?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:libnet: Improve debug messages
[Samba.git] / source3 / libnet / libnet_join.c
blob6017cc7694d545656961095b6514acedb8d636e2
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "ads.h"
23 #include "libsmb/namequery.h"
24 #include "librpc/gen_ndr/ndr_libnet_join.h"
25 #include "libnet/libnet_join.h"
26 #include "libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_samr_c.h"
28 #include "rpc_client/init_samr.h"
29 #include "../librpc/gen_ndr/ndr_lsa_c.h"
30 #include "rpc_client/cli_lsarpc.h"
31 #include "../librpc/gen_ndr/ndr_netlogon.h"
32 #include "rpc_client/cli_netlogon.h"
33 #include "lib/smbconf/smbconf.h"
34 #include "lib/smbconf/smbconf_reg.h"
35 #include "../libds/common/flags.h"
36 #include "secrets.h"
37 #include "rpc_client/init_lsa.h"
38 #include "rpc_client/cli_pipe.h"
39 #include "../libcli/security/security.h"
40 #include "passdb.h"
41 #include "libsmb/libsmb.h"
42 #include "../libcli/smb/smbXcli_base.h"
43 #include "lib/param/loadparm.h"
44 #include "libcli/auth/netlogon_creds_cli.h"
45 #include "auth/credentials/credentials.h"
46 #include "krb5_env.h"
47 #include "libsmb/dsgetdcname.h"
48
49 /****************************************************************
50 ****************************************************************/
51
52 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
53 do { \
54 char *str = NULL; \
55 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
56 DEBUG(1,("libnet_Join:\n%s", str)); \
57 TALLOC_FREE(str); \
58 } while (0)
59
60 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
61 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
62 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
63 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
64
65 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
66 do { \
67 char *str = NULL; \
68 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
69 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
70 TALLOC_FREE(str); \
71 } while (0)
72
73 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
74 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
75 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
76 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
77
78 /****************************************************************
79 ****************************************************************/
80
81 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
82 struct libnet_JoinCtx *r,
83 const char *format, ...)
84 PRINTF_ATTRIBUTE(3,4);
85
86 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
87 struct libnet_JoinCtx *r,
88 const char *format, ...)
89 {
90 va_list args;
91
92 if (r->out.error_string) {
93 return;
94 }
95
96 va_start(args, format);
97 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
98 va_end(args);
99 }
100
101 /****************************************************************
102 ****************************************************************/
103
104 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
105 struct libnet_UnjoinCtx *r,
106 const char *format, ...)
107 PRINTF_ATTRIBUTE(3,4);
108
109 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
110 struct libnet_UnjoinCtx *r,
111 const char *format, ...)
112 {
113 va_list args;
114
115 if (r->out.error_string) {
116 return;
117 }
118
119 va_start(args, format);
120 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
121 va_end(args);
122 }
123
124 #ifdef HAVE_ADS
125
126 /****************************************************************
127 ****************************************************************/
128
129 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
130 const char *netbios_domain_name,
131 const char *dc_name,
132 const char *user_name,
133 const char *password,
134 const char *ccname,
135 ADS_STRUCT **ads)
136 {
137 ADS_STATUS status;
138 ADS_STRUCT *my_ads = NULL;
139 char *cp;
140
141 my_ads = ads_init(dns_domain_name,
142 netbios_domain_name,
143 dc_name,
144 ADS_SASL_SEAL);
145 if (!my_ads) {
146 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
147 }
148
149 my_ads->auth.flags |= ADS_AUTH_ALLOW_NTLMSSP;
150
151 if (user_name) {
152 SAFE_FREE(my_ads->auth.user_name);
153 my_ads->auth.user_name = SMB_STRDUP(user_name);
154 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
155 *cp++ = '\0';
156 SAFE_FREE(my_ads->auth.realm);
157 my_ads->auth.realm = smb_xstrdup(cp);
158 if (!strupper_m(my_ads->auth.realm)) {
159 ads_destroy(&my_ads);
160 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
161 }
162 }
163 }
164
165 if (password) {
166 SAFE_FREE(my_ads->auth.password);
167 my_ads->auth.password = SMB_STRDUP(password);
168 }
169
170 if (ccname != NULL) {
171 SAFE_FREE(my_ads->auth.ccache_name);
172 my_ads->auth.ccache_name = SMB_STRDUP(ccname);
173 setenv(KRB5_ENV_CCNAME, my_ads->auth.ccache_name, 1);
174 }
175
176 status = ads_connect_user_creds(my_ads);
177 if (!ADS_ERR_OK(status)) {
178 ads_destroy(&my_ads);
179 return status;
180 }
181
182 *ads = my_ads;
183 return ADS_SUCCESS;
184 }
185
186 /****************************************************************
187 ****************************************************************/
188
189 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
190 struct libnet_JoinCtx *r,
191 bool use_machine_creds)
192 {
193 ADS_STATUS status;
194 const char *username;
195 const char *password;
196 const char *ccname = NULL;
197
198 if (use_machine_creds) {
199 if (r->in.machine_name == NULL ||
200 r->in.machine_password == NULL) {
201 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
202 }
203 username = talloc_asprintf(mem_ctx, "%s$",
204 r->in.machine_name);
205 if (username == NULL) {
206 return ADS_ERROR(LDAP_NO_MEMORY);
207 }
208 password = r->in.machine_password;
209 ccname = "MEMORY:libnet_join_machine_creds";
210 } else {
211 char *p = NULL;
212
213 username = r->in.admin_account;
214
215 p = strchr(r->in.admin_account, '@');
216 if (p == NULL) {
217 username = talloc_asprintf(mem_ctx, "%s@%s",
218 r->in.admin_account,
219 r->in.admin_domain);
220 }
221 if (username == NULL) {
222 return ADS_ERROR(LDAP_NO_MEMORY);
223 }
224 password = r->in.admin_password;
225
226 /*
227 * when r->in.use_kerberos is set to allow "net ads join -k" we
228 * may not override the provided credential cache - gd
229 */
230
231 if (!r->in.use_kerberos) {
232 ccname = "MEMORY:libnet_join_user_creds";
233 }
234 }
235
236 status = libnet_connect_ads(r->out.dns_domain_name,
237 r->out.netbios_domain_name,
238 r->in.dc_name,
239 username,
240 password,
241 ccname,
242 &r->in.ads);
243 if (!ADS_ERR_OK(status)) {
244 libnet_join_set_error_string(mem_ctx, r,
245 "failed to connect to AD: %s",
246 ads_errstr(status));
247 return status;
248 }
249
250 if (!r->out.netbios_domain_name) {
251 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
252 r->in.ads->server.workgroup);
253 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
254 }
255
256 if (!r->out.dns_domain_name) {
257 r->out.dns_domain_name = talloc_strdup(mem_ctx,
258 r->in.ads->config.realm);
259 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
260 }
261
262 r->out.domain_is_ad = true;
263
264 return ADS_SUCCESS;
265 }
266
267 /****************************************************************
268 ****************************************************************/
269
270 static ADS_STATUS libnet_join_connect_ads_user(TALLOC_CTX *mem_ctx,
271 struct libnet_JoinCtx *r)
272 {
273 return libnet_join_connect_ads(mem_ctx, r, false);
274 }
275
276 /****************************************************************
277 ****************************************************************/
278
279 static ADS_STATUS libnet_join_connect_ads_machine(TALLOC_CTX *mem_ctx,
280 struct libnet_JoinCtx *r)
281 {
282 return libnet_join_connect_ads(mem_ctx, r, true);
283 }
284
285 /****************************************************************
286 ****************************************************************/
287
288 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
289 struct libnet_UnjoinCtx *r)
290 {
291 ADS_STATUS status;
292
293 status = libnet_connect_ads(r->in.domain_name,
294 r->in.domain_name,
295 r->in.dc_name,
296 r->in.admin_account,
297 r->in.admin_password,
298 NULL,
299 &r->in.ads);
300 if (!ADS_ERR_OK(status)) {
301 libnet_unjoin_set_error_string(mem_ctx, r,
302 "failed to connect to AD: %s",
303 ads_errstr(status));
304 }
305
306 return status;
307 }
308
309 /****************************************************************
310 join a domain using ADS (LDAP mods)
311 ****************************************************************/
312
313 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
314 struct libnet_JoinCtx *r)
315 {
316 ADS_STATUS status;
317 LDAPMessage *res = NULL;
318 const char *attrs[] = { "dn", NULL };
319 bool moved = false;
320
321 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
322 if (!ADS_ERR_OK(status)) {
323 return status;
324 }
325
326 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
327 if (!ADS_ERR_OK(status)) {
328 return status;
329 }
330
331 if (ads_count_replies(r->in.ads, res) != 1) {
332 ads_msgfree(r->in.ads, res);
333 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
334 }
335
336 ads_msgfree(r->in.ads, res);
337
338 /* Attempt to create the machine account and bail if this fails.
