source/passdb/secrets.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Andrew Tridgell 1992-2001
   4    Copyright (C) Andrew Bartlett      2002
   5    Copyright (C) Rafal Szczesniak     2002
   6    Copyright (C) Tim Potter           2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /* the Samba secrets database stores any generated, private information
  24    such as the local SID and machine trust password */
  25
  26 #include "includes.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_PASSDB
  30
  31 static TDB_CONTEXT *tdb;
  32
  33 /* Urrrg. global.... */
  34 BOOL global_machine_password_needs_changing;
  35
  36 /**
  37  * Use a TDB to store an incrementing random seed.
  38  *
  39  * Initialised to the current pid, the very first time Samba starts,
  40  * and incremented by one each time it is needed.
  41  *
  42  * @note Not called by systems with a working /dev/urandom.
  43  */
  44 static void get_rand_seed(int *new_seed)
  45 {
  46         *new_seed = sys_getpid();
  47         if (tdb) {
  48                 tdb_change_int32_atomic(tdb, "INFO/random_seed", new_seed, 1);
  49         }
  50 }
  51
  52 /* open up the secrets database */
  53 BOOL secrets_init(void)
  54 {
  55         pstring fname;
  56         unsigned char dummy;
  57
  58         if (tdb)
  59                 return True;
  60
  61         pstrcpy(fname, lp_private_dir());
  62         pstrcat(fname,"/secrets.tdb");
  63
  64         tdb = tdb_open_log(fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  65
  66         if (!tdb) {
  67                 DEBUG(0,("Failed to open %s\n", fname));
  68                 return False;
  69         }
  70
  71         /**
  72          * Set a reseed function for the crypto random generator
  73          *
  74          * This avoids a problem where systems without /dev/urandom
  75          * could send the same challenge to multiple clients
  76          */
  77         set_rand_reseed_callback(get_rand_seed);
  78
  79         /* Ensure that the reseed is done now, while we are root, etc */
  80         generate_random_buffer(&dummy, sizeof(dummy));
  81
  82         return True;
  83 }
  84
  85 /* read a entry from the secrets database - the caller must free the result
  86    if size is non-null then the size of the entry is put in there
  87  */
  88 void *secrets_fetch(const char *key, size_t *size)
  89 {
  90         TDB_DATA dbuf;
  91         secrets_init();
  92         if (!tdb)
  93                 return NULL;
  94         dbuf = tdb_fetch(tdb, string_tdb_data(key));
  95         if (size)
  96                 *size = dbuf.dsize;
  97         return dbuf.dptr;
  98 }
  99
 100 /* store a secrets entry
 101  */
 102 BOOL secrets_store(const char *key, const void *data, size_t size)
 103 {
 104         secrets_init();
 105         if (!tdb)
 106                 return False;
 107         return tdb_store(tdb, string_tdb_data(key), make_tdb_data(data, size),
 108                          TDB_REPLACE) == 0;
 109 }
 110
 111
 112 /* delete a secets database entry
 113  */
 114 BOOL secrets_delete(const char *key)
 115 {
 116         secrets_init();
 117         if (!tdb)
 118                 return False;
 119         return tdb_delete(tdb, string_tdb_data(key)) == 0;
 120 }
 121
 122 BOOL secrets_store_domain_sid(const char *domain, const DOM_SID *sid)
 123 {
 124         fstring key;
 125         BOOL ret;
 126
 127         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_SID, domain);
 128         strupper_m(key);
 129         ret = secrets_store(key, sid, sizeof(DOM_SID));
 130
 131         /* Force a re-query, in case we modified our domain */
 132         if (ret)
 133                 reset_global_sam_sid();
 134         return ret;
 135 }
 136
 137 BOOL secrets_fetch_domain_sid(const char *domain, DOM_SID *sid)
 138 {
 139         DOM_SID *dyn_sid;
 140         fstring key;
 141         size_t size = 0;
 142
 143         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_SID, domain);
 144         strupper_m(key);
 145         dyn_sid = (DOM_SID *)secrets_fetch(key, &size);
 146
 147         if (dyn_sid == NULL)
 148                 return False;
 149
 150         if (size != sizeof(DOM_SID)) {
 151                 SAFE_FREE(dyn_sid);
 152                 return False;
 153         }
 154
 155         *sid = *dyn_sid;
 156         SAFE_FREE(dyn_sid);
 157         return True;
 158 }
 159
 160 BOOL secrets_store_domain_guid(const char *domain, struct uuid *guid)
 161 {
 162         fstring key;
 163
 164         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
 165         strupper_m(key);
 166         return secrets_store(key, guid, sizeof(struct uuid));
 167 }
 168
 169 BOOL secrets_fetch_domain_guid(const char *domain, struct uuid *guid)
 170 {
 171         struct uuid *dyn_guid;
 172         fstring key;
 173         size_t size = 0;
 174         struct uuid new_guid;
 175
 176         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain);
 177         strupper_m(key);
 178         dyn_guid = (struct uuid *)secrets_fetch(key, &size);
 179
 180         if ((!dyn_guid) && (lp_server_role() == ROLE_DOMAIN_PDC)) {
 181                 smb_uuid_generate_random(&new_guid);
