s4-dsdb: Add secrets_tdb_sync - an ldb module to keep secrets.tdb in sync

secrets_tdb_sync is a new ldb module designed to sync secrets.ldb
entries with the secrets.tdb file.

While not ideal to keep two copies of this data, this routine will
assist in allowing the samba-tool domain join code to operate
correctly in most cases where winbindd and smbd are used.

Andrew Bartlett

6 files changed, 543 insertions, 2 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/samba_secrets.c b/source4/dsdb/samdb/ldb_modules/samba_secrets.c
index 1eaf00af0d9..d184ee7f847 100644
--- a/source4/dsdb/samdb/ldb_modules/samba_secrets.c
+++ b/source4/dsdb/samdb/ldb_modules/samba_secrets.c
@@ -52,6 +52,7 @@ static int samba_secrets_init(struct ldb_module *module)
 	  stack visually
 	*/
 	static const char *modules_list[] = {"update_keytab",
+					     "secrets_tdb_sync",
 					     "objectguid",
 					     "rdn_name",
 					     NULL };
diff --git a/source4/dsdb/samdb/ldb_modules/secrets_tdb_sync.c b/source4/dsdb/samdb/ldb_modules/secrets_tdb_sync.c
new file mode 100644
index 00000000000..c742d868487
--- /dev/null
+++ b/source4/dsdb/samdb/ldb_modules/secrets_tdb_sync.c
@@ -0,0 +1,529 @@
+/*
+   ldb database library
+
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007-2012
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/*
+ *  Name: ldb
+ *
+ *  Component: ldb secrets_tdb_sync module
+ *
+ *  Description: Update secrets.tdb whenever the matching secret record changes
+ *
+ *  Author: Andrew Bartlett
+ */
+
+#include "includes.h"
+#include "ldb_module.h"
+#include "lib/util/dlinklist.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
+#include "system/kerberos.h"
+#include "auth/kerberos/kerberos.h"
+#include "auth/kerberos/kerberos_srv_keytab.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+#include "param/secrets.h"
+#include "source3/include/secrets.h"
+#include "lib/dbwrap/dbwrap.h"
+#include "dsdb/samdb/samdb.h"
+
+struct dn_list {
+	struct ldb_message *msg;
+	bool do_delete;
+	struct dn_list *prev, *next;
+};
+
+struct secrets_tdb_sync_private {
+	struct dn_list *changed_dns;
+	struct db_context *secrets_tdb;
+};
+
+struct secrets_tdb_sync_ctx {
+	struct ldb_module *module;
+	struct ldb_request *req;
+
+	struct ldb_dn *dn;
+	bool do_delete;
+
+	struct ldb_reply *op_reply;
+	bool found;
+};
+
+static struct secrets_tdb_sync_ctx *secrets_tdb_sync_ctx_init(struct ldb_module *module,
+						struct ldb_request *req)
+{
+	struct secrets_tdb_sync_ctx *ac;
+
+	ac = talloc_zero(req, struct secrets_tdb_sync_ctx);
+	if (ac == NULL) {
+		ldb_oom(ldb_module_get_ctx(module));
+		return NULL;
+	}
+
+	ac->module = module;
+	ac->req = req;
+
+	return ac;
+}
+
+/* FIXME: too many semi-async searches here for my taste, direct and indirect as
+ * cli_credentials_set_secrets() performs a sync ldb search.
+ * Just hope we are lucky and nothing breaks (using the tdb backend masks a lot
+ * of async issues). -SSS
+ */
+static int add_modified(struct ldb_module *module, struct ldb_dn *dn, bool do_delete,
+			struct ldb_request *parent)
+{
+	struct ldb_context *ldb = ldb_module_get_ctx(module);
+	struct secrets_tdb_sync_private *data = talloc_get_type(ldb_module_get_private(module), struct secrets_tdb_sync_private);
+	struct dn_list *item;
+	char *filter;
+	struct ldb_result *res;
+	int ret;
+
+	filter = talloc_asprintf(data,
+				 "(&(objectClass=primaryDomain)(flatname=*))");
+	if (!filter) {
+		return ldb_oom(ldb);
+	}
+
+	ret = dsdb_module_search(module, data, &res,
+				 dn, LDB_SCOPE_BASE, NULL,
+				 DSDB_FLAG_NEXT_MODULE, parent,
+				 "%s", filter);
