_users_tests.samba.tests.krb5.protected_users_tests.ProtectedUsersTests.test_samr_change_password_protected.ad_dc
>-#
>-# Lockout tests
>-#
>-^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local
>diff --git a/source4/kdc/hdb-samba4.c b/source4/kdc/hdb-samba4.c
>index 7ac5842bc4d..96bb3d858f0 100644
>--- a/source4/kdc/hdb-samba4.c
>+++ b/source4/kdc/hdb-samba4.c
>@@ -703,8 +703,13 @@ static krb5_error_code hdb_samba4_audit(krb5_context context,
> 		} else if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_TIME_SKEW) {
> 			status = NT_STATUS_TIME_DIFFERENCE_AT_DC;
> 		} else if (hdb_auth_status == KDC_AUTH_EVENT_WRONG_LONG_TERM_KEY) {
>-			authsam_update_bad_pwd_count(kdc_db_ctx->samdb, p->msg, domain_dn);
>-			status = NT_STATUS_WRONG_PASSWORD;
>+			status = authsam_update_bad_pwd_count(kdc_db_ctx->samdb, p->msg, domain_dn);
>+			if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
>+				final_ret = KRB5KDC_ERR_CLIENT_REVOKED;
>+				r->error_code = final_ret;
>+			} else {
>+				status = NT_STATUS_WRONG_PASSWORD;
>+			}
> 			rwdc_fallback = kdc_db_ctx->rodc;
> 		} else if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_LOCKED_OUT) {
> 			status = NT_STATUS_ACCOUNT_LOCKED_OUT;
>-- 
>2.35.0
>
>
>From 05c4096e62bb6c4ff5028c139a181bba5aa59150 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Sat, 9 Jul 2022 15:55:02 +1200
>Subject: [PATCH 28/40] CVE-2021-20251 s4-rpc_server: Check badPwdCount update
> return status
>
>If the account has been locked out in the meantime (indicated by
>NT_STATUS_ACCOUNT_LOCKED_OUT), we should return the appropriate error
>code.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/rpc_server/samr/samr_password.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
>index 09d7501d474..e55d5c28b5c 100644
>--- a/source4/rpc_server/samr/samr_password.c
>+++ b/source4/rpc_server/samr/samr_password.c
>@@ -485,7 +485,11 @@ failed:
> 
> 	/* Only update the badPwdCount if we found the user */
> 	if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
>-		authsam_update_bad_pwd_count(sam_ctx, msg, ldb_get_default_basedn(sam_ctx));
>+		NTSTATUS bad_pwd_status = authsam_update_bad_pwd_count(
>+			sam_ctx, msg, ldb_get_default_basedn(sam_ctx));
>+		if (NT_STATUS_EQUAL(bad_pwd_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
>+			status = bad_pwd_status;
>+		}
> 	} else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
> 		/* Don't give the game away:  (don't allow anonymous users to prove the existence of usernames) */
> 		status = NT_STATUS_WRONG_PASSWORD;
>-- 
>2.35.0
>
>
>From ab3e651fe410207e2e34cdcd85dad8f4be6e829c Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Mon, 4 Jul 2022 20:51:38 +1200
>Subject: [PATCH 29/40] CVE-2021-20251 s4:auth_winbind: Check return status of
> authsam_logon_success_accounting()
>
>This may return an error if we find the account is locked out.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/auth/ntlm/auth_winbind.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
>diff --git a/source4/auth/ntlm/auth_winbind.c b/source4/auth/ntlm/auth_winbind.c
>index d7879966603..6381f866667 100644
>--- a/source4/auth/ntlm/auth_winbind.c
>+++ b/source4/auth/ntlm/auth_winbind.c
>@@ -252,11 +252,14 @@ static void winbind_check_password_done(struct tevent_req *subreq)
> 		status = authsam_search_account(state, ctx->auth_ctx->sam_ctx,
> 						nt4_account, domain_dn, &msg);
> 		if (NT_STATUS_IS_OK(status)) {
>-			authsam_logon_success_accounting(
>+			status = authsam_logon_success_accounting(
> 				ctx->auth_ctx->sam_ctx, msg,
> 				domain_dn,
> 				user_info->flags & USER_INFO_INTERACTIVE_LOGON,
> 				NULL);
>+			if (tevent_req_nterror(req, status)) {
>+				return;
>+			}
> 		}
> 	}
> 
>-- 
>2.35.0
>
>
>From 9c862497f56138556b1246df38cccbb37d1d8b48 Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Mon, 11 Jan 2021 12:11:35 -0800
>Subject: [PATCH 30/40] CVE-2021-20251 s3: ensure bad password count atomic
> updates
>
>The bad password count is supposed to limit the number of failed login
>attempt a user can make before being temporarily locked out, but race
>conditions between processes have allowed determined attackers to make
>many more than the specified number of attempts.  This is especially
>bad on constrained or overcommitted hardware.
>
>To fix this, once a bad password is detected, we reload the sam account
>information under a user-specific mutex, ensuring we have an up to
>date bad password count.
>
>Discovered by Nathaniel W. Turner.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source3/auth/check_samsec.c | 77 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 77 insertions(+)
>
>diff --git a/source3/auth/check_samsec.c b/source3/auth/check_samsec.c
>index b9563c958a9..bd8ca8de2f0 100644
>--- a/source3/auth/check_samsec.c
>+++ b/source3/auth/check_samsec.c
>@@ -379,6 +379,8 @@ NTSTATUS check_sam_security(const DATA_BLOB *challenge,
> 	const uint8_t *nt_pw;
> 	const uint8_t *lm_pw;
> 	uint32_t acct_ctrl;
>+	char *mutex_name_by_user = NULL;
>+	struct named_mutex *mtx = NULL;
> 
> 	/* the returned struct gets kept on the server_info, by means
> 	   of a steal further down */
>@@ -418,6 +420,79 @@ NTSTATUS check_sam_security(const DATA_BLOB *challenge,
> 				    challenge, lm_pw, nt_pw,
> 				    user_info, &user_sess_key, &lm_sess_key);
> 
>+	/*
>+	 * We must re-load the sam acount information under a mutex
>+	 * lock to ensure we don't miss any concurrent account lockout
>+	 * changes.
