s3: Fix some debug msgs in ntlm_auth (cherry picked from commit 6400f3ee62108e3dd1e6c...
[Samba.git] / source3 / passdb / secrets.c
blob4eca9dbc62b98b2f1a9742b512f80fd60b387311
1 /*
2 Unix SMB/CIFS implementation.
3 Copyright (C) Andrew Tridgell 1992-2001
4 Copyright (C) Andrew Bartlett 2002
5 Copyright (C) Rafal Szczesniak 2002
6 Copyright (C) Tim Potter 2001
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 /* the Samba secrets database stores any generated, private information
23 such as the local SID and machine trust password */
25 #include "includes.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "librpc/gen_ndr/ndr_secrets.h"
29 #undef DBGC_CLASS
30 #define DBGC_CLASS DBGC_PASSDB
32 static struct db_context *db_ctx;
34 /* Urrrg. global.... */
35 bool global_machine_password_needs_changing;
37 /**
38 * Use a TDB to store an incrementing random seed.
40 * Initialised to the current pid, the very first time Samba starts,
41 * and incremented by one each time it is needed.
43 * @note Not called by systems with a working /dev/urandom.
45 static void get_rand_seed(void *userdata, int *new_seed)
47 *new_seed = sys_getpid();
48 if (db_ctx) {
49 dbwrap_trans_change_int32_atomic(db_ctx, "INFO/random_seed",
50 new_seed, 1);
54 /* open up the secrets database */
55 bool secrets_init(void)
57 char *fname = NULL;
58 unsigned char dummy;
60 if (db_ctx != NULL)
61 return True;
63 fname = talloc_asprintf(talloc_tos(), "%s/secrets.tdb",
64 lp_private_dir());
65 if (fname == NULL) {
66 return false;
69 db_ctx = db_open(NULL, fname, 0,
70 TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
72 if (db_ctx == NULL) {
73 DEBUG(0,("Failed to open %s\n", fname));
74 TALLOC_FREE(fname);
75 return False;
78 TALLOC_FREE(fname);
80 /**
81 * Set a reseed function for the crypto random generator
83 * This avoids a problem where systems without /dev/urandom
84 * could send the same challenge to multiple clients
86 set_rand_reseed_callback(get_rand_seed, NULL);
88 /* Ensure that the reseed is done now, while we are root, etc */
89 generate_random_buffer(&dummy, sizeof(dummy));
91 return True;
94 struct db_context *secrets_db_ctx(void)
96 if (!secrets_init()) {
97 return NULL;
100 return db_ctx;
104 * close secrets.tdb
106 void secrets_shutdown(void)
108 TALLOC_FREE(db_ctx);
111 /* read a entry from the secrets database - the caller must free the result
112 if size is non-null then the size of the entry is put in there
114 void *secrets_fetch(const char *key, size_t *size)
116 TDB_DATA dbuf;
117 void *result;
119 if (!secrets_init()) {
120 return NULL;
123 if (db_ctx->fetch(db_ctx, talloc_tos(), string_tdb_data(key),
124 &dbuf) != 0) {
125 return NULL;
128 result = memdup(dbuf.dptr, dbuf.dsize);
129 if (result == NULL) {
130 return NULL;
132 TALLOC_FREE(dbuf.dptr);
134 if (size) {
135 *size = dbuf.dsize;
138 return result;
141 /* store a secrets entry
143 bool secrets_store(const char *key, const void *data, size_t size)
145 NTSTATUS status;
147 if (!secrets_init()) {
148 return false;
151 status = dbwrap_trans_store(db_ctx, string_tdb_data(key),
152 make_tdb_data((const uint8 *)data, size),
153 TDB_REPLACE);
154 return NT_STATUS_IS_OK(status);
158 /* delete a secets database entry
160 bool secrets_delete(const char *key)
162 NTSTATUS status;
163 if (!secrets_init()) {
164 return false;
167 status = dbwrap_trans_delete(db_ctx, string_tdb_data(key));
169 return NT_STATUS_IS_OK(status);
173 * Form a key for fetching the domain sid
175 * @param domain domain name
177 * @return keystring
179 static const char *domain_sid_keystr(const char *domain)
181 char *keystr;
183 keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
184 SECRETS_DOMAIN_SID, domain);
185 SMB_ASSERT(keystr != NULL);
186 return keystr;
189 bool secrets_store_domain_sid(const char *domain, const DOM_SID *sid)
191 bool ret;
193 ret = secrets_store(domain_sid_keystr(domain), sid, sizeof(DOM_SID));
195 /* Force a re-query, in case we modified our domain */
196 if (ret)
197 reset_global_sam_sid();
198 return ret;