339 Assume that the admin wants exactly what they requested */
340
341 if (r->in.machine_password == NULL) {
342 r->in.machine_password =
343 trust_pw_new_value(mem_ctx,
344 r->in.secure_channel_type,
345 SEC_ADS);
346 if (r->in.machine_password == NULL) {
347 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
348 }
349 }
350
351 status = ads_create_machine_acct(r->in.ads,
352 r->in.machine_name,
353 r->in.machine_password,
354 r->in.account_ou,
355 r->in.desired_encryption_types,
356 r->out.dns_domain_name);
357
358 if (ADS_ERR_OK(status)) {
359 DBG_WARNING("Machine account successfully created\n");
360 return status;
361 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
362 (status.err.rc == LDAP_ALREADY_EXISTS)) {
363 status = ADS_SUCCESS;
364 }
365
366 if (!ADS_ERR_OK(status)) {
367 DBG_WARNING("Failed to create machine account\n");
368 return status;
369 }
370
371 status = ads_move_machine_acct(r->in.ads,
372 r->in.machine_name,
373 r->in.account_ou,
374 &moved);
375 if (!ADS_ERR_OK(status)) {
376 DEBUG(1,("failure to locate/move pre-existing "
377 "machine account\n"));
378 return status;
379 }
380
381 DEBUG(1,("The machine account %s the specified OU.\n",
382 moved ? "was moved into" : "already exists in"));
383
384 return status;
385 }
386
387 /****************************************************************
388 ****************************************************************/
389
390 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
391 struct libnet_UnjoinCtx *r)
392 {
393 ADS_STATUS status;
394
395 if (!r->in.ads) {
396 status = libnet_unjoin_connect_ads(mem_ctx, r);
397 if (!ADS_ERR_OK(status)) {
398 libnet_unjoin_set_error_string(mem_ctx, r,
399 "failed to connect to AD: %s",
400 ads_errstr(status));
401 return status;
402 }
403 }
404
405 status = ads_leave_realm(r->in.ads, r->in.machine_name);
406 if (!ADS_ERR_OK(status)) {
407 libnet_unjoin_set_error_string(mem_ctx, r,
408 "failed to leave realm: %s",
409 ads_errstr(status));
410 return status;
411 }
412
413 return ADS_SUCCESS;
414 }
415
416 /****************************************************************
417 ****************************************************************/
418
419 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
420 struct libnet_JoinCtx *r)
421 {
422 ADS_STATUS status;
423 LDAPMessage *res = NULL;
424 char *dn = NULL;
425
426 if (!r->in.machine_name) {
427 return ADS_ERROR(LDAP_NO_MEMORY);
428 }
429
430 status = ads_find_machine_acct(r->in.ads,
431 &res,
432 r->in.machine_name);
433 if (!ADS_ERR_OK(status)) {
434 return status;
435 }
436
437 if (ads_count_replies(r->in.ads, res) != 1) {
438 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
439 goto done;
440 }
441
442 dn = ads_get_dn(r->in.ads, mem_ctx, res);
443 if (!dn) {
444 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
445 goto done;
446 }
447
448 r->out.dn = talloc_strdup(mem_ctx, dn);
449 if (!r->out.dn) {
450 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
451 goto done;
452 }
453
454 if (!ads_pull_uint32(r->in.ads, res, "msDS-SupportedEncryptionTypes",
455 &r->out.set_encryption_types)) {
456 r->out.set_encryption_types = 0;
457 }
458
459 done:
460 ads_msgfree(r->in.ads, res);
461 TALLOC_FREE(dn);
462
463 return status;
464 }
465
466 static ADS_STATUS libnet_join_get_machine_spns(TALLOC_CTX *mem_ctx,
467 struct libnet_JoinCtx *r,
468 char ***spn_array,
469 size_t *num_spns)
470 {
471 ADS_STATUS status;
472
473 if (r->in.machine_name == NULL) {
474 return ADS_ERROR_SYSTEM(EINVAL);
475 }
476
477 status = ads_get_service_principal_names(mem_ctx,
478 r->in.ads,
479 r->in.machine_name,
480 spn_array,
481 num_spns);
482
483 return status;
484 }
485
486 /****************************************************************
487 Set a machines dNSHostName and servicePrincipalName attributes
488 ****************************************************************/
489
490 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
491 struct libnet_JoinCtx *r)
492 {
493 ADS_STATUS status;
494 ADS_MODLIST mods;
495 fstring my_fqdn;
496 const char **spn_array = NULL;
497 size_t num_spns = 0;
498 char *spn = NULL;
499 bool ok;
500 const char **netbios_aliases = NULL;
501
502 /* Find our DN */
503
504 status = libnet_join_find_machine_acct(mem_ctx, r);
505 if (!ADS_ERR_OK(status)) {
506 return status;
507 }
508
509 status = libnet_join_get_machine_spns(mem_ctx,
510 r,
511 discard_const_p(char **, &spn_array),
512 &num_spns);
513 if (!ADS_ERR_OK(status)) {
514 DEBUG(5, ("Retrieving the servicePrincipalNames failed.\n"));
515 }
516
517 /* Windows only creates HOST/shortname & HOST/fqdn. */
518
519 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
520 if (!spn) {
521 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
522 }
523 if (!strupper_m(spn)) {
524 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
525 }
526
527 ok = ads_element_in_array(spn_array, num_spns, spn);
528 if (!ok) {
529 ok = add_string_to_array(spn_array, spn,
530 &spn_array, &num_spns);
531 if (!ok) {
532 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
533 }
534 }
535
536 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
537 || (strchr(my_fqdn, '.') == NULL)) {
538 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
539 r->out.dns_domain_name);
540 }
541
542 if (!strlower_m(my_fqdn)) {
543 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
544 }
545
546 if (!strequal(my_fqdn, r->in.machine_name)) {
547 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
548 if (!spn) {
549 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
550 }
551
552 ok = ads_element_in_array(spn_array, num_spns, spn);
553 if (!ok) {
554 ok = add_string_to_array(spn_array, spn,
555 &spn_array, &num_spns);
556 if (!ok) {
557 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
558 }
559 }
560 }
561
562 netbios_aliases = lp_netbios_aliases();
563 if (netbios_aliases != NULL) {
564 for (; *netbios_aliases != NULL; netbios_aliases++) {
565 /*
566 * Add HOST/NETBIOSNAME
567 */
568 spn = talloc_asprintf(mem_ctx, "HOST/%s", *netbios_aliases);
569 if (spn == NULL) {
570 TALLOC_FREE(spn);
571 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
572 }
573 if (!strupper_m(spn)) {
574 TALLOC_FREE(spn);
575 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
576 }
577
578 ok = ads_element_in_array(spn_array, num_spns, spn);
579 if (ok) {
580 TALLOC_FREE(spn);
581 continue;
582 }
583 ok = add_string_to_array(spn_array, spn,
584 &spn_array, &num_spns);
585 if (!ok) {
586 TALLOC_FREE(spn);
587 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
588 }
589 TALLOC_FREE(spn);
590
591 /*
592 * Add HOST/netbiosname.domainname
593 */
594 if (r->out.dns_domain_name == NULL) {
595 continue;
596 }
597 fstr_sprintf(my_fqdn, "%s.%s",
598 *netbios_aliases,
599 r->out.dns_domain_name);
600
601 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
602 if (spn == NULL) {
603 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
604 }
605
606 ok = ads_element_in_array(spn_array, num_spns, spn);
607 if (ok) {
608 TALLOC_FREE(spn);
609 continue;
610 }
611 ok = add_string_to_array(spn_array, spn,
612 &spn_array, &num_spns);
613 if (!ok) {
614 TALLOC_FREE(spn);
615 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
616 }
617 TALLOC_FREE(spn);
618 }
619 }
620
621 /* make sure to NULL terminate the array */
622 spn_array = talloc_realloc(mem_ctx, spn_array, const char *, num_spns + 1);
623 if (spn_array == NULL) {
624 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
625 }
626 spn_array[num_spns] = NULL;
627
628 mods = ads_init_mods(mem_ctx);
629 if (!mods) {
630 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
631 }
632
633 /* fields of primary importance */
634
635 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
636 if (!ADS_ERR_OK(status)) {
637 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
638 }
639
640 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
641 spn_array);
642 if (!ADS_ERR_OK(status)) {
643 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
644 }
645
646 return ads_gen_mod(r->in.ads, r->out.dn, mods);
647 }
648
649 /****************************************************************
650 ****************************************************************/
651
652 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
653 struct libnet_JoinCtx *r)
654 {
655 ADS_STATUS status;
656 ADS_MODLIST mods;
657
658 if (!r->in.create_upn) {
659 return ADS_SUCCESS;
660 }
661
662 /* Find our DN */
663
664 status = libnet_join_find_machine_acct(mem_ctx, r);
665 if (!ADS_ERR_OK(status)) {
666 return status;
667 }
668
669 if (!r->in.upn) {
670 const char *realm = r->out.dns_domain_name;
671
672 /* in case we are about to generate a keytab during the join
673 * make sure the default upn we create is usable with kinit -k.
674 * gd */
675
676 if (USE_KERBEROS_KEYTAB) {
677 realm = talloc_strdup_upper(mem_ctx,
678 r->out.dns_domain_name);
679 }
680
681 if (!realm) {
682 return ADS_ERROR(LDAP_NO_MEMORY);
683 }
684
685 r->in.upn = talloc_asprintf(mem_ctx,
686 "host/%s@%s",
687 r->in.machine_name,
688 realm);
689 if (!r->in.upn) {
690 return ADS_ERROR(LDAP_NO_MEMORY);
691 }
692 }
693
694 /* now do the mods */
695
696 mods = ads_init_mods(mem_ctx);
697 if (!mods) {
698 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
699 }
700
701 /* fields of primary importance */
702
703 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
704 if (!ADS_ERR_OK(status)) {
705 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
706 }
707
708 return ads_gen_mod(r->in.ads, r->out.dn, mods);
709 }
710
711
712 /****************************************************************
713 ****************************************************************/
714
715 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
716 struct libnet_JoinCtx *r)
717 {
718 ADS_STATUS status;
719 ADS_MODLIST mods;
720 char *os_sp = NULL;
721
722 if (!r->in.os_name || !r->in.os_version ) {
723 return ADS_SUCCESS;
724 }
725
726 /* Find our DN */
727
728 status = libnet_join_find_machine_acct(mem_ctx, r);
729 if (!ADS_ERR_OK(status)) {
730 return status;
731 }
732
733 /* now do the mods */
734
735 mods = ads_init_mods(mem_ctx);
736 if (!mods) {
737 return ADS_ERROR(LDAP_NO_MEMORY);
738 }
739
740 if (r->in.os_servicepack) {
741 /*
742 * if blank string then leave os_sp equal to NULL to force