>+	 */
>+
>+	/* Clear out old sampass info. */
>+	TALLOC_FREE(sampass);
>+	acct_ctrl = 0;
>+	username = NULL;
>+	nt_pw = NULL;
>+	lm_pw = NULL;
>+
>+	sampass = samu_new(mem_ctx);
>+	if (sampass == NULL) {
>+		return NT_STATUS_NO_MEMORY;
>+	}
>+
>+	mutex_name_by_user = talloc_asprintf(mem_ctx,
>+					     "check_sam_security_mutex_%s",
>+					     user_info->mapped.account_name);
>+	if (mutex_name_by_user == NULL) {
>+		nt_status = NT_STATUS_NO_MEMORY;
>+		goto done;
>+	}
>+
>+	/* Grab the named mutex under root with 30 second timeout. */
>+	become_root();
>+	mtx = grab_named_mutex(mem_ctx, mutex_name_by_user, 30);
>+	if (mtx != NULL) {
>+		/* Re-load the account information if we got the mutex. */
>+		ret = pdb_getsampwnam(sampass, user_info->mapped.account_name);
>+	}
>+	unbecome_root();
>+
>+	/* Everything from here on until mtx is freed is done under the mutex.*/
>+
>+	if (mtx == NULL) {
>+		DBG_ERR("Acquisition of mutex %s failed "
>+			"for user %s\n",
>+			mutex_name_by_user,
>+			user_info->mapped.account_name);
>+		nt_status = NT_STATUS_INTERNAL_ERROR;
>+		goto done;
>+	}
>+
>+	if (!ret) {
>+		/*
>+		 * Re-load of account failed. This could only happen if the
>+		 * user was deleted in the meantime.
>+		 */
>+		DBG_NOTICE("reload of user '%s' in passdb failed.\n",
>+			   user_info->mapped.account_name);
>+		nt_status = NT_STATUS_NO_SUCH_USER;
>+		goto done;
>+	}
>+
>+	/* Re-load the account control info. */
>+	acct_ctrl = pdb_get_acct_ctrl(sampass);
>+	username = pdb_get_username(sampass);
>+
>+	/*
>+	 * Check if the account is now locked out - now under the mutex.
>+	 * This can happen if the server is under
>+	 * a password guess attack and the ACB_AUTOLOCK is set by
>+	 * another process.
>+	 */
>+	if (acct_ctrl & ACB_AUTOLOCK) {
>+		DBG_NOTICE("Account for user %s was locked out.\n", username);
>+		nt_status = NT_STATUS_ACCOUNT_LOCKED_OUT;
>+		goto done;
>+	}
>+
> 	/* Notify passdb backend of login success/failure. If not
> 	   NT_STATUS_OK the backend doesn't like the login */
> 
>@@ -510,6 +585,8 @@ done:
> 	TALLOC_FREE(sampass);
> 	data_blob_free(&user_sess_key);
> 	data_blob_free(&lm_sess_key);
>+	TALLOC_FREE(mutex_name_by_user);
>+	TALLOC_FREE(mtx);
> 	return nt_status;
> }
> 
>-- 
>2.35.0
>
>
>From b5adc6e51ce2448242019c26bb284d1df8df35c6 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 5 Jul 2022 20:17:33 +1200
>Subject: [PATCH 31/40] CVE-2021-20251 s3: Ensure bad password count atomic
> updates for SAMR password change
>
>The bad password count is supposed to limit the number of failed login
>attempt a user can make before being temporarily locked out, but race
>conditions between processes have allowed determined attackers to make
>many more than the specified number of attempts.  This is especially
>bad on constrained or overcommitted hardware.
>
>To fix this, once a bad password is detected, we reload the sam account
>information under a user-specific mutex, ensuring we have an up to
>date bad password count.
>
>Derived from a similar patch to source3/auth/check_samsec.c by
>Jeremy Allison <jra@samba.org>
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source3/rpc_server/samr/srv_samr_chgpasswd.c | 81 ++++++++++++++++++--
> 1 file changed, 75 insertions(+), 6 deletions(-)
>
>diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c
>index f1d833a630c..9662284eac6 100644
>--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c
>+++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c
>@@ -1205,6 +1205,8 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 	bool ret = false;
> 	bool updated_badpw = false;
> 	NTSTATUS update_login_attempts_status;
>+	char *mutex_name_by_user = NULL;
>+	struct named_mutex *mtx = NULL;
> 
> 	if (!(sampass = samu_new(NULL))) {
> 		return NT_STATUS_NO_MEMORY;
>@@ -1216,15 +1218,15 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 
> 	if (ret == false) {
> 		DEBUG(0,("pass_oem_change: getsmbpwnam returned NULL\n"));
>-		TALLOC_FREE(sampass);
>-		return NT_STATUS_NO_SUCH_USER;
>+		nt_status = NT_STATUS_NO_SUCH_USER;
>+		goto done;
> 	}
> 
> 	/* Quit if the account was locked out. */
> 	if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
> 		DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", user));
>-		TALLOC_FREE(sampass);
>-		return NT_STATUS_ACCOUNT_LOCKED_OUT;
>+		nt_status = NT_STATUS_ACCOUNT_LOCKED_OUT;
>+		goto done;
> 	}
> 
> 	nt_status = check_oem_password(user,
>@@ -1235,6 +1237,71 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 				       sampass,
> 				       &new_passwd);
> 
>+	/*
>+	 * We must re-load the sam acount information under a mutex
>+	 * lock to ensure we don't miss any concurrent account lockout
>+	 * changes.
