?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:registry/regfio read SD from the correct location
[Samba.git] / source3 / libnet / libnet_join.c
blobdcb04dbb588e32fb15f4080c380445380c2b02f3
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "ads.h"
23 #include "librpc/gen_ndr/ndr_libnet_join.h"
24 #include "libnet/libnet_join.h"
25 #include "libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/ndr_samr_c.h"
27 #include "rpc_client/init_samr.h"
28 #include "../librpc/gen_ndr/ndr_lsa_c.h"
29 #include "rpc_client/cli_lsarpc.h"
30 #include "../librpc/gen_ndr/ndr_netlogon.h"
31 #include "rpc_client/cli_netlogon.h"
32 #include "lib/smbconf/smbconf.h"
33 #include "lib/smbconf/smbconf_reg.h"
34 #include "../libds/common/flags.h"
35 #include "secrets.h"
36 #include "rpc_client/init_lsa.h"
37 #include "rpc_client/cli_pipe.h"
38 #include "../libcli/security/security.h"
39 #include "passdb.h"
40 #include "libsmb/libsmb.h"
41 #include "../libcli/smb/smbXcli_base.h"
42 #include "lib/param/loadparm.h"
43
44 /****************************************************************
45 ****************************************************************/
46
47 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
48 do { \
49 char *str = NULL; \
50 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
51 DEBUG(1,("libnet_Join:\n%s", str)); \
52 TALLOC_FREE(str); \
53 } while (0)
54
55 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
56 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
57 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
58 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
59
60 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
61 do { \
62 char *str = NULL; \
63 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
64 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
65 TALLOC_FREE(str); \
66 } while (0)
67
68 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
69 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
70 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
71 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
72
73 /****************************************************************
74 ****************************************************************/
75
76 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
77 struct libnet_JoinCtx *r,
78 const char *format, ...)
79 {
80 va_list args;
81
82 if (r->out.error_string) {
83 return;
84 }
85
86 va_start(args, format);
87 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
88 va_end(args);
89 }
90
91 /****************************************************************
92 ****************************************************************/
93
94 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
95 struct libnet_UnjoinCtx *r,
96 const char *format, ...)
97 {
98 va_list args;
99
100 if (r->out.error_string) {
101 return;
102 }
103
104 va_start(args, format);
105 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
106 va_end(args);
107 }
108
109 #ifdef HAVE_ADS
110
111 /****************************************************************
112 ****************************************************************/
113
114 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
115 const char *netbios_domain_name,
116 const char *dc_name,
117 const char *user_name,
118 const char *password,
119 ADS_STRUCT **ads)
120 {
121 ADS_STATUS status;
122 ADS_STRUCT *my_ads = NULL;
123 char *cp;
124
125 my_ads = ads_init(dns_domain_name,
126 netbios_domain_name,
127 dc_name);
128 if (!my_ads) {
129 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
130 }
131
132 if (user_name) {
133 SAFE_FREE(my_ads->auth.user_name);
134 my_ads->auth.user_name = SMB_STRDUP(user_name);
135 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
136 *cp++ = '\0';
137 SAFE_FREE(my_ads->auth.realm);
138 my_ads->auth.realm = smb_xstrdup(cp);
139 if (!strupper_m(my_ads->auth.realm)) {
140 ads_destroy(&my_ads);
141 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
142 }
143 }
144 }
145
146 if (password) {
147 SAFE_FREE(my_ads->auth.password);
148 my_ads->auth.password = SMB_STRDUP(password);
149 }
150
151 status = ads_connect_user_creds(my_ads);
152 if (!ADS_ERR_OK(status)) {
153 ads_destroy(&my_ads);
154 return status;
155 }
156
157 *ads = my_ads;
158 return ADS_SUCCESS;
159 }
160
161 /****************************************************************
162 ****************************************************************/
163
164 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
165 struct libnet_JoinCtx *r)
166 {
167 ADS_STATUS status;
168
169 status = libnet_connect_ads(r->out.dns_domain_name,
170 r->out.netbios_domain_name,
171 r->in.dc_name,
172 r->in.admin_account,
173 r->in.admin_password,
174 &r->in.ads);
175 if (!ADS_ERR_OK(status)) {
176 libnet_join_set_error_string(mem_ctx, r,
177 "failed to connect to AD: %s",
178 ads_errstr(status));
179 return status;
180 }
181
182 if (!r->out.netbios_domain_name) {
183 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
184 r->in.ads->server.workgroup);
185 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
186 }
187
188 if (!r->out.dns_domain_name) {
189 r->out.dns_domain_name = talloc_strdup(mem_ctx,
190 r->in.ads->config.realm);
191 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
192 }
193
194 r->out.domain_is_ad = true;
195
196 return ADS_SUCCESS;
197 }
198
199 /****************************************************************
200 ****************************************************************/
201
202 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
203 struct libnet_UnjoinCtx *r)
204 {
205 ADS_STATUS status;
206
207 status = libnet_connect_ads(r->in.domain_name,
208 r->in.domain_name,
209 r->in.dc_name,
210 r->in.admin_account,
211 r->in.admin_password,
212 &r->in.ads);
213 if (!ADS_ERR_OK(status)) {
214 libnet_unjoin_set_error_string(mem_ctx, r,
215 "failed to connect to AD: %s",
216 ads_errstr(status));
217 }
218
219 return status;
220 }
221
222 /****************************************************************
223 join a domain using ADS (LDAP mods)
224 ****************************************************************/
225
226 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
227 struct libnet_JoinCtx *r)
228 {
229 ADS_STATUS status;
230 LDAPMessage *res = NULL;
231 const char *attrs[] = { "dn", NULL };
232 bool moved = false;
233
234 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
235 if (!ADS_ERR_OK(status)) {
236 return status;
237 }
238
239 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
240 if (!ADS_ERR_OK(status)) {
241 return status;
242 }
243
244 if (ads_count_replies(r->in.ads, res) != 1) {
245 ads_msgfree(r->in.ads, res);
246 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
247 }
248
249 ads_msgfree(r->in.ads, res);
250
251 /* Attempt to create the machine account and bail if this fails.
