?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: vfs_fruit: Ensure we operate on a copy of the incoming security descriptor.
[Samba.git] / source3 / libnet / libnet_join.c
blob903c93bfd2f34f394184ffc333fb317414a95325
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "ads.h"
23 #include "librpc/gen_ndr/ndr_libnet_join.h"
24 #include "libnet/libnet_join.h"
25 #include "libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/ndr_samr_c.h"
27 #include "rpc_client/init_samr.h"
28 #include "../librpc/gen_ndr/ndr_lsa_c.h"
29 #include "rpc_client/cli_lsarpc.h"
30 #include "../librpc/gen_ndr/ndr_netlogon.h"
31 #include "rpc_client/cli_netlogon.h"
32 #include "lib/smbconf/smbconf.h"
33 #include "lib/smbconf/smbconf_reg.h"
34 #include "../libds/common/flags.h"
35 #include "secrets.h"
36 #include "rpc_client/init_lsa.h"
37 #include "rpc_client/cli_pipe.h"
38 #include "../libcli/security/security.h"
39 #include "passdb.h"
40 #include "libsmb/libsmb.h"
41 #include "../libcli/smb/smbXcli_base.h"
42 #include "lib/param/loadparm.h"
43 #include "libcli/auth/netlogon_creds_cli.h"
44 #include "auth/credentials/credentials.h"
45 #include "krb5_env.h"
46
47 /****************************************************************
48 ****************************************************************/
49
50 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
51 do { \
52 char *str = NULL; \
53 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
54 DEBUG(1,("libnet_Join:\n%s", str)); \
55 TALLOC_FREE(str); \
56 } while (0)
57
58 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
59 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
60 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
61 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
62
63 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
64 do { \
65 char *str = NULL; \
66 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
67 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
68 TALLOC_FREE(str); \
69 } while (0)
70
71 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
72 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
73 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
74 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
75
76 /****************************************************************
77 ****************************************************************/
78
79 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
80 struct libnet_JoinCtx *r,
81 const char *format, ...)
82 PRINTF_ATTRIBUTE(3,4);
83
84 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
85 struct libnet_JoinCtx *r,
86 const char *format, ...)
87 {
88 va_list args;
89
90 if (r->out.error_string) {
91 return;
92 }
93
94 va_start(args, format);
95 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
96 va_end(args);
97 }
98
99 /****************************************************************
100 ****************************************************************/
101
102 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
103 struct libnet_UnjoinCtx *r,
104 const char *format, ...)
105 PRINTF_ATTRIBUTE(3,4);
106
107 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
108 struct libnet_UnjoinCtx *r,
109 const char *format, ...)
110 {
111 va_list args;
112
113 if (r->out.error_string) {
114 return;
115 }
116
117 va_start(args, format);
118 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
119 va_end(args);
120 }
121
122 #ifdef HAVE_ADS
123
124 /****************************************************************
125 ****************************************************************/
126
127 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
128 const char *netbios_domain_name,
129 const char *dc_name,
130 const char *user_name,
131 const char *password,
132 const char *ccname,
133 ADS_STRUCT **ads)
134 {
135 ADS_STATUS status;
136 ADS_STRUCT *my_ads = NULL;
137 char *cp;
138
139 my_ads = ads_init(dns_domain_name,
140 netbios_domain_name,
141 dc_name);
142 if (!my_ads) {
143 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
144 }
145
146 if (user_name) {
147 SAFE_FREE(my_ads->auth.user_name);
148 my_ads->auth.user_name = SMB_STRDUP(user_name);
149 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
150 *cp++ = '\0';
151 SAFE_FREE(my_ads->auth.realm);
152 my_ads->auth.realm = smb_xstrdup(cp);
153 if (!strupper_m(my_ads->auth.realm)) {
154 ads_destroy(&my_ads);
155 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
156 }
157 }
158 }
159
160 if (password) {
161 SAFE_FREE(my_ads->auth.password);
162 my_ads->auth.password = SMB_STRDUP(password);
163 }
164
165 if (ccname != NULL) {
166 SAFE_FREE(my_ads->auth.ccache_name);
167 my_ads->auth.ccache_name = SMB_STRDUP(ccname);
168 setenv(KRB5_ENV_CCNAME, my_ads->auth.ccache_name, 1);
169 }
170
171 status = ads_connect_user_creds(my_ads);
172 if (!ADS_ERR_OK(status)) {
173 ads_destroy(&my_ads);
174 return status;
175 }
176
177 *ads = my_ads;
178 return ADS_SUCCESS;
179 }
180
181 /****************************************************************
182 ****************************************************************/
183
184 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
185 struct libnet_JoinCtx *r,
186 bool use_machine_creds)
187 {
188 ADS_STATUS status;
189 const char *username;
190 const char *password;
191 const char *ccname = NULL;
192
193 if (use_machine_creds) {
194 if (r->in.machine_name == NULL ||
195 r->in.machine_password == NULL) {
196 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
197 }
198 username = talloc_asprintf(mem_ctx, "%s$",
199 r->in.machine_name);
200 if (username == NULL) {
201 return ADS_ERROR(LDAP_NO_MEMORY);
202 }
203 password = r->in.machine_password;
204 ccname = "MEMORY:libnet_join_machine_creds";
205 } else {
206 username = r->in.admin_account;
207 password = r->in.admin_password;
208
209 /*
210 * when r->in.use_kerberos is set to allow "net ads join -k" we
211 * may not override the provided credential cache - gd
212 */
213
214 if (!r->in.use_kerberos) {
215 ccname = "MEMORY:libnet_join_user_creds";
216 }
217 }
218
219 status = libnet_connect_ads(r->out.dns_domain_name,
220 r->out.netbios_domain_name,
221 r->in.dc_name,
222 username,
223 password,
224 ccname,
225 &r->in.ads);
226 if (!ADS_ERR_OK(status)) {
227 libnet_join_set_error_string(mem_ctx, r,
228 "failed to connect to AD: %s",
229 ads_errstr(status));
230 return status;
231 }
232
233 if (!r->out.netbios_domain_name) {
234 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
235 r->in.ads->server.workgroup);
236 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
237 }
238
239 if (!r->out.dns_domain_name) {
240 r->out.dns_domain_name = talloc_strdup(mem_ctx,
241 r->in.ads->config.realm);
242 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
243 }
244
245 r->out.domain_is_ad = true;
246
247 return ADS_SUCCESS;
248 }
249
250 /****************************************************************
251 ****************************************************************/
252
253 static ADS_STATUS libnet_join_connect_ads_user(TALLOC_CTX *mem_ctx,
254 struct libnet_JoinCtx *r)
255 {
256 return libnet_join_connect_ads(mem_ctx, r, false);
257 }
258
259 /****************************************************************
260 ****************************************************************/
261
262 static ADS_STATUS libnet_join_connect_ads_machine(TALLOC_CTX *mem_ctx,
263 struct libnet_JoinCtx *r)
264 {
265 return libnet_join_connect_ads(mem_ctx, r, true);
266 }
267
268 /****************************************************************
269 ****************************************************************/
270
271 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
272 struct libnet_UnjoinCtx *r)
273 {
274 ADS_STATUS status;
275
276 status = libnet_connect_ads(r->in.domain_name,
277 r->in.domain_name,
278 r->in.dc_name,
279 r->in.admin_account,
280 r->in.admin_password,
281 NULL,
282 &r->in.ads);
283 if (!ADS_ERR_OK(status)) {
284 libnet_unjoin_set_error_string(mem_ctx, r,
285 "failed to connect to AD: %s",
286 ads_errstr(status));
287 }
288
289 return status;
290 }
291
292 /****************************************************************
293 join a domain using ADS (LDAP mods)
294 ****************************************************************/
295
296 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
297 struct libnet_JoinCtx *r)
298 {
299 ADS_STATUS status;
300 LDAPMessage *res = NULL;
301 const char *attrs[] = { "dn", NULL };
302 bool moved = false;
303
304 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
305 if (!ADS_ERR_OK(status)) {
306 return status;
307 }
308
309 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
310 if (!ADS_ERR_OK(status)) {
311 return status;
312 }
313
314 if (ads_count_replies(r->in.ads, res) != 1) {
315 ads_msgfree(r->in.ads, res);
316 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
317 }
318
319 ads_msgfree(r->in.ads, res);
320
321 /* Attempt to create the machine account and bail if this fails.
