Changeset 740 for vendor/current/source4/param/secrets.c

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

File:

• vendor/current/source4/param/secrets.c (modified) (6 diffs)

vendor/current/source4/param/secrets.c

@@ -26 +26 @@
 #include "param/param.h"
 #include "system/filesys.h"
-#include "tdb_wrap.h"
-#include "lib/ldb/include/ldb.h"
-#include "../tdb/include/tdb.h"
+#include "lib/util/tdb_wrap.h"
+#include "lib/ldb-samba/ldb_wrap.h"
+#include <ldb.h>
 #include "../lib/util/util_tdb.h"
-#include "../lib/util/util_ldb.h"
 #include "librpc/gen_ndr/ndr_security.h"
+#include "dsdb/samdb/samdb.h"
 
 /**
@@ -87 +87 @@
 */
 struct ldb_context *secrets_db_connect(TALLOC_CTX *mem_ctx,
-                                        struct tevent_context *ev_ctx,
                                         struct loadparm_context *lp_ctx)
 {
-        char *path;
-        const char *url;
-        struct ldb_context *ldb;
-
-        url = lp_secrets_url(lp_ctx);
-        if (!url || !url[0]) {
-                return NULL;
-        }
-
-        path = private_path(mem_ctx, lp_ctx, url);
-        if (!path) {
-                return NULL;
-        }
-
-        /* Secrets.ldb *must* always be local.  If we call for a
-         * system_session() we will recurse */
-        ldb = ldb_init(mem_ctx, ev_ctx);
-        if (!ldb) {
-                talloc_free(path);
-                return NULL;
-        }
-
-        ldb_set_modules_dir(ldb, 
-                            talloc_asprintf(ldb, "%s/ldb", lp_modulesdir(lp_ctx)));
-
-        if (ldb_connect(ldb, path, 0, NULL) != 0) {
-                talloc_free(path);
-                return NULL;
-        }
-
-        /* the update_keytab module relies on this being setup */
-        if (ldb_set_opaque(ldb, "loadparm", lp_ctx) != LDB_SUCCESS) {
-                talloc_free(path);
-                talloc_free(ldb);
-                return NULL;
-        }
-
-        talloc_free(path);
-        
-        return ldb;
+        return ldb_wrap_connect(mem_ctx, NULL, lp_ctx, lpcfg_secrets_url(lp_ctx),
+                               NULL, NULL, 0);
 }
 
@@ -137 +98 @@
  */
 struct dom_sid *secrets_get_domain_sid(TALLOC_CTX *mem_ctx,
-                                       struct tevent_context *ev_ctx,
                                        struct loadparm_context *lp_ctx,
-                                       const char *domain)
+                                       const char *domain,
+                                       enum netr_SchannelType *sec_channel_type,
+                                       char **errstring)
 {
         struct ldb_context *ldb;
-        struct ldb_message **msgs;
+        struct ldb_message *msg;
         int ldb_ret;
-        const char *attrs[] = { "objectSid", NULL };
+        const char *attrs[] = { "objectSid", "secureChannelType", NULL };
         struct dom_sid *result = NULL;
         const struct ldb_val *v;
         enum ndr_err_code ndr_err;
 
-        ldb = secrets_db_connect(mem_ctx, ev_ctx, lp_ctx);
+        *errstring = NULL;
+
+        ldb = secrets_db_connect(mem_ctx, lp_ctx);
         if (ldb == NULL) {
                 DEBUG(5, ("secrets_db_connect failed\n"));
@@ -155 +119 @@
         }
 
-        ldb_ret = gendb_search(ldb, ldb,
-                               ldb_dn_new(mem_ctx, ldb, SECRETS_PRIMARY_DOMAIN_DN), 
-                               &msgs, attrs,
-                               SECRETS_PRIMARY_DOMAIN_FILTER, domain);
+        ldb_ret = dsdb_search_one(ldb, ldb, &msg,
+                              ldb_dn_new(mem_ctx, ldb, SECRETS_PRIMARY_DOMAIN_DN),
+                              LDB_SCOPE_ONELEVEL,
+                              attrs, 0, SECRETS_PRIMARY_DOMAIN_FILTER, domain);
 
-        if (ldb_ret == -1) {
-                DEBUG(5, ("Error searching for domain SID for %s: %s", 
-                          domain, ldb_errstring(ldb))); 
-                talloc_free(ldb);
+        if (ldb_ret != LDB_SUCCESS) {
+                *errstring = talloc_asprintf(mem_ctx, "Failed to find record for %s in %s: %s: %s", 
+                                             domain, (char *) ldb_get_opaque(ldb, "ldb_url"),
+                                             ldb_strerror(ldb_ret), ldb_errstring(ldb));
+                return NULL;
+        }
+        v = ldb_msg_find_ldb_val(msg, "objectSid");
+        if (v == NULL) {
+                *errstring = talloc_asprintf(mem_ctx, "Failed to find a SID on record for %s in %s", 
+                                             domain, (char *) ldb_get_opaque(ldb, "ldb_url"));
                 return NULL;
         }
 
-        if (ldb_ret == 0) {
-                DEBUG(5, ("Did not find domain record for %s\n", domain));
-                talloc_free(ldb);
-                return NULL;
+        if (sec_channel_type) {
+                int t;
+                t = ldb_msg_find_attr_as_int(msg, "secureChannelType", -1);
+                if (t == -1) {
+                        *errstring = talloc_asprintf(mem_ctx, "Failed to find secureChannelType for %s in %s",
+                                                     domain, (char *) ldb_get_opaque(ldb, "ldb_url"));
+                        return NULL;
+                }
+                *sec_channel_type = t;
         }
 
-        if (ldb_ret > 1) {
-                DEBUG(5, ("Found more than one (%d) domain records for %s\n",
-                          ldb_ret, domain));
-                talloc_free(ldb);
-                return NULL;
-        }
-
-        v = ldb_msg_find_ldb_val(msgs[0], "objectSid");
-        if (v == NULL) {
-                DEBUG(0, ("Domain object for %s does not contain a SID!\n",
-                          domain));
-                return NULL;
-        }
         result = talloc(mem_ctx, struct dom_sid);
         if (result == NULL) {
@@ -192 +154 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(v, result, NULL, result,
+        ndr_err = ndr_pull_struct_blob(v, result, result,
                                        (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                *errstring = talloc_asprintf(mem_ctx, "Failed to parse SID on record for %s in %s", 
+                                             domain, (char *) ldb_get_opaque(ldb, "ldb_url"));
                 talloc_free(result);
                 talloc_free(ldb);
@@ -202 +166 @@
         return result;
 }
+
+char *keytab_name_from_msg(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, struct ldb_message *msg) 
+{
+        const char *krb5keytab = ldb_msg_find_attr_as_string(msg, "krb5Keytab", NULL);
+        if (krb5keytab) {
+                return talloc_strdup(mem_ctx, krb5keytab);
+        } else {
+                char *file_keytab;
+                char *relative_path;
+                const char *privateKeytab = ldb_msg_find_attr_as_string(msg, "privateKeytab", NULL);
+                if (!privateKeytab) {
+                        return NULL;
+                }
+
+                relative_path = ldb_relative_path(ldb, mem_ctx, privateKeytab);
+                if (!relative_path) {
+                        return NULL;
+                }
+                file_keytab = talloc_asprintf(mem_ctx, "FILE:%s", relative_path);
+                talloc_free(relative_path);
+                return file_keytab;
+        }
+        return NULL;
+}
+