 182                 if (!secrets_store_domain_guid(domain, &new_guid))
 183                         return False;
 184                 dyn_guid = (struct uuid *)secrets_fetch(key, &size);
 185                 if (dyn_guid == NULL)
 186                         return False;
 187         }
 188
 189         if (size != sizeof(struct uuid)) {
 190                 DEBUG(1,("UUID size %d is wrong!\n", (int)size));
 191                 SAFE_FREE(dyn_guid);
 192                 return False;
 193         }
 194
 195         *guid = *dyn_guid;
 196         SAFE_FREE(dyn_guid);
 197         return True;
 198 }
 199
 200 /**
 201  * Form a key for fetching the machine trust account password
 202  *
 203  * @param domain domain name
 204  *
 205  * @return stored password's key
 206  **/
 207 const char *trust_keystr(const char *domain)
 208 {
 209         static fstring keystr;
 210
 211         slprintf(keystr,sizeof(keystr)-1,"%s/%s",
 212                  SECRETS_MACHINE_ACCT_PASS, domain);
 213         strupper_m(keystr);
 214
 215         return keystr;
 216 }
 217
 218 /**
 219  * Form a key for fetching a trusted domain password
 220  *
 221  * @param domain trusted domain name
 222  *
 223  * @return stored password's key
 224  **/
 225 static char *trustdom_keystr(const char *domain)
 226 {
 227         static pstring keystr;
 228
 229         pstr_sprintf(keystr, "%s/%s", SECRETS_DOMTRUST_ACCT_PASS, domain);
 230         strupper_m(keystr);
 231
 232         return keystr;
 233 }
 234
 235 /************************************************************************
 236  Lock the trust password entry.
 237 ************************************************************************/
 238
 239 BOOL secrets_lock_trust_account_password(const char *domain, BOOL dolock)
 240 {
 241         if (!tdb)
 242                 return False;
 243
 244         if (dolock)
 245                 return (tdb_lock_bystring(tdb, trust_keystr(domain),0) == 0);
 246         else
 247                 tdb_unlock_bystring(tdb, trust_keystr(domain));
 248         return True;
 249 }
 250
 251 /************************************************************************
 252  Routine to get the default secure channel type for trust accounts
 253 ************************************************************************/
 254
 255 uint32 get_default_sec_channel(void)
 256 {
 257         if (lp_server_role() == ROLE_DOMAIN_BDC ||
 258             lp_server_role() == ROLE_DOMAIN_PDC) {
 259                 return SEC_CHAN_BDC;
 260         } else {
 261                 return SEC_CHAN_WKSTA;
 262         }
 263 }
 264
 265 /************************************************************************
 266  Routine to get the trust account password for a domain.
 267  The user of this function must have locked the trust password file using
 268  the above secrets_lock_trust_account_password().
 269 ************************************************************************/
 270
 271 BOOL secrets_fetch_trust_account_password(const char *domain, uint8 ret_pwd[16],
 272                                           time_t *pass_last_set_time,
 273                                           uint32 *channel)
 274 {
 275         struct machine_acct_pass *pass;
 276         char *plaintext;
 277         size_t size = 0;
 278
 279         plaintext = secrets_fetch_machine_password(domain, pass_last_set_time,
 280                                                    channel);
 281         if (plaintext) {
 282                 DEBUG(4,("Using cleartext machine password\n"));
 283                 E_md4hash(plaintext, ret_pwd);
 284                 SAFE_FREE(plaintext);
 285                 return True;
 286         }
 287
 288         if (!(pass = secrets_fetch(trust_keystr(domain), &size))) {
 289                 DEBUG(5, ("secrets_fetch failed!\n"));
 290                 return False;
 291         }
 292
 293         if (size != sizeof(*pass)) {
 294                 DEBUG(0, ("secrets were of incorrect size!\n"));
 295                 return False;
 296         }
 297
 298         if (pass_last_set_time) {
 299                 *pass_last_set_time = pass->mod_time;
 300         }
 301         memcpy(ret_pwd, pass->hash, 16);
 302
 303         if (channel) {
 304                 *channel = get_default_sec_channel();
 305         }
 306
 307         /* Test if machine password has expired and needs to be changed */
 308         if (lp_machine_password_timeout()) {
 309                 if (pass->mod_time > 0 && time(NULL) > (pass->mod_time +
 310                                 lp_machine_password_timeout())) {
 311                         global_machine_password_needs_changing = True;
 312                 }
 313         }
 314
 315         SAFE_FREE(pass);
 316         return True;
 317 }
 318
 319 /************************************************************************
 320  Routine to get account password to trusted domain
 321 ************************************************************************/
 322
 323 BOOL secrets_fetch_trusted_domain_password(const char *domain, char** pwd,
 324                                            DOM_SID *sid, time_t *pass_last_set_time)
 325 {
 326         struct trusted_dom_pass pass;
