X-Git-Url: http://git.samba.org/?a=blobdiff_plain;f=source4%2Fparam%2Fsecrets.c;h=407e27ff670edae95e96b348b2364434505348da;hb=af4a7c0f4be4bb94d6299e93f22d26e2f8340e69;hp=6640fd473d9156382aa9ca44413b81ceb7c2ed95;hpb=d5a93dfcb950ecd52d8dea7a2a5d667feb6259ca;p=abartlet%2Fsamba.git%2F.git diff --git a/source4/param/secrets.c b/source4/param/secrets.c index 6640fd473d9..407e27ff670 100644 --- a/source4/param/secrets.c +++ b/source4/param/secrets.c @@ -25,13 +25,15 @@ #include "secrets.h" #include "param/param.h" #include "system/filesys.h" -#include "db_wrap.h" +#include "tdb_wrap.h" #include "lib/ldb/include/ldb.h" -#include "lib/tdb/include/tdb.h" -#include "lib/util/util_tdb.h" +#include "../tdb/include/tdb.h" +#include "../lib/util/util_tdb.h" +#include "../lib/util/util_ldb.h" +#include "librpc/gen_ndr/ndr_security.h" #include "dsdb/samdb/samdb.h" - -static struct tdb_wrap *tdb; +#include "dsdb/common/util.h" +#include "dsdb/common/proto.h" /** * Use a TDB to store an incrementing random seed. @@ -41,39 +43,33 @@ static struct tdb_wrap *tdb; * * @note Not called by systems with a working /dev/urandom. */ -static void get_rand_seed(int *new_seed) +static void get_rand_seed(struct tdb_wrap *secretsdb, int *new_seed) { *new_seed = getpid(); - if (tdb) { - tdb_change_int32_atomic(tdb->tdb, "INFO/random_seed", new_seed, 1); + if (secretsdb != NULL) { + tdb_change_int32_atomic(secretsdb->tdb, "INFO/random_seed", new_seed, 1); } } -/* close the secrets database */ -void secrets_shutdown(void) -{ - talloc_free(tdb); -} - -/* open up the secrets database */ -bool secrets_init(void) +/** + * open up the secrets database + */ +struct tdb_wrap *secrets_init(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx) { char *fname; uint8_t dummy; + struct tdb_wrap *tdb; - if (tdb) - return true; + fname = private_path(mem_ctx, lp_ctx, "secrets.tdb"); - asprintf(&fname, "%s/secrets.tdb", lp_private_dir(global_loadparm)); - - tdb = tdb_wrap_open(talloc_autofree_context(), fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600); + tdb = tdb_wrap_open(mem_ctx, fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600); if (!tdb) { DEBUG(0,("Failed to open %s\n", fname)); - SAFE_FREE(fname); - return false; + talloc_free(fname); + return NULL; } - SAFE_FREE(fname); + talloc_free(fname); /** * Set a reseed function for the crypto random generator @@ -81,99 +77,117 @@ bool secrets_init(void) * This avoids a problem where systems without /dev/urandom * could send the same challenge to multiple clients */ - set_rand_reseed_callback(get_rand_seed); + set_rand_reseed_callback((void (*) (void *, int *))get_rand_seed, tdb); /* Ensure that the reseed is done now, while we are root, etc */ generate_random_buffer(&dummy, sizeof(dummy)); - return true; + return tdb; } -/* - connect to the schannel ldb +/** + connect to the secrets ldb */ -struct ldb_context *secrets_db_connect(TALLOC_CTX *mem_ctx) +struct ldb_context *secrets_db_connect(TALLOC_CTX *mem_ctx, + struct tevent_context *ev_ctx, + struct loadparm_context *lp_ctx) { char *path; const char *url; struct ldb_context *ldb; - bool existed; - const char *init_ldif = - "dn: @ATTRIBUTES\n" \ - "computerName: CASE_INSENSITIVE\n" \ - "flatname: CASE_INSENSITIVE\n"; - url = lp_secrets_url(global_loadparm); + url = lp_secrets_url(lp_ctx); if (!url || !url[0]) { return