?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
When doing a cli_ulogoff don't invalidate the cnum, invalidate the vuid.
[Samba.git] / source / libnet / libnet_join.c
blobc13ac9b769e3219c9560f3254f76d2b3cac89237
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23
24 /****************************************************************
25 ****************************************************************/
26
27 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
28 do { \
29 char *str = NULL; \
30 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
31 DEBUG(1,("libnet_Join:\n%s", str)); \
32 TALLOC_FREE(str); \
33 } while (0)
34
35 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
36 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
37 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
38 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
39
40 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
41 do { \
42 char *str = NULL; \
43 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
44 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
45 TALLOC_FREE(str); \
46 } while (0)
47
48 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
49 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
50 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
51 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
52
53 #define W_ERROR_NOT_OK_GOTO_DONE(x) do { \
54 if (!W_ERROR_IS_OK(x)) {\
55 goto done;\
56 }\
57 } while (0)
58
59 /****************************************************************
60 ****************************************************************/
61
62 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
63 struct libnet_JoinCtx *r,
64 const char *format, ...)
65 {
66 va_list args;
67
68 if (r->out.error_string) {
69 return;
70 }
71
72 va_start(args, format);
73 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
74 va_end(args);
75 }
76
77 /****************************************************************
78 ****************************************************************/
79
80 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
81 struct libnet_UnjoinCtx *r,
82 const char *format, ...)
83 {
84 va_list args;
85
86 if (r->out.error_string) {
87 return;
88 }
89
90 va_start(args, format);
91 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
92 va_end(args);
93 }
94
95 #ifdef WITH_ADS
96
97 /****************************************************************
98 ****************************************************************/
99
100 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
101 const char *netbios_domain_name,
102 const char *dc_name,
103 const char *user_name,
104 const char *password,
105 ADS_STRUCT **ads)
106 {
107 ADS_STATUS status;
108 ADS_STRUCT *my_ads = NULL;
109
110 my_ads = ads_init(dns_domain_name,
111 netbios_domain_name,
112 dc_name);
113 if (!my_ads) {
114 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
115 }
116
117 if (user_name) {
118 SAFE_FREE(my_ads->auth.user_name);
119 my_ads->auth.user_name = SMB_STRDUP(user_name);
120 }
121
122 if (password) {
123 SAFE_FREE(my_ads->auth.password);
124 my_ads->auth.password = SMB_STRDUP(password);
125 }
126
127 status = ads_connect(my_ads);
128 if (!ADS_ERR_OK(status)) {
129 ads_destroy(&my_ads);
130 return status;
131 }
132
133 *ads = my_ads;
134 return ADS_SUCCESS;
135 }
136
137 /****************************************************************
138 ****************************************************************/
139
140 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
141 struct libnet_JoinCtx *r)
142 {
143 ADS_STATUS status;
144
145 status = libnet_connect_ads(r->out.dns_domain_name,
146 r->out.netbios_domain_name,
147 r->in.dc_name,
148 r->in.admin_account,
149 r->in.admin_password,
150 &r->in.ads);
151 if (!ADS_ERR_OK(status)) {
152 libnet_join_set_error_string(mem_ctx, r,
153 "failed to connect to AD: %s",
154 ads_errstr(status));
155 return status;
156 }
157
158 if (!r->out.netbios_domain_name) {
159 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
160 r->in.ads->server.workgroup);
161 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
162 }
163
164 if (!r->out.dns_domain_name) {
165 r->out.dns_domain_name = talloc_strdup(mem_ctx,
166 r->in.ads->config.realm);
167 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
168 }
169
170 r->out.domain_is_ad = true;
171
172 return ADS_SUCCESS;
173 }
174
175 /****************************************************************
176 ****************************************************************/
177
178 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
179 struct libnet_UnjoinCtx *r)
180 {
181 ADS_STATUS status;
182
183 status = libnet_connect_ads(r->in.domain_name,
184 r->in.domain_name,
185 r->in.dc_name,
186 r->in.admin_account,
187 r->in.admin_password,
188 &r->in.ads);
189 if (!ADS_ERR_OK(status)) {
190 libnet_unjoin_set_error_string(mem_ctx, r,
191 "failed to connect to AD: %s",
192 ads_errstr(status));
193 }
194
195 return status;
196 }
197
198 /****************************************************************
199 join a domain using ADS (LDAP mods)
200 ****************************************************************/
201
202 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
203 struct libnet_JoinCtx *r)
204 {
205 ADS_STATUS status;
206 LDAPMessage *res = NULL;
207 const char *attrs[] = { "dn", NULL };
208 bool moved = false;
209
210 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
211 if (!ADS_ERR_OK(status)) {
212 return status;
213 }
214
215 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
216 if (!ADS_ERR_OK(status)) {
217 return status;
218 }
219
220 if (ads_count_replies(r->in.ads, res) != 1) {
221 ads_msgfree(r->in.ads, res);
222 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
223 }
224
225 ads_msgfree(r->in.ads, res);
226
227 /* Attempt to create the machine account and bail if this fails.
