source3/lib/netapi/joindomain.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  NetApi Join Support
   4  *  Copyright (C) Guenther Deschner 2007-2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "ads.h"
  22 #include "librpc/gen_ndr/libnetapi.h"
  23 #include "libcli/auth/libcli_auth.h"
  24 #include "lib/netapi/netapi.h"
  25 #include "lib/netapi/netapi_private.h"
  26 #include "lib/netapi/libnetapi.h"
  27 #include "librpc/gen_ndr/libnet_join.h"
  28 #include "libnet/libnet_join.h"
  29 #include "../librpc/gen_ndr/ndr_wkssvc_c.h"
  30 #include "rpc_client/cli_pipe.h"
  31 #include "secrets.h"
  32
  33 /****************************************************************
  34 ****************************************************************/
  35
  36 WERROR NetJoinDomain_l(struct libnetapi_ctx *mem_ctx,
  37                        struct NetJoinDomain *r)
  38 {
  39         struct libnet_JoinCtx *j = NULL;
  40         struct libnetapi_private_ctx *priv;
  41         WERROR werr;
  42
  43         priv = talloc_get_type_abort(mem_ctx->private_data,
  44                 struct libnetapi_private_ctx);
  45
  46         if (!r->in.domain) {
  47                 return WERR_INVALID_PARAM;
  48         }
  49
  50         werr = libnet_init_JoinCtx(mem_ctx, &j);
  51         W_ERROR_NOT_OK_RETURN(werr);
  52
  53         j->in.domain_name = talloc_strdup(mem_ctx, r->in.domain);
  54         W_ERROR_HAVE_NO_MEMORY(j->in.domain_name);
  55
  56         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
  57                 NTSTATUS status;
  58                 struct netr_DsRGetDCNameInfo *info = NULL;
  59                 const char *dc = NULL;
  60                 uint32_t flags = DS_DIRECTORY_SERVICE_REQUIRED |
  61                                  DS_WRITABLE_REQUIRED |
  62                                  DS_RETURN_DNS_NAME;
  63                 status = dsgetdcname(mem_ctx, priv->msg_ctx, r->in.domain,
  64                                      NULL, NULL, flags, &info);
  65                 if (!NT_STATUS_IS_OK(status)) {
  66                         libnetapi_set_error_string(mem_ctx,
  67                                 "%s", get_friendly_nt_error_msg(status));
  68                         return ntstatus_to_werror(status);
  69                 }
  70
  71                 dc = strip_hostname(info->dc_unc);
  72                 j->in.dc_name = talloc_strdup(mem_ctx, dc);
  73                 W_ERROR_HAVE_NO_MEMORY(j->in.dc_name);
  74         }
  75
  76         if (r->in.account_ou) {
  77                 j->in.account_ou = talloc_strdup(mem_ctx, r->in.account_ou);
  78                 W_ERROR_HAVE_NO_MEMORY(j->in.account_ou);
  79         }
  80
  81         if (r->in.account) {
  82                 j->in.admin_account = talloc_strdup(mem_ctx, r->in.account);
  83                 W_ERROR_HAVE_NO_MEMORY(j->in.admin_account);
  84         }
  85
  86         if (r->in.password) {
  87                 j->in.admin_password = talloc_strdup(mem_ctx, r->in.password);
  88                 W_ERROR_HAVE_NO_MEMORY(j->in.admin_password);
  89         }
  90
  91         j->in.join_flags = r->in.join_flags;
  92         j->in.modify_config = true;
  93         j->in.debug = true;
  94
  95         werr = libnet_Join(mem_ctx, j);
  96         if (!W_ERROR_IS_OK(werr) && j->out.error_string) {
  97                 libnetapi_set_error_string(mem_ctx, "%s", j->out.error_string);
  98         }
  99         TALLOC_FREE(j);
 100
 101         return werr;
 102 }
 103
 104 /****************************************************************
 105 ****************************************************************/
 106
 107 WERROR NetJoinDomain_r(struct libnetapi_ctx *ctx,
 108                        struct NetJoinDomain *r)
 109 {
 110         struct rpc_pipe_client *pipe_cli = NULL;
 111         struct wkssvc_PasswordBuffer *encrypted_password = NULL;
 112         NTSTATUS status;
 113         WERROR werr;
 114         unsigned int old_timeout = 0;
 115         struct dcerpc_binding_handle *b;
 116         DATA_BLOB session_key;
 117
 118         werr = libnetapi_open_pipe(ctx, r->in.server,
 119                                    &ndr_table_wkssvc,
 120                                    &pipe_cli);
 121         if (!W_ERROR_IS_OK(werr)) {
 122                 goto done;
 123         }
 124
 125         b = pipe_cli->binding_handle;
