mirror of
https://github.com/samba-team/samba.git
synced 2024-12-25 23:21:54 +03:00
85450cb1c9
(This used to be commit 153c4a56b0
)
237 lines
6.2 KiB
C
237 lines
6.2 KiB
C
/*
|
|
Unix SMB/Netbios implementation.
|
|
Version 3.0.
|
|
Copyright (C) Andrew Tridgell 1992-2001
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program; if not, write to the Free Software
|
|
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
*/
|
|
|
|
/* the Samba secrets database stores any generated, private information
|
|
such as the local SID and machine trust password */
|
|
|
|
#include "includes.h"
|
|
|
|
static TDB_CONTEXT *tdb;
|
|
|
|
/* open up the secrets database */
|
|
BOOL secrets_init(void)
|
|
{
|
|
pstring fname;
|
|
|
|
if (tdb)
|
|
return True;
|
|
|
|
pstrcpy(fname, lp_private_dir());
|
|
pstrcat(fname,"/secrets.tdb");
|
|
|
|
tdb = tdb_open_log(fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
|
|
|
|
if (!tdb) {
|
|
DEBUG(0,("Failed to open %s\n", fname));
|
|
return False;
|
|
}
|
|
return True;
|
|
}
|
|
|
|
/* read a entry from the secrets database - the caller must free the result
|
|
if size is non-null then the size of the entry is put in there
|
|
*/
|
|
void *secrets_fetch(char *key, size_t *size)
|
|
{
|
|
TDB_DATA kbuf, dbuf;
|
|
if (!tdb)
|
|
return NULL;
|
|
kbuf.dptr = key;
|
|
kbuf.dsize = strlen(key);
|
|
dbuf = tdb_fetch(tdb, kbuf);
|
|
if (size)
|
|
*size = dbuf.dsize;
|
|
return dbuf.dptr;
|
|
}
|
|
|
|
/* store a secrets entry
|
|
*/
|
|
BOOL secrets_store(char *key, void *data, size_t size)
|
|
{
|
|
TDB_DATA kbuf, dbuf;
|
|
if (!tdb)
|
|
return False;
|
|
kbuf.dptr = key;
|
|
kbuf.dsize = strlen(key);
|
|
dbuf.dptr = data;
|
|
dbuf.dsize = size;
|
|
return tdb_store(tdb, kbuf, dbuf, TDB_REPLACE) == 0;
|
|
}
|
|
|
|
|
|
/* delete a secets database entry
|
|
*/
|
|
BOOL secrets_delete(char *key)
|
|
{
|
|
TDB_DATA kbuf;
|
|
if (!tdb)
|
|
return False;
|
|
kbuf.dptr = key;
|
|
kbuf.dsize = strlen(key);
|
|
return tdb_delete(tdb, kbuf) == 0;
|
|
}
|
|
|
|
BOOL secrets_store_domain_sid(char *domain, DOM_SID *sid)
|
|
{
|
|
fstring key;
|
|
|
|
slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_SID, domain);
|
|
return secrets_store(key, sid, sizeof(DOM_SID));
|
|
}
|
|
|
|
BOOL secrets_fetch_domain_sid(char *domain, DOM_SID *sid)
|
|
{
|
|
DOM_SID *dyn_sid;
|
|
fstring key;
|
|
size_t size;
|
|
|
|
slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_SID, domain);
|
|
dyn_sid = (DOM_SID *)secrets_fetch(key, &size);
|
|
|
|
if (dyn_sid == NULL)
|
|
return False;
|
|
|
|
if (size != sizeof(DOM_SID))
|
|
{
|
|
SAFE_FREE(dyn_sid);
|
|
return False;
|
|
}
|
|
|
|
*sid = *dyn_sid;
|
|
SAFE_FREE(dyn_sid);
|
|
return True;
|
|
}
|
|
|
|
|
|
/************************************************************************
|
|
form a key for fetching a domain trust password
|
|
************************************************************************/
|
|
char *trust_keystr(char *domain)
|
|
{
|
|
static fstring keystr;
|
|
|
|
slprintf(keystr,sizeof(keystr)-1,"%s/%s",
|
|
SECRETS_MACHINE_ACCT_PASS, domain);
|
|
|
|
return keystr;
|
|
}
|
|
|
|
/************************************************************************
|
|
Routine to get the trust account password for a domain.