228 Assume that the admin wants exactly what they requested */
229
230 status = ads_create_machine_acct(r->in.ads,
231 r->in.machine_name,
232 r->in.account_ou);
233
234 if (ADS_ERR_OK(status)) {
235 DEBUG(1,("machine account creation created\n"));
236 return status;
237 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
238 (status.err.rc == LDAP_ALREADY_EXISTS)) {
239 status = ADS_SUCCESS;
240 }
241
242 if (!ADS_ERR_OK(status)) {
243 DEBUG(1,("machine account creation failed\n"));
244 return status;
245 }
246
247 status = ads_move_machine_acct(r->in.ads,
248 r->in.machine_name,
249 r->in.account_ou,
250 &moved);
251 if (!ADS_ERR_OK(status)) {
252 DEBUG(1,("failure to locate/move pre-existing "
253 "machine account\n"));
254 return status;
255 }
256
257 DEBUG(1,("The machine account %s the specified OU.\n",
258 moved ? "was moved into" : "already exists in"));
259
260 return status;
261 }
262
263 /****************************************************************
264 ****************************************************************/
265
266 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
267 struct libnet_UnjoinCtx *r)
268 {
269 ADS_STATUS status;
270
271 if (!r->in.ads) {
272 return libnet_unjoin_connect_ads(mem_ctx, r);
273 }
274
275 status = ads_leave_realm(r->in.ads, r->in.machine_name);
276 if (!ADS_ERR_OK(status)) {
277 libnet_unjoin_set_error_string(mem_ctx, r,
278 "failed to leave realm: %s",
279 ads_errstr(status));
280 return status;
281 }
282
283 return ADS_SUCCESS;
284 }
285
286 /****************************************************************
287 ****************************************************************/
288
289 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
290 struct libnet_JoinCtx *r)
291 {
292 ADS_STATUS status;
293 LDAPMessage *res = NULL;
294 char *dn = NULL;
295
296 if (!r->in.machine_name) {
297 return ADS_ERROR(LDAP_NO_MEMORY);
298 }
299
300 status = ads_find_machine_acct(r->in.ads,
301 &res,
302 r->in.machine_name);
303 if (!ADS_ERR_OK(status)) {
304 return status;
305 }
306
307 if (ads_count_replies(r->in.ads, res) != 1) {
308 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
309 goto done;
310 }
311
312 dn = ads_get_dn(r->in.ads, res);
313 if (!dn) {
314 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
315 goto done;
316 }
317
318 r->out.dn = talloc_strdup(mem_ctx, dn);
319 if (!r->out.dn) {
320 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
321 goto done;
322 }
323
324 done:
325 ads_msgfree(r->in.ads, res);
326 ads_memfree(r->in.ads, dn);
327
328 return status;
329 }
330
331 /****************************************************************
332 Set a machines dNSHostName and servicePrincipalName attributes
333 ****************************************************************/
334
335 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
336 struct libnet_JoinCtx *r)
337 {
338 ADS_STATUS status;
339 ADS_MODLIST mods;
340 fstring my_fqdn;
341 const char *spn_array[3] = {NULL, NULL, NULL};
342 char *spn = NULL;
343
344 /* Find our DN */
345
346 status = libnet_join_find_machine_acct(mem_ctx, r);
347 if (!ADS_ERR_OK(status)) {
348 return status;
349 }
350
351 /* Windows only creates HOST/shortname & HOST/fqdn. */
352
353 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
354 if (!spn) {
355 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
356 }
357 strupper_m(spn);
358 spn_array[0] = spn;
359
360 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
361 || (strchr(my_fqdn, '.') == NULL)) {
362 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
363 r->out.dns_domain_name);
364 }
365
366 strlower_m(my_fqdn);
367
368 if (!strequal(my_fqdn, r->in.machine_name)) {
369 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
370 if (!spn) {
371 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
372 }
373 spn_array[1] = spn;
374 }
375
376 mods = ads_init_mods(mem_ctx);
377 if (!mods) {
378 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
379 }
380
381 /* fields of primary importance */
382
383 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
384 if (!ADS_ERR_OK(status)) {
385 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
386 }
387
388 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
389 spn_array);
390 if (!ADS_ERR_OK(status)) {
391 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
392 }
393
394 return ads_gen_mod(r->in.ads, r->out.dn, mods);
395 }
396
397 /****************************************************************
398 ****************************************************************/
399
400 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
401 struct libnet_JoinCtx *r)
402 {
403 ADS_STATUS status;
404 ADS_MODLIST mods;
405
406 if (!r->in.create_upn) {
407 return ADS_SUCCESS;
408 }
409
410 /* Find our DN */
411
412 status = libnet_join_find_machine_acct(mem_ctx, r);
413 if (!ADS_ERR_OK(status)) {
414 return status;
415 }
416
417 if (!r->in.upn) {
418 r->in.upn = talloc_asprintf(mem_ctx,
419 "host/%s@%s",
420 r->in.machine_name,
421 r->out.dns_domain_name);
422 if (!r->in.upn) {
423 return ADS_ERROR(LDAP_NO_MEMORY);
424 }
425 }
426
427 /* now do the mods */
428
429 mods = ads_init_mods(mem_ctx);
430 if (!mods) {
431 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
432 }
433
434 /* fields of primary importance */
435
436 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
437 if (!ADS_ERR_OK(status)) {
438 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
439 }
440
441 return ads_gen_mod(r->in.ads, r->out.dn, mods);
442 }
443
444
445 /****************************************************************
446 ****************************************************************/
447
448 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
449 struct libnet_JoinCtx *r)
450 {
451 ADS_STATUS status;
452 ADS_MODLIST mods;
453 char *os_sp = NULL;
454
455 if (!r->in.os_name || !r->in.os_version ) {
456 return ADS_SUCCESS;
457 }
458
459 /* Find our DN */
460
461 status = libnet_join_find_machine_acct(mem_ctx, r);
462 if (!ADS_ERR_OK(status)) {
463 return status;
464 }
465
466 /* now do the mods */
467
468 mods = ads_init_mods(mem_ctx);
469 if (!mods) {
470 return ADS_ERROR(LDAP_NO_MEMORY);
471 }
472
473 os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
474 if (!os_sp) {
475 return ADS_ERROR(LDAP_NO_MEMORY);
476 }
477
478 /* fields of primary importance */
479
480 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
481 r->in.os_name);
482 if (!ADS_ERR_OK(status)) {
483 return status;
484 }
485
486 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
487 r->in.os_version);
488 if (!ADS_ERR_OK(status)) {
489 return status;
490 }
491
492 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