743 * attribute delete (LDAP_MOD_DELETE)
744 */
745 if (!strequal(r->in.os_servicepack,"")) {
746 os_sp = talloc_strdup(mem_ctx, r->in.os_servicepack);
747 }
748 } else {
749 os_sp = talloc_asprintf(mem_ctx, "Samba %s",
750 samba_version_string());
751 }
752 if (!os_sp && !strequal(r->in.os_servicepack,"")) {
753 return ADS_ERROR(LDAP_NO_MEMORY);
754 }
755
756 /* fields of primary importance */
757
758 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
759 r->in.os_name);
760 if (!ADS_ERR_OK(status)) {
761 return status;
762 }
763
764 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
765 r->in.os_version);
766 if (!ADS_ERR_OK(status)) {
767 return status;
768 }
769
770 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
771 os_sp);
772 if (!ADS_ERR_OK(status)) {
773 return status;
774 }
775
776 return ads_gen_mod(r->in.ads, r->out.dn, mods);
777 }
778
779 /****************************************************************
780 ****************************************************************/
781
782 static ADS_STATUS libnet_join_set_etypes(TALLOC_CTX *mem_ctx,
783 struct libnet_JoinCtx *r)
784 {
785 ADS_STATUS status;
786 ADS_MODLIST mods;
787 const char *etype_list_str;
788
789 etype_list_str = talloc_asprintf(mem_ctx, "%d",
790 r->in.desired_encryption_types);
791 if (!etype_list_str) {
792 return ADS_ERROR(LDAP_NO_MEMORY);
793 }
794
795 /* Find our DN */
796
797 status = libnet_join_find_machine_acct(mem_ctx, r);
798 if (!ADS_ERR_OK(status)) {
799 return status;
800 }
801
802 if (r->in.desired_encryption_types == r->out.set_encryption_types) {
803 return ADS_SUCCESS;
804 }
805
806 /* now do the mods */
807
808 mods = ads_init_mods(mem_ctx);
809 if (!mods) {
810 return ADS_ERROR(LDAP_NO_MEMORY);
811 }
812
813 status = ads_mod_str(mem_ctx, &mods, "msDS-SupportedEncryptionTypes",
814 etype_list_str);
815 if (!ADS_ERR_OK(status)) {
816 return status;
817 }
818
819 status = ads_gen_mod(r->in.ads, r->out.dn, mods);
820 if (!ADS_ERR_OK(status)) {
821 return status;
822 }
823
824 r->out.set_encryption_types = r->in.desired_encryption_types;
825
826 return ADS_SUCCESS;
827 }
828
829 /****************************************************************
830 ****************************************************************/
831
832 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
833 struct libnet_JoinCtx *r)
834 {
835 if (!USE_SYSTEM_KEYTAB) {
836 return true;
837 }
838
839 if (ads_keytab_create_default(r->in.ads) != 0) {
840 return false;
841 }
842
843 return true;
844 }
845
846 /****************************************************************
847 ****************************************************************/
848
849 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
850 struct libnet_JoinCtx *r)
851 {
852 uint32_t domain_func;
853 ADS_STATUS status;
854 const char *salt = NULL;
855 char *std_salt = NULL;
856
857 status = ads_domain_func_level(r->in.ads, &domain_func);
858 if (!ADS_ERR_OK(status)) {
859 libnet_join_set_error_string(mem_ctx, r,
860 "failed to determine domain functional level: %s",
861 ads_errstr(status));
862 return false;
863 }
864
865 /* go ahead and setup the default salt */
866
867 std_salt = kerberos_standard_des_salt();
868 if (!std_salt) {
869 libnet_join_set_error_string(mem_ctx, r,
870 "failed to obtain standard DES salt");
871 return false;
872 }
873
874 salt = talloc_strdup(mem_ctx, std_salt);
875 if (!salt) {
876 return false;
877 }
878
879 SAFE_FREE(std_salt);
880
881 /* if it's a Windows functional domain, we have to look for the UPN */
882
883 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
884 char *upn;
885
886 upn = ads_get_upn(r->in.ads, mem_ctx,
887 r->in.machine_name);
888 if (upn) {
889 salt = talloc_strdup(mem_ctx, upn);
890 if (!salt) {
891 return false;
892 }
893 }
894 }
895
896 r->out.krb5_salt = salt;
897 return true;
898 }
899
900 /****************************************************************
901 ****************************************************************/
902
903 static ADS_STATUS libnet_join_post_processing_ads_modify(TALLOC_CTX *mem_ctx,
904 struct libnet_JoinCtx *r)
905 {
906 ADS_STATUS status;
907 bool need_etype_update = false;
908
909 if (!r->in.ads) {
910 status = libnet_join_connect_ads_user(mem_ctx, r);
911 if (!ADS_ERR_OK(status)) {
912 return status;
913 }
914 }
915
916 status = libnet_join_set_machine_spn(mem_ctx, r);
917 if (!ADS_ERR_OK(status)) {
918 libnet_join_set_error_string(mem_ctx, r,
919 "Failed to set machine spn: %s\n"
920 "Do you have sufficient permissions to create machine "
921 "accounts?",
922 ads_errstr(status));
923 return status;
924 }
925
926 status = libnet_join_set_os_attributes(mem_ctx, r);
927 if (!ADS_ERR_OK(status)) {
928 libnet_join_set_error_string(mem_ctx, r,
929 "failed to set machine os attributes: %s",
930 ads_errstr(status));
931 return status;
932 }
933
934 status = libnet_join_set_machine_upn(mem_ctx, r);
935 if (!ADS_ERR_OK(status)) {
936 libnet_join_set_error_string(mem_ctx, r,
937 "failed to set machine upn: %s",
938 ads_errstr(status));
939 return status;
940 }
941
942 status = libnet_join_find_machine_acct(mem_ctx, r);
943 if (!ADS_ERR_OK(status)) {
944 return status;
945 }
946
947 if (r->in.desired_encryption_types != r->out.set_encryption_types) {
948 uint32_t func_level = 0;
949
950 status = ads_domain_func_level(r->in.ads, &func_level);
951 if (!ADS_ERR_OK(status)) {
952 libnet_join_set_error_string(mem_ctx, r,
953 "failed to query domain controller functional level: %s",
954 ads_errstr(status));
955 return status;
956 }
957
958 if (func_level >= DS_DOMAIN_FUNCTION_2008) {
959 need_etype_update = true;
960 }
961 }
962
963 if (need_etype_update) {
964 /*
965 * We need to reconnect as machine account in order
966 * to update msDS-SupportedEncryptionTypes reliable
967 */
968
969 if (r->in.ads->auth.ccache_name != NULL) {
970 ads_kdestroy(r->in.ads->auth.ccache_name);
971 }
972
973 ads_destroy(&r->in.ads);
974
975 status = libnet_join_connect_ads_machine(mem_ctx, r);
976 if (!ADS_ERR_OK(status)) {
977 libnet_join_set_error_string(mem_ctx, r,
978 "Failed to connect as machine account: %s",
979 ads_errstr(status));
980 return status;
981 }
982
983 status = libnet_join_set_etypes(mem_ctx, r);
984 if (!ADS_ERR_OK(status)) {
985 libnet_join_set_error_string(mem_ctx, r,
986 "failed to set machine kerberos encryption types: %s",
987 ads_errstr(status));
988 return status;
989 }
990 }
991
992 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
993 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
994 }
995
996 return ADS_SUCCESS;
997 }
998
999 static ADS_STATUS libnet_join_post_processing_ads_sync(TALLOC_CTX *mem_ctx,
1000 struct libnet_JoinCtx *r)
1001 {
1002 if (!libnet_join_create_keytab(mem_ctx, r)) {
1003 libnet_join_set_error_string(mem_ctx, r,
1004 "failed to create kerberos keytab");
1005 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
1006 }
1007
1008 return ADS_SUCCESS;
1009 }
1010 #endif /* HAVE_ADS */
1011
1012 /****************************************************************
1013 Store the machine password and domain SID
1014 ****************************************************************/
1015
1016 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
1017 struct libnet_JoinCtx *r)
1018 {
1019 NTSTATUS status;
1020
1021 status = secrets_store_JoinCtx(r);
1022 if (!NT_STATUS_IS_OK(status)) {
1023 DBG_ERR("secrets_store_JoinCtx() failed %s\n",
1024 nt_errstr(status));
1025 return false;
1026 }
1027
1028 return true;
1029 }
1030
1031 /****************************************************************
1032 Connect dc's IPC$ share
1033 ****************************************************************/
1034
1035 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
1036 const char *user,
1037 const char *domain,
1038 const char *pass,
1039 bool use_kerberos,
1040 struct cli_state **cli)
1041 {
1042 int flags = 0;
1043
1044 if (use_kerberos) {
1045 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1046 }
1047
1048 if (use_kerberos && pass) {
1049 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
1050 }
1051
1052 return cli_full_connection(cli, NULL,
1053 dc,
1054 NULL, 0,
1055 "IPC$", "IPC",
1056 user,
1057 domain,
1058 pass,
1059 flags,
1060 SMB_SIGNING_IPC_DEFAULT);
1061 }
1062
1063 /****************************************************************
1064 Lookup domain dc's info
1065 ****************************************************************/
1066
1067 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
1068 struct libnet_JoinCtx *r,
1069 struct cli_state **cli)
1070 {
1071 struct rpc_pipe_client *pipe_hnd = NULL;
1072 struct policy_handle lsa_pol;
1073 NTSTATUS status, result;
1074 union lsa_PolicyInformation *info = NULL;
1075 struct dcerpc_binding_handle *b;
1076 const char *account = r->in.admin_account;
1077 const char *domain = r->in.admin_domain;
1078 const char *password = r->in.admin_password;
1079 bool use_kerberos = r->in.use_kerberos;
1080
1081 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) {
1082 account = "";
1083 domain = "";
1084 password = NULL;
1085 use_kerberos = false;
1086 }
1087
1088 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1089 account,
1090 domain,
1091 password,
1092 use_kerberos,
1093 cli);
1094 if (!NT_STATUS_IS_OK(status)) {
1095 goto done;
1096 }
1097
1098 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc,
1099 &pipe_hnd);
1100 if (!NT_STATUS_IS_OK(status)) {
1101 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
1102 nt_errstr(status)));
1103 goto done;
1104 }
1105
1106 b = pipe_hnd->binding_handle;
1107
1108 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
1109 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1110 if (!NT_STATUS_IS_OK(status)) {
1111 goto done;
1112 }
1113
1114 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
1115 &lsa_pol,
1116 LSA_POLICY_INFO_DNS,
1117 &info,
1118 &result);
1119 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
1120 r->out.domain_is_ad = true;
1121 r->out.netbios_domain_name = info->dns.name.string;
1122 r->out.dns_domain_name = info->dns.dns_domain.string;
1123 r->out.forest_name = info->dns.dns_forest.string;
1124 r->out.domain_guid = info->dns.domain_guid;
1125 r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
1126 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
