?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
re-run make idl.
[Samba.git] / source / libnet / libnet_join.c
blob7451cb27c6f2e200126b1461087bea95c1b49a04
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23
24 /****************************************************************
25 ****************************************************************/
26
27 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
28 do { \
29 char *str = NULL; \
30 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
31 DEBUG(1,("libnet_Join:\n%s", str)); \
32 TALLOC_FREE(str); \
33 } while (0)
34
35 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
36 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
37 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
38 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
39
40 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
41 do { \
42 char *str = NULL; \
43 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
44 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
45 TALLOC_FREE(str); \
46 } while (0)
47
48 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
49 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
50 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
51 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
52
53 #define W_ERROR_NOT_OK_GOTO_DONE(x) do { \
54 if (!W_ERROR_IS_OK(x)) {\
55 goto done;\
56 }\
57 } while (0)
58
59 /****************************************************************
60 ****************************************************************/
61
62 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
63 struct libnet_JoinCtx *r,
64 const char *format, ...)
65 {
66 va_list args;
67
68 if (r->out.error_string) {
69 return;
70 }
71
72 va_start(args, format);
73 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
74 va_end(args);
75 }
76
77 /****************************************************************
78 ****************************************************************/
79
80 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
81 struct libnet_UnjoinCtx *r,
82 const char *format, ...)
83 {
84 va_list args;
85
86 if (r->out.error_string) {
87 return;
88 }
89
90 va_start(args, format);
91 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
92 va_end(args);
93 }
94
95 #ifdef WITH_ADS
96
97 /****************************************************************
98 ****************************************************************/
99
100 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
101 const char *netbios_domain_name,
102 const char *dc_name,
103 const char *user_name,
104 const char *password,
105 ADS_STRUCT **ads)
106 {
107 ADS_STATUS status;
108 ADS_STRUCT *my_ads = NULL;
109
110 my_ads = ads_init(dns_domain_name,
111 netbios_domain_name,
112 dc_name);
113 if (!my_ads) {
114 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
115 }
116
117 if (user_name) {
118 SAFE_FREE(my_ads->auth.user_name);
119 my_ads->auth.user_name = SMB_STRDUP(user_name);
120 }
121
122 if (password) {
123 SAFE_FREE(my_ads->auth.password);
124 my_ads->auth.password = SMB_STRDUP(password);
125 }
126
127 status = ads_connect(my_ads);
128 if (!ADS_ERR_OK(status)) {
129 ads_destroy(&my_ads);
130 return status;
131 }
132
133 *ads = my_ads;
134 return ADS_SUCCESS;
135 }
136
137 /****************************************************************
138 ****************************************************************/
139
140 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
141 struct libnet_JoinCtx *r)
142 {
143 ADS_STATUS status;
144
145 status = libnet_connect_ads(r->out.dns_domain_name,
146 r->out.netbios_domain_name,
147 r->in.dc_name,
148 r->in.admin_account,
149 r->in.admin_password,
150 &r->in.ads);
151 if (!ADS_ERR_OK(status)) {
152 libnet_join_set_error_string(mem_ctx, r,
153 "failed to connect to AD: %s",
154 ads_errstr(status));
155 return status;
156 }
157
158 if (!r->out.netbios_domain_name) {
159 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
160 r->in.ads->server.workgroup);
161 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
162 }
163
164 if (!r->out.dns_domain_name) {
165 r->out.dns_domain_name = talloc_strdup(mem_ctx,
166 r->in.ads->config.realm);
167 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
168 }
169
170 r->out.domain_is_ad = true;
171
172 return ADS_SUCCESS;
173 }
174
175 /****************************************************************
176 ****************************************************************/
177
178 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
179 struct libnet_UnjoinCtx *r)
180 {
181 ADS_STATUS status;
182
183 status = libnet_connect_ads(r->in.domain_name,
184 r->in.domain_name,
185 r->in.dc_name,
186 r->in.admin_account,
187 r->in.admin_password,
188 &r->in.ads);
189 if (!ADS_ERR_OK(status)) {
190 libnet_unjoin_set_error_string(mem_ctx, r,
191 "failed to connect to AD: %s",
192 ads_errstr(status));
193 }
194
195 return status;
196 }
197
198 /****************************************************************
199 join a domain using ADS (LDAP mods)
200 ****************************************************************/
201
202 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
203 struct libnet_JoinCtx *r)
204 {
205 ADS_STATUS status;
206 LDAPMessage *res = NULL;
207 const char *attrs[] = { "dn", NULL };
208 bool moved = false;
209
210 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
211 if (!ADS_ERR_OK(status)) {
212 return status;
213 }
214
215 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
216 if (!ADS_ERR_OK(status)) {
217 return status;
218 }
219
220 if (ads_count_replies(r->in.ads, res) != 1) {
221 ads_msgfree(r->in.ads, res);
222 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
223 }
224
225 ads_msgfree(r->in.ads, res);
226
227 /* Attempt to create the machine account and bail if this fails.