493 os_sp);
494 if (!ADS_ERR_OK(status)) {
495 return status;
496 }
497
498 return ads_gen_mod(r->in.ads, r->out.dn, mods);
499 }
500
501 /****************************************************************
502 ****************************************************************/
503
504 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
505 struct libnet_JoinCtx *r)
506 {
507 if (!lp_use_kerberos_keytab()) {
508 return true;
509 }
510
511 if (ads_keytab_create_default(r->in.ads) != 0) {
512 return false;
513 }
514
515 return true;
516 }
517
518 /****************************************************************
519 ****************************************************************/
520
521 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
522 struct libnet_JoinCtx *r)
523 {
524 uint32_t domain_func;
525 ADS_STATUS status;
526 const char *salt = NULL;
527 char *std_salt = NULL;
528
529 status = ads_domain_func_level(r->in.ads, &domain_func);
530 if (!ADS_ERR_OK(status)) {
531 libnet_join_set_error_string(mem_ctx, r,
532 "failed to determine domain functional level: %s",
533 ads_errstr(status));
534 return false;
535 }
536
537 /* go ahead and setup the default salt */
538
539 std_salt = kerberos_standard_des_salt();
540 if (!std_salt) {
541 libnet_join_set_error_string(mem_ctx, r,
542 "failed to obtain standard DES salt");
543 return false;
544 }
545
546 salt = talloc_strdup(mem_ctx, std_salt);
547 if (!salt) {
548 return false;
549 }
550
551 SAFE_FREE(std_salt);
552
553 /* if it's a Windows functional domain, we have to look for the UPN */
554
555 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
556 char *upn;
557
558 upn = ads_get_upn(r->in.ads, mem_ctx,
559 r->in.machine_name);
560 if (upn) {
561 salt = talloc_strdup(mem_ctx, upn);
562 if (!salt) {
563 return false;
564 }
565 }
566 }
567
568 return kerberos_secrets_store_des_salt(salt);
569 }
570
571 /****************************************************************
572 ****************************************************************/
573
574 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
575 struct libnet_JoinCtx *r)
576 {
577 ADS_STATUS status;
578
579 if (!r->in.ads) {
580 status = libnet_join_connect_ads(mem_ctx, r);
581 if (!ADS_ERR_OK(status)) {
582 return status;
583 }
584 }
585
586 status = libnet_join_set_machine_spn(mem_ctx, r);
587 if (!ADS_ERR_OK(status)) {
588 libnet_join_set_error_string(mem_ctx, r,
589 "failed to set machine spn: %s",
590 ads_errstr(status));
591 return status;
592 }
593
594 status = libnet_join_set_os_attributes(mem_ctx, r);
595 if (!ADS_ERR_OK(status)) {
596 libnet_join_set_error_string(mem_ctx, r,
597 "failed to set machine os attributes: %s",
598 ads_errstr(status));
599 return status;
600 }
601
602 status = libnet_join_set_machine_upn(mem_ctx, r);
603 if (!ADS_ERR_OK(status)) {
604 libnet_join_set_error_string(mem_ctx, r,
605 "failed to set machine upn: %s",
606 ads_errstr(status));
607 return status;
608 }
609
610 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
611 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
612 }
613
614 if (!libnet_join_create_keytab(mem_ctx, r)) {
615 libnet_join_set_error_string(mem_ctx, r,
616 "failed to create kerberos keytab");
617 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
618 }
619
620 return ADS_SUCCESS;
621 }
622 #endif /* WITH_ADS */
623
624 /****************************************************************
625 Store the machine password and domain SID
626 ****************************************************************/
627
628 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
629 struct libnet_JoinCtx *r)
630 {
631 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
632 r->out.domain_sid))
633 {
634 DEBUG(1,("Failed to save domain sid\n"));
635 return false;
636 }
637
638 if (!secrets_store_machine_password(r->in.machine_password,
639 r->out.netbios_domain_name,
640 r->in.secure_channel_type))
641 {
642 DEBUG(1,("Failed to save machine password\n"));
643 return false;
644 }
645
646 return true;
647 }
648
649 /****************************************************************
650 Lookup domain dc's info
651 ****************************************************************/
652
653 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
654 struct libnet_JoinCtx *r,
655 struct cli_state **cli)
656 {
657 struct rpc_pipe_client *pipe_hnd = NULL;
658 POLICY_HND lsa_pol;
659 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
660 union lsa_PolicyInformation *info = NULL;
661
662 status = cli_full_connection(cli, NULL,
663 r->in.dc_name,
664 NULL, 0,
665 "IPC$", "IPC",
666 r->in.admin_account,
667 NULL,
668 r->in.admin_password,
669 0,
670 Undefined, NULL);
671
672 if (!NT_STATUS_IS_OK(status)) {
673 goto done;
674 }
675
676 pipe_hnd = cli_rpc_pipe_open_noauth(*cli, PI_LSARPC, &status);
677 if (!pipe_hnd) {
678 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
679 nt_errstr(status)));
680 goto done;
681 }
682
683 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
684 SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
685 if (!NT_STATUS_IS_OK(status)) {
686 goto done;
687 }
688
689 status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
690 &lsa_pol,
691 LSA_POLICY_INFO_DNS,
692 &info);
693 if (NT_STATUS_IS_OK(status)) {
694 r->out.domain_is_ad = true;
695 r->out.netbios_domain_name = info->dns.name.string;
696 r->out.dns_domain_name = info->dns.dns_domain.string;
697 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->dns.sid);
698 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
699 }
700
701 if (!NT_STATUS_IS_OK(status)) {
702 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
703 &lsa_pol,
704 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
705 &info);
706 if (!NT_STATUS_IS_OK(status)) {
707 goto done;
708 }
709
710 r->out.netbios_domain_name = info->account_domain.name.string;
711 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->account_domain.sid);
712 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
713 }
714
715 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
716 cli_rpc_pipe_close(pipe_hnd);
717
718 done:
719 return status;
720 }
721
722 /****************************************************************
723 Do the domain join
724 ****************************************************************/
725
726 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
727 struct libnet_JoinCtx *r,
728 struct cli_state *cli)
729 {
730 struct rpc_pipe_client *pipe_hnd = NULL;
731 POLICY_HND sam_pol, domain_pol, user_pol;
732 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
733 char *acct_name;
734 struct lsa_String lsa_acct_name;