322 Assume that the admin wants exactly what they requested */
323
324 status = ads_create_machine_acct(r->in.ads,
325 r->in.machine_name,
326 r->in.account_ou,
327 r->in.desired_encryption_types);
328
329 if (ADS_ERR_OK(status)) {
330 DEBUG(1,("machine account creation created\n"));
331 return status;
332 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
333 (status.err.rc == LDAP_ALREADY_EXISTS)) {
334 status = ADS_SUCCESS;
335 }
336
337 if (!ADS_ERR_OK(status)) {
338 DEBUG(1,("machine account creation failed\n"));
339 return status;
340 }
341
342 status = ads_move_machine_acct(r->in.ads,
343 r->in.machine_name,
344 r->in.account_ou,
345 &moved);
346 if (!ADS_ERR_OK(status)) {
347 DEBUG(1,("failure to locate/move pre-existing "
348 "machine account\n"));
349 return status;
350 }
351
352 DEBUG(1,("The machine account %s the specified OU.\n",
353 moved ? "was moved into" : "already exists in"));
354
355 return status;
356 }
357
358 /****************************************************************
359 ****************************************************************/
360
361 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
362 struct libnet_UnjoinCtx *r)
363 {
364 ADS_STATUS status;
365
366 if (!r->in.ads) {
367 status = libnet_unjoin_connect_ads(mem_ctx, r);
368 if (!ADS_ERR_OK(status)) {
369 libnet_unjoin_set_error_string(mem_ctx, r,
370 "failed to connect to AD: %s",
371 ads_errstr(status));
372 return status;
373 }
374 }
375
376 status = ads_leave_realm(r->in.ads, r->in.machine_name);
377 if (!ADS_ERR_OK(status)) {
378 libnet_unjoin_set_error_string(mem_ctx, r,
379 "failed to leave realm: %s",
380 ads_errstr(status));
381 return status;
382 }
383
384 return ADS_SUCCESS;
385 }
386
387 /****************************************************************
388 ****************************************************************/
389
390 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
391 struct libnet_JoinCtx *r)
392 {
393 ADS_STATUS status;
394 LDAPMessage *res = NULL;
395 char *dn = NULL;
396
397 if (!r->in.machine_name) {
398 return ADS_ERROR(LDAP_NO_MEMORY);
399 }
400
401 status = ads_find_machine_acct(r->in.ads,
402 &res,
403 r->in.machine_name);
404 if (!ADS_ERR_OK(status)) {
405 return status;
406 }
407
408 if (ads_count_replies(r->in.ads, res) != 1) {
409 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
410 goto done;
411 }
412
413 dn = ads_get_dn(r->in.ads, mem_ctx, res);
414 if (!dn) {
415 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
416 goto done;
417 }
418
419 r->out.dn = talloc_strdup(mem_ctx, dn);
420 if (!r->out.dn) {
421 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
422 goto done;
423 }
424
425 if (!ads_pull_uint32(r->in.ads, res, "msDS-SupportedEncryptionTypes",
426 &r->out.set_encryption_types)) {
427 r->out.set_encryption_types = 0;
428 }
429
430 done:
431 ads_msgfree(r->in.ads, res);
432 TALLOC_FREE(dn);
433
434 return status;
435 }
436
437 static ADS_STATUS libnet_join_get_machine_spns(TALLOC_CTX *mem_ctx,
438 struct libnet_JoinCtx *r,
439 char ***spn_array,
440 size_t *num_spns)
441 {
442 ADS_STATUS status;
443
444 if (r->in.machine_name == NULL) {
445 return ADS_ERROR_SYSTEM(EINVAL);
446 }
447
448 status = ads_get_service_principal_names(mem_ctx,
449 r->in.ads,
450 r->in.machine_name,
451 spn_array,
452 num_spns);
453
454 return status;
455 }
456
457 /****************************************************************
458 Set a machines dNSHostName and servicePrincipalName attributes
459 ****************************************************************/
460
461 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
462 struct libnet_JoinCtx *r)
463 {
464 ADS_STATUS status;
465 ADS_MODLIST mods;
466 fstring my_fqdn;
467 const char **spn_array = NULL;
468 size_t num_spns = 0;
469 char *spn = NULL;
470 bool ok;
471 const char **netbios_aliases = NULL;
472
473 /* Find our DN */
474
475 status = libnet_join_find_machine_acct(mem_ctx, r);
476 if (!ADS_ERR_OK(status)) {
477 return status;
478 }
479
480 status = libnet_join_get_machine_spns(mem_ctx,
481 r,
482 discard_const_p(char **, &spn_array),
483 &num_spns);
484 if (!ADS_ERR_OK(status)) {
485 DEBUG(5, ("Retrieving the servicePrincipalNames failed.\n"));
486 }
487
488 /* Windows only creates HOST/shortname & HOST/fqdn. */
489
490 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
491 if (!spn) {
492 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
493 }
494 if (!strupper_m(spn)) {
495 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
496 }
497
498 ok = ads_element_in_array(spn_array, num_spns, spn);
499 if (!ok) {
500 ok = add_string_to_array(spn_array, spn,
501 &spn_array, &num_spns);
502 if (!ok) {
503 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
504 }
505 }
506
507 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
508 || (strchr(my_fqdn, '.') == NULL)) {
509 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
510 r->out.dns_domain_name);
511 }
512
513 if (!strlower_m(my_fqdn)) {
514 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
515 }
516
517 if (!strequal(my_fqdn, r->in.machine_name)) {
518 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
519 if (!spn) {
520 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
521 }
522
523 ok = ads_element_in_array(spn_array, num_spns, spn);
524 if (!ok) {
525 ok = add_string_to_array(spn_array, spn,
526 &spn_array, &num_spns);
527 if (!ok) {
528 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
529 }
530 }
531 }
532
533 netbios_aliases = lp_netbios_aliases();
534 if (netbios_aliases != NULL) {
535 for (; *netbios_aliases != NULL; netbios_aliases++) {
536 /*
537 * Add HOST/NETBIOSNAME
538 */
539 spn = talloc_asprintf(mem_ctx, "HOST/%s", *netbios_aliases);
540 if (spn == NULL) {
541 TALLOC_FREE(spn);
542 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
543 }
544 if (!strupper_m(spn)) {
545 TALLOC_FREE(spn);
546 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
547 }
548
549 ok = ads_element_in_array(spn_array, num_spns, spn);
550 if (ok) {
551 TALLOC_FREE(spn);
552 continue;
553 }
554 ok = add_string_to_array(spn_array, spn,
555 &spn_array, &num_spns);
556 if (!ok) {
557 TALLOC_FREE(spn);
558 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
559 }
560 TALLOC_FREE(spn);
561
562 /*
563 * Add HOST/netbiosname.domainname
564 */
565 if (r->out.dns_domain_name == NULL) {
566 continue;
567 }
568 fstr_sprintf(my_fqdn, "%s.%s",
569 *netbios_aliases,
570 r->out.dns_domain_name);
571
572 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
573 if (spn == NULL) {
574 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
575 }
576
577 ok = ads_element_in_array(spn_array, num_spns, spn);
578 if (ok) {
579 TALLOC_FREE(spn);
580 continue;
581 }
582 ok = add_string_to_array(spn_array, spn,
583 &spn_array, &num_spns);
584 if (!ok) {
585 TALLOC_FREE(spn);
586 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
587 }
588 TALLOC_FREE(spn);
589 }
590 }
591
592 /* make sure to NULL terminate the array */
593 spn_array = talloc_realloc(mem_ctx, spn_array, const char *, num_spns + 1);
594 if (spn_array == NULL) {
595 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
596 }
597 spn_array[num_spns] = NULL;
598
599 mods = ads_init_mods(mem_ctx);
600 if (!mods) {
601 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
602 }
603
604 /* fields of primary importance */
605
606 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
607 if (!ADS_ERR_OK(status)) {
608 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
609 }
610
611 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
612 spn_array);
613 if (!ADS_ERR_OK(status)) {
614 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
615 }
616
617 return ads_gen_mod(r->in.ads, r->out.dn, mods);
618 }
619
620 /****************************************************************
621 ****************************************************************/
622
623 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
624 struct libnet_JoinCtx *r)
625 {
626 ADS_STATUS status;
627 ADS_MODLIST mods;
628
629 if (!r->in.create_upn) {
630 return ADS_SUCCESS;
631 }
632
633 /* Find our DN */
634
635 status = libnet_join_find_machine_acct(mem_ctx, r);
636 if (!ADS_ERR_OK(status)) {
637 return status;
638 }
639
640 if (!r->in.upn) {
641 const char *realm = r->out.dns_domain_name;
642
643 /* in case we are about to generate a keytab during the join
644 * make sure the default upn we create is usable with kinit -k.
645 * gd */
646
647 if (USE_KERBEROS_KEYTAB) {
648 realm = talloc_strdup_upper(mem_ctx,
649 r->out.dns_domain_name);
650 }
651
652 if (!realm) {
653 return ADS_ERROR(LDAP_NO_MEMORY);
654 }
655
656 r->in.upn = talloc_asprintf(mem_ctx,
657 "host/%s@%s",
658 r->in.machine_name,
659 realm);
660 if (!r->in.upn) {
661 return ADS_ERROR(LDAP_NO_MEMORY);
662 }
663 }
664
665 /* now do the mods */
666
667 mods = ads_init_mods(mem_ctx);
668 if (!mods) {
669 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
670 }
671
672 /* fields of primary importance */
673
674 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
675 if (!ADS_ERR_OK(status)) {
676 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
677 }
678
679 return ads_gen_mod(r->in.ads, r->out.dn, mods);
680 }
681
682
683 /****************************************************************
684 ****************************************************************/
685
686 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
687 struct libnet_JoinCtx *r)
688 {
689 ADS_STATUS status;
690 ADS_MODLIST mods;
691 char *os_sp = NULL;
692
693 if (!r->in.os_name || !r->in.os_version ) {
694 return ADS_SUCCESS;
695 }
696
697 /* Find our DN */
698
699 status = libnet_join_find_machine_acct(mem_ctx, r);
700 if (!ADS_ERR_OK(status)) {
701 return status;
702 }
703
704 /* now do the mods */
705
706 mods = ads_init_mods(mem_ctx);
707 if (!mods) {
708 return ADS_ERROR(LDAP_NO_MEMORY);
709 }
710
711 if (r->in.os_servicepack) {
712 /*
713 * if blank string then leave os_sp equal to NULL to force
714 * attribute delete (LDAP_MOD_DELETE)
715 */
716 if (!strequal(r->in.os_servicepack,"")) {
717 os_sp = talloc_strdup(mem_ctx, r->in.os_servicepack);
718 }
719 } else {