1127 }
1128
1129 if (!NT_STATUS_IS_OK(status)) {
1130 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
1131 &lsa_pol,
1132 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1133 &info,
1134 &result);
1135 if (!NT_STATUS_IS_OK(status)) {
1136 goto done;
1137 }
1138 if (!NT_STATUS_IS_OK(result)) {
1139 status = result;
1140 goto done;
1141 }
1142
1143 r->out.netbios_domain_name = info->account_domain.name.string;
1144 r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
1145 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
1146 }
1147
1148 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
1149 TALLOC_FREE(pipe_hnd);
1150
1151 done:
1152 return status;
1153 }
1154
1155 /****************************************************************
1156 Do the domain join unsecure
1157 ****************************************************************/
1158
1159 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
1160 struct libnet_JoinCtx *r,
1161 struct cli_state *cli)
1162 {
1163 TALLOC_CTX *frame = talloc_stackframe();
1164 struct rpc_pipe_client *authenticate_pipe = NULL;
1165 struct rpc_pipe_client *passwordset_pipe = NULL;
1166 struct cli_credentials *cli_creds;
1167 struct netlogon_creds_cli_context *netlogon_creds = NULL;
1168 struct netlogon_creds_CredentialState *creds = NULL;
1169 uint32_t netlogon_flags = 0;
1170 size_t len = 0;
1171 bool ok;
1172 DATA_BLOB new_trust_blob = data_blob_null;
1173 NTSTATUS status;
1174
1175 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon,
1176 &authenticate_pipe);
1177 if (!NT_STATUS_IS_OK(status)) {
1178 TALLOC_FREE(frame);
1179 return status;
1180 }
1181
1182 if (!r->in.machine_password) {
1183 int security = r->in.ads ? SEC_ADS : SEC_DOMAIN;
1184
1185 r->in.machine_password = trust_pw_new_value(mem_ctx,
1186 r->in.secure_channel_type,
1187 security);
1188 if (r->in.machine_password == NULL) {
1189 TALLOC_FREE(frame);
1190 return NT_STATUS_NO_MEMORY;
1191 }
1192 }
1193
1194 cli_creds = cli_credentials_init(talloc_tos());
1195 if (cli_creds == NULL) {
1196 TALLOC_FREE(frame);
1197 return NT_STATUS_NO_MEMORY;
1198 }
1199
1200 cli_credentials_set_username(cli_creds, r->out.account_name,
1201 CRED_SPECIFIED);
1202 cli_credentials_set_domain(cli_creds, r->in.domain_name,
1203 CRED_SPECIFIED);
1204 cli_credentials_set_realm(cli_creds, "", CRED_SPECIFIED);
1205 cli_credentials_set_secure_channel_type(cli_creds,
1206 r->in.secure_channel_type);
1207
1208 /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
1209 cli_credentials_set_password(cli_creds, r->in.admin_password,
1210 CRED_SPECIFIED);
1211
1212 status = rpccli_create_netlogon_creds_ctx(
1213 cli_creds, authenticate_pipe->desthost, r->in.msg_ctx,
1214 frame, &netlogon_creds);
1215 if (!NT_STATUS_IS_OK(status)) {
1216 TALLOC_FREE(frame);
1217 return status;
1218 }
1219
1220 status = rpccli_setup_netlogon_creds(
1221 cli, NCACN_NP, netlogon_creds, true /* force_reauth */,
1222 cli_creds);
1223 if (!NT_STATUS_IS_OK(status)) {
1224 TALLOC_FREE(frame);
1225 return status;
1226 }
1227
1228 status = netlogon_creds_cli_get(netlogon_creds, frame, &creds);
1229 if (!NT_STATUS_IS_OK(status)) {
1230 TALLOC_FREE(frame);
1231 return status;
1232 }
1233
1234 netlogon_flags = creds->negotiate_flags;
1235 TALLOC_FREE(creds);
1236
1237 if (netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC) {
1238 status = cli_rpc_pipe_open_schannel_with_creds(cli,
1239 &ndr_table_netlogon,
1240 NCACN_NP,
1241 netlogon_creds,
1242 &passwordset_pipe);
1243 if (!NT_STATUS_IS_OK(status)) {
1244 TALLOC_FREE(frame);
1245 return status;
1246 }
1247 } else {
1248 passwordset_pipe = authenticate_pipe;
1249 }
1250
1251 len = strlen(r->in.machine_password);
1252 ok = convert_string_talloc(frame, CH_UNIX, CH_UTF16,
1253 r->in.machine_password, len,
1254 (void **)&new_trust_blob.data,
1255 &new_trust_blob.length);
1256 if (!ok) {
1257 status = NT_STATUS_UNMAPPABLE_CHARACTER;
1258 if (errno == ENOMEM) {
1259 status = NT_STATUS_NO_MEMORY;
1260 }
1261 TALLOC_FREE(frame);
1262 return status;
1263 }
1264
1265 status = netlogon_creds_cli_ServerPasswordSet(netlogon_creds,
1266 passwordset_pipe->binding_handle,
1267 &new_trust_blob,
1268 NULL); /* new_version */
1269 if (!NT_STATUS_IS_OK(status)) {
1270 TALLOC_FREE(frame);
1271 return status;
1272 }
1273
1274 TALLOC_FREE(frame);
1275 return NT_STATUS_OK;
1276 }
1277
1278 /****************************************************************
1279 Do the domain join
1280 ****************************************************************/
1281
1282 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
1283 struct libnet_JoinCtx *r,
1284 struct cli_state *cli)
1285 {
1286 struct rpc_pipe_client *pipe_hnd = NULL;
1287 struct policy_handle sam_pol, domain_pol, user_pol;
1288 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1289 char *acct_name;
1290 struct lsa_String lsa_acct_name;
1291 uint32_t user_rid;
1292 uint32_t acct_flags = ACB_WSTRUST;
1293 struct samr_Ids user_rids;
1294 struct samr_Ids name_types;
1295 union samr_UserInfo user_info;
1296 struct dcerpc_binding_handle *b = NULL;
1297 unsigned int old_timeout = 0;
1298
1299 DATA_BLOB session_key = data_blob_null;
1300 struct samr_CryptPassword crypt_pwd;
1301 struct samr_CryptPasswordEx crypt_pwd_ex;
1302
1303 ZERO_STRUCT(sam_pol);
1304 ZERO_STRUCT(domain_pol);
1305 ZERO_STRUCT(user_pol);
1306
1307 switch (r->in.secure_channel_type) {
1308 case SEC_CHAN_WKSTA:
1309 acct_flags = ACB_WSTRUST;
1310 break;
1311 case SEC_CHAN_BDC:
1312 acct_flags = ACB_SVRTRUST;
1313 break;
1314 default:
1315 return NT_STATUS_INVALID_PARAMETER;
1316 }
1317
1318 if (!r->in.machine_password) {
1319 int security = r->in.ads ? SEC_ADS : SEC_DOMAIN;
1320
1321 r->in.machine_password = trust_pw_new_value(mem_ctx,
1322 r->in.secure_channel_type,
1323 security);
1324 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
1325 }
1326
1327 /* Open the domain */
1328
1329 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
1330 &pipe_hnd);
1331 if (!NT_STATUS_IS_OK(status)) {
1332 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1333 nt_errstr(status)));
1334 goto done;
1335 }
1336
1337 b = pipe_hnd->binding_handle;
1338
1339 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
1340 if (!NT_STATUS_IS_OK(status)) {
1341 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
1342 nt_errstr(status)));
1343 goto done;
1344 }
1345
1346 status = dcerpc_samr_Connect2(b, mem_ctx,
1347 pipe_hnd->desthost,
1348 SAMR_ACCESS_ENUM_DOMAINS
1349 | SAMR_ACCESS_LOOKUP_DOMAIN,
1350 &sam_pol,
1351 &result);
1352 if (!NT_STATUS_IS_OK(status)) {
1353 goto done;
1354 }
1355 if (!NT_STATUS_IS_OK(result)) {
1356 status = result;
1357 goto done;
1358 }
1359
1360 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1361 &sam_pol,
1362 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
1363 | SAMR_DOMAIN_ACCESS_CREATE_USER
1364 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
1365 r->out.domain_sid,
1366 &domain_pol,
1367 &result);
1368 if (!NT_STATUS_IS_OK(status)) {
1369 goto done;
1370 }
1371 if (!NT_STATUS_IS_OK(result)) {
1372 status = result;
1373 goto done;
1374 }
1375
1376 /* Create domain user */
1377
1378 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1379 if (!strlower_m(acct_name)) {
1380 status = NT_STATUS_INVALID_PARAMETER;
1381 goto done;
1382 }
1383
1384 init_lsa_String(&lsa_acct_name, acct_name);
1385
1386 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
1387 uint32_t access_desired =
1388 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
1389 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
1390 SAMR_USER_ACCESS_SET_PASSWORD |
1391 SAMR_USER_ACCESS_GET_ATTRIBUTES |
1392 SAMR_USER_ACCESS_SET_ATTRIBUTES;
1393 uint32_t access_granted = 0;
1394
1395 DEBUG(10,("Creating account with desired access mask: %d\n",
1396 access_desired));
1397
1398 status = dcerpc_samr_CreateUser2(b, mem_ctx,
1399 &domain_pol,
1400 &lsa_acct_name,
1401 acct_flags,
1402 access_desired,
1403 &user_pol,
1404 &access_granted,
1405 &user_rid,
1406 &result);
1407 if (!NT_STATUS_IS_OK(status)) {
1408 goto done;
1409 }
1410
1411 status = result;
1412 if (!NT_STATUS_IS_OK(status) &&
1413 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1414
1415 DEBUG(10,("Creation of workstation account failed: %s\n",
1416 nt_errstr(status)));
1417
1418 /* If NT_STATUS_ACCESS_DENIED then we have a valid
1419 username/password combo but the user does not have
1420 administrator access. */
1421
1422 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1423 libnet_join_set_error_string(mem_ctx, r,
1424 "User specified does not have "
1425 "administrator privileges");
1426 }
1427
1428 goto done;
1429 }
1430
1431 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1432 if (!(r->in.join_flags &
1433 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
1434 goto done;
1435 }
1436 }
1437
1438 /* We *must* do this.... don't ask... */
1439
1440 if (NT_STATUS_IS_OK(status)) {
1441 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1442 }
1443 }
1444
1445 status = dcerpc_samr_LookupNames(b, mem_ctx,
1446 &domain_pol,
1447 1,
1448 &lsa_acct_name,
1449 &user_rids,
1450 &name_types,
1451 &result);
1452 if (!NT_STATUS_IS_OK(status)) {
1453 goto done;
1454 }
1455 if (!NT_STATUS_IS_OK(result)) {
1456 status = result;
1457 goto done;
1458 }
1459 if (user_rids.count != 1) {
1460 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1461 goto done;
1462 }
1463 if (name_types.count != 1) {
1464 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1465 goto done;
1466 }
1467
1468 if (name_types.ids[0] != SID_NAME_USER) {
1469 DEBUG(0,("%s is not a user account (type=%d)\n",
1470 acct_name, name_types.ids[0]));
1471 status = NT_STATUS_INVALID_WORKSTATION;
1472 goto done;
1473 }
1474
1475 user_rid = user_rids.ids[0];
1476
1477 /* Open handle on user */
1478
1479 status = dcerpc_samr_OpenUser(b, mem_ctx,
1480 &domain_pol,
1481 SEC_FLAG_MAXIMUM_ALLOWED,
1482 user_rid,
1483 &user_pol,
1484 &result);
1485 if (!NT_STATUS_IS_OK(status)) {
1486 goto done;
1487 }
1488 if (!NT_STATUS_IS_OK(result)) {
1489 status = result;
1490 goto done;
1491 }
1492
1493 /* Fill in the additional account flags now */
1494
1495 acct_flags |= ACB_PWNOEXP;
1496
1497 /* Set account flags on machine account */
1498 ZERO_STRUCT(user_info.info16);
1499 user_info.info16.acct_flags = acct_flags;
