dbwrap: Use tdb_null in db_ctdb_delete
[Samba/gbeck.git] / source3 / libsmb / trusts_util.c
blob0d039bc812e8eac127c53050e25176956d003e3d
1 /*
2 * Unix SMB/CIFS implementation.
3 * Routines to operate on various trust relationships
4 * Copyright (C) Andrew Bartlett 2001
5 * Copyright (C) Rafal Szczesniak 2003
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "includes.h"
22 #include "../libcli/auth/libcli_auth.h"
23 #include "rpc_client/cli_netlogon.h"
24 #include "rpc_client/cli_pipe.h"
25 #include "../librpc/gen_ndr/ndr_netlogon.h"
26 #include "secrets.h"
27 #include "passdb.h"
28 #include "libsmb/libsmb.h"
30 /*********************************************************
31 Change the domain password on the PDC.
32 Store the password ourselves, but use the supplied password
33 Caller must have already setup the connection to the NETLOGON pipe
34 **********************************************************/
36 NTSTATUS trust_pw_change_and_store_it(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
37 const char *domain,
38 const char *account_name,
39 unsigned char orig_trust_passwd_hash[16],
40 enum netr_SchannelType sec_channel_type)
42 unsigned char new_trust_passwd_hash[16];
43 char *new_trust_passwd;
44 NTSTATUS nt_status;
46 switch (sec_channel_type) {
47 case SEC_CHAN_WKSTA:
48 case SEC_CHAN_DOMAIN:
49 break;
50 default:
51 return NT_STATUS_NOT_SUPPORTED;
54 /* Create a random machine account password */
55 new_trust_passwd = generate_random_password(mem_ctx,
56 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
57 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
58 if (new_trust_passwd == NULL) {
59 DEBUG(0, ("generate_random_password failed\n"));
60 return NT_STATUS_NO_MEMORY;
63 E_md4hash(new_trust_passwd, new_trust_passwd_hash);
65 nt_status = rpccli_netlogon_set_trust_password(cli, mem_ctx,
66 account_name,
67 orig_trust_passwd_hash,
68 new_trust_passwd,
69 new_trust_passwd_hash,
70 sec_channel_type);
72 if (NT_STATUS_IS_OK(nt_status)) {
73 DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n",
74 current_timestring(talloc_tos(), False)));
76 * Return the result of trying to write the new password
77 * back into the trust account file.
80 switch (sec_channel_type) {
82 case SEC_CHAN_WKSTA:
83 if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
84 nt_status = NT_STATUS_UNSUCCESSFUL;
86 break;
88 case SEC_CHAN_DOMAIN: {
89 char *pwd;
90 struct dom_sid sid;
91 time_t pass_last_set_time;
93 /* we need to get the sid first for the
94 * pdb_set_trusteddom_pw call */
96 if (!pdb_get_trusteddom_pw(domain, &pwd, &sid, &pass_last_set_time)) {
97 nt_status = NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
99 if (!pdb_set_trusteddom_pw(domain, new_trust_passwd, &sid)) {
100 nt_status = NT_STATUS_INTERNAL_DB_CORRUPTION;
102 break;
104 default:
105 break;
109 return nt_status;
112 /*********************************************************
113 Change the domain password on the PDC.
114 Do most of the legwork ourselfs. Caller must have
115 already setup the connection to the NETLOGON pipe
116 **********************************************************/
118 NTSTATUS trust_pw_find_change_and_store_it(struct rpc_pipe_client *cli,
119 TALLOC_CTX *mem_ctx,
120 const char *domain)
122 unsigned char old_trust_passwd_hash[16];
123 enum netr_SchannelType sec_channel_type = SEC_CHAN_NULL;
124 const char *account_name;
126 if (!get_trust_pw_hash(domain, old_trust_passwd_hash, &account_name,
127 &sec_channel_type)) {
128 DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
129 return NT_STATUS_UNSUCCESSFUL;
132 return trust_pw_change_and_store_it(cli, mem_ctx, domain,
133 account_name,
134 old_trust_passwd_hash,
135 sec_channel_type);
138 NTSTATUS change_trust_account_password( const char *domain, const char *remote_machine)
140 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
141 struct sockaddr_storage pdc_ss;
142 fstring dc_name;
143 struct cli_state *cli = NULL;
144 struct rpc_pipe_client *netlogon_pipe = NULL;
146 DEBUG(5,("change_trust_account_password: Attempting to change trust account password in domain %s....\n",
147 domain));
149 if (remote_machine == NULL || !strcmp(remote_machine, "*")) {
150 /* Use the PDC *only* for this */
152 if ( !get_pdc_ip(domain, &pdc_ss) ) {
153 DEBUG(0,("Can't get IP for PDC for domain %s\n", domain));
154 goto failed;
157 if ( !name_status_find( domain, 0x1b, 0x20, &pdc_ss, dc_name) )
158 goto failed;
159 } else {
160 /* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */
161 fstrcpy( dc_name, remote_machine );
164 /* if this next call fails, then give up. We can't do
165 password changes on BDC's --jerry */
167 if (!NT_STATUS_IS_OK(cli_full_connection(&cli, lp_netbios_name(), dc_name,
168 NULL, 0,
169 "IPC$", "IPC",
170 "", "",
171 "", 0, SMB_SIGNING_DEFAULT))) {
172 DEBUG(0,("modify_trust_password: Connection to %s failed!\n", dc_name));
173 nt_status = NT_STATUS_UNSUCCESSFUL;
174 goto failed;
178 * Ok - we have an anonymous connection to the IPC$ share.
179 * Now start the NT Domain stuff :-).
182 /* Shouldn't we open this with schannel ? JRA. */
184 nt_status = cli_rpc_pipe_open_noauth(
185 cli, &ndr_table_netlogon.syntax_id, &netlogon_pipe);
186 if (!NT_STATUS_IS_OK(nt_status)) {
187 DEBUG(0,("modify_trust_password: unable to open the domain client session to machine %s. Error was : %s.\n",
188 dc_name, nt_errstr(nt_status)));
189 cli_shutdown(cli);
190 cli = NULL;
191 goto failed;
194 nt_status = trust_pw_find_change_and_store_it(
195 netlogon_pipe, netlogon_pipe, domain);
197 cli_shutdown(cli);
198 cli = NULL;
200 failed:
201 if (!NT_STATUS_IS_OK(nt_status)) {
202 DEBUG(0,("%s : change_trust_account_password: Failed to change password for domain %s.\n",
203 current_timestring(talloc_tos(), False), domain));
205 else
206 DEBUG(5,("change_trust_account_password: sucess!\n"));
208 return nt_status;