NULL; } - path = private_path(mem_ctx, global_loadparm, url); + path = private_path(mem_ctx, lp_ctx, url); if (!path) { return NULL; } - existed = file_exist(path); - /* Secrets.ldb *must* always be local. If we call for a * system_session() we will recurse */ - ldb = ldb_wrap_connect(mem_ctx, global_loadparm, path, NULL, NULL, 0, NULL); - talloc_free(path); + ldb = ldb_init(mem_ctx, ev_ctx); if (!ldb) { + talloc_free(path); return NULL; } - - if (!existed) { - gendb_add_ldif(ldb, init_ldif); + + ldb_set_modules_dir(ldb, + talloc_asprintf(ldb, "%s/ldb", lp_modulesdir(lp_ctx))); + + if (ldb_connect(ldb, path, 0, NULL) != 0) { + talloc_free(path); + return NULL; } + /* the update_keytab module relies on this being setup */ + if (ldb_set_opaque(ldb, "loadparm", lp_ctx) != LDB_SUCCESS) { + talloc_free(path); + talloc_free(ldb); + return NULL; + } + + talloc_free(path); + return ldb; } +/** + * Retrieve the domain SID from the secrets database. + * @return pointer to a SID object if the SID could be obtained, NULL otherwise + */ struct dom_sid *secrets_get_domain_sid(TALLOC_CTX *mem_ctx, - const char *domain) + struct tevent_context *ev_ctx, + struct loadparm_context *lp_ctx, + const char *domain, + char **errstring) { struct ldb_context *ldb; - struct ldb_message **msgs; + struct ldb_message *msg; int ldb_ret; const char *attrs[] = { "objectSid", NULL }; struct dom_sid *result = NULL; + const struct ldb_val *v; + enum ndr_err_code ndr_err; + *errstring = NULL; - ldb = secrets_db_connect(mem_ctx); + ldb = secrets_db_connect(mem_ctx, ev_ctx, lp_ctx); if (ldb == NULL) { DEBUG(5, ("secrets_db_connect failed\n")); return NULL; } - ldb_ret = gendb_search(ldb, ldb, - ldb_dn_new(mem_ctx, ldb, SECRETS_PRIMARY_DOMAIN_DN), - &msgs, attrs, - SECRETS_PRIMARY_DOMAIN_FILTER, domain); + ldb_ret = dsdb_search_one(ldb, ldb, &msg, + ldb_dn_new(mem_ctx, ldb, SECRETS_PRIMARY_DOMAIN_DN), + LDB_SCOPE_ONELEVEL, + attrs, 0, SECRETS_PRIMARY_DOMAIN_FILTER, domain); - if (ldb_ret == -1) { - DEBUG(5, ("Error searching for domain SID for %s: %s", - domain, ldb_errstring(ldb))); - talloc_free(ldb); + if (ldb_ret != LDB_SUCCESS) { + *errstring = talloc_asprintf(mem_ctx, "Failed to find record for %s in %s: %s: %s", + domain, ldb_get_opaque(ldb, "ldb_url"), + ldb_strerror(ldb_ret), ldb_errstring(ldb)); return NULL; } - - if (ldb_ret == 0) { - DEBUG(5, ("Did not find domain record for %s\n", domain)); - talloc_free(ldb); + v = ldb_msg_find_ldb_val(msg, "objectSid"); + if (v == NULL) { + *errstring = talloc_asprintf(mem_ctx, "Failed to find a SID on record for %s in %s", + domain, ldb_get_opaque(ldb, "ldb_url")); return NULL; } - - if (ldb_ret > 1) { - DEBUG(5, ("Found more than one (%d) domain records for %s\n", - ldb_ret, domain)); + result = talloc(mem_ctx, struct dom_sid); + if (result == NULL) { talloc_free(ldb); return NULL; } - result = samdb_result_dom_sid(mem_ctx, msgs[0], "objectSid"); - if (result == NULL) { - DEBUG(0, ("Domain object for %s does not contain a SID!\n", - domain)); + ndr_err = ndr_pull_struct_blob(v, result, NULL, result, + (ndr_pull_flags_fn_t)ndr_pull_dom_sid); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + *errstring = talloc_asprintf(mem_ctx, "Failed to parse SID on record for %s in %s", + domain, ldb_get_opaque(ldb, "ldb_url")); + talloc_free(result); talloc_free(ldb); return NULL; }