201 bool secrets_fetch_domain_sid(const char *domain, DOM_SID *sid)
203 DOM_SID *dyn_sid;
204 size_t size = 0;
206 dyn_sid = (DOM_SID *)secrets_fetch(domain_sid_keystr(domain), &size);
208 if (dyn_sid == NULL)
209 return False;
211 if (size != sizeof(DOM_SID)) {
212 SAFE_FREE(dyn_sid);
213 return False;
216 *sid = *dyn_sid;
217 SAFE_FREE(dyn_sid);
218 return True;
221 bool secrets_store_domain_guid(const char *domain, struct GUID *guid)
223 fstring key;
225 slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
226 strupper_m(key);
227 return secrets_store(key, guid, sizeof(struct GUID));
230 bool secrets_fetch_domain_guid(const char *domain, struct GUID *guid)
232 struct GUID *dyn_guid;
233 fstring key;
234 size_t size = 0;
235 struct GUID new_guid;
237 slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
238 strupper_m(key);
239 dyn_guid = (struct GUID *)secrets_fetch(key, &size);
241 if (!dyn_guid) {
242 if (lp_server_role() == ROLE_DOMAIN_PDC) {
243 new_guid = GUID_random();
244 if (!secrets_store_domain_guid(domain, &new_guid))
245 return False;
246 dyn_guid = (struct GUID *)secrets_fetch(key, &size);
248 if (dyn_guid == NULL) {
249 return False;
253 if (size != sizeof(struct GUID)) {
254 DEBUG(1,("UUID size %d is wrong!\n", (int)size));
255 SAFE_FREE(dyn_guid);
256 return False;
259 *guid = *dyn_guid;
260 SAFE_FREE(dyn_guid);
261 return True;
264 bool secrets_store_local_schannel_key(uint8_t schannel_key[16])
266 return secrets_store(SECRETS_LOCAL_SCHANNEL_KEY, schannel_key, 16);
269 bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16])
271 size_t size = 0;
272 uint8_t *key;
274 key = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY, &size);
275 if (key == NULL) {
276 return false;
279 if (size != 16) {
280 SAFE_FREE(key);
281 return false;
284 memcpy(schannel_key, key, 16);
285 SAFE_FREE(key);
286 return true;
290 * Form a key for fetching the machine trust account sec channel type
292 * @param domain domain name
294 * @return keystring
296 static const char *machine_sec_channel_type_keystr(const char *domain)
298 char *keystr;
300 keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
301 SECRETS_MACHINE_SEC_CHANNEL_TYPE,
302 domain);
303 SMB_ASSERT(keystr != NULL);
304 return keystr;
308 * Form a key for fetching the machine trust account last change time
310 * @param domain domain name
312 * @return keystring
314 static const char *machine_last_change_time_keystr(const char *domain)
316 char *keystr;
318 keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
319 SECRETS_MACHINE_LAST_CHANGE_TIME,
320 domain);
321 SMB_ASSERT(keystr != NULL);
322 return keystr;
327 * Form a key for fetching the machine previous trust account password
329 * @param domain domain name
331 * @return keystring
333 static const char *machine_prev_password_keystr(const char *domain)
335 char *keystr;
337 keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
338 SECRETS_MACHINE_PASSWORD_PREV, domain);
339 SMB_ASSERT(keystr != NULL);
340 return keystr;
344 * Form a key for fetching the machine trust account password
346 * @param domain domain name
348 * @return keystring
350 static const char *machine_password_keystr(const char *domain)
352 char *keystr;
354 keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
355 SECRETS_MACHINE_PASSWORD, domain);
356 SMB_ASSERT(keystr != NULL);
357 return keystr;
361 * Form a key for fetching the machine trust account password
363 * @param domain domain name
365 * @return stored password's key
367 static const char *trust_keystr(const char *domain)
369 char *keystr;
371 keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
372 SECRETS_MACHINE_ACCT_PASS, domain);
373 SMB_ASSERT(keystr != NULL);
374 return keystr;
378 * Form a key for fetching a trusted domain password
380 * @param domain trusted domain name
382 * @return stored password's key
384 static char *trustdom_keystr(const char *domain)
386 char *keystr;
388 keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
389 SECRETS_DOMTRUST_ACCT_PASS,
390 domain);
391 SMB_ASSERT(keystr != NULL);
392 return keystr;
