source/passdb/secrets.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Andrew Tridgell 1992-2001
   4    Copyright (C) Andrew Bartlett      2002
   5    Copyright (C) Rafal Szczesniak     2002
   6    Copyright (C) Tim Potter           2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /* the Samba secrets database stores any generated, private information
  23    such as the local SID and machine trust password */
  24
  25 #include "includes.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_PASSDB
  29
  30 static struct db_context *db_ctx;
  31
  32 /* Urrrg. global.... */
  33 bool global_machine_password_needs_changing;
  34
  35 /**
  36  * Use a TDB to store an incrementing random seed.
  37  *
  38  * Initialised to the current pid, the very first time Samba starts,
  39  * and incremented by one each time it is needed.
  40  *
  41  * @note Not called by systems with a working /dev/urandom.
  42  */
  43 static void get_rand_seed(int *new_seed)
  44 {
  45         *new_seed = sys_getpid();
  46         if (db_ctx) {
  47                 dbwrap_change_int32_atomic(db_ctx, "INFO/random_seed",
  48                                            new_seed, 1);
  49         }
  50 }
  51
  52 /* open up the secrets database */
  53 bool secrets_init(void)
  54 {
  55         char *fname = NULL;
  56         unsigned char dummy;
  57
  58         if (db_ctx != NULL)
  59                 return True;
  60
  61         fname = talloc_asprintf(talloc_tos(), "%s/secrets.tdb",
  62                                 lp_private_dir());
  63         if (fname == NULL) {
  64                 return false;
  65         }
  66
  67         db_ctx = db_open_trans(NULL, fname, 0,
  68                                TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  69
  70         if (db_ctx == NULL) {
  71                 DEBUG(0,("Failed to open %s\n", fname));
  72                 TALLOC_FREE(fname);
  73                 return False;
  74         }
  75
  76         TALLOC_FREE(fname);
  77
  78         /**
  79          * Set a reseed function for the crypto random generator
  80          *
  81          * This avoids a problem where systems without /dev/urandom
  82          * could send the same challenge to multiple clients
  83          */
  84         set_rand_reseed_callback(get_rand_seed);
  85
  86         /* Ensure that the reseed is done now, while we are root, etc */
  87         generate_random_buffer(&dummy, sizeof(dummy));
  88
  89         return True;
  90 }
  91
  92 struct db_context *secrets_db_ctx(void)
  93 {
  94         if (!secrets_init()) {
  95                 return NULL;
  96         }
  97
  98         return db_ctx;
  99 }
 100
 101 /*
 102  * close secrets.tdb
 103  */
 104 void secrets_shutdown(void)
 105 {
 106         TALLOC_FREE(db_ctx);
 107 }
 108
 109 /* read a entry from the secrets database - the caller must free the result
 110    if size is non-null then the size of the entry is put in there
 111  */
 112 void *secrets_fetch(const char *key, size_t *size)
 113 {
 114         TDB_DATA dbuf;
 115         void *result;
 116
 117         if (!secrets_init()) {
 118                 return NULL;
 119         }
 120
 121         if (db_ctx->fetch(db_ctx, talloc_tos(), string_tdb_data(key),
 122                           &dbuf) != 0) {
 123                 return NULL;
 124         }
 125
 126         result = memdup(dbuf.dptr, dbuf.dsize);
 127         if (result == NULL) {
 128                 return NULL;
 129         }
 130         TALLOC_FREE(dbuf.dptr);
 131
 132         if (size) {
 133                 *size = dbuf.dsize;
 134         }
 135
 136         return result;
 137 }
 138
 139 /* store a secrets entry
 140  */
 141 bool secrets_store(const char *key, const void *data, size_t size)
 142 {
 143         NTSTATUS status;
 144
 145         if (!secrets_init()) {
 146                 return false;
 147         }
 148
 149         status = dbwrap_trans_store(db_ctx, string_tdb_data(key),
 150                                     make_tdb_data((const uint8 *)data, size),
 151                                     TDB_REPLACE);
 152         return NT_STATUS_IS_OK(status);
 153 }
 154
 155
 156 /* delete a secets database entry
 157  */
 158 bool secrets_delete(const char *key)
 159 {
 160         NTSTATUS status;
 161         if (!secrets_init()) {
 162                 return false;
 163         }
 164
 165         status = dbwrap_trans_delete(db_ctx, string_tdb_data(key));
 166
 167         return NT_STATUS_IS_OK(status);
 168 }
 169
 170 /**
 171  * Form a key for fetching the domain sid
 172  *
 173  * @param domain domain name
 174  *
 175  * @return keystring
 176  **/
 177 static const char *domain_sid_keystr(const char *domain)
 178 {
 179         char *keystr;
 180
 181         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 182                                             SECRETS_DOMAIN_SID, domain);
 183         SMB_ASSERT(keystr != NULL);
 184         return keystr;
 185 }
 186
 187 bool secrets_store_domain_sid(const char *domain, const DOM_SID *sid)
 188 {
 189         bool ret;
 190
 191         ret = secrets_store(domain_sid_keystr(domain), sid, sizeof(DOM_SID));
 192
 193         /* Force a re-query, in case we modified our domain */
 194         if (ret)
 195                 reset_global_sam_sid();
 196         return ret;
 197 }
 198
 199 bool secrets_fetch_domain_sid(const char *domain, DOM_SID *sid)
 200 {
 201         DOM_SID *dyn_sid;
 202         size_t size = 0;
 203
 204         dyn_sid = (DOM_SID *)secrets_fetch(domain_sid_keystr(domain), &size);
 205
 206         if (dyn_sid == NULL)
 207                 return False;
 208
 209         if (size != sizeof(DOM_SID)) {
 210                 SAFE_FREE(dyn_sid);
