?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:winbindd: make use of samba_tevent_context_init()
[Samba/gebeck_regimport.git] / source3 / libnet / libnet_join.c
blob3d0a6d30b89d17df00ce56d6444caedaee07e88d
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "ads.h"
23 #include "librpc/gen_ndr/ndr_libnet_join.h"
24 #include "libnet/libnet_join.h"
25 #include "libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/ndr_samr_c.h"
27 #include "rpc_client/init_samr.h"
28 #include "../librpc/gen_ndr/ndr_lsa_c.h"
29 #include "rpc_client/cli_lsarpc.h"
30 #include "../librpc/gen_ndr/ndr_netlogon.h"
31 #include "rpc_client/cli_netlogon.h"
32 #include "lib/smbconf/smbconf.h"
33 #include "lib/smbconf/smbconf_reg.h"
34 #include "../libds/common/flags.h"
35 #include "secrets.h"
36 #include "rpc_client/init_lsa.h"
37 #include "rpc_client/cli_pipe.h"
38 #include "../libcli/security/security.h"
39 #include "passdb.h"
40 #include "libsmb/libsmb.h"
41 #include "../libcli/smb/smbXcli_base.h"
42 #include "lib/param/loadparm.h"
43
44 /****************************************************************
45 ****************************************************************/
46
47 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
48 do { \
49 char *str = NULL; \
50 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
51 DEBUG(1,("libnet_Join:\n%s", str)); \
52 TALLOC_FREE(str); \
53 } while (0)
54
55 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
56 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
57 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
58 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
59
60 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
61 do { \
62 char *str = NULL; \
63 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
64 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
65 TALLOC_FREE(str); \
66 } while (0)
67
68 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
69 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
70 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
71 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
72
73 /****************************************************************
74 ****************************************************************/
75
76 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
77 struct libnet_JoinCtx *r,
78 const char *format, ...)
79 {
80 va_list args;
81
82 if (r->out.error_string) {
83 return;
84 }
85
86 va_start(args, format);
87 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
88 va_end(args);
89 }
90
91 /****************************************************************
92 ****************************************************************/
93
94 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
95 struct libnet_UnjoinCtx *r,
96 const char *format, ...)
97 {
98 va_list args;
99
100 if (r->out.error_string) {
101 return;
102 }
103
104 va_start(args, format);
105 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
106 va_end(args);
107 }
108
109 #ifdef HAVE_ADS
110
111 /****************************************************************
112 ****************************************************************/
113
114 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
115 const char *netbios_domain_name,
116 const char *dc_name,
117 const char *user_name,
118 const char *password,
119 ADS_STRUCT **ads)
120 {
121 ADS_STATUS status;
122 ADS_STRUCT *my_ads = NULL;
123 char *cp;
124
125 my_ads = ads_init(dns_domain_name,
126 netbios_domain_name,
127 dc_name);
128 if (!my_ads) {
129 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
130 }
131
132 if (user_name) {
133 SAFE_FREE(my_ads->auth.user_name);
134 my_ads->auth.user_name = SMB_STRDUP(user_name);
135 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
136 *cp++ = '\0';
137 SAFE_FREE(my_ads->auth.realm);
138 my_ads->auth.realm = smb_xstrdup(cp);
139 if (!strupper_m(my_ads->auth.realm)) {
140 ads_destroy(&my_ads);
141 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
142 }
143 }
144 }
145
146 if (password) {
147 SAFE_FREE(my_ads->auth.password);
148 my_ads->auth.password = SMB_STRDUP(password);
149 }
150
151 status = ads_connect_user_creds(my_ads);
152 if (!ADS_ERR_OK(status)) {
153 ads_destroy(&my_ads);
154 return status;
155 }
156
157 *ads = my_ads;
158 return ADS_SUCCESS;
159 }
160
161 /****************************************************************
162 ****************************************************************/
163
164 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
165 struct libnet_JoinCtx *r)
166 {
167 ADS_STATUS status;
168
169 status = libnet_connect_ads(r->out.dns_domain_name,
170 r->out.netbios_domain_name,
171 r->in.dc_name,
172 r->in.admin_account,
173 r->in.admin_password,
174 &r->in.ads);
175 if (!ADS_ERR_OK(status)) {
176 libnet_join_set_error_string(mem_ctx, r,
177 "failed to connect to AD: %s",
178 ads_errstr(status));
179 return status;
180 }
181
182 if (!r->out.netbios_domain_name) {
183 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
184 r->in.ads->server.workgroup);
185 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
186 }
187
188 if (!r->out.dns_domain_name) {
189 r->out.dns_domain_name = talloc_strdup(mem_ctx,
190 r->in.ads->config.realm);
191 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
192 }
193
194 r->out.domain_is_ad = true;
195
196 return ADS_SUCCESS;
197 }
198
199 /****************************************************************
200 ****************************************************************/
201
202 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
203 struct libnet_UnjoinCtx *r)
204 {
205 ADS_STATUS status;
206
207 status = libnet_connect_ads(r->in.domain_name,
208 r->in.domain_name,
209 r->in.dc_name,
210 r->in.admin_account,
211 r->in.admin_password,
212 &r->in.ads);
213 if (!ADS_ERR_OK(status)) {
214 libnet_unjoin_set_error_string(mem_ctx, r,
215 "failed to connect to AD: %s",
216 ads_errstr(status));
217 }
218
219 return status;
220 }
221
222 /****************************************************************
223 join a domain using ADS (LDAP mods)
224 ****************************************************************/
225
226 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
227 struct libnet_JoinCtx *r)
228 {
229 ADS_STATUS status;
230 LDAPMessage *res = NULL;
231 const char *attrs[] = { "dn", NULL };
232 bool moved = false;
233
234 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
235 if (!ADS_ERR_OK(status)) {
236 return status;
237 }
238
239 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
240 if (!ADS_ERR_OK(status)) {
241 return status;
242 }
243
244 if (ads_count_replies(r->in.ads, res) != 1) {
245 ads_msgfree(r->in.ads, res);
246 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
247 }
248
249 ads_msgfree(r->in.ads, res);
250
251 /* Attempt to create the machine account and bail if this fails.