395 /************************************************************************
396 Lock the trust password entry.
397 ************************************************************************/
399 void *secrets_get_trust_account_lock(TALLOC_CTX *mem_ctx, const char *domain)
401 if (!secrets_init()) {
402 return NULL;
405 return db_ctx->fetch_locked(
406 db_ctx, mem_ctx, string_term_tdb_data(trust_keystr(domain)));
409 /************************************************************************
410 Routine to get the default secure channel type for trust accounts
411 ************************************************************************/
413 enum netr_SchannelType get_default_sec_channel(void)
415 if (lp_server_role() == ROLE_DOMAIN_BDC ||
416 lp_server_role() == ROLE_DOMAIN_PDC) {
417 return SEC_CHAN_BDC;
418 } else {
419 return SEC_CHAN_WKSTA;
423 /************************************************************************
424 Routine to get the trust account password for a domain.
425 This only tries to get the legacy hashed version of the password.
426 The user of this function must have locked the trust password file using
427 the above secrets_lock_trust_account_password().
428 ************************************************************************/
430 bool secrets_fetch_trust_account_password_legacy(const char *domain,
431 uint8 ret_pwd[16],
432 time_t *pass_last_set_time,
433 enum netr_SchannelType *channel)
435 struct machine_acct_pass *pass;
436 size_t size = 0;
438 if (!(pass = (struct machine_acct_pass *)secrets_fetch(
439 trust_keystr(domain), &size))) {
440 DEBUG(5, ("secrets_fetch failed!\n"));
441 return False;
444 if (size != sizeof(*pass)) {
445 DEBUG(0, ("secrets were of incorrect size!\n"));
446 SAFE_FREE(pass);
447 return False;
450 if (pass_last_set_time) {
451 *pass_last_set_time = pass->mod_time;
453 memcpy(ret_pwd, pass->hash, 16);
455 if (channel) {
456 *channel = get_default_sec_channel();
459 /* Test if machine password has expired and needs to be changed */
460 if (lp_machine_password_timeout()) {
461 if (pass->mod_time > 0 && time(NULL) > (pass->mod_time +
462 (time_t)lp_machine_password_timeout())) {
463 global_machine_password_needs_changing = True;
467 SAFE_FREE(pass);
468 return True;
471 /************************************************************************
472 Routine to get the trust account password for a domain.
473 The user of this function must have locked the trust password file using
474 the above secrets_lock_trust_account_password().
