secrets: Ensure we store the secureChannelType when written to secrets.ldb

This will allow winbindd to know when we are an RODC
without needing to dig into sam.ldb.

Change-Id: Ibdfa37fe6269305ccc5db42479f4a8db5eea53f3
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Nadezhda Ivanova <nivanova@samba.org>

diff --git a/source3/include/secrets.h b/source3/include/secrets.h
index 1eeb24c1c9bcda6d146f62c2504c451d84e82c01..16162e1dd9d54eac45dc111cb5310ed016b480ea 100644 (file)
--- a/source3/include/secrets.h
+++ b/source3/include/secrets.h
@@ -130,6 +130,7 @@ bool secrets_store_machine_pw_sync(const char *pass, const char *oldpass, const
                                   const char *realm,
                                   const char *salting_principal, uint32_t supported_enc_types,
                                   const struct dom_sid *domain_sid, uint32_t last_change_time,
+                                  uint32_t secure_channel,
                                   bool delete_join);
 
 /* The following definitions come from passdb/secrets_lsa.c  */

diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c
index 4e35a726382c16678ac76ceba416aeb12b6f9712..37ee9bcc4c4f6d6ad33ec3a66e50b8096f0bc4bb 100644 (file)
--- a/source3/passdb/machine_account_secrets.c
+++ b/source3/passdb/machine_account_secrets.c
@@ -482,11 +482,13 @@ bool secrets_store_machine_pw_sync(const char *pass, const char *oldpass, const
                                   const char *realm,
                                   const char *salting_principal, uint32_t supported_enc_types,
                                   const struct dom_sid *domain_sid, uint32_t last_change_time,
+                                  uint32_t secure_channel_type,
                                   bool delete_join)
 {
        bool ret;
        uint8_t last_change_time_store[4];
        TALLOC_CTX *frame = talloc_stackframe();
+       uint8_t sec_channel_bytes[4];
        void *value;
 
        if (delete_join) {
@@ -516,13 +518,23 @@ bool secrets_store_machine_pw_sync(const char *pass, const char *oldpass, const
                return ret;
        }
 
-       /* We delete this and instead have the read code fall back to
-        * a default based on server role, as our caller can't specify
-        * this with any more certainty */
-       value = secrets_fetch(machine_sec_channel_type_keystr(domain), NULL);
-       if (value) {
-               SAFE_FREE(value);
-               ret = secrets_delete(machine_sec_channel_type_keystr(domain));
+       if (secure_channel_type == 0) {
+               /* We delete this and instead have the read code fall back to
+                * a default based on server role, as our caller can't specify
+                * this with any more certainty */
+               value = secrets_fetch(machine_sec_channel_type_keystr(domain), NULL);
+               if (value) {
+                       SAFE_FREE(value);
+                       ret = secrets_delete(machine_sec_channel_type_keystr(domain));
+                       if (!ret) {
+                               TALLOC_FREE(frame);
+                               return ret;
+                       }
+               }
+       } else {
+               SIVAL(&sec_channel_bytes, 0, secure_channel_type);
+               ret = secrets_store(machine_sec_channel_type_keystr(domain), 
+                                   &sec_channel_bytes, sizeof(sec_channel_bytes));
                if (!ret) {
                        TALLOC_FREE(frame);
                        return ret;

diff --git a/source4/dsdb/samdb/ldb_modules/secrets_tdb_sync.c b/source4/dsdb/samdb/ldb_modules/secrets_tdb_sync.c
index 284aa1b6e2d09d6fe32e8964df1afc0ae8db59d4..7307f27fbeb00f35e45c9d86517a0af2f59a3376 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/secrets_tdb_sync.c
+++ b/source4/dsdb/samdb/ldb_modules/secrets_tdb_sync.c
@@ -408,6 +408,7 @@ static int secrets_tdb_sync_prepare_commit(struct ldb_module *module)
                                                    samdb_result_dom_sid(tmp_ctx, p->msg, "objectSid"),
 
                                                    lct,
+                                                   (uint32_t)ldb_msg_find_attr_as_int(p->msg, "secureChannelType", 0),
                                                    p->do_delete);
                if (ret == false) {
                        ldb_asprintf_errstring(ldb, "Failed to update secrets.tdb from entry %s in %s",