Bug 15206 - libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4()
Summary: libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4()
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Other (show other bugs)
Version: 4.17.0
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Björn Baumbach
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-10-14 13:38 UTC by Andreas Schneider
Modified: 2022-12-15 16:34 UTC (History)
4 users (show)

See Also:

Attachments
patch for 4.17 (19.48 KB, patch)
2022-10-25 12:24 UTC, Andreas Schneider 		npower: review+
Details
additional patches for 4.17 (2.76 KB, patch)
2022-12-14 13:49 UTC, Björn Baumbach 		metze: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Schneider 2022-10-14 13:38:10 UTC 
change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(). We need to pass down the salt to use the one we already use of PBKDF2!

Patch will follow!
Comment 1 Samba QA Contact 2022-10-25 10:31:03 UTC 
This bug was referenced in samba master:

e3ebda8c6ae6e0c202e2b11a65b98b4f247ae4db
16335412ff312ecb330f7890bd3e94117a5fa6ff
30ca92a8164e1c3a76cdb798ee997d27621a5abb
Comment 2 Andreas Schneider 2022-10-25 12:24:43 UTC 
Created attachment 17602 [details]
patch for 4.17
Comment 3 Noel Power 2022-10-25 14:52:03 UTC 
Comment on attachment 17602 [details]
patch for 4.17

lgtm
Comment 4 Noel Power 2022-10-25 14:52:39 UTC 
assign to Jule for inclusion in next 4.17
Comment 5 Jule Anger 2022-10-31 09:04:13 UTC 
Pushed to autobuild-v4-17-test.
Comment 6 Samba QA Contact 2022-10-31 10:09:04 UTC 
This bug was referenced in samba v4-17-test:

c59f9c33192d7ca985023db5bdfe6c3939458f75
d26e2da30c08658bb3cf3643ac9b906239351c09
c57b3d3751df90c945c96467a897416c892b8bf6
Comment 7 Jule Anger 2022-10-31 14:28:05 UTC 
Closing out bug report.

Thanks!
Comment 8 Björn Baumbach 2022-12-08 15:38:10 UTC 
I'm currently running some tests with current v4-17-test. The tests detected an unexpectet NT_STATUS_OK when changing a password, while NT_STATUS_PASSWORD_RESTRICTION is expected. This seems be related to this bug.

With v4-17-stable:
ERROR: Failed to change password : (-1073741716, "samr_ChangePasswordUser3 for '\\\\DC6.TEMP.TEST\\temp1' failed: NT_STATUS_PASSWORD_RESTRICTION")

With v4-17-stable + patch, attached to this bug report:
ERROR: Failed to change password : (-1073741716, "samr_ChangePasswordUser4 for '\\\\DC6.TEMP.TEST\\temp1' failed: NT_STATUS_OK")

This happens on systems with newer gnutls, e.g. 3.7.7. On systems with older gnutls, e.g. 3.6.16) I still get NT_STATUS_PASSWORD_RESTRICTION.

Is this a regression?
Comment 9 Samba QA Contact 2022-12-14 13:36:03 UTC 
This bug was referenced in samba master:

53d558365161be1793dad78ebcce877c732f2419
eb5df255faea7326a7b85c1e7ce5a66119a27c3a
Comment 10 Björn Baumbach 2022-12-14 13:49:05 UTC 
Created attachment 17700 [details]
additional patches for 4.17

Relates to issue described in Comment 8
Comment 11 Samba QA Contact 2022-12-14 14:47:03 UTC 
This bug was referenced in samba v4-17-test:

77fb5b4762198d7fa1727b6e0b35cb172de1d627
1c7d60ee090155e0222284e937dd553d1eccc929
Comment 12 Samba QA Contact 2022-12-15 16:34:10 UTC 
This bug was referenced in samba v4-17-stable (Release samba-4.17.4):

c59f9c33192d7ca985023db5bdfe6c3939458f75
d26e2da30c08658bb3cf3643ac9b906239351c09
c57b3d3751df90c945c96467a897416c892b8bf6
77fb5b4762198d7fa1727b6e0b35cb172de1d627
1c7d60ee090155e0222284e937dd553d1eccc929