475 ************************************************************************/
477 bool secrets_fetch_trust_account_password(const char *domain, uint8 ret_pwd[16],
478 time_t *pass_last_set_time,
479 enum netr_SchannelType *channel)
481 char *plaintext;
483 plaintext = secrets_fetch_machine_password(domain, pass_last_set_time,
484 channel);
485 if (plaintext) {
486 DEBUG(4,("Using cleartext machine password\n"));
487 E_md4hash(plaintext, ret_pwd);
488 SAFE_FREE(plaintext);
489 return True;
492 return secrets_fetch_trust_account_password_legacy(domain, ret_pwd,
493 pass_last_set_time,
494 channel);
497 /************************************************************************
498 Routine to get account password to trusted domain
499 ************************************************************************/
501 bool secrets_fetch_trusted_domain_password(const char *domain, char** pwd,
502 DOM_SID *sid, time_t *pass_last_set_time)
504 struct TRUSTED_DOM_PASS pass;
505 enum ndr_err_code ndr_err;
507 /* unpacking structures */
508 DATA_BLOB blob;
510 /* fetching trusted domain password structure */
511 if (!(blob.data = (uint8_t *)secrets_fetch(trustdom_keystr(domain),
512 &blob.length))) {
513 DEBUG(5, ("secrets_fetch failed!\n"));
514 return False;
517 /* unpack trusted domain password */
518 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &pass,
519 (ndr_pull_flags_fn_t)ndr_pull_TRUSTED_DOM_PASS);
520 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
521 return false;
524 SAFE_FREE(blob.data);
526 /* the trust's password */
527 if (pwd) {
528 *pwd = SMB_STRDUP(pass.pass);
529 if (!*pwd) {
530 return False;
534 /* last change time */
535 if (pass_last_set_time) *pass_last_set_time = pass.mod_time;
537 /* domain sid */
538 if (sid != NULL) sid_copy(sid, &pass.domain_sid);
540 return True;
544 * Routine to store the password for trusted domain
546 * @param domain remote domain name
547 * @param pwd plain text password of trust relationship
548 * @param sid remote domain sid
550 * @return true if succeeded
553 bool secrets_store_trusted_domain_password(const char* domain, const char* pwd,
554 const DOM_SID *sid)
556 bool ret;
558 /* packing structures */
559 DATA_BLOB blob;
560 enum ndr_err_code ndr_err;
561 struct TRUSTED_DOM_PASS pass;
562 ZERO_STRUCT(pass);
564 pass.uni_name = domain;
565 pass.uni_name_len = strlen(domain)+1;
567 /* last change time */
568 pass.mod_time = time(NULL);
570 /* password of the trust */
571 pass.pass_len = strlen(pwd);
572 pass.pass = pwd;
574 /* domain sid */
575 sid_copy(&pass.domain_sid, sid);
577 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &pass,
578 (ndr_push_flags_fn_t)ndr_push_TRUSTED_DOM_PASS);
579 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
580 return false;
583 ret = secrets_store(trustdom_keystr(domain), blob.data, blob.length);
585 data_blob_free(&blob);
587 return ret;
590 /************************************************************************
591 Routine to delete the old plaintext machine account password if any
592 ************************************************************************/
594 static bool secrets_delete_prev_machine_password(const char *domain)
596 char *oldpass = (char *)secrets_fetch(machine_prev_password_keystr(domain), NULL);
597 if (oldpass == NULL) {
598 return true;
600 SAFE_FREE(oldpass);
601 return secrets_delete(machine_prev_password_keystr(domain));
604 /************************************************************************
605 Routine to delete the plaintext machine account password and old
606 password if any
607 ************************************************************************/
609 bool secrets_delete_machine_password(const char *domain)
611 if (!secrets_delete_prev_machine_password(domain)) {
612 return false;
614 return secrets_delete(machine_password_keystr(domain));
617 /************************************************************************
618 Routine to delete the plaintext machine account password, old password,
619 sec channel type and last change time from secrets database
620 ************************************************************************/
622 bool secrets_delete_machine_password_ex(const char *domain)
624 if (!secrets_delete_prev_machine_password(domain)) {
625 return false;
627 if (!secrets_delete(machine_password_keystr(domain))) {
628 return false;
630 if (!secrets_delete(machine_sec_channel_type_keystr(domain))) {
631 return false;
633 return secrets_delete(machine_last_change_time_keystr(domain));
636 /************************************************************************
637 Routine to delete the domain sid
638 ************************************************************************/
640 bool secrets_delete_domain_sid(const char *domain)
642 return secrets_delete(domain_sid_keystr(domain));
645 /************************************************************************
646 Routine to store the previous machine password (by storing the current password
647 as the old)
648 ************************************************************************/
650 static bool secrets_store_prev_machine_password(const char *domain)
652 char *oldpass;
653 bool ret;
655 oldpass = (char *)secrets_fetch(machine_password_keystr(domain), NULL);
656 if (oldpass == NULL) {
657 return true;
659 ret = secrets_store(machine_prev_password_keystr(domain), oldpass, strlen(oldpass)+1);
660 SAFE_FREE(oldpass);
661 return ret;
664 /************************************************************************
665 Routine to set the plaintext machine account password for a realm
666 the password is assumed to be a null terminated ascii string.