252 Assume that the admin wants exactly what they requested */
253
254 status = ads_create_machine_acct(r->in.ads,
255 r->in.machine_name,
256 r->in.account_ou);
257
258 if (ADS_ERR_OK(status)) {
259 DEBUG(1,("machine account creation created\n"));
260 return status;
261 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
262 (status.err.rc == LDAP_ALREADY_EXISTS)) {
263 status = ADS_SUCCESS;
264 }
265
266 if (!ADS_ERR_OK(status)) {
267 DEBUG(1,("machine account creation failed\n"));
268 return status;
269 }
270
271 status = ads_move_machine_acct(r->in.ads,
272 r->in.machine_name,
273 r->in.account_ou,
274 &moved);
275 if (!ADS_ERR_OK(status)) {
276 DEBUG(1,("failure to locate/move pre-existing "
277 "machine account\n"));
278 return status;
279 }
280
281 DEBUG(1,("The machine account %s the specified OU.\n",
282 moved ? "was moved into" : "already exists in"));
283
284 return status;
285 }
286
287 /****************************************************************
288 ****************************************************************/
289
290 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
291 struct libnet_UnjoinCtx *r)
292 {
293 ADS_STATUS status;
294
295 if (!r->in.ads) {
296 status = libnet_unjoin_connect_ads(mem_ctx, r);
297 if (!ADS_ERR_OK(status)) {
298 libnet_unjoin_set_error_string(mem_ctx, r,
299 "failed to connect to AD: %s",
300 ads_errstr(status));
301 return status;
302 }
303 }
304
305 status = ads_leave_realm(r->in.ads, r->in.machine_name);
306 if (!ADS_ERR_OK(status)) {
307 libnet_unjoin_set_error_string(mem_ctx, r,
308 "failed to leave realm: %s",
309 ads_errstr(status));
310 return status;
311 }
312
313 return ADS_SUCCESS;
314 }
315
316 /****************************************************************
317 ****************************************************************/
318
319 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
320 struct libnet_JoinCtx *r)
321 {
322 ADS_STATUS status;
323 LDAPMessage *res = NULL;
324 char *dn = NULL;
325
326 if (!r->in.machine_name) {
327 return ADS_ERROR(LDAP_NO_MEMORY);
328 }
329
330 status = ads_find_machine_acct(r->in.ads,
331 &res,
332 r->in.machine_name);
333 if (!ADS_ERR_OK(status)) {
334 return status;
335 }
336
337 if (ads_count_replies(r->in.ads, res) != 1) {
338 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
339 goto done;
340 }
341
342 dn = ads_get_dn(r->in.ads, mem_ctx, res);
343 if (!dn) {
344 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
345 goto done;
346 }
347
348 r->out.dn = talloc_strdup(mem_ctx, dn);
349 if (!r->out.dn) {
350 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
351 goto done;
352 }
353
354 done:
355 ads_msgfree(r->in.ads, res);
356 TALLOC_FREE(dn);
357
358 return status;
359 }
360
361 /****************************************************************
362 Set a machines dNSHostName and servicePrincipalName attributes
363 ****************************************************************/
364
365 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
366 struct libnet_JoinCtx *r)
367 {
368 ADS_STATUS status;
369 ADS_MODLIST mods;
370 fstring my_fqdn;
371 const char *spn_array[3] = {NULL, NULL, NULL};
372 char *spn = NULL;
373
374 /* Find our DN */
375
376 status = libnet_join_find_machine_acct(mem_ctx, r);
377 if (!ADS_ERR_OK(status)) {
378 return status;
379 }
380
381 /* Windows only creates HOST/shortname & HOST/fqdn. */
382
383 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
384 if (!spn) {
385 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
386 }
387 if (!strupper_m(spn)) {
388 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
389 }
390 spn_array[0] = spn;
391
392 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
393 || (strchr(my_fqdn, '.') == NULL)) {
394 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
395 r->out.dns_domain_name);
396 }
397
398 if (!strlower_m(my_fqdn)) {
399 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
400 }
401
402 if (!strequal(my_fqdn, r->in.machine_name)) {
403 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
404 if (!spn) {
405 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
406 }
407 spn_array[1] = spn;
408 }
409
410 mods = ads_init_mods(mem_ctx);
411 if (!mods) {
412 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
413 }
414
415 /* fields of primary importance */
416
417 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
418 if (!ADS_ERR_OK(status)) {
419 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
420 }
421
422 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
423 spn_array);
424 if (!ADS_ERR_OK(status)) {
425 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
426 }
427
428 return ads_gen_mod(r->in.ads, r->out.dn, mods);
429 }
430