252 Assume that the admin wants exactly what they requested */
253
254 status = ads_create_machine_acct(r->in.ads,
255 r->in.machine_name,
256 r->in.account_ou);
257
258 if (ADS_ERR_OK(status)) {
259 DEBUG(1,("machine account creation created\n"));
260 return status;
261 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
262 (status.err.rc == LDAP_ALREADY_EXISTS)) {
263 status = ADS_SUCCESS;
264 }
265
266 if (!ADS_ERR_OK(status)) {
267 DEBUG(1,("machine account creation failed\n"));
268 return status;
269 }
270
271 status = ads_move_machine_acct(r->in.ads,
272 r->in.machine_name,
273 r->in.account_ou,
274 &moved);
275 if (!ADS_ERR_OK(status)) {
276 DEBUG(1,("failure to locate/move pre-existing "
277 "machine account\n"));
278 return status;
279 }
280
281 DEBUG(1,("The machine account %s the specified OU.\n",
282 moved ? "was moved into" : "already exists in"));
283
284 return status;
285 }
286
287 /****************************************************************
288 ****************************************************************/
289
290 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
291 struct libnet_UnjoinCtx *r)
292 {
293 ADS_STATUS status;
294
295 if (!r->in.ads) {
296 status = libnet_unjoin_connect_ads(mem_ctx, r);
297 if (!ADS_ERR_OK(status)) {
298 libnet_unjoin_set_error_string(mem_ctx, r,
299 "failed to connect to AD: %s",
300 ads_errstr(status));
301 return status;
302 }
303 }
304
305 status = ads_leave_realm(r->in.ads, r->in.machine_name);
306 if (!ADS_ERR_OK(status)) {
307 libnet_unjoin_set_error_string(mem_ctx, r,
308 "failed to leave realm: %s",
309 ads_errstr(status));
310 return status;
311 }
312
313 return ADS_SUCCESS;
314 }
315
316 /****************************************************************
317 ****************************************************************/
318
319 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
320 struct libnet_JoinCtx *r)
321 {
322 ADS_STATUS status;
323 LDAPMessage *res = NULL;
324 char *dn = NULL;
325
326 if (!r->in.machine_name) {
327 return ADS_ERROR(LDAP_NO_MEMORY);
328 }
329
330 status = ads_find_machine_acct(r->in.ads,
331 &res,
332 r->in.machine_name);
333 if (!ADS_ERR_OK(status)) {
334 return status;
335 }
336
337 if (ads_count_replies(r->in.ads, res) != 1) {
338 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
339 goto done;
340 }
341
342 dn = ads_get_dn(r->in.ads, mem_ctx, res);
343 if (!dn) {
344 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
345 goto done;
346 }
347
348 r->out.dn = talloc_strdup(mem_ctx, dn);
349 if (!r->out.dn) {
350 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
351 goto done;
352 }
353
354 done:
355 ads_msgfree(r->in.ads, res);
356 TALLOC_FREE(dn);
357
358 return status;
359 }
360
361 static ADS_STATUS libnet_join_get_machine_spns(TALLOC_CTX *mem_ctx,
362 struct libnet_JoinCtx *r,
363 char ***spn_array,
364 size_t *num_spns)
365 {
366 ADS_STATUS status;
367
368 if (r->in.machine_name == NULL) {
369 return ADS_ERROR_SYSTEM(EINVAL);
370 }
371
372 status = ads_get_service_principal_names(mem_ctx,
373 r->in.ads,
374 r->in.machine_name,
375 spn_array,
376 num_spns);
377
378 return status;
379 }
380
381 /****************************************************************
382 Set a machines dNSHostName and servicePrincipalName attributes
383 ****************************************************************/
384
385 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
386 struct libnet_JoinCtx *r)
387 {
388 ADS_STATUS status;
389 ADS_MODLIST mods;
390 fstring my_fqdn;
391 const char **spn_array = NULL;
392 size_t num_spns = 0;
393 char *spn = NULL;
394 bool ok;
395
396 /* Find our DN */
397
398 status = libnet_join_find_machine_acct(mem_ctx, r);
399 if (!ADS_ERR_OK(status)) {
400 return status;
401 }
402
403 status = libnet_join_get_machine_spns(mem_ctx,
404 r,
405 discard_const_p(char **, &spn_array),
406 &num_spns);
407 if (!ADS_ERR_OK(status)) {
408 DEBUG(5, ("Retrieving the servicePrincipalNames failed.\n"));
409 }
410
411 /* Windows only creates HOST/shortname & HOST/fqdn. */
412
413 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
414 if (!spn) {
415 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
416 }
417 if (!strupper_m(spn)) {
418 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
419 }
420
421 ok = ads_element_in_array(spn_array, num_spns, spn);
422 if (!ok) {
423 ok = add_string_to_array(spn_array, spn,
424 &spn_array, (int *)&num_spns);
425 if (!ok) {
426 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
427 }
428 }
429
430 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
431 || (strchr(my_fqdn, '.') == NULL)) {
432 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
433 r->out.dns_domain_name);
434 }
435
436 if (!strlower_m(my_fqdn)) {
437 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
438 }
439
440 if (!strequal(my_fqdn, r->in.machine_name)) {
441 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
442 if (!spn) {
443 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
444 }
445
446 ok = ads_element_in_array(spn_array, num_spns, spn);
447 if (!ok) {
448 ok = add_string_to_array(spn_array, spn,
449 &spn_array, (int *)&num_spns);
450 if (!ok) {
451 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
452 }
453 }
454 }
455
456 /* make sure to NULL terminate the array */
457 spn_array = talloc_realloc(mem_ctx, spn_array, const char *, num_spns + 1);
458 if (spn_array == NULL) {
459 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
460 }
461 spn_array[num_spns] = NULL;
462
463 mods = ads_init_mods(mem_ctx);
464 if (!mods) {
465 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
466 }
467
468 /* fields of primary importance */
469
470 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
471 if (!ADS_ERR_OK(status)) {
472 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
473 }
474
475 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
476 spn_array);
477 if (!ADS_ERR_OK(status)) {
478 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
479 }
480
481 return ads_gen_mod(r->in.ads, r->out.dn, mods);
482 }
483
484 /****************************************************************
485 ****************************************************************/
486
487 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
488 struct libnet_JoinCtx *r)
489 {
490 ADS_STATUS status;
491 ADS_MODLIST mods;
492
493 if (!r->in.create_upn) {
494 return ADS_SUCCESS;
495 }
496
497 /* Find our DN */
498
499 status = libnet_join_find_machine_acct(mem_ctx, r);
500 if (!ADS_ERR_OK(status)) {
501 return status;
502 }
503
504 if (!r->in.upn) {
505 r->in.upn = talloc_asprintf(mem_ctx,
506 "host/%s@%s",
507 r->in.machine_name,
508 r->out.dns_domain_name);
509 if (!r->in.upn) {
510 return ADS_ERROR(LDAP_NO_MEMORY);
511 }
512 }
513
514 /* now do the mods */
515
516 mods = ads_init_mods(mem_ctx);
517 if (!mods) {
518 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
519 }
520
521 /* fields of primary importance */
522
523 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
524 if (!ADS_ERR_OK(status)) {
525 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
526 }
527
528 return ads_gen_mod(r->in.ads, r->out.dn, mods);
529 }
530
531
532 /****************************************************************
533 ****************************************************************/
534
535 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
536 struct libnet_JoinCtx *r)
537 {
538 ADS_STATUS status;
539 ADS_MODLIST mods;
540 char *os_sp = NULL;
541
542 if (!r->in.os_name || !r->in.os_version ) {
543 return ADS_SUCCESS;
544 }
545
546 /* Find our DN */
547
548 status = libnet_join_find_machine_acct(mem_ctx, r);
549 if (!ADS_ERR_OK(status)) {
550 return status;
551 }
552
553 /* now do the mods */
554
555 mods = ads_init_mods(mem_ctx);
556 if (!mods) {
557 return ADS_ERROR(LDAP_NO_MEMORY);
558 }
559
560 os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
561 if (!os_sp) {
562 return ADS_ERROR(LDAP_NO_MEMORY);
563 }
564
565 /* fields of primary importance */
566
567 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
568 r->in.os_name);
569 if (!ADS_ERR_OK(status)) {
570 return status;
571 }
572
573 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