720 os_sp = talloc_asprintf(mem_ctx, "Samba %s",
721 samba_version_string());
722 }
723 if (!os_sp && !strequal(r->in.os_servicepack,"")) {
724 return ADS_ERROR(LDAP_NO_MEMORY);
725 }
726
727 /* fields of primary importance */
728
729 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
730 r->in.os_name);
731 if (!ADS_ERR_OK(status)) {
732 return status;
733 }
734
735 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
736 r->in.os_version);
737 if (!ADS_ERR_OK(status)) {
738 return status;
739 }
740
741 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
742 os_sp);
743 if (!ADS_ERR_OK(status)) {
744 return status;
745 }
746
747 return ads_gen_mod(r->in.ads, r->out.dn, mods);
748 }
749
750 /****************************************************************
751 ****************************************************************/
752
753 static ADS_STATUS libnet_join_set_etypes(TALLOC_CTX *mem_ctx,
754 struct libnet_JoinCtx *r)
755 {
756 ADS_STATUS status;
757 ADS_MODLIST mods;
758 const char *etype_list_str;
759
760 etype_list_str = talloc_asprintf(mem_ctx, "%d",
761 r->in.desired_encryption_types);
762 if (!etype_list_str) {
763 return ADS_ERROR(LDAP_NO_MEMORY);
764 }
765
766 /* Find our DN */
767
768 status = libnet_join_find_machine_acct(mem_ctx, r);
769 if (!ADS_ERR_OK(status)) {
770 return status;
771 }
772
773 if (r->in.desired_encryption_types == r->out.set_encryption_types) {
774 return ADS_SUCCESS;
775 }
776
777 /* now do the mods */
778
779 mods = ads_init_mods(mem_ctx);
780 if (!mods) {
781 return ADS_ERROR(LDAP_NO_MEMORY);
782 }
783
784 status = ads_mod_str(mem_ctx, &mods, "msDS-SupportedEncryptionTypes",
785 etype_list_str);
786 if (!ADS_ERR_OK(status)) {
787 return status;
788 }
789
790 status = ads_gen_mod(r->in.ads, r->out.dn, mods);
791 if (!ADS_ERR_OK(status)) {
792 return status;
793 }
794
795 r->out.set_encryption_types = r->in.desired_encryption_types;
796
797 return ADS_SUCCESS;
798 }
799
800 /****************************************************************
801 ****************************************************************/
802
803 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
804 struct libnet_JoinCtx *r)
805 {
806 if (!USE_SYSTEM_KEYTAB) {
807 return true;
808 }
809
810 if (ads_keytab_create_default(r->in.ads) != 0) {
811 return false;
812 }
813
814 return true;
815 }
816
817 /****************************************************************
818 ****************************************************************/
819
820 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
821 struct libnet_JoinCtx *r)
822 {
823 uint32_t domain_func;
824 ADS_STATUS status;
825 const char *salt = NULL;
826 char *std_salt = NULL;
827
828 status = ads_domain_func_level(r->in.ads, &domain_func);
829 if (!ADS_ERR_OK(status)) {
830 libnet_join_set_error_string(mem_ctx, r,
831 "failed to determine domain functional level: %s",
832 ads_errstr(status));
833 return false;
834 }
835
836 /* go ahead and setup the default salt */
837
838 std_salt = kerberos_standard_des_salt();
839 if (!std_salt) {
840 libnet_join_set_error_string(mem_ctx, r,
841 "failed to obtain standard DES salt");
842 return false;
843 }
844
845 salt = talloc_strdup(mem_ctx, std_salt);
846 if (!salt) {
847 return false;
848 }
849
850 SAFE_FREE(std_salt);
851
852 /* if it's a Windows functional domain, we have to look for the UPN */
853
854 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
855 char *upn;
856
857 upn = ads_get_upn(r->in.ads, mem_ctx,
858 r->in.machine_name);
859 if (upn) {
860 salt = talloc_strdup(mem_ctx, upn);
861 if (!salt) {
862 return false;
863 }
864 }
865 }
866
867 r->out.krb5_salt = salt;
868 return true;
869 }
870
871 /****************************************************************
872 ****************************************************************/
873
874 static ADS_STATUS libnet_join_post_processing_ads_modify(TALLOC_CTX *mem_ctx,
875 struct libnet_JoinCtx *r)
876 {
877 ADS_STATUS status;
878 bool need_etype_update = false;
879
880 if (!r->in.ads) {
881 status = libnet_join_connect_ads_user(mem_ctx, r);
882 if (!ADS_ERR_OK(status)) {
883 return status;
884 }
885 }
886
887 status = libnet_join_set_machine_spn(mem_ctx, r);
888 if (!ADS_ERR_OK(status)) {
889 libnet_join_set_error_string(mem_ctx, r,
890 "Failed to set machine spn: %s\n"
891 "Do you have sufficient permissions to create machine "
892 "accounts?",
893 ads_errstr(status));
894 return status;
895 }
896
897 status = libnet_join_set_os_attributes(mem_ctx, r);
898 if (!ADS_ERR_OK(status)) {
899 libnet_join_set_error_string(mem_ctx, r,
900 "failed to set machine os attributes: %s",
901 ads_errstr(status));
902 return status;
903 }
904
905 status = libnet_join_set_machine_upn(mem_ctx, r);
906 if (!ADS_ERR_OK(status)) {
907 libnet_join_set_error_string(mem_ctx, r,
908 "failed to set machine upn: %s",
909 ads_errstr(status));
910 return status;
911 }
912
913 status = libnet_join_find_machine_acct(mem_ctx, r);
914 if (!ADS_ERR_OK(status)) {
915 return status;
916 }
917
918 if (r->in.desired_encryption_types != r->out.set_encryption_types) {
919 uint32_t func_level = 0;
920
921 status = ads_domain_func_level(r->in.ads, &func_level);
922 if (!ADS_ERR_OK(status)) {
923 libnet_join_set_error_string(mem_ctx, r,
924 "failed to query domain controller functional level: %s",
925 ads_errstr(status));
926 return status;
927 }
928
929 if (func_level >= DS_DOMAIN_FUNCTION_2008) {
930 need_etype_update = true;
931 }
932 }
933
934 if (need_etype_update) {
935 /*
936 * We need to reconnect as machine account in order
937 * to update msDS-SupportedEncryptionTypes reliable
938 */
939
940 if (r->in.ads->auth.ccache_name != NULL) {
941 ads_kdestroy(r->in.ads->auth.ccache_name);
942 }
943
944 ads_destroy(&r->in.ads);
945
946 status = libnet_join_connect_ads_machine(mem_ctx, r);
947 if (!ADS_ERR_OK(status)) {
948 libnet_join_set_error_string(mem_ctx, r,
949 "Failed to connect as machine account: %s",
950 ads_errstr(status));
951 return status;
952 }
953
954 status = libnet_join_set_etypes(mem_ctx, r);
955 if (!ADS_ERR_OK(status)) {
956 libnet_join_set_error_string(mem_ctx, r,
957 "failed to set machine kerberos encryption types: %s",
958 ads_errstr(status));
959 return status;
960 }
961 }
962
963 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
964 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
965 }
966
967 return ADS_SUCCESS;
968 }
969
970 static ADS_STATUS libnet_join_post_processing_ads_sync(TALLOC_CTX *mem_ctx,
971 struct libnet_JoinCtx *r)
972 {
973 if (!libnet_join_create_keytab(mem_ctx, r)) {
974 libnet_join_set_error_string(mem_ctx, r,
975 "failed to create kerberos keytab");
976 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
977 }
978
979 return ADS_SUCCESS;
980 }
981 #endif /* HAVE_ADS */
982
983 /****************************************************************
984 Store the machine password and domain SID
985 ****************************************************************/
986
987 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
988 struct libnet_JoinCtx *r)
989 {
990 NTSTATUS status;
991
992 status = secrets_store_JoinCtx(r);
993 if (!NT_STATUS_IS_OK(status)) {
994 DBG_ERR("secrets_store_JoinCtx() failed %s\n",
995 nt_errstr(status));
996 return false;
997 }
998
999 return true;
1000 }
1001
1002 /****************************************************************
1003 Connect dc's IPC$ share
1004 ****************************************************************/
1005
1006 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
1007 const char *user,
1008 const char *domain,
1009 const char *pass,
1010 bool use_kerberos,
1011 struct cli_state **cli)
1012 {
1013 int flags = 0;
1014
1015 if (use_kerberos) {
1016 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1017 }
1018
1019 if (use_kerberos && pass) {
1020 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
1021 }
1022
1023 return cli_full_connection(cli, NULL,
1024 dc,
1025 NULL, 0,
1026 "IPC$", "IPC",
1027 user,
1028 domain,
1029 pass,
1030 flags,
1031 SMB_SIGNING_IPC_DEFAULT);
1032 }
1033
1034 /****************************************************************
1035 Lookup domain dc's info
1036 ****************************************************************/
1037
1038 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
1039 struct libnet_JoinCtx *r,
1040 struct cli_state **cli)
1041 {
1042 struct rpc_pipe_client *pipe_hnd = NULL;
1043 struct policy_handle lsa_pol;
1044 NTSTATUS status, result;
1045 union lsa_PolicyInformation *info = NULL;
1046 struct dcerpc_binding_handle *b;
1047 const char *account = r->in.admin_account;
1048 const char *domain = r->in.admin_domain;
1049 const char *password = r->in.admin_password;
1050 bool use_kerberos = r->in.use_kerberos;
1051
1052 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) {
1053 account = "";
1054 domain = "";
1055 password = NULL;
1056 use_kerberos = false;
1057 }
1058
1059 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1060 account,
1061 domain,
1062 password,
1063 use_kerberos,
1064 cli);
1065 if (!NT_STATUS_IS_OK(status)) {
1066 goto done;
1067 }
1068
1069 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc,
1070 &pipe_hnd);
1071 if (!NT_STATUS_IS_OK(status)) {
1072 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
1073 nt_errstr(status)));
1074 goto done;
1075 }
1076
1077 b = pipe_hnd->binding_handle;
1078
1079 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
1080 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1081 if (!NT_STATUS_IS_OK(status)) {
1082 goto done;
1083 }
1084
1085 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
1086 &lsa_pol,
1087 LSA_POLICY_INFO_DNS,
1088 &info,
1089 &result);
1090 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
1091 r->out.domain_is_ad = true;
1092 r->out.netbios_domain_name = info->dns.name.string;
1093 r->out.dns_domain_name = info->dns.dns_domain.string;
1094 r->out.forest_name = info->dns.dns_forest.string;
1095 r->out.domain_guid = info->dns.domain_guid;
1096 r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
1097 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
1098 }
1099
1100 if (!NT_STATUS_IS_OK(status)) {