 211                 return False;
 212         }
 213
 214         *sid = *dyn_sid;
 215         SAFE_FREE(dyn_sid);
 216         return True;
 217 }
 218
 219 bool secrets_store_domain_guid(const char *domain, struct GUID *guid)
 220 {
 221         fstring key;
 222
 223         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
 224         strupper_m(key);
 225         return secrets_store(key, guid, sizeof(struct GUID));
 226 }
 227
 228 bool secrets_fetch_domain_guid(const char *domain, struct GUID *guid)
 229 {
 230         struct GUID *dyn_guid;
 231         fstring key;
 232         size_t size = 0;
 233         struct GUID new_guid;
 234
 235         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
 236         strupper_m(key);
 237         dyn_guid = (struct GUID *)secrets_fetch(key, &size);
 238
 239         if (!dyn_guid) {
 240                 if (lp_server_role() == ROLE_DOMAIN_PDC) {
 241                         smb_uuid_generate_random(&new_guid);
 242                         if (!secrets_store_domain_guid(domain, &new_guid))
 243                                 return False;
 244                         dyn_guid = (struct GUID *)secrets_fetch(key, &size);
 245                 }
 246                 if (dyn_guid == NULL) {
 247                         return False;
 248                 }
 249         }
 250
 251         if (size != sizeof(struct GUID)) {
 252                 DEBUG(1,("UUID size %d is wrong!\n", (int)size));
 253                 SAFE_FREE(dyn_guid);
 254                 return False;
 255         }
 256
 257         *guid = *dyn_guid;
 258         SAFE_FREE(dyn_guid);
 259         return True;
 260 }
 261
 262 /**
 263  * Form a key for fetching the machine trust account sec channel type
 264  *
 265  * @param domain domain name
 266  *
 267  * @return keystring
 268  **/
 269 static const char *machine_sec_channel_type_keystr(const char *domain)
 270 {
 271         char *keystr;
 272
 273         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 274                                             SECRETS_MACHINE_SEC_CHANNEL_TYPE,
 275                                             domain);
 276         SMB_ASSERT(keystr != NULL);
 277         return keystr;
 278 }
 279
 280 /**
 281  * Form a key for fetching the machine trust account last change time
 282  *
 283  * @param domain domain name
 284  *
 285  * @return keystring
 286  **/
 287 static const char *machine_last_change_time_keystr(const char *domain)
 288 {
 289         char *keystr;
 290
 291         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 292                                             SECRETS_MACHINE_LAST_CHANGE_TIME,
 293                                             domain);
 294         SMB_ASSERT(keystr != NULL);
 295         return keystr;
 296 }
 297
 298
 299 /**
 300  * Form a key for fetching the machine trust account password
 301  *
 302  * @param domain domain name
 303  *
 304  * @return keystring
 305  **/
 306 static const char *machine_password_keystr(const char *domain)
 307 {
 308         char *keystr;
 309
 310         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 311                                             SECRETS_MACHINE_PASSWORD, domain);
 312         SMB_ASSERT(keystr != NULL);
 313         return keystr;
 314 }
 315
 316 /**
 317  * Form a key for fetching the machine trust account password
 318  *
 319  * @param domain domain name
 320  *
 321  * @return stored password's key
 322  **/
 323 static const char *trust_keystr(const char *domain)
 324 {
 325         char *keystr;
 326
 327         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 328                                             SECRETS_MACHINE_ACCT_PASS, domain);
 329         SMB_ASSERT(keystr != NULL);
 330         return keystr;
 331 }
 332
 333 /**
 334  * Form a key for fetching a trusted domain password
 335  *
 336  * @param domain trusted domain name
 337  *
 338  * @return stored password's key
 339  **/
 340 static char *trustdom_keystr(const char *domain)
 341 {
 342         char *keystr;
 343
 344         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 345                                             SECRETS_DOMTRUST_ACCT_PASS,
 346                                             domain);
 347         SMB_ASSERT(keystr != NULL);
 348         return keystr;
 349 }
 350
 351 /************************************************************************
 352  Lock the trust password entry.
 353 ************************************************************************/
 354
 355 void *secrets_get_trust_account_lock(TALLOC_CTX *mem_ctx, const char *domain)
 356 {
 357         if (!secrets_init()) {
 358                 return NULL;
 359         }
 360
 361         return db_ctx->fetch_locked(
 362                 db_ctx, mem_ctx, string_term_tdb_data(trust_keystr(domain)));
 363 }
 364
 365 /************************************************************************
 366  Routine to get the default secure channel type for trust accounts
 367 ************************************************************************/
 368
 369 uint32 get_default_sec_channel(void)
 370 {
 371         if (lp_server_role() == ROLE_DOMAIN_BDC ||
 372             lp_server_role() == ROLE_DOMAIN_PDC) {
 373                 return SEC_CHAN_BDC;
 374         } else {
 375                 return SEC_CHAN_WKSTA;
 376         }
 377 }
 378
 379 /************************************************************************
 380  Routine to get the trust account password for a domain.
 381  This only tries to get the legacy hashed version of the password.
 382  The user of this function must have locked the trust password file using
 383  the above secrets_lock_trust_account_password().