 126
 127         if (r->in.password) {
 128
 129                 status = cli_get_session_key(talloc_tos(), pipe_cli, &session_key);
 130                 if (!NT_STATUS_IS_OK(status)) {
 131                         werr = ntstatus_to_werror(status);
 132                         goto done;
 133                 }
 134
 135                 encode_wkssvc_join_password_buffer(ctx,
 136                                                    r->in.password,
 137                                                    &session_key,
 138                                                    &encrypted_password);
 139         }
 140
 141         old_timeout = rpccli_set_timeout(pipe_cli, 600000);
 142
 143         status = dcerpc_wkssvc_NetrJoinDomain2(b, talloc_tos(),
 144                                                r->in.server,
 145                                                r->in.domain,
 146                                                r->in.account_ou,
 147                                                r->in.account,
 148                                                encrypted_password,
 149                                                r->in.join_flags,
 150                                                &werr);
 151         if (!NT_STATUS_IS_OK(status)) {
 152                 werr = ntstatus_to_werror(status);
 153                 goto done;
 154         }
 155
 156  done:
 157         if (pipe_cli && old_timeout) {
 158                 rpccli_set_timeout(pipe_cli, old_timeout);
 159         }
 160
 161         return werr;
 162 }
 163 /****************************************************************
 164 ****************************************************************/
 165
 166 WERROR NetUnjoinDomain_l(struct libnetapi_ctx *mem_ctx,
 167                          struct NetUnjoinDomain *r)
 168 {
 169         struct libnet_UnjoinCtx *u = NULL;
 170         struct dom_sid domain_sid;
 171         const char *domain = NULL;
 172         WERROR werr;
 173         struct libnetapi_private_ctx *priv;
 174
 175         priv = talloc_get_type_abort(mem_ctx->private_data,
 176                 struct libnetapi_private_ctx);
 177
 178         if (!secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
 179                 return WERR_SETUP_NOT_JOINED;
 180         }
 181
 182         werr = libnet_init_UnjoinCtx(mem_ctx, &u);
 183         W_ERROR_NOT_OK_RETURN(werr);
 184
 185         if (lp_realm()) {
 186                 domain = lp_realm();
 187         } else {
 188                 domain = lp_workgroup();
 189         }
 190
 191         if (r->in.server_name) {
 192                 u->in.dc_name = talloc_strdup(mem_ctx, r->in.server_name);
 193                 W_ERROR_HAVE_NO_MEMORY(u->in.dc_name);
 194         } else {
 195                 NTSTATUS status;
 196                 struct netr_DsRGetDCNameInfo *info = NULL;
 197                 const char *dc = NULL;
 198                 uint32_t flags = DS_DIRECTORY_SERVICE_REQUIRED |
 199                                  DS_WRITABLE_REQUIRED |
 200                                  DS_RETURN_DNS_NAME;
 201                 status = dsgetdcname(mem_ctx, priv->msg_ctx, domain,
 202                                      NULL, NULL, flags, &info);
 203                 if (!NT_STATUS_IS_OK(status)) {
 204                         libnetapi_set_error_string(mem_ctx,
 205                                 "failed to find DC for domain %s: %s",
 206                                 domain,
 207                                 get_friendly_nt_error_msg(status));
 208                         return ntstatus_to_werror(status);
 209                 }
 210
 211                 dc = strip_hostname(info->dc_unc);
 212                 u->in.dc_name = talloc_strdup(mem_ctx, dc);
 213                 W_ERROR_HAVE_NO_MEMORY(u->in.dc_name);
 214
 215                 u->in.domain_name = domain;
 216         }
 217
 218         if (r->in.account) {
 219                 u->in.admin_account = talloc_strdup(mem_ctx, r->in.account);
 220                 W_ERROR_HAVE_NO_MEMORY(u->in.admin_account);
 221         }
 222
 223         if (r->in.password) {
 224                 u->in.admin_password = talloc_strdup(mem_ctx, r->in.password);
 225                 W_ERROR_HAVE_NO_MEMORY(u->in.admin_password);
 226         }
 227
 228         u->in.domain_name = domain;