1101 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
1102 &lsa_pol,
1103 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1104 &info,
1105 &result);
1106 if (!NT_STATUS_IS_OK(status)) {
1107 goto done;
1108 }
1109 if (!NT_STATUS_IS_OK(result)) {
1110 status = result;
1111 goto done;
1112 }
1113
1114 r->out.netbios_domain_name = info->account_domain.name.string;
1115 r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
1116 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
1117 }
1118
1119 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
1120 TALLOC_FREE(pipe_hnd);
1121
1122 done:
1123 return status;
1124 }
1125
1126 /****************************************************************
1127 Do the domain join unsecure
1128 ****************************************************************/
1129
1130 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
1131 struct libnet_JoinCtx *r,
1132 struct cli_state *cli)
1133 {
1134 TALLOC_CTX *frame = talloc_stackframe();
1135 struct rpc_pipe_client *authenticate_pipe = NULL;
1136 struct rpc_pipe_client *passwordset_pipe = NULL;
1137 struct netlogon_creds_cli_context *netlogon_creds = NULL;
1138 struct cli_credentials *cli_creds = NULL;
1139 struct netlogon_creds_CredentialState *creds = NULL;
1140 uint32_t netlogon_flags = 0;
1141 size_t len = 0;
1142 bool ok;
1143 DATA_BLOB new_trust_blob = data_blob_null;
1144 NTSTATUS status;
1145
1146 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon,
1147 &authenticate_pipe);
1148 if (!NT_STATUS_IS_OK(status)) {
1149 TALLOC_FREE(frame);
1150 return status;
1151 }
1152
1153 if (!r->in.machine_password) {
1154 int security = r->in.ads ? SEC_ADS : SEC_DOMAIN;
1155
1156 r->in.machine_password = trust_pw_new_value(mem_ctx,
1157 r->in.secure_channel_type,
1158 security);
1159 if (r->in.machine_password == NULL) {
1160 TALLOC_FREE(frame);
1161 return NT_STATUS_NO_MEMORY;
1162 }
1163 }
1164
1165 cli_creds = cli_credentials_init(talloc_tos());
1166 if (cli_creds == NULL) {
1167 TALLOC_FREE(frame);
1168 return NT_STATUS_NO_MEMORY;
1169 }
1170
1171 cli_credentials_set_username(cli_creds, r->out.account_name,
1172 CRED_SPECIFIED);
1173 cli_credentials_set_domain(cli_creds, r->in.domain_name,
1174 CRED_SPECIFIED);
1175 cli_credentials_set_realm(cli_creds, "", CRED_SPECIFIED);
1176 cli_credentials_set_secure_channel_type(cli_creds,
1177 r->in.secure_channel_type);
1178
1179 /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
1180 cli_credentials_set_password(cli_creds, r->in.admin_password,
1181 CRED_SPECIFIED);
1182
1183 status = rpccli_create_netlogon_creds_with_creds(cli_creds,
1184 authenticate_pipe->desthost,
1185 r->in.msg_ctx,
1186 frame,
1187 &netlogon_creds);
1188 if (!NT_STATUS_IS_OK(status)) {
1189 TALLOC_FREE(frame);
1190 return status;
1191 }
1192
1193 status = rpccli_setup_netlogon_creds_with_creds(cli, NCACN_NP,
1194 netlogon_creds,
1195 true, /* force_reauth */
1196 cli_creds);
1197 if (!NT_STATUS_IS_OK(status)) {
1198 TALLOC_FREE(frame);
1199 return status;
1200 }
1201
1202 status = netlogon_creds_cli_get(netlogon_creds, frame, &creds);
1203 if (!NT_STATUS_IS_OK(status)) {
1204 TALLOC_FREE(frame);
1205 return status;
1206 }
1207
1208 netlogon_flags = creds->negotiate_flags;
1209 TALLOC_FREE(creds);
1210
1211 if (netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC) {
1212 status = cli_rpc_pipe_open_schannel_with_creds(cli,
1213 &ndr_table_netlogon,
1214 NCACN_NP,
1215 cli_creds,
1216 netlogon_creds,
1217 &passwordset_pipe);
1218 if (!NT_STATUS_IS_OK(status)) {
1219 TALLOC_FREE(frame);
1220 return status;
1221 }
1222 } else {
1223 passwordset_pipe = authenticate_pipe;
1224 }
1225
1226 len = strlen(r->in.machine_password);
1227 ok = convert_string_talloc(frame, CH_UNIX, CH_UTF16,
1228 r->in.machine_password, len,
1229 (void **)&new_trust_blob.data,
1230 &new_trust_blob.length);
1231 if (!ok) {
1232 status = NT_STATUS_UNMAPPABLE_CHARACTER;
1233 if (errno == ENOMEM) {
1234 status = NT_STATUS_NO_MEMORY;
1235 }
1236 TALLOC_FREE(frame);
1237 return status;
1238 }
1239
1240 status = netlogon_creds_cli_ServerPasswordSet(netlogon_creds,
1241 passwordset_pipe->binding_handle,
1242 &new_trust_blob,
1243 NULL); /* new_version */
1244 if (!NT_STATUS_IS_OK(status)) {
1245 TALLOC_FREE(frame);
1246 return status;
1247 }
1248
1249 TALLOC_FREE(frame);
1250 return NT_STATUS_OK;
1251 }
1252
1253 /****************************************************************
1254 Do the domain join
1255 ****************************************************************/
1256
1257 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
1258 struct libnet_JoinCtx *r,
1259 struct cli_state *cli)
1260 {
1261 struct rpc_pipe_client *pipe_hnd = NULL;
1262 struct policy_handle sam_pol, domain_pol, user_pol;
1263 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1264 char *acct_name;
1265 struct lsa_String lsa_acct_name;
1266 uint32_t user_rid;
1267 uint32_t acct_flags = ACB_WSTRUST;
1268 struct samr_Ids user_rids;
1269 struct samr_Ids name_types;
1270 union samr_UserInfo user_info;
1271 struct dcerpc_binding_handle *b = NULL;
1272 unsigned int old_timeout = 0;
1273
1274 DATA_BLOB session_key = data_blob_null;
1275 struct samr_CryptPassword crypt_pwd;
1276 struct samr_CryptPasswordEx crypt_pwd_ex;
1277
1278 ZERO_STRUCT(sam_pol);
1279 ZERO_STRUCT(domain_pol);
1280 ZERO_STRUCT(user_pol);
1281
1282 switch (r->in.secure_channel_type) {
1283 case SEC_CHAN_WKSTA:
1284 acct_flags = ACB_WSTRUST;
1285 break;
1286 case SEC_CHAN_BDC:
1287 acct_flags = ACB_SVRTRUST;
1288 break;
1289 default:
1290 return NT_STATUS_INVALID_PARAMETER;
1291 }
1292
1293 if (!r->in.machine_password) {
1294 int security = r->in.ads ? SEC_ADS : SEC_DOMAIN;
1295
1296 r->in.machine_password = trust_pw_new_value(mem_ctx,
1297 r->in.secure_channel_type,
1298 security);
1299 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
1300 }
1301
1302 /* Open the domain */
1303
1304 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
1305 &pipe_hnd);
1306 if (!NT_STATUS_IS_OK(status)) {
1307 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1308 nt_errstr(status)));
1309 goto done;
1310 }
1311
1312 b = pipe_hnd->binding_handle;
1313
1314 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
1315 if (!NT_STATUS_IS_OK(status)) {
1316 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
1317 nt_errstr(status)));
1318 goto done;
1319 }
1320
1321 status = dcerpc_samr_Connect2(b, mem_ctx,
1322 pipe_hnd->desthost,
1323 SAMR_ACCESS_ENUM_DOMAINS
1324 | SAMR_ACCESS_LOOKUP_DOMAIN,
1325 &sam_pol,
1326 &result);
1327 if (!NT_STATUS_IS_OK(status)) {
1328 goto done;
1329 }
1330 if (!NT_STATUS_IS_OK(result)) {
1331 status = result;
1332 goto done;
1333 }
1334
1335 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1336 &sam_pol,
1337 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
1338 | SAMR_DOMAIN_ACCESS_CREATE_USER
1339 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
1340 r->out.domain_sid,
1341 &domain_pol,
1342 &result);
1343 if (!NT_STATUS_IS_OK(status)) {
1344 goto done;
1345 }
1346 if (!NT_STATUS_IS_OK(result)) {
1347 status = result;
1348 goto done;
1349 }
1350
1351 /* Create domain user */
1352
1353 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1354 if (!strlower_m(acct_name)) {
1355 status = NT_STATUS_INVALID_PARAMETER;
1356 goto done;
1357 }
1358
1359 init_lsa_String(&lsa_acct_name, acct_name);
1360
1361 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
1362 uint32_t access_desired =
1363 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
1364 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
1365 SAMR_USER_ACCESS_SET_PASSWORD |
1366 SAMR_USER_ACCESS_GET_ATTRIBUTES |
1367 SAMR_USER_ACCESS_SET_ATTRIBUTES;
1368 uint32_t access_granted = 0;
1369
1370 DEBUG(10,("Creating account with desired access mask: %d\n",
1371 access_desired));
1372
1373 status = dcerpc_samr_CreateUser2(b, mem_ctx,
1374 &domain_pol,
1375 &lsa_acct_name,
1376 acct_flags,
1377 access_desired,
1378 &user_pol,
1379 &access_granted,
1380 &user_rid,
1381 &result);
1382 if (!NT_STATUS_IS_OK(status)) {
1383 goto done;
1384 }
1385
1386 status = result;
1387 if (!NT_STATUS_IS_OK(status) &&
1388 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1389
1390 DEBUG(10,("Creation of workstation account failed: %s\n",
1391 nt_errstr(status)));
1392
1393 /* If NT_STATUS_ACCESS_DENIED then we have a valid
1394 username/password combo but the user does not have
1395 administrator access. */
1396
1397 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1398 libnet_join_set_error_string(mem_ctx, r,
1399 "User specified does not have "
1400 "administrator privileges");
1401 }
1402
1403 goto done;
1404 }
1405
1406 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1407 if (!(r->in.join_flags &
1408 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
1409 goto done;
1410 }
1411 }
1412
1413 /* We *must* do this.... don't ask... */
1414
1415 if (NT_STATUS_IS_OK(status)) {
1416 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1417 }
1418 }
1419
1420 status = dcerpc_samr_LookupNames(b, mem_ctx,
1421 &domain_pol,
1422 1,
1423 &lsa_acct_name,
1424 &user_rids,
1425 &name_types,
1426 &result);
1427 if (!NT_STATUS_IS_OK(status)) {
1428 goto done;
1429 }
1430 if (!NT_STATUS_IS_OK(result)) {
1431 status = result;
1432 goto done;
1433 }
1434 if (user_rids.count != 1) {
1435 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1436 goto done;
1437 }
1438 if (name_types.count != 1) {
1439 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1440 goto done;
1441 }
1442
1443 if (name_types.ids[0] != SID_NAME_USER) {
1444 DEBUG(0,("%s is not a user account (type=%d)\n",
1445 acct_name, name_types.ids[0]));
1446 status = NT_STATUS_INVALID_WORKSTATION;
1447 goto done;
1448 }
1449
1450 user_rid = user_rids.ids[0];
1451
1452 /* Open handle on user */
1453
1454 status = dcerpc_samr_OpenUser(b, mem_ctx,
1455 &domain_pol,
1456 SEC_FLAG_MAXIMUM_ALLOWED,
1457 user_rid,
1458 &user_pol,
1459 &result);
1460 if (!NT_STATUS_IS_OK(status)) {
1461 goto done;
1462 }
1463 if (!NT_STATUS_IS_OK(result)) {
1464 status = result;
1465 goto done;
1466 }
1467
1468 /* Fill in the additional account flags now */
1469