 327         size_t size = 0;
 328
 329         /* unpacking structures */
 330         char* pass_buf;
 331         int pass_len = 0;
 332
 333         ZERO_STRUCT(pass);
 334
 335         /* fetching trusted domain password structure */
 336         if (!(pass_buf = secrets_fetch(trustdom_keystr(domain), &size))) {
 337                 DEBUG(5, ("secrets_fetch failed!\n"));
 338                 return False;
 339         }
 340
 341         /* unpack trusted domain password */
 342         pass_len = tdb_trusted_dom_pass_unpack(pass_buf, size, &pass);
 343         SAFE_FREE(pass_buf);
 344
 345         if (pass_len != size) {
 346                 DEBUG(5, ("Invalid secrets size. Unpacked data doesn't match trusted_dom_pass structure.\n"));
 347                 return False;
 348         }
 349
 350         /* the trust's password */
 351         if (pwd) {
 352                 *pwd = SMB_STRDUP(pass.pass);
 353                 if (!*pwd) {
 354                         return False;
 355                 }
 356         }
 357
 358         /* last change time */
 359         if (pass_last_set_time) *pass_last_set_time = pass.mod_time;
 360
 361         /* domain sid */
 362         if (sid != NULL) sid_copy(sid, &pass.domain_sid);
 363
 364         return True;
 365 }
 366
 367 /************************************************************************
 368  Routine to set the trust account password for a domain.
 369 ************************************************************************/
 370
 371 BOOL secrets_store_trust_account_password(const char *domain, uint8 new_pwd[16])
 372 {
 373         struct machine_acct_pass pass;
 374
 375         pass.mod_time = time(NULL);
 376         memcpy(pass.hash, new_pwd, 16);
 377
 378         return secrets_store(trust_keystr(domain), (void *)&pass, sizeof(pass));
 379 }
 380
 381 /**
 382  * Routine to store the password for trusted domain
 383  *
 384  * @param domain remote domain name
 385  * @param pwd plain text password of trust relationship
 386  * @param sid remote domain sid
 387  *
 388  * @return true if succeeded
 389  **/
 390
 391 BOOL secrets_store_trusted_domain_password(const char* domain, const char* pwd,
 392                                            const DOM_SID *sid)
 393 {
 394         smb_ucs2_t *uni_dom_name;
 395
 396         /* packing structures */
 397         pstring pass_buf;
 398         int pass_len = 0;
 399         int pass_buf_len = sizeof(pass_buf);
 400
 401         struct trusted_dom_pass pass;
 402         ZERO_STRUCT(pass);
 403
 404         if (push_ucs2_allocate(&uni_dom_name, domain) < 0) {
 405                 DEBUG(0, ("Could not convert domain name %s to unicode\n",
 406                           domain));
 407                 return False;
 408         }
 409
 410         strncpy_w(pass.uni_name, uni_dom_name, sizeof(pass.uni_name) - 1);
 411         pass.uni_name_len = strlen_w(uni_dom_name)+1;
 412
 413         /* last change time */
 414         pass.mod_time = time(NULL);
 415
 416         /* password of the trust */
 417         pass.pass_len = strlen(pwd);
 418         fstrcpy(pass.pass, pwd);
 419
 420         /* domain sid */
 421         sid_copy(&pass.domain_sid, sid);
 422
 423         pass_len = tdb_trusted_dom_pass_pack(pass_buf, pass_buf_len, &pass);
 424
 425         return secrets_store(trustdom_keystr(domain), (void *)&pass_buf, pass_len);
 426 }
 427
 428 /************************************************************************
 429  Routine to set the plaintext machine account password for a realm
 430 the password is assumed to be a null terminated ascii string
 431 ************************************************************************/
 432
 433 BOOL secrets_store_machine_password(const char *pass, const char *domain, uint32 sec_channel)
 434 {
 435         char *key = NULL;
 436         BOOL ret;
 437         uint32 last_change_time;
 438         uint32 sec_channel_type;
 439
 440         asprintf(&key, "%s/%s", SECRETS_MACHINE_PASSWORD, domain);
 441         if (!key)
 442                 return False;
 443         strupper_m(key);
 444
 445         ret = secrets_store(key, pass, strlen(pass)+1);
 446         SAFE_FREE(key);
 447
 448         if (!ret)
 449                 return ret;
 450
 451         asprintf(&key, "%s/%s", SECRETS_MACHINE_LAST_CHANGE_TIME, domain);
 452         if (!key)
 453                 return False;
 454         strupper_m(key);
 455
 456         SIVAL(&last_change_time, 0, time(NULL));
 457         ret = secrets_store(key, &last_change_time, sizeof(last_change_time));
 458         SAFE_FREE(key);
 459
 460         asprintf(&key, "%s/%s", SECRETS_MACHINE_SEC_CHANNEL_TYPE, domain);
 461         if (!key)
 462                 return False;
 463         strupper_m(key);
 464
 465         SIVAL(&sec_channel_type, 0, sec_channel);
 466         ret = secrets_store(key, &sec_channel_type, sizeof(sec_channel_type));
 467         SAFE_FREE(key);
 468
 469         return ret;
 470 }
 471
 472 /************************************************************************
 473  Routine to fetch the plaintext machine account password for a realm
 474  the password is assumed to be a null terminated ascii string.