+	talloc_free(filter);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	if (res->count != 1) {
+		/* if it's not a primaryDomain then we don't have anything to update */
+		talloc_free(res);
+		return LDB_SUCCESS;
+	}
+
+	item = talloc(data->changed_dns? (void *)data->changed_dns: (void *)data, struct dn_list);
+	if (!item) {
+		talloc_free(res);
+		return ldb_oom(ldb);
+	}
+
+	item->msg = talloc_steal(item, res->msgs[0]);
+	item->do_delete = do_delete;
+	talloc_free(res);
+
+	DLIST_ADD_END(data->changed_dns, item, struct dn_list *);
+	return LDB_SUCCESS;
+}
+
+static int ust_search_modified(struct secrets_tdb_sync_ctx *ac);
+
+static int secrets_tdb_sync_op_callback(struct ldb_request *req,
+				 struct ldb_reply *ares)
+{
+	struct ldb_context *ldb;
+	struct secrets_tdb_sync_ctx *ac;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct secrets_tdb_sync_ctx);
+	ldb = ldb_module_get_ctx(ac->module);
+
+	if (!ares) {
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	if (ares->type != LDB_REPLY_DONE) {
+		ldb_set_errstring(ldb, "Invalid request type!\n");
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+
+	if (ac->do_delete) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, LDB_SUCCESS);
+	}
+
+	ac->op_reply = talloc_steal(ac, ares);
+
+	ret = ust_search_modified(ac);
+	if (ret != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, NULL, NULL, ret);
+	}
+
+	return LDB_SUCCESS;
+}
+
+static int ust_del_op(struct secrets_tdb_sync_ctx *ac)
+{
+	struct ldb_context *ldb;
+	struct ldb_request *down_req;
+	int ret;
+
+	ldb = ldb_module_get_ctx(ac->module);
+
+	ret = ldb_build_del_req(&down_req, ldb, ac,
+				ac->dn,
+				ac->req->controls,
+				ac, secrets_tdb_sync_op_callback,
+				ac->req);
+	LDB_REQ_SET_LOCATION(down_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+	return ldb_next_request(ac->module, down_req);
+}
+
+static int ust_search_modified_callback(struct ldb_request *req,
+					struct ldb_reply *ares)
+{
+	struct secrets_tdb_sync_ctx *ac;
+	int ret;
+
+	ac = talloc_get_type(req->context, struct secrets_tdb_sync_ctx);
+
+	if (!ares) {
+		return ldb_module_done(ac->req, NULL, NULL,
+					LDB_ERR_OPERATIONS_ERROR);
+	}
+	if (ares->error != LDB_SUCCESS) {
+		return ldb_module_done(ac->req, ares->controls,
+					ares->response, ares->error);
+	}
+
+	switch (ares->type) {
+	case LDB_REPLY_ENTRY:
+
+		ac->found = true;
+		break;
+
+	case LDB_REPLY_REFERRAL:
+		/* ignore */
+		break;
+
+	case LDB_REPLY_DONE:
+
+		if (ac->found) {
+			/* do the dirty sync job here :/ */
+			ret = add_modified(ac->module, ac->dn, ac->do_delete, ac->req);
+		}
+
+		if (ac->do_delete) {
+			ret = ust_del_op(ac);
+			if (ret != LDB_SUCCESS) {
+				return ldb_module_done(ac->req,
+							NULL, NULL, ret);
+			}
+			break;
+		}
+
+		return ldb_module_done(ac->req, ac->op_reply->controls,
+					ac->op_reply->response, LDB_SUCCESS);
+	}
+
+	talloc_free(ares);
+	return LDB_SUCCESS;
+}
+
+static int ust_search_modified(struct secrets_tdb_sync_ctx *ac)
+{
+	struct ldb_context *ldb;
+	static const char * const no_attrs[] = { NULL };
+	struct ldb_request *search_req;
+	int ret;
+
+	ldb = ldb_module_get_ctx(ac->module);
+
+	ret = ldb_build_search_req(&search_req, ldb, ac,
+				   ac->dn, LDB_SCOPE_BASE,
+				   "(&(objectClass=kerberosSecret)"
+				     "(privateKeytab=*))", no_attrs,
+				   NULL,
+				   ac, ust_search_modified_callback,
+				   ac->req);
+	LDB_REQ_SET_LOCATION(search_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+	return ldb_next_request(ac->module, search_req);
+}
+
+
+/* add */