 384 ************************************************************************/
 385
 386 bool secrets_fetch_trust_account_password_legacy(const char *domain,
 387                                                  uint8 ret_pwd[16],
 388                                                  time_t *pass_last_set_time,
 389                                                  uint32 *channel)
 390 {
 391         struct machine_acct_pass *pass;
 392         size_t size = 0;
 393
 394         if (!(pass = (struct machine_acct_pass *)secrets_fetch(
 395                       trust_keystr(domain), &size))) {
 396                 DEBUG(5, ("secrets_fetch failed!\n"));
 397                 return False;
 398         }
 399
 400         if (size != sizeof(*pass)) {
 401                 DEBUG(0, ("secrets were of incorrect size!\n"));
 402                 SAFE_FREE(pass);
 403                 return False;
 404         }
 405
 406         if (pass_last_set_time) {
 407                 *pass_last_set_time = pass->mod_time;
 408         }
 409         memcpy(ret_pwd, pass->hash, 16);
 410
 411         if (channel) {
 412                 *channel = get_default_sec_channel();
 413         }
 414
 415         /* Test if machine password has expired and needs to be changed */
 416         if (lp_machine_password_timeout()) {
 417                 if (pass->mod_time > 0 && time(NULL) > (pass->mod_time +
 418                                 (time_t)lp_machine_password_timeout())) {
 419                         global_machine_password_needs_changing = True;
 420                 }
 421         }
 422
 423         SAFE_FREE(pass);
 424         return True;
 425 }
 426
 427 /************************************************************************
 428  Routine to get the trust account password for a domain.
 429  The user of this function must have locked the trust password file using
 430  the above secrets_lock_trust_account_password().
 431 ************************************************************************/
 432
 433 bool secrets_fetch_trust_account_password(const char *domain, uint8 ret_pwd[16],
 434                                           time_t *pass_last_set_time,
 435                                           uint32 *channel)
 436 {
 437         char *plaintext;
 438
 439         plaintext = secrets_fetch_machine_password(domain, pass_last_set_time,
 440                                                    channel);
 441         if (plaintext) {
 442                 DEBUG(4,("Using cleartext machine password\n"));
 443                 E_md4hash(plaintext, ret_pwd);
 444                 SAFE_FREE(plaintext);
 445                 return True;
 446         }
 447
 448         return secrets_fetch_trust_account_password_legacy(domain, ret_pwd,
 449                                                            pass_last_set_time,
 450                                                            channel);
 451 }
 452
 453 /**
 454  * Pack SID passed by pointer
 455  *
 456  * @param pack_buf pointer to buffer which is to be filled with packed data
 457  * @param bufsize size of packing buffer
 458  * @param sid pointer to sid to be packed
 459  *
 460  * @return length of the packed representation of the whole structure
 461  **/
 462 static size_t tdb_sid_pack(uint8 *pack_buf, int bufsize, DOM_SID* sid)
 463 {
 464         int idx;
 465         size_t len = 0;
 466         uint8 *p = pack_buf;
 467         int remaining_space = pack_buf ? bufsize : 0;
 468
 469         if (!sid) {
 470                 return -1;
 471         }
 472
 473         len += tdb_pack(p, remaining_space, "bb", sid->sid_rev_num,
 474                         sid->num_auths);
 475         if (pack_buf) {
 476                 p = pack_buf + len;
 477                 remaining_space = bufsize - len;
 478         }
 479
 480         for (idx = 0; idx < 6; idx++) {
 481                 len += tdb_pack(p, remaining_space, "b",
 482                                 sid->id_auth[idx]);
 483                 if (pack_buf) {
 484                         p = pack_buf + len;
 485                         remaining_space = bufsize - len;
 486                 }
 487         }
 488
 489         for (idx = 0; idx < MAXSUBAUTHS; idx++) {
 490                 len += tdb_pack(p, remaining_space, "d",
 491                                 sid->sub_auths[idx]);
 492                 if (pack_buf) {
 493                         p = pack_buf + len;
 494                         remaining_space = bufsize - len;
 495                 }
 496         }
 497
 498         return len;
 499 }
 500
 501 /**
 502  * Unpack SID into a pointer
 503  *
 504  * @param pack_buf pointer to buffer with packed representation
 505  * @param bufsize size of the buffer
 506  * @param sid pointer to sid structure to be filled with unpacked data
 507  *
 508  * @return size of structure unpacked from buffer
 509  **/
 510 static size_t tdb_sid_unpack(uint8 *pack_buf, int bufsize, DOM_SID* sid)
 511 {
 512         int idx, len = 0;
 513
 514         if (!sid || !pack_buf) return -1;
 515
 516         len += tdb_unpack(pack_buf + len, bufsize - len, "bb",
 517                           &sid->sid_rev_num, &sid->num_auths);
 518
 519         for (idx = 0; idx < 6; idx++) {
 520                 len += tdb_unpack(pack_buf + len, bufsize - len, "b",
 521                                   &sid->id_auth[idx]);
 522         }
 523
 524         for (idx = 0; idx < MAXSUBAUTHS; idx++) {
 525                 len += tdb_unpack(pack_buf + len, bufsize - len, "d",
 526                                   &sid->sub_auths[idx]);
 527         }
 528
 529         return len;
 530 }
 531
 532 /**
 533  * Pack TRUSTED_DOM_PASS passed by pointer
 534  *
 535  * @param pack_buf pointer to buffer which is to be filled with packed data
 536  * @param bufsize size of the buffer
 537  * @param pass pointer to trusted domain password to be packed
 538  *
 539  * @return length of the packed representation of the whole structure
 540  **/
 541 static size_t tdb_trusted_dom_pass_pack(uint8 *pack_buf, int bufsize,
 542                                         TRUSTED_DOM_PASS* pass)
 543 {
 544         int idx, len = 0;
 545         uint8 *p = pack_buf;
 546         int remaining_space = pack_buf ? bufsize : 0;
 547
 548         if (!pass) {
 549                 return -1;
 550         }
 551
 552         /* packing unicode domain name and password */
 553         len += tdb_pack(p, remaining_space, "d",
 554                         pass->uni_name_len);
 555         if (pack_buf) {
 556                 p = pack_buf + len;
 557                 remaining_space = bufsize - len;
 558         }
 559
 560         for (idx = 0; idx < 32; idx++) {
 561                 len += tdb_pack(p, remaining_space, "w",