574 r->in.os_version);
575 if (!ADS_ERR_OK(status)) {
576 return status;
577 }
578
579 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
580 os_sp);
581 if (!ADS_ERR_OK(status)) {
582 return status;
583 }
584
585 return ads_gen_mod(r->in.ads, r->out.dn, mods);
586 }
587
588 /****************************************************************
589 ****************************************************************/
590
591 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
592 struct libnet_JoinCtx *r)
593 {
594 if (!USE_SYSTEM_KEYTAB) {
595 return true;
596 }
597
598 if (ads_keytab_create_default(r->in.ads) != 0) {
599 return false;
600 }
601
602 return true;
603 }
604
605 /****************************************************************
606 ****************************************************************/
607
608 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
609 struct libnet_JoinCtx *r)
610 {
611 uint32_t domain_func;
612 ADS_STATUS status;
613 const char *salt = NULL;
614 char *std_salt = NULL;
615
616 status = ads_domain_func_level(r->in.ads, &domain_func);
617 if (!ADS_ERR_OK(status)) {
618 libnet_join_set_error_string(mem_ctx, r,
619 "failed to determine domain functional level: %s",
620 ads_errstr(status));
621 return false;
622 }
623
624 /* go ahead and setup the default salt */
625
626 std_salt = kerberos_standard_des_salt();
627 if (!std_salt) {
628 libnet_join_set_error_string(mem_ctx, r,
629 "failed to obtain standard DES salt");
630 return false;
631 }
632
633 salt = talloc_strdup(mem_ctx, std_salt);
634 if (!salt) {
635 return false;
636 }
637
638 SAFE_FREE(std_salt);
639
640 /* if it's a Windows functional domain, we have to look for the UPN */
641
642 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
643 char *upn;
644
645 upn = ads_get_upn(r->in.ads, mem_ctx,
646 r->in.machine_name);
647 if (upn) {
648 salt = talloc_strdup(mem_ctx, upn);
649 if (!salt) {
650 return false;
651 }
652 }
653 }
654
655 return kerberos_secrets_store_des_salt(salt);
656 }
657
658 /****************************************************************
659 ****************************************************************/
660
661 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
662 struct libnet_JoinCtx *r)
663 {
664 ADS_STATUS status;
665
666 if (!r->in.ads) {
667 status = libnet_join_connect_ads(mem_ctx, r);
668 if (!ADS_ERR_OK(status)) {
669 return status;
670 }
671 }
672
673 status = libnet_join_set_machine_spn(mem_ctx, r);
674 if (!ADS_ERR_OK(status)) {
675 libnet_join_set_error_string(mem_ctx, r,
676 "failed to set machine spn: %s",
677 ads_errstr(status));
678 return status;
679 }
680
681 status = libnet_join_set_os_attributes(mem_ctx, r);
682 if (!ADS_ERR_OK(status)) {
683 libnet_join_set_error_string(mem_ctx, r,
684 "failed to set machine os attributes: %s",
685 ads_errstr(status));
686 return status;
687 }
688
689 status = libnet_join_set_machine_upn(mem_ctx, r);
690 if (!ADS_ERR_OK(status)) {
691 libnet_join_set_error_string(mem_ctx, r,
692 "failed to set machine upn: %s",
693 ads_errstr(status));
694 return status;
695 }
696
697 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
698 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
699 }
700
701 if (!libnet_join_create_keytab(mem_ctx, r)) {
702 libnet_join_set_error_string(mem_ctx, r,
703 "failed to create kerberos keytab");
704 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
705 }
706
707 return ADS_SUCCESS;
708 }
709 #endif /* HAVE_ADS */
710
711 /****************************************************************
712 Store the machine password and domain SID
713 ****************************************************************/
714
715 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
716 struct libnet_JoinCtx *r)
717 {
718 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
719 r->out.domain_sid))
720 {
721 DEBUG(1,("Failed to save domain sid\n"));
722 return false;
723 }
724
725 if (!secrets_store_machine_password(r->in.machine_password,
726 r->out.netbios_domain_name,
727 r->in.secure_channel_type))
728 {
729 DEBUG(1,("Failed to save machine password\n"));
730 return false;
731 }
732
733 return true;
734 }
735
736 /****************************************************************
737 Connect dc's IPC$ share
738 ****************************************************************/
739
740 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
741 const char *user,
742 const char *pass,
743 bool use_kerberos,
744 struct cli_state **cli)
745 {
746 int flags = 0;
747
748 if (use_kerberos) {
749 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
750 }
751
752 if (use_kerberos && pass) {
753 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
754 }
755
756 return cli_full_connection(cli, NULL,
757 dc,
758 NULL, 0,
759 "IPC$", "IPC",
760 user,
761 NULL,
762 pass,
763 flags,
764 SMB_SIGNING_DEFAULT);
765 }
766
767 /****************************************************************
768 Lookup domain dc's info
769 ****************************************************************/
770
771 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
772 struct libnet_JoinCtx *r,
773 struct cli_state **cli)
774 {
775 struct rpc_pipe_client *pipe_hnd = NULL;
776 struct policy_handle lsa_pol;
777 NTSTATUS status, result;
778 union lsa_PolicyInformation *info = NULL;
779 struct dcerpc_binding_handle *b;
780
781 status = libnet_join_connect_dc_ipc(r->in.dc_name,
782 r->in.admin_account,
783 r->in.admin_password,
784 r->in.use_kerberos,
785 cli);
786 if (!NT_STATUS_IS_OK(status)) {
787 goto done;
788 }
789
790 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
791 &pipe_hnd);
792 if (!NT_STATUS_IS_OK(status)) {
793 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
794 nt_errstr(status)));
795 goto done;
796 }
797
798 b = pipe_hnd->binding_handle;
799
800 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
801 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
802 if (!NT_STATUS_IS_OK(status)) {
803 goto done;
804 }
805
806 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
807 &lsa_pol,
808 LSA_POLICY_INFO_DNS,
809 &info,
810 &result);
811 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
812 r->out.domain_is_ad = true;
813 r->out.netbios_domain_name = info->dns.name.string;
814 r->out.dns_domain_name = info->dns.dns_domain.string;
815 r->out.forest_name = info->dns.dns_forest.string;
816 r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
817 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
818 }
819
820 if (!NT_STATUS_IS_OK(status)) {
821 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
822 &lsa_pol,
823 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
824 &info,
825 &result);
826 if (!NT_STATUS_IS_OK(status)) {
827 goto done;
828 }
829 if (!NT_STATUS_IS_OK(result)) {
830 status = result;
831 goto done;
832 }
833
834 r->out.netbios_domain_name = info->account_domain.name.string;
835 r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
836 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
837 }
838
839 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
840 TALLOC_FREE(pipe_hnd);
841
842 done:
843 return status;
844 }
845
846 /****************************************************************
847 Do the domain join unsecure
848 ****************************************************************/
849
850 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
851 struct libnet_JoinCtx *r,
852 struct cli_state *cli)
853 {
854 struct rpc_pipe_client *pipe_hnd = NULL;
855 unsigned char orig_trust_passwd_hash[16];
856 unsigned char new_trust_passwd_hash[16];
857 fstring trust_passwd;
858 NTSTATUS status;
859
860 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
861 &pipe_hnd);
862 if (!NT_STATUS_IS_OK(status)) {
863 return status;
864 }
865
866 if (!r->in.machine_password) {
867 r->in.machine_password = generate_random_password(mem_ctx,
868 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
869 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
870 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
871 }
872
873 E_md4hash(r->in.machine_password, new_trust_passwd_hash);
874
875 /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
876 fstrcpy(trust_passwd, r->in.admin_password);