>+	 */
>+
>+	/* Clear out old sampass info. */
>+	TALLOC_FREE(sampass);
>+
>+	sampass = samu_new(NULL);
>+	if (sampass == NULL) {
>+		return NT_STATUS_NO_MEMORY;
>+	}
>+
>+	mutex_name_by_user = talloc_asprintf(NULL,
>+					     "check_sam_security_mutex_%s",
>+					     user);
>+	if (mutex_name_by_user == NULL) {
>+		nt_status = NT_STATUS_NO_MEMORY;
>+		goto done;
>+	}
>+
>+	/* Grab the named mutex under root with 30 second timeout. */
>+	become_root();
>+	mtx = grab_named_mutex(NULL, mutex_name_by_user, 30);
>+	if (mtx != NULL) {
>+		/* Re-load the account information if we got the mutex. */
>+		ret = pdb_getsampwnam(sampass, user);
>+	}
>+	unbecome_root();
>+
>+	/* Everything from here on until mtx is freed is done under the mutex.*/
>+
>+	if (mtx == NULL) {
>+		DBG_ERR("Acquisition of mutex %s failed "
>+			"for user %s\n",
>+			mutex_name_by_user,
>+			user);
>+		nt_status = NT_STATUS_INTERNAL_ERROR;
>+		goto done;
>+	}
>+
>+	if (!ret) {
>+		/*
>+		 * Re-load of account failed. This could only happen if the
>+		 * user was deleted in the meantime.
>+		 */
>+		DBG_NOTICE("reload of user '%s' in passdb failed.\n",
>+			   user);
>+		nt_status = NT_STATUS_NO_SUCH_USER;
>+		goto done;
>+	}
>+
>+	/*
>+	 * Check if the account is now locked out - now under the mutex.
>+	 * This can happen if the server is under
>+	 * a password guess attack and the ACB_AUTOLOCK is set by
>+	 * another process.
>+	 */
>+	if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
>+		DBG_NOTICE("Account for user %s was locked out.\n", user);
>+		nt_status = NT_STATUS_ACCOUNT_LOCKED_OUT;
>+		goto done;
>+	}
>+
> 	/*
> 	 * Notify passdb backend of login success/failure. If not
> 	 * NT_STATUS_OK the backend doesn't like the login
>@@ -1282,8 +1349,7 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 	}
> 
> 	if (!NT_STATUS_IS_OK(nt_status)) {
>-		TALLOC_FREE(sampass);
>-		return nt_status;
>+		goto done;
> 	}
> 
> 	/* We've already checked the old password here.... */
>@@ -1294,7 +1360,10 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 
> 	memset(new_passwd, 0, strlen(new_passwd));
> 
>+done:
> 	TALLOC_FREE(sampass);
>+	TALLOC_FREE(mutex_name_by_user);
>+	TALLOC_FREE(mtx);
> 
> 	return nt_status;
> }
>-- 
>2.35.0
>
>
>From a211685da745c2f32c9f3ef90af24fca826bbdef Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:35:33 +1200
>Subject: [PATCH 32/40] lib:util: Check memset_s() error code in
> talloc_keep_secret_destructor()
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> lib/util/talloc_keep_secret.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
>diff --git a/lib/util/talloc_keep_secret.c b/lib/util/talloc_keep_secret.c
>index 70d449b5f12..00956d6b56d 100644
>--- a/lib/util/talloc_keep_secret.c
>+++ b/lib/util/talloc_keep_secret.c
>@@ -28,9 +28,7 @@ static int talloc_keep_secret_destructor(void *ptr)
> 		return 0;
> 	}
> 
>-	memset_s(ptr, size, 0, size);
>-
>-	return 0;
>+	return memset_s(ptr, size, 0, size);
> }
> 
> void _talloc_keep_secret(void *ptr, const char *name)
>-- 
>2.35.0
>
>
>From 3c339bfb8fca0966b5af17f0f53f917229e0d2fc Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:35:50 +1200
>Subject: [PATCH 33/40] libcli:auth: Keep passwords from
> convert_string_talloc() secret
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> libcli/auth/smbencrypt.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c
>index 7abf6613d80..8492202ea93 100644
>--- a/libcli/auth/smbencrypt.c
>+++ b/libcli/auth/smbencrypt.c
>@@ -975,6 +975,7 @@ bool decode_pw_buffer(TALLOC_CTX *ctx,
> 		DBG_ERR("Failed to convert incoming password\n");
> 		return false;
> 	}
>+	talloc_keep_secret(*pp_new_pwrd);
> 
> #ifdef DEBUG_PASSWORD
> 	DEBUG(100,("decode_pw_buffer: new_pwrd: "));
>@@ -1067,6 +1068,7 @@ bool decode_pwd_string_from_buffer514(TALLOC_CTX *mem_ctx,
> 	if (!ok) {
> 		return false;
> 	}
>+	talloc_keep_secret(decoded_password->data);
> 
> 	return true;
> }
>-- 
>2.35.0
>
>
>From d997bef4db0371efea595a8d2891966b71c08741 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:36:24 +1200
>Subject: [PATCH 34/40] s3:rpc_server: Check memset_s() return value
>
>Print a debug message if it fails.
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source3/rpc_server/samr/srv_samr_chgpasswd.c | 17 +++++++++++------
> source3/rpc_server/samr/srv_samr_nt.c        | 13 +++++++++++--
> 2 files changed, 22 insertions(+), 8 deletions(-)
>
>diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c
>index 9662284eac6..a73ba0c3336 100644
>--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c
>+++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c
>@@ -1202,7 +1202,8 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 	char *new_passwd = NULL;
> 	struct samu *sampass = NULL;
> 	NTSTATUS nt_status;
>-	bool ret = false;
>+	bool ok = false;
>+	int ret;
> 	bool updated_badpw = false;
> 	NTSTATUS update_login_attempts_status;
> 	char *mutex_name_by_user = NULL;
>@@ -1213,10 +1214,10 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 	}
> 
> 	become_root();
>-	ret = pdb_getsampwnam(sampass, user);
>+	ok = pdb_getsampwnam(sampass, user);
> 	unbecome_root();
> 
>-	if (ret == false) {
>+	if (ok == false) {
> 		DEBUG(0,("pass_oem_change: getsmbpwnam returned NULL\n"));
> 		nt_status = NT_STATUS_NO_SUCH_USER;
> 		goto done;
>@@ -1264,7 +1265,7 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 	mtx = grab_named_mutex(NULL, mutex_name_by_user, 30);
> 	if (mtx != NULL) {
> 		/* Re-load the account information if we got the mutex. */
>-		ret = pdb_getsampwnam(sampass, user);
>+		ok = pdb_getsampwnam(sampass, user);
> 	}
> 	unbecome_root();
> 
>@@ -1279,7 +1280,7 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 		goto done;
> 	}
> 
>-	if (!ret) {
>+	if (!ok) {
> 		/*
> 		 * Re-load of account failed. This could only happen if the
> 		 * user was deleted in the meantime.