 562                                  pass->uni_name[idx]);
 563                 if (pack_buf) {
 564                         p = pack_buf + len;
 565                         remaining_space = bufsize - len;
 566                 }
 567         }
 568
 569         len += tdb_pack(p, remaining_space, "dPd", pass->pass_len,
 570                              pass->pass, pass->mod_time);
 571         if (pack_buf) {
 572                 p = pack_buf + len;
 573                 remaining_space = bufsize - len;
 574         }
 575
 576         /* packing SID structure */
 577         len += tdb_sid_pack(p, remaining_space, &pass->domain_sid);
 578         if (pack_buf) {
 579                 p = pack_buf + len;
 580                 remaining_space = bufsize - len;
 581         }
 582
 583         return len;
 584 }
 585
 586
 587 /**
 588  * Unpack TRUSTED_DOM_PASS passed by pointer
 589  *
 590  * @param pack_buf pointer to buffer with packed representation
 591  * @param bufsize size of the buffer
 592  * @param pass pointer to trusted domain password to be filled with unpacked data
 593  *
 594  * @return size of structure unpacked from buffer
 595  **/
 596 static size_t tdb_trusted_dom_pass_unpack(uint8 *pack_buf, int bufsize,
 597                                           TRUSTED_DOM_PASS* pass)
 598 {
 599         int idx, len = 0;
 600         char *passp = NULL;
 601
 602         if (!pack_buf || !pass) return -1;
 603
 604         /* unpack unicode domain name and plaintext password */
 605         len += tdb_unpack(pack_buf, bufsize - len, "d", &pass->uni_name_len);
 606
 607         for (idx = 0; idx < 32; idx++)
 608                 len +=  tdb_unpack(pack_buf + len, bufsize - len, "w",
 609                                    &pass->uni_name[idx]);
 610
 611         len += tdb_unpack(pack_buf + len, bufsize - len, "dPd",
 612                           &pass->pass_len, &passp, &pass->mod_time);
 613         if (passp) {
 614                 fstrcpy(pass->pass, passp);
 615         }
 616         SAFE_FREE(passp);
 617
 618         /* unpack domain sid */
 619         len += tdb_sid_unpack(pack_buf + len, bufsize - len,
 620                               &pass->domain_sid);
 621
 622         return len;
 623 }
 624
 625 /************************************************************************
 626  Routine to get account password to trusted domain
 627 ************************************************************************/
 628
 629 bool secrets_fetch_trusted_domain_password(const char *domain, char** pwd,
 630                                            DOM_SID *sid, time_t *pass_last_set_time)
 631 {
 632         struct trusted_dom_pass pass;
 633         size_t size = 0;
 634
 635         /* unpacking structures */
 636         uint8 *pass_buf;
 637         int pass_len = 0;
 638
 639         ZERO_STRUCT(pass);
 640
 641         /* fetching trusted domain password structure */
 642         if (!(pass_buf = (uint8 *)secrets_fetch(trustdom_keystr(domain),
 643                                                &size))) {
 644                 DEBUG(5, ("secrets_fetch failed!\n"));
 645                 return False;
 646         }
 647
 648         /* unpack trusted domain password */
 649         pass_len = tdb_trusted_dom_pass_unpack(pass_buf, size, &pass);
 650         SAFE_FREE(pass_buf);
 651
 652         if (pass_len != size) {
 653                 DEBUG(5, ("Invalid secrets size. Unpacked data doesn't match trusted_dom_pass structure.\n"));
 654                 return False;
 655         }
 656
 657         /* the trust's password */
 658         if (pwd) {
 659                 *pwd = SMB_STRDUP(pass.pass);
 660                 if (!*pwd) {
 661                         return False;
 662                 }
 663         }
 664
 665         /* last change time */
 666         if (pass_last_set_time) *pass_last_set_time = pass.mod_time;
 667
 668         /* domain sid */
 669         if (sid != NULL) sid_copy(sid, &pass.domain_sid);
 670
 671         return True;
 672 }
 673
 674 /**
 675  * Routine to store the password for trusted domain
 676  *
 677  * @param domain remote domain name
 678  * @param pwd plain text password of trust relationship
 679  * @param sid remote domain sid
 680  *
 681  * @return true if succeeded
 682  **/
 683
 684 bool secrets_store_trusted_domain_password(const char* domain, const char* pwd,
 685                                            const DOM_SID *sid)
 686 {
 687         smb_ucs2_t *uni_dom_name;
 688         bool ret;
 689
 690         /* packing structures */
 691         uint8 *pass_buf = NULL;
 692         int pass_len = 0;
 693
 694         struct trusted_dom_pass pass;
 695         ZERO_STRUCT(pass);
 696
 697         if (push_ucs2_allocate(&uni_dom_name, domain) == (size_t)-1) {
 698                 DEBUG(0, ("Could not convert domain name %s to unicode\n",
 699                           domain));
 700                 return False;
 701         }
 702
 703         strncpy_w(pass.uni_name, uni_dom_name, sizeof(pass.uni_name) - 1);
 704         pass.uni_name_len = strlen_w(uni_dom_name)+1;
 705         SAFE_FREE(uni_dom_name);
 706
 707         /* last change time */
 708         pass.mod_time = time(NULL);
 709
 710         /* password of the trust */
 711         pass.pass_len = strlen(pwd);
 712         fstrcpy(pass.pass, pwd);
 713
 714         /* domain sid */
 715         sid_copy(&pass.domain_sid, sid);
 716
 717         /* Calculate the length. */
 718         pass_len = tdb_trusted_dom_pass_pack(NULL, 0, &pass);
 719         pass_buf = SMB_MALLOC_ARRAY(uint8, pass_len);
 720         if (!pass_buf) {
 721                 return false;
 722         }
 723         pass_len = tdb_trusted_dom_pass_pack(pass_buf, pass_len, &pass);
 724         ret = secrets_store(trustdom_keystr(domain), (void *)pass_buf,
 725                         pass_len);
 726         SAFE_FREE(pass_buf);
 727         return ret;
 728 }
 729
 730 /************************************************************************
 731  Routine to delete the plaintext machine account password
 732 ************************************************************************/
 733
 734 bool secrets_delete_machine_password(const char *domain)
 735 {
 736         return secrets_delete(machine_password_keystr(domain));
 737 }
 738
 739 /************************************************************************
 740  Routine to delete the plaintext machine account password, sec channel type and
 741  last change time from secrets database
 742 ************************************************************************/
 743
 744 bool secrets_delete_machine_password_ex(const char *domain)
 745 {
 746         if (!secrets_delete(machine_password_keystr(domain))) {