1500
1501 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1502 &user_pol,
1503 UserControlInformation,
1504 &user_info,
1505 &result);
1506 if (!NT_STATUS_IS_OK(status)) {
1507 dcerpc_samr_DeleteUser(b, mem_ctx,
1508 &user_pol,
1509 &result);
1510
1511 libnet_join_set_error_string(mem_ctx, r,
1512 "Failed to set account flags for machine account (%s)\n",
1513 nt_errstr(status));
1514 goto done;
1515 }
1516
1517 if (!NT_STATUS_IS_OK(result)) {
1518 status = result;
1519
1520 dcerpc_samr_DeleteUser(b, mem_ctx,
1521 &user_pol,
1522 &result);
1523
1524 libnet_join_set_error_string(mem_ctx, r,
1525 "Failed to set account flags for machine account (%s)\n",
1526 nt_errstr(status));
1527 goto done;
1528 }
1529
1530 /* Set password on machine account - first try level 26 */
1531
1532 /*
1533 * increase the timeout as password filter modules on the DC
1534 * might delay the operation for a significant amount of time
1535 */
1536 old_timeout = rpccli_set_timeout(pipe_hnd, 600000);
1537
1538 status = init_samr_CryptPasswordEx(r->in.machine_password,
1539 &session_key,
1540 &crypt_pwd_ex);
1541 if (!NT_STATUS_IS_OK(status)) {
1542 goto error;
1543 }
1544
1545 user_info.info26.password = crypt_pwd_ex;
1546 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1547
1548 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1549 &user_pol,
1550 UserInternal5InformationNew,
1551 &user_info,
1552 &result);
1553
1554 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1555
1556 /* retry with level 24 */
1557
1558 status = init_samr_CryptPassword(r->in.machine_password,
1559 &session_key,
1560 &crypt_pwd);
1561 if (!NT_STATUS_IS_OK(status)) {
1562 goto error;
1563 }
1564
1565 user_info.info24.password = crypt_pwd;
1566 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1567
1568 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1569 &user_pol,
1570 UserInternal5Information,
1571 &user_info,
1572 &result);
1573 }
1574
1575 error:
1576 old_timeout = rpccli_set_timeout(pipe_hnd, old_timeout);
1577
1578 if (!NT_STATUS_IS_OK(status)) {
1579
1580 dcerpc_samr_DeleteUser(b, mem_ctx,
1581 &user_pol,
1582 &result);
1583
1584 libnet_join_set_error_string(mem_ctx, r,
1585 "Failed to set password for machine account (%s)\n",
1586 nt_errstr(status));
1587 goto done;
1588 }
1589 if (!NT_STATUS_IS_OK(result)) {
1590 status = result;
1591
1592 dcerpc_samr_DeleteUser(b, mem_ctx,
1593 &user_pol,
1594 &result);
1595
1596 libnet_join_set_error_string(mem_ctx, r,
1597 "Failed to set password for machine account (%s)\n",
1598 nt_errstr(status));
1599 goto done;
1600 }
1601
1602 status = NT_STATUS_OK;
1603
1604 done:
1605 if (!pipe_hnd) {
1606 return status;
1607 }
1608
1609 data_blob_clear_free(&session_key);
1610
1611 if (is_valid_policy_hnd(&sam_pol)) {
1612 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1613 }
1614 if (is_valid_policy_hnd(&domain_pol)) {
1615 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1616 }
1617 if (is_valid_policy_hnd(&user_pol)) {
1618 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1619 }
1620 TALLOC_FREE(pipe_hnd);
1621
1622 return status;
1623 }
1624
1625 /****************************************************************
1626 ****************************************************************/
1627
1628 NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
1629 const char *netbios_domain_name,
1630 const char *dc_name,
1631 const bool use_kerberos)
1632 {
1633 TALLOC_CTX *frame = talloc_stackframe();
1634 struct cli_state *cli = NULL;
1635 struct rpc_pipe_client *netlogon_pipe = NULL;
1636 struct cli_credentials *cli_creds = NULL;
1637 struct netlogon_creds_cli_context *netlogon_creds = NULL;
1638 struct netlogon_creds_CredentialState *creds = NULL;
1639 uint32_t netlogon_flags = 0;
1640 NTSTATUS status;
1641 int flags = 0;
1642
1643 if (!dc_name) {
1644 TALLOC_FREE(frame);
1645 return NT_STATUS_INVALID_PARAMETER;
1646 }
1647
1648 if (!secrets_init()) {
1649 TALLOC_FREE(frame);
1650 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1651 }
1652
1653 status = pdb_get_trust_credentials(netbios_domain_name, NULL,
1654 frame, &cli_creds);
1655 if (!NT_STATUS_IS_OK(status)) {
1656 TALLOC_FREE(frame);
1657 return status;
1658 }
1659
1660 /* we don't want any old password */
1661 cli_credentials_set_old_password(cli_creds, NULL, CRED_SPECIFIED);
1662
1663 if (use_kerberos) {
1664 cli_credentials_set_kerberos_state(cli_creds,
1665 CRED_MUST_USE_KERBEROS);
1666 }
1667
1668 status = cli_full_connection_creds(&cli, NULL,
1669 dc_name,
1670 NULL, 0,
1671 "IPC$", "IPC",
1672 cli_creds,
1673 flags,
1674 SMB_SIGNING_IPC_DEFAULT);
1675
1676 if (!NT_STATUS_IS_OK(status)) {
1677 status = cli_full_connection(&cli, NULL,
1678 dc_name,
1679 NULL, 0,
1680 "IPC$", "IPC",
1681 "",
1682 NULL,
1683 "",
1684 0,
1685 SMB_SIGNING_IPC_DEFAULT);
1686 }
1687
1688 if (!NT_STATUS_IS_OK(status)) {
1689 TALLOC_FREE(frame);
1690 return status;
1691 }
1692
1693 status = rpccli_create_netlogon_creds_ctx(cli_creds,
1694 dc_name,
1695 msg_ctx,
1696 frame,
1697 &netlogon_creds);
1698 if (!NT_STATUS_IS_OK(status)) {
1699 cli_shutdown(cli);
1700 TALLOC_FREE(frame);
1701 return status;
1702 }
1703
1704 status = rpccli_setup_netlogon_creds(cli, NCACN_NP,
1705 netlogon_creds,
1706 true, /* force_reauth */
1707 cli_creds);
1708 if (!NT_STATUS_IS_OK(status)) {
1709 DEBUG(0,("connect_to_domain_password_server: "
1710 "unable to open the domain client session to "
1711 "machine %s. Flags[0x%08X] Error was : %s.\n",
1712 dc_name, (unsigned)netlogon_flags,
1713 nt_errstr(status)));
1714 cli_shutdown(cli);
1715 TALLOC_FREE(frame);
1716 return status;
1717 }
1718
1719 status = netlogon_creds_cli_get(netlogon_creds,
1720 talloc_tos(),
1721 &creds);
1722 if (!NT_STATUS_IS_OK(status)) {
1723 cli_shutdown(cli);
1724 TALLOC_FREE(frame);
1725 return status;
1726 }
1727 netlogon_flags = creds->negotiate_flags;
1728 TALLOC_FREE(creds);
1729
1730 if (!(netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
1731 cli_shutdown(cli);
1732 TALLOC_FREE(frame);
1733 return NT_STATUS_OK;
1734 }
1735
1736 status = cli_rpc_pipe_open_schannel_with_creds(
1737 cli, &ndr_table_netlogon, NCACN_NP,
1738 netlogon_creds, &netlogon_pipe);
1739
1740 TALLOC_FREE(netlogon_pipe);
1741
1742 if (!NT_STATUS_IS_OK(status)) {
1743 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1744 "on netlogon pipe to server %s for domain %s. "
1745 "Error was %s\n",
1746 smbXcli_conn_remote_name(cli->conn),
1747 netbios_domain_name, nt_errstr(status)));
1748 cli_shutdown(cli);
1749 TALLOC_FREE(frame);
1750 return status;
1751 }
1752
1753 cli_shutdown(cli);
1754 TALLOC_FREE(frame);
1755 return NT_STATUS_OK;
1756 }
1757
1758 /****************************************************************
1759 ****************************************************************/
1760
1761 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1762 struct libnet_JoinCtx *r)
1763 {
1764 NTSTATUS status;
1765
1766 status = libnet_join_ok(r->in.msg_ctx,
1767 r->out.netbios_domain_name,
1768 r->in.dc_name,
1769 r->in.use_kerberos);
1770 if (!NT_STATUS_IS_OK(status)) {
1771 libnet_join_set_error_string(mem_ctx, r,
1772 "failed to verify domain membership after joining: %s",
1773 get_friendly_nt_error_msg(status));
1774 return WERR_NERR_SETUPNOTJOINED;
1775 }
1776
1777 return WERR_OK;
1778 }
1779
1780 /****************************************************************
1781 ****************************************************************/
1782
1783 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1784 struct libnet_UnjoinCtx *r)
1785 {
1786 /*
1787 * TODO: use values from 'struct libnet_UnjoinCtx' ?
1788 */
1789 return secrets_delete_machine_password_ex(lp_workgroup(), lp_realm());
1790 }
1791
1792 /****************************************************************
1793 ****************************************************************/
1794
1795 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1796 struct libnet_UnjoinCtx *r)
1797 {
1798 struct cli_state *cli = NULL;
1799 struct rpc_pipe_client *pipe_hnd = NULL;
1800 struct policy_handle sam_pol, domain_pol, user_pol;
1801 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1802 char *acct_name;
1803 uint32_t user_rid;
1804 struct lsa_String lsa_acct_name;
1805 struct samr_Ids user_rids;
1806 struct samr_Ids name_types;
1807 union samr_UserInfo *info = NULL;
1808 struct dcerpc_binding_handle *b = NULL;
1809
1810 ZERO_STRUCT(sam_pol);
1811 ZERO_STRUCT(domain_pol);
1812 ZERO_STRUCT(user_pol);
1813
1814 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1815 r->in.admin_account,
1816 r->in.admin_domain,
1817 r->in.admin_password,
1818 r->in.use_kerberos,
1819 &cli);
1820 if (!NT_STATUS_IS_OK(status)) {
1821 goto done;
1822 }
1823
1824 /* Open the domain */
1825
1826 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
1827 &pipe_hnd);
1828 if (!NT_STATUS_IS_OK(status)) {
1829 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1830 nt_errstr(status)));
1831 goto done;
1832 }
1833
1834 b = pipe_hnd->binding_handle;
1835
1836 status = dcerpc_samr_Connect2(b, mem_ctx,
1837 pipe_hnd->desthost,
1838 SEC_FLAG_MAXIMUM_ALLOWED,
1839 &sam_pol,
1840 &result);
1841 if (!NT_STATUS_IS_OK(status)) {
1842 goto done;
1843 }
1844 if (!NT_STATUS_IS_OK(result)) {
1845 status = result;
1846 goto done;
1847 }
1848
1849 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1850 &sam_pol,
1851 SEC_FLAG_MAXIMUM_ALLOWED,
1852 r->in.domain_sid,
1853 &domain_pol,
1854 &result);
1855 if (!NT_STATUS_IS_OK(status)) {
1856 goto done;
1857 }
1858 if (!NT_STATUS_IS_OK(result)) {
1859 status = result;
1860 goto done;
1861 }
1862
1863 /* Create domain user */
1864
1865 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1866 if (!strlower_m(acct_name)) {
1867 status = NT_STATUS_INVALID_PARAMETER;
1868 goto done;
1869 }
1870
1871 init_lsa_String(&lsa_acct_name, acct_name);
1872
1873 status = dcerpc_samr_LookupNames(b, mem_ctx,
1874 &domain_pol,
1875 1,
1876 &lsa_acct_name,
1877 &user_rids,
1878 &name_types,
1879 &result);
1880
1881 if (!NT_STATUS_IS_OK(status)) {
1882 goto done;
1883 }
1884 if (!NT_STATUS_IS_OK(result)) {
1885 status = result;
1886 goto done;
1887 }
1888 if (user_rids.count != 1) {
1889 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1890 goto done;
1891 }
1892 if (name_types.count != 1) {