 229         u->in.unjoin_flags = r->in.unjoin_flags;
 230         u->in.delete_machine_account = false;
 231         u->in.modify_config = true;
 232         u->in.debug = true;
 233
 234         u->in.domain_sid = &domain_sid;
 235
 236         werr = libnet_Unjoin(mem_ctx, u);
 237         if (!W_ERROR_IS_OK(werr) && u->out.error_string) {
 238                 libnetapi_set_error_string(mem_ctx, "%s", u->out.error_string);
 239         }
 240         TALLOC_FREE(u);
 241
 242         return werr;
 243 }
 244
 245 /****************************************************************
 246 ****************************************************************/
 247
 248 WERROR NetUnjoinDomain_r(struct libnetapi_ctx *ctx,
 249                          struct NetUnjoinDomain *r)
 250 {
 251         struct rpc_pipe_client *pipe_cli = NULL;
 252         struct wkssvc_PasswordBuffer *encrypted_password = NULL;
 253         NTSTATUS status;
 254         WERROR werr;
 255         unsigned int old_timeout = 0;
 256         struct dcerpc_binding_handle *b;
 257         DATA_BLOB session_key;
 258
 259         werr = libnetapi_open_pipe(ctx, r->in.server_name,
 260                                    &ndr_table_wkssvc,
 261                                    &pipe_cli);
 262         if (!W_ERROR_IS_OK(werr)) {
 263                 goto done;
 264         }
 265
 266         b = pipe_cli->binding_handle;
 267
 268         if (r->in.password) {
 269
 270                 status = cli_get_session_key(talloc_tos(), pipe_cli, &session_key);
 271                 if (!NT_STATUS_IS_OK(status)) {
 272                         werr = ntstatus_to_werror(status);
 273                         goto done;
 274                 }
 275
 276                 encode_wkssvc_join_password_buffer(ctx,
 277                                                    r->in.password,
 278                                                    &session_key,
 279                                                    &encrypted_password);
 280         }
 281
 282         old_timeout = rpccli_set_timeout(pipe_cli, 60000);
 283
 284         status = dcerpc_wkssvc_NetrUnjoinDomain2(b, talloc_tos(),
 285                                                  r->in.server_name,
 286                                                  r->in.account,
 287                                                  encrypted_password,
 288                                                  r->in.unjoin_flags,
 289                                                  &werr);
 290         if (!NT_STATUS_IS_OK(status)) {
 291                 werr = ntstatus_to_werror(status);
 292                 goto done;
 293         }
 294
 295  done:
 296         if (pipe_cli && old_timeout) {
 297                 rpccli_set_timeout(pipe_cli, old_timeout);
 298         }
 299
 300         return werr;
 301 }
 302
 303 /****************************************************************
 304 ****************************************************************/
 305
 306 WERROR NetGetJoinInformation_r(struct libnetapi_ctx *ctx,
 307                                struct NetGetJoinInformation *r)
 308 {
 309         struct rpc_pipe_client *pipe_cli = NULL;
 310         NTSTATUS status;
 311         WERROR werr;
 312         const char *buffer = NULL;
 313         struct dcerpc_binding_handle *b;
 314
 315         werr = libnetapi_open_pipe(ctx, r->in.server_name,
 316                                    &ndr_table_wkssvc,
 317                                    &pipe_cli);
 318         if (!W_ERROR_IS_OK(werr)) {
 319                 goto done;
 320         }
 321
 322         b = pipe_cli->binding_handle;
 323
 324         status = dcerpc_wkssvc_NetrGetJoinInformation(b, talloc_tos(),
 325                                                       r->in.server_name,
 326                                                       &buffer,
 327                                                       (enum wkssvc_NetJoinStatus *)r->out.name_type,
 328                                                       &werr);
 329         if (!NT_STATUS_IS_OK(status)) {
 330                 werr = ntstatus_to_werror(status);
 331                 goto done;
 332         }
 333
 334         if (!W_ERROR_IS_OK(werr)) {
 335                 goto done;
 336         }
 337
 338         *r->out.name_buffer = talloc_strdup(ctx, buffer);
 339         W_ERROR_HAVE_NO_MEMORY(*r->out.name_buffer);