228 Assume that the admin wants exactly what they requested */
229
230 status = ads_create_machine_acct(r->in.ads,
231 r->in.machine_name,
232 r->in.account_ou);
233
234 if (ADS_ERR_OK(status)) {
235 DEBUG(1,("machine account creation created\n"));
236 return status;
237 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
238 (status.err.rc == LDAP_ALREADY_EXISTS)) {
239 status = ADS_SUCCESS;
240 }
241
242 if (!ADS_ERR_OK(status)) {
243 DEBUG(1,("machine account creation failed\n"));
244 return status;
245 }
246
247 status = ads_move_machine_acct(r->in.ads,
248 r->in.machine_name,
249 r->in.account_ou,
250 &moved);
251 if (!ADS_ERR_OK(status)) {
252 DEBUG(1,("failure to locate/move pre-existing "
253 "machine account\n"));
254 return status;
255 }
256
257 DEBUG(1,("The machine account %s the specified OU.\n",
258 moved ? "was moved into" : "already exists in"));
259
260 return status;
261 }
262
263 /****************************************************************
264 ****************************************************************/
265
266 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
267 struct libnet_UnjoinCtx *r)
268 {
269 ADS_STATUS status;
270
271 if (!r->in.ads) {
272 return libnet_unjoin_connect_ads(mem_ctx, r);
273 }
274
275 status = ads_leave_realm(r->in.ads, r->in.machine_name);
276 if (!ADS_ERR_OK(status)) {
277 libnet_unjoin_set_error_string(mem_ctx, r,
278 "failed to leave realm: %s",
279 ads_errstr(status));
280 return status;
281 }
282
283 return ADS_SUCCESS;
284 }
285
286 /****************************************************************
287 ****************************************************************/
288
289 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
290 struct libnet_JoinCtx *r)
291 {
292 ADS_STATUS status;
293 LDAPMessage *res = NULL;
294 char *dn = NULL;
295
296 if (!r->in.machine_name) {
297 return ADS_ERROR(LDAP_NO_MEMORY);
298 }
299
300 status = ads_find_machine_acct(r->in.ads,
301 &res,
302 r->in.machine_name);
303 if (!ADS_ERR_OK(status)) {
304 return status;
305 }
306
307 if (ads_count_replies(r->in.ads, res) != 1) {
308 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
309 goto done;
310 }
311
312 dn = ads_get_dn(r->in.ads, res);
313 if (!dn) {
314 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
315 goto done;
316 }
317
318 r->out.dn = talloc_strdup(mem_ctx, dn);
319 if (!r->out.dn) {
320 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
321 goto done;
322 }
323
324 done:
325 ads_msgfree(r->in.ads, res);
326 ads_memfree(r->in.ads, dn);
327
328 return status;
329 }
330
331 /****************************************************************
332 Set a machines dNSHostName and servicePrincipalName attributes
333 ****************************************************************/
334
335 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
336 struct libnet_JoinCtx *r)
337 {
338 ADS_STATUS status;
339 ADS_MODLIST mods;
340 fstring my_fqdn;
341 const char *spn_array[3] = {NULL, NULL, NULL};
342 char *spn = NULL;
343
344 /* Find our DN */
345
346 status = libnet_join_find_machine_acct(mem_ctx, r);
347 if (!ADS_ERR_OK(status)) {
348 return status;
349 }
350
351 /* Windows only creates HOST/shortname & HOST/fqdn. */
352
353 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
354 if (!spn) {
355 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
356 }
357 strupper_m(spn);
358 spn_array[0] = spn;
359
360 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
361 || (strchr(my_fqdn, '.') == NULL)) {
362 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
363 r->out.dns_domain_name);
364 }
365
366 strlower_m(my_fqdn);
367
368 if (!strequal(my_fqdn, r->in.machine_name)) {
369 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
370 if (!spn) {
371 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
372 }
373 spn_array[1] = spn;
374 }
375
376 mods = ads_init_mods(mem_ctx);
377 if (!mods) {
378 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
379 }
380
381 /* fields of primary importance */
382
383 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
384 if (!ADS_ERR_OK(status)) {
385 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
386 }
387
388 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
389 spn_array);
390 if (!ADS_ERR_OK(status)) {
391 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
392 }
393
394 return ads_gen_mod(r->in.ads, r->out.dn, mods);
395 }
396
397 /****************************************************************
398 ****************************************************************/
399
400 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
401 struct libnet_JoinCtx *r)
402 {
403 ADS_STATUS status;
404 ADS_MODLIST mods;
405
406 if (!r->in.create_upn) {
407 return ADS_SUCCESS;
408 }
409
410 /* Find our DN */
411
412 status = libnet_join_find_machine_acct(mem_ctx, r);
413 if (!ADS_ERR_OK(status)) {
414 return status;
415 }
416
417 if (!r->in.upn) {
418 r->in.upn = talloc_asprintf(mem_ctx,
419 "host/%s@%s",
420 r->in.machine_name,
421 r->out.dns_domain_name);
422 if (!r->in.upn) {
423 return ADS_ERROR(LDAP_NO_MEMORY);
424 }
425 }
426
427 /* now do the mods */
428
429 mods = ads_init_mods(mem_ctx);
430 if (!mods) {
431 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
432 }
433
434 /* fields of primary importance */
435
436 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
437 if (!ADS_ERR_OK(status)) {
438 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
439 }
440
441 return ads_gen_mod(r->in.ads, r->out.dn, mods);
442 }
443
444
445 /****************************************************************
446 ****************************************************************/
447
448 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
449 struct libnet_JoinCtx *r)
450 {
451 ADS_STATUS status;
452 ADS_MODLIST mods;
453 char *os_sp = NULL;
454
455 if (!r->in.os_name || !r->in.os_version ) {
456 return ADS_SUCCESS;
457 }
458
459 /* Find our DN */
460
461 status = libnet_join_find_machine_acct(mem_ctx, r);
462 if (!ADS_ERR_OK(status)) {
463 return status;
464 }
465
466 /* now do the mods */
467
468 mods = ads_init_mods(mem_ctx);
469 if (!mods) {
470 return ADS_ERROR(LDAP_NO_MEMORY);
471 }
472
473 os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
474 if (!os_sp) {
475 return ADS_ERROR(LDAP_NO_MEMORY);
476 }
477
478 /* fields of primary importance */
479
480 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
481 r->in.os_name);
482 if (!ADS_ERR_OK(status)) {
483 return status;
484 }
485
486 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
487 r->in.os_version);
488 if (!ADS_ERR_OK(status)) {
489 return status;
490 }
491
492 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