1893 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1894 goto done;
1895 }
1896
1897 if (name_types.ids[0] != SID_NAME_USER) {
1898 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1899 name_types.ids[0]));
1900 status = NT_STATUS_INVALID_WORKSTATION;
1901 goto done;
1902 }
1903
1904 user_rid = user_rids.ids[0];
1905
1906 /* Open handle on user */
1907
1908 status = dcerpc_samr_OpenUser(b, mem_ctx,
1909 &domain_pol,
1910 SEC_FLAG_MAXIMUM_ALLOWED,
1911 user_rid,
1912 &user_pol,
1913 &result);
1914 if (!NT_STATUS_IS_OK(status)) {
1915 goto done;
1916 }
1917 if (!NT_STATUS_IS_OK(result)) {
1918 status = result;
1919 goto done;
1920 }
1921
1922 /* Get user info */
1923
1924 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1925 &user_pol,
1926 16,
1927 &info,
1928 &result);
1929 if (!NT_STATUS_IS_OK(status)) {
1930 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1931 goto done;
1932 }
1933 if (!NT_STATUS_IS_OK(result)) {
1934 status = result;
1935 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1936 goto done;
1937 }
1938
1939 /* now disable and setuser info */
1940
1941 info->info16.acct_flags |= ACB_DISABLED;
1942
1943 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1944 &user_pol,
1945 16,
1946 info,
1947 &result);
1948 if (!NT_STATUS_IS_OK(status)) {
1949 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1950 goto done;
1951 }
1952 if (!NT_STATUS_IS_OK(result)) {
1953 status = result;
1954 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1955 goto done;
1956 }
1957 status = result;
1958 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1959
1960 done:
1961 if (pipe_hnd && b) {
1962 if (is_valid_policy_hnd(&domain_pol)) {
1963 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1964 }
1965 if (is_valid_policy_hnd(&sam_pol)) {
1966 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1967 }
1968 TALLOC_FREE(pipe_hnd);
1969 }
1970
1971 if (cli) {
1972 cli_shutdown(cli);
1973 }
1974
1975 return status;
1976 }
1977
1978 /****************************************************************
1979 ****************************************************************/
1980
1981 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1982 {
1983 WERROR werr = WERR_OK;
1984 sbcErr err;
1985 struct smbconf_ctx *ctx;
1986
1987 err = smbconf_init_reg(r, &ctx, NULL);
1988 if (!SBC_ERROR_IS_OK(err)) {
1989 werr = WERR_SERVICE_DOES_NOT_EXIST;
1990 goto done;
1991 }
1992
1993 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1994
1995 err = smbconf_set_global_parameter(ctx, "security", "user");
1996 if (!SBC_ERROR_IS_OK(err)) {
1997 werr = WERR_SERVICE_DOES_NOT_EXIST;
1998 goto done;
1999 }
2000
2001 err = smbconf_set_global_parameter(ctx, "workgroup",
2002 r->in.domain_name);
2003 if (!SBC_ERROR_IS_OK(err)) {
2004 werr = WERR_SERVICE_DOES_NOT_EXIST;
2005 goto done;
2006 }
2007
2008 smbconf_delete_global_parameter(ctx, "realm");
2009 goto done;
2010 }
2011
2012 err = smbconf_set_global_parameter(ctx, "security", "domain");
2013 if (!SBC_ERROR_IS_OK(err)) {
2014 werr = WERR_SERVICE_DOES_NOT_EXIST;
2015 goto done;
2016 }
2017
2018 err = smbconf_set_global_parameter(ctx, "workgroup",
2019 r->out.netbios_domain_name);
2020 if (!SBC_ERROR_IS_OK(err)) {
2021 werr = WERR_SERVICE_DOES_NOT_EXIST;
2022 goto done;
2023 }
2024
2025 if (r->out.domain_is_ad) {
2026 err = smbconf_set_global_parameter(ctx, "security", "ads");
2027 if (!SBC_ERROR_IS_OK(err)) {
2028 werr = WERR_SERVICE_DOES_NOT_EXIST;
2029 goto done;
2030 }
2031
2032 err = smbconf_set_global_parameter(ctx, "realm",
2033 r->out.dns_domain_name);
2034 if (!SBC_ERROR_IS_OK(err)) {
2035 werr = WERR_SERVICE_DOES_NOT_EXIST;
2036 goto done;
2037 }
2038 }
2039
2040 done:
2041 smbconf_shutdown(ctx);
2042 return werr;
2043 }
2044
2045 /****************************************************************
2046 ****************************************************************/
2047
2048 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
2049 {
2050 WERROR werr = WERR_OK;
2051 sbcErr err;
2052 struct smbconf_ctx *ctx;
2053
2054 err = smbconf_init_reg(r, &ctx, NULL);
2055 if (!SBC_ERROR_IS_OK(err)) {
2056 werr = WERR_SERVICE_DOES_NOT_EXIST;
2057 goto done;
2058 }
2059
2060 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2061
2062 err = smbconf_set_global_parameter(ctx, "security", "user");
2063 if (!SBC_ERROR_IS_OK(err)) {
2064 werr = WERR_SERVICE_DOES_NOT_EXIST;
2065 goto done;
2066 }
2067
2068 err = smbconf_delete_global_parameter(ctx, "workgroup");
2069 if (!SBC_ERROR_IS_OK(err)) {
2070 werr = WERR_SERVICE_DOES_NOT_EXIST;
2071 goto done;
2072 }
2073
2074 smbconf_delete_global_parameter(ctx, "realm");
2075 }
2076
2077 done:
2078 smbconf_shutdown(ctx);
2079 return werr;
2080 }
2081
2082 /****************************************************************
2083 ****************************************************************/
2084
2085 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
2086 {
2087 WERROR werr;
2088
2089 if (!W_ERROR_IS_OK(r->out.result)) {
2090 return r->out.result;
2091 }
2092
2093 if (!r->in.modify_config) {
2094 return WERR_OK;
2095 }
2096
2097 werr = do_join_modify_vals_config(r);
2098 if (!W_ERROR_IS_OK(werr)) {
2099 return werr;
2100 }
2101
2102 lp_load_global(get_dyn_CONFIGFILE());
2103
2104 r->out.modified_config = true;
2105 r->out.result = werr;
2106
2107 return werr;
2108 }
2109
2110 /****************************************************************
2111 ****************************************************************/
2112
2113 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
2114 {
2115 WERROR werr;
2116
2117 if (!W_ERROR_IS_OK(r->out.result)) {
2118 return r->out.result;
2119 }
2120
2121 if (!r->in.modify_config) {
2122 return WERR_OK;
2123 }
2124
2125 werr = do_unjoin_modify_vals_config(r);
2126 if (!W_ERROR_IS_OK(werr)) {
2127 return werr;
2128 }
2129
2130 lp_load_global(get_dyn_CONFIGFILE());
2131
2132 r->out.modified_config = true;
2133 r->out.result = werr;
2134
2135 return werr;
2136 }
2137
2138 /****************************************************************
2139 ****************************************************************/
2140
2141 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
2142 const char *domain_str,
2143 const char **domain_p,
2144 const char **dc_p)
2145 {
2146 char *domain = NULL;
2147 char *dc = NULL;
2148 const char *p = NULL;
2149
2150 if (!domain_str || !domain_p || !dc_p) {
2151 return false;
2152 }
2153
2154 p = strchr_m(domain_str, '\\');
2155
2156 if (p != NULL) {
2157 domain = talloc_strndup(mem_ctx, domain_str,
2158 PTR_DIFF(p, domain_str));
2159 dc = talloc_strdup(mem_ctx, p+1);
2160 if (!dc) {
2161 return false;
2162 }
2163 } else {
2164 domain = talloc_strdup(mem_ctx, domain_str);
2165 dc = NULL;
2166 }
2167 if (!domain) {
2168 return false;
2169 }
2170
2171 *domain_p = domain;
2172
2173 if (!*dc_p && dc) {
2174 *dc_p = dc;
2175 }
2176
2177 return true;
2178 }
2179
2180 /****************************************************************
2181 ****************************************************************/
2182
2183 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
2184 struct libnet_JoinCtx *r)
2185 {
2186 if (!r->in.domain_name) {
2187 libnet_join_set_error_string(mem_ctx, r,
2188 "No domain name defined");
2189 return WERR_INVALID_PARAMETER;
2190 }
2191
2192 if (strlen(r->in.machine_name) > 15) {
2193 libnet_join_set_error_string(mem_ctx, r,
2194 "Our netbios name can be at most 15 chars long, "
2195 "\"%s\" is %u chars long\n",
2196 r->in.machine_name,
2197 (unsigned int)strlen(r->in.machine_name));
2198 return WERR_INVALID_PARAMETER;
2199 }
2200
2201 r->out.account_name = talloc_asprintf(mem_ctx, "%s$",
2202 r->in.machine_name);
2203 if (r->out.account_name == NULL) {
2204 libnet_join_set_error_string(mem_ctx, r,
2205 "Unable to construct r->out.account_name");
2206 return WERR_NOT_ENOUGH_MEMORY;
2207 }
2208
2209 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2210 &r->in.domain_name,
2211 &r->in.dc_name)) {
2212 libnet_join_set_error_string(mem_ctx, r,
2213 "Failed to parse domain name");
2214 return WERR_INVALID_PARAMETER;
2215 }
2216
2217 if (!r->in.admin_domain) {
2218 char *admin_domain = NULL;
2219 char *admin_account = NULL;
2220 bool ok;
2221
2222 ok = split_domain_user(mem_ctx,
2223 r->in.admin_account,
2224 &admin_domain,
2225 &admin_account);
2226 if (!ok) {
2227 return WERR_NOT_ENOUGH_MEMORY;
2228 }
2229
2230 if (admin_domain != NULL) {
2231 r->in.admin_domain = admin_domain;
2232 } else {
2233 r->in.admin_domain = r->in.domain_name;
2234 }
2235 r->in.admin_account = admin_account;
2236 }
2237
2238 if (!secrets_init()) {
2239 libnet_join_set_error_string(mem_ctx, r,
2240 "Unable to open secrets database");
2241 return WERR_CAN_NOT_COMPLETE;
2242 }
2243
2244 return WERR_OK;
2245 }
2246
2247 /****************************************************************
2248 ****************************************************************/
2249
2250 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
2251 {
2252 NTSTATUS status;
2253
2254 /* Try adding dom admins to builtin\admins. Only log failures. */
2255 status = create_builtin_administrators(domain_sid);
2256 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
2257 DEBUG(10,("Unable to auto-add domain administrators to "
2258 "BUILTIN\\Administrators during join because "
2259 "winbindd must be running.\n"));
2260 } else if (!NT_STATUS_IS_OK(status)) {
2261 DEBUG(5, ("Failed to auto-add domain administrators to "
2262 "BUILTIN\\Administrators during join: %s\n",
2263 nt_errstr(status)));
2264 }
2265
2266 /* Try adding dom users to builtin\users. Only log failures. */
2267 status = create_builtin_users(domain_sid);
2268 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
2269 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
2270 "during join because winbindd must be running.\n"));
2271 } else if (!NT_STATUS_IS_OK(status)) {
2272 DEBUG(5, ("Failed to auto-add domain administrators to "
2273 "BUILTIN\\Administrators during join: %s\n",
2274 nt_errstr(status)));
2275 }
2276
2277 /* Try adding dom guests to builtin\guests. Only log failures. */
2278 status = create_builtin_guests(domain_sid);
2279 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
2280 DEBUG(10,("Unable to auto-add domain guests to "
2281 "BUILTIN\\Guests during join because "
