Store a local schannel key in secrets.tdb

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 7cdcba19ab203275fb18dd214b1bc9252ce38a27..41544da8c988957eda93735e325843399b1b962c 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -6421,6 +6421,8 @@ bool secrets_restore_schannel_session_info(TALLOC_CTX *mem_ctx,
                                struct dcinfo **ppdc);
 bool secrets_store_generic(const char *owner, const char *key, const char *secret);
 char *secrets_fetch_generic(const char *owner, const char *key);
+bool secrets_store_local_schannel_key(uint8_t schannel_key[16]);
+bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16]);
 
 /* The following definitions come from passdb/util_builtin.c  */
 

diff --git a/source3/include/secrets.h b/source3/include/secrets.h
index d9f457558bf6db2c9f5a89d34968eaaadd5f55e0..3c8e2ccf81ac166f5d9926c2f2f3580787e13726 100644 (file)
--- a/source3/include/secrets.h
+++ b/source3/include/secrets.h
@@ -45,6 +45,8 @@
 
 #define SECRETS_LDAP_BIND_PW "SECRETS/LDAP_BIND_PW"
 
+#define SECRETS_LOCAL_SCHANNEL_KEY "SECRETS/LOCAL_SCHANNEL_KEY"
+
 /* Authenticated user info is stored in secrets.tdb under these keys */
 
 #define SECRETS_AUTH_USER      "SECRETS/AUTH_USER"

diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c
index 4527ae712766e47fb0a719450d312e15e573c7bd..306d4d0a35c5ce5cb4477c78973ff35a341604dc 100644 (file)
--- a/source3/passdb/secrets.c
+++ b/source3/passdb/secrets.c
@@ -259,6 +259,31 @@ bool secrets_fetch_domain_guid(const char *domain, struct GUID *guid)
        return True;
 }
 
+bool secrets_store_local_schannel_key(uint8_t schannel_key[16])
+{
+       return secrets_store(SECRETS_LOCAL_SCHANNEL_KEY, schannel_key, 16);
+}
+
+bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16])
+{
+       size_t size = 0;
+       uint8_t *key;
+
+       key = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY, &size);
+       if (key == NULL) {
+               return false;
+       }
+
+       if (size != 16) {
+               SAFE_FREE(key);
+               return false;
+       }
+
+       memcpy(schannel_key, key, 16);
+       SAFE_FREE(key);
+       return true;
+}
+
 /**
  * Form a key for fetching the machine trust account sec channel type
  *