1470 acct_flags |= ACB_PWNOEXP;
1471
1472 /* Set account flags on machine account */
1473 ZERO_STRUCT(user_info.info16);
1474 user_info.info16.acct_flags = acct_flags;
1475
1476 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1477 &user_pol,
1478 UserControlInformation,
1479 &user_info,
1480 &result);
1481 if (!NT_STATUS_IS_OK(status)) {
1482 dcerpc_samr_DeleteUser(b, mem_ctx,
1483 &user_pol,
1484 &result);
1485
1486 libnet_join_set_error_string(mem_ctx, r,
1487 "Failed to set account flags for machine account (%s)\n",
1488 nt_errstr(status));
1489 goto done;
1490 }
1491
1492 if (!NT_STATUS_IS_OK(result)) {
1493 status = result;
1494
1495 dcerpc_samr_DeleteUser(b, mem_ctx,
1496 &user_pol,
1497 &result);
1498
1499 libnet_join_set_error_string(mem_ctx, r,
1500 "Failed to set account flags for machine account (%s)\n",
1501 nt_errstr(status));
1502 goto done;
1503 }
1504
1505 /* Set password on machine account - first try level 26 */
1506
1507 /*
1508 * increase the timeout as password filter modules on the DC
1509 * might delay the operation for a significant amount of time
1510 */
1511 old_timeout = rpccli_set_timeout(pipe_hnd, 600000);
1512
1513 init_samr_CryptPasswordEx(r->in.machine_password,
1514 &session_key,
1515 &crypt_pwd_ex);
1516
1517 user_info.info26.password = crypt_pwd_ex;
1518 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1519
1520 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1521 &user_pol,
1522 UserInternal5InformationNew,
1523 &user_info,
1524 &result);
1525
1526 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1527
1528 /* retry with level 24 */
1529
1530 init_samr_CryptPassword(r->in.machine_password,
1531 &session_key,
1532 &crypt_pwd);
1533
1534 user_info.info24.password = crypt_pwd;
1535 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1536
1537 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1538 &user_pol,
1539 UserInternal5Information,
1540 &user_info,
1541 &result);
1542 }
1543
1544 old_timeout = rpccli_set_timeout(pipe_hnd, old_timeout);
1545
1546 if (!NT_STATUS_IS_OK(status)) {
1547
1548 dcerpc_samr_DeleteUser(b, mem_ctx,
1549 &user_pol,
1550 &result);
1551
1552 libnet_join_set_error_string(mem_ctx, r,
1553 "Failed to set password for machine account (%s)\n",
1554 nt_errstr(status));
1555 goto done;
1556 }
1557 if (!NT_STATUS_IS_OK(result)) {
1558 status = result;
1559
1560 dcerpc_samr_DeleteUser(b, mem_ctx,
1561 &user_pol,
1562 &result);
1563
1564 libnet_join_set_error_string(mem_ctx, r,
1565 "Failed to set password for machine account (%s)\n",
1566 nt_errstr(status));
1567 goto done;
1568 }
1569
1570 status = NT_STATUS_OK;
1571
1572 done:
1573 if (!pipe_hnd) {
1574 return status;
1575 }
1576
1577 data_blob_clear_free(&session_key);
1578
1579 if (is_valid_policy_hnd(&sam_pol)) {
1580 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1581 }
1582 if (is_valid_policy_hnd(&domain_pol)) {
1583 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1584 }
1585 if (is_valid_policy_hnd(&user_pol)) {
1586 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1587 }
1588 TALLOC_FREE(pipe_hnd);
1589
1590 return status;
1591 }
1592
1593 /****************************************************************
1594 ****************************************************************/
1595
1596 NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
1597 const char *netbios_domain_name,
1598 const char *dc_name,
1599 const bool use_kerberos)
1600 {
1601 TALLOC_CTX *frame = talloc_stackframe();
1602 struct cli_state *cli = NULL;
1603 struct rpc_pipe_client *netlogon_pipe = NULL;
1604 struct cli_credentials *cli_creds = NULL;
1605 struct netlogon_creds_cli_context *netlogon_creds = NULL;
1606 struct netlogon_creds_CredentialState *creds = NULL;
1607 uint32_t netlogon_flags = 0;
1608 NTSTATUS status;
1609 int flags = 0;
1610
1611 if (!dc_name) {
1612 TALLOC_FREE(frame);
1613 return NT_STATUS_INVALID_PARAMETER;
1614 }
1615
1616 if (!secrets_init()) {
1617 TALLOC_FREE(frame);
1618 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1619 }
1620
1621 status = pdb_get_trust_credentials(netbios_domain_name, NULL,
1622 frame, &cli_creds);
1623 if (!NT_STATUS_IS_OK(status)) {
1624 TALLOC_FREE(frame);
1625 return status;
1626 }
1627
1628 /* we don't want any old password */
1629 cli_credentials_set_old_password(cli_creds, NULL, CRED_SPECIFIED);
1630
1631 if (use_kerberos) {
1632 cli_credentials_set_kerberos_state(cli_creds,
1633 CRED_MUST_USE_KERBEROS);
1634 }
1635
1636 status = cli_full_connection_creds(&cli, NULL,
1637 dc_name,
1638 NULL, 0,
1639 "IPC$", "IPC",
1640 cli_creds,
1641 flags,
1642 SMB_SIGNING_IPC_DEFAULT);
1643
1644 if (!NT_STATUS_IS_OK(status)) {
1645 status = cli_full_connection(&cli, NULL,
1646 dc_name,
1647 NULL, 0,
1648 "IPC$", "IPC",
1649 "",
1650 NULL,
1651 "",
1652 0,
1653 SMB_SIGNING_IPC_DEFAULT);
1654 }
1655
1656 if (!NT_STATUS_IS_OK(status)) {
1657 TALLOC_FREE(frame);
1658 return status;
1659 }
1660
1661 status = rpccli_create_netlogon_creds_with_creds(cli_creds,
1662 dc_name,
1663 msg_ctx,
1664 frame,
1665 &netlogon_creds);
1666 if (!NT_STATUS_IS_OK(status)) {
1667 cli_shutdown(cli);
1668 TALLOC_FREE(frame);
1669 return status;
1670 }
1671
1672 status = rpccli_setup_netlogon_creds_with_creds(cli, NCACN_NP,
1673 netlogon_creds,
1674 true, /* force_reauth */
1675 cli_creds);
1676 if (!NT_STATUS_IS_OK(status)) {
1677 DEBUG(0,("connect_to_domain_password_server: "
1678 "unable to open the domain client session to "
1679 "machine %s. Flags[0x%08X] Error was : %s.\n",
1680 dc_name, (unsigned)netlogon_flags,
1681 nt_errstr(status)));
1682 cli_shutdown(cli);
1683 TALLOC_FREE(frame);
1684 return status;
1685 }
1686
1687 status = netlogon_creds_cli_get(netlogon_creds,
1688 talloc_tos(),
1689 &creds);
1690 if (!NT_STATUS_IS_OK(status)) {
1691 cli_shutdown(cli);
1692 TALLOC_FREE(frame);
1693 return status;
1694 }
1695 netlogon_flags = creds->negotiate_flags;
1696 TALLOC_FREE(creds);
1697
1698 if (!(netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
1699 cli_shutdown(cli);
1700 TALLOC_FREE(frame);
1701 return NT_STATUS_OK;
1702 }
1703
1704 status = cli_rpc_pipe_open_schannel_with_creds(
1705 cli, &ndr_table_netlogon, NCACN_NP,
1706 cli_creds,
1707 netlogon_creds, &netlogon_pipe);
1708
1709 TALLOC_FREE(netlogon_pipe);
1710
1711 if (!NT_STATUS_IS_OK(status)) {
1712 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1713 "on netlogon pipe to server %s for domain %s. "
1714 "Error was %s\n",
1715 smbXcli_conn_remote_name(cli->conn),
1716 netbios_domain_name, nt_errstr(status)));
1717 cli_shutdown(cli);
1718 TALLOC_FREE(frame);
1719 return status;
1720 }
1721
1722 cli_shutdown(cli);
1723 TALLOC_FREE(frame);
1724 return NT_STATUS_OK;
1725 }
1726
1727 /****************************************************************
1728 ****************************************************************/
1729
1730 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1731 struct libnet_JoinCtx *r)
1732 {
1733 NTSTATUS status;
1734
1735 status = libnet_join_ok(r->in.msg_ctx,
1736 r->out.netbios_domain_name,
1737 r->in.dc_name,
1738 r->in.use_kerberos);
1739 if (!NT_STATUS_IS_OK(status)) {
1740 libnet_join_set_error_string(mem_ctx, r,
1741 "failed to verify domain membership after joining: %s",
1742 get_friendly_nt_error_msg(status));
1743 return WERR_NERR_SETUPNOTJOINED;
1744 }
1745
1746 return WERR_OK;
1747 }
1748
1749 /****************************************************************
1750 ****************************************************************/
1751
1752 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1753 struct libnet_UnjoinCtx *r)
1754 {
1755 /*
1756 * TODO: use values from 'struct libnet_UnjoinCtx' ?
1757 */
1758 return secrets_delete_machine_password_ex(lp_workgroup(), lp_realm());
1759 }
1760
1761 /****************************************************************
1762 ****************************************************************/
1763
1764 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1765 struct libnet_UnjoinCtx *r)
1766 {
1767 struct cli_state *cli = NULL;
1768 struct rpc_pipe_client *pipe_hnd = NULL;
1769 struct policy_handle sam_pol, domain_pol, user_pol;
1770 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1771 char *acct_name;
1772 uint32_t user_rid;
1773 struct lsa_String lsa_acct_name;
1774 struct samr_Ids user_rids;
1775 struct samr_Ids name_types;
1776 union samr_UserInfo *info = NULL;
1777 struct dcerpc_binding_handle *b = NULL;
1778
1779 ZERO_STRUCT(sam_pol);
1780 ZERO_STRUCT(domain_pol);
1781 ZERO_STRUCT(user_pol);
1782
1783 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1784 r->in.admin_account,
1785 r->in.admin_domain,
1786 r->in.admin_password,
1787 r->in.use_kerberos,
1788 &cli);
1789 if (!NT_STATUS_IS_OK(status)) {
1790 goto done;
1791 }
1792
1793 /* Open the domain */
1794
1795 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
1796 &pipe_hnd);
1797 if (!NT_STATUS_IS_OK(status)) {
1798 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1799 nt_errstr(status)));
1800 goto done;
1801 }
1802
1803 b = pipe_hnd->binding_handle;
1804
1805 status = dcerpc_samr_Connect2(b, mem_ctx,
1806 pipe_hnd->desthost,
1807 SEC_FLAG_MAXIMUM_ALLOWED,
1808 &sam_pol,
1809 &result);
1810 if (!NT_STATUS_IS_OK(status)) {
1811 goto done;
1812 }
1813 if (!NT_STATUS_IS_OK(result)) {
1814 status = result;
1815 goto done;
1816 }
1817
1818 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1819 &sam_pol,
1820 SEC_FLAG_MAXIMUM_ALLOWED,
1821 r->in.domain_sid,
1822 &domain_pol,
1823 &result);
1824 if (!NT_STATUS_IS_OK(status)) {
1825 goto done;
1826 }
1827 if (!NT_STATUS_IS_OK(result)) {
1828 status = result;
1829 goto done;
1830 }
1831
1832 /* Create domain user */
1833
1834 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1835 if (!strlower_m(acct_name)) {
1836 status = NT_STATUS_INVALID_PARAMETER;
1837 goto done;
1838 }
1839
1840 init_lsa_String(&lsa_acct_name, acct_name);
1841
1842 status = dcerpc_samr_LookupNames(b, mem_ctx,
1843 &domain_pol,
1844 1,
1845 &lsa_acct_name,
1846 &user_rids,
1847 &name_types,
1848 &result);
1849
1850 if (!NT_STATUS_IS_OK(status)) {
1851 goto done;
1852 }
1853 if (!NT_STATUS_IS_OK(result)) {
1854 status = result;