431 /****************************************************************
432 ****************************************************************/
433
434 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
435 struct libnet_JoinCtx *r)
436 {
437 ADS_STATUS status;
438 ADS_MODLIST mods;
439
440 if (!r->in.create_upn) {
441 return ADS_SUCCESS;
442 }
443
444 /* Find our DN */
445
446 status = libnet_join_find_machine_acct(mem_ctx, r);
447 if (!ADS_ERR_OK(status)) {
448 return status;
449 }
450
451 if (!r->in.upn) {
452 r->in.upn = talloc_asprintf(mem_ctx,
453 "host/%s@%s",
454 r->in.machine_name,
455 r->out.dns_domain_name);
456 if (!r->in.upn) {
457 return ADS_ERROR(LDAP_NO_MEMORY);
458 }
459 }
460
461 /* now do the mods */
462
463 mods = ads_init_mods(mem_ctx);
464 if (!mods) {
465 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
466 }
467
468 /* fields of primary importance */
469
470 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
471 if (!ADS_ERR_OK(status)) {
472 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
473 }
474
475 return ads_gen_mod(r->in.ads, r->out.dn, mods);
476 }
477
478
479 /****************************************************************
480 ****************************************************************/
481
482 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
483 struct libnet_JoinCtx *r)
484 {
485 ADS_STATUS status;
486 ADS_MODLIST mods;
487 char *os_sp = NULL;
488
489 if (!r->in.os_name || !r->in.os_version ) {
490 return ADS_SUCCESS;
491 }
492
493 /* Find our DN */
494
495 status = libnet_join_find_machine_acct(mem_ctx, r);
496 if (!ADS_ERR_OK(status)) {
497 return status;
498 }
499
500 /* now do the mods */
501
502 mods = ads_init_mods(mem_ctx);
503 if (!mods) {
504 return ADS_ERROR(LDAP_NO_MEMORY);
505 }
506
507 os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
508 if (!os_sp) {
509 return ADS_ERROR(LDAP_NO_MEMORY);
510 }
511
512 /* fields of primary importance */
513
514 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
515 r->in.os_name);
516 if (!ADS_ERR_OK(status)) {
517 return status;
518 }
519
520 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
521 r->in.os_version);
522 if (!ADS_ERR_OK(status)) {
523 return status;
524 }
525
526 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
527 os_sp);
528 if (!ADS_ERR_OK(status)) {
529 return status;
530 }
531
532 return ads_gen_mod(r->in.ads, r->out.dn, mods);
533 }
534
535 /****************************************************************
536 ****************************************************************/
537
538 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
539 struct libnet_JoinCtx *r)
540 {
541 if (!USE_SYSTEM_KEYTAB) {
542 return true;
543 }
544
545 if (ads_keytab_create_default(r->in.ads) != 0) {
546 return false;
547 }
548
549 return true;
550 }
551
552 /****************************************************************
553 ****************************************************************/
554
555 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
556 struct libnet_JoinCtx *r)
557 {
558 uint32_t domain_func;
559 ADS_STATUS status;
560 const char *salt = NULL;
561 char *std_salt = NULL;
562
563 status = ads_domain_func_level(r->in.ads, &domain_func);
564 if (!ADS_ERR_OK(status)) {
565 libnet_join_set_error_string(mem_ctx, r,
566 "failed to determine domain functional level: %s",
567 ads_errstr(status));
568 return false;
569 }
570
571 /* go ahead and setup the default salt */
572
573 std_salt = kerberos_standard_des_salt();
574 if (!std_salt) {
575 libnet_join_set_error_string(mem_ctx, r,
576 "failed to obtain standard DES salt");
577 return false;
578 }
579
580 salt = talloc_strdup(mem_ctx, std_salt);
581 if (!salt) {
582 return false;
583 }
584
585 SAFE_FREE(std_salt);
586
587 /* if it's a Windows functional domain, we have to look for the UPN */
588
589 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
590 char *upn;
591
592 upn = ads_get_upn(r->in.ads, mem_ctx,
593 r->in.machine_name);
594 if (upn) {
595 salt = talloc_strdup(mem_ctx, upn);
596 if (!salt) {
597 return false;
598 }
599 }
600 }
601
602 return kerberos_secrets_store_des_salt(salt);
603 }
604
605 /****************************************************************
606 ****************************************************************/
607
608 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
609 struct libnet_JoinCtx *r)
610 {
611 ADS_STATUS status;
612
613 if (!r->in.ads) {
614 status = libnet_join_connect_ads(mem_ctx, r);
615 if (!ADS_ERR_OK(status)) {
616 return status;
617 }
618 }
619
620 status = libnet_join_set_machine_spn(mem_ctx, r);
621 if (!ADS_ERR_OK(status)) {
622 libnet_join_set_error_string(mem_ctx, r,
623 "failed to set machine spn: %s",