735 uint32_t user_rid;
736 uint32_t acct_flags = ACB_WSTRUST;
737 struct samr_Ids user_rids;
738 struct samr_Ids name_types;
739 union samr_UserInfo user_info;
740
741 struct samr_CryptPassword crypt_pwd;
742 struct samr_CryptPasswordEx crypt_pwd_ex;
743
744 ZERO_STRUCT(sam_pol);
745 ZERO_STRUCT(domain_pol);
746 ZERO_STRUCT(user_pol);
747
748 if (!r->in.machine_password) {
749 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
750 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
751 }
752
753 /* Open the domain */
754
755 pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
756 if (!pipe_hnd) {
757 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
758 nt_errstr(status)));
759 goto done;
760 }
761
762 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
763 pipe_hnd->cli->desthost,
764 SAMR_ACCESS_ENUM_DOMAINS
765 | SAMR_ACCESS_OPEN_DOMAIN,
766 &sam_pol);
767 if (!NT_STATUS_IS_OK(status)) {
768 goto done;
769 }
770
771 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
772 &sam_pol,
773 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
774 | SAMR_DOMAIN_ACCESS_CREATE_USER
775 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
776 r->out.domain_sid,
777 &domain_pol);
778 if (!NT_STATUS_IS_OK(status)) {
779 goto done;
780 }
781
782 /* Create domain user */
783
784 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
785 strlower_m(acct_name);
786
787 init_lsa_String(&lsa_acct_name, acct_name);
788
789 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
790 uint32_t access_desired =
791 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
792 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
793 SAMR_USER_ACCESS_SET_PASSWORD |
794 SAMR_USER_ACCESS_GET_ATTRIBUTES |
795 SAMR_USER_ACCESS_SET_ATTRIBUTES;
796 uint32_t access_granted = 0;
797
798 /* Don't try to set any acct_flags flags other than ACB_WSTRUST */
799
800 DEBUG(10,("Creating account with desired access mask: %d\n",
801 access_desired));
802
803 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
804 &domain_pol,
805 &lsa_acct_name,
806 ACB_WSTRUST,
807 access_desired,
808 &user_pol,
809 &access_granted,
810 &user_rid);
811 if (!NT_STATUS_IS_OK(status) &&
812 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
813
814 DEBUG(10,("Creation of workstation account failed: %s\n",
815 nt_errstr(status)));
816
817 /* If NT_STATUS_ACCESS_DENIED then we have a valid
818 username/password combo but the user does not have
819 administrator access. */
820
821 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
822 libnet_join_set_error_string(mem_ctx, r,
823 "User specified does not have "
824 "administrator privileges");
825 }
826
827 goto done;
828 }
829
830 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
831 if (!(r->in.join_flags &
832 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
833 goto done;
834 }
835 }
836
837 /* We *must* do this.... don't ask... */
838
839 if (NT_STATUS_IS_OK(status)) {
840 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
841 }
842 }
843
844 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
845 &domain_pol,
846 1,
847 &lsa_acct_name,
848 &user_rids,
849 &name_types);
850 if (!NT_STATUS_IS_OK(status)) {
851 goto done;
852 }
853
854 if (name_types.ids[0] != SID_NAME_USER) {
855 DEBUG(0,("%s is not a user account (type=%d)\n",
856 acct_name, name_types.ids[0]));
857 status = NT_STATUS_INVALID_WORKSTATION;
858 goto done;
859 }
860
861 user_rid = user_rids.ids[0];
862
863 /* Open handle on user */
864
865 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
866 &domain_pol,
867 SEC_RIGHTS_MAXIMUM_ALLOWED,
868 user_rid,
869 &user_pol);
870 if (!NT_STATUS_IS_OK(status)) {
871 goto done;
872 }
873
874 /* Fill in the additional account flags now */
875
876 acct_flags |= ACB_PWNOEXP;
877 if (r->out.domain_is_ad) {
878 #if !defined(ENCTYPE_ARCFOUR_HMAC)
879 acct_flags |= ACB_USE_DES_KEY_ONLY;
880 #endif
881 ;;
882 }
883
884 /* Set account flags on machine account */
885 ZERO_STRUCT(user_info.info16);
886 user_info.info16.acct_flags = acct_flags;
887
888 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
889 &user_pol,
890 16,
891 &user_info);
892
893 if (!NT_STATUS_IS_OK(status)) {
894
895 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
896 &user_pol);
897
898 libnet_join_set_error_string(mem_ctx, r,
899 "Failed to set account flags for machine account (%s)\n",
900 nt_errstr(status));
901 goto done;
902 }
903
904 /* Set password on machine account - first try level 26 */
905
906 init_samr_CryptPasswordEx(r->in.machine_password,
907 &cli->user_session_key,
908 &crypt_pwd_ex);
909
910 init_samr_user_info26(&user_info.info26, &crypt_pwd_ex,
911 PASS_DONT_CHANGE_AT_NEXT_LOGON);
912
913 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
914 &user_pol,
915 26,
916 &user_info);
917
918 if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
919
920 /* retry with level 24 */
921
922 init_samr_CryptPassword(r->in.machine_password,
923 &cli->user_session_key,
924 &crypt_pwd);
925
926 init_samr_user_info24(&user_info.info24, &crypt_pwd,
927 PASS_DONT_CHANGE_AT_NEXT_LOGON);
928
929 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
930 &user_pol,
931 24,
932 &user_info);
933 }
934
935 if (!NT_STATUS_IS_OK(status)) {
936
937 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
938 &user_pol);
939
940 libnet_join_set_error_string(mem_ctx, r,
941 "Failed to set password for machine account (%s)\n",
942 nt_errstr(status));
943 goto done;
944 }
945
946 status = NT_STATUS_OK;
947
948 done:
949 if (!pipe_hnd) {
950 return status;
951 }
952
953 if (is_valid_policy_hnd(&sam_pol)) {
954 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
955 }
956 if (is_valid_policy_hnd(&domain_pol)) {
957 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
958 }
959 if (is_valid_policy_hnd(&user_pol)) {
960 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
961 }
962 cli_rpc_pipe_close(pipe_hnd);
963
964 return status;
965 }
966
967 /****************************************************************
968 ****************************************************************/
969
970 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
971 const char *machine_name,
972 const char *dc_name)
973 {
974 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
975 struct cli_state *cli = NULL;
976 struct rpc_pipe_client *pipe_hnd = NULL;
977 struct rpc_pipe_client *netlogon_pipe = NULL;
978 NTSTATUS status;
979 char *machine_password = NULL;
980 char *machine_account = NULL;
981
982 if (!dc_name) {
983 return NT_STATUS_INVALID_PARAMETER;
984 }
985
986 if (!secrets_init()) {
987 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
988 }
989