 747                 return false;
 748         }
 749         if (!secrets_delete(machine_sec_channel_type_keystr(domain))) {
 750                 return false;
 751         }
 752         return secrets_delete(machine_last_change_time_keystr(domain));
 753 }
 754
 755 /************************************************************************
 756  Routine to delete the domain sid
 757 ************************************************************************/
 758
 759 bool secrets_delete_domain_sid(const char *domain)
 760 {
 761         return secrets_delete(domain_sid_keystr(domain));
 762 }
 763
 764 /************************************************************************
 765  Routine to set the plaintext machine account password for a realm
 766 the password is assumed to be a null terminated ascii string
 767 ************************************************************************/
 768
 769 bool secrets_store_machine_password(const char *pass, const char *domain, uint32 sec_channel)
 770 {
 771         bool ret;
 772         uint32 last_change_time;
 773         uint32 sec_channel_type;
 774
 775         ret = secrets_store(machine_password_keystr(domain), pass, strlen(pass)+1);
 776         if (!ret)
 777                 return ret;
 778
 779         SIVAL(&last_change_time, 0, time(NULL));
 780         ret = secrets_store(machine_last_change_time_keystr(domain), &last_change_time, sizeof(last_change_time));
 781
 782         SIVAL(&sec_channel_type, 0, sec_channel);
 783         ret = secrets_store(machine_sec_channel_type_keystr(domain), &sec_channel_type, sizeof(sec_channel_type));
 784
 785         return ret;
 786 }
 787
 788 /************************************************************************
 789  Routine to fetch the plaintext machine account password for a realm
 790  the password is assumed to be a null terminated ascii string.
 791 ************************************************************************/
 792
 793 char *secrets_fetch_machine_password(const char *domain,
 794                                      time_t *pass_last_set_time,
 795                                      uint32 *channel)
 796 {
 797         char *ret;
 798         ret = (char *)secrets_fetch(machine_password_keystr(domain), NULL);
 799
 800         if (pass_last_set_time) {
 801                 size_t size;
 802                 uint32 *last_set_time;
 803                 last_set_time = (unsigned int *)secrets_fetch(machine_last_change_time_keystr(domain), &size);
 804                 if (last_set_time) {
 805                         *pass_last_set_time = IVAL(last_set_time,0);
 806                         SAFE_FREE(last_set_time);
 807                 } else {
 808                         *pass_last_set_time = 0;
 809                 }
 810         }
 811
 812         if (channel) {
 813                 size_t size;
 814                 uint32 *channel_type;
 815                 channel_type = (unsigned int *)secrets_fetch(machine_sec_channel_type_keystr(domain), &size);
 816                 if (channel_type) {
 817                         *channel = IVAL(channel_type,0);
 818                         SAFE_FREE(channel_type);
 819                 } else {
 820                         *channel = get_default_sec_channel();
 821                 }
 822         }
 823
 824         return ret;
 825 }
 826
 827 /************************************************************************
 828  Routine to delete the password for trusted domain
 829 ************************************************************************/
 830
 831 bool trusted_domain_password_delete(const char *domain)
 832 {
 833         return secrets_delete(trustdom_keystr(domain));
 834 }
 835
 836 bool secrets_store_ldap_pw(const char* dn, char* pw)
 837 {
 838         char *key = NULL;
 839         bool ret;
 840
 841         if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, dn) < 0) {
 842                 DEBUG(0, ("secrets_store_ldap_pw: asprintf failed!\n"));
 843                 return False;
 844         }
 845
 846         ret = secrets_store(key, pw, strlen(pw)+1);
 847
 848         SAFE_FREE(key);
 849         return ret;
 850 }
 851
 852 /*******************************************************************
 853  Find the ldap password.
 854 ******************************************************************/
 855
 856 bool fetch_ldap_pw(char **dn, char** pw)
 857 {
 858         char *key = NULL;
 859         size_t size = 0;
 860
 861         *dn = smb_xstrdup(lp_ldap_admin_dn());
 862
 863         if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) {
 864                 SAFE_FREE(*dn);
 865                 DEBUG(0, ("fetch_ldap_pw: asprintf failed!\n"));
 866         }
 867
 868         *pw=(char *)secrets_fetch(key, &size);
 869         SAFE_FREE(key);
 870
 871         if (!size) {
 872                 /* Upgrade 2.2 style entry */
 873                 char *p;
 874                 char* old_style_key = SMB_STRDUP(*dn);
 875                 char *data;
 876                 fstring old_style_pw;
 877
 878                 if (!old_style_key) {
 879                         DEBUG(0, ("fetch_ldap_pw: strdup failed!\n"));
 880                         return False;
 881                 }
 882
 883                 for (p=old_style_key; *p; p++)
 884                         if (*p == ',') *p = '/';
 885
 886                 data=(char *)secrets_fetch(old_style_key, &size);
 887                 if ((data == NULL) || (size < sizeof(old_style_pw))) {
 888                         DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n"));
 889                         SAFE_FREE(old_style_key);
 890                         SAFE_FREE(*dn);
 891                         SAFE_FREE(data);
 892                         return False;
 893                 }
 894
 895                 size = MIN(size, sizeof(fstring)-1);
 896                 strncpy(old_style_pw, data, size);
 897                 old_style_pw[size] = 0;
 898
 899                 SAFE_FREE(data);
 900
 901                 if (!secrets_store_ldap_pw(*dn, old_style_pw)) {
 902                         DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n"));
 903                         SAFE_FREE(old_style_key);
 904                         SAFE_FREE(*dn);
 905                         return False;
 906                 }
 907                 if (!secrets_delete(old_style_key)) {
 908                         DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n"));
 909                 }
 910
 911                 SAFE_FREE(old_style_key);
 912
 913                 *pw = smb_xstrdup(old_style_pw);
 914         }
 915
 916         return True;
 917 }
 918
 919 /**
 920  * Get trusted domains info from secrets.tdb.
