[PATCH] Remove broken api_SetUserPassword() ?

[Andrew Bartlett]

On Mon, 2012-05-14 at 22:12 +0200, Volker Lendecke wrote:
> On Mon, May 14, 2012 at 09:52:27PM +0200, Volker Lendecke wrote:
> > Hi!
> > 
> > Attached find a patch for what I find to be a very likely
> > cut&paste error.
> > 
> > Does anybody know if we have a test for this case? To me it
> > seems it's a bit unlikely we actually have to use
> > strlen(pass1) and strlen(pass2) in this code piece. The
> > code to me seems to indicate we got raw hashes, which might
> > contain 0-bytes.
> > 
> > Volker
> 
> Attachement...

Volker, first very well spotted for noticing this.

Not only is this code untested, a code inspection shows it is
inoperative (our SAMR server will not accept a password change without
the NT hash as verification for that call), and in the plaintext case is
simply wrong (the passwords are not encrypted correctly for
decryption). 

I propose this patch instead (remove the lot) for discussion.  This
isn't even the RAP password change used by smbpasswd as a fallback
(SamOEMChangePassword), this is an even older one.  This version doesn't
give us the new plaintext or NT password, unless the whole lot was sent
plaintext over the wire (and then the current implementation looses the
plaintext). 

All that said, in the commit a17203ba (reimplementing this against SAMR)
GD removed the comment which said:
-	/*
-	 * Attempt to verify the old password against smbpasswd entries
-	 * Win98 clients send old and new password in plaintext for this call.
-	 */

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-s3-lanman-Remove-RAP_WUserPasswordSet2-implementatio.patch
Type: text/x-patch
Size: 8617 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20120515/0f861278/attachment.bin>