493 os_sp);
494 if (!ADS_ERR_OK(status)) {
495 return status;
496 }
497
498 return ads_gen_mod(r->in.ads, r->out.dn, mods);
499 }
500
501 /****************************************************************
502 ****************************************************************/
503
504 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
505 struct libnet_JoinCtx *r)
506 {
507 if (!lp_use_kerberos_keytab()) {
508 return true;
509 }
510
511 if (ads_keytab_create_default(r->in.ads) != 0) {
512 return false;
513 }
514
515 return true;
516 }
517
518 /****************************************************************
519 ****************************************************************/
520
521 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
522 struct libnet_JoinCtx *r)
523 {
524 uint32_t domain_func;
525 ADS_STATUS status;
526 const char *salt = NULL;
527 char *std_salt = NULL;
528
529 status = ads_domain_func_level(r->in.ads, &domain_func);
530 if (!ADS_ERR_OK(status)) {
531 libnet_join_set_error_string(mem_ctx, r,
532 "failed to determine domain functional level: %s",
533 ads_errstr(status));
534 return false;
535 }
536
537 /* go ahead and setup the default salt */
538
539 std_salt = kerberos_standard_des_salt();
540 if (!std_salt) {
541 libnet_join_set_error_string(mem_ctx, r,
542 "failed to obtain standard DES salt");
543 return false;
544 }
545
546 salt = talloc_strdup(mem_ctx, std_salt);
547 if (!salt) {
548 return false;
549 }
550
551 SAFE_FREE(std_salt);
552
553 /* if it's a Windows functional domain, we have to look for the UPN */
554
555 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
556 char *upn;
557
558 upn = ads_get_upn(r->in.ads, mem_ctx,
559 r->in.machine_name);
560 if (upn) {
561 salt = talloc_strdup(mem_ctx, upn);
562 if (!salt) {
563 return false;
564 }
565 }
566 }
567
568 return kerberos_secrets_store_des_salt(salt);
569 }
570
571 /****************************************************************
572 ****************************************************************/
573
574 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
575 struct libnet_JoinCtx *r)
576 {
577 ADS_STATUS status;
578
579 if (!r->in.ads) {
580 status = libnet_join_connect_ads(mem_ctx, r);
581 if (!ADS_ERR_OK(status)) {
582 return status;
583 }
584 }
585
586 status = libnet_join_set_machine_spn(mem_ctx, r);
587 if (!ADS_ERR_OK(status)) {
588 libnet_join_set_error_string(mem_ctx, r,
589 "failed to set machine spn: %s",
590 ads_errstr(status));
591 return status;
592 }
593
594 status = libnet_join_set_os_attributes(mem_ctx, r);
595 if (!ADS_ERR_OK(status)) {
596 libnet_join_set_error_string(mem_ctx, r,
597 "failed to set machine os attributes: %s",
598 ads_errstr(status));
599 return status;
600 }
601
602 status = libnet_join_set_machine_upn(mem_ctx, r);
603 if (!ADS_ERR_OK(status)) {
604 libnet_join_set_error_string(mem_ctx, r,
605 "failed to set machine upn: %s",
606 ads_errstr(status));
607 return status;
608 }
609
610 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
611 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
612 }
613
614 if (!libnet_join_create_keytab(mem_ctx, r)) {
615 libnet_join_set_error_string(mem_ctx, r,
616 "failed to create kerberos keytab");
617 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
618 }
619
620 return ADS_SUCCESS;
621 }
622 #endif /* WITH_ADS */
623
624 /****************************************************************
625 Store the machine password and domain SID
626 ****************************************************************/
627
628 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
629 struct libnet_JoinCtx *r)
630 {
631 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
632 r->out.domain_sid))
633 {
634 DEBUG(1,("Failed to save domain sid\n"));
635 return false;
636 }
637
638 if (!secrets_store_machine_password(r->in.machine_password,
639 r->out.netbios_domain_name,
640 r->in.secure_channel_type))
641 {
642 DEBUG(1,("Failed to save machine password\n"));
643 return false;
644 }
645
646 return true;
647 }
648
649 /****************************************************************
650 Lookup domain dc's info
651 ****************************************************************/
652
653 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
654 struct libnet_JoinCtx *r,
655 struct cli_state **cli)
656 {
657 struct rpc_pipe_client *pipe_hnd = NULL;
658 POLICY_HND lsa_pol;
659 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
660 union lsa_PolicyInformation *info = NULL;
661
662 status = cli_full_connection(cli, NULL,
663 r->in.dc_name,
664 NULL, 0,
665 "IPC$", "IPC",
666 r->in.admin_account,
667 NULL,
668 r->in.admin_password,
669 0,
670 Undefined, NULL);
671
672 if (!NT_STATUS_IS_OK(status)) {
673 goto done;
674 }
675
676 pipe_hnd = cli_rpc_pipe_open_noauth(*cli, PI_LSARPC, &status);
677 if (!pipe_hnd) {
678 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
679 nt_errstr(status)));
680 goto done;
681 }
682
683 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
684 SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
685 if (!NT_STATUS_IS_OK(status)) {
686 goto done;
687 }
688
689 status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
690 &lsa_pol,
691 LSA_POLICY_INFO_DNS,
692 &info);
693 if (NT_STATUS_IS_OK(status)) {
694 r->out.domain_is_ad = true;
695 r->out.netbios_domain_name = info->dns.name.string;
696 r->out.dns_domain_name = info->dns.dns_domain.string;
697 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->dns.sid);
698 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
699 }
700
701 if (!NT_STATUS_IS_OK(status)) {
702 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
703 &lsa_pol,
704 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
705 &info);
706 if (!NT_STATUS_IS_OK(status)) {
707 goto done;
708 }
709
710 r->out.netbios_domain_name = info->account_domain.name.string;
711 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->account_domain.sid);
712 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
713 }
714
715 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
716 cli_rpc_pipe_close(pipe_hnd);
717
718 done:
719 return status;
720 }
721
722 /****************************************************************
723 Do the domain join
724 ****************************************************************/
725
726 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
727 struct libnet_JoinCtx *r,
728 struct cli_state *cli)
729 {
730 struct rpc_pipe_client *pipe_hnd = NULL;
731 POLICY_HND sam_pol, domain_pol, user_pol;
732 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
733 char *acct_name;
734 struct lsa_String lsa_acct_name;