877 if (!strlower_m(trust_passwd)) {
878 return NT_STATUS_INVALID_PARAMETER;
879 }
880
881 /*
882 * Machine names can be 15 characters, but the max length on
883 * a password is 14. --jerry
884 */
885
886 trust_passwd[14] = '\0';
887
888 E_md4hash(trust_passwd, orig_trust_passwd_hash);
889
890 status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
891 r->in.machine_name,
892 orig_trust_passwd_hash,
893 r->in.machine_password,
894 new_trust_passwd_hash,
895 r->in.secure_channel_type);
896
897 return status;
898 }
899
900 /****************************************************************
901 Do the domain join
902 ****************************************************************/
903
904 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
905 struct libnet_JoinCtx *r,
906 struct cli_state *cli)
907 {
908 struct rpc_pipe_client *pipe_hnd = NULL;
909 struct policy_handle sam_pol, domain_pol, user_pol;
910 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
911 char *acct_name;
912 struct lsa_String lsa_acct_name;
913 uint32_t user_rid;
914 uint32_t acct_flags = ACB_WSTRUST;
915 struct samr_Ids user_rids;
916 struct samr_Ids name_types;
917 union samr_UserInfo user_info;
918 struct dcerpc_binding_handle *b = NULL;
919
920 DATA_BLOB session_key = data_blob_null;
921 struct samr_CryptPassword crypt_pwd;
922 struct samr_CryptPasswordEx crypt_pwd_ex;
923
924 ZERO_STRUCT(sam_pol);
925 ZERO_STRUCT(domain_pol);
926 ZERO_STRUCT(user_pol);
927
928 switch (r->in.secure_channel_type) {
929 case SEC_CHAN_WKSTA:
930 acct_flags = ACB_WSTRUST;
931 break;
932 case SEC_CHAN_BDC:
933 acct_flags = ACB_SVRTRUST;
934 break;
935 default:
936 return NT_STATUS_INVALID_PARAMETER;
937 }
938
939 if (!r->in.machine_password) {
940 r->in.machine_password = generate_random_password(mem_ctx,
941 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
942 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
943 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
944 }
945
946 /* Open the domain */
947
948 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
949 &pipe_hnd);
950 if (!NT_STATUS_IS_OK(status)) {
951 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
952 nt_errstr(status)));
953 goto done;
954 }
955
956 b = pipe_hnd->binding_handle;
957
958 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
959 if (!NT_STATUS_IS_OK(status)) {
960 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
961 nt_errstr(status)));
962 goto done;
963 }
964
965 status = dcerpc_samr_Connect2(b, mem_ctx,
966 pipe_hnd->desthost,
967 SAMR_ACCESS_ENUM_DOMAINS
968 | SAMR_ACCESS_LOOKUP_DOMAIN,
969 &sam_pol,
970 &result);
971 if (!NT_STATUS_IS_OK(status)) {
972 goto done;
973 }
974 if (!NT_STATUS_IS_OK(result)) {
975 status = result;
976 goto done;
977 }
978
979 status = dcerpc_samr_OpenDomain(b, mem_ctx,
980 &sam_pol,
981 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
982 | SAMR_DOMAIN_ACCESS_CREATE_USER
983 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
984 r->out.domain_sid,
985 &domain_pol,
986 &result);
987 if (!NT_STATUS_IS_OK(status)) {
988 goto done;
989 }
990 if (!NT_STATUS_IS_OK(result)) {
991 status = result;
992 goto done;
993 }
994
995 /* Create domain user */
996
997 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
998 if (!strlower_m(acct_name)) {
999 status = NT_STATUS_INVALID_PARAMETER;
1000 goto done;
1001 }
1002
1003 init_lsa_String(&lsa_acct_name, acct_name);
1004
1005 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
1006 uint32_t access_desired =
1007 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
1008 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
1009 SAMR_USER_ACCESS_SET_PASSWORD |
1010 SAMR_USER_ACCESS_GET_ATTRIBUTES |
1011 SAMR_USER_ACCESS_SET_ATTRIBUTES;
1012 uint32_t access_granted = 0;
1013
1014 DEBUG(10,("Creating account with desired access mask: %d\n",
1015 access_desired));
1016
1017 status = dcerpc_samr_CreateUser2(b, mem_ctx,
1018 &domain_pol,
1019 &lsa_acct_name,
1020 acct_flags,
1021 access_desired,
1022 &user_pol,
1023 &access_granted,
1024 &user_rid,
1025 &result);
1026 if (!NT_STATUS_IS_OK(status)) {
1027 goto done;
1028 }
1029
1030 status = result;
1031 if (!NT_STATUS_IS_OK(status) &&
1032 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1033
1034 DEBUG(10,("Creation of workstation account failed: %s\n",
1035 nt_errstr(status)));
1036
1037 /* If NT_STATUS_ACCESS_DENIED then we have a valid
1038 username/password combo but the user does not have
1039 administrator access. */
1040
1041 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1042 libnet_join_set_error_string(mem_ctx, r,
1043 "User specified does not have "
1044 "administrator privileges");
1045 }
1046
1047 goto done;
1048 }
1049
1050 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1051 if (!(r->in.join_flags &
1052 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
1053 goto done;
1054 }
1055 }
1056
1057 /* We *must* do this.... don't ask... */
1058
1059 if (NT_STATUS_IS_OK(status)) {
1060 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1061 }
1062 }
1063
1064 status = dcerpc_samr_LookupNames(b, mem_ctx,
1065 &domain_pol,
1066 1,
1067 &lsa_acct_name,
1068 &user_rids,
1069 &name_types,
1070 &result);
1071 if (!NT_STATUS_IS_OK(status)) {
1072 goto done;
1073 }
1074 if (!NT_STATUS_IS_OK(result)) {
1075 status = result;
1076 goto done;
1077 }
1078 if (user_rids.count != 1) {
1079 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1080 goto done;
1081 }
1082 if (name_types.count != 1) {
1083 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1084 goto done;
1085 }
1086
1087 if (name_types.ids[0] != SID_NAME_USER) {
1088 DEBUG(0,("%s is not a user account (type=%d)\n",
1089 acct_name, name_types.ids[0]));
1090 status = NT_STATUS_INVALID_WORKSTATION;
1091 goto done;
1092 }
1093
1094 user_rid = user_rids.ids[0];
1095
1096 /* Open handle on user */
1097
1098 status = dcerpc_samr_OpenUser(b, mem_ctx,
1099 &domain_pol,
1100 SEC_FLAG_MAXIMUM_ALLOWED,
1101 user_rid,
1102 &user_pol,
1103 &result);
1104 if (!NT_STATUS_IS_OK(status)) {
1105 goto done;
1106 }
1107 if (!NT_STATUS_IS_OK(result)) {
1108 status = result;
1109 goto done;
1110 }
1111
1112 /* Fill in the additional account flags now */
1113
1114 acct_flags |= ACB_PWNOEXP;
1115
1116 /* Set account flags on machine account */
1117 ZERO_STRUCT(user_info.info16);
1118 user_info.info16.acct_flags = acct_flags;
1119
1120 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1121 &user_pol,
1122 16,
1123 &user_info,
1124 &result);
1125 if (!NT_STATUS_IS_OK(status)) {
1126 dcerpc_samr_DeleteUser(b, mem_ctx,
1127 &user_pol,
1128 &result);
1129
1130 libnet_join_set_error_string(mem_ctx, r,
1131 "Failed to set account flags for machine account (%s)\n",
1132 nt_errstr(status));
1133 goto done;
1134 }
1135
1136 if (!NT_STATUS_IS_OK(result)) {
1137 status = result;
1138
1139 dcerpc_samr_DeleteUser(b, mem_ctx,
1140 &user_pol,
1141 &result);
1142
1143 libnet_join_set_error_string(mem_ctx, r,
1144 "Failed to set account flags for machine account (%s)\n",
1145 nt_errstr(status));
1146 goto done;
1147 }
1148
1149 /* Set password on machine account - first try level 26 */
1150
1151 init_samr_CryptPasswordEx(r->in.machine_password,
1152 &session_key,
1153 &crypt_pwd_ex);
1154
1155 user_info.info26.password = crypt_pwd_ex;
1156 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1157
1158 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1159 &user_pol,
1160 26,
1161 &user_info,
1162 &result);
1163
1164 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1165
1166 /* retry with level 24 */
1167
1168 init_samr_CryptPassword(r->in.machine_password,
1169 &session_key,
1170 &crypt_pwd);
1171
1172 user_info.info24.password = crypt_pwd;
1173 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1174
1175 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1176 &user_pol,
1177 24,
1178 &user_info,
1179 &result);
1180 }
1181
1182 if (!NT_STATUS_IS_OK(status)) {
1183
1184 dcerpc_samr_DeleteUser(b, mem_ctx,
1185 &user_pol,
1186 &result);
1187
1188 libnet_join_set_error_string(mem_ctx, r,
1189 "Failed to set password for machine account (%s)\n",
1190 nt_errstr(status));
1191 goto done;
1192 }
1193 if (!NT_STATUS_IS_OK(result)) {
1194 status = result;
1195