>@@ -1358,7 +1359,11 @@ NTSTATUS pass_oem_change(char *user, const char *rhost,
> 					True, reject_reason);
> 	unbecome_root();
> 
>-	memset(new_passwd, 0, strlen(new_passwd));
>+	ret = memset_s(new_passwd, strlen(new_passwd), 0, strlen(new_passwd));
>+	if (ret) {
>+		DBG_WARNING("Failed to zero password buffer: %s",
>+			    strerror(ret));
>+	}
> 
> done:
> 	TALLOC_FREE(sampass);
>diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
>index ac40cbc418b..239b99c404f 100644
>--- a/source3/rpc_server/samr/srv_samr_nt.c
>+++ b/source3/rpc_server/samr/srv_samr_nt.c
>@@ -4947,7 +4947,11 @@ static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
> 	}
> 
> 	if (plaintext_buf) {
>-		memset(plaintext_buf, '\0', strlen(plaintext_buf));
>+		int ret = memset_s(plaintext_buf, len, '\0', strlen(plaintext_buf));
>+		if (ret) {
>+			DBG_WARNING("Failed to zero password buffer: %s",
>+				    strerror(ret));
>+		}
> 	}
> 
> 	if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
>@@ -4972,6 +4976,7 @@ static bool set_user_info_pw(uint8_t *pass, const char *rhost, struct samu *pwd)
> 	size_t len = 0;
> 	char *plaintext_buf = NULL;
> 	uint32_t acct_ctrl;
>+	int ret;
> 
> 	DEBUG(5, ("Attempting administrator password change for user %s\n",
> 		  pdb_get_username(pwd)));
>@@ -5018,7 +5023,11 @@ static bool set_user_info_pw(uint8_t *pass, const char *rhost, struct samu *pwd)
> 		}
> 	}
> 
>-	memset(plaintext_buf, '\0', strlen(plaintext_buf));
>+	ret = memset_s(plaintext_buf, len, '\0', strlen(plaintext_buf));
>+	if (ret) {
>+		DBG_WARNING("Failed to zero password buffer: %s",
>+			    strerror(ret));
>+	}
> 
> 	DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
> 
>-- 
>2.35.0
>
>
>From c82178b856bb9f67bdd9b3235572cfe0702b4350 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:37:52 +1200
>Subject: [PATCH 35/40] CVE-2021-20251 s4-rpc_server: Use
> authsam_search_account() to find the user
>
>This helps the bad password and audit log handling code as it
>allows assumptions to be made about the attributes found in
>the variable "msg", such as that DSDB_SEARCH_SHOW_EXTENDED_DN
>was used.
>
>This ensures we can re-search on the DN via the embedded GUID,
>which in in turn rename-proof.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/rpc_server/samr/samr_password.c | 47 ++++++++-----------------
> 1 file changed, 15 insertions(+), 32 deletions(-)
>
>diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
>index e55d5c28b5c..904e5fba6c5 100644
>--- a/source4/rpc_server/samr/samr_password.c
>+++ b/source4/rpc_server/samr/samr_password.c
>@@ -119,16 +119,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call,
> {
> #ifdef HAVE_GNUTLS_PBKDF2
> 	struct ldb_context *sam_ctx = NULL;
>-	struct ldb_message **ldb_res = NULL;
>-	const char *const attrs[] = {"unicodePwd",
>-				     "dBCSPwd",
>-				     "userAccountControl",
>-				     "msDS-ResultantPSO",
>-				     "msDS-User-Account-Control-Computed",
>-				     "badPwdCount",
>-				     "badPasswordTime",
>-				     "objectSid",
>-				     NULL};
>+	struct ldb_message *msg = NULL;
> 	struct ldb_dn *dn = NULL;
> 	const char *samAccountName = NULL;
> 	struct dom_sid *objectSid = NULL;
>@@ -178,35 +169,27 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call,
> 	}
> 
> 	/*
>-	 * We need the users dn and the domain dn (derived from the user SID).
>-	 * We also need the current lm and nt password hashes in order to
>-	 * decrypt the incoming passwords.
>+	 * We use authsam_search_account() to be consistent with the
>+	 * other callers in the bad password and audit log handling
>+	 * systems.  It ensures we get DSDB_SEARCH_SHOW_EXTENDED_DN.