735 uint32_t user_rid;
736 uint32_t acct_flags = ACB_WSTRUST;
737 uchar pwbuf[532];
738 struct MD5Context md5ctx;
739 uchar md5buffer[16];
740 DATA_BLOB digested_session_key;
741 uchar md4_trust_password[16];
742 struct samr_Ids user_rids;
743 struct samr_Ids name_types;
744 union samr_UserInfo user_info;
745
746 ZERO_STRUCT(sam_pol);
747 ZERO_STRUCT(domain_pol);
748 ZERO_STRUCT(user_pol);
749
750 if (!r->in.machine_password) {
751 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
752 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
753 }
754
755 /* Open the domain */
756
757 pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
758 if (!pipe_hnd) {
759 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
760 nt_errstr(status)));
761 goto done;
762 }
763
764 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
765 pipe_hnd->cli->desthost,
766 SEC_RIGHTS_MAXIMUM_ALLOWED,
767 &sam_pol);
768 if (!NT_STATUS_IS_OK(status)) {
769 goto done;
770 }
771
772 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
773 &sam_pol,
774 SEC_RIGHTS_MAXIMUM_ALLOWED,
775 r->out.domain_sid,
776 &domain_pol);
777 if (!NT_STATUS_IS_OK(status)) {
778 goto done;
779 }
780
781 /* Create domain user */
782
783 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
784 strlower_m(acct_name);
785
786 init_lsa_String(&lsa_acct_name, acct_name);
787
788 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
789 uint32_t access_desired =
790 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
791 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
792 SAMR_USER_ACCESS_SET_PASSWORD |
793 SAMR_USER_ACCESS_GET_ATTRIBUTES |
794 SAMR_USER_ACCESS_SET_ATTRIBUTES;
795 uint32_t access_granted = 0;
796
797 /* Don't try to set any acct_flags flags other than ACB_WSTRUST */
798
799 DEBUG(10,("Creating account with desired access mask: %d\n",
800 access_desired));
801
802 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
803 &domain_pol,
804 &lsa_acct_name,
805 ACB_WSTRUST,
806 access_desired,
807 &user_pol,
808 &access_granted,
809 &user_rid);
810 if (!NT_STATUS_IS_OK(status) &&
811 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
812
813 DEBUG(10,("Creation of workstation account failed: %s\n",
814 nt_errstr(status)));
815
816 /* If NT_STATUS_ACCESS_DENIED then we have a valid
817 username/password combo but the user does not have
818 administrator access. */
819
820 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
821 libnet_join_set_error_string(mem_ctx, r,
822 "User specified does not have "
823 "administrator privileges");
824 }
825
826 goto done;
827 }
828
829 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
830 if (!(r->in.join_flags &
831 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
832 goto done;
833 }
834 }
835
836 /* We *must* do this.... don't ask... */
837
838 if (NT_STATUS_IS_OK(status)) {
839 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
840 }
841 }
842
843 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
844 &domain_pol,
845 1,
846 &lsa_acct_name,
847 &user_rids,
848 &name_types);
849 if (!NT_STATUS_IS_OK(status)) {
850 goto done;
851 }
852
853 if (name_types.ids[0] != SID_NAME_USER) {
854 DEBUG(0,("%s is not a user account (type=%d)\n",
855 acct_name, name_types.ids[0]));
856 status = NT_STATUS_INVALID_WORKSTATION;
857 goto done;
858 }
859
860 user_rid = user_rids.ids[0];
861
862 /* Open handle on user */
863
864 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
865 &domain_pol,
866 SEC_RIGHTS_MAXIMUM_ALLOWED,
867 user_rid,
868 &user_pol);
869 if (!NT_STATUS_IS_OK(status)) {
870 goto done;
871 }
872
873 /* Create a random machine account password and generate the hash */
874
875 E_md4hash(r->in.machine_password, md4_trust_password);
876 encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
877
878 generate_random_buffer((uint8_t*)md5buffer, sizeof(md5buffer));
879 digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
880
881 MD5Init(&md5ctx);
882 MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
883 MD5Update(&md5ctx, cli->user_session_key.data,
884 cli->user_session_key.length);
885 MD5Final(digested_session_key.data, &md5ctx);
886
887 SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
888 memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
889
890 /* Fill in the additional account flags now */
891
892 acct_flags |= ACB_PWNOEXP;
893 if (r->out.domain_is_ad) {
894 #if !defined(ENCTYPE_ARCFOUR_HMAC)
895 acct_flags |= ACB_USE_DES_KEY_ONLY;
896 #endif
897 ;;
898 }
899
900 /* Set password and account flags on machine account */
901
902 ZERO_STRUCT(user_info.info25);
903
904 user_info.info25.info.fields_present = ACCT_NT_PWD_SET |
905 ACCT_LM_PWD_SET |
906 SAMR_FIELD_ACCT_FLAGS;
907
908 user_info.info25.info.acct_flags = acct_flags;
909 memcpy(&user_info.info25.password.data, pwbuf, sizeof(pwbuf));
910
911 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
912 &user_pol,
913 25,
914 &user_info);
915
916 if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
917
918 uchar pwbuf2[516];
919
920 encode_pw_buffer(pwbuf2, r->in.machine_password, STR_UNICODE);
921
922 /* retry with level 24 */
923 init_samr_user_info24(&user_info.info24, pwbuf2, 24);
924
925 SamOEMhashBlob(user_info.info24.password.data, 516,
926 &cli->user_session_key);
927
928 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
929 &user_pol,
930 24,
931 &user_info);
932 }
933
934 if (!NT_STATUS_IS_OK(status)) {
935
936 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
937 &user_pol);
938
939 libnet_join_set_error_string(mem_ctx, r,
940 "Failed to set password for machine account (%s)\n",
941 nt_errstr(status));
942 goto done;
943 }
944
945 status = NT_STATUS_OK;
946
947 done:
948 if (!pipe_hnd) {
949 return status;
950 }
951
952 if (is_valid_policy_hnd(&sam_pol)) {
953 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
954 }
955 if (is_valid_policy_hnd(&domain_pol)) {
956 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
957 }
958 if (is_valid_policy_hnd(&user_pol)) {
959 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
960 }
961 cli_rpc_pipe_close(pipe_hnd);
962
963 return status;
964 }
965
966 /****************************************************************
967 ****************************************************************/
968
969 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
970 const char *machine_name,
971 const char *dc_name)
972 {
973 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
974 struct cli_state *cli = NULL;
975 struct rpc_pipe_client *pipe_hnd = NULL;
976 struct rpc_pipe_client *netlogon_pipe = NULL;
977 NTSTATUS status;
978 char *machine_password = NULL;
979 char *machine_account = NULL;
980