667 Before storing
668 ************************************************************************/
670 bool secrets_store_machine_password(const char *pass, const char *domain,
671 enum netr_SchannelType sec_channel)
673 bool ret;
674 uint32 last_change_time;
675 uint32 sec_channel_type;
677 if (!secrets_store_prev_machine_password(domain)) {
678 return false;
681 ret = secrets_store(machine_password_keystr(domain), pass, strlen(pass)+1);
682 if (!ret)
683 return ret;
685 SIVAL(&last_change_time, 0, time(NULL));
686 ret = secrets_store(machine_last_change_time_keystr(domain), &last_change_time, sizeof(last_change_time));
688 SIVAL(&sec_channel_type, 0, sec_channel);
689 ret = secrets_store(machine_sec_channel_type_keystr(domain), &sec_channel_type, sizeof(sec_channel_type));
691 return ret;
695 /************************************************************************
696 Routine to fetch the previous plaintext machine account password for a realm
697 the password is assumed to be a null terminated ascii string.
698 ************************************************************************/
700 char *secrets_fetch_prev_machine_password(const char *domain)
702 return (char *)secrets_fetch(machine_prev_password_keystr(domain), NULL);
705 /************************************************************************
706 Routine to fetch the plaintext machine account password for a realm
707 the password is assumed to be a null terminated ascii string.
708 ************************************************************************/
710 char *secrets_fetch_machine_password(const char *domain,
711 time_t *pass_last_set_time,
712 enum netr_SchannelType *channel)
714 char *ret;
715 ret = (char *)secrets_fetch(machine_password_keystr(domain), NULL);
717 if (pass_last_set_time) {
718 size_t size;
719 uint32 *last_set_time;
720 last_set_time = (unsigned int *)secrets_fetch(machine_last_change_time_keystr(domain), &size);
721 if (last_set_time) {
722 *pass_last_set_time = IVAL(last_set_time,0);
723 SAFE_FREE(last_set_time);
724 } else {
725 *pass_last_set_time = 0;
729 if (channel) {
730 size_t size;
731 uint32 *channel_type;
732 channel_type = (unsigned int *)secrets_fetch(machine_sec_channel_type_keystr(domain), &size);
733 if (channel_type) {
734 *channel = IVAL(channel_type,0);
735 SAFE_FREE(channel_type);
736 } else {
737 *channel = get_default_sec_channel();
741 return ret;
744 /************************************************************************
745 Routine to delete the password for trusted domain
746 ************************************************************************/
748 bool trusted_domain_password_delete(const char *domain)
750 return secrets_delete(trustdom_keystr(domain));
753 bool secrets_store_ldap_pw(const char* dn, char* pw)
755 char *key = NULL;
756 bool ret;
758 if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, dn) < 0) {
759 DEBUG(0, ("secrets_store_ldap_pw: asprintf failed!\n"));
760 return False;
763 ret = secrets_store(key, pw, strlen(pw)+1);
765 SAFE_FREE(key);
766 return ret;