990 machine_password = secrets_fetch_machine_password(netbios_domain_name,
991 NULL, NULL);
992 if (!machine_password) {
993 return NT_STATUS_NO_TRUST_LSA_SECRET;
994 }
995
996 asprintf(&machine_account, "%s$", machine_name);
997 if (!machine_account) {
998 SAFE_FREE(machine_password);
999 return NT_STATUS_NO_MEMORY;
1000 }
1001
1002 status = cli_full_connection(&cli, NULL,
1003 dc_name,
1004 NULL, 0,
1005 "IPC$", "IPC",
1006 machine_account,
1007 NULL,
1008 machine_password,
1009 0,
1010 Undefined, NULL);
1011 free(machine_account);
1012 free(machine_password);
1013
1014 if (!NT_STATUS_IS_OK(status)) {
1015 status = cli_full_connection(&cli, NULL,
1016 dc_name,
1017 NULL, 0,
1018 "IPC$", "IPC",
1019 "",
1020 NULL,
1021 "",
1022 0,
1023 Undefined, NULL);
1024 }
1025
1026 if (!NT_STATUS_IS_OK(status)) {
1027 return status;
1028 }
1029
1030 netlogon_pipe = get_schannel_session_key(cli,
1031 netbios_domain_name,
1032 &neg_flags, &status);
1033 if (!netlogon_pipe) {
1034 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1035 cli_shutdown(cli);
1036 return NT_STATUS_OK;
1037 }
1038
1039 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1040 "key from server %s for domain %s. Error was %s\n",
1041 cli->desthost, netbios_domain_name, nt_errstr(status)));
1042 cli_shutdown(cli);
1043 return status;
1044 }
1045
1046 if (!lp_client_schannel()) {
1047 cli_shutdown(cli);
1048 return NT_STATUS_OK;
1049 }
1050
1051 pipe_hnd = cli_rpc_pipe_open_schannel_with_key(cli, PI_NETLOGON,
1052 PIPE_AUTH_LEVEL_PRIVACY,
1053 netbios_domain_name,
1054 netlogon_pipe->dc,
1055 &status);
1056
1057 cli_shutdown(cli);
1058
1059 if (!pipe_hnd) {
1060 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1061 "on netlogon pipe to server %s for domain %s. "
1062 "Error was %s\n",
1063 cli->desthost, netbios_domain_name, nt_errstr(status)));
1064 return status;
1065 }
1066
1067 return NT_STATUS_OK;
1068 }
1069
1070 /****************************************************************
1071 ****************************************************************/
1072
1073 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1074 struct libnet_JoinCtx *r)
1075 {
1076 NTSTATUS status;
1077
1078 status = libnet_join_ok(r->out.netbios_domain_name,
1079 r->in.machine_name,
1080 r->in.dc_name);
1081 if (!NT_STATUS_IS_OK(status)) {
1082 libnet_join_set_error_string(mem_ctx, r,
1083 "failed to verify domain membership after joining: %s",
1084 get_friendly_nt_error_msg(status));
1085 return WERR_SETUP_NOT_JOINED;
1086 }
1087
1088 return WERR_OK;
1089 }
1090
1091 /****************************************************************
1092 ****************************************************************/
1093
1094 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1095 struct libnet_UnjoinCtx *r)
1096 {
1097 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1098 return false;
1099 }
1100
1101 if (!secrets_delete_domain_sid(lp_workgroup())) {
1102 return false;
1103 }
1104
1105 return true;
1106 }
1107
1108 /****************************************************************
1109 ****************************************************************/
1110
1111 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1112 struct libnet_UnjoinCtx *r)
1113 {
1114 struct cli_state *cli = NULL;
1115 struct rpc_pipe_client *pipe_hnd = NULL;
1116 POLICY_HND sam_pol, domain_pol, user_pol;
1117 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1118 char *acct_name;
1119 uint32_t user_rid;
1120 struct lsa_String lsa_acct_name;
1121 struct samr_Ids user_rids;
1122 struct samr_Ids name_types;
1123 union samr_UserInfo *info = NULL;
1124
1125 ZERO_STRUCT(sam_pol);
1126 ZERO_STRUCT(domain_pol);
1127 ZERO_STRUCT(user_pol);
1128
1129 status = cli_full_connection(&cli, NULL,
1130 r->in.dc_name,
1131 NULL, 0,
1132 "IPC$", "IPC",
1133 r->in.admin_account,
1134 NULL,
1135 r->in.admin_password,
1136 0, Undefined, NULL);
1137
1138 if (!NT_STATUS_IS_OK(status)) {
1139 goto done;
1140 }
1141
1142 /* Open the domain */
1143
1144 pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
1145 if (!pipe_hnd) {
1146 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1147 nt_errstr(status)));
1148 goto done;
1149 }
1150
1151 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1152 pipe_hnd->cli->desthost,
1153 SEC_RIGHTS_MAXIMUM_ALLOWED,
1154 &sam_pol);
1155 if (!NT_STATUS_IS_OK(status)) {
1156 goto done;
1157 }
1158
1159 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1160 &sam_pol,
1161 SEC_RIGHTS_MAXIMUM_ALLOWED,
1162 r->in.domain_sid,
1163 &domain_pol);
1164 if (!NT_STATUS_IS_OK(status)) {
1165 goto done;
1166 }
1167
1168 /* Create domain user */
1169
1170 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1171 strlower_m(acct_name);
1172
1173 init_lsa_String(&lsa_acct_name, acct_name);
1174
1175 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1176 &domain_pol,
1177 1,
1178 &lsa_acct_name,
1179 &user_rids,
1180 &name_types);
1181
1182 if (!NT_STATUS_IS_OK(status)) {
1183 goto done;
1184 }
1185
1186 if (name_types.ids[0] != SID_NAME_USER) {
1187 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1188 name_types.ids[0]));
1189 status = NT_STATUS_INVALID_WORKSTATION;
1190 goto done;
1191 }
1192
1193 user_rid = user_rids.ids[0];
1194
1195 /* Open handle on user */
1196
1197 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1198 &domain_pol,
1199 SEC_RIGHTS_MAXIMUM_ALLOWED,
1200 user_rid,
1201 &user_pol);
1202 if (!NT_STATUS_IS_OK(status)) {
1203 goto done;
1204 }
1205
1206 /* Get user info */
1207
1208 status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1209 &user_pol,
1210 16,
1211 &info);
1212 if (!NT_STATUS_IS_OK(status)) {
1213 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1214 goto done;
1215 }
1216
1217 /* now disable and setuser info */
1218
1219 info->info16.acct_flags |= ACB_DISABLED;
1220
1221 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1222 &user_pol,
1223 16,
1224 info);
1225
1226 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1227
1228 done:
1229 if (pipe_hnd) {
1230 if (is_valid_policy_hnd(&domain_pol)) {
1231 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1232 }
1233 if (is_valid_policy_hnd(&sam_pol)) {
1234 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1235 }
1236 cli_rpc_pipe_close(pipe_hnd);
1237 }
1238
1239 if (cli) {
1240 cli_shutdown(cli);
1241 }
1242
1243 return status;
1244 }
1245
1246 /****************************************************************
1247 ****************************************************************/
1248
1249 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1250 {
1251 WERROR werr;
1252 struct smbconf_ctx *ctx;
1253
1254 werr = smbconf_init_reg(r, &ctx, NULL);