1855 goto done;
1856 }
1857 if (user_rids.count != 1) {
1858 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1859 goto done;
1860 }
1861 if (name_types.count != 1) {
1862 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1863 goto done;
1864 }
1865
1866 if (name_types.ids[0] != SID_NAME_USER) {
1867 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1868 name_types.ids[0]));
1869 status = NT_STATUS_INVALID_WORKSTATION;
1870 goto done;
1871 }
1872
1873 user_rid = user_rids.ids[0];
1874
1875 /* Open handle on user */
1876
1877 status = dcerpc_samr_OpenUser(b, mem_ctx,
1878 &domain_pol,
1879 SEC_FLAG_MAXIMUM_ALLOWED,
1880 user_rid,
1881 &user_pol,
1882 &result);
1883 if (!NT_STATUS_IS_OK(status)) {
1884 goto done;
1885 }
1886 if (!NT_STATUS_IS_OK(result)) {
1887 status = result;
1888 goto done;
1889 }
1890
1891 /* Get user info */
1892
1893 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1894 &user_pol,
1895 16,
1896 &info,
1897 &result);
1898 if (!NT_STATUS_IS_OK(status)) {
1899 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1900 goto done;
1901 }
1902 if (!NT_STATUS_IS_OK(result)) {
1903 status = result;
1904 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1905 goto done;
1906 }
1907
1908 /* now disable and setuser info */
1909
1910 info->info16.acct_flags |= ACB_DISABLED;
1911
1912 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1913 &user_pol,
1914 16,
1915 info,
1916 &result);
1917 if (!NT_STATUS_IS_OK(status)) {
1918 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1919 goto done;
1920 }
1921 if (!NT_STATUS_IS_OK(result)) {
1922 status = result;
1923 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1924 goto done;
1925 }
1926 status = result;
1927 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1928
1929 done:
1930 if (pipe_hnd && b) {
1931 if (is_valid_policy_hnd(&domain_pol)) {
1932 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1933 }
1934 if (is_valid_policy_hnd(&sam_pol)) {
1935 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1936 }
1937 TALLOC_FREE(pipe_hnd);
1938 }
1939
1940 if (cli) {
1941 cli_shutdown(cli);
1942 }
1943
1944 return status;
1945 }
1946
1947 /****************************************************************
1948 ****************************************************************/
1949
1950 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1951 {
1952 WERROR werr = WERR_OK;
1953 sbcErr err;
1954 struct smbconf_ctx *ctx;
1955
1956 err = smbconf_init_reg(r, &ctx, NULL);
1957 if (!SBC_ERROR_IS_OK(err)) {
1958 werr = WERR_SERVICE_DOES_NOT_EXIST;
1959 goto done;
1960 }
1961
1962 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1963
1964 err = smbconf_set_global_parameter(ctx, "security", "user");
1965 if (!SBC_ERROR_IS_OK(err)) {
1966 werr = WERR_SERVICE_DOES_NOT_EXIST;
1967 goto done;
1968 }
1969
1970 err = smbconf_set_global_parameter(ctx, "workgroup",
1971 r->in.domain_name);
1972 if (!SBC_ERROR_IS_OK(err)) {
1973 werr = WERR_SERVICE_DOES_NOT_EXIST;
1974 goto done;
1975 }
1976
1977 smbconf_delete_global_parameter(ctx, "realm");
1978 goto done;
1979 }
1980
1981 err = smbconf_set_global_parameter(ctx, "security", "domain");
1982 if (!SBC_ERROR_IS_OK(err)) {
1983 werr = WERR_SERVICE_DOES_NOT_EXIST;
1984 goto done;
1985 }
1986
1987 err = smbconf_set_global_parameter(ctx, "workgroup",
1988 r->out.netbios_domain_name);
1989 if (!SBC_ERROR_IS_OK(err)) {
1990 werr = WERR_SERVICE_DOES_NOT_EXIST;
1991 goto done;
1992 }
1993
1994 if (r->out.domain_is_ad) {
1995 err = smbconf_set_global_parameter(ctx, "security", "ads");
1996 if (!SBC_ERROR_IS_OK(err)) {
1997 werr = WERR_SERVICE_DOES_NOT_EXIST;
1998 goto done;
1999 }
2000
2001 err = smbconf_set_global_parameter(ctx, "realm",
2002 r->out.dns_domain_name);
2003 if (!SBC_ERROR_IS_OK(err)) {
2004 werr = WERR_SERVICE_DOES_NOT_EXIST;
2005 goto done;
2006 }
2007 }
2008
2009 done:
2010 smbconf_shutdown(ctx);
2011 return werr;
2012 }
2013
2014 /****************************************************************
2015 ****************************************************************/
2016
2017 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
2018 {
2019 WERROR werr = WERR_OK;
2020 sbcErr err;
2021 struct smbconf_ctx *ctx;
2022
2023 err = smbconf_init_reg(r, &ctx, NULL);
2024 if (!SBC_ERROR_IS_OK(err)) {
2025 werr = WERR_SERVICE_DOES_NOT_EXIST;
2026 goto done;
2027 }
2028
2029 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2030
2031 err = smbconf_set_global_parameter(ctx, "security", "user");
2032 if (!SBC_ERROR_IS_OK(err)) {
2033 werr = WERR_SERVICE_DOES_NOT_EXIST;
2034 goto done;
2035 }
2036
2037 err = smbconf_delete_global_parameter(ctx, "workgroup");
2038 if (!SBC_ERROR_IS_OK(err)) {
2039 werr = WERR_SERVICE_DOES_NOT_EXIST;
2040 goto done;
2041 }
2042
2043 smbconf_delete_global_parameter(ctx, "realm");
2044 }
2045
2046 done:
2047 smbconf_shutdown(ctx);
2048 return werr;
2049 }
2050
2051 /****************************************************************
2052 ****************************************************************/
2053
2054 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
2055 {
2056 WERROR werr;
2057
2058 if (!W_ERROR_IS_OK(r->out.result)) {
2059 return r->out.result;
2060 }
2061
2062 if (!r->in.modify_config) {
2063 return WERR_OK;
2064 }
2065
2066 werr = do_join_modify_vals_config(r);
2067 if (!W_ERROR_IS_OK(werr)) {
2068 return werr;
2069 }
2070
2071 lp_load_global(get_dyn_CONFIGFILE());
2072
2073 r->out.modified_config = true;
2074 r->out.result = werr;
2075
2076 return werr;
2077 }
2078
2079 /****************************************************************
2080 ****************************************************************/
2081
2082 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
2083 {
2084 WERROR werr;
2085
2086 if (!W_ERROR_IS_OK(r->out.result)) {
2087 return r->out.result;
2088 }
2089
2090 if (!r->in.modify_config) {
2091 return WERR_OK;
2092 }
2093
2094 werr = do_unjoin_modify_vals_config(r);
2095 if (!W_ERROR_IS_OK(werr)) {
2096 return werr;
2097 }
2098
2099 lp_load_global(get_dyn_CONFIGFILE());
2100
2101 r->out.modified_config = true;
2102 r->out.result = werr;
2103
2104 return werr;
2105 }
2106
2107 /****************************************************************
2108 ****************************************************************/
2109
2110 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
2111 const char *domain_str,
2112 const char **domain_p,
2113 const char **dc_p)
2114 {
2115 char *domain = NULL;
2116 char *dc = NULL;
2117 const char *p = NULL;
2118
2119 if (!domain_str || !domain_p || !dc_p) {
2120 return false;
2121 }
2122
2123 p = strchr_m(domain_str, '\\');
2124
2125 if (p != NULL) {
2126 domain = talloc_strndup(mem_ctx, domain_str,
2127 PTR_DIFF(p, domain_str));
2128 dc = talloc_strdup(mem_ctx, p+1);
2129 if (!dc) {
2130 return false;
2131 }
2132 } else {
2133 domain = talloc_strdup(mem_ctx, domain_str);
2134 dc = NULL;
2135 }
2136 if (!domain) {
2137 return false;
2138 }
2139
2140 *domain_p = domain;
2141
2142 if (!*dc_p && dc) {
2143 *dc_p = dc;
2144 }
2145
2146 return true;
2147 }
2148
2149 /****************************************************************
2150 ****************************************************************/
2151
2152 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
2153 struct libnet_JoinCtx *r)
2154 {
2155 if (!r->in.domain_name) {
2156 libnet_join_set_error_string(mem_ctx, r,
2157 "No domain name defined");
2158 return WERR_INVALID_PARAMETER;
2159 }
2160
2161 if (strlen(r->in.machine_name) > 15) {
2162 libnet_join_set_error_string(mem_ctx, r,
2163 "Our netbios name can be at most 15 chars long, "
2164 "\"%s\" is %u chars long\n",
2165 r->in.machine_name,
2166 (unsigned int)strlen(r->in.machine_name));
2167 return WERR_INVALID_PARAMETER;
2168 }
2169
2170 r->out.account_name = talloc_asprintf(mem_ctx, "%s$",
2171 r->in.machine_name);
2172 if (r->out.account_name == NULL) {
2173 libnet_join_set_error_string(mem_ctx, r,
2174 "Unable to construct r->out.account_name");
2175 return WERR_NOT_ENOUGH_MEMORY;
2176 }
2177
2178 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2179 &r->in.domain_name,
2180 &r->in.dc_name)) {
2181 libnet_join_set_error_string(mem_ctx, r,
2182 "Failed to parse domain name");
2183 return WERR_INVALID_PARAMETER;
2184 }
2185
2186 if (!r->in.admin_domain) {
2187 char *admin_domain = NULL;
2188 char *admin_account = NULL;
2189 bool ok;
2190
2191 ok = split_domain_user(mem_ctx,
2192 r->in.admin_account,
2193 &admin_domain,
2194 &admin_account);
2195 if (!ok) {
2196 return WERR_NOT_ENOUGH_MEMORY;
2197 }
2198
2199 if (admin_domain != NULL) {
2200 r->in.admin_domain = admin_domain;
2201 } else {
2202 r->in.admin_domain = r->in.domain_name;
2203 }
2204 r->in.admin_account = admin_account;
2205 }
2206
2207 if (!secrets_init()) {
2208 libnet_join_set_error_string(mem_ctx, r,
2209 "Unable to open secrets database");
2210 return WERR_CAN_NOT_COMPLETE;
2211 }
2212
2213 return WERR_OK;
2214 }
2215
2216 /****************************************************************
2217 ****************************************************************/
2218
2219 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
2220 {
2221 NTSTATUS status;
2222
2223 /* Try adding dom admins to builtin\admins. Only log failures. */
2224 status = create_builtin_administrators(domain_sid);
2225 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
2226 DEBUG(10,("Unable to auto-add domain administrators to "
2227 "BUILTIN\\Administrators during join because "
2228 "winbindd must be running.\n"));
2229 } else if (!NT_STATUS_IS_OK(status)) {
2230 DEBUG(5, ("Failed to auto-add domain administrators to "
2231 "BUILTIN\\Administrators during join: %s\n",
2232 nt_errstr(status)));
2233 }
2234
2235 /* Try adding dom users to builtin\users. Only log failures. */
2236 status = create_builtin_users(domain_sid);
2237 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
2238 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
2239 "during join because winbindd must be running.\n"));
2240 } else if (!NT_STATUS_IS_OK(status)) {
2241 DEBUG(5, ("Failed to auto-add domain administrators to "
2242 "BUILTIN\\Administrators during join: %s\n",