624 ads_errstr(status));
625 return status;
626 }
627
628 status = libnet_join_set_os_attributes(mem_ctx, r);
629 if (!ADS_ERR_OK(status)) {
630 libnet_join_set_error_string(mem_ctx, r,
631 "failed to set machine os attributes: %s",
632 ads_errstr(status));
633 return status;
634 }
635
636 status = libnet_join_set_machine_upn(mem_ctx, r);
637 if (!ADS_ERR_OK(status)) {
638 libnet_join_set_error_string(mem_ctx, r,
639 "failed to set machine upn: %s",
640 ads_errstr(status));
641 return status;
642 }
643
644 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
645 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
646 }
647
648 if (!libnet_join_create_keytab(mem_ctx, r)) {
649 libnet_join_set_error_string(mem_ctx, r,
650 "failed to create kerberos keytab");
651 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
652 }
653
654 return ADS_SUCCESS;
655 }
656 #endif /* HAVE_ADS */
657
658 /****************************************************************
659 Store the machine password and domain SID
660 ****************************************************************/
661
662 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
663 struct libnet_JoinCtx *r)
664 {
665 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
666 r->out.domain_sid))
667 {
668 DEBUG(1,("Failed to save domain sid\n"));
669 return false;
670 }
671
672 if (!secrets_store_machine_password(r->in.machine_password,
673 r->out.netbios_domain_name,
674 r->in.secure_channel_type))
675 {
676 DEBUG(1,("Failed to save machine password\n"));
677 return false;
678 }
679
680 return true;
681 }
682
683 /****************************************************************
684 Connect dc's IPC$ share
685 ****************************************************************/
686
687 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
688 const char *user,
689 const char *pass,
690 bool use_kerberos,
691 struct cli_state **cli)
692 {
693 int flags = 0;
694
695 if (use_kerberos) {
696 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
697 }
698
699 if (use_kerberos && pass) {
700 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
701 }
702
703 return cli_full_connection(cli, NULL,
704 dc,
705 NULL, 0,
706 "IPC$", "IPC",
707 user,
708 NULL,
709 pass,
710 flags,
711 SMB_SIGNING_DEFAULT);
712 }
713
714 /****************************************************************
715 Lookup domain dc's info
716 ****************************************************************/
717
718 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
719 struct libnet_JoinCtx *r,
720 struct cli_state **cli)
721 {
722 struct rpc_pipe_client *pipe_hnd = NULL;
723 struct policy_handle lsa_pol;
724 NTSTATUS status, result;
725 union lsa_PolicyInformation *info = NULL;
726 struct dcerpc_binding_handle *b;
727
728 status = libnet_join_connect_dc_ipc(r->in.dc_name,
729 r->in.admin_account,
730 r->in.admin_password,
731 r->in.use_kerberos,
732 cli);
733 if (!NT_STATUS_IS_OK(status)) {
734 goto done;
735 }
736
737 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
738 &pipe_hnd);
739 if (!NT_STATUS_IS_OK(status)) {
740 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
741 nt_errstr(status)));
742 goto done;
743 }
744
745 b = pipe_hnd->binding_handle;
746
747 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
748 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
749 if (!NT_STATUS_IS_OK(status)) {
750 goto done;
751 }
752
753 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
754 &lsa_pol,
755 LSA_POLICY_INFO_DNS,
756 &info,
757 &result);
758 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
759 r->out.domain_is_ad = true;
760 r->out.netbios_domain_name = info->dns.name.string;
761 r->out.dns_domain_name = info->dns.dns_domain.string;
762 r->out.forest_name = info->dns.dns_forest.string;
763 r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
764 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
765 }
766
767 if (!NT_STATUS_IS_OK(status)) {
768 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
769 &lsa_pol,
770 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
771 &info,
772 &result);
773 if (!NT_STATUS_IS_OK(status)) {
774 goto done;
775 }
776 if (!NT_STATUS_IS_OK(result)) {
777 status = result;
778 goto done;
779 }
780
781 r->out.netbios_domain_name = info->account_domain.name.string;
782 r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
783 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
784 }
785
786 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
787 TALLOC_FREE(pipe_hnd);
788
789 done:
790 return status;
791 }
792
793 /****************************************************************
794 Do the domain join unsecure
795 ****************************************************************/