1255 if (!W_ERROR_IS_OK(werr)) {
1256 goto done;
1257 }
1258
1259 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1260
1261 werr = smbconf_set_global_parameter(ctx, "security", "user");
1262 W_ERROR_NOT_OK_GOTO_DONE(werr);
1263
1264 werr = smbconf_set_global_parameter(ctx, "workgroup",
1265 r->in.domain_name);
1266
1267 smbconf_delete_global_parameter(ctx, "realm");
1268 goto done;
1269 }
1270
1271 werr = smbconf_set_global_parameter(ctx, "security", "domain");
1272 W_ERROR_NOT_OK_GOTO_DONE(werr);
1273
1274 werr = smbconf_set_global_parameter(ctx, "workgroup",
1275 r->out.netbios_domain_name);
1276 W_ERROR_NOT_OK_GOTO_DONE(werr);
1277
1278 if (r->out.domain_is_ad) {
1279 werr = smbconf_set_global_parameter(ctx, "security", "ads");
1280 W_ERROR_NOT_OK_GOTO_DONE(werr);
1281
1282 werr = smbconf_set_global_parameter(ctx, "realm",
1283 r->out.dns_domain_name);
1284 W_ERROR_NOT_OK_GOTO_DONE(werr);
1285 }
1286
1287 done:
1288 smbconf_shutdown(ctx);
1289 return werr;
1290 }
1291
1292 /****************************************************************
1293 ****************************************************************/
1294
1295 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1296 {
1297 WERROR werr = WERR_OK;
1298 struct smbconf_ctx *ctx;
1299
1300 werr = smbconf_init_reg(r, &ctx, NULL);
1301 if (!W_ERROR_IS_OK(werr)) {
1302 goto done;
1303 }
1304
1305 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1306
1307 werr = smbconf_set_global_parameter(ctx, "security", "user");
1308 W_ERROR_NOT_OK_GOTO_DONE(werr);
1309
1310 werr = smbconf_delete_global_parameter(ctx, "workgroup");
1311 W_ERROR_NOT_OK_GOTO_DONE(werr);
1312
1313 smbconf_delete_global_parameter(ctx, "realm");
1314 }
1315
1316 done:
1317 smbconf_shutdown(ctx);
1318 return werr;
1319 }
1320
1321 /****************************************************************
1322 ****************************************************************/
1323
1324 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1325 {
1326 WERROR werr;
1327
1328 if (!W_ERROR_IS_OK(r->out.result)) {
1329 return r->out.result;
1330 }
1331
1332 if (!r->in.modify_config) {
1333 return WERR_OK;
1334 }
1335
1336 werr = do_join_modify_vals_config(r);
1337 if (!W_ERROR_IS_OK(werr)) {
1338 return werr;
1339 }
1340
1341 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1342
1343 r->out.modified_config = true;
1344 r->out.result = werr;
1345
1346 return werr;
1347 }
1348
1349 /****************************************************************
1350 ****************************************************************/
1351
1352 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1353 {
1354 WERROR werr;
1355
1356 if (!W_ERROR_IS_OK(r->out.result)) {
1357 return r->out.result;
1358 }
1359
1360 if (!r->in.modify_config) {
1361 return WERR_OK;
1362 }
1363
1364 werr = do_unjoin_modify_vals_config(r);
1365 if (!W_ERROR_IS_OK(werr)) {
1366 return werr;
1367 }
1368
1369 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1370
1371 r->out.modified_config = true;
1372 r->out.result = werr;
1373
1374 return werr;
1375 }
1376
1377 /****************************************************************
1378 ****************************************************************/
1379
1380 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1381 const char *domain_str,
1382 const char **domain_p,
1383 const char **dc_p)
1384 {
1385 char *domain = NULL;
1386 char *dc = NULL;
1387 const char *p = NULL;
1388
1389 if (!domain_str || !domain_p || !dc_p) {
1390 return false;
1391 }
1392
1393 p = strchr_m(domain_str, '\\');
1394
1395 if (p != NULL) {
1396 domain = talloc_strndup(mem_ctx, domain_str,
1397 PTR_DIFF(p, domain_str));
1398 dc = talloc_strdup(mem_ctx, p+1);
1399 if (!dc) {
1400 return false;
1401 }
1402 } else {
1403 domain = talloc_strdup(mem_ctx, domain_str);
1404 dc = NULL;
1405 }
1406 if (!domain) {
1407 return false;
1408 }
1409
1410 *domain_p = domain;
1411
1412 if (!*dc_p && dc) {
1413 *dc_p = dc;
1414 }
1415
1416 return true;
1417 }
1418
1419 /****************************************************************
1420 ****************************************************************/
1421
1422 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1423 struct libnet_JoinCtx *r)
1424 {
1425 if (!r->in.domain_name) {
1426 libnet_join_set_error_string(mem_ctx, r,
1427 "No domain name defined");
1428 return WERR_INVALID_PARAM;
1429 }
1430
1431 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1432 &r->in.domain_name,
1433 &r->in.dc_name)) {
1434 libnet_join_set_error_string(mem_ctx, r,
1435 "Failed to parse domain name");
1436 return WERR_INVALID_PARAM;
1437 }
1438
1439 if (IS_DC) {
1440 return WERR_SETUP_DOMAIN_CONTROLLER;
1441 }
1442
1443 if (!secrets_init()) {
1444 libnet_join_set_error_string(mem_ctx, r,
1445 "Unable to open secrets database");
1446 return WERR_CAN_NOT_COMPLETE;
1447 }
1448
1449 return WERR_OK;
1450 }
1451
1452 /****************************************************************
1453 ****************************************************************/
1454
1455 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1456 struct libnet_JoinCtx *r)
1457 {
1458 WERROR werr;
1459
1460 if (!W_ERROR_IS_OK(r->out.result)) {
1461 return r->out.result;
1462 }
1463
1464 werr = do_JoinConfig(r);
1465 if (!W_ERROR_IS_OK(werr)) {
1466 return werr;
1467 }
1468
1469 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1470 return WERR_OK;
1471 }
1472
1473 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1474 if (r->out.dns_domain_name) {
1475 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1476 }
1477
1478 #ifdef WITH_ADS
1479 if (r->out.domain_is_ad) {
1480 ADS_STATUS ads_status;
1481
1482 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1483 if (!ADS_ERR_OK(ads_status)) {
1484 return WERR_GENERAL_FAILURE;
1485 }
1486 }
1487 #endif /* WITH_ADS */
1488
1489 return WERR_OK;
1490 }
1491
1492 /****************************************************************
1493 ****************************************************************/
1494
1495 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1496 {
1497 const char *krb5_cc_env = NULL;
1498
1499 if (r->in.ads) {
1500 ads_destroy(&r->in.ads);
1501 }
1502
1503 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1504 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1505 unsetenv(KRB5_ENV_CCNAME);
1506 }
1507
1508 return 0;
1509 }
1510
1511 /****************************************************************
1512 ****************************************************************/
1513
1514 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1515 {
1516 const char *krb5_cc_env = NULL;
1517
1518 if (r->in.ads) {
1519 ads_destroy(&r->in.ads);