 475 ************************************************************************/
 476
 477 char *secrets_fetch_machine_password(const char *domain,
 478                                      time_t *pass_last_set_time,
 479                                      uint32 *channel)
 480 {
 481         char *key = NULL;
 482         char *ret;
 483         asprintf(&key, "%s/%s", SECRETS_MACHINE_PASSWORD, domain);
 484         strupper_m(key);
 485         ret = (char *)secrets_fetch(key, NULL);
 486         SAFE_FREE(key);
 487
 488         if (pass_last_set_time) {
 489                 size_t size;
 490                 uint32 *last_set_time;
 491                 asprintf(&key, "%s/%s", SECRETS_MACHINE_LAST_CHANGE_TIME, domain);
 492                 strupper_m(key);
 493                 last_set_time = secrets_fetch(key, &size);
 494                 if (last_set_time) {
 495                         *pass_last_set_time = IVAL(last_set_time,0);
 496                         SAFE_FREE(last_set_time);
 497                 } else {
 498                         *pass_last_set_time = 0;
 499                 }
 500                 SAFE_FREE(key);
 501         }
 502
 503         if (channel) {
 504                 size_t size;
 505                 uint32 *channel_type;
 506                 asprintf(&key, "%s/%s", SECRETS_MACHINE_SEC_CHANNEL_TYPE, domain);
 507                 strupper_m(key);
 508                 channel_type = secrets_fetch(key, &size);
 509                 if (channel_type) {
 510                         *channel = IVAL(channel_type,0);
 511                         SAFE_FREE(channel_type);
 512                 } else {
 513                         *channel = get_default_sec_channel();
 514                 }
 515                 SAFE_FREE(key);
 516         }
 517
 518         return ret;
 519 }
 520
 521 /*******************************************************************
 522  Wrapper around retrieving the trust account password
 523 *******************************************************************/
 524
 525 BOOL get_trust_pw(const char *domain, uint8 ret_pwd[16], uint32 *channel)
 526 {
 527         DOM_SID sid;
 528         char *pwd;
 529         time_t last_set_time;
 530
 531         /* if we are a DC and this is not our domain, then lookup an account
 532                 for the domain trust */
 533
 534         if ( IS_DC && !strequal(domain, lp_workgroup()) && lp_allow_trusted_domains() ) {
 535                 if (!secrets_fetch_trusted_domain_password(domain, &pwd, &sid,
 536                                                         &last_set_time)) {
 537                         DEBUG(0, ("get_trust_pw: could not fetch trust "
 538                                 "account password for trusted domain %s\n",
 539                                 domain));
 540                         return False;
 541                 }
 542
 543                 *channel = SEC_CHAN_DOMAIN;
 544                 E_md4hash(pwd, ret_pwd);
 545                 SAFE_FREE(pwd);
 546
 547                 return True;
 548         }
 549
 550         /* Just get the account for the requested domain. In the future this
 551          * might also cover to be member of more than one domain. */
 552
 553         if (secrets_fetch_trust_account_password(domain, ret_pwd,
 554                                                 &last_set_time, channel))
 555                 return True;
 556
 557         DEBUG(5, ("get_trust_pw: could not fetch trust account "
 558                 "password for domain %s\n", domain));
 559         return False;
 560 }
 561
 562 /************************************************************************
 563  Routine to delete the machine trust account password file for a domain.
 564 ************************************************************************/
 565
 566 BOOL trust_password_delete(const char *domain)
 567 {
 568         return secrets_delete(trust_keystr(domain));
 569 }
 570
 571 /************************************************************************
 572  Routine to delete the password for trusted domain
 573 ************************************************************************/
 574
 575 BOOL trusted_domain_password_delete(const char *domain)
 576 {
 577         return secrets_delete(trustdom_keystr(domain));
 578 }
 579
 580 BOOL secrets_store_ldap_pw(const char* dn, char* pw)
 581 {
 582         char *key = NULL;
 583         BOOL ret;
 584
 585         if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, dn) < 0) {
 586                 DEBUG(0, ("secrets_store_ldap_pw: asprintf failed!\n"));
 587                 return False;
 588         }
 589
 590         ret = secrets_store(key, pw, strlen(pw)+1);
 591
 592         SAFE_FREE(key);
 593         return ret;