796
797 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
798 struct libnet_JoinCtx *r,
799 struct cli_state *cli)
800 {
801 struct rpc_pipe_client *pipe_hnd = NULL;
802 unsigned char orig_trust_passwd_hash[16];
803 unsigned char new_trust_passwd_hash[16];
804 fstring trust_passwd;
805 NTSTATUS status;
806
807 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
808 &pipe_hnd);
809 if (!NT_STATUS_IS_OK(status)) {
810 return status;
811 }
812
813 if (!r->in.machine_password) {
814 r->in.machine_password = generate_random_password(mem_ctx,
815 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
816 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
817 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
818 }
819
820 E_md4hash(r->in.machine_password, new_trust_passwd_hash);
821
822 /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
823 fstrcpy(trust_passwd, r->in.admin_password);
824 if (!strlower_m(trust_passwd)) {
825 return NT_STATUS_INVALID_PARAMETER;
826 }
827
828 /*
829 * Machine names can be 15 characters, but the max length on
830 * a password is 14. --jerry
831 */
832
833 trust_passwd[14] = '\0';
834
835 E_md4hash(trust_passwd, orig_trust_passwd_hash);
836
837 status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
838 r->in.machine_name,
839 orig_trust_passwd_hash,
840 r->in.machine_password,
841 new_trust_passwd_hash,
842 r->in.secure_channel_type);
843
844 return status;
845 }
846
847 /****************************************************************
848 Do the domain join
849 ****************************************************************/
850
851 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
852 struct libnet_JoinCtx *r,
853 struct cli_state *cli)
854 {
855 struct rpc_pipe_client *pipe_hnd = NULL;
856 struct policy_handle sam_pol, domain_pol, user_pol;
857 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
858 char *acct_name;
859 struct lsa_String lsa_acct_name;
860 uint32_t user_rid;
861 uint32_t acct_flags = ACB_WSTRUST;
862 struct samr_Ids user_rids;
863 struct samr_Ids name_types;
864 union samr_UserInfo user_info;
865 struct dcerpc_binding_handle *b = NULL;
866
867 DATA_BLOB session_key = data_blob_null;
868 struct samr_CryptPassword crypt_pwd;
869 struct samr_CryptPasswordEx crypt_pwd_ex;
870
871 ZERO_STRUCT(sam_pol);
872 ZERO_STRUCT(domain_pol);
873 ZERO_STRUCT(user_pol);
874
875 switch (r->in.secure_channel_type) {
876 case SEC_CHAN_WKSTA:
877 acct_flags = ACB_WSTRUST;
878 break;
879 case SEC_CHAN_BDC:
880 acct_flags = ACB_SVRTRUST;
881 break;
882 default:
883 return NT_STATUS_INVALID_PARAMETER;
884 }
885
886 if (!r->in.machine_password) {
887 r->in.machine_password = generate_random_password(mem_ctx,
888 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
889 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
890 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
891 }
892
893 /* Open the domain */
894
895 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
896 &pipe_hnd);
897 if (!NT_STATUS_IS_OK(status)) {
898 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
899 nt_errstr(status)));
900 goto done;
901 }
902
903 b = pipe_hnd->binding_handle;
904
905 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
906 if (!NT_STATUS_IS_OK(status)) {
907 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
908 nt_errstr(status)));
909 goto done;
910 }
911
912 status = dcerpc_samr_Connect2(b, mem_ctx,
913 pipe_hnd->desthost,
914 SAMR_ACCESS_ENUM_DOMAINS
915 | SAMR_ACCESS_LOOKUP_DOMAIN,
916 &sam_pol,
917 &result);
918 if (!NT_STATUS_IS_OK(status)) {
919 goto done;
920 }
921 if (!NT_STATUS_IS_OK(result)) {
922 status = result;
923 goto done;
924 }
925
926 status = dcerpc_samr_OpenDomain(b, mem_ctx,
927 &sam_pol,
928 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
929 | SAMR_DOMAIN_ACCESS_CREATE_USER
930 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
931 r->out.domain_sid,
932 &domain_pol,
933 &result);
934 if (!NT_STATUS_IS_OK(status)) {
935 goto done;
936 }
937 if (!NT_STATUS_IS_OK(result)) {
938 status = result;
939 goto done;
940 }
941
942 /* Create domain user */
943
944 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
945 if (!strlower_m(acct_name)) {
946 status = NT_STATUS_INVALID_PARAMETER;
947 goto done;
948 }
949
950 init_lsa_String(&lsa_acct_name, acct_name);
951
952 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
953 uint32_t access_desired =
954 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
955 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
956 SAMR_USER_ACCESS_SET_PASSWORD |
957 SAMR_USER_ACCESS_GET_ATTRIBUTES |
958 SAMR_USER_ACCESS_SET_ATTRIBUTES;
959 uint32_t access_granted = 0;
960