981 if (!dc_name) {
982 return NT_STATUS_INVALID_PARAMETER;
983 }
984
985 if (!secrets_init()) {
986 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
987 }
988
989 machine_password = secrets_fetch_machine_password(netbios_domain_name,
990 NULL, NULL);
991 if (!machine_password) {
992 return NT_STATUS_NO_TRUST_LSA_SECRET;
993 }
994
995 asprintf(&machine_account, "%s$", machine_name);
996 if (!machine_account) {
997 SAFE_FREE(machine_password);
998 return NT_STATUS_NO_MEMORY;
999 }
1000
1001 status = cli_full_connection(&cli, NULL,
1002 dc_name,
1003 NULL, 0,
1004 "IPC$", "IPC",
1005 machine_account,
1006 NULL,
1007 machine_password,
1008 0,
1009 Undefined, NULL);
1010 free(machine_account);
1011 free(machine_password);
1012
1013 if (!NT_STATUS_IS_OK(status)) {
1014 status = cli_full_connection(&cli, NULL,
1015 dc_name,
1016 NULL, 0,
1017 "IPC$", "IPC",
1018 "",
1019 NULL,
1020 "",
1021 0,
1022 Undefined, NULL);
1023 }
1024
1025 if (!NT_STATUS_IS_OK(status)) {
1026 return status;
1027 }
1028
1029 netlogon_pipe = get_schannel_session_key(cli,
1030 netbios_domain_name,
1031 &neg_flags, &status);
1032 if (!netlogon_pipe) {
1033 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1034 cli_shutdown(cli);
1035 return NT_STATUS_OK;
1036 }
1037
1038 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1039 "key from server %s for domain %s. Error was %s\n",
1040 cli->desthost, netbios_domain_name, nt_errstr(status)));
1041 cli_shutdown(cli);
1042 return status;
1043 }
1044
1045 if (!lp_client_schannel()) {
1046 cli_shutdown(cli);
1047 return NT_STATUS_OK;
1048 }
1049
1050 pipe_hnd = cli_rpc_pipe_open_schannel_with_key(cli, PI_NETLOGON,
1051 PIPE_AUTH_LEVEL_PRIVACY,
1052 netbios_domain_name,
1053 netlogon_pipe->dc,
1054 &status);
1055
1056 cli_shutdown(cli);
1057
1058 if (!pipe_hnd) {
1059 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1060 "on netlogon pipe to server %s for domain %s. "
1061 "Error was %s\n",
1062 cli->desthost, netbios_domain_name, nt_errstr(status)));
1063 return status;
1064 }
1065
1066 return NT_STATUS_OK;
1067 }
1068
1069 /****************************************************************
1070 ****************************************************************/
1071
1072 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1073 struct libnet_JoinCtx *r)
1074 {
1075 NTSTATUS status;
1076
1077 status = libnet_join_ok(r->out.netbios_domain_name,
1078 r->in.machine_name,
1079 r->in.dc_name);
1080 if (!NT_STATUS_IS_OK(status)) {
1081 libnet_join_set_error_string(mem_ctx, r,
1082 "failed to verify domain membership after joining: %s",
1083 get_friendly_nt_error_msg(status));
1084 return WERR_SETUP_NOT_JOINED;
1085 }
1086
1087 return WERR_OK;
1088 }
1089
1090 /****************************************************************
1091 ****************************************************************/
1092
1093 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1094 struct libnet_UnjoinCtx *r)
1095 {
1096 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1097 return false;
1098 }
1099
1100 if (!secrets_delete_domain_sid(lp_workgroup())) {
1101 return false;
1102 }
1103
1104 return true;
1105 }
1106
1107 /****************************************************************
1108 ****************************************************************/
1109
1110 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1111 struct libnet_UnjoinCtx *r)
1112 {
1113 struct cli_state *cli = NULL;
1114 struct rpc_pipe_client *pipe_hnd = NULL;
1115 POLICY_HND sam_pol, domain_pol, user_pol;
1116 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1117 char *acct_name;
1118 uint32_t user_rid;
1119 struct lsa_String lsa_acct_name;
1120 struct samr_Ids user_rids;
1121 struct samr_Ids name_types;
1122 union samr_UserInfo *info = NULL;
1123
1124 ZERO_STRUCT(sam_pol);
1125 ZERO_STRUCT(domain_pol);
1126 ZERO_STRUCT(user_pol);
1127
1128 status = cli_full_connection(&cli, NULL,
1129 r->in.dc_name,
1130 NULL, 0,
1131 "IPC$", "IPC",
1132 r->in.admin_account,
1133 NULL,
1134 r->in.admin_password,
1135 0, Undefined, NULL);
1136
1137 if (!NT_STATUS_IS_OK(status)) {
1138 goto done;
1139 }
1140
1141 /* Open the domain */
1142
1143 pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
1144 if (!pipe_hnd) {
1145 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1146 nt_errstr(status)));
1147 goto done;
1148 }
1149
1150 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1151 pipe_hnd->cli->desthost,
1152 SEC_RIGHTS_MAXIMUM_ALLOWED,
1153 &sam_pol);
1154 if (!NT_STATUS_IS_OK(status)) {
1155 goto done;
1156 }
1157
1158 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1159 &sam_pol,
1160 SEC_RIGHTS_MAXIMUM_ALLOWED,
1161 r->in.domain_sid,
1162 &domain_pol);
1163 if (!NT_STATUS_IS_OK(status)) {
1164 goto done;
1165 }
1166
1167 /* Create domain user */
1168
1169 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1170 strlower_m(acct_name);
1171
1172 init_lsa_String(&lsa_acct_name, acct_name);
1173
1174 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1175 &domain_pol,
1176 1,
1177 &lsa_acct_name,
1178 &user_rids,
1179 &name_types);
1180
1181 if (!NT_STATUS_IS_OK(status)) {
1182 goto done;
1183 }
1184
1185 if (name_types.ids[0] != SID_NAME_USER) {
1186 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1187 name_types.ids[0]));
1188 status = NT_STATUS_INVALID_WORKSTATION;
1189 goto done;
1190 }
1191
1192 user_rid = user_rids.ids[0];
1193
1194 /* Open handle on user */
1195
1196 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1197 &domain_pol,
1198 SEC_RIGHTS_MAXIMUM_ALLOWED,
1199 user_rid,
1200 &user_pol);
1201 if (!NT_STATUS_IS_OK(status)) {
1202 goto done;
1203 }
1204
1205 /* Get user info */
1206
1207 status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1208 &user_pol,
1209 16,
1210 &info);
1211 if (!NT_STATUS_IS_OK(status)) {
1212 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1213 goto done;
1214 }
1215
1216 /* now disable and setuser info */
1217
1218 info->info16.acct_flags |= ACB_DISABLED;
1219
1220 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1221 &user_pol,
1222 16,
1223 info);
1224
1225 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1226
1227 done:
1228 if (pipe_hnd) {
1229 if (is_valid_policy_hnd(&domain_pol)) {
1230 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1231 }
1232 if (is_valid_policy_hnd(&sam_pol)) {
1233 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1234 }
1235 cli_rpc_pipe_close(pipe_hnd);
1236 }
1237
1238 if (cli) {
1239 cli_shutdown(cli);
1240 }
1241
1242 return status;
1243 }
1244
1245 /****************************************************************
1246 ****************************************************************/