2282 "winbindd must be running.\n"));
2283 } else if (!NT_STATUS_IS_OK(status)) {
2284 DEBUG(5, ("Failed to auto-add domain guests to "
2285 "BUILTIN\\Guests during join: %s\n",
2286 nt_errstr(status)));
2287 }
2288 }
2289
2290 /****************************************************************
2291 ****************************************************************/
2292
2293 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
2294 struct libnet_JoinCtx *r)
2295 {
2296 WERROR werr;
2297
2298 if (!W_ERROR_IS_OK(r->out.result)) {
2299 return r->out.result;
2300 }
2301
2302 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
2303 werr = do_JoinConfig(r);
2304 if (!W_ERROR_IS_OK(werr)) {
2305 return werr;
2306 }
2307
2308 return WERR_OK;
2309 }
2310
2311 #ifdef HAVE_ADS
2312 if (r->out.domain_is_ad &&
2313 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2314 ADS_STATUS ads_status;
2315
2316 ads_status = libnet_join_post_processing_ads_modify(mem_ctx, r);
2317 if (!ADS_ERR_OK(ads_status)) {
2318 return WERR_GEN_FAILURE;
2319 }
2320 }
2321 #endif /* HAVE_ADS */
2322
2323 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
2324 if (r->out.dns_domain_name) {
2325 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
2326 }
2327
2328 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2329 return WERR_NERR_SETUPNOTJOINED;
2330 }
2331
2332 werr = do_JoinConfig(r);
2333 if (!W_ERROR_IS_OK(werr)) {
2334 return werr;
2335 }
2336
2337 #ifdef HAVE_ADS
2338 if (r->out.domain_is_ad &&
2339 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2340 ADS_STATUS ads_status;
2341
2342 ads_status = libnet_join_post_processing_ads_sync(mem_ctx, r);
2343 if (!ADS_ERR_OK(ads_status)) {
2344 return WERR_GEN_FAILURE;
2345 }
2346 }
2347 #endif /* HAVE_ADS */
2348
2349 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
2350
2351 return WERR_OK;
2352 }
2353
2354 /****************************************************************
2355 ****************************************************************/
2356
2357 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
2358 {
2359 if (r->in.ads) {
2360 ads_destroy(&r->in.ads);
2361 }
2362
2363 return 0;
2364 }
2365
2366 /****************************************************************
2367 ****************************************************************/
2368
2369 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
2370 {
2371 if (r->in.ads) {
2372 ads_destroy(&r->in.ads);
2373 }
2374
2375 return 0;
2376 }
2377
2378 /****************************************************************
2379 ****************************************************************/
2380
2381 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
2382 struct libnet_JoinCtx **r)
2383 {
2384 struct libnet_JoinCtx *ctx;
2385
2386 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
2387 if (!ctx) {
2388 return WERR_NOT_ENOUGH_MEMORY;
2389 }
2390
2391 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
2392
2393 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
2394 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
2395
2396 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
2397
2398 ctx->in.desired_encryption_types = ENC_CRC32 |
2399 ENC_RSA_MD5 |
2400 ENC_RC4_HMAC_MD5;
2401 #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
2402 ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES128;
2403 #endif
2404 #ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
2405 ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES256;
2406 #endif
2407
2408 *r = ctx;
2409
2410 return WERR_OK;
2411 }
2412
2413 /****************************************************************
2414 ****************************************************************/
2415
2416 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
2417 struct libnet_UnjoinCtx **r)
2418 {
2419 struct libnet_UnjoinCtx *ctx;
2420
2421 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
2422 if (!ctx) {
2423 return WERR_NOT_ENOUGH_MEMORY;
2424 }
2425
2426 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
2427
2428 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
2429 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
2430
2431 *r = ctx;
2432
2433 return WERR_OK;
2434 }
2435
2436 /****************************************************************
2437 ****************************************************************/
2438
2439 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
2440 struct libnet_JoinCtx *r)
2441 {
2442 bool valid_security = false;
2443 bool valid_workgroup = false;
2444 bool valid_realm = false;
2445 bool ignored_realm = false;
2446
2447 /* check if configuration is already set correctly */
2448
2449 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
2450
2451 switch (r->out.domain_is_ad) {
2452 case false:
2453 valid_security = (lp_security() == SEC_DOMAIN)
2454 || (lp_server_role() == ROLE_DOMAIN_PDC)
2455 || (lp_server_role() == ROLE_DOMAIN_BDC);
2456 if (valid_workgroup && valid_security) {
2457 /* nothing to be done */
2458 return WERR_OK;
2459 }
2460 break;
2461 case true:
2462 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
2463 switch (lp_security()) {
2464 case SEC_DOMAIN:
2465 if (!valid_realm && lp_winbind_rpc_only()) {
2466 valid_realm = true;
2467 ignored_realm = true;
2468 }
2469
2470 FALL_THROUGH;
2471 case SEC_ADS:
2472 valid_security = true;
2473 }
2474
2475 if (valid_workgroup && valid_realm && valid_security) {
2476 if (ignored_realm && !r->in.modify_config)
2477 {
2478 libnet_join_set_error_string(mem_ctx, r,
2479 "Warning: ignoring realm when "
2480 "joining AD domain with "
2481 "'security=domain' and "
2482 "'winbind rpc only = yes'. "
2483 "(realm set to '%s', "
2484 "should be '%s').", lp_realm(),
2485 r->out.dns_domain_name);
2486 }
2487 /* nothing to be done */
2488 return WERR_OK;
2489 }
2490 break;
2491 }
2492
2493 /* check if we are supposed to manipulate configuration */
2494
2495 if (!r->in.modify_config) {
2496
2497 char *wrong_conf = talloc_strdup(mem_ctx, "");
2498
2499 if (!valid_workgroup) {
2500 wrong_conf = talloc_asprintf_append(wrong_conf,
2501 "\"workgroup\" set to '%s', should be '%s'",
2502 lp_workgroup(), r->out.netbios_domain_name);
2503 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2504 }
2505
2506 if (!valid_realm) {
2507 wrong_conf = talloc_asprintf_append(wrong_conf,
2508 "\"realm\" set to '%s', should be '%s'",
2509 lp_realm(), r->out.dns_domain_name);
2510 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2511 }
2512
2513 if (!valid_security) {
2514 const char *sec = NULL;
2515 switch (lp_security()) {
2516 case SEC_USER: sec = "user"; break;
2517 case SEC_DOMAIN: sec = "domain"; break;
2518 case SEC_ADS: sec = "ads"; break;
2519 }
2520 wrong_conf = talloc_asprintf_append(wrong_conf,
2521 "\"security\" set to '%s', should be %s",
2522 sec, r->out.domain_is_ad ?
2523 "either 'domain' or 'ads'" : "'domain'");
2524 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2525 }
2526
2527 libnet_join_set_error_string(mem_ctx, r,
2528 "Invalid configuration (%s) and configuration modification "
2529 "was not requested", wrong_conf);
2530 return WERR_CAN_NOT_COMPLETE;
2531 }
2532
2533 /* check if we are able to manipulate configuration */
2534
2535 if (!lp_config_backend_is_registry()) {
2536 libnet_join_set_error_string(mem_ctx, r,
2537 "Configuration manipulation requested but not "
2538 "supported by backend");
2539 return WERR_NOT_SUPPORTED;
2540 }
2541
2542 return WERR_OK;
2543 }
2544
2545 /****************************************************************
2546 ****************************************************************/
2547
2548 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
2549 struct libnet_JoinCtx *r)
2550 {
2551 NTSTATUS status;
2552 WERROR werr;
2553 struct cli_state *cli = NULL;
2554 #ifdef HAVE_ADS
2555 ADS_STATUS ads_status;
2556 #endif /* HAVE_ADS */
2557 const char *pre_connect_realm = NULL;
2558 const char *numeric_dcip = NULL;
2559 const char *sitename = NULL;
2560
2561 /* Before contacting a DC, we can securely know
2562 * the realm only if the user specifies it.
2563 */
2564 if (r->in.use_kerberos &&
2565 r->in.domain_name_type == JoinDomNameTypeDNS) {
2566 pre_connect_realm = r->in.domain_name;
2567 }
2568
2569 if (!r->in.dc_name) {
2570 struct netr_DsRGetDCNameInfo *info;
2571 const char *dc;
2572 uint32_t name_type_flags = 0;
2573 if (r->in.domain_name_type == JoinDomNameTypeDNS) {
2574 name_type_flags = DS_IS_DNS_NAME;
2575 } else if (r->in.domain_name_type == JoinDomNameTypeNBT) {
2576 name_type_flags = DS_IS_FLAT_NAME;
2577 }
2578 status = dsgetdcname(mem_ctx,
2579 r->in.msg_ctx,
2580 r->in.domain_name,
2581 NULL,
2582 NULL,
2583 DS_FORCE_REDISCOVERY |
2584 DS_DIRECTORY_SERVICE_REQUIRED |
2585 DS_WRITABLE_REQUIRED |
2586 DS_RETURN_DNS_NAME |
2587 name_type_flags,
2588 &info);
2589 if (!NT_STATUS_IS_OK(status)) {
2590 libnet_join_set_error_string(mem_ctx, r,
2591 "failed to find DC for domain %s - %s",
2592 r->in.domain_name,
2593 get_friendly_nt_error_msg(status));
2594 return WERR_NERR_DCNOTFOUND;
2595 }
2596
2597 dc = strip_hostname(info->dc_unc);
2598 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2599 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2600
2601 if (info->dc_address == NULL || info->dc_address[0] != '\\' ||
2602 info->dc_address[1] != '\\') {
2603 DBG_ERR("ill-formed DC address '%s'\n",
2604 info->dc_address);
2605 return WERR_NERR_DCNOTFOUND;
2606 }
2607
2608 numeric_dcip = info->dc_address + 2;
2609 sitename = info->dc_site_name;
2610 /* info goes out of scope but the memory stays
2611 allocated on the talloc context */
2612 }
2613
2614 if (pre_connect_realm != NULL) {
2615 struct sockaddr_storage ss = {0};
2616
2617 if (numeric_dcip != NULL) {
2618 if (!interpret_string_addr(&ss, numeric_dcip,
2619 AI_NUMERICHOST)) {
2620 DBG_ERR(
2621 "cannot parse IP address '%s' of DC '%s'\n",
2622 numeric_dcip, r->in.dc_name);
2623 return WERR_NERR_DCNOTFOUND;
2624 }
2625 } else {
2626 if (!interpret_string_addr(&ss, r->in.dc_name, 0)) {
2627 DBG_WARNING(
2628 "cannot resolve IP address of DC '%s'\n",
2629 r->in.dc_name);
2630 return WERR_NERR_DCNOTFOUND;
2631 }
2632 }
2633
2634 /* The domain parameter is only used as modifier
2635 * to krb5.conf file name. _JOIN_ is is not a valid
2636 * NetBIOS name so it cannot clash with another domain
2637 * -- Uri.