 921  **/
 922
 923 struct list_trusted_domains_state {
 924         uint32 num_domains;
 925         struct trustdom_info **domains;
 926 };
 927
 928 static int list_trusted_domain(struct db_record *rec, void *private_data)
 929 {
 930         const size_t prefix_len = strlen(SECRETS_DOMTRUST_ACCT_PASS);
 931         size_t packed_size = 0;
 932         struct trusted_dom_pass pass;
 933         struct trustdom_info *dom_info;
 934
 935         struct list_trusted_domains_state *state =
 936                 (struct list_trusted_domains_state *)private_data;
 937
 938         if ((rec->key.dsize < prefix_len)
 939             || (strncmp((char *)rec->key.dptr, SECRETS_DOMTRUST_ACCT_PASS,
 940                         prefix_len) != 0)) {
 941                 return 0;
 942         }
 943
 944         packed_size = tdb_trusted_dom_pass_unpack(
 945                 rec->value.dptr, rec->value.dsize, &pass);
 946
 947         if (rec->value.dsize != packed_size) {
 948                 DEBUG(2, ("Secrets record is invalid!\n"));
 949                 return 0;
 950         }
 951
 952         if (pass.domain_sid.num_auths != 4) {
 953                 DEBUG(0, ("SID %s is not a domain sid, has %d "
 954                           "auths instead of 4\n",
 955                           sid_string_dbg(&pass.domain_sid),
 956                           pass.domain_sid.num_auths));
 957                 return 0;
 958         }
 959
 960         if (!(dom_info = TALLOC_P(state->domains, struct trustdom_info))) {
 961                 DEBUG(0, ("talloc failed\n"));
 962                 return 0;
 963         }
 964
 965         if (pull_ucs2_talloc(dom_info, &dom_info->name,
 966                              pass.uni_name) == (size_t)-1) {
 967                 DEBUG(2, ("pull_ucs2_talloc failed\n"));
 968                 TALLOC_FREE(dom_info);
 969                 return 0;
 970         }
 971
 972         sid_copy(&dom_info->sid, &pass.domain_sid);
 973
 974         ADD_TO_ARRAY(state->domains, struct trustdom_info *, dom_info,
 975                      &state->domains, &state->num_domains);
 976
 977         if (state->domains == NULL) {
 978                 state->num_domains = 0;
 979                 return -1;
 980         }
 981         return 0;
 982 }
 983
 984 NTSTATUS secrets_trusted_domains(TALLOC_CTX *mem_ctx, uint32 *num_domains,
 985                                  struct trustdom_info ***domains)
 986 {
 987         struct list_trusted_domains_state state;
 988
 989         secrets_init();
 990
 991         if (db_ctx == NULL) {
 992                 return NT_STATUS_ACCESS_DENIED;
 993         }
 994
 995         state.num_domains = 0;
 996
 997         /*
 998          * Make sure that a talloc context for the trustdom_info structs
 999          * exists
1000          */
1001
1002         if (!(state.domains = TALLOC_ARRAY(
1003                       mem_ctx, struct trustdom_info *, 1))) {
1004                 return NT_STATUS_NO_MEMORY;
1005         }
1006
1007         db_ctx->traverse_read(db_ctx, list_trusted_domain, (void *)&state);
1008
1009         *num_domains = state.num_domains;
1010         *domains = state.domains;
1011         return NT_STATUS_OK;
1012 }
1013
1014 /*******************************************************************************
1015  Store a complete AFS keyfile into secrets.tdb.
1016 *******************************************************************************/
1017
1018 bool secrets_store_afs_keyfile(const char *cell, const struct afs_keyfile *keyfile)
1019 {
1020         fstring key;
1021
1022         if ((cell == NULL) || (keyfile == NULL))
1023                 return False;
1024
1025         if (ntohl(keyfile->nkeys) > SECRETS_AFS_MAXKEYS)
1026                 return False;
1027
1028         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell);
1029         return secrets_store(key, keyfile, sizeof(struct afs_keyfile));
1030 }
1031
1032 /*******************************************************************************
1033  Fetch the current (highest) AFS key from secrets.tdb
1034 *******************************************************************************/
1035 bool secrets_fetch_afs_key(const char *cell, struct afs_key *result)
1036 {
1037         fstring key;
1038         struct afs_keyfile *keyfile;
1039         size_t size = 0;
1040         uint32 i;
1041
1042         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell);
1043
1044         keyfile = (struct afs_keyfile *)secrets_fetch(key, &size);
1045
1046         if (keyfile == NULL)
1047                 return False;
1048
1049         if (size != sizeof(struct afs_keyfile)) {
1050                 SAFE_FREE(keyfile);
1051                 return False;
1052         }
1053
1054         i = ntohl(keyfile->nkeys);
1055
1056         if (i > SECRETS_AFS_MAXKEYS) {
1057                 SAFE_FREE(keyfile);
1058                 return False;
1059         }
1060
1061         *result = keyfile->entry[i-1];
1062
1063         result->kvno = ntohl(result->kvno);
1064
1065         SAFE_FREE(keyfile);
1066
1067         return True;
1068 }
1069
1070 /******************************************************************************
1071   When kerberos is not available, choose between anonymous or
1072   authenticated connections.