961 DEBUG(10,("Creating account with desired access mask: %d\n",
962 access_desired));
963
964 status = dcerpc_samr_CreateUser2(b, mem_ctx,
965 &domain_pol,
966 &lsa_acct_name,
967 acct_flags,
968 access_desired,
969 &user_pol,
970 &access_granted,
971 &user_rid,
972 &result);
973 if (!NT_STATUS_IS_OK(status)) {
974 goto done;
975 }
976
977 status = result;
978 if (!NT_STATUS_IS_OK(status) &&
979 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
980
981 DEBUG(10,("Creation of workstation account failed: %s\n",
982 nt_errstr(status)));
983
984 /* If NT_STATUS_ACCESS_DENIED then we have a valid
985 username/password combo but the user does not have
986 administrator access. */
987
988 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
989 libnet_join_set_error_string(mem_ctx, r,
990 "User specified does not have "
991 "administrator privileges");
992 }
993
994 goto done;
995 }
996
997 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
998 if (!(r->in.join_flags &
999 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
1000 goto done;
1001 }
1002 }
1003
1004 /* We *must* do this.... don't ask... */
1005
1006 if (NT_STATUS_IS_OK(status)) {
1007 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1008 }
1009 }
1010
1011 status = dcerpc_samr_LookupNames(b, mem_ctx,
1012 &domain_pol,
1013 1,
1014 &lsa_acct_name,
1015 &user_rids,
1016 &name_types,
1017 &result);
1018 if (!NT_STATUS_IS_OK(status)) {
1019 goto done;
1020 }
1021 if (!NT_STATUS_IS_OK(result)) {
1022 status = result;
1023 goto done;
1024 }
1025
1026 if (name_types.ids[0] != SID_NAME_USER) {
1027 DEBUG(0,("%s is not a user account (type=%d)\n",
1028 acct_name, name_types.ids[0]));
1029 status = NT_STATUS_INVALID_WORKSTATION;
1030 goto done;
1031 }
1032
1033 user_rid = user_rids.ids[0];
1034
1035 /* Open handle on user */
1036
1037 status = dcerpc_samr_OpenUser(b, mem_ctx,
1038 &domain_pol,
1039 SEC_FLAG_MAXIMUM_ALLOWED,
1040 user_rid,
1041 &user_pol,
1042 &result);
1043 if (!NT_STATUS_IS_OK(status)) {
1044 goto done;
1045 }
1046 if (!NT_STATUS_IS_OK(result)) {
1047 status = result;
1048 goto done;
1049 }
1050
1051 /* Fill in the additional account flags now */
1052
1053 acct_flags |= ACB_PWNOEXP;
1054
1055 /* Set account flags on machine account */
1056 ZERO_STRUCT(user_info.info16);
1057 user_info.info16.acct_flags = acct_flags;
1058
1059 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1060 &user_pol,
1061 16,
1062 &user_info,
1063 &result);
1064 if (!NT_STATUS_IS_OK(status)) {
1065 dcerpc_samr_DeleteUser(b, mem_ctx,
1066 &user_pol,
1067 &result);
1068
1069 libnet_join_set_error_string(mem_ctx, r,
1070 "Failed to set account flags for machine account (%s)\n",
1071 nt_errstr(status));
1072 goto done;
1073 }
1074
1075 if (!NT_STATUS_IS_OK(result)) {
1076 status = result;
1077
1078 dcerpc_samr_DeleteUser(b, mem_ctx,
1079 &user_pol,
1080 &result);
1081
1082 libnet_join_set_error_string(mem_ctx, r,
1083 "Failed to set account flags for machine account (%s)\n",
1084 nt_errstr(status));
1085 goto done;
1086 }
1087
1088 /* Set password on machine account - first try level 26 */
1089
1090 init_samr_CryptPasswordEx(r->in.machine_password,
1091 &session_key,
1092 &crypt_pwd_ex);
1093
1094 user_info.info26.password = crypt_pwd_ex;
1095 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1096
1097 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1098 &user_pol,
1099 26,
1100 &user_info,
1101 &result);
1102
1103 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1104
1105 /* retry with level 24 */
1106
1107 init_samr_CryptPassword(r->in.machine_password,
1108 &session_key,
1109 &crypt_pwd);
1110
1111 user_info.info24.password = crypt_pwd;
1112 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1113
1114 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1115 &user_pol,
1116 24,
1117 &user_info,
1118 &result);
1119 }
1120
1121 if (!NT_STATUS_IS_OK(status)) {
1122
1123 dcerpc_samr_DeleteUser(b, mem_ctx,
1124 &user_pol,
1125 &result);
1126
1127 libnet_join_set_error_string(mem_ctx, r,
1128 "Failed to set password for machine account (%s)\n",
1129 nt_errstr(status));
1130 goto done;
1131 }
1132 if (!NT_STATUS_IS_OK(result)) {
1133 status = result;
1134
1135 dcerpc_samr_DeleteUser(b, mem_ctx,
1136 &user_pol,
1137 &result);
1138
1139 libnet_join_set_error_string(mem_ctx, r,
1140 "Failed to set password for machine account (%s)\n",
1141 nt_errstr(status));
1142 goto done;
1143 }
1144
1145 status = NT_STATUS_OK;
1146
1147 done:
1148 if (!pipe_hnd) {
1149 return status;
1150 }
1151
1152 data_blob_clear_free(&session_key);
1153
1154 if (is_valid_policy_hnd(&sam_pol)) {
1155 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1156 }
1157 if (is_valid_policy_hnd(&domain_pol)) {
1158 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1159 }