 594 }
 595
 596 /*******************************************************************
 597  Find the ldap password.
 598 ******************************************************************/
 599
 600 BOOL fetch_ldap_pw(char **dn, char** pw)
 601 {
 602         char *key = NULL;
 603         size_t size = 0;
 604
 605         *dn = smb_xstrdup(lp_ldap_admin_dn());
 606
 607         if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) {
 608                 SAFE_FREE(*dn);
 609                 DEBUG(0, ("fetch_ldap_pw: asprintf failed!\n"));
 610         }
 611
 612         *pw=secrets_fetch(key, &size);
 613         SAFE_FREE(key);
 614
 615         if (!size) {
 616                 /* Upgrade 2.2 style entry */
 617                 char *p;
 618                 char* old_style_key = SMB_STRDUP(*dn);
 619                 char *data;
 620                 fstring old_style_pw;
 621
 622                 if (!old_style_key) {
 623                         DEBUG(0, ("fetch_ldap_pw: strdup failed!\n"));
 624                         return False;
 625                 }
 626
 627                 for (p=old_style_key; *p; p++)
 628                         if (*p == ',') *p = '/';
 629
 630                 data=secrets_fetch(old_style_key, &size);
 631                 if (!size && size < sizeof(old_style_pw)) {
 632                         DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n"));
 633                         SAFE_FREE(old_style_key);
 634                         SAFE_FREE(*dn);
 635                         return False;
 636                 }
 637
 638                 size = MIN(size, sizeof(fstring)-1);
 639                 strncpy(old_style_pw, data, size);
 640                 old_style_pw[size] = 0;
 641
 642                 SAFE_FREE(data);
 643
 644                 if (!secrets_store_ldap_pw(*dn, old_style_pw)) {
 645                         DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n"));
 646                         SAFE_FREE(old_style_key);
 647                         SAFE_FREE(*dn);
 648                         return False;
 649                 }
 650                 if (!secrets_delete(old_style_key)) {
 651                         DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n"));
 652                 }
 653
 654                 SAFE_FREE(old_style_key);
 655
 656                 *pw = smb_xstrdup(old_style_pw);
 657         }
 658
 659         return True;
 660 }
 661
 662 /**
 663  * Get trusted domains info from secrets.tdb.
 664  **/
 665
 666 NTSTATUS secrets_trusted_domains(TALLOC_CTX *mem_ctx, uint32 *num_domains,
 667                                  struct trustdom_info ***domains)
 668 {
 669         TDB_LIST_NODE *keys, *k;
 670         char *pattern;
 671
 672         if (!secrets_init()) return NT_STATUS_ACCESS_DENIED;
 673
 674         /* generate searching pattern */
 675         pattern = talloc_asprintf(mem_ctx, "%s/*", SECRETS_DOMTRUST_ACCT_PASS);
 676         if (pattern == NULL) {
 677                 DEBUG(0, ("secrets_trusted_domains: talloc_asprintf() "
 678                           "failed!\n"));
 679                 return NT_STATUS_NO_MEMORY;
 680         }
 681
 682         *domains = NULL;
 683         *num_domains = 0;
 684
 685         /* fetching trusted domains' data and collecting them in a list */
 686         keys = tdb_search_keys(tdb, pattern);
 687
 688         /* searching for keys in secrets db -- way to go ... */
 689         for (k = keys; k; k = k->next) {
 690                 char *packed_pass;
 691                 size_t size = 0, packed_size = 0;
 692                 struct trusted_dom_pass pass;
 693                 char *secrets_key;
 694                 struct trustdom_info *dom_info;
 695
 696                 /* important: ensure null-termination of the key string */
 697                 secrets_key = talloc_strndup(mem_ctx,
 698                                              k->node_key.dptr,
 699                                              k->node_key.dsize);
 700                 if (!secrets_key) {
 701                         DEBUG(0, ("strndup failed!\n"));
 702                         return NT_STATUS_NO_MEMORY;
 703                 }
 704
 705                 packed_pass = secrets_fetch(secrets_key, &size);
 706                 packed_size = tdb_trusted_dom_pass_unpack(packed_pass, size,
 707                                                           &pass);
 708                 /* packed representation isn't needed anymore */
 709                 SAFE_FREE(packed_pass);
 710
 711                 if (size != packed_size) {
 712                         DEBUG(2, ("Secrets record %s is invalid!\n",
 713                                   secrets_key));
 714                         continue;
 715                 }