769 /*******************************************************************
770 Find the ldap password.
771 ******************************************************************/
773 bool fetch_ldap_pw(char **dn, char** pw)
775 char *key = NULL;
776 size_t size = 0;
778 *dn = smb_xstrdup(lp_ldap_admin_dn());
780 if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) {
781 SAFE_FREE(*dn);
782 DEBUG(0, ("fetch_ldap_pw: asprintf failed!\n"));
783 return false;
786 *pw=(char *)secrets_fetch(key, &size);
787 SAFE_FREE(key);
789 if (!size) {
790 /* Upgrade 2.2 style entry */
791 char *p;
792 char* old_style_key = SMB_STRDUP(*dn);
793 char *data;
794 fstring old_style_pw;
796 if (!old_style_key) {
797 DEBUG(0, ("fetch_ldap_pw: strdup failed!\n"));
798 return False;
801 for (p=old_style_key; *p; p++)
802 if (*p == ',') *p = '/';
804 data=(char *)secrets_fetch(old_style_key, &size);
805 if ((data == NULL) || (size < sizeof(old_style_pw))) {
806 DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n"));
807 SAFE_FREE(old_style_key);
808 SAFE_FREE(*dn);
809 SAFE_FREE(data);
810 return False;
813 size = MIN(size, sizeof(fstring)-1);
814 strncpy(old_style_pw, data, size);
815 old_style_pw[size] = 0;
817 SAFE_FREE(data);
819 if (!secrets_store_ldap_pw(*dn, old_style_pw)) {
820 DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n"));
821 SAFE_FREE(old_style_key);
822 SAFE_FREE(*dn);
823 return False;
825 if (!secrets_delete(old_style_key)) {
826 DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n"));
829 SAFE_FREE(old_style_key);
831 *pw = smb_xstrdup(old_style_pw);
834 return True;
838 * Get trusted domains info from secrets.tdb.
841 struct list_trusted_domains_state {
842 uint32 num_domains;
843 struct trustdom_info **domains;
846 static int list_trusted_domain(struct db_record *rec, void *private_data)
848 const size_t prefix_len = strlen(SECRETS_DOMTRUST_ACCT_PASS);
849 struct TRUSTED_DOM_PASS pass;
850 enum ndr_err_code ndr_err;
851 DATA_BLOB blob;
852 struct trustdom_info *dom_info;
854 struct list_trusted_domains_state *state =
855 (struct list_trusted_domains_state *)private_data;
857 if ((rec->key.dsize < prefix_len)
858 || (strncmp((char *)rec->key.dptr, SECRETS_DOMTRUST_ACCT_PASS,
859 prefix_len) != 0)) {
860 return 0;
863 blob = data_blob_const(rec->value.dptr, rec->value.dsize);
865 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &pass,
866 (ndr_pull_flags_fn_t)ndr_pull_TRUSTED_DOM_PASS);
867 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
868 return false;
871 if (pass.domain_sid.num_auths != 4) {
872 DEBUG(0, ("SID %s is not a domain sid, has %d "
873 "auths instead of 4\n",
874 sid_string_dbg(&pass.domain_sid),
875 pass.domain_sid.num_auths));
876 return 0;
879 if (!(dom_info = TALLOC_P(state->domains, struct trustdom_info))) {
880 DEBUG(0, ("talloc failed\n"));
881 return 0;
884 dom_info->name = talloc_strdup(dom_info, pass.uni_name);
885 if (!dom_info->name) {
886 TALLOC_FREE(dom_info);
887 return 0;
890 sid_copy(&dom_info->sid, &pass.domain_sid);
892 ADD_TO_ARRAY(state->domains, struct trustdom_info *, dom_info,
893 &state->domains, &state->num_domains);
895 if (state->domains == NULL) {
896 state->num_domains = 0;
897 return -1;
899 return 0;
902 NTSTATUS secrets_trusted_domains(TALLOC_CTX *mem_ctx, uint32 *num_domains,
903 struct trustdom_info ***domains)
905 struct list_trusted_domains_state state;
907 secrets_init();
909 if (db_ctx == NULL) {
910 return NT_STATUS_ACCESS_DENIED;
913 state.num_domains = 0;
916 * Make sure that a talloc context for the trustdom_info structs
917 * exists
920 if (!(state.domains = TALLOC_ARRAY(
921 mem_ctx, struct trustdom_info *, 1))) {
922 return NT_STATUS_NO_MEMORY;
925 db_ctx->traverse_read(db_ctx, list_trusted_domain, (void *)&state);
927 *num_domains = state.num_domains;
928 *domains = state.domains;
929 return NT_STATUS_OK;
932 /*******************************************************************************