1247
1248 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1249 {
1250 WERROR werr;
1251 struct smbconf_ctx *ctx;
1252
1253 werr = smbconf_init_reg(r, &ctx, NULL);
1254 if (!W_ERROR_IS_OK(werr)) {
1255 goto done;
1256 }
1257
1258 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1259
1260 werr = smbconf_set_global_parameter(ctx, "security", "user");
1261 W_ERROR_NOT_OK_GOTO_DONE(werr);
1262
1263 werr = smbconf_set_global_parameter(ctx, "workgroup",
1264 r->in.domain_name);
1265
1266 smbconf_delete_global_parameter(ctx, "realm");
1267 goto done;
1268 }
1269
1270 werr = smbconf_set_global_parameter(ctx, "security", "domain");
1271 W_ERROR_NOT_OK_GOTO_DONE(werr);
1272
1273 werr = smbconf_set_global_parameter(ctx, "workgroup",
1274 r->out.netbios_domain_name);
1275 W_ERROR_NOT_OK_GOTO_DONE(werr);
1276
1277 if (r->out.domain_is_ad) {
1278 werr = smbconf_set_global_parameter(ctx, "security", "ads");
1279 W_ERROR_NOT_OK_GOTO_DONE(werr);
1280
1281 werr = smbconf_set_global_parameter(ctx, "realm",
1282 r->out.dns_domain_name);
1283 W_ERROR_NOT_OK_GOTO_DONE(werr);
1284 }
1285
1286 done:
1287 smbconf_shutdown(ctx);
1288 return werr;
1289 }
1290
1291 /****************************************************************
1292 ****************************************************************/
1293
1294 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1295 {
1296 WERROR werr = WERR_OK;
1297 struct smbconf_ctx *ctx;
1298
1299 werr = smbconf_init_reg(r, &ctx, NULL);
1300 if (!W_ERROR_IS_OK(werr)) {
1301 goto done;
1302 }
1303
1304 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1305
1306 werr = smbconf_set_global_parameter(ctx, "security", "user");
1307 W_ERROR_NOT_OK_GOTO_DONE(werr);
1308
1309 werr = smbconf_delete_global_parameter(ctx, "workgroup");
1310 W_ERROR_NOT_OK_GOTO_DONE(werr);
1311
1312 smbconf_delete_global_parameter(ctx, "realm");
1313 }
1314
1315 done:
1316 smbconf_shutdown(ctx);
1317 return werr;
1318 }
1319
1320 /****************************************************************
1321 ****************************************************************/
1322
1323 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1324 {
1325 WERROR werr;
1326
1327 if (!W_ERROR_IS_OK(r->out.result)) {
1328 return r->out.result;
1329 }
1330
1331 if (!r->in.modify_config) {
1332 return WERR_OK;
1333 }
1334
1335 werr = do_join_modify_vals_config(r);
1336 if (!W_ERROR_IS_OK(werr)) {
1337 return werr;
1338 }
1339
1340 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1341
1342 r->out.modified_config = true;
1343 r->out.result = werr;
1344
1345 return werr;
1346 }
1347
1348 /****************************************************************
1349 ****************************************************************/
1350
1351 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1352 {
1353 WERROR werr;
1354
1355 if (!W_ERROR_IS_OK(r->out.result)) {
1356 return r->out.result;
1357 }
1358
1359 if (!r->in.modify_config) {
1360 return WERR_OK;
1361 }
1362
1363 werr = do_unjoin_modify_vals_config(r);
1364 if (!W_ERROR_IS_OK(werr)) {
1365 return werr;
1366 }
1367
1368 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1369
1370 r->out.modified_config = true;
1371 r->out.result = werr;
1372
1373 return werr;
1374 }
1375
1376 /****************************************************************
1377 ****************************************************************/
1378
1379 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1380 const char *domain_str,
1381 const char **domain_p,
1382 const char **dc_p)
1383 {
1384 char *domain = NULL;
1385 char *dc = NULL;
1386 const char *p = NULL;
1387
1388 if (!domain_str || !domain_p || !dc_p) {
1389 return false;
1390 }
1391
1392 p = strchr_m(domain_str, '\\');
1393
1394 if (p != NULL) {
1395 domain = talloc_strndup(mem_ctx, domain_str,
1396 PTR_DIFF(p, domain_str));
1397 dc = talloc_strdup(mem_ctx, p+1);
1398 if (!dc) {
1399 return false;
1400 }
1401 } else {
1402 domain = talloc_strdup(mem_ctx, domain_str);
1403 dc = NULL;
1404 }
1405 if (!domain) {
1406 return false;
1407 }
1408
1409 *domain_p = domain;
1410
1411 if (!*dc_p && dc) {
1412 *dc_p = dc;
1413 }
1414
1415 return true;
1416 }
1417
1418 /****************************************************************
1419 ****************************************************************/
1420
1421 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1422 struct libnet_JoinCtx *r)
1423 {
1424 if (!r->in.domain_name) {
1425 libnet_join_set_error_string(mem_ctx, r,
1426 "No domain name defined");
1427 return WERR_INVALID_PARAM;
1428 }
1429
1430 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1431 &r->in.domain_name,
1432 &r->in.dc_name)) {
1433 libnet_join_set_error_string(mem_ctx, r,
1434 "Failed to parse domain name");
1435 return WERR_INVALID_PARAM;
1436 }
1437
1438 if (IS_DC) {
1439 return WERR_SETUP_DOMAIN_CONTROLLER;
1440 }
1441
1442 if (!secrets_init()) {
1443 libnet_join_set_error_string(mem_ctx, r,
1444 "Unable to open secrets database");
1445 return WERR_CAN_NOT_COMPLETE;
1446 }
1447
1448 return WERR_OK;
1449 }
1450
1451 /****************************************************************
1452 ****************************************************************/
1453
1454 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1455 struct libnet_JoinCtx *r)
1456 {
1457 WERROR werr;
1458
1459 if (!W_ERROR_IS_OK(r->out.result)) {
1460 return r->out.result;
1461 }
1462
1463 werr = do_JoinConfig(r);
1464 if (!W_ERROR_IS_OK(werr)) {
1465 return werr;
1466 }
1467
1468 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1469 saf_store(r->in.domain_name, r->in.dc_name);
1470 }
1471
1472 return WERR_OK;
1473 }
1474
1475 /****************************************************************
1476 ****************************************************************/
1477
1478 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1479 {
1480 const char *krb5_cc_env = NULL;
1481
1482 if (r->in.ads) {
1483 ads_destroy(&r->in.ads);
1484 }
1485
1486 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1487 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1488 unsetenv(KRB5_ENV_CCNAME);
1489 }
1490
1491 return 0;
1492 }
1493
1494 /****************************************************************
1495 ****************************************************************/
1496
1497 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1498 {
1499 const char *krb5_cc_env = NULL;
1500
1501 if (r->in.ads) {
1502 ads_destroy(&r->in.ads);
1503 }
1504
1505 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1506 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1507 unsetenv(KRB5_ENV_CCNAME);
1508 }
1509
1510 return 0;
1511 }
1512