1196 dcerpc_samr_DeleteUser(b, mem_ctx,
1197 &user_pol,
1198 &result);
1199
1200 libnet_join_set_error_string(mem_ctx, r,
1201 "Failed to set password for machine account (%s)\n",
1202 nt_errstr(status));
1203 goto done;
1204 }
1205
1206 status = NT_STATUS_OK;
1207
1208 done:
1209 if (!pipe_hnd) {
1210 return status;
1211 }
1212
1213 data_blob_clear_free(&session_key);
1214
1215 if (is_valid_policy_hnd(&sam_pol)) {
1216 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1217 }
1218 if (is_valid_policy_hnd(&domain_pol)) {
1219 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1220 }
1221 if (is_valid_policy_hnd(&user_pol)) {
1222 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1223 }
1224 TALLOC_FREE(pipe_hnd);
1225
1226 return status;
1227 }
1228
1229 /****************************************************************
1230 ****************************************************************/
1231
1232 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1233 const char *machine_name,
1234 const char *dc_name,
1235 const bool use_kerberos)
1236 {
1237 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1238 struct cli_state *cli = NULL;
1239 struct rpc_pipe_client *pipe_hnd = NULL;
1240 struct rpc_pipe_client *netlogon_pipe = NULL;
1241 NTSTATUS status;
1242 char *machine_password = NULL;
1243 char *machine_account = NULL;
1244 int flags = 0;
1245
1246 if (!dc_name) {
1247 return NT_STATUS_INVALID_PARAMETER;
1248 }
1249
1250 if (!secrets_init()) {
1251 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1252 }
1253
1254 machine_password = secrets_fetch_machine_password(netbios_domain_name,
1255 NULL, NULL);
1256 if (!machine_password) {
1257 return NT_STATUS_NO_TRUST_LSA_SECRET;
1258 }
1259
1260 if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1261 SAFE_FREE(machine_password);
1262 return NT_STATUS_NO_MEMORY;
1263 }
1264
1265 if (use_kerberos) {
1266 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1267 }
1268
1269 status = cli_full_connection(&cli, NULL,
1270 dc_name,
1271 NULL, 0,
1272 "IPC$", "IPC",
1273 machine_account,
1274 NULL,
1275 machine_password,
1276 flags,
1277 SMB_SIGNING_DEFAULT);
1278 free(machine_account);
1279 free(machine_password);
1280
1281 if (!NT_STATUS_IS_OK(status)) {
1282 status = cli_full_connection(&cli, NULL,
1283 dc_name,
1284 NULL, 0,
1285 "IPC$", "IPC",
1286 "",
1287 NULL,
1288 "",
1289 0,
1290 SMB_SIGNING_DEFAULT);
1291 }
1292
1293 if (!NT_STATUS_IS_OK(status)) {
1294 return status;
1295 }
1296
1297 status = get_schannel_session_key(cli, netbios_domain_name,
1298 &neg_flags, &netlogon_pipe);
1299 if (!NT_STATUS_IS_OK(status)) {
1300 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1301 cli_shutdown(cli);
1302 return NT_STATUS_OK;
1303 }
1304
1305 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1306 "key from server %s for domain %s. Error was %s\n",
1307 smbXcli_conn_remote_name(cli->conn),
1308 netbios_domain_name, nt_errstr(status)));
1309 cli_shutdown(cli);
1310 return status;
1311 }
1312
1313 if (!lp_client_schannel()) {
1314 cli_shutdown(cli);
1315 return NT_STATUS_OK;
1316 }
1317
1318 status = cli_rpc_pipe_open_schannel_with_key(
1319 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1320 DCERPC_AUTH_LEVEL_PRIVACY,
1321 netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1322
1323 cli_shutdown(cli);
1324
1325 if (!NT_STATUS_IS_OK(status)) {
1326 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1327 "on netlogon pipe to server %s for domain %s. "
1328 "Error was %s\n",
1329 smbXcli_conn_remote_name(cli->conn),
1330 netbios_domain_name, nt_errstr(status)));
1331 return status;
1332 }
1333
1334 return NT_STATUS_OK;
1335 }
1336
1337 /****************************************************************
1338 ****************************************************************/
1339
1340 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1341 struct libnet_JoinCtx *r)
1342 {
1343 NTSTATUS status;
1344
1345 status = libnet_join_ok(r->out.netbios_domain_name,
1346 r->in.machine_name,
1347 r->in.dc_name,
1348 r->in.use_kerberos);
1349 if (!NT_STATUS_IS_OK(status)) {
1350 libnet_join_set_error_string(mem_ctx, r,
1351 "failed to verify domain membership after joining: %s",
1352 get_friendly_nt_error_msg(status));
1353 return WERR_SETUP_NOT_JOINED;
1354 }
1355
1356 return WERR_OK;
1357 }
1358
1359 /****************************************************************
1360 ****************************************************************/
1361
1362 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1363 struct libnet_UnjoinCtx *r)
1364 {
1365 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1366 return false;
1367 }
1368
1369 if (!secrets_delete_domain_sid(lp_workgroup())) {
1370 return false;
1371 }
1372
1373 return true;
1374 }
1375
1376 /****************************************************************
1377 ****************************************************************/
1378
1379 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1380 struct libnet_UnjoinCtx *r)
1381 {
1382 struct cli_state *cli = NULL;
1383 struct rpc_pipe_client *pipe_hnd = NULL;
1384 struct policy_handle sam_pol, domain_pol, user_pol;
1385 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1386 char *acct_name;
1387 uint32_t user_rid;
1388 struct lsa_String lsa_acct_name;
1389 struct samr_Ids user_rids;
1390 struct samr_Ids name_types;
1391 union samr_UserInfo *info = NULL;
1392 struct dcerpc_binding_handle *b = NULL;
1393
1394 ZERO_STRUCT(sam_pol);
1395 ZERO_STRUCT(domain_pol);
1396 ZERO_STRUCT(user_pol);
1397
1398 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1399 r->in.admin_account,
1400 r->in.admin_password,
1401 r->in.use_kerberos,
1402 &cli);
1403 if (!NT_STATUS_IS_OK(status)) {
1404 goto done;
1405 }
1406
1407 /* Open the domain */
1408
1409 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1410 &pipe_hnd);
1411 if (!NT_STATUS_IS_OK(status)) {
1412 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1413 nt_errstr(status)));
1414 goto done;
1415 }
1416
1417 b = pipe_hnd->binding_handle;
1418
1419 status = dcerpc_samr_Connect2(b, mem_ctx,
1420 pipe_hnd->desthost,
1421 SEC_FLAG_MAXIMUM_ALLOWED,
1422 &sam_pol,
1423 &result);
1424 if (!NT_STATUS_IS_OK(status)) {
1425 goto done;
1426 }
1427 if (!NT_STATUS_IS_OK(result)) {
1428 status = result;
1429 goto done;
1430 }
1431
1432 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1433 &sam_pol,
1434 SEC_FLAG_MAXIMUM_ALLOWED,
1435 r->in.domain_sid,
1436 &domain_pol,
1437 &result);
1438 if (!NT_STATUS_IS_OK(status)) {
1439 goto done;
1440 }
1441 if (!NT_STATUS_IS_OK(result)) {
1442 status = result;
1443 goto done;
1444 }
1445
1446 /* Create domain user */
1447
1448 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1449 if (!strlower_m(acct_name)) {
1450 status = NT_STATUS_INVALID_PARAMETER;
1451 goto done;
1452 }
1453
1454 init_lsa_String(&lsa_acct_name, acct_name);
1455
1456 status = dcerpc_samr_LookupNames(b, mem_ctx,
1457 &domain_pol,
1458 1,
1459 &lsa_acct_name,
1460 &user_rids,
1461 &name_types,
1462 &result);
1463
1464 if (!NT_STATUS_IS_OK(status)) {
1465 goto done;
1466 }
1467 if (!NT_STATUS_IS_OK(result)) {
1468 status = result;
1469 goto done;
1470 }
1471 if (user_rids.count != 1) {
1472 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1473 goto done;
1474 }
1475 if (name_types.count != 1) {
1476 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1477 goto done;
1478 }
1479
1480 if (name_types.ids[0] != SID_NAME_USER) {
1481 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1482 name_types.ids[0]));
1483 status = NT_STATUS_INVALID_WORKSTATION;
1484 goto done;
1485 }
1486
1487 user_rid = user_rids.ids[0];
1488
1489 /* Open handle on user */
1490
1491 status = dcerpc_samr_OpenUser(b, mem_ctx,
1492 &domain_pol,
1493 SEC_FLAG_MAXIMUM_ALLOWED,
1494 user_rid,
1495 &user_pol,
1496 &result);
1497 if (!NT_STATUS_IS_OK(status)) {
1498 goto done;
1499 }
1500 if (!NT_STATUS_IS_OK(result)) {
1501 status = result;
1502 goto done;
1503 }
1504
1505 /* Get user info */
1506
1507 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1508 &user_pol,
1509 16,
1510 &info,
1511 &result);
1512 if (!NT_STATUS_IS_OK(status)) {
1513 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1514 goto done;
1515 }