933 Store a complete AFS keyfile into secrets.tdb.
934 *******************************************************************************/
936 bool secrets_store_afs_keyfile(const char *cell, const struct afs_keyfile *keyfile)
938 fstring key;
940 if ((cell == NULL) || (keyfile == NULL))
941 return False;
943 if (ntohl(keyfile->nkeys) > SECRETS_AFS_MAXKEYS)
944 return False;
946 slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell);
947 return secrets_store(key, keyfile, sizeof(struct afs_keyfile));
950 /*******************************************************************************
951 Fetch the current (highest) AFS key from secrets.tdb
952 *******************************************************************************/
953 bool secrets_fetch_afs_key(const char *cell, struct afs_key *result)
955 fstring key;
956 struct afs_keyfile *keyfile;
957 size_t size = 0;
958 uint32 i;
960 slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell);
962 keyfile = (struct afs_keyfile *)secrets_fetch(key, &size);
964 if (keyfile == NULL)
965 return False;
967 if (size != sizeof(struct afs_keyfile)) {
968 SAFE_FREE(keyfile);
969 return False;
972 i = ntohl(keyfile->nkeys);
974 if (i > SECRETS_AFS_MAXKEYS) {
975 SAFE_FREE(keyfile);
976 return False;
979 *result = keyfile->entry[i-1];
981 result->kvno = ntohl(result->kvno);
983 SAFE_FREE(keyfile);
985 return True;
988 /******************************************************************************
989 When kerberos is not available, choose between anonymous or
990 authenticated connections.
992 We need to use an authenticated connection if DCs have the
993 RestrictAnonymous registry entry set > 0, or the "Additional
994 restrictions for anonymous connections" set in the win2k Local
995 Security Policy.
997 Caller to free() result in domain, username, password
998 *******************************************************************************/
999 void secrets_fetch_ipc_userpass(char **username, char **domain, char **password)
1001 *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
1002 *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
1003 *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
1005 if (*username && **username) {
1007 if (!*domain || !**domain)
1008 *domain = smb_xstrdup(lp_workgroup());
1010 if (!*password || !**password)
1011 *password = smb_xstrdup("");
1013 DEBUG(3, ("IPC$ connections done by user %s\\%s\n",
1014 *domain, *username));
1016 } else {
1017 DEBUG(3, ("IPC$ connections done anonymously\n"));
1018 *username = smb_xstrdup("");
1019 *domain = smb_xstrdup("");
1020 *password = smb_xstrdup("");
1024 bool secrets_store_generic(const char *owner, const char *key, const char *secret)
1026 char *tdbkey = NULL;
1027 bool ret;
1029 if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
1030 DEBUG(0, ("asprintf failed!\n"));
1031 return False;
1034 ret = secrets_store(tdbkey, secret, strlen(secret)+1);
1036 SAFE_FREE(tdbkey);
1037 return ret;
1040 bool secrets_delete_generic(const char *owner, const char *key)
1042 char *tdbkey = NULL;
1043 bool ret;
1045 if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
1046 DEBUG(0, ("asprintf failed!\n"));
1047 return False;
1050 ret = secrets_delete(tdbkey);
1052 SAFE_FREE(tdbkey);
1053 return ret;
1056 /*******************************************************************
1057 Find the ldap password.
1058 ******************************************************************/
1060 char *secrets_fetch_generic(const char *owner, const char *key)
1062 char *secret = NULL;
1063 char *tdbkey = NULL;
1065 if (( ! owner) || ( ! key)) {
1066 DEBUG(1, ("Invalid Paramters"));
1067 return NULL;
1070 if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
1071 DEBUG(0, ("Out of memory!\n"));
1072 return NULL;
1075 secret = (char *)secrets_fetch(tdbkey, NULL);
1076 SAFE_FREE(tdbkey);
1078 return secret;