 716
 717                 if (pass.domain_sid.num_auths != 4) {
 718                         DEBUG(0, ("SID %s is not a domain sid, has %d "
 719                                   "auths instead of 4\n",
 720                                   sid_string_static(&pass.domain_sid),
 721                                   pass.domain_sid.num_auths));
 722                         continue;
 723                 }
 724
 725                 dom_info = TALLOC_P(mem_ctx, struct trustdom_info);
 726                 if (dom_info == NULL) {
 727                         DEBUG(0, ("talloc failed\n"));
 728                         return NT_STATUS_NO_MEMORY;
 729                 }
 730
 731                 if (pull_ucs2_talloc(mem_ctx, &dom_info->name,
 732                                      pass.uni_name) < 0) {
 733                         DEBUG(2, ("pull_ucs2_talloc failed\n"));
 734                         return NT_STATUS_NO_MEMORY;
 735                 }
 736
 737                 sid_copy(&dom_info->sid, &pass.domain_sid);
 738
 739                 ADD_TO_ARRAY(mem_ctx, struct trustdom_info *, dom_info,
 740                              domains, num_domains);
 741
 742                 if (*domains == NULL) {
 743                         return NT_STATUS_NO_MEMORY;
 744                 }
 745                 talloc_steal(*domains, dom_info);
 746         }
 747
 748         DEBUG(5, ("secrets_get_trusted_domains: got %d domains\n",
 749                   *num_domains));
 750
 751         /* free the results of searching the keys */
 752         tdb_search_list_free(keys);
 753
 754         return NT_STATUS_OK;
 755 }
 756
 757 /*******************************************************************************
 758  Lock the secrets tdb based on a string - this is used as a primitive form of mutex
 759  between smbd instances.
 760 *******************************************************************************/
 761
 762 BOOL secrets_named_mutex(const char *name, unsigned int timeout)
 763 {
 764         int ret = 0;
 765
 766         if (!secrets_init())
 767                 return False;
 768
 769         ret = tdb_lock_bystring(tdb, name, timeout);
 770         if (ret == 0)
 771                 DEBUG(10,("secrets_named_mutex: got mutex for %s\n", name ));
 772
 773         return (ret == 0);
 774 }
 775
 776 /*******************************************************************************
 777  Unlock a named mutex.
 778 *******************************************************************************/
 779
 780 void secrets_named_mutex_release(const char *name)
 781 {
 782         tdb_unlock_bystring(tdb, name);
 783         DEBUG(10,("secrets_named_mutex: released mutex for %s\n", name ));
 784 }
 785
 786 /*******************************************************************************
 787  Store a complete AFS keyfile into secrets.tdb.
 788 *******************************************************************************/
 789
 790 BOOL secrets_store_afs_keyfile(const char *cell, const struct afs_keyfile *keyfile)
 791 {
 792         fstring key;
 793
 794         if ((cell == NULL) || (keyfile == NULL))
 795                 return False;
 796
 797         if (ntohl(keyfile->nkeys) > SECRETS_AFS_MAXKEYS)
 798                 return False;
 799
 800         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell);
 801         return secrets_store(key, keyfile, sizeof(struct afs_keyfile));
 802 }
 803
 804 /*******************************************************************************
 805  Fetch the current (highest) AFS key from secrets.tdb
 806 *******************************************************************************/
 807 BOOL secrets_fetch_afs_key(const char *cell, struct afs_key *result)
 808 {
 809         fstring key;
 810         struct afs_keyfile *keyfile;
 811         size_t size = 0;
 812         uint32 i;
 813
 814         slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell);
 815
 816         keyfile = (struct afs_keyfile *)secrets_fetch(key, &size);
 817
 818         if (keyfile == NULL)
 819                 return False;
 820
 821         if (size != sizeof(struct afs_keyfile)) {
 822                 SAFE_FREE(keyfile);
 823                 return False;
 824         }
 825
 826         i = ntohl(keyfile->nkeys);
 827
 828         if (i > SECRETS_AFS_MAXKEYS) {
 829                 SAFE_FREE(keyfile);
 830                 return False;
 831         }
 832
 833         *result = keyfile->entry[i-1];
 834
 835         result->kvno = ntohl(result->kvno);
 836
 837         return True;
 838 }
 839
 840 /******************************************************************************
 841   When kerberos is not available, choose between anonymous or
 842   authenticated connections.