2638 */
2639 create_local_private_krb5_conf_for_domain(pre_connect_realm,
2640 "_JOIN_",
2641 sitename,
2642 &ss);
2643 }
2644
2645 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
2646 if (!NT_STATUS_IS_OK(status)) {
2647 libnet_join_set_error_string(mem_ctx, r,
2648 "failed to lookup DC info for domain '%s' over rpc: %s",
2649 r->in.domain_name, get_friendly_nt_error_msg(status));
2650 return ntstatus_to_werror(status);
2651 }
2652
2653 werr = libnet_join_check_config(mem_ctx, r);
2654 if (!W_ERROR_IS_OK(werr)) {
2655 goto done;
2656 }
2657
2658 #ifdef HAVE_ADS
2659
2660 if (r->out.domain_is_ad) {
2661 create_local_private_krb5_conf_for_domain(
2662 r->out.dns_domain_name, r->out.netbios_domain_name,
2663 sitename, smbXcli_conn_remote_sockaddr(cli->conn));
2664 }
2665
2666 if (r->out.domain_is_ad &&
2667 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2668
2669 const char *initial_account_ou = r->in.account_ou;
2670
2671 /*
2672 * we want to create the msDS-SupportedEncryptionTypes attribute
2673 * as early as possible so always try an LDAP create as the user
2674 * first. We copy r->in.account_ou because it may be changed
2675 * during the machine pre-creation.
2676 */
2677
2678 ads_status = libnet_join_connect_ads_user(mem_ctx, r);
2679 if (!ADS_ERR_OK(ads_status)) {
2680 libnet_join_set_error_string(mem_ctx, r,
2681 "failed to connect to AD: %s",
2682 ads_errstr(ads_status));
2683 return WERR_NERR_DEFAULTJOINREQUIRED;
2684 }
2685
2686 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
2687 if (ADS_ERR_OK(ads_status)) {
2688
2689 /*
2690 * LDAP object creation succeeded.
2691 */
2692 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
2693
2694 return WERR_OK;
2695 }
2696
2697 if (initial_account_ou != NULL) {
2698 libnet_join_set_error_string(mem_ctx, r,
2699 "failed to precreate account in ou %s: %s",
2700 r->in.account_ou,
2701 ads_errstr(ads_status));
2702 return WERR_NERR_DEFAULTJOINREQUIRED;
2703 }
2704
2705 DBG_INFO("Failed to pre-create account in OU %s: %s\n",
2706 r->in.account_ou, ads_errstr(ads_status));
2707 }
2708 #endif /* HAVE_ADS */
2709
2710 if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2711 (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2712 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2713 } else {
2714 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2715 }
2716 if (!NT_STATUS_IS_OK(status)) {
2717 libnet_join_set_error_string(mem_ctx, r,
2718 "failed to join domain '%s' over rpc: %s",
2719 r->in.domain_name, get_friendly_nt_error_msg(status));
2720 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2721 return WERR_NERR_SETUPALREADYJOINED;
2722 }
2723 werr = ntstatus_to_werror(status);
2724 goto done;
2725 }
2726
2727 werr = WERR_OK;
2728
2729 done:
2730 if (cli) {
2731 cli_shutdown(cli);
2732 }
2733
2734 return werr;
2735 }
2736
2737 /****************************************************************
2738 ****************************************************************/
2739
2740 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2741 struct libnet_JoinCtx *r)
2742 {
2743 WERROR werr;
2744 struct libnet_UnjoinCtx *u = NULL;
2745
2746 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2747 if (!W_ERROR_IS_OK(werr)) {
2748 return werr;
2749 }
2750
2751 u->in.debug = r->in.debug;
2752 u->in.dc_name = r->in.dc_name;
2753 u->in.domain_name = r->in.domain_name;
2754 u->in.admin_account = r->in.admin_account;
2755 u->in.admin_password = r->in.admin_password;
2756 u->in.modify_config = r->in.modify_config;
2757 u->in.use_kerberos = r->in.use_kerberos;
2758 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
2759 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2760
2761 werr = libnet_Unjoin(mem_ctx, u);
2762 TALLOC_FREE(u);
2763
2764 return werr;
2765 }
2766
2767 /****************************************************************
2768 ****************************************************************/
2769
2770 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2771 struct libnet_JoinCtx *r)
2772 {
2773 WERROR werr;
2774
2775 if (r->in.debug) {
2776 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2777 }
2778
2779 ZERO_STRUCT(r->out);
2780
2781 werr = libnet_join_pre_processing(mem_ctx, r);
2782 if (!W_ERROR_IS_OK(werr)) {
2783 goto done;
2784 }
2785
2786 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2787 werr = libnet_DomainJoin(mem_ctx, r);
2788 if (!W_ERROR_IS_OK(werr)) {
2789 goto done;
2790 }
2791 }
2792
2793 werr = libnet_join_post_processing(mem_ctx, r);
2794 if (!W_ERROR_IS_OK(werr)) {
2795 goto done;
2796 }
2797
2798 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2799 werr = libnet_join_post_verify(mem_ctx, r);
2800 if (!W_ERROR_IS_OK(werr)) {
2801 libnet_join_rollback(mem_ctx, r);
2802 }
2803 }
2804
2805 done:
2806 r->out.result = werr;
2807
2808 if (r->in.debug) {
2809 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2810 }
2811 return werr;
2812 }
2813
2814 /****************************************************************
2815 ****************************************************************/
2816
2817 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2818 struct libnet_UnjoinCtx *r)
2819 {
2820 NTSTATUS status;
2821
2822 if (!r->in.domain_sid) {
2823 struct dom_sid sid;
2824 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2825 libnet_unjoin_set_error_string(mem_ctx, r,
2826 "Unable to fetch domain sid: are we joined?");
2827 return WERR_NERR_SETUPNOTJOINED;
2828 }
2829 r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2830 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2831 }
2832
2833 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2834 !r->in.delete_machine_account) {
2835 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2836 return WERR_OK;
2837 }
2838
2839 if (!r->in.dc_name) {
2840 struct netr_DsRGetDCNameInfo *info;
2841 const char *dc;
2842 status = dsgetdcname(mem_ctx,
2843 r->in.msg_ctx,
2844 r->in.domain_name,
2845 NULL,
2846 NULL,
2847 DS_DIRECTORY_SERVICE_REQUIRED |
2848 DS_WRITABLE_REQUIRED |
2849 DS_RETURN_DNS_NAME,
2850 &info);
2851 if (!NT_STATUS_IS_OK(status)) {
2852 libnet_unjoin_set_error_string(mem_ctx, r,
2853 "failed to find DC for domain %s - %s",
2854 r->in.domain_name,
2855 get_friendly_nt_error_msg(status));
2856 return WERR_NERR_DCNOTFOUND;
2857 }
2858
2859 dc = strip_hostname(info->dc_unc);
2860 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2861 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2862 }
2863
2864 #ifdef HAVE_ADS
2865 /* for net ads leave, try to delete the account. If it works,
2866 no sense in disabling. If it fails, we can still try to
2867 disable it. jmcd */
2868
2869 if (r->in.delete_machine_account) {
2870 ADS_STATUS ads_status;
2871 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2872 if (ADS_ERR_OK(ads_status)) {
2873 /* dirty hack */
2874 r->out.dns_domain_name =
2875 talloc_strdup(mem_ctx,
2876 r->in.ads->server.realm);
2877 ads_status =
2878 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2879 }
2880 if (!ADS_ERR_OK(ads_status)) {
2881 libnet_unjoin_set_error_string(mem_ctx, r,
2882 "failed to remove machine account from AD: %s",
2883 ads_errstr(ads_status));
2884 } else {
2885 r->out.deleted_machine_account = true;
2886 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2887 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2888 return WERR_OK;
2889 }
2890 }
2891 #endif /* HAVE_ADS */
2892
2893 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2894 "disable". */
2895 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2896 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2897 if (!NT_STATUS_IS_OK(status)) {
2898 libnet_unjoin_set_error_string(mem_ctx, r,
2899 "failed to disable machine account via rpc: %s",
2900 get_friendly_nt_error_msg(status));
2901 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2902 return WERR_NERR_SETUPNOTJOINED;
2903 }
2904 return ntstatus_to_werror(status);
2905 }
2906
2907 r->out.dns_domain_name = talloc_strdup(mem_ctx,
2908 r->in.domain_name);
2909 r->out.disabled_machine_account = true;
2910 }
2911
2912 /* If disable succeeded or was not requested at all, we
2913 should be getting rid of our end of things */
2914
2915 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2916
2917 return WERR_OK;
2918 }
2919
2920 /****************************************************************
2921 ****************************************************************/
2922
2923 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2924 struct libnet_UnjoinCtx *r)
2925 {
2926 if (!r->in.domain_name) {
2927 libnet_unjoin_set_error_string(mem_ctx, r,
2928 "No domain name defined");
2929 return WERR_INVALID_PARAMETER;
2930 }
2931
2932 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2933 &r->in.domain_name,
2934 &r->in.dc_name)) {
2935 libnet_unjoin_set_error_string(mem_ctx, r,
2936 "Failed to parse domain name");
2937 return WERR_INVALID_PARAMETER;
2938 }
2939
2940 if (IS_DC) {
2941 return WERR_NERR_SETUPDOMAINCONTROLLER;
2942 }
2943
2944 if (!r->in.admin_domain) {
2945 char *admin_domain = NULL;
2946 char *admin_account = NULL;
2947 bool ok;
2948
2949 ok = split_domain_user(mem_ctx,
2950 r->in.admin_account,
2951 &admin_domain,
2952 &admin_account);
2953 if (!ok) {
2954 return WERR_NOT_ENOUGH_MEMORY;
2955 }
2956
2957 if (admin_domain != NULL) {
2958 r->in.admin_domain = admin_domain;
2959 } else {
2960 r->in.admin_domain = r->in.domain_name;
2961 }
2962 r->in.admin_account = admin_account;
2963 }
2964
2965 if (!secrets_init()) {
2966 libnet_unjoin_set_error_string(mem_ctx, r,
2967 "Unable to open secrets database");
2968 return WERR_CAN_NOT_COMPLETE;
2969 }
2970
2971 return WERR_OK;
2972 }
2973
2974 /****************************************************************
2975 ****************************************************************/
2976
2977 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2978 struct libnet_UnjoinCtx *r)
2979 {
2980 saf_delete(r->out.netbios_domain_name);
2981 saf_delete(r->out.dns_domain_name);
2982
2983 return libnet_unjoin_config(r);
2984 }
2985
2986 /****************************************************************
2987 ****************************************************************/
2988
2989 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2990 struct libnet_UnjoinCtx *r)
2991 {
2992 WERROR werr;
2993
2994 if (r->in.debug) {
2995 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2996 }
2997
2998 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2999 if (!W_ERROR_IS_OK(werr)) {
3000 goto done;
3001 }
3002
3003 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
3004 werr = libnet_DomainUnjoin(mem_ctx, r);
3005 if (!W_ERROR_IS_OK(werr)) {
3006 libnet_unjoin_config(r);
3007 goto done;
3008 }
3009 }
3010
3011 werr = libnet_unjoin_post_processing(mem_ctx, r);
3012 if (!W_ERROR_IS_OK(werr)) {
3013 goto done;
3014 }
3015
3016 done:
3017 r->out.result = werr;
3018
3019 if (r->in.debug) {
3020 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
3021 }
3022
3023 return werr;
3024 }
Samba GIT mirror