1516 if (!NT_STATUS_IS_OK(result)) {
1517 status = result;
1518 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1519 goto done;
1520 }
1521
1522 /* now disable and setuser info */
1523
1524 info->info16.acct_flags |= ACB_DISABLED;
1525
1526 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1527 &user_pol,
1528 16,
1529 info,
1530 &result);
1531 if (!NT_STATUS_IS_OK(status)) {
1532 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1533 goto done;
1534 }
1535 if (!NT_STATUS_IS_OK(result)) {
1536 status = result;
1537 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1538 goto done;
1539 }
1540 status = result;
1541 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1542
1543 done:
1544 if (pipe_hnd && b) {
1545 if (is_valid_policy_hnd(&domain_pol)) {
1546 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1547 }
1548 if (is_valid_policy_hnd(&sam_pol)) {
1549 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1550 }
1551 TALLOC_FREE(pipe_hnd);
1552 }
1553
1554 if (cli) {
1555 cli_shutdown(cli);
1556 }
1557
1558 return status;
1559 }
1560
1561 /****************************************************************
1562 ****************************************************************/
1563
1564 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1565 {
1566 WERROR werr = WERR_OK;
1567 sbcErr err;
1568 struct smbconf_ctx *ctx;
1569
1570 err = smbconf_init_reg(r, &ctx, NULL);
1571 if (!SBC_ERROR_IS_OK(err)) {
1572 werr = WERR_NO_SUCH_SERVICE;
1573 goto done;
1574 }
1575
1576 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1577
1578 err = smbconf_set_global_parameter(ctx, "security", "user");
1579 if (!SBC_ERROR_IS_OK(err)) {
1580 werr = WERR_NO_SUCH_SERVICE;
1581 goto done;
1582 }
1583
1584 err = smbconf_set_global_parameter(ctx, "workgroup",
1585 r->in.domain_name);
1586 if (!SBC_ERROR_IS_OK(err)) {
1587 werr = WERR_NO_SUCH_SERVICE;
1588 goto done;
1589 }
1590
1591 smbconf_delete_global_parameter(ctx, "realm");
1592 goto done;
1593 }
1594
1595 err = smbconf_set_global_parameter(ctx, "security", "domain");
1596 if (!SBC_ERROR_IS_OK(err)) {
1597 werr = WERR_NO_SUCH_SERVICE;
1598 goto done;
1599 }
1600
1601 err = smbconf_set_global_parameter(ctx, "workgroup",
1602 r->out.netbios_domain_name);
1603 if (!SBC_ERROR_IS_OK(err)) {
1604 werr = WERR_NO_SUCH_SERVICE;
1605 goto done;
1606 }
1607
1608 if (r->out.domain_is_ad) {
1609 err = smbconf_set_global_parameter(ctx, "security", "ads");
1610 if (!SBC_ERROR_IS_OK(err)) {
1611 werr = WERR_NO_SUCH_SERVICE;
1612 goto done;
1613 }
1614
1615 err = smbconf_set_global_parameter(ctx, "realm",
1616 r->out.dns_domain_name);
1617 if (!SBC_ERROR_IS_OK(err)) {
1618 werr = WERR_NO_SUCH_SERVICE;
1619 goto done;
1620 }
1621 }
1622
1623 done:
1624 smbconf_shutdown(ctx);
1625 return werr;
1626 }
1627
1628 /****************************************************************
1629 ****************************************************************/
1630
1631 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1632 {
1633 WERROR werr = WERR_OK;
1634 sbcErr err;
1635 struct smbconf_ctx *ctx;
1636
1637 err = smbconf_init_reg(r, &ctx, NULL);
1638 if (!SBC_ERROR_IS_OK(err)) {
1639 werr = WERR_NO_SUCH_SERVICE;
1640 goto done;
1641 }
1642
1643 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1644
1645 err = smbconf_set_global_parameter(ctx, "security", "user");
1646 if (!SBC_ERROR_IS_OK(err)) {
1647 werr = WERR_NO_SUCH_SERVICE;
1648 goto done;
1649 }
1650
1651 err = smbconf_delete_global_parameter(ctx, "workgroup");
1652 if (!SBC_ERROR_IS_OK(err)) {
1653 werr = WERR_NO_SUCH_SERVICE;
1654 goto done;
1655 }
1656
1657 smbconf_delete_global_parameter(ctx, "realm");
1658 }
1659
1660 done:
1661 smbconf_shutdown(ctx);
1662 return werr;
1663 }
1664
1665 /****************************************************************
1666 ****************************************************************/
1667
1668 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1669 {
1670 WERROR werr;
1671
1672 if (!W_ERROR_IS_OK(r->out.result)) {
1673 return r->out.result;
1674 }
1675
1676 if (!r->in.modify_config) {
1677 return WERR_OK;
1678 }
1679
1680 werr = do_join_modify_vals_config(r);
1681 if (!W_ERROR_IS_OK(werr)) {
1682 return werr;
1683 }
1684
1685 lp_load_global(get_dyn_CONFIGFILE());
1686
1687 r->out.modified_config = true;
1688 r->out.result = werr;
1689
1690 return werr;
1691 }
1692
1693 /****************************************************************
1694 ****************************************************************/
1695
1696 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1697 {
1698 WERROR werr;
1699
1700 if (!W_ERROR_IS_OK(r->out.result)) {
1701 return r->out.result;
1702 }
1703
1704 if (!r->in.modify_config) {
1705 return WERR_OK;
1706 }
1707
1708 werr = do_unjoin_modify_vals_config(r);
1709 if (!W_ERROR_IS_OK(werr)) {
1710 return werr;
1711 }
1712
1713 lp_load_global(get_dyn_CONFIGFILE());
1714
1715 r->out.modified_config = true;
1716 r->out.result = werr;
1717
1718 return werr;
1719 }
1720
1721 /****************************************************************
1722 ****************************************************************/
1723
1724 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1725 const char *domain_str,
1726 const char **domain_p,
1727 const char **dc_p)
1728 {
1729 char *domain = NULL;
1730 char *dc = NULL;
1731 const char *p = NULL;
1732
1733 if (!domain_str || !domain_p || !dc_p) {
1734 return false;
1735 }
1736
1737 p = strchr_m(domain_str, '\\');
1738
1739 if (p != NULL) {
1740 domain = talloc_strndup(mem_ctx, domain_str,
1741 PTR_DIFF(p, domain_str));
1742 dc = talloc_strdup(mem_ctx, p+1);
1743 if (!dc) {
1744 return false;
1745 }
1746 } else {
1747 domain = talloc_strdup(mem_ctx, domain_str);
1748 dc = NULL;
1749 }
1750 if (!domain) {
1751 return false;
1752 }
1753
1754 *domain_p = domain;
1755
1756 if (!*dc_p && dc) {
1757 *dc_p = dc;
1758 }
1759
1760 return true;
1761 }
1762
1763 /****************************************************************
1764 ****************************************************************/
1765
1766 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1767 struct libnet_JoinCtx *r)
1768 {
1769 if (!r->in.domain_name) {
1770 libnet_join_set_error_string(mem_ctx, r,
1771 "No domain name defined");
1772 return WERR_INVALID_PARAM;
1773 }
1774
1775 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1776 &r->in.domain_name,
1777 &r->in.dc_name)) {
1778 libnet_join_set_error_string(mem_ctx, r,
1779 "Failed to parse domain name");
1780 return WERR_INVALID_PARAM;
1781 }
1782
1783 if (IS_DC) {
1784 return WERR_SETUP_DOMAIN_CONTROLLER;
1785 }
1786
1787 if (!secrets_init()) {
1788 libnet_join_set_error_string(mem_ctx, r,
1789 "Unable to open secrets database");
1790 return WERR_CAN_NOT_COMPLETE;
1791 }
1792
1793 return WERR_OK;
1794 }
1795
1796 /****************************************************************
1797 ****************************************************************/
1798
1799 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1800 {
1801 NTSTATUS status;
1802
1803 /* Try adding dom admins to builtin\admins. Only log failures. */
1804 status = create_builtin_administrators(domain_sid);
1805 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1806 DEBUG(10,("Unable to auto-add domain administrators to "
1807 "BUILTIN\\Administrators during join because "
1808 "winbindd must be running.\n"));
1809 } else if (!NT_STATUS_IS_OK(status)) {
1810 DEBUG(5, ("Failed to auto-add domain administrators to "
1811 "BUILTIN\\Administrators during join: %s\n",
1812 nt_errstr(status)));
1813 }
1814
1815 /* Try adding dom users to builtin\users. Only log failures. */
1816 status = create_builtin_users(domain_sid);
1817 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1818 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1819 "during join because winbindd must be running.\n"));
1820 } else if (!NT_STATUS_IS_OK(status)) {
1821 DEBUG(5, ("Failed to auto-add domain administrators to "
1822 "BUILTIN\\Administrators during join: %s\n",
1823 nt_errstr(status)));
1824 }
1825 }
1826
1827 /****************************************************************
1828 ****************************************************************/