 843
 844   We need to use an authenticated connection if DCs have the
 845   RestrictAnonymous registry entry set > 0, or the "Additional
 846   restrictions for anonymous connections" set in the win2k Local
 847   Security Policy.
 848
 849   Caller to free() result in domain, username, password
 850 *******************************************************************************/
 851 void secrets_fetch_ipc_userpass(char **username, char **domain, char **password)
 852 {
 853         *username = secrets_fetch(SECRETS_AUTH_USER, NULL);
 854         *domain = secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 855         *password = secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 856
 857         if (*username && **username) {
 858
 859                 if (!*domain || !**domain)
 860                         *domain = smb_xstrdup(lp_workgroup());
 861
 862                 if (!*password || !**password)
 863                         *password = smb_xstrdup("");
 864
 865                 DEBUG(3, ("IPC$ connections done by user %s\\%s\n",
 866                           *domain, *username));
 867
 868         } else {
 869                 DEBUG(3, ("IPC$ connections done anonymously\n"));
 870                 *username = smb_xstrdup("");
 871                 *domain = smb_xstrdup("");
 872                 *password = smb_xstrdup("");
 873         }
 874 }
 875
 876 /******************************************************************************
 877  Open or create the schannel session store tdb.
 878 *******************************************************************************/
 879
 880 static TDB_CONTEXT *open_schannel_session_store(TALLOC_CTX *mem_ctx)
 881 {
 882         TDB_DATA vers;
 883         uint32 ver;
 884         TDB_CONTEXT *tdb_sc = NULL;
 885         char *fname = talloc_asprintf(mem_ctx, "%s/schannel_store.tdb", lp_private_dir());
 886
 887         if (!fname) {
 888                 return NULL;
 889         }
 890
 891         tdb_sc = tdb_open_log(fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
 892
 893         if (!tdb_sc) {
 894                 DEBUG(0,("open_schannel_session_store: Failed to open %s\n", fname));
 895                 TALLOC_FREE(fname);
 896                 return NULL;
 897         }
 898
 899         vers = tdb_fetch_bystring(tdb_sc, "SCHANNEL_STORE_VERSION");
 900         if (vers.dptr == NULL) {
 901                 /* First opener, no version. */
 902                 SIVAL(&ver,0,1);
 903                 vers.dptr = (char *)&ver;
 904                 vers.dsize = 4;
 905                 tdb_store_bystring(tdb_sc, "SCHANNEL_STORE_VERSION", vers, TDB_REPLACE);
 906                 vers.dptr = NULL;
 907         } else if (vers.dsize == 4) {
 908                 ver = IVAL(vers.dptr,0);
 909                 if (ver != 1) {
 910                         tdb_close(tdb_sc);
 911                         tdb_sc = NULL;
 912                         DEBUG(0,("open_schannel_session_store: wrong version number %d in %s\n",
 913                                 (int)ver, fname ));
 914                 }
 915         } else {
 916                 tdb_close(tdb_sc);
 917                 tdb_sc = NULL;
 918                 DEBUG(0,("open_schannel_session_store: wrong version number size %d in %s\n",
 919                         (int)vers.dsize, fname ));
 920         }
 921
 922         SAFE_FREE(vers.dptr);
 923         TALLOC_FREE(fname);
 924
 925         return tdb_sc;
 926 }
 927
 928 /******************************************************************************
 929  Store the schannel state after an AUTH2 call.
 930  Note we must be root here.
 931 *******************************************************************************/
 932
 933 BOOL secrets_store_schannel_session_info(TALLOC_CTX *mem_ctx,
 934                                 const char *remote_machine,
 935                                 const struct dcinfo *pdc)
 936 {
 937         TDB_CONTEXT *tdb_sc = NULL;
 938         TDB_DATA value;
 939         BOOL ret;
 940         char *keystr = talloc_asprintf(mem_ctx, "%s/%s", SECRETS_SCHANNEL_STATE,
 941                                 remote_machine);
 942         if (!keystr) {
 943                 return False;
 944         }
 945
 946         strupper_m(keystr);
 947
 948         /* Work out how large the record is. */
 949         value.dsize = tdb_pack(NULL, 0, "dBBBBBfff",
 950                                 pdc->sequence,
 951                                 8, pdc->seed_chal.data,
 952                                 8, pdc->clnt_chal.data,
 953                                 8, pdc->srv_chal.data,
 954                                 16, pdc->sess_key,
 955                                 16, pdc->mach_pw,
 956                                 pdc->mach_acct,
 957                                 pdc->remote_machine,
 958                                 pdc->domain);
 959
 960         value.dptr = TALLOC(mem_ctx, value.dsize);
 961         if (!value.dptr) {
 962                 TALLOC_FREE(keystr);
 963                 return False;
 964         }
 965
 966         value.dsize = tdb_pack(value.dptr, value.dsize, "dBBBBBfff",
 967                                 pdc->sequence,
 968                                 8, pdc->seed_chal.data,
 969                                 8, pdc->clnt_chal.data,
 970                                 8, pdc->srv_chal.data,
 971                                 16, pdc->sess_key,
 972                                 16, pdc->mach_pw,
 973                                 pdc->mach_acct,
 974                                 pdc->remote_machine,
 975                                 pdc->domain);
 976
 977         tdb_sc = open_schannel_session_store(mem_ctx);
 978         if (!tdb_sc) {
 979                 TALLOC_FREE(keystr);
 980                 TALLOC_FREE(value.dptr);
 981                 return False;
 982         }
 983
 984         ret = (tdb_store_bystring(tdb_sc, keystr, value, TDB_REPLACE) == 0 ? True : False);
 985
 986         DEBUG(3,("secrets_store_schannel_session_info: stored schannel info with key %s\n",
 987                 keystr ));
 988
 989         tdb_close(tdb_sc);
 990         TALLOC_FREE(keystr);
 991         TALLOC_FREE(value.dptr);
 992         return ret;
 993 }
 994
 995 /******************************************************************************