+static int secrets_tdb_sync_add(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_context *ldb;
+	struct secrets_tdb_sync_ctx *ac;
+	struct ldb_request *down_req;
+	int ret;
+
+	ldb = ldb_module_get_ctx(module);
+
+	ac = secrets_tdb_sync_ctx_init(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	ac->dn = req->op.add.message->dn;
+
+	ret = ldb_build_add_req(&down_req, ldb, ac,
+				req->op.add.message,
+				req->controls,
+				ac, secrets_tdb_sync_op_callback,
+				req);
+	LDB_REQ_SET_LOCATION(down_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	return ldb_next_request(module, down_req);
+}
+
+/* modify */
+static int secrets_tdb_sync_modify(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_context *ldb;
+	struct secrets_tdb_sync_ctx *ac;
+	struct ldb_request *down_req;
+	int ret;
+
+	ldb = ldb_module_get_ctx(module);
+
+	ac = secrets_tdb_sync_ctx_init(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	ac->dn = req->op.mod.message->dn;
+
+	ret = ldb_build_mod_req(&down_req, ldb, ac,
+				req->op.mod.message,
+				req->controls,
+				ac, secrets_tdb_sync_op_callback,
+				req);
+	LDB_REQ_SET_LOCATION(down_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	return ldb_next_request(module, down_req);
+}
+
+/* delete */
+static int secrets_tdb_sync_delete(struct ldb_module *module, struct ldb_request *req)
+{
+	struct secrets_tdb_sync_ctx *ac;
+
+	ac = secrets_tdb_sync_ctx_init(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb_module_get_ctx(module));
+	}
+
+	ac->dn = req->op.del.dn;
+	ac->do_delete = true;
+
+	return ust_search_modified(ac);
+}
+
+/* rename */
+static int secrets_tdb_sync_rename(struct ldb_module *module, struct ldb_request *req)
+{
+	struct ldb_context *ldb;
+	struct secrets_tdb_sync_ctx *ac;
+	struct ldb_request *down_req;
+	int ret;
+
+	ldb = ldb_module_get_ctx(module);
+
+	ac = secrets_tdb_sync_ctx_init(module, req);
+	if (ac == NULL) {
+		return ldb_operr(ldb);
+	}
+
+	ac->dn = req->op.rename.newdn;
+
+	ret = ldb_build_rename_req(&down_req, ldb, ac,
+				req->op.rename.olddn,
+				req->op.rename.newdn,
+				req->controls,
+				ac, secrets_tdb_sync_op_callback,
+				req);
+	LDB_REQ_SET_LOCATION(down_req);
+	if (ret != LDB_SUCCESS) {
+		return ret;
+	}
+
+	return ldb_next_request(module, down_req);
+}
+
+/* prepare for a commit */
+static int secrets_tdb_sync_prepare_commit(struct ldb_module *module)
+{
+	struct ldb_context *ldb = ldb_module_get_ctx(module);
+	struct secrets_tdb_sync_private *data = talloc_get_type(ldb_module_get_private(module),
+								struct secrets_tdb_sync_private);
+	struct dn_list *p;
+	TALLOC_CTX *tmp_ctx;
+
+	tmp_ctx = talloc_new(data);
+	if (!tmp_ctx) {
+		ldb_oom(ldb);
+		goto fail;
+	}
+
+	for (p=data->changed_dns; p; p = p->next) {
+		const struct ldb_val *whenChanged = ldb_msg_find_ldb_val(p->msg, "whenChanged");
+		time_t lct = 0;
+		bool ret;
+
+		if (whenChanged) {
+			ldb_val_to_time(whenChanged, &lct);
+		}
+
+		ret = secrets_store_machine_pw_sync(ldb_msg_find_attr_as_string(p->msg, "secret", NULL),
+						    ldb_msg_find_attr_as_string(p->msg, "priorSecret", NULL),
+
+						    ldb_msg_find_attr_as_string(p->msg, "flatname", NULL),
+						    ldb_msg_find_attr_as_string(p->msg, "realm", NULL),
+						    ldb_msg_find_attr_as_string(p->msg, "saltPrincipal", NULL),
+						    (uint32_t)ldb_msg_find_attr_as_int(p->msg, "msDS-SupportedEncryptionTypes", ENC_ALL_TYPES),
+						    samdb_result_dom_sid(tmp_ctx, p->msg, "objectSid"),
+
+						    lct,
+						    p->do_delete);
+		if (ret == false) {
+			ldb_asprintf_errstring(ldb, "Failed to update secrets.tdb from entry %s in %s",