 340
 341  done:
 342         return werr;
 343 }
 344
 345 /****************************************************************
 346 ****************************************************************/
 347
 348 WERROR NetGetJoinInformation_l(struct libnetapi_ctx *ctx,
 349                                struct NetGetJoinInformation *r)
 350 {
 351         if ((lp_security() == SEC_ADS) && lp_realm()) {
 352                 *r->out.name_buffer = talloc_strdup(ctx, lp_realm());
 353         } else {
 354                 *r->out.name_buffer = talloc_strdup(ctx, lp_workgroup());
 355         }
 356         if (!*r->out.name_buffer) {
 357                 return WERR_NOMEM;
 358         }
 359
 360         switch (lp_server_role()) {
 361                 case ROLE_DOMAIN_MEMBER:
 362                 case ROLE_DOMAIN_PDC:
 363                 case ROLE_DOMAIN_BDC:
 364                         *r->out.name_type = NetSetupDomainName;
 365                         break;
 366                 case ROLE_STANDALONE:
 367                 default:
 368                         *r->out.name_type = NetSetupWorkgroupName;
 369                         break;
 370         }
 371
 372         return WERR_OK;
 373 }
 374
 375 /****************************************************************
 376 ****************************************************************/
 377
 378 WERROR NetGetJoinableOUs_l(struct libnetapi_ctx *ctx,
 379                            struct NetGetJoinableOUs *r)
 380 {
 381 #ifdef HAVE_ADS
 382         NTSTATUS status;
 383         ADS_STATUS ads_status;
 384         ADS_STRUCT *ads = NULL;
 385         struct netr_DsRGetDCNameInfo *info = NULL;
 386         const char *dc = NULL;
 387         uint32_t flags = DS_DIRECTORY_SERVICE_REQUIRED |
 388                          DS_RETURN_DNS_NAME;
 389         struct libnetapi_private_ctx *priv;
 390         char **p;
 391         size_t s;
 392
 393         priv = talloc_get_type_abort(ctx->private_data,
 394                 struct libnetapi_private_ctx);
 395
 396         status = dsgetdcname(ctx, priv->msg_ctx, r->in.domain,
 397                              NULL, NULL, flags, &info);
 398         if (!NT_STATUS_IS_OK(status)) {
 399                 libnetapi_set_error_string(ctx, "%s",
 400                         get_friendly_nt_error_msg(status));
 401                 return ntstatus_to_werror(status);
 402         }
 403
 404         dc = strip_hostname(info->dc_unc);
 405
 406         ads = ads_init(info->domain_name, info->domain_name, dc);
 407         if (!ads) {
 408                 return WERR_GENERAL_FAILURE;
 409         }
 410
 411         SAFE_FREE(ads->auth.user_name);
 412         if (r->in.account) {
 413                 ads->auth.user_name = SMB_STRDUP(r->in.account);
 414         } else if (ctx->username) {
 415                 ads->auth.user_name = SMB_STRDUP(ctx->username);
 416         }
 417
 418         SAFE_FREE(ads->auth.password);
 419         if (r->in.password) {
 420                 ads->auth.password = SMB_STRDUP(r->in.password);
 421         } else if (ctx->password) {
 422                 ads->auth.password = SMB_STRDUP(ctx->password);
 423         }
 424
 425         ads_status = ads_connect_user_creds(ads);
 426         if (!ADS_ERR_OK(ads_status)) {
 427                 ads_destroy(&ads);
 428                 return WERR_DEFAULT_JOIN_REQUIRED;
 429         }
 430
 431         ads_status = ads_get_joinable_ous(ads, ctx, &p, &s);
 432         if (!ADS_ERR_OK(ads_status)) {
 433                 ads_destroy(&ads);
 434                 return WERR_DEFAULT_JOIN_REQUIRED;
 435         }
 436         *r->out.ous = discard_const_p(const char *, p);
 437         *r->out.ou_count = s;
 438
 439         ads_destroy(&ads);
 440         return WERR_OK;
 441 #else
 442         return WERR_NOT_SUPPORTED;
 443 #endif
 444 }
 445
 446 /****************************************************************
 447 ****************************************************************/
 448
 449 WERROR NetGetJoinableOUs_r(struct libnetapi_ctx *ctx,
 450                            struct NetGetJoinableOUs *r)
 451 {
 452         struct rpc_pipe_client *pipe_cli = NULL;
 453         struct wkssvc_PasswordBuffer *encrypted_password = NULL;
 454         NTSTATUS status;
 455         WERROR werr;
 456         struct dcerpc_binding_handle *b;