1513 /****************************************************************
1514 ****************************************************************/
1515
1516 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1517 struct libnet_JoinCtx **r)
1518 {
1519 struct libnet_JoinCtx *ctx;
1520 const char *krb5_cc_env = NULL;
1521
1522 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1523 if (!ctx) {
1524 return WERR_NOMEM;
1525 }
1526
1527 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1528
1529 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1530 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1531
1532 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1533 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1534 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1535 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1536 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1537 }
1538
1539 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1540
1541 *r = ctx;
1542
1543 return WERR_OK;
1544 }
1545
1546 /****************************************************************
1547 ****************************************************************/
1548
1549 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1550 struct libnet_UnjoinCtx **r)
1551 {
1552 struct libnet_UnjoinCtx *ctx;
1553 const char *krb5_cc_env = NULL;
1554
1555 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1556 if (!ctx) {
1557 return WERR_NOMEM;
1558 }
1559
1560 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1561
1562 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1563 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1564
1565 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1566 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1567 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1568 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1569 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1570 }
1571
1572 *r = ctx;
1573
1574 return WERR_OK;
1575 }
1576
1577 /****************************************************************
1578 ****************************************************************/
1579
1580 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1581 struct libnet_JoinCtx *r)
1582 {
1583 /* check if configuration is already set correctly */
1584
1585 switch (r->out.domain_is_ad) {
1586 case false:
1587 if ((strequal(lp_workgroup(),
1588 r->out.netbios_domain_name)) &&
1589 (lp_security() == SEC_DOMAIN)) {
1590 /* nothing to be done */
1591 return WERR_OK;
1592 }
1593 break;
1594 case true:
1595 if ((strequal(lp_workgroup(),
1596 r->out.netbios_domain_name)) &&
1597 (strequal(lp_realm(),
1598 r->out.dns_domain_name)) &&
1599 ((lp_security() == SEC_ADS) ||
1600 (lp_security() == SEC_DOMAIN))) {
1601 /* nothing to be done */
1602 return WERR_OK;
1603 }
1604 break;
1605 }
1606
1607 /* check if we are supposed to manipulate configuration */
1608
1609 if (!r->in.modify_config) {
1610 libnet_join_set_error_string(mem_ctx, r,
1611 "Invalid configuration and configuration modification "
1612 "was not requested");
1613 return WERR_CAN_NOT_COMPLETE;
1614 }
1615
1616 /* check if we are able to manipulate configuration */
1617
1618 if (!lp_config_backend_is_registry()) {
1619 libnet_join_set_error_string(mem_ctx, r,
1620 "Configuration manipulation requested but not "
1621 "supported by backend");
1622 return WERR_NOT_SUPPORTED;
1623 }
1624
1625 return WERR_OK;
1626 }
1627
1628 /****************************************************************
1629 ****************************************************************/
1630
1631 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1632 struct libnet_JoinCtx *r)
1633 {
1634 NTSTATUS status;
1635 WERROR werr;
1636 struct cli_state *cli = NULL;
1637 #ifdef WITH_ADS
1638 ADS_STATUS ads_status;
1639 #endif /* WITH_ADS */
1640
1641 if (!r->in.dc_name) {
1642 struct netr_DsRGetDCNameInfo *info;
1643 const char *dc;
1644 status = dsgetdcname(mem_ctx,
1645 r->in.msg_ctx,
1646 r->in.domain_name,
1647 NULL,
1648 NULL,
1649 DS_DIRECTORY_SERVICE_REQUIRED |
1650 DS_WRITABLE_REQUIRED |
1651 DS_RETURN_DNS_NAME,
1652 &info);
1653 if (!NT_STATUS_IS_OK(status)) {
1654 libnet_join_set_error_string(mem_ctx, r,
1655 "failed to find DC for domain %s",
1656 r->in.domain_name,
1657 get_friendly_nt_error_msg(status));
1658 return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1659 }
1660
1661 dc = strip_hostname(info->dc_unc);
1662 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1663 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1664 }
1665
1666 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1667 if (!NT_STATUS_IS_OK(status)) {
1668 libnet_join_set_error_string(mem_ctx, r,
1669 "failed to lookup DC info for domain '%s' over rpc: %s",
1670 r->in.domain_name, get_friendly_nt_error_msg(status));
1671 return ntstatus_to_werror(status);
1672 }
1673
1674 werr = libnet_join_check_config(mem_ctx, r);
1675 if (!W_ERROR_IS_OK(werr)) {
1676 goto done;
1677 }
1678
1679 #ifdef WITH_ADS
1680 if (r->out.domain_is_ad && r->in.account_ou) {
1681
1682 ads_status = libnet_join_connect_ads(mem_ctx, r);
1683 if (!ADS_ERR_OK(ads_status)) {
1684 return WERR_DEFAULT_JOIN_REQUIRED;
1685 }
1686
1687 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1688 if (!ADS_ERR_OK(ads_status)) {
1689 libnet_join_set_error_string(mem_ctx, r,
1690 "failed to precreate account in ou %s: %s",
1691 r->in.account_ou,
1692 ads_errstr(ads_status));
1693 return WERR_DEFAULT_JOIN_REQUIRED;
1694 }
1695
1696 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1697 }
1698 #endif /* WITH_ADS */
1699
1700 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
1701 if (!NT_STATUS_IS_OK(status)) {
1702 libnet_join_set_error_string(mem_ctx, r,
1703 "failed to join domain '%s' over rpc: %s",
1704 r->in.domain_name, get_friendly_nt_error_msg(status));
1705 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1706 return WERR_SETUP_ALREADY_JOINED;
1707 }
1708 werr = ntstatus_to_werror(status);
1709 goto done;
1710 }
1711
1712 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1713 werr = WERR_SETUP_NOT_JOINED;
1714 goto done;
1715 }
1716
1717 #ifdef WITH_ADS
1718 if (r->out.domain_is_ad) {
1719 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1720 if (!ADS_ERR_OK(ads_status)) {
1721 werr = WERR_GENERAL_FAILURE;
1722 goto done;
1723 }
1724 }
1725 #endif /* WITH_ADS */
1726
1727 werr = WERR_OK;
1728
1729 done:
1730 if (cli) {
1731 cli_shutdown(cli);
1732 }
1733
1734 return werr;
1735 }
1736
1737 /****************************************************************
1738 ****************************************************************/
1739
