s3-spoolss: add some printer info validation for AddPrinter calls.

[abartlet/samba.git/.git] / source3 / libsmb / trusts_util.c

diff --git a/source3/libsmb/trusts_util.c b/source3/libsmb/trusts_util.c
index f0595695d2279920c04497f3a46941fea6fcca4c..8acdc0fa59ba2bfa6824bc20308c874ebc2bc4d2 100644 (file)
--- a/source3/libsmb/trusts_util.c
+++ b/source3/libsmb/trusts_util.c
@@ -19,6 +19,8 @@
  */
 
 #include "includes.h"
+#include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/cli_lsa.h"
 
 /*********************************************************
  Change the domain password on the PDC.
@@ -28,13 +30,22 @@
 
 NTSTATUS trust_pw_change_and_store_it(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, 
                                      const char *domain,
+                                     const char *account_name,
                                      unsigned char orig_trust_passwd_hash[16],
-                                     uint32 sec_channel_type)
+                                     enum netr_SchannelType sec_channel_type)
 {
        unsigned char new_trust_passwd_hash[16];
        char *new_trust_passwd;
        NTSTATUS nt_status;
-               
+
+       switch (sec_channel_type) {
+       case SEC_CHAN_WKSTA:
+       case SEC_CHAN_DOMAIN:
+               break;
+       default:
+               return NT_STATUS_NOT_SUPPORTED;
+       }
+
        /* Create a random machine account password */
        new_trust_passwd = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
 
@@ -42,24 +53,50 @@ NTSTATUS trust_pw_change_and_store_it(struct rpc_pipe_client *cli, TALLOC_CTX *m
                DEBUG(0, ("talloc_strdup failed\n"));
                return NT_STATUS_NO_MEMORY;
        }
-       
+
        E_md4hash(new_trust_passwd, new_trust_passwd_hash);
 
        nt_status = rpccli_netlogon_set_trust_password(cli, mem_ctx,
+                                                      account_name,
                                                       orig_trust_passwd_hash,
                                                       new_trust_passwd,
                                                       new_trust_passwd_hash,
                                                       sec_channel_type);
-       
+
        if (NT_STATUS_IS_OK(nt_status)) {
                DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n", 
-                        current_timestring(debug_ctx(), False)));
+                        current_timestring(talloc_tos(), False)));
                /*
                 * Return the result of trying to write the new password
                 * back into the trust account file.
                 */
-               if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
-                       nt_status = NT_STATUS_UNSUCCESSFUL;
+
+               switch (sec_channel_type) {
+
+               case SEC_CHAN_WKSTA:
+                       if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
+                               nt_status = NT_STATUS_UNSUCCESSFUL;
+                       }
+                       break;
+
+               case SEC_CHAN_DOMAIN: {
+                       char *pwd;
+                       struct dom_sid sid;
+                       time_t pass_last_set_time;
+
+                       /* we need to get the sid first for the
+                        * pdb_set_trusteddom_pw call */
+
+                       if (!pdb_get_trusteddom_pw(domain, &pwd, &sid, &pass_last_set_time)) {
+                               nt_status = NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
+                       }
+                       if (!pdb_set_trusteddom_pw(domain, new_trust_passwd, &sid)) {
+                               nt_status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                       }
+                       break;
+               }
+               default:
+                       break;
                }
        }
 
@@ -77,16 +114,17 @@ NTSTATUS trust_pw_find_change_and_store_it(struct rpc_pipe_client *cli,
                                           const char *domain) 
 {
        unsigned char old_trust_passwd_hash[16];
-       uint32 sec_channel_type = 0;
+       enum netr_SchannelType sec_channel_type = SEC_CHAN_NULL;
+       const char *account_name;
 
-       if (!secrets_fetch_trust_account_password(domain,
-                                                 old_trust_passwd_hash, 
-                                                 NULL, &sec_channel_type)) {
+       if (!get_trust_pw_hash(domain, old_trust_passwd_hash, &account_name,
+                              &sec_channel_type)) {
                DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
                return NT_STATUS_UNSUCCESSFUL;
        }
-       
+
        return trust_pw_change_and_store_it(cli, mem_ctx, domain,
+                                           account_name,
                                            old_trust_passwd_hash,
                                            sec_channel_type);
 }
@@ -99,13 +137,13 @@ bool enumerate_domain_trusts( TALLOC_CTX *mem_ctx, const char *domain,
                                      char ***domain_names, uint32 *num_domains,
                                     DOM_SID **sids )
 {
-       POLICY_HND      pol;
+       struct policy_handle    pol;
        NTSTATUS        result = NT_STATUS_UNSUCCESSFUL;
        fstring         dc_name;
        struct sockaddr_storage dc_ss;
        uint32          enum_ctx = 0;
        struct cli_state *cli = NULL;
-       struct rpc_pipe_client *lsa_pipe;
+       struct rpc_pipe_client *lsa_pipe = NULL;
        bool            retry;
        struct lsa_DomainList dom_list;
        int i;