2243 nt_errstr(status)));
2244 }
2245 }
2246
2247 /****************************************************************
2248 ****************************************************************/
2249
2250 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
2251 struct libnet_JoinCtx *r)
2252 {
2253 WERROR werr;
2254
2255 if (!W_ERROR_IS_OK(r->out.result)) {
2256 return r->out.result;
2257 }
2258
2259 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
2260 werr = do_JoinConfig(r);
2261 if (!W_ERROR_IS_OK(werr)) {
2262 return werr;
2263 }
2264
2265 return WERR_OK;
2266 }
2267
2268 #ifdef HAVE_ADS
2269 if (r->out.domain_is_ad &&
2270 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2271 ADS_STATUS ads_status;
2272
2273 ads_status = libnet_join_post_processing_ads_modify(mem_ctx, r);
2274 if (!ADS_ERR_OK(ads_status)) {
2275 return WERR_GEN_FAILURE;
2276 }
2277 }
2278 #endif /* HAVE_ADS */
2279
2280 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
2281 if (r->out.dns_domain_name) {
2282 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
2283 }
2284
2285 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2286 return WERR_NERR_SETUPNOTJOINED;
2287 }
2288
2289 werr = do_JoinConfig(r);
2290 if (!W_ERROR_IS_OK(werr)) {
2291 return werr;
2292 }
2293
2294 #ifdef HAVE_ADS
2295 if (r->out.domain_is_ad &&
2296 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2297 ADS_STATUS ads_status;
2298
2299 ads_status = libnet_join_post_processing_ads_sync(mem_ctx, r);
2300 if (!ADS_ERR_OK(ads_status)) {
2301 return WERR_GEN_FAILURE;
2302 }
2303 }
2304 #endif /* HAVE_ADS */
2305
2306 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
2307
2308 return WERR_OK;
2309 }
2310
2311 /****************************************************************
2312 ****************************************************************/
2313
2314 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
2315 {
2316 if (r->in.ads) {
2317 ads_destroy(&r->in.ads);
2318 }
2319
2320 return 0;
2321 }
2322
2323 /****************************************************************
2324 ****************************************************************/
2325
2326 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
2327 {
2328 if (r->in.ads) {
2329 ads_destroy(&r->in.ads);
2330 }
2331
2332 return 0;
2333 }
2334
2335 /****************************************************************
2336 ****************************************************************/
2337
2338 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
2339 struct libnet_JoinCtx **r)
2340 {
2341 struct libnet_JoinCtx *ctx;
2342
2343 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
2344 if (!ctx) {
2345 return WERR_NOT_ENOUGH_MEMORY;
2346 }
2347
2348 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
2349
2350 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
2351 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
2352
2353 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
2354
2355 ctx->in.desired_encryption_types = ENC_CRC32 |
2356 ENC_RSA_MD5 |
2357 ENC_RC4_HMAC_MD5;
2358 #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
2359 ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES128;
2360 #endif
2361 #ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
2362 ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES256;
2363 #endif
2364
2365 *r = ctx;
2366
2367 return WERR_OK;
2368 }
2369
2370 /****************************************************************
2371 ****************************************************************/
2372
2373 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
2374 struct libnet_UnjoinCtx **r)
2375 {
2376 struct libnet_UnjoinCtx *ctx;
2377
2378 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
2379 if (!ctx) {
2380 return WERR_NOT_ENOUGH_MEMORY;
2381 }
2382
2383 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
2384
2385 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
2386 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
2387
2388 *r = ctx;
2389
2390 return WERR_OK;
2391 }
2392
2393 /****************************************************************
2394 ****************************************************************/
2395
2396 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
2397 struct libnet_JoinCtx *r)
2398 {
2399 bool valid_security = false;
2400 bool valid_workgroup = false;
2401 bool valid_realm = false;
2402 bool ignored_realm = false;
2403
2404 /* check if configuration is already set correctly */
2405
2406 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
2407
2408 switch (r->out.domain_is_ad) {
2409 case false:
2410 valid_security = (lp_security() == SEC_DOMAIN)
2411 || (lp_server_role() == ROLE_DOMAIN_PDC)
2412 || (lp_server_role() == ROLE_DOMAIN_BDC);
2413 if (valid_workgroup && valid_security) {
2414 /* nothing to be done */
2415 return WERR_OK;
2416 }
2417 break;
2418 case true:
2419 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
2420 switch (lp_security()) {
2421 case SEC_DOMAIN:
2422 if (!valid_realm && lp_winbind_rpc_only()) {
2423 valid_realm = true;
2424 ignored_realm = true;
2425 }
2426 /* FALL THROUGH */
2427 case SEC_ADS:
2428 valid_security = true;
2429 }
2430
2431 if (valid_workgroup && valid_realm && valid_security) {
2432 if (ignored_realm && !r->in.modify_config)
2433 {
2434 libnet_join_set_error_string(mem_ctx, r,
2435 "Warning: ignoring realm when "
2436 "joining AD domain with "
2437 "'security=domain' and "
2438 "'winbind rpc only = yes'. "
2439 "(realm set to '%s', "
2440 "should be '%s').", lp_realm(),
2441 r->out.dns_domain_name);
2442 }
2443 /* nothing to be done */
2444 return WERR_OK;
2445 }
2446 break;
2447 }
2448
2449 /* check if we are supposed to manipulate configuration */
2450
2451 if (!r->in.modify_config) {
2452
2453 char *wrong_conf = talloc_strdup(mem_ctx, "");
2454
2455 if (!valid_workgroup) {
2456 wrong_conf = talloc_asprintf_append(wrong_conf,
2457 "\"workgroup\" set to '%s', should be '%s'",
2458 lp_workgroup(), r->out.netbios_domain_name);
2459 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2460 }
2461
2462 if (!valid_realm) {
2463 wrong_conf = talloc_asprintf_append(wrong_conf,
2464 "\"realm\" set to '%s', should be '%s'",
2465 lp_realm(), r->out.dns_domain_name);
2466 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2467 }
2468
2469 if (!valid_security) {
2470 const char *sec = NULL;
2471 switch (lp_security()) {
2472 case SEC_USER: sec = "user"; break;
2473 case SEC_DOMAIN: sec = "domain"; break;
2474 case SEC_ADS: sec = "ads"; break;
2475 }
2476 wrong_conf = talloc_asprintf_append(wrong_conf,
2477 "\"security\" set to '%s', should be %s",
2478 sec, r->out.domain_is_ad ?
2479 "either 'domain' or 'ads'" : "'domain'");
2480 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2481 }
2482
2483 libnet_join_set_error_string(mem_ctx, r,
2484 "Invalid configuration (%s) and configuration modification "
2485 "was not requested", wrong_conf);
2486 return WERR_CAN_NOT_COMPLETE;
2487 }
2488
2489 /* check if we are able to manipulate configuration */
2490
2491 if (!lp_config_backend_is_registry()) {
2492 libnet_join_set_error_string(mem_ctx, r,
2493 "Configuration manipulation requested but not "
2494 "supported by backend");
2495 return WERR_NOT_SUPPORTED;
2496 }
2497
2498 return WERR_OK;
2499 }
2500
2501 /****************************************************************
2502 ****************************************************************/
2503
2504 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
2505 struct libnet_JoinCtx *r)
2506 {
2507 NTSTATUS status;
2508 WERROR werr;
2509 struct cli_state *cli = NULL;
2510 #ifdef HAVE_ADS
2511 ADS_STATUS ads_status;
2512 #endif /* HAVE_ADS */
2513 const char *pre_connect_realm = NULL;
2514 const char *numeric_dcip = NULL;
2515 const char *sitename = NULL;
2516
2517 /* Before contacting a DC, we can securely know
2518 * the realm only if the user specifies it.
2519 */
2520 if (r->in.use_kerberos &&
2521 r->in.domain_name_type == JoinDomNameTypeDNS) {
2522 pre_connect_realm = r->in.domain_name;
2523 }
2524
2525 if (!r->in.dc_name) {
2526 struct netr_DsRGetDCNameInfo *info;
2527 const char *dc;
2528 uint32_t name_type_flags = 0;
2529 if (r->in.domain_name_type == JoinDomNameTypeDNS) {
2530 name_type_flags = DS_IS_DNS_NAME;
2531 } else if (r->in.domain_name_type == JoinDomNameTypeNBT) {
2532 name_type_flags = DS_IS_FLAT_NAME;
2533 }
2534 status = dsgetdcname(mem_ctx,
2535 r->in.msg_ctx,
2536 r->in.domain_name,
2537 NULL,
2538 NULL,
2539 DS_FORCE_REDISCOVERY |
2540 DS_DIRECTORY_SERVICE_REQUIRED |
2541 DS_WRITABLE_REQUIRED |
2542 DS_RETURN_DNS_NAME |
2543 name_type_flags,
2544 &info);
2545 if (!NT_STATUS_IS_OK(status)) {
2546 libnet_join_set_error_string(mem_ctx, r,
2547 "failed to find DC for domain %s - %s",
2548 r->in.domain_name,
2549 get_friendly_nt_error_msg(status));
2550 return WERR_NERR_DCNOTFOUND;
2551 }
2552
2553 dc = strip_hostname(info->dc_unc);
2554 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2555 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2556
2557 if (info->dc_address == NULL || info->dc_address[0] != '\\' ||
2558 info->dc_address[1] != '\\') {
2559 DBG_ERR("ill-formed DC address '%s'\n",
2560 info->dc_address);
2561 return WERR_NERR_DCNOTFOUND;
2562 }
2563
2564 numeric_dcip = info->dc_address + 2;
2565 sitename = info->dc_site_name;
2566 /* info goes out of scope but the memory stays
2567 allocated on the talloc context */
2568 }
2569
2570 if (pre_connect_realm != NULL) {
2571 struct sockaddr_storage ss = {0};
2572
2573 if (numeric_dcip != NULL) {
2574 if (!interpret_string_addr(&ss, numeric_dcip,
2575 AI_NUMERICHOST)) {
2576 DBG_ERR(
2577 "cannot parse IP address '%s' of DC '%s'\n",
2578 numeric_dcip, r->in.dc_name);
2579 return WERR_NERR_DCNOTFOUND;
2580 }
2581 } else {
2582 if (!interpret_string_addr(&ss, r->in.dc_name, 0)) {
2583 DBG_WARNING(
2584 "cannot resolve IP address of DC '%s'\n",
2585 r->in.dc_name);
2586 return WERR_NERR_DCNOTFOUND;
2587 }
2588 }
2589
2590 /* The domain parameter is only used as modifier
2591 * to krb5.conf file name. .JOIN is is not a valid
2592 * NetBIOS name so it cannot clash with another domain
2593 * -- Uri.