1160 if (is_valid_policy_hnd(&user_pol)) {
1161 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1162 }
1163 TALLOC_FREE(pipe_hnd);
1164
1165 return status;
1166 }
1167
1168 /****************************************************************
1169 ****************************************************************/
1170
1171 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1172 const char *machine_name,
1173 const char *dc_name)
1174 {
1175 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1176 struct cli_state *cli = NULL;
1177 struct rpc_pipe_client *pipe_hnd = NULL;
1178 struct rpc_pipe_client *netlogon_pipe = NULL;
1179 NTSTATUS status;
1180 char *machine_password = NULL;
1181 char *machine_account = NULL;
1182
1183 if (!dc_name) {
1184 return NT_STATUS_INVALID_PARAMETER;
1185 }
1186
1187 if (!secrets_init()) {
1188 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1189 }
1190
1191 machine_password = secrets_fetch_machine_password(netbios_domain_name,
1192 NULL, NULL);
1193 if (!machine_password) {
1194 return NT_STATUS_NO_TRUST_LSA_SECRET;
1195 }
1196
1197 if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1198 SAFE_FREE(machine_password);
1199 return NT_STATUS_NO_MEMORY;
1200 }
1201
1202 status = cli_full_connection(&cli, NULL,
1203 dc_name,
1204 NULL, 0,
1205 "IPC$", "IPC",
1206 machine_account,
1207 NULL,
1208 machine_password,
1209 0,
1210 SMB_SIGNING_DEFAULT);
1211 free(machine_account);
1212 free(machine_password);
1213
1214 if (!NT_STATUS_IS_OK(status)) {
1215 status = cli_full_connection(&cli, NULL,
1216 dc_name,
1217 NULL, 0,
1218 "IPC$", "IPC",
1219 "",
1220 NULL,
1221 "",
1222 0,
1223 SMB_SIGNING_DEFAULT);
1224 }
1225
1226 if (!NT_STATUS_IS_OK(status)) {
1227 return status;
1228 }
1229
1230 status = get_schannel_session_key(cli, netbios_domain_name,
1231 &neg_flags, &netlogon_pipe);
1232 if (!NT_STATUS_IS_OK(status)) {
1233 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1234 cli_shutdown(cli);
1235 return NT_STATUS_OK;
1236 }
1237
1238 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1239 "key from server %s for domain %s. Error was %s\n",
1240 smbXcli_conn_remote_name(cli->conn),
1241 netbios_domain_name, nt_errstr(status)));
1242 cli_shutdown(cli);
1243 return status;
1244 }
1245
1246 if (!lp_client_schannel()) {
1247 cli_shutdown(cli);
1248 return NT_STATUS_OK;
1249 }
1250
1251 status = cli_rpc_pipe_open_schannel_with_key(
1252 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1253 DCERPC_AUTH_LEVEL_PRIVACY,
1254 netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1255
1256 cli_shutdown(cli);
1257
1258 if (!NT_STATUS_IS_OK(status)) {
1259 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1260 "on netlogon pipe to server %s for domain %s. "
1261 "Error was %s\n",
1262 smbXcli_conn_remote_name(cli->conn),
1263 netbios_domain_name, nt_errstr(status)));
1264 return status;
1265 }
1266
1267 return NT_STATUS_OK;
1268 }
1269
1270 /****************************************************************
1271 ****************************************************************/
1272
1273 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1274 struct libnet_JoinCtx *r)
1275 {
1276 NTSTATUS status;
1277
1278 status = libnet_join_ok(r->out.netbios_domain_name,
1279 r->in.machine_name,
1280 r->in.dc_name);
1281 if (!NT_STATUS_IS_OK(status)) {
1282 libnet_join_set_error_string(mem_ctx, r,
1283 "failed to verify domain membership after joining: %s",
1284 get_friendly_nt_error_msg(status));
1285 return WERR_SETUP_NOT_JOINED;
1286 }
1287
1288 return WERR_OK;
1289 }
1290
1291 /****************************************************************
1292 ****************************************************************/
1293
1294 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1295 struct libnet_UnjoinCtx *r)
1296 {
1297 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1298 return false;
1299 }
1300
1301 if (!secrets_delete_domain_sid(lp_workgroup())) {
1302 return false;
1303 }
1304
1305 return true;
1306 }
1307
1308 /****************************************************************
1309 ****************************************************************/
1310
1311 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1312 struct libnet_UnjoinCtx *r)
1313 {
1314 struct cli_state *cli = NULL;
1315 struct rpc_pipe_client *pipe_hnd = NULL;
1316 struct policy_handle sam_pol, domain_pol, user_pol;
1317 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1318 char *acct_name;
1319 uint32_t user_rid;
1320 struct lsa_String lsa_acct_name;
1321 struct samr_Ids user_rids;
1322 struct samr_Ids name_types;
1323 union samr_UserInfo *info = NULL;
1324 struct dcerpc_binding_handle *b = NULL;
1325