1073
1074   We need to use an authenticated connection if DCs have the
1075   RestrictAnonymous registry entry set > 0, or the "Additional
1076   restrictions for anonymous connections" set in the win2k Local
1077   Security Policy.
1078
1079   Caller to free() result in domain, username, password
1080 *******************************************************************************/
1081 void secrets_fetch_ipc_userpass(char **username, char **domain, char **password)
1082 {
1083         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
1084         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
1085         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
1086
1087         if (*username && **username) {
1088
1089                 if (!*domain || !**domain)
1090                         *domain = smb_xstrdup(lp_workgroup());
1091
1092                 if (!*password || !**password)
1093                         *password = smb_xstrdup("");
1094
1095                 DEBUG(3, ("IPC$ connections done by user %s\\%s\n",
1096                           *domain, *username));
1097
1098         } else {
1099                 DEBUG(3, ("IPC$ connections done anonymously\n"));
1100                 *username = smb_xstrdup("");
1101                 *domain = smb_xstrdup("");
1102                 *password = smb_xstrdup("");
1103         }
1104 }
1105
1106 /******************************************************************************
1107  Open or create the schannel session store tdb.
1108 *******************************************************************************/
1109
1110 static TDB_CONTEXT *open_schannel_session_store(TALLOC_CTX *mem_ctx)
1111 {
1112         TDB_DATA vers;
1113         uint32 ver;
1114         TDB_CONTEXT *tdb_sc = NULL;
1115         char *fname = talloc_asprintf(mem_ctx, "%s/schannel_store.tdb", lp_private_dir());
1116
1117         if (!fname) {
1118                 return NULL;
1119         }
1120
1121         tdb_sc = tdb_open_log(fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
1122
1123         if (!tdb_sc) {
1124                 DEBUG(0,("open_schannel_session_store: Failed to open %s\n", fname));
1125                 TALLOC_FREE(fname);
1126                 return NULL;
1127         }
1128
1129         vers = tdb_fetch_bystring(tdb_sc, "SCHANNEL_STORE_VERSION");
1130         if (vers.dptr == NULL) {
1131                 /* First opener, no version. */
1132                 SIVAL(&ver,0,1);
1133                 vers.dptr = (uint8 *)&ver;
1134                 vers.dsize = 4;
1135                 tdb_store_bystring(tdb_sc, "SCHANNEL_STORE_VERSION", vers, TDB_REPLACE);
1136                 vers.dptr = NULL;
1137         } else if (vers.dsize == 4) {
1138                 ver = IVAL(vers.dptr,0);
1139                 if (ver != 1) {
1140                         tdb_close(tdb_sc);
1141                         tdb_sc = NULL;
1142                         DEBUG(0,("open_schannel_session_store: wrong version number %d in %s\n",
1143                                 (int)ver, fname ));
1144                 }
1145         } else {
1146                 tdb_close(tdb_sc);
1147                 tdb_sc = NULL;
1148                 DEBUG(0,("open_schannel_session_store: wrong version number size %d in %s\n",
1149                         (int)vers.dsize, fname ));
1150         }
1151
1152         SAFE_FREE(vers.dptr);
1153         TALLOC_FREE(fname);
1154
1155         return tdb_sc;
1156 }
1157
1158 /******************************************************************************
1159  Store the schannel state after an AUTH2 call.
1160  Note we must be root here.
1161 *******************************************************************************/
1162
1163 bool secrets_store_schannel_session_info(TALLOC_CTX *mem_ctx,
1164                                 const char *remote_machine,
1165                                 const struct dcinfo *pdc)
1166 {
1167         TDB_CONTEXT *tdb_sc = NULL;
1168         TDB_DATA value;
1169         bool ret;
1170         char *keystr = talloc_asprintf_strupper_m(mem_ctx, "%s/%s",
1171                                                   SECRETS_SCHANNEL_STATE,
1172                                                   remote_machine);
1173         if (!keystr) {
1174                 return False;
1175         }
1176
1177         /* Work out how large the record is. */
1178         value.dsize = tdb_pack(NULL, 0, "dBBBBBfff",
1179                                 pdc->sequence,
1180                                 8, pdc->seed_chal.data,
1181                                 8, pdc->clnt_chal.data,
1182                                 8, pdc->srv_chal.data,
1183                                 16, pdc->sess_key,
1184                                 16, pdc->mach_pw,
1185                                 pdc->mach_acct,
1186                                 pdc->remote_machine,
1187                                 pdc->domain);
1188
1189         value.dptr = TALLOC_ARRAY(mem_ctx, uint8, value.dsize);
1190         if (!value.dptr) {
1191                 TALLOC_FREE(keystr);
1192                 return False;
1193         }
1194
1195         value.dsize = tdb_pack(value.dptr, value.dsize, "dBBBBBfff",
1196                                 pdc->sequence,
1197                                 8, pdc->seed_chal.data,
1198                                 8, pdc->clnt_chal.data,
1199                                 8, pdc->srv_chal.data,
1200                                 16, pdc->sess_key,
1201                                 16, pdc->mach_pw,
1202                                 pdc->mach_acct,
1203                                 pdc->remote_machine,
1204                                 pdc->domain);
1205
1206         tdb_sc = open_schannel_session_store(mem_ctx);
1207         if (!tdb_sc) {
1208                 TALLOC_FREE(keystr);
1209                 TALLOC_FREE(value.dptr);
1210                 return False;
1211         }
1212
1213         ret = (tdb_store_bystring(tdb_sc, keystr, value, TDB_REPLACE) == 0 ? True : False);
1214
1215         DEBUG(3,("secrets_store_schannel_session_info: stored schannel info with key %s\n",
1216                 keystr ));
1217
1218         tdb_close(tdb_sc);
1219         TALLOC_FREE(keystr);
1220         TALLOC_FREE(value.dptr);
1221         return ret;
1222 }
1223
1224 /******************************************************************************