 457         DATA_BLOB session_key;
 458
 459         werr = libnetapi_open_pipe(ctx, r->in.server_name,
 460                                    &ndr_table_wkssvc,
 461                                    &pipe_cli);
 462         if (!W_ERROR_IS_OK(werr)) {
 463                 goto done;
 464         }
 465
 466         b = pipe_cli->binding_handle;
 467
 468         if (r->in.password) {
 469
 470                 status = cli_get_session_key(talloc_tos(), pipe_cli, &session_key);
 471                 if (!NT_STATUS_IS_OK(status)) {
 472                         werr = ntstatus_to_werror(status);
 473                         goto done;
 474                 }
 475
 476                 encode_wkssvc_join_password_buffer(ctx,
 477                                                    r->in.password,
 478                                                    &session_key,
 479                                                    &encrypted_password);
 480         }
 481
 482         status = dcerpc_wkssvc_NetrGetJoinableOus2(b, talloc_tos(),
 483                                                    r->in.server_name,
 484                                                    r->in.domain,
 485                                                    r->in.account,
 486                                                    encrypted_password,
 487                                                    r->out.ou_count,
 488                                                    r->out.ous,
 489                                                    &werr);
 490         if (!NT_STATUS_IS_OK(status)) {
 491                 werr = ntstatus_to_werror(status);
 492                 goto done;
 493         }
 494
 495  done:
 496         return werr;
 497 }
 498
 499 /****************************************************************
 500 ****************************************************************/
 501
 502 WERROR NetRenameMachineInDomain_r(struct libnetapi_ctx *ctx,
 503                                   struct NetRenameMachineInDomain *r)
 504 {
 505         struct rpc_pipe_client *pipe_cli = NULL;
 506         struct wkssvc_PasswordBuffer *encrypted_password = NULL;
 507         NTSTATUS status;
 508         WERROR werr;
 509         struct dcerpc_binding_handle *b;
 510         DATA_BLOB session_key;
 511
 512         werr = libnetapi_open_pipe(ctx, r->in.server_name,
 513                                    &ndr_table_wkssvc,
 514                                    &pipe_cli);
 515         if (!W_ERROR_IS_OK(werr)) {
 516                 goto done;
 517         }
 518
 519         b = pipe_cli->binding_handle;
 520
 521         if (r->in.password) {
 522
 523                 status = cli_get_session_key(talloc_tos(), pipe_cli, &session_key);
 524                 if (!NT_STATUS_IS_OK(status)) {
 525                         werr = ntstatus_to_werror(status);
 526                         goto done;
 527                 }
 528
 529                 encode_wkssvc_join_password_buffer(ctx,
 530                                                    r->in.password,
 531                                                    &session_key,
 532                                                    &encrypted_password);
 533         }
 534
 535         status = dcerpc_wkssvc_NetrRenameMachineInDomain2(b, talloc_tos(),
 536                                                           r->in.server_name,
 537                                                           r->in.new_machine_name,
 538                                                           r->in.account,
 539                                                           encrypted_password,
 540                                                           r->in.rename_options,
 541                                                           &werr);
 542         if (!NT_STATUS_IS_OK(status)) {
 543                 werr = ntstatus_to_werror(status);
 544                 goto done;
 545         }
 546
 547  done:
 548         return werr;
 549 }
 550
 551 /****************************************************************
 552 ****************************************************************/
 553
 554 WERROR NetRenameMachineInDomain_l(struct libnetapi_ctx *ctx,
 555                                   struct NetRenameMachineInDomain *r)
 556 {
 557         LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetRenameMachineInDomain);
 558 }