1829
1830 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1831 struct libnet_JoinCtx *r)
1832 {
1833 WERROR werr;
1834
1835 if (!W_ERROR_IS_OK(r->out.result)) {
1836 return r->out.result;
1837 }
1838
1839 werr = do_JoinConfig(r);
1840 if (!W_ERROR_IS_OK(werr)) {
1841 return werr;
1842 }
1843
1844 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1845 return WERR_OK;
1846 }
1847
1848 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1849 if (r->out.dns_domain_name) {
1850 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1851 }
1852
1853 #ifdef HAVE_ADS
1854 if (r->out.domain_is_ad &&
1855 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1856 ADS_STATUS ads_status;
1857
1858 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1859 if (!ADS_ERR_OK(ads_status)) {
1860 return WERR_GENERAL_FAILURE;
1861 }
1862 }
1863 #endif /* HAVE_ADS */
1864
1865 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1866
1867 return WERR_OK;
1868 }
1869
1870 /****************************************************************
1871 ****************************************************************/
1872
1873 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1874 {
1875 if (r->in.ads) {
1876 ads_destroy(&r->in.ads);
1877 }
1878
1879 return 0;
1880 }
1881
1882 /****************************************************************
1883 ****************************************************************/
1884
1885 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1886 {
1887 if (r->in.ads) {
1888 ads_destroy(&r->in.ads);
1889 }
1890
1891 return 0;
1892 }
1893
1894 /****************************************************************
1895 ****************************************************************/
1896
1897 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1898 struct libnet_JoinCtx **r)
1899 {
1900 struct libnet_JoinCtx *ctx;
1901
1902 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1903 if (!ctx) {
1904 return WERR_NOMEM;
1905 }
1906
1907 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1908
1909 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
1910 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1911
1912 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1913
1914 *r = ctx;
1915
1916 return WERR_OK;
1917 }
1918
1919 /****************************************************************
1920 ****************************************************************/
1921
1922 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1923 struct libnet_UnjoinCtx **r)
1924 {
1925 struct libnet_UnjoinCtx *ctx;
1926
1927 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1928 if (!ctx) {
1929 return WERR_NOMEM;
1930 }
1931
1932 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1933
1934 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
1935 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1936
1937 *r = ctx;
1938
1939 return WERR_OK;
1940 }
1941
1942 /****************************************************************
1943 ****************************************************************/
1944
1945 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1946 struct libnet_JoinCtx *r)
1947 {
1948 bool valid_security = false;
1949 bool valid_workgroup = false;
1950 bool valid_realm = false;
1951
1952 /* check if configuration is already set correctly */
1953
1954 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1955
1956 switch (r->out.domain_is_ad) {
1957 case false:
1958 valid_security = (lp_security() == SEC_DOMAIN);
1959 if (valid_workgroup && valid_security) {
1960 /* nothing to be done */
1961 return WERR_OK;
1962 }
1963 break;
1964 case true:
1965 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1966 switch (lp_security()) {
1967 case SEC_DOMAIN:
1968 case SEC_ADS:
1969 valid_security = true;
1970 }
1971
1972 if (valid_workgroup && valid_realm && valid_security) {
1973 /* nothing to be done */
1974 return WERR_OK;
1975 }
1976 break;
1977 }
1978
1979 /* check if we are supposed to manipulate configuration */
1980
1981 if (!r->in.modify_config) {
1982
1983 char *wrong_conf = talloc_strdup(mem_ctx, "");
1984
1985 if (!valid_workgroup) {
1986 wrong_conf = talloc_asprintf_append(wrong_conf,
1987 "\"workgroup\" set to '%s', should be '%s'",
1988 lp_workgroup(), r->out.netbios_domain_name);
1989 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1990 }
1991
1992 if (!valid_realm) {
1993 wrong_conf = talloc_asprintf_append(wrong_conf,
1994 "\"realm\" set to '%s', should be '%s'",
1995 lp_realm(), r->out.dns_domain_name);
1996 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1997 }
1998
1999 if (!valid_security) {
2000 const char *sec = NULL;
2001 switch (lp_security()) {
2002 case SEC_USER: sec = "user"; break;
2003 case SEC_DOMAIN: sec = "domain"; break;
2004 case SEC_ADS: sec = "ads"; break;
2005 }
2006 wrong_conf = talloc_asprintf_append(wrong_conf,
2007 "\"security\" set to '%s', should be %s",
2008 sec, r->out.domain_is_ad ?
2009 "either 'domain' or 'ads'" : "'domain'");
2010 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2011 }
2012
2013 libnet_join_set_error_string(mem_ctx, r,
2014 "Invalid configuration (%s) and configuration modification "
2015 "was not requested", wrong_conf);
2016 return WERR_CAN_NOT_COMPLETE;
2017 }
2018
2019 /* check if we are able to manipulate configuration */
2020
2021 if (!lp_config_backend_is_registry()) {
2022 libnet_join_set_error_string(mem_ctx, r,
2023 "Configuration manipulation requested but not "
2024 "supported by backend");
2025 return WERR_NOT_SUPPORTED;
2026 }
2027
2028 return WERR_OK;
2029 }
2030
2031 /****************************************************************
2032 ****************************************************************/
2033
2034 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
2035 struct libnet_JoinCtx *r)
2036 {
2037 NTSTATUS status;
2038 WERROR werr;
2039 struct cli_state *cli = NULL;
2040 #ifdef HAVE_ADS
2041 ADS_STATUS ads_status;
2042 #endif /* HAVE_ADS */
2043
2044 if (!r->in.dc_name) {
2045 struct netr_DsRGetDCNameInfo *info;
2046 const char *dc;
2047 status = dsgetdcname(mem_ctx,
2048 r->in.msg_ctx,
2049 r->in.domain_name,
2050 NULL,
2051 NULL,
2052 DS_FORCE_REDISCOVERY |
2053 DS_DIRECTORY_SERVICE_REQUIRED |
2054 DS_WRITABLE_REQUIRED |
2055 DS_RETURN_DNS_NAME,
2056 &info);
2057 if (!NT_STATUS_IS_OK(status)) {
2058 libnet_join_set_error_string(mem_ctx, r,
2059 "failed to find DC for domain %s",
2060 r->in.domain_name,
2061 get_friendly_nt_error_msg(status));
2062 return WERR_DCNOTFOUND;
2063 }
2064
2065 dc = strip_hostname(info->dc_unc);
2066 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2067 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2068 }
2069
2070 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
2071 if (!NT_STATUS_IS_OK(status)) {
2072 libnet_join_set_error_string(mem_ctx, r,
2073 "failed to lookup DC info for domain '%s' over rpc: %s",
2074 r->in.domain_name, get_friendly_nt_error_msg(status));
2075 return ntstatus_to_werror(status);
2076 }
2077
2078 werr = libnet_join_check_config(mem_ctx, r);
2079 if (!W_ERROR_IS_OK(werr)) {
2080 goto done;
2081 }
2082
2083 #ifdef HAVE_ADS
2084
2085 create_local_private_krb5_conf_for_domain(
2086 r->out.dns_domain_name, r->out.netbios_domain_name,
2087 NULL, smbXcli_conn_remote_sockaddr(cli->conn),
2088 smbXcli_conn_remote_name(cli->conn));
2089
2090 if (r->out.domain_is_ad && r->in.account_ou &&
2091 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2092
2093 ads_status = libnet_join_connect_ads(mem_ctx, r);
2094 if (!ADS_ERR_OK(ads_status)) {
2095 return WERR_DEFAULT_JOIN_REQUIRED;
2096 }
2097
2098 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
2099 if (!ADS_ERR_OK(ads_status)) {
2100 libnet_join_set_error_string(mem_ctx, r,
2101 "failed to precreate account in ou %s: %s",
2102 r->in.account_ou,
2103 ads_errstr(ads_status));
2104 return WERR_DEFAULT_JOIN_REQUIRED;
2105 }
2106
2107 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
2108 }
2109 #endif /* HAVE_ADS */
2110
2111 if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2112 (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2113 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2114 } else {
2115 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2116 }