1225  Restore the schannel state on a client reconnect.
1226  Note we must be root here.
1227 *******************************************************************************/
1228
1229 bool secrets_restore_schannel_session_info(TALLOC_CTX *mem_ctx,
1230                                 const char *remote_machine,
1231                                 struct dcinfo **ppdc)
1232 {
1233         TDB_CONTEXT *tdb_sc = NULL;
1234         TDB_DATA value;
1235         unsigned char *pseed_chal = NULL;
1236         unsigned char *pclnt_chal = NULL;
1237         unsigned char *psrv_chal = NULL;
1238         unsigned char *psess_key = NULL;
1239         unsigned char *pmach_pw = NULL;
1240         uint32 l1, l2, l3, l4, l5;
1241         int ret;
1242         struct dcinfo *pdc = NULL;
1243         char *keystr = talloc_asprintf_strupper_m(mem_ctx, "%s/%s",
1244                                                   SECRETS_SCHANNEL_STATE,
1245                                                   remote_machine);
1246
1247         *ppdc = NULL;
1248
1249         if (!keystr) {
1250                 return False;
1251         }
1252
1253         tdb_sc = open_schannel_session_store(mem_ctx);
1254         if (!tdb_sc) {
1255                 TALLOC_FREE(keystr);
1256                 return False;
1257         }
1258
1259         value = tdb_fetch_bystring(tdb_sc, keystr);
1260         if (!value.dptr) {
1261                 DEBUG(0,("secrets_restore_schannel_session_info: Failed to find entry with key %s\n",
1262                         keystr ));
1263                 tdb_close(tdb_sc);
1264                 return False;
1265         }
1266
1267         pdc = TALLOC_ZERO_P(mem_ctx, struct dcinfo);
1268
1269         /* Retrieve the record. */
1270         ret = tdb_unpack(value.dptr, value.dsize, "dBBBBBfff",
1271                                 &pdc->sequence,
1272                                 &l1, &pseed_chal,
1273                                 &l2, &pclnt_chal,
1274                                 &l3, &psrv_chal,
1275                                 &l4, &psess_key,
1276                                 &l5, &pmach_pw,
1277                                 &pdc->mach_acct,
1278                                 &pdc->remote_machine,
1279                                 &pdc->domain);
1280
1281         if (ret == -1 || l1 != 8 || l2 != 8 || l3 != 8 || l4 != 16 || l5 != 16) {
1282                 /* Bad record - delete it. */
1283                 tdb_delete_bystring(tdb_sc, keystr);
1284                 tdb_close(tdb_sc);
1285                 TALLOC_FREE(keystr);
1286                 TALLOC_FREE(pdc);
1287                 SAFE_FREE(pseed_chal);
1288                 SAFE_FREE(pclnt_chal);
1289                 SAFE_FREE(psrv_chal);
1290                 SAFE_FREE(psess_key);
1291                 SAFE_FREE(pmach_pw);
1292                 SAFE_FREE(value.dptr);
1293                 return False;
1294         }
1295
1296         tdb_close(tdb_sc);
1297
1298         memcpy(pdc->seed_chal.data, pseed_chal, 8);
1299         memcpy(pdc->clnt_chal.data, pclnt_chal, 8);
1300         memcpy(pdc->srv_chal.data, psrv_chal, 8);
1301         memcpy(pdc->sess_key, psess_key, 16);
1302         memcpy(pdc->mach_pw, pmach_pw, 16);
1303
1304         /* We know these are true so didn't bother to store them. */
1305         pdc->challenge_sent = True;
1306         pdc->authenticated = True;
1307
1308         DEBUG(3,("secrets_restore_schannel_session_info: restored schannel info key %s\n",
1309                 keystr ));
1310
1311         SAFE_FREE(pseed_chal);
1312         SAFE_FREE(pclnt_chal);
1313         SAFE_FREE(psrv_chal);
1314         SAFE_FREE(psess_key);
1315         SAFE_FREE(pmach_pw);
1316
1317         TALLOC_FREE(keystr);
1318         SAFE_FREE(value.dptr);
1319
1320         *ppdc = pdc;
1321
1322         return True;
1323 }
1324
1325 bool secrets_store_generic(const char *owner, const char *key, const char *secret)
1326 {
1327         char *tdbkey = NULL;
1328         bool ret;
1329
1330         if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
1331                 DEBUG(0, ("asprintf failed!\n"));
1332                 return False;
1333         }
1334
1335         ret = secrets_store(tdbkey, secret, strlen(secret)+1);
1336
1337         SAFE_FREE(tdbkey);
1338         return ret;
1339 }
1340
1341 /*******************************************************************
1342  Find the ldap password.
1343 ******************************************************************/
1344
1345 char *secrets_fetch_generic(const char *owner, const char *key)
1346 {
1347         char *secret = NULL;
1348         char *tdbkey = NULL;
1349
1350         if (( ! owner) || ( ! key)) {
1351                 DEBUG(1, ("Invalid Paramters"));
1352                 return NULL;
1353         }
1354
1355         if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
1356                 DEBUG(0, ("Out of memory!\n"));
1357                 return NULL;
1358         }
1359
1360         secret = (char *)secrets_fetch(tdbkey, NULL);
1361         SAFE_FREE(tdbkey);
1362
1363         return secret;
1364 }
1365