source: branches/samba-3.2.x/source/passdb/secrets.c@ 536

/*
   Unix SMB/CIFS implementation.
   Copyright (C) Andrew Tridgell 1992-2001
   Copyright (C) Andrew Bartlett      2002
   Copyright (C) Rafal Szczesniak     2002
   Copyright (C) Tim Potter           2001

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

/* the Samba secrets database stores any generated, private information
   such as the local SID and machine trust password */

#include "includes.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_PASSDB

static struct db_context *db_ctx;

/* Urrrg. global.... */
bool global_machine_password_needs_changing;

/**
 * Use a TDB to store an incrementing random seed.
 *
 * Initialised to the current pid, the very first time Samba starts,
 * and incremented by one each time it is needed.
 *
 * @note Not called by systems with a working /dev/urandom.
 */
static void get_rand_seed(int *new_seed)
{
        *new_seed = sys_getpid();
        if (db_ctx) {
                dbwrap_change_int32_atomic(db_ctx, "INFO/random_seed",
                                           new_seed, 1);
        }
}

/* open up the secrets database */
bool secrets_init(void)
{
        char *fname = NULL;
        unsigned char dummy;

        if (db_ctx != NULL)
                return True;

        fname = talloc_asprintf(talloc_tos(), "%s/secrets.tdb",
                                lp_private_dir());
        if (fname == NULL) {
                return false;
        }

        db_ctx = db_open_trans(NULL, fname, 0,
                               TDB_DEFAULT, O_RDWR|O_CREAT, 0600);

        if (db_ctx == NULL) {
                DEBUG(0,("Failed to open %s\n", fname));
                TALLOC_FREE(fname);
                return False;
        }

        TALLOC_FREE(fname);

        /**
         * Set a reseed function for the crypto random generator
         *
         * This avoids a problem where systems without /dev/urandom
         * could send the same challenge to multiple clients
         */
        set_rand_reseed_callback(get_rand_seed);

        /* Ensure that the reseed is done now, while we are root, etc */
        generate_random_buffer(&dummy, sizeof(dummy));

        return True;
}

struct db_context *secrets_db_ctx(void)
{
        if (!secrets_init()) {
                return NULL;
        }

        return db_ctx;
}

/*
 * close secrets.tdb
 */
void secrets_shutdown(void)
{
        TALLOC_FREE(db_ctx);
}

/* read a entry from the secrets database - the caller must free the result
   if size is non-null then the size of the entry is put in there
 */
void *secrets_fetch(const char *key, size_t *size)
{
        TDB_DATA dbuf;
        void *result;

        if (!secrets_init()) {
                return NULL;
        }

        if (db_ctx->fetch(db_ctx, talloc_tos(), string_tdb_data(key),
                          &dbuf) != 0) {
                return NULL;
        }

        result = memdup(dbuf.dptr, dbuf.dsize);
        if (result == NULL) {
                return NULL;
        }
        TALLOC_FREE(dbuf.dptr);

        if (size) {
                *size = dbuf.dsize;
        }

        return result;
}

/* store a secrets entry
 */
bool secrets_store(const char *key, const void *data, size_t size)
{
        NTSTATUS status;

        if (!secrets_init()) {
                return false;
        }

        status = dbwrap_trans_store(db_ctx, string_tdb_data(key),
                                    make_tdb_data((const uint8 *)data, size),
                                    TDB_REPLACE);
        return NT_STATUS_IS_OK(status);
}


/* delete a secets database entry
 */
bool secrets_delete(const char *key)
{
        NTSTATUS status;
        if (!secrets_init()) {
                return false;
        }

        status = dbwrap_trans_delete(db_ctx, string_tdb_data(key));

        return NT_STATUS_IS_OK(status);
}

/**
 * Form a key for fetching the domain sid
 *
 * @param domain domain name
 *
 * @return keystring
 **/
static const char *domain_sid_keystr(const char *domain)
{
        char *keystr;

        keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
                                            SECRETS_DOMAIN_SID, domain);
        SMB_ASSERT(keystr != NULL);
        return keystr;
}

bool secrets_store_domain_sid(const char *domain, const DOM_SID *sid)
{
        bool ret;

        ret = secrets_store(domain_sid_keystr(domain), sid, sizeof(DOM_SID));

        /* Force a re-query, in case we modified our domain */
        if (ret)
                reset_global_sam_sid();
        return ret;
}

bool secrets_fetch_domain_sid(const char *domain, DOM_SID *sid)
{
        DOM_SID *dyn_sid;
        size_t size = 0;

        dyn_sid = (DOM_SID *)secrets_fetch(domain_sid_keystr(domain), &size);

        if (dyn_sid == NULL)
                return False;

        if (size != sizeof(DOM_SID)) {
                SAFE_FREE(dyn_sid);
                return False;
        }

        *sid = *dyn_sid;
        SAFE_FREE(dyn_sid);
        return True;
}

bool secrets_store_domain_guid(const char *domain, struct GUID *guid)