> 	 */
>-	rc = gendb_search(
>-		sam_ctx,
>-		mem_ctx,
>-		NULL,
>-		&ldb_res,
>-		attrs,
>-		"(&(sAMAccountName=%s)(objectclass=user))",
>-		ldb_binary_encode_string(mem_ctx, r->in.account->string));
>-	if (rc != 1) {
>-		/* Will be converted to WRONG_PASSWORD below */
>+	status = authsam_search_account(mem_ctx,
>+					sam_ctx,
>+					r->in.account->string,
>+					ldb_get_default_basedn(sam_ctx),
>+					&msg);
>+	if (!NT_STATUS_IS_OK(status)) {
> 		ldb_transaction_cancel(sam_ctx);
>-		DBG_WARNING("Unable to find account: %s",
>-			    r->in.account->string);
>-		status = NT_STATUS_NO_SUCH_USER;
> 		goto done;
> 	}
> 
>-	dn = ldb_res[0]->dn;
>-	samAccountName =
>-		ldb_msg_find_attr_as_string(ldb_res[0], "samAccountName", NULL);
>-	objectSid = samdb_result_dom_sid(ldb_res, ldb_res[0], "objectSid");
>+	dn = msg->dn;
>+	samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
>+	objectSid = samdb_result_dom_sid(msg, msg, "objectSid");
> 
> 	status = samdb_result_passwords(mem_ctx,
> 					dce_call->conn->dce_ctx->lp_ctx,
>-					ldb_res[0],
>+					msg,
> 					&nt_pwd);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		ldb_transaction_cancel(sam_ctx);
>@@ -282,7 +265,7 @@ done:
> 	/* Only update the badPwdCount if we found the user */
> 	if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
> 		authsam_update_bad_pwd_count(sam_ctx,
>-					     ldb_res[0],
>+					     msg,
> 					     ldb_get_default_basedn(sam_ctx));
> 	} else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
> 		/*
>-- 
>2.35.0
>
>
>From f128104839ec99b9730da021c3c2520aaa898bda Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:39:06 +1200
>Subject: [PATCH 36/40] CVE-2021-20251 s4-rpc_server: Use user privileges for
> SAMR password change
>
>We don't (and shouldn't) need system prvileges to perform the password
>change, so drop to the privileges of the user by setting
>DSDB_SESSION_INFO. We need to reuse the same sam_ctx: creating a new one
>with only user privileges would not work, because any database
>modifications would be blocked by the transaction taken out on the
>original context.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/rpc_server/samr/samr_password.c | 22 +++++++++++++++++++++-
> 1 file changed, 21 insertions(+), 1 deletion(-)
>
>diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
>index 904e5fba6c5..fd71e6d2854 100644
>--- a/source4/rpc_server/samr/samr_password.c
>+++ b/source4/rpc_server/samr/samr_password.c
>@@ -134,6 +134,8 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call,
> 		.data = cdk_data,
> 		.length = sizeof(cdk_data),
> 	};
>+	struct auth_session_info *call_session_info = NULL;
>+	struct auth_session_info *old_session_info = NULL;
> 	NTSTATUS status = NT_STATUS_WRONG_PASSWORD;
> 	int rc;
> 
>@@ -219,6 +221,19 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call,
> 		goto done;
> 	}
> 
>+	/* Drop to user privileges for the password change */
>+
>+	old_session_info = ldb_get_opaque(sam_ctx, DSDB_SESSION_INFO);
>+	call_session_info = dcesrv_call_session_info(dce_call);
>+
>+	rc = ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, call_session_info);
>+	if (rc != LDB_SUCCESS) {
>+		old_session_info = NULL;
>+		ldb_transaction_cancel(sam_ctx);
>+		status = NT_STATUS_INVALID_SYSTEM_SERVICE;
>+		goto done;
>+	}
>+
> 	status = samr_set_password_aes(dce_call,
> 				       mem_ctx,
> 				       &cdk,
>@@ -264,6 +279,11 @@ done:
> 
> 	/* Only update the badPwdCount if we found the user */
> 	if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
>+		/* Restore our privileges to system level */
>+		if (old_session_info != NULL) {
>+			ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, old_session_info);
>+		}
>+
> 		authsam_update_bad_pwd_count(sam_ctx,
> 					     msg,
> 					     ldb_get_default_basedn(sam_ctx));
>@@ -779,7 +799,7 @@ NTSTATUS samr_set_password_aes(struct dcesrv_call_state *dce_call,
> 				       domain_dn,
> 				       &new_password,
> 				       NULL,
>-				       DSDB_PASSWORD_RESET,
>+				       DSDB_PASSWORD_CHECKED_AND_CORRECT,
> 				       NULL,
> 				       NULL);
> 	TALLOC_FREE(new_password.data);
>-- 
>2.35.0
>
>
>From 37c3f69f7fc5e7872e0697c8177cfe2267ac75e8 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:39:43 +1200
>Subject: [PATCH 37/40] CVE-2021-20251 s4-rpc_server: Extend scope of
> transaction for ChangePasswordUser3
>
>Now the initial account search is performed under the transaction,
>ensuring the overall password change is atomic. We set DSDB_SESSION_INFO
>to drop our privileges to those of the user before we perform the actual
>password change, and restore them afterwards if we need to update the
>bad password count.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/rpc_server/samr/samr_password.c | 43 +++++++++++++++++++------
> 1 file changed, 34 insertions(+), 9 deletions(-)
>
>diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
>index fd71e6d2854..8e8d3ad6cb7 100644
>--- a/source4/rpc_server/samr/samr_password.c
>+++ b/source4/rpc_server/samr/samr_password.c
>@@ -329,6 +329,8 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 		= lpcfg_ntlm_auth(lp_ctx);
> 	gnutls_cipher_hd_t cipher_hnd = NULL;
> 	gnutls_datum_t nt_session_key;
>+	struct auth_session_info *call_session_info = NULL;
>+	struct auth_session_info *old_session_info = NULL;
> 	int rc;
> 
> 	*r->out.dominfo = NULL;
>@@ -353,6 +355,12 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 		return NT_STATUS_INVALID_SYSTEM_SERVICE;
> 	}
> 
>+	ret = ldb_transaction_start(sam_ctx);
>+	if (ret != LDB_SUCCESS) {
>+		DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