2117 if (!NT_STATUS_IS_OK(status)) {
2118 libnet_join_set_error_string(mem_ctx, r,
2119 "failed to join domain '%s' over rpc: %s",
2120 r->in.domain_name, get_friendly_nt_error_msg(status));
2121 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2122 return WERR_SETUP_ALREADY_JOINED;
2123 }
2124 werr = ntstatus_to_werror(status);
2125 goto done;
2126 }
2127
2128 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2129 werr = WERR_SETUP_NOT_JOINED;
2130 goto done;
2131 }
2132
2133 werr = WERR_OK;
2134
2135 done:
2136 if (cli) {
2137 cli_shutdown(cli);
2138 }
2139
2140 return werr;
2141 }
2142
2143 /****************************************************************
2144 ****************************************************************/
2145
2146 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2147 struct libnet_JoinCtx *r)
2148 {
2149 WERROR werr;
2150 struct libnet_UnjoinCtx *u = NULL;
2151
2152 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2153 if (!W_ERROR_IS_OK(werr)) {
2154 return werr;
2155 }
2156
2157 u->in.debug = r->in.debug;
2158 u->in.dc_name = r->in.dc_name;
2159 u->in.domain_name = r->in.domain_name;
2160 u->in.admin_account = r->in.admin_account;
2161 u->in.admin_password = r->in.admin_password;
2162 u->in.modify_config = r->in.modify_config;
2163 u->in.use_kerberos = r->in.use_kerberos;
2164 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
2165 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2166
2167 werr = libnet_Unjoin(mem_ctx, u);
2168 TALLOC_FREE(u);
2169
2170 return werr;
2171 }
2172
2173 /****************************************************************
2174 ****************************************************************/
2175
2176 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2177 struct libnet_JoinCtx *r)
2178 {
2179 WERROR werr;
2180
2181 if (r->in.debug) {
2182 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2183 }
2184
2185 ZERO_STRUCT(r->out);
2186
2187 werr = libnet_join_pre_processing(mem_ctx, r);
2188 if (!W_ERROR_IS_OK(werr)) {
2189 goto done;
2190 }
2191
2192 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2193 werr = libnet_DomainJoin(mem_ctx, r);
2194 if (!W_ERROR_IS_OK(werr)) {
2195 goto done;
2196 }
2197 }
2198
2199 werr = libnet_join_post_processing(mem_ctx, r);
2200 if (!W_ERROR_IS_OK(werr)) {
2201 goto done;
2202 }
2203
2204 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2205 werr = libnet_join_post_verify(mem_ctx, r);
2206 if (!W_ERROR_IS_OK(werr)) {
2207 libnet_join_rollback(mem_ctx, r);
2208 }
2209 }
2210
2211 done:
2212 r->out.result = werr;
2213
2214 if (r->in.debug) {
2215 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2216 }
2217 return werr;
2218 }
2219
2220 /****************************************************************
2221 ****************************************************************/
2222
2223 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2224 struct libnet_UnjoinCtx *r)
2225 {
2226 NTSTATUS status;
2227
2228 if (!r->in.domain_sid) {
2229 struct dom_sid sid;
2230 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2231 libnet_unjoin_set_error_string(mem_ctx, r,
2232 "Unable to fetch domain sid: are we joined?");
2233 return WERR_SETUP_NOT_JOINED;
2234 }
2235 r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2236 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2237 }
2238
2239 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2240 !r->in.delete_machine_account) {
2241 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2242 return WERR_OK;
2243 }
2244
2245 if (!r->in.dc_name) {
2246 struct netr_DsRGetDCNameInfo *info;
2247 const char *dc;
2248 status = dsgetdcname(mem_ctx,
2249 r->in.msg_ctx,
2250 r->in.domain_name,
2251 NULL,
2252 NULL,
2253 DS_DIRECTORY_SERVICE_REQUIRED |
2254 DS_WRITABLE_REQUIRED |
2255 DS_RETURN_DNS_NAME,
2256 &info);
2257 if (!NT_STATUS_IS_OK(status)) {
2258 libnet_unjoin_set_error_string(mem_ctx, r,
2259 "failed to find DC for domain %s",
2260 r->in.domain_name,
2261 get_friendly_nt_error_msg(status));
2262 return WERR_DCNOTFOUND;
2263 }
2264
2265 dc = strip_hostname(info->dc_unc);
2266 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2267 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2268 }
2269
2270 #ifdef HAVE_ADS
2271 /* for net ads leave, try to delete the account. If it works,
2272 no sense in disabling. If it fails, we can still try to
2273 disable it. jmcd */
2274
2275 if (r->in.delete_machine_account) {
2276 ADS_STATUS ads_status;
2277 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2278 if (ADS_ERR_OK(ads_status)) {
2279 /* dirty hack */
2280 r->out.dns_domain_name =
2281 talloc_strdup(mem_ctx,
2282 r->in.ads->server.realm);
2283 ads_status =
2284 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2285 }
2286 if (!ADS_ERR_OK(ads_status)) {
2287 libnet_unjoin_set_error_string(mem_ctx, r,
2288 "failed to remove machine account from AD: %s",
2289 ads_errstr(ads_status));
2290 } else {
2291 r->out.deleted_machine_account = true;
2292 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2293 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2294 return WERR_OK;
2295 }
2296 }
2297 #endif /* HAVE_ADS */
2298
2299 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2300 "disable". */
2301 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2302 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2303 if (!NT_STATUS_IS_OK(status)) {
2304 libnet_unjoin_set_error_string(mem_ctx, r,
2305 "failed to disable machine account via rpc: %s",
2306 get_friendly_nt_error_msg(status));
2307 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2308 return WERR_SETUP_NOT_JOINED;
2309 }
2310 return ntstatus_to_werror(status);
2311 }
2312
2313 r->out.disabled_machine_account = true;
2314 }
2315
2316 /* If disable succeeded or was not requested at all, we
2317 should be getting rid of our end of things */
2318
2319 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2320
2321 return WERR_OK;
2322 }
2323
2324 /****************************************************************
2325 ****************************************************************/
2326
2327 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2328 struct libnet_UnjoinCtx *r)
2329 {
2330 if (!r->in.domain_name) {
2331 libnet_unjoin_set_error_string(mem_ctx, r,
2332 "No domain name defined");
2333 return WERR_INVALID_PARAM;
2334 }
2335
2336 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2337 &r->in.domain_name,
2338 &r->in.dc_name)) {
2339 libnet_unjoin_set_error_string(mem_ctx, r,
2340 "Failed to parse domain name");
2341 return WERR_INVALID_PARAM;
2342 }
2343
2344 if (IS_DC) {
2345 return WERR_SETUP_DOMAIN_CONTROLLER;
2346 }
2347
2348 if (!secrets_init()) {
2349 libnet_unjoin_set_error_string(mem_ctx, r,
2350 "Unable to open secrets database");
2351 return WERR_CAN_NOT_COMPLETE;
2352 }
2353
2354 return WERR_OK;
2355 }
2356
2357 /****************************************************************
2358 ****************************************************************/
2359
2360 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2361 struct libnet_UnjoinCtx *r)
2362 {
2363 saf_delete(r->out.netbios_domain_name);
2364 saf_delete(r->out.dns_domain_name);
2365
2366 return libnet_unjoin_config(r);
2367 }
2368
2369 /****************************************************************
2370 ****************************************************************/
2371
2372 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2373 struct libnet_UnjoinCtx *r)
2374 {
2375 WERROR werr;
2376
2377 if (r->in.debug) {
2378 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2379 }
2380
2381 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2382 if (!W_ERROR_IS_OK(werr)) {
2383 goto done;
2384 }
2385
2386 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2387 werr = libnet_DomainUnjoin(mem_ctx, r);
2388 if (!W_ERROR_IS_OK(werr)) {
2389 libnet_unjoin_config(r);
2390 goto done;
2391 }
2392 }
2393
2394 werr = libnet_unjoin_post_processing(mem_ctx, r);
2395 if (!W_ERROR_IS_OK(werr)) {
2396 goto done;
2397 }
2398
2399 done:
2400 r->out.result = werr;
2401
2402 if (r->in.debug) {
2403 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2404 }
2405
2406 return werr;
2407 }
Samba GIT mirror