+					       ldb_dn_get_linearized(p->msg->dn),
+					       (const char *)ldb_get_opaque(ldb, "ldb_url"));
+			goto fail;
+		}
+	}
+
+	talloc_free(data->changed_dns);
+	data->changed_dns = NULL;
+	talloc_free(tmp_ctx);
+
+	return ldb_next_prepare_commit(module);
+
+fail:
+	dbwrap_transaction_cancel(data->secrets_tdb);
+	talloc_free(data->changed_dns);
+	data->changed_dns = NULL;
+	talloc_free(tmp_ctx);
+	return LDB_ERR_OPERATIONS_ERROR;
+}
+
+/* start a transaction */
+static int secrets_tdb_sync_start_transaction(struct ldb_module *module)
+{
+	struct secrets_tdb_sync_private *data = talloc_get_type(ldb_module_get_private(module), struct secrets_tdb_sync_private);
+
+	if (dbwrap_transaction_start(data->secrets_tdb) != 0) {
+		return ldb_module_operr(module);
+	}
+
+	return ldb_next_start_trans(module);
+}
+
+/* end a transaction */
+static int secrets_tdb_sync_end_transaction(struct ldb_module *module)
+{
+	struct secrets_tdb_sync_private *data = talloc_get_type(ldb_module_get_private(module), struct secrets_tdb_sync_private);
+
+	if (dbwrap_transaction_commit(data->secrets_tdb) != 0) {
+		return ldb_module_operr(module);
+	}
+
+	return ldb_next_end_trans(module);
+}
+
+/* abandon a transaction */
+static int secrets_tdb_sync_del_transaction(struct ldb_module *module)
+{
+	struct secrets_tdb_sync_private *data = talloc_get_type(ldb_module_get_private(module), struct secrets_tdb_sync_private);
+
+	talloc_free(data->changed_dns);
+	data->changed_dns = NULL;
+	if (dbwrap_transaction_cancel(data->secrets_tdb) != 0) {
+		return ldb_module_operr(module);
+	}
+
+	return ldb_next_del_trans(module);
+}
+
+static int secrets_tdb_sync_init(struct ldb_module *module)
+{
+	struct ldb_context *ldb;
+	struct secrets_tdb_sync_private *data;
+	char *private_dir, *p;
+	const char *secrets_ldb;
+
+	ldb = ldb_module_get_ctx(module);
+
+	data = talloc(module, struct secrets_tdb_sync_private);
+	if (data == NULL) {
+		return ldb_oom(ldb);
+	}
+
+	data->changed_dns = NULL;
+
+	ldb_module_set_private(module, data);
+
+	secrets_ldb = (const char *)ldb_get_opaque(ldb, "ldb_url");
+	if (strncmp("tdb://", secrets_ldb, 6) == 0) {
+		secrets_ldb += 6;
+	}
+	if (!secrets_ldb) {
+		return ldb_operr(ldb);
+	}
+	private_dir = talloc_strdup(data, secrets_ldb);
+	p = strrchr(private_dir, '/');
+	if (p) {
+		*p = '\0';
+	} else {
+		return ldb_operr(ldb);
+	}
+
+	secrets_init_path(private_dir);
+
+	data->secrets_tdb = secrets_db_ctx();
+
+	return ldb_next_init(module);
+}
+
+static const struct ldb_module_ops ldb_secrets_tdb_sync_module_ops = {
+	.name		   = "secrets_tdb_sync",
+	.init_context	   = secrets_tdb_sync_init,
+	.add               = secrets_tdb_sync_add,
+	.modify            = secrets_tdb_sync_modify,
+	.rename            = secrets_tdb_sync_rename,
+	.del               = secrets_tdb_sync_delete,
+	.start_transaction = secrets_tdb_sync_start_transaction,
+	.prepare_commit    = secrets_tdb_sync_prepare_commit,
+	.end_transaction   = secrets_tdb_sync_end_transaction,
+	.del_transaction   = secrets_tdb_sync_del_transaction,
+};
+
+int ldb_secrets_tdb_sync_module_init(const char *version)
+{
+	LDB_MODULE_CHECK_VERSION(version);
+	return ldb_register_module(&ldb_secrets_tdb_sync_module_ops);
+}
diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server
index f44d4827dd6..5d09c4002ee 100755
--- a/source4/dsdb/samdb/ldb_modules/wscript_build_server
+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server
@@ -199,6 +199,15 @@ bld.SAMBA_MODULE('ldb_update_keytab',
 	deps='talloc samba-credentials ldb com_err KERBEROS_SRV_KEYTAB SECRETS DSDB_MODULE_HELPERS'
 	)
 