1520 }
1521
1522 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1523 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1524 unsetenv(KRB5_ENV_CCNAME);
1525 }
1526
1527 return 0;
1528 }
1529
1530 /****************************************************************
1531 ****************************************************************/
1532
1533 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1534 struct libnet_JoinCtx **r)
1535 {
1536 struct libnet_JoinCtx *ctx;
1537 const char *krb5_cc_env = NULL;
1538
1539 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1540 if (!ctx) {
1541 return WERR_NOMEM;
1542 }
1543
1544 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1545
1546 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1547 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1548
1549 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1550 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1551 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1552 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1553 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1554 }
1555
1556 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1557
1558 *r = ctx;
1559
1560 return WERR_OK;
1561 }
1562
1563 /****************************************************************
1564 ****************************************************************/
1565
1566 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1567 struct libnet_UnjoinCtx **r)
1568 {
1569 struct libnet_UnjoinCtx *ctx;
1570 const char *krb5_cc_env = NULL;
1571
1572 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1573 if (!ctx) {
1574 return WERR_NOMEM;
1575 }
1576
1577 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1578
1579 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1580 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1581
1582 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1583 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1584 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1585 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1586 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1587 }
1588
1589 *r = ctx;
1590
1591 return WERR_OK;
1592 }
1593
1594 /****************************************************************
1595 ****************************************************************/
1596
1597 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1598 struct libnet_JoinCtx *r)
1599 {
1600 /* check if configuration is already set correctly */
1601
1602 switch (r->out.domain_is_ad) {
1603 case false:
1604 if ((strequal(lp_workgroup(),
1605 r->out.netbios_domain_name)) &&
1606 (lp_security() == SEC_DOMAIN)) {
1607 /* nothing to be done */
1608 return WERR_OK;
1609 }
1610 break;
1611 case true:
1612 if ((strequal(lp_workgroup(),
1613 r->out.netbios_domain_name)) &&
1614 (strequal(lp_realm(),
1615 r->out.dns_domain_name)) &&
1616 ((lp_security() == SEC_ADS) ||
1617 (lp_security() == SEC_DOMAIN))) {
1618 /* nothing to be done */
1619 return WERR_OK;
1620 }
1621 break;
1622 }
1623
1624 /* check if we are supposed to manipulate configuration */
1625
1626 if (!r->in.modify_config) {
1627 libnet_join_set_error_string(mem_ctx, r,
1628 "Invalid configuration and configuration modification "
1629 "was not requested");
1630 return WERR_CAN_NOT_COMPLETE;
1631 }
1632
1633 /* check if we are able to manipulate configuration */
1634
1635 if (!lp_config_backend_is_registry()) {
1636 libnet_join_set_error_string(mem_ctx, r,
1637 "Configuration manipulation requested but not "
1638 "supported by backend");
1639 return WERR_NOT_SUPPORTED;
1640 }
1641
1642 return WERR_OK;
1643 }
1644
1645 /****************************************************************
1646 ****************************************************************/
1647
1648 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1649 struct libnet_JoinCtx *r)
1650 {
1651 NTSTATUS status;
1652 WERROR werr;
1653 struct cli_state *cli = NULL;
1654 #ifdef WITH_ADS
1655 ADS_STATUS ads_status;
1656 #endif /* WITH_ADS */
1657
1658 if (!r->in.dc_name) {
1659 struct netr_DsRGetDCNameInfo *info;
1660 const char *dc;
1661 status = dsgetdcname(mem_ctx,
1662 r->in.msg_ctx,
1663 r->in.domain_name,
1664 NULL,
1665 NULL,
1666 DS_FORCE_REDISCOVERY |
1667 DS_DIRECTORY_SERVICE_REQUIRED |
1668 DS_WRITABLE_REQUIRED |
1669 DS_RETURN_DNS_NAME,
1670 &info);
1671 if (!NT_STATUS_IS_OK(status)) {
1672 libnet_join_set_error_string(mem_ctx, r,
1673 "failed to find DC for domain %s",
1674 r->in.domain_name,
1675 get_friendly_nt_error_msg(status));
1676 return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1677 }
1678
1679 dc = strip_hostname(info->dc_unc);
1680 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1681 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1682 }
1683
1684 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1685 if (!NT_STATUS_IS_OK(status)) {
1686 libnet_join_set_error_string(mem_ctx, r,
1687 "failed to lookup DC info for domain '%s' over rpc: %s",
1688 r->in.domain_name, get_friendly_nt_error_msg(status));
1689 return ntstatus_to_werror(status);
1690 }
1691
1692 werr = libnet_join_check_config(mem_ctx, r);
1693 if (!W_ERROR_IS_OK(werr)) {
1694 goto done;
1695 }
1696
1697 #ifdef WITH_ADS
1698 if (r->out.domain_is_ad && r->in.account_ou) {
1699
1700 ads_status = libnet_join_connect_ads(mem_ctx, r);
1701 if (!ADS_ERR_OK(ads_status)) {
1702 return WERR_DEFAULT_JOIN_REQUIRED;
1703 }
1704
1705 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1706 if (!ADS_ERR_OK(ads_status)) {
1707 libnet_join_set_error_string(mem_ctx, r,
1708 "failed to precreate account in ou %s: %s",
1709 r->in.account_ou,
1710 ads_errstr(ads_status));
1711 return WERR_DEFAULT_JOIN_REQUIRED;
1712 }
1713
1714 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1715 }
1716 #endif /* WITH_ADS */
1717
1718 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
1719 if (!NT_STATUS_IS_OK(status)) {
1720 libnet_join_set_error_string(mem_ctx, r,
1721 "failed to join domain '%s' over rpc: %s",
1722 r->in.domain_name, get_friendly_nt_error_msg(status));
1723 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1724 return WERR_SETUP_ALREADY_JOINED;
1725 }
1726 werr = ntstatus_to_werror(status);
1727 goto done;
1728 }
1729
1730 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1731 werr = WERR_SETUP_NOT_JOINED;
1732 goto done;
1733 }
1734
1735 werr = WERR_OK;
1736
1737 done:
1738 if (cli) {
1739 cli_shutdown(cli);
1740 }
1741
1742 return werr;
1743 }
1744
1745 /****************************************************************
1746 ****************************************************************/
1747