 996  Restore the schannel state on a client reconnect.
 997  Note we must be root here.
 998 *******************************************************************************/
 999
1000 BOOL secrets_restore_schannel_session_info(TALLOC_CTX *mem_ctx,
1001                                 const char *remote_machine,
1002                                 struct dcinfo **ppdc)
1003 {
1004         TDB_CONTEXT *tdb_sc = NULL;
1005         TDB_DATA value;
1006         unsigned char *pseed_chal = NULL;
1007         unsigned char *pclnt_chal = NULL;
1008         unsigned char *psrv_chal = NULL;
1009         unsigned char *psess_key = NULL;
1010         unsigned char *pmach_pw = NULL;
1011         uint32 l1, l2, l3, l4, l5;
1012         int ret;
1013         struct dcinfo *pdc = NULL;
1014         char *keystr = talloc_asprintf(mem_ctx, "%s/%s", SECRETS_SCHANNEL_STATE,
1015                                 remote_machine);
1016
1017         *ppdc = NULL;
1018
1019         if (!keystr) {
1020                 return False;
1021         }
1022
1023         strupper_m(keystr);
1024
1025         tdb_sc = open_schannel_session_store(mem_ctx);
1026         if (!tdb_sc) {
1027                 TALLOC_FREE(keystr);
1028                 return False;
1029         }
1030
1031         value = tdb_fetch_bystring(tdb_sc, keystr);
1032         if (!value.dptr) {
1033                 DEBUG(0,("secrets_restore_schannel_session_info: Failed to find entry with key %s\n",
1034                         keystr ));
1035                 tdb_close(tdb_sc);
1036                 return False;
1037         }
1038
1039         tdb_close(tdb_sc);
1040
1041         pdc = TALLOC_ZERO_P(mem_ctx, struct dcinfo);
1042
1043         /* Retrieve the record. */
1044         ret = tdb_unpack(value.dptr, value.dsize, "dBBBBBfff",
1045                                 &pdc->sequence,
1046                                 &l1, &pseed_chal,
1047                                 &l2, &pclnt_chal,
1048                                 &l3, &psrv_chal,
1049                                 &l4, &psess_key,
1050                                 &l5, &pmach_pw,
1051                                 &pdc->mach_acct,
1052                                 &pdc->remote_machine,
1053                                 &pdc->domain);
1054
1055         if (ret == -1 || l1 != 8 || l2 != 8 || l3 != 8 || l4 != 16 || l5 != 16) {
1056                 /* Bad record - delete it. */
1057                 tdb_delete_bystring(tdb_sc, keystr);
1058                 TALLOC_FREE(keystr);
1059                 TALLOC_FREE(pdc);
1060                 SAFE_FREE(pseed_chal);
1061                 SAFE_FREE(pclnt_chal);
1062                 SAFE_FREE(psrv_chal);
1063                 SAFE_FREE(psess_key);
1064                 SAFE_FREE(pmach_pw);
1065                 SAFE_FREE(value.dptr);
1066                 return False;
1067         }
1068
1069         memcpy(pdc->seed_chal.data, pseed_chal, 8);
1070         memcpy(pdc->clnt_chal.data, pclnt_chal, 8);
1071         memcpy(pdc->srv_chal.data, psrv_chal, 8);
1072         memcpy(pdc->sess_key, psess_key, 16);
1073         memcpy(pdc->mach_pw, pmach_pw, 16);
1074
1075         /* We know these are true so didn't bother to store them. */
1076         pdc->challenge_sent = True;
1077         pdc->authenticated = True;
1078
1079         DEBUG(3,("secrets_restore_schannel_session_info: restored schannel info key %s\n",
1080                 keystr ));
1081
1082         SAFE_FREE(pseed_chal);
1083         SAFE_FREE(pclnt_chal);
1084         SAFE_FREE(psrv_chal);
1085         SAFE_FREE(psess_key);
1086         SAFE_FREE(pmach_pw);
1087
1088         TALLOC_FREE(keystr);
1089         SAFE_FREE(value.dptr);
1090
1091         *ppdc = pdc;
1092
1093         return True;
1094 }