>+		return NT_STATUS_TRANSACTION_ABORTED;
>+	}
>+
> 	/*
> 	 * We use authsam_search_account() to be consistent with the
> 	 * other callers in the bad password and audit log handling
>@@ -364,6 +372,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 					ldb_get_default_basedn(sam_ctx),
> 					&msg);
> 	if (!NT_STATUS_IS_OK(status)) {
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
>@@ -374,11 +383,13 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 	status = samdb_result_passwords(mem_ctx, lp_ctx,
> 					msg, &nt_pwd);
> 	if (!NT_STATUS_IS_OK(status) ) {
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
> 	if (!nt_pwd) {
> 		status = NT_STATUS_WRONG_PASSWORD;
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
>@@ -394,6 +405,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 				NULL);
> 	if (rc < 0) {
> 		status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
>@@ -403,17 +415,20 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 	gnutls_cipher_deinit(cipher_hnd);
> 	if (rc < 0) {
> 		status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
> 	if (!extract_pw_from_buffer(mem_ctx, r->in.nt_password->data, &new_password)) {
> 		DEBUG(3,("samr: failed to decode password buffer\n"));
> 		status =  NT_STATUS_WRONG_PASSWORD;
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
> 	if (r->in.nt_verifier == NULL) {
> 		status = NT_STATUS_WRONG_PASSWORD;
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
>@@ -423,23 +438,26 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
> 	rc = E_old_pw_hash(new_nt_hash, nt_pwd->hash, nt_verifier.hash);
> 	if (rc != 0) {
> 		status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 	if (!mem_equal_const_time(nt_verifier.hash, r->in.nt_verifier->hash, 16)) {
> 		status = NT_STATUS_WRONG_PASSWORD;
>+		ldb_transaction_cancel(sam_ctx);
> 		goto failed;
> 	}
> 
>-	/* Connect to a SAMDB with user privileges for the password change */
>-	sam_ctx = dcesrv_samdb_connect_as_user(mem_ctx, dce_call);
>-	if (sam_ctx == NULL) {
>-		return NT_STATUS_INVALID_SYSTEM_SERVICE;
>-	}
>+	/* Drop to user privileges for the password change */
> 
>-	ret = ldb_transaction_start(sam_ctx);
>+	old_session_info = ldb_get_opaque(sam_ctx, DSDB_SESSION_INFO);
>+	call_session_info = dcesrv_call_session_info(dce_call);
>+
>+	ret = ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, call_session_info);
> 	if (ret != LDB_SUCCESS) {
>-		DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
>-		return NT_STATUS_TRANSACTION_ABORTED;
>+		old_session_info = NULL;
>+		status = NT_STATUS_INVALID_SYSTEM_SERVICE;
>+		ldb_transaction_cancel(sam_ctx);
>+		goto failed;
> 	}
> 
> 	/* Performs the password modification. We pass the old hashes read out
>@@ -488,7 +506,14 @@ failed:
> 
> 	/* Only update the badPwdCount if we found the user */
> 	if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
>-		NTSTATUS bad_pwd_status = authsam_update_bad_pwd_count(
>+		NTSTATUS bad_pwd_status;
>+
>+		/* Restore our privileges to system level */
>+		if (old_session_info != NULL) {
>+			ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, old_session_info);
>+		}
>+
>+		bad_pwd_status = authsam_update_bad_pwd_count(
> 			sam_ctx, msg, ldb_get_default_basedn(sam_ctx));
> 		if (NT_STATUS_EQUAL(bad_pwd_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
> 			status = bad_pwd_status;
>-- 
>2.35.0
>
>
>From 93fbe51ddd43506db581f9f47c4469197ccdaf7d Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:40:01 +1200
>Subject: [PATCH 38/40] CVE-2021-20251 dsdb/common: Remove transaction logic
> from samdb_set_password()
>
>All of its callers, where necessary, take out a transaction covering the
>entire password set or change operation, so a transaction is no longer
>needed here.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source4/dsdb/common/util.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
>diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
>index aff31ac8651..be0a2cd4a33 100644
>--- a/source4/dsdb/common/util.c
>+++ b/source4/dsdb/common/util.c
>@@ -2414,7 +2414,10 @@ static NTSTATUS samdb_set_password_internal(struct ldb_context *ldb, TALLOC_CTX
> 		return NT_STATUS_NO_MEMORY;
> 	}
> 
>-	ret = dsdb_autotransaction_request(ldb, req);
>+	ret = ldb_request(ldb, req);
>+	if (ret == LDB_SUCCESS) {
>+		ret = ldb_wait(req->handle, LDB_WAIT_ALL);
>+	}
> 
> 	if (req->context != NULL) {
> 		struct ldb_control *control = talloc_get_type_abort(req->context,
>-- 
>2.35.0
>
>
>From 94aee21a3f9a8686c4aa9a846e2096e56943626e Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:43:09 +1200
>Subject: [PATCH 39/40] CVE-2021-20251 s3:rpc_server: Split
> change_oem_password() call out of samr_set_password_aes()
>
>Now samr_set_password_aes() just returns the new password in a similar
>manner to check_oem_password(). This simplifies the logic for the
>following change to recheck whether the account is locked out, and to
>update the bad password count.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source3/rpc_server/samr/srv_samr_chgpasswd.c | 36 +++++++-------------
> source3/rpc_server/samr/srv_samr_nt.c        | 24 +++++++++----
> source3/rpc_server/samr/srv_samr_util.h      |  8 +++--
> 3 files changed, 36 insertions(+), 32 deletions(-)
>
>diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c
>index a73ba0c3336..9e4676d6add 100644
>--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c
>+++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c
>@@ -1072,10 +1072,10 @@ NTSTATUS check_password_complexity(const char *username,
>  is correct before calling. JRA.
