source3/libsmb/trusts_util.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Routines to operate on various trust relationships
   4  *  Copyright (C) Andrew Bartlett                   2001
   5  *  Copyright (C) Rafal Szczesniak                  2003
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23 #include "../libcli/auth/netlogon_creds_cli.h"
  24 #include "rpc_client/cli_netlogon.h"
  25 #include "rpc_client/cli_pipe.h"
  26 #include "../librpc/gen_ndr/ndr_netlogon.h"
  27 #include "secrets.h"
  28 #include "passdb.h"
  29 #include "libsmb/libsmb.h"
  30 #include "source3/include/messages.h"
  31 #include "source3/include/g_lock.h"
  32
  33 /*********************************************************
  34  Change the domain password on the PDC.
  35  Do most of the legwork ourselfs.  Caller must have
  36  already setup the connection to the NETLOGON pipe
  37 **********************************************************/
  38
  39 struct trust_pw_change_state {
  40         struct g_lock_ctx *g_ctx;
  41         char *g_lock_key;
  42 };
  43
  44 static int trust_pw_change_state_destructor(struct trust_pw_change_state *state)
  45 {
  46         g_lock_unlock(state->g_ctx, state->g_lock_key);
  47         return 0;
  48 }
  49
  50 NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
  51                          struct messaging_context *msg_ctx,
  52                          struct dcerpc_binding_handle *b,
  53                          const char *domain,
  54                          bool force)
  55 {
  56         TALLOC_CTX *frame = talloc_stackframe();
  57         struct trust_pw_change_state *state;
  58         struct samr_Password current_nt_hash;
  59         const struct samr_Password *previous_nt_hash = NULL;
  60         enum netr_SchannelType sec_channel_type = SEC_CHAN_NULL;
  61         const char *account_name;
  62         char *new_trust_passwd;
  63         char *pwd;
  64         struct dom_sid sid;
  65         time_t pass_last_set_time;
  66         struct timeval g_timeout = { 0, };
  67         int timeout = 0;
  68         struct timeval tv = { 0, };
  69         NTSTATUS status;
  70
  71         state = talloc_zero(frame, struct trust_pw_change_state);
  72         if (state == NULL) {
  73                 TALLOC_FREE(frame);
  74                 return NT_STATUS_NO_MEMORY;
  75         }
  76
  77         state->g_ctx = g_lock_ctx_init(state, msg_ctx);
  78         if (state->g_ctx == NULL) {
  79                 TALLOC_FREE(frame);
  80                 return NT_STATUS_NO_MEMORY;
  81         }
  82
  83         state->g_lock_key = talloc_asprintf(state,
  84                                 "trust_password_change_%s",
  85                                 domain);
  86         if (state->g_lock_key == NULL) {
  87                 TALLOC_FREE(frame);
  88                 return NT_STATUS_NO_MEMORY;
  89         }
  90
  91         g_timeout = timeval_current_ofs(10, 0);
  92         status = g_lock_lock(state->g_ctx,
  93                              state->g_lock_key,
  94                              G_LOCK_WRITE, g_timeout);
  95         if (!NT_STATUS_IS_OK(status)) {
  96                 DEBUG(1, ("could not get g_lock on [%s]!\n",
  97                           state->g_lock_key));
  98                 TALLOC_FREE(frame);
  99                 return status;
 100         }
 101
 102         talloc_set_destructor(state, trust_pw_change_state_destructor);
 103
 104         if (!get_trust_pw_hash(domain, current_nt_hash.hash,
 105                                &account_name,
 106                                &sec_channel_type)) {
 107                 DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
 108                 TALLOC_FREE(frame);
 109                 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
 110         }
 111
 112         switch (sec_channel_type) {
 113         case SEC_CHAN_WKSTA:
 114         case SEC_CHAN_BDC:
 115                 pwd = secrets_fetch_machine_password(domain,
 116                                                      &pass_last_set_time,
 117                                                      NULL);
 118                 if (pwd == NULL) {
 119                         TALLOC_FREE(frame);
 120                         return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
 121                 }
 122                 free(pwd);
 123                 break;
 124         case SEC_CHAN_DOMAIN:
 125                 if (!pdb_get_trusteddom_pw(domain, &pwd, &sid, &pass_last_set_time)) {
 126                         TALLOC_FREE(frame);
 127                         return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
 128                 }
 129                 break;
 130         default:
 131                 TALLOC_FREE(frame);
 132                 return NT_STATUS_NOT_SUPPORTED;
 133         }
 134
 135         timeout = lp_machine_password_timeout();
 136         if (timeout == 0) {
 137                 if (!force) {
 138                         DEBUG(10,("machine password never expires\n"));
 139                         TALLOC_FREE(frame);
 140                         return NT_STATUS_OK;
 141                 }
 142         }
 143
 144         tv.tv_sec = pass_last_set_time;
 145         DEBUG(10, ("password last changed %s\n",
 146                    timeval_string(talloc_tos(), &tv, false)));
 147         tv.tv_sec += timeout;
 148         DEBUGADD(10, ("password valid until %s\n",
 149                       timeval_string(talloc_tos(), &tv, false)));
 150
 151         if (!force && !timeval_expired(&tv)) {
 152                 TALLOC_FREE(frame);
 153                 return NT_STATUS_OK;
 154         }
 155
 156         /* Create a random machine account password */
 157         new_trust_passwd = generate_random_password(frame,
 158                                 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
 159                                 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
 160         if (new_trust_passwd == NULL) {
 161                 DEBUG(0, ("generate_random_password failed\n"));
 162                 TALLOC_FREE(frame);
 163                 return NT_STATUS_NO_MEMORY;
 164         }
 165
 166         status = netlogon_creds_cli_auth(context, b,
 167                                          current_nt_hash,
 168                                          previous_nt_hash);
 169         if (!NT_STATUS_IS_OK(status)) {
 170                 TALLOC_FREE(frame);
 171                 return status;
 172         }
 173
 174         status = netlogon_creds_cli_ServerPasswordSet(context, b,
 175                                                       new_trust_passwd, NULL);
 176         if (!NT_STATUS_IS_OK(status)) {
 177                 TALLOC_FREE(frame);
 178                 return status;
 179         }
 180
 181         DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n",
 182                  current_timestring(talloc_tos(), False)));
 183
 184         /*
 185          * Return the result of trying to write the new password
 186          * back into the trust account file.
 187          */
 188
 189         switch (sec_channel_type) {
 190
 191         case SEC_CHAN_WKSTA:
 192         case SEC_CHAN_BDC:
 193                 if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
 194                         TALLOC_FREE(frame);
 195                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 196                 }
 197                 break;
 198
 199         case SEC_CHAN_DOMAIN:
 200                 /*
 201                  * we need to get the sid first for the
 202                  * pdb_set_trusteddom_pw call
 203                  */
 204                 if (!pdb_set_trusteddom_pw(domain, new_trust_passwd, &sid)) {
 205                         TALLOC_FREE(frame);
 206                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 207                 }
 208                 break;
 209
 210         default:
 211                 smb_panic("Unsupported secure channel type");
 212                 break;
 213         }
 214
 215         TALLOC_FREE(frame);
 216         return NT_STATUS_OK;
 217 }