+bld.SAMBA_MODULE('ldb_secrets_tdb_sync',
+	source='secrets_tdb_sync.c',
+	subsystem='ldb',
+	init_function='ldb_secrets_tdb_sync_module_init',
+	module_init_name='ldb_init_module',
+	internal_module=False,
+	deps='talloc secrets3 DSDB_MODULE_HELPERS dbwrap'
+	)
+
 
 bld.SAMBA_MODULE('ldb_objectclass',
 	source='objectclass.c',
diff --git a/source4/scripting/python/samba/tests/provision.py b/source4/scripting/python/samba/tests/provision.py
index cfb6ded3c7a..9375f91b83d 100644
--- a/source4/scripting/python/samba/tests/provision.py
+++ b/source4/scripting/python/samba/tests/provision.py
@@ -55,6 +55,7 @@ class ProvisionTestCase(samba.tests.TestCaseInTempDir):
 
     def test_setup_secretsdb(self):
         path = os.path.join(self.tempdir, "secrets.ldb")
+        secrets_tdb_path = os.path.join(self.tempdir, "secrets.tdb")
         paths = ProvisionPaths()
         paths.secrets = path
         paths.private_dir = os.path.dirname(path)
@@ -67,6 +68,7 @@ class ProvisionTestCase(samba.tests.TestCaseInTempDir):
         finally:
             del ldb
             os.unlink(path)
+            os.unlink(secrets_tdb_path)
 
 
 class FindNssTests(TestCase):
diff --git a/source4/scripting/python/samba/tests/upgradeprovision.py b/source4/scripting/python/samba/tests/upgradeprovision.py
index ab7378756da..85b7cc7e2be 100644
--- a/source4/scripting/python/samba/tests/upgradeprovision.py
+++ b/source4/scripting/python/samba/tests/upgradeprovision.py
@@ -126,7 +126,7 @@ class UpdateSecretsTests(samba.tests.TestCaseInTempDir):
         self.assertEquals(newmodules.msgs, refmodules.msgs)
 
     def tearDown(self):
-        for name in ["ref.ldb", "secrets.ldb"]:
+        for name in ["ref.ldb", "secrets.ldb", "secrets.tdb"]:
             path = os.path.join(self.tempdir, name)
             if os.path.exists(path):
                 os.unlink(path)
diff --git a/source4/scripting/python/samba/tests/upgradeprovisionneeddc.py b/source4/scripting/python/samba/tests/upgradeprovisionneeddc.py
index 92255ceb258..1de123c71d1 100644
--- a/source4/scripting/python/samba/tests/upgradeprovisionneeddc.py
+++ b/source4/scripting/python/samba/tests/upgradeprovisionneeddc.py
@@ -172,7 +172,7 @@ class UpgradeProvisionWithLdbTestCase(TestCaseInTempDir):
         self.assertTrue(re.match(".*upgrade to.*", str(oem2)))
 
     def tearDown(self):
-        for name in ["ref.ldb", "secrets.ldb", "sam.ldb"]:
+        for name in ["ref.ldb", "secrets.ldb", "secrets.tdb", "sam.ldb"]:
             path = os.path.join(self.tempdir, name)
             if os.path.exists(path):
                 os.unlink(path)