|
|
************************************************************************/
|
|
BOOL secrets_fetch_trust_account_password(char *domain, uint8 ret_pwd[16],
|
|
time_t *pass_last_set_time)
|
|
{
|
|
struct machine_acct_pass *pass;
|
|
char *plaintext;
|
|
size_t size;
|
|
|
|
plaintext = secrets_fetch_machine_password();
|
|
if (plaintext) {
|
|
/* we have an ADS password - use that */
|
|
DEBUG(4,("Using ADS machine password\n"));
|
|
E_md4hash((uchar *)plaintext, ret_pwd);
|
|
SAFE_FREE(plaintext);
|
|
return True;
|
|
}
|
|
|
|
if (!(pass = secrets_fetch(trust_keystr(domain), &size)) ||
|
|
size != sizeof(*pass))
|
|
return False;
|
|
|
|
if (pass_last_set_time) *pass_last_set_time = pass->mod_time;
|
|
memcpy(ret_pwd, pass->hash, 16);
|
|
SAFE_FREE(pass);
|
|
return True;
|
|
}
|
|
|
|
|
|
/************************************************************************
|
|
Routine to set the trust account password for a domain.
|
|
************************************************************************/
|
|
BOOL secrets_store_trust_account_password(char *domain, uint8 new_pwd[16])
|
|
{
|
|
struct machine_acct_pass pass;
|
|
|
|
pass.mod_time = time(NULL);
|
|
memcpy(pass.hash, new_pwd, 16);
|
|
|
|
return secrets_store(trust_keystr(domain), (void *)&pass, sizeof(pass));
|
|
}
|
|
|
|
/************************************************************************
|
|
Routine to set the plaintext machine account password for a realm
|
|
the password is assumed to be a null terminated ascii string
|
|
************************************************************************/
|
|
BOOL secrets_store_machine_password(char *pass)
|
|
{
|
|
return secrets_store(SECRETS_MACHINE_PASSWORD, pass, strlen(pass)+1);
|
|
}
|
|
|
|
|
|
/************************************************************************
|
|
Routine to fetch the plaintext machine account password for a realm
|
|
the password is assumed to be a null terminated ascii string
|
|
************************************************************************/
|
|
char *secrets_fetch_machine_password(void)
|
|
{
|
|
return (char *)secrets_fetch(SECRETS_MACHINE_PASSWORD, NULL);
|
|
}
|
|
|
|
|
|
|
|
/************************************************************************
|
|
Routine to delete the trust account password file for a domain.
|
|
************************************************************************/
|
|
|
|
BOOL trust_password_delete(char *domain)
|
|
{
|
|
return secrets_delete(trust_keystr(domain));
|
|
}
|
|
|
|
/*******************************************************************
|
|
Reset the 'done' variables so after a client process is created
|
|
from a fork call these calls will be re-done. This should be
|
|
expanded if more variables need reseting.
|
|
******************************************************************/
|
|
|
|
void reset_globals_after_fork(void)
|
|
{
|
|
unsigned char dummy;
|
|
|
|
/*
|
|
* Increment the global seed value to ensure every smbd starts
|
|
* with a new random seed.
|
|
*/
|
|
|
|
if (tdb) {
|
|
uint32 initial_val = sys_getpid();
|
|
tdb_change_int_atomic(tdb, "INFO/random_seed", (int *)&initial_val, 1);
|
|
set_rand_reseed_data((unsigned char *)&initial_val, sizeof(initial_val));
|
|
}
|
|
|
|
/*
|
|
* Re-seed the random crypto generator, so all smbd's
|
|
* started from the same parent won't generate the same
|
|
* sequence.
|
|
*/
|
|
generate_random_buffer( &dummy, 1, True);
|
|
}
|