1740 WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
1741 struct libnet_JoinCtx *r)
1742 {
1743 WERROR werr;
1744 struct libnet_UnjoinCtx *u = NULL;
1745
1746 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
1747 if (!W_ERROR_IS_OK(werr)) {
1748 return werr;
1749 }
1750
1751 u->in.debug = r->in.debug;
1752 u->in.dc_name = r->in.dc_name;
1753 u->in.domain_name = r->in.domain_name;
1754 u->in.admin_account = r->in.admin_account;
1755 u->in.admin_password = r->in.admin_password;
1756 u->in.modify_config = r->in.modify_config;
1757 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1758 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
1759
1760 werr = libnet_Unjoin(mem_ctx, u);
1761 TALLOC_FREE(u);
1762
1763 return werr;
1764 }
1765
1766 /****************************************************************
1767 ****************************************************************/
1768
1769 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1770 struct libnet_JoinCtx *r)
1771 {
1772 WERROR werr;
1773
1774 if (r->in.debug) {
1775 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1776 }
1777
1778 werr = libnet_join_pre_processing(mem_ctx, r);
1779 if (!W_ERROR_IS_OK(werr)) {
1780 goto done;
1781 }
1782
1783 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1784 werr = libnet_DomainJoin(mem_ctx, r);
1785 if (!W_ERROR_IS_OK(werr)) {
1786 goto done;
1787 }
1788 }
1789
1790 werr = libnet_join_post_processing(mem_ctx, r);
1791 if (!W_ERROR_IS_OK(werr)) {
1792 goto done;
1793 }
1794
1795 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1796 werr = libnet_join_post_verify(mem_ctx, r);
1797 if (!W_ERROR_IS_OK(werr)) {
1798 libnet_join_rollback(mem_ctx, r);
1799 }
1800 }
1801
1802 done:
1803 r->out.result = werr;
1804
1805 if (r->in.debug) {
1806 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1807 }
1808 return werr;
1809 }
1810
1811 /****************************************************************
1812 ****************************************************************/
1813
1814 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1815 struct libnet_UnjoinCtx *r)
1816 {
1817 NTSTATUS status;
1818
1819 if (!r->in.domain_sid) {
1820 struct dom_sid sid;
1821 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1822 libnet_unjoin_set_error_string(mem_ctx, r,
1823 "Unable to fetch domain sid: are we joined?");
1824 return WERR_SETUP_NOT_JOINED;
1825 }
1826 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
1827 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
1828 }
1829
1830 if (!r->in.dc_name) {
1831 struct netr_DsRGetDCNameInfo *info;
1832 const char *dc;
1833 status = dsgetdcname(mem_ctx,
1834 r->in.msg_ctx,
1835 r->in.domain_name,
1836 NULL,
1837 NULL,
1838 DS_DIRECTORY_SERVICE_REQUIRED |
1839 DS_WRITABLE_REQUIRED |
1840 DS_RETURN_DNS_NAME,
1841 &info);
1842 if (!NT_STATUS_IS_OK(status)) {
1843 libnet_unjoin_set_error_string(mem_ctx, r,
1844 "failed to find DC for domain %s",
1845 r->in.domain_name,
1846 get_friendly_nt_error_msg(status));
1847 return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1848 }
1849
1850 dc = strip_hostname(info->dc_unc);
1851 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1852 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1853 }
1854
1855 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1856 if (!NT_STATUS_IS_OK(status)) {
1857 libnet_unjoin_set_error_string(mem_ctx, r,
1858 "failed to disable machine account via rpc: %s",
1859 get_friendly_nt_error_msg(status));
1860 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1861 return WERR_SETUP_NOT_JOINED;
1862 }
1863 return ntstatus_to_werror(status);
1864 }
1865
1866 r->out.disabled_machine_account = true;
1867
1868 #ifdef WITH_ADS
1869 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1870 ADS_STATUS ads_status;
1871 libnet_unjoin_connect_ads(mem_ctx, r);
1872 ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
1873 if (!ADS_ERR_OK(ads_status)) {
1874 libnet_unjoin_set_error_string(mem_ctx, r,
1875 "failed to remove machine account from AD: %s",
1876 ads_errstr(ads_status));
1877 } else {
1878 r->out.deleted_machine_account = true;
1879 /* dirty hack */
1880 r->out.dns_domain_name = talloc_strdup(mem_ctx,
1881 r->in.ads->server.realm);
1882 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
1883 }
1884 }
1885 #endif /* WITH_ADS */
1886
1887 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1888
1889 return WERR_OK;
1890 }
1891
1892 /****************************************************************
1893 ****************************************************************/
1894
1895 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
1896 struct libnet_UnjoinCtx *r)
1897 {
1898 if (!r->in.domain_name) {
1899 libnet_unjoin_set_error_string(mem_ctx, r,
1900 "No domain name defined");
1901 return WERR_INVALID_PARAM;
1902 }
1903
1904 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1905 &r->in.domain_name,
1906 &r->in.dc_name)) {
1907 libnet_unjoin_set_error_string(mem_ctx, r,
1908 "Failed to parse domain name");
1909 return WERR_INVALID_PARAM;
1910 }
1911
1912 if (IS_DC) {
1913 return WERR_SETUP_DOMAIN_CONTROLLER;
1914 }
1915
1916 if (!secrets_init()) {
1917 libnet_unjoin_set_error_string(mem_ctx, r,
1918 "Unable to open secrets database");
1919 return WERR_CAN_NOT_COMPLETE;
1920 }
1921
1922 return WERR_OK;
1923 }
1924
1925 /****************************************************************
1926 ****************************************************************/
1927
1928 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
1929 struct libnet_UnjoinCtx *r)
1930 {
1931 saf_delete(r->out.netbios_domain_name);
1932 saf_delete(r->out.dns_domain_name);
1933
1934 return libnet_unjoin_config(r);
1935 }
1936
1937 /****************************************************************
1938 ****************************************************************/
1939
1940 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1941 struct libnet_UnjoinCtx *r)
1942 {
1943 WERROR werr;
1944
1945 if (r->in.debug) {
1946 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
1947 }
1948
1949 werr = libnet_unjoin_pre_processing(mem_ctx, r);
1950 if (!W_ERROR_IS_OK(werr)) {
1951 goto done;
1952 }
1953
1954 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1955 werr = libnet_DomainUnjoin(mem_ctx, r);
1956 if (!W_ERROR_IS_OK(werr)) {
1957 libnet_unjoin_config(r);
1958 goto done;
1959 }
1960 }
1961
1962 werr = libnet_unjoin_post_processing(mem_ctx, r);
1963 if (!W_ERROR_IS_OK(werr)) {
1964 goto done;
1965 }
1966
1967 done:
1968 r->out.result = werr;
1969
1970 if (r->in.debug) {
1971 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
1972 }
1973
1974 return werr;
1975 }
Samba GIT mirror