From c162d52b14947990fb6102180a7e2fd6a7d8d1d5 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Tue, 9 Jul 2019 13:11:54 +0200
Subject: [PATCH 021/187] s4:libnet: Use encode_rc4_passwd_buffer() in
 libnet_SetPassword_samr_handle_25()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit e44ba0397c7558e1da6a46cc38237a3b0e5cef49)
---
 source4/libnet/libnet_passwd.c | 43 +++++++---------------------------
 1 file changed, 9 insertions(+), 34 deletions(-)

diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
index 0beea077bd0..b2105121523 100644
--- a/source4/libnet/libnet_passwd.c
+++ b/source4/libnet/libnet_passwd.c
@@ -331,10 +331,6 @@ static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TA
 	struct samr_SetUserInfo2 sui;
 	union samr_UserInfo u_info;
 	DATA_BLOB session_key;
-	DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
-	uint8_t confounder[16];	
-	gnutls_hash_hd_t hash_hnd = NULL;
-	int rc;
 
 	if (!r->samr_handle.in.info21) {
 		return NT_STATUS_INVALID_PARAMETER_MIX;
@@ -344,7 +340,6 @@ static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TA
 	ZERO_STRUCT(u_info);
 	u_info.info25.info = *r->samr_handle.in.info21;
 	u_info.info25.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
-	encode_pw_buffer(u_info.info25.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 
 	status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -354,36 +349,17 @@ static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TA
 		return status;
 	}
 
-	generate_random_buffer((uint8_t *)confounder, 16);
-
-	rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
-	if (rc < 0) {
-		status = gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
-		goto out;
-	}
-
-	rc = gnutls_hash(hash_hnd, confounder, 16);
-	if (rc < 0) {
-		gnutls_hash_deinit(hash_hnd, NULL);
-		status = gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
-		goto out;
-	}
-	rc = gnutls_hash(hash_hnd, session_key.data, session_key.length);
-	if (rc < 0) {
-		gnutls_hash_deinit(hash_hnd, NULL);
-		status = gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
-		goto out;
+	status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
+					  &session_key,
+					  &u_info.info25.password);
+	if (!NT_STATUS_IS_OK(status)) {
+		r->samr_handle.out.error_string =
+			talloc_asprintf(mem_ctx,
+					"encode_rc4_passwd_buffer failed: %s",
+					nt_errstr(status));
+		return status;
 	}
 
-	gnutls_hash_deinit(hash_hnd, confounded_session_key.data);
-
-	arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
-	ZERO_ARRAY_LEN(confounded_session_key.data,
-		       confounded_session_key.length);
-	data_blob_free(&confounded_session_key);
-
-	memcpy(&u_info.info25.password.data[516], confounder, 16);
-	ZERO_ARRAY(confounder);
 
 	sui.in.user_handle = r->samr_handle.in.user_handle;
 	sui.in.info = &u_info;
@@ -401,7 +377,6 @@ static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TA
 					  r->samr_handle.in.account_name, nt_errstr(status));
 	}
 
-out:
 	return status;
 }
 
-- 
2.23.0