> ************************************************************/
> 
>-static NTSTATUS change_oem_password(struct samu *hnd, const char *rhost,
>-				    char *old_passwd, char *new_passwd,
>-				    bool as_root,
>-				    enum samPwdChangeReason *samr_reject_reason)
>+NTSTATUS change_oem_password(struct samu *hnd, const char *rhost,
>+			     char *old_passwd, char *new_passwd,
>+			     bool as_root,
>+			     enum samPwdChangeReason *samr_reject_reason)
> {
> 	uint32_t min_len;
> 	uint32_t refuse;
>@@ -1374,21 +1374,20 @@ done:
> }
> 
> NTSTATUS samr_set_password_aes(TALLOC_CTX *mem_ctx,
>-			       struct samu *sampass,
>-			       const char *rhost,
> 			       const DATA_BLOB *cdk,
> 			       struct samr_EncryptedPasswordAES *pwbuf,
>-			       enum samPwdChangeReason *reject_reason)
>+			       char **new_password_str)
> {
> 	DATA_BLOB pw_data = data_blob_null;
> 	DATA_BLOB new_password = data_blob_null;
> 	const DATA_BLOB ciphertext =
> 		data_blob_const(pwbuf->cipher, pwbuf->cipher_len);
> 	DATA_BLOB iv = data_blob_const(pwbuf->salt, sizeof(pwbuf->salt));
>-	char *new_password_str = NULL;
> 	NTSTATUS status;
> 	bool ok;
> 
>+	*new_password_str = NULL;
>+
> 	status = samba_gnutls_aead_aes_256_cbc_hmac_sha512_decrypt(
> 		mem_ctx,
> 		&ciphertext,
>@@ -1412,23 +1411,14 @@ NTSTATUS samr_set_password_aes(TALLOC_CTX *mem_ctx,
> 		return NT_STATUS_WRONG_PASSWORD;
> 	}
> 
>-	new_password_str = talloc_strndup(mem_ctx,
>-					  (char *)new_password.data,
>-					  new_password.length);
>+	*new_password_str = talloc_strndup(mem_ctx,
>+					   (char *)new_password.data,
>+					   new_password.length);
> 	TALLOC_FREE(new_password.data);
>-	if (new_password_str == NULL) {
>+	if (*new_password_str == NULL) {
> 		return NT_STATUS_NO_MEMORY;
> 	}
>+	talloc_keep_secret(*new_password_str);
> 
>-	become_root();
>-	status = change_oem_password(sampass,
>-				     rhost,
>-				     NULL,
>-				     new_password_str,
>-				     true,
>-				     reject_reason);
>-	unbecome_root();
>-	TALLOC_FREE(new_password_str);
>-
>-	return status;
>+	return NT_STATUS_OK;
> }
>diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
>index 239b99c404f..7e4d1d02625 100644
>--- a/source3/rpc_server/samr/srv_samr_nt.c
>+++ b/source3/rpc_server/samr/srv_samr_nt.c
>@@ -7692,7 +7692,6 @@ NTSTATUS _samr_ChangePasswordUser4(struct pipes_struct *p,
> 	struct dcesrv_connection *dcesrv_conn = dce_call->conn;
> 	const struct tsocket_address *remote_address =
> 		dcesrv_connection_get_remote_address(dcesrv_conn);
>-	enum samPwdChangeReason reject_reason;
> 	char *rhost = NULL;
> 	struct samu *sampass = NULL;
> 	char *username = NULL;
>@@ -7708,6 +7707,7 @@ NTSTATUS _samr_ChangePasswordUser4(struct pipes_struct *p,
> 		.data = cdk_data,
> 		.length = sizeof(cdk_data),
> 	};
>+	char *new_passwd = NULL;
> 	NTSTATUS status = NT_STATUS_WRONG_PASSWORD;
> 	bool ok;
> 	int rc;
>@@ -7777,19 +7777,31 @@ NTSTATUS _samr_ChangePasswordUser4(struct pipes_struct *p,
> 	}
> 
> 	status = samr_set_password_aes(frame,
>-				       sampass,
>-				       rhost,
> 				       &cdk,
> 				       r->in.password,
>-				       &reject_reason);
>+				       &new_passwd);
> 	BURN_DATA(cdk_data);
>-	if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
>-		return NT_STATUS_WRONG_PASSWORD;
>+	if (!NT_STATUS_IS_OK(status)) {
>+		goto done;
> 	}
> 
>+	become_root();
>+	status = change_oem_password(sampass,
>+				     rhost,
>+				     NULL,
>+				     new_passwd,
>+				     true,
>+				     NULL);
>+	unbecome_root();
>+	TALLOC_FREE(new_passwd);
>+
> done:
> 	TALLOC_FREE(frame);
> 
>+	if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
>+		return NT_STATUS_WRONG_PASSWORD;
>+	}
>+
> 	return status;
> #else  /* HAVE_GNUTLS_PBKDF2 */
> 	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
>diff --git a/source3/rpc_server/samr/srv_samr_util.h b/source3/rpc_server/samr/srv_samr_util.h
>index a702d5d449c..5e839ac77c0 100644
>--- a/source3/rpc_server/samr/srv_samr_util.h
>+++ b/source3/rpc_server/samr/srv_samr_util.h
>@@ -69,6 +69,10 @@ void copy_pwd_expired_to_sam_passwd(struct samu *to,
> 
> bool chgpasswd(const char *name, const char *rhost, const struct passwd *pass,
> 	       const char *oldpass, const char *newpass, bool as_root);
>+NTSTATUS change_oem_password(struct samu *hnd, const char *rhost,
>+			     char *old_passwd, char *new_passwd,
>+			     bool as_root,
>+			     enum samPwdChangeReason *samr_reject_reason);
> NTSTATUS pass_oem_change(char *user, const char *rhost,
> 			 uchar password_encrypted_with_lm_hash[516],
> 			 const uchar old_lm_hash_encrypted[16],
>@@ -80,8 +84,6 @@ NTSTATUS check_password_complexity(const char *username,
> 				   const char *password,
> 				   enum samPwdChangeReason *samr_reject_reason);
> NTSTATUS samr_set_password_aes(TALLOC_CTX *mem_ctx,
>-			       struct samu *sampass,
>-			       const char *rhost,
> 			       const DATA_BLOB *cdk,
> 			       struct samr_EncryptedPasswordAES *pwbuf,
>-			       enum samPwdChangeReason *reject_reason);
>+			       char **new_password_str);
>-- 
>2.35.0
>
>
>From e490f274a754fb12c0ab5120a7071cef38e918e1 Mon Sep 17 00:00:00 2001
>From: Joseph Sutton <josephsutton@catalyst.net.nz>
>Date: Tue, 2 Aug 2022 14:43:19 +1200
>Subject: [PATCH 40/40] CVE-2021-20251 s3: Ensure bad password count atomic
> updates for SAMR AES password change
>
>The bad password count is supposed to limit the number of failed login
>attempt a user can make before being temporarily locked out, but race
>conditions between processes have allowed determined attackers to make
>many more than the specified number of attempts.  This is especially
>bad on constrained or overcommitted hardware.