2594 */
2595 create_local_private_krb5_conf_for_domain(
2596 pre_connect_realm, ".JOIN", sitename, &ss);
2597 }
2598
2599 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
2600 if (!NT_STATUS_IS_OK(status)) {
2601 libnet_join_set_error_string(mem_ctx, r,
2602 "failed to lookup DC info for domain '%s' over rpc: %s",
2603 r->in.domain_name, get_friendly_nt_error_msg(status));
2604 return ntstatus_to_werror(status);
2605 }
2606
2607 werr = libnet_join_check_config(mem_ctx, r);
2608 if (!W_ERROR_IS_OK(werr)) {
2609 goto done;
2610 }
2611
2612 #ifdef HAVE_ADS
2613
2614 if (r->out.domain_is_ad) {
2615 create_local_private_krb5_conf_for_domain(
2616 r->out.dns_domain_name, r->out.netbios_domain_name,
2617 sitename, smbXcli_conn_remote_sockaddr(cli->conn));
2618 }
2619
2620 if (r->out.domain_is_ad &&
2621 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2622
2623 const char *initial_account_ou = r->in.account_ou;
2624
2625 /*
2626 * we want to create the msDS-SupportedEncryptionTypes attribute
2627 * as early as possible so always try an LDAP create as the user
2628 * first. We copy r->in.account_ou because it may be changed
2629 * during the machine pre-creation.
2630 */
2631
2632 ads_status = libnet_join_connect_ads_user(mem_ctx, r);
2633 if (!ADS_ERR_OK(ads_status)) {
2634 return WERR_NERR_DEFAULTJOINREQUIRED;
2635 }
2636
2637 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
2638 if (ADS_ERR_OK(ads_status)) {
2639
2640 /*
2641 * LDAP object create succeeded, now go to the rpc
2642 * password set routines
2643 */
2644
2645 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
2646 goto rpc_join;
2647 }
2648
2649 if (initial_account_ou != NULL) {
2650 libnet_join_set_error_string(mem_ctx, r,
2651 "failed to precreate account in ou %s: %s",
2652 r->in.account_ou,
2653 ads_errstr(ads_status));
2654 return WERR_NERR_DEFAULTJOINREQUIRED;
2655 }
2656
2657 DEBUG(5, ("failed to precreate account in ou %s: %s",
2658 r->in.account_ou, ads_errstr(ads_status)));
2659 }
2660 #endif /* HAVE_ADS */
2661
2662 rpc_join:
2663 if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2664 (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2665 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2666 } else {
2667 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2668 }
2669 if (!NT_STATUS_IS_OK(status)) {
2670 libnet_join_set_error_string(mem_ctx, r,
2671 "failed to join domain '%s' over rpc: %s",
2672 r->in.domain_name, get_friendly_nt_error_msg(status));
2673 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2674 return WERR_NERR_SETUPALREADYJOINED;
2675 }
2676 werr = ntstatus_to_werror(status);
2677 goto done;
2678 }
2679
2680 werr = WERR_OK;
2681
2682 done:
2683 if (cli) {
2684 cli_shutdown(cli);
2685 }
2686
2687 return werr;
2688 }
2689
2690 /****************************************************************
2691 ****************************************************************/
2692
2693 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2694 struct libnet_JoinCtx *r)
2695 {
2696 WERROR werr;
2697 struct libnet_UnjoinCtx *u = NULL;
2698
2699 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2700 if (!W_ERROR_IS_OK(werr)) {
2701 return werr;
2702 }
2703
2704 u->in.debug = r->in.debug;
2705 u->in.dc_name = r->in.dc_name;
2706 u->in.domain_name = r->in.domain_name;
2707 u->in.admin_account = r->in.admin_account;
2708 u->in.admin_password = r->in.admin_password;
2709 u->in.modify_config = r->in.modify_config;
2710 u->in.use_kerberos = r->in.use_kerberos;
2711 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
2712 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2713
2714 werr = libnet_Unjoin(mem_ctx, u);
2715 TALLOC_FREE(u);
2716
2717 return werr;
2718 }
2719
2720 /****************************************************************
2721 ****************************************************************/
2722
2723 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2724 struct libnet_JoinCtx *r)
2725 {
2726 WERROR werr;
2727
2728 if (r->in.debug) {
2729 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2730 }
2731
2732 ZERO_STRUCT(r->out);
2733
2734 werr = libnet_join_pre_processing(mem_ctx, r);
2735 if (!W_ERROR_IS_OK(werr)) {
2736 goto done;
2737 }
2738
2739 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2740 werr = libnet_DomainJoin(mem_ctx, r);
2741 if (!W_ERROR_IS_OK(werr)) {
2742 goto done;
2743 }
2744 }
2745
2746 werr = libnet_join_post_processing(mem_ctx, r);
2747 if (!W_ERROR_IS_OK(werr)) {
2748 goto done;
2749 }
2750
2751 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2752 werr = libnet_join_post_verify(mem_ctx, r);
2753 if (!W_ERROR_IS_OK(werr)) {
2754 libnet_join_rollback(mem_ctx, r);
2755 }
2756 }
2757
2758 done:
2759 r->out.result = werr;
2760
2761 if (r->in.debug) {
2762 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2763 }
2764 return werr;
2765 }
2766
2767 /****************************************************************
2768 ****************************************************************/
2769
2770 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2771 struct libnet_UnjoinCtx *r)
2772 {
2773 NTSTATUS status;
2774
2775 if (!r->in.domain_sid) {
2776 struct dom_sid sid;
2777 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2778 libnet_unjoin_set_error_string(mem_ctx, r,
2779 "Unable to fetch domain sid: are we joined?");
2780 return WERR_NERR_SETUPNOTJOINED;
2781 }
2782 r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2783 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2784 }
2785
2786 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2787 !r->in.delete_machine_account) {
2788 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2789 return WERR_OK;
2790 }
2791
2792 if (!r->in.dc_name) {
2793 struct netr_DsRGetDCNameInfo *info;
2794 const char *dc;
2795 status = dsgetdcname(mem_ctx,
2796 r->in.msg_ctx,
2797 r->in.domain_name,
2798 NULL,
2799 NULL,
2800 DS_DIRECTORY_SERVICE_REQUIRED |
2801 DS_WRITABLE_REQUIRED |
2802 DS_RETURN_DNS_NAME,
2803 &info);
2804 if (!NT_STATUS_IS_OK(status)) {
2805 libnet_unjoin_set_error_string(mem_ctx, r,
2806 "failed to find DC for domain %s - %s",
2807 r->in.domain_name,
2808 get_friendly_nt_error_msg(status));
2809 return WERR_NERR_DCNOTFOUND;
2810 }
2811
2812 dc = strip_hostname(info->dc_unc);
2813 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2814 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2815 }
2816
2817 #ifdef HAVE_ADS
2818 /* for net ads leave, try to delete the account. If it works,
2819 no sense in disabling. If it fails, we can still try to
2820 disable it. jmcd */
2821
2822 if (r->in.delete_machine_account) {
2823 ADS_STATUS ads_status;
2824 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2825 if (ADS_ERR_OK(ads_status)) {
2826 /* dirty hack */
2827 r->out.dns_domain_name =
2828 talloc_strdup(mem_ctx,
2829 r->in.ads->server.realm);
2830 ads_status =
2831 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2832 }
2833 if (!ADS_ERR_OK(ads_status)) {
2834 libnet_unjoin_set_error_string(mem_ctx, r,
2835 "failed to remove machine account from AD: %s",
2836 ads_errstr(ads_status));
2837 } else {
2838 r->out.deleted_machine_account = true;
2839 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2840 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2841 return WERR_OK;
2842 }
2843 }
2844 #endif /* HAVE_ADS */
2845
2846 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2847 "disable". */
2848 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2849 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2850 if (!NT_STATUS_IS_OK(status)) {
2851 libnet_unjoin_set_error_string(mem_ctx, r,
2852 "failed to disable machine account via rpc: %s",
2853 get_friendly_nt_error_msg(status));
2854 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2855 return WERR_NERR_SETUPNOTJOINED;
2856 }
2857 return ntstatus_to_werror(status);
2858 }
2859
2860 r->out.disabled_machine_account = true;
2861 }
2862
2863 /* If disable succeeded or was not requested at all, we
2864 should be getting rid of our end of things */
2865
2866 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2867
2868 return WERR_OK;
2869 }
2870
2871 /****************************************************************
2872 ****************************************************************/
2873
2874 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2875 struct libnet_UnjoinCtx *r)
2876 {
2877 if (!r->in.domain_name) {
2878 libnet_unjoin_set_error_string(mem_ctx, r,
2879 "No domain name defined");
2880 return WERR_INVALID_PARAMETER;
2881 }
2882
2883 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2884 &r->in.domain_name,
2885 &r->in.dc_name)) {
2886 libnet_unjoin_set_error_string(mem_ctx, r,
2887 "Failed to parse domain name");
2888 return WERR_INVALID_PARAMETER;
2889 }
2890
2891 if (IS_DC) {
2892 return WERR_NERR_SETUPDOMAINCONTROLLER;
2893 }
2894
2895 if (!r->in.admin_domain) {
2896 char *admin_domain = NULL;
2897 char *admin_account = NULL;
2898 bool ok;
2899
2900 ok = split_domain_user(mem_ctx,
2901 r->in.admin_account,
2902 &admin_domain,
2903 &admin_account);
2904 if (!ok) {
2905 return WERR_NOT_ENOUGH_MEMORY;
2906 }
2907
2908 if (admin_domain != NULL) {
2909 r->in.admin_domain = admin_domain;
2910 } else {
2911 r->in.admin_domain = r->in.domain_name;
2912 }
2913 r->in.admin_account = admin_account;
2914 }
2915
2916 if (!secrets_init()) {
2917 libnet_unjoin_set_error_string(mem_ctx, r,
2918 "Unable to open secrets database");
2919 return WERR_CAN_NOT_COMPLETE;
2920 }
2921
2922 return WERR_OK;
2923 }
2924
2925 /****************************************************************
2926 ****************************************************************/
2927
2928 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2929 struct libnet_UnjoinCtx *r)
2930 {
2931 saf_delete(r->out.netbios_domain_name);
2932 saf_delete(r->out.dns_domain_name);
2933
2934 return libnet_unjoin_config(r);
2935 }
2936
2937 /****************************************************************
2938 ****************************************************************/
2939
2940 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2941 struct libnet_UnjoinCtx *r)
2942 {
2943 WERROR werr;
2944
2945 if (r->in.debug) {
2946 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2947 }
2948
2949 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2950 if (!W_ERROR_IS_OK(werr)) {
2951 goto done;
2952 }
2953
2954 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2955 werr = libnet_DomainUnjoin(mem_ctx, r);
2956 if (!W_ERROR_IS_OK(werr)) {
2957 libnet_unjoin_config(r);
2958 goto done;
2959 }
2960 }
2961
2962 werr = libnet_unjoin_post_processing(mem_ctx, r);
2963 if (!W_ERROR_IS_OK(werr)) {
2964 goto done;
2965 }
2966
2967 done:
2968 r->out.result = werr;
2969
2970 if (r->in.debug) {
2971 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2972 }
2973
2974 return werr;
2975 }
Samba GIT mirror