1748 WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
1749 struct libnet_JoinCtx *r)
1750 {
1751 WERROR werr;
1752 struct libnet_UnjoinCtx *u = NULL;
1753
1754 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
1755 if (!W_ERROR_IS_OK(werr)) {
1756 return werr;
1757 }
1758
1759 u->in.debug = r->in.debug;
1760 u->in.dc_name = r->in.dc_name;
1761 u->in.domain_name = r->in.domain_name;
1762 u->in.admin_account = r->in.admin_account;
1763 u->in.admin_password = r->in.admin_password;
1764 u->in.modify_config = r->in.modify_config;
1765 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1766 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
1767
1768 werr = libnet_Unjoin(mem_ctx, u);
1769 TALLOC_FREE(u);
1770
1771 return werr;
1772 }
1773
1774 /****************************************************************
1775 ****************************************************************/
1776
1777 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1778 struct libnet_JoinCtx *r)
1779 {
1780 WERROR werr;
1781
1782 if (r->in.debug) {
1783 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1784 }
1785
1786 werr = libnet_join_pre_processing(mem_ctx, r);
1787 if (!W_ERROR_IS_OK(werr)) {
1788 goto done;
1789 }
1790
1791 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1792 werr = libnet_DomainJoin(mem_ctx, r);
1793 if (!W_ERROR_IS_OK(werr)) {
1794 goto done;
1795 }
1796 }
1797
1798 werr = libnet_join_post_processing(mem_ctx, r);
1799 if (!W_ERROR_IS_OK(werr)) {
1800 goto done;
1801 }
1802
1803 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1804 werr = libnet_join_post_verify(mem_ctx, r);
1805 if (!W_ERROR_IS_OK(werr)) {
1806 libnet_join_rollback(mem_ctx, r);
1807 }
1808 }
1809
1810 done:
1811 r->out.result = werr;
1812
1813 if (r->in.debug) {
1814 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1815 }
1816 return werr;
1817 }
1818
1819 /****************************************************************
1820 ****************************************************************/
1821
1822 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1823 struct libnet_UnjoinCtx *r)
1824 {
1825 NTSTATUS status;
1826
1827 if (!r->in.domain_sid) {
1828 struct dom_sid sid;
1829 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1830 libnet_unjoin_set_error_string(mem_ctx, r,
1831 "Unable to fetch domain sid: are we joined?");
1832 return WERR_SETUP_NOT_JOINED;
1833 }
1834 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
1835 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
1836 }
1837
1838 if (!r->in.dc_name) {
1839 struct netr_DsRGetDCNameInfo *info;
1840 const char *dc;
1841 status = dsgetdcname(mem_ctx,
1842 r->in.msg_ctx,
1843 r->in.domain_name,
1844 NULL,
1845 NULL,
1846 DS_DIRECTORY_SERVICE_REQUIRED |
1847 DS_WRITABLE_REQUIRED |
1848 DS_RETURN_DNS_NAME,
1849 &info);
1850 if (!NT_STATUS_IS_OK(status)) {
1851 libnet_unjoin_set_error_string(mem_ctx, r,
1852 "failed to find DC for domain %s",
1853 r->in.domain_name,
1854 get_friendly_nt_error_msg(status));
1855 return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1856 }
1857
1858 dc = strip_hostname(info->dc_unc);
1859 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1860 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1861 }
1862
1863 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1864 if (!NT_STATUS_IS_OK(status)) {
1865 libnet_unjoin_set_error_string(mem_ctx, r,
1866 "failed to disable machine account via rpc: %s",
1867 get_friendly_nt_error_msg(status));
1868 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1869 return WERR_SETUP_NOT_JOINED;
1870 }
1871 return ntstatus_to_werror(status);
1872 }
1873
1874 r->out.disabled_machine_account = true;
1875
1876 #ifdef WITH_ADS
1877 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1878 ADS_STATUS ads_status;
1879 libnet_unjoin_connect_ads(mem_ctx, r);
1880 ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
1881 if (!ADS_ERR_OK(ads_status)) {
1882 libnet_unjoin_set_error_string(mem_ctx, r,
1883 "failed to remove machine account from AD: %s",
1884 ads_errstr(ads_status));
1885 } else {
1886 r->out.deleted_machine_account = true;
1887 /* dirty hack */
1888 r->out.dns_domain_name = talloc_strdup(mem_ctx,
1889 r->in.ads->server.realm);
1890 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
1891 }
1892 }
1893 #endif /* WITH_ADS */
1894
1895 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1896
1897 return WERR_OK;
1898 }
1899
1900 /****************************************************************
1901 ****************************************************************/
1902
1903 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
1904 struct libnet_UnjoinCtx *r)
1905 {
1906 if (!r->in.domain_name) {
1907 libnet_unjoin_set_error_string(mem_ctx, r,
1908 "No domain name defined");
1909 return WERR_INVALID_PARAM;
1910 }
1911
1912 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1913 &r->in.domain_name,
1914 &r->in.dc_name)) {
1915 libnet_unjoin_set_error_string(mem_ctx, r,
1916 "Failed to parse domain name");
1917 return WERR_INVALID_PARAM;
1918 }
1919
1920 if (IS_DC) {
1921 return WERR_SETUP_DOMAIN_CONTROLLER;
1922 }
1923
1924 if (!secrets_init()) {
1925 libnet_unjoin_set_error_string(mem_ctx, r,
1926 "Unable to open secrets database");
1927 return WERR_CAN_NOT_COMPLETE;
1928 }
1929
1930 return WERR_OK;
1931 }
1932
1933 /****************************************************************
1934 ****************************************************************/
1935
1936 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
1937 struct libnet_UnjoinCtx *r)
1938 {
1939 saf_delete(r->out.netbios_domain_name);
1940 saf_delete(r->out.dns_domain_name);
1941
1942 return libnet_unjoin_config(r);
1943 }
1944
1945 /****************************************************************
1946 ****************************************************************/
1947
1948 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1949 struct libnet_UnjoinCtx *r)
1950 {
1951 WERROR werr;
1952
1953 if (r->in.debug) {
1954 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
1955 }
1956
1957 werr = libnet_unjoin_pre_processing(mem_ctx, r);
1958 if (!W_ERROR_IS_OK(werr)) {
1959 goto done;
1960 }
1961
1962 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1963 werr = libnet_DomainUnjoin(mem_ctx, r);
1964 if (!W_ERROR_IS_OK(werr)) {
1965 libnet_unjoin_config(r);
1966 goto done;
1967 }
1968 }
1969
1970 werr = libnet_unjoin_post_processing(mem_ctx, r);
1971 if (!W_ERROR_IS_OK(werr)) {
1972 goto done;
1973 }
1974
1975 done:
1976 r->out.result = werr;
1977
1978 if (r->in.debug) {
1979 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
1980 }
1981
1982 return werr;
1983 }
Samba GIT mirror