>
>To fix this, once a bad password is detected, we reload the sam account
>information under a user-specific mutex, ensuring we have an up to
>date bad password count.
>
>We also update the bad password count if the password is wrong, which we
>did not previously do.
>
>Derived from a similar patch to source3/auth/check_samsec.c by
>Jeremy Allison <jra@samba.org>
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
>
>Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>---
> source3/rpc_server/samr/srv_samr_nt.c | 117 ++++++++++++++++++++++++++
> 1 file changed, 117 insertions(+)
>
>diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
>index 7e4d1d02625..fec30892046 100644
>--- a/source3/rpc_server/samr/srv_samr_nt.c
>+++ b/source3/rpc_server/samr/srv_samr_nt.c
>@@ -7708,6 +7708,10 @@ NTSTATUS _samr_ChangePasswordUser4(struct pipes_struct *p,
> 		.length = sizeof(cdk_data),
> 	};
> 	char *new_passwd = NULL;
>+	bool updated_badpw = false;
>+	NTSTATUS update_login_attempts_status;
>+	char *mutex_name_by_user = NULL;
>+	struct named_mutex *mtx = NULL;
> 	NTSTATUS status = NT_STATUS_WRONG_PASSWORD;
> 	bool ok;
> 	int rc;
>@@ -7781,6 +7785,119 @@ NTSTATUS _samr_ChangePasswordUser4(struct pipes_struct *p,
> 				       r->in.password,
> 				       &new_passwd);
> 	BURN_DATA(cdk_data);
>+
>+	/*
>+	 * We must re-load the sam acount information under a mutex
>+	 * lock to ensure we don't miss any concurrent account lockout
>+	 * changes.
>+	 */
>+
>+	/* Clear out old sampass info. */
>+	TALLOC_FREE(sampass);
>+
>+	sampass = samu_new(frame);
>+	if (sampass == NULL) {
>+		status = NT_STATUS_NO_MEMORY;
>+		goto done;
>+	}
>+
>+	mutex_name_by_user = talloc_asprintf(frame,
>+					     "check_sam_security_mutex_%s",
>+					     username);
>+	if (mutex_name_by_user == NULL) {
>+		status = NT_STATUS_NO_MEMORY;
>+		goto done;
>+	}
>+
>+	/* Grab the named mutex under root with 30 second timeout. */
>+	become_root();
>+	mtx = grab_named_mutex(frame, mutex_name_by_user, 30);
>+	if (mtx != NULL) {
>+		/* Re-load the account information if we got the mutex. */
>+		ok = pdb_getsampwnam(sampass, username);
>+	}
>+	unbecome_root();
>+
>+	/* Everything from here on until mtx is freed is done under the mutex.*/
>+
>+	if (mtx == NULL) {
>+		DBG_ERR("Acquisition of mutex %s failed "
>+			"for user %s\n",
>+			mutex_name_by_user,
>+			username);
>+		status = NT_STATUS_INTERNAL_ERROR;
>+		goto done;
>+	}
>+
>+	if (!ok) {
>+		/*
>+		 * Re-load of account failed. This could only happen if the
>+		 * user was deleted in the meantime.
>+		 */
>+		DBG_NOTICE("reload of user '%s' in passdb failed.\n",
>+			   username);
>+		status = NT_STATUS_NO_SUCH_USER;
>+		goto done;
>+	}
>+
>+	/*
>+	 * Check if the account is now locked out - now under the mutex.
>+	 * This can happen if the server is under
>+	 * a password guess attack and the ACB_AUTOLOCK is set by
>+	 * another process.
>+	 */
>+	if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
>+		DBG_NOTICE("Account for user %s was locked out.\n", username);
>+		status = NT_STATUS_ACCOUNT_LOCKED_OUT;
>+		goto done;
>+	}
>+
>+	/*
>+	 * Notify passdb backend of login success/failure. If not
>+	 * NT_STATUS_OK the backend doesn't like the login
>+	 */
>+	update_login_attempts_status = pdb_update_login_attempts(
>+		sampass, NT_STATUS_IS_OK(status));
>+
>+	if (!NT_STATUS_IS_OK(status)) {
>+		bool increment_bad_pw_count = false;
>+
>+		if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD) &&
>+		    (pdb_get_acct_ctrl(sampass) & ACB_NORMAL) &&
>+		    NT_STATUS_IS_OK(update_login_attempts_status))
>+		{
>+			increment_bad_pw_count = true;
>+		}
>+
>+		if (increment_bad_pw_count) {
>+			pdb_increment_bad_password_count(sampass);
>+			updated_badpw = true;
>+		} else {
>+			pdb_update_bad_password_count(sampass,
>+						      &updated_badpw);
>+		}
>+	} else {
>+		if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) &&
>+		    (pdb_get_bad_password_count(sampass) > 0))
>+		{
>+			pdb_set_bad_password_count(sampass, 0, PDB_CHANGED);
>+			pdb_set_bad_password_time(sampass, 0, PDB_CHANGED);
>+			updated_badpw = true;
>+		}
>+	}
>+
>+	if (updated_badpw) {
>+		NTSTATUS update_status;
>+		become_root();
>+		update_status = pdb_update_sam_account(sampass);
>+		unbecome_root();
>+
>+		if (!NT_STATUS_IS_OK(update_status)) {
>+			DEBUG(1, ("Failed to modify entry: %s\n",
>+				  nt_errstr(update_status)));
>+		}
>+	}
>+
> 	if (!NT_STATUS_IS_OK(status)) {
> 		goto done;
> 	}
>-- 
>2.35.0
>

Actions: View

Attachments on bug 14611: 16386 | 16390 | 16391 | 16392 | 16393 | 16411 | 16474 | 16483 | 16484 | 16485 | 16486 | 16487 | 16573 | 17410 | 17411 | 17413 | 17436 | 17452 | 17453 | 17456 | 17513 | 17521 | 17733 | 17734