1326 ZERO_STRUCT(sam_pol);
1327 ZERO_STRUCT(domain_pol);
1328 ZERO_STRUCT(user_pol);
1329
1330 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1331 r->in.admin_account,
1332 r->in.admin_password,
1333 r->in.use_kerberos,
1334 &cli);
1335 if (!NT_STATUS_IS_OK(status)) {
1336 goto done;
1337 }
1338
1339 /* Open the domain */
1340
1341 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1342 &pipe_hnd);
1343 if (!NT_STATUS_IS_OK(status)) {
1344 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1345 nt_errstr(status)));
1346 goto done;
1347 }
1348
1349 b = pipe_hnd->binding_handle;
1350
1351 status = dcerpc_samr_Connect2(b, mem_ctx,
1352 pipe_hnd->desthost,
1353 SEC_FLAG_MAXIMUM_ALLOWED,
1354 &sam_pol,
1355 &result);
1356 if (!NT_STATUS_IS_OK(status)) {
1357 goto done;
1358 }
1359 if (!NT_STATUS_IS_OK(result)) {
1360 status = result;
1361 goto done;
1362 }
1363
1364 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1365 &sam_pol,
1366 SEC_FLAG_MAXIMUM_ALLOWED,
1367 r->in.domain_sid,
1368 &domain_pol,
1369 &result);
1370 if (!NT_STATUS_IS_OK(status)) {
1371 goto done;
1372 }
1373 if (!NT_STATUS_IS_OK(result)) {
1374 status = result;
1375 goto done;
1376 }
1377
1378 /* Create domain user */
1379
1380 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1381 if (!strlower_m(acct_name)) {
1382 status = NT_STATUS_INVALID_PARAMETER;
1383 goto done;
1384 }
1385
1386 init_lsa_String(&lsa_acct_name, acct_name);
1387
1388 status = dcerpc_samr_LookupNames(b, mem_ctx,
1389 &domain_pol,
1390 1,
1391 &lsa_acct_name,
1392 &user_rids,
1393 &name_types,
1394 &result);
1395
1396 if (!NT_STATUS_IS_OK(status)) {
1397 goto done;
1398 }
1399 if (!NT_STATUS_IS_OK(result)) {
1400 status = result;
1401 goto done;
1402 }
1403
1404 if (name_types.ids[0] != SID_NAME_USER) {
1405 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1406 name_types.ids[0]));
1407 status = NT_STATUS_INVALID_WORKSTATION;
1408 goto done;
1409 }
1410
1411 user_rid = user_rids.ids[0];
1412
1413 /* Open handle on user */
1414
1415 status = dcerpc_samr_OpenUser(b, mem_ctx,
1416 &domain_pol,
1417 SEC_FLAG_MAXIMUM_ALLOWED,
1418 user_rid,
1419 &user_pol,
1420 &result);
1421 if (!NT_STATUS_IS_OK(status)) {
1422 goto done;
1423 }
1424 if (!NT_STATUS_IS_OK(result)) {
1425 status = result;
1426 goto done;
1427 }
1428
1429 /* Get user info */
1430
1431 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1432 &user_pol,
1433 16,
1434 &info,
1435 &result);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1438 goto done;
1439 }
1440 if (!NT_STATUS_IS_OK(result)) {
1441 status = result;
1442 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1443 goto done;
1444 }
1445
1446 /* now disable and setuser info */
1447
1448 info->info16.acct_flags |= ACB_DISABLED;
1449
1450 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1451 &user_pol,
1452 16,
1453 info,
1454 &result);
1455 if (!NT_STATUS_IS_OK(status)) {
1456 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1457 goto done;
1458 }
1459 if (!NT_STATUS_IS_OK(result)) {
1460 status = result;
1461 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1462 goto done;
1463 }
1464 status = result;
1465 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1466
1467 done:
1468 if (pipe_hnd && b) {
1469 if (is_valid_policy_hnd(&domain_pol)) {
1470 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1471 }
1472 if (is_valid_policy_hnd(&sam_pol)) {
1473 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1474 }
1475 TALLOC_FREE(pipe_hnd);
1476 }
1477
1478 if (cli) {
1479 cli_shutdown(cli);
1480 }
1481
1482 return status;
1483 }
1484
1485 /****************************************************************
1486 ****************************************************************/
1487
1488 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1489 {
1490 WERROR werr = WERR_OK;
1491 sbcErr err;
1492 struct smbconf_ctx *ctx;
1493
1494 err = smbconf_init_reg(r, &ctx, NULL);
1495 if (!SBC_ERROR_IS_OK(err)) {
1496 werr = WERR_NO_SUCH_SERVICE;
1497 goto done;
1498 }
1499
1500 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1501
1502 err = smbconf_set_global_parameter(ctx, "security", "user");
1503 if (!SBC_ERROR_IS_OK(err)) {
1504 werr = WERR_NO_SUCH_SERVICE;
1505 goto done;
1506 }
1507
1508 err = smbconf_set_global_parameter(ctx, "workgroup",
1509 r->in.domain_name);
1510 if (!SBC_ERROR_IS_OK(err)) {
1511 werr = WERR_NO_SUCH_SERVICE;
1512 goto done;
1513 }
1514
1515 smbconf_delete_global_parameter(ctx, "realm");
1516 goto done;
1517 }
1518
1519 err = smbconf_set_global_parameter(ctx, "security", "domain");
1520 if (!SBC_ERROR_IS_OK(err)) {
1521 werr = WERR_NO_SUCH_SERVICE;
1522 goto done;
1523 }
1524
1525 err = smbconf_set_global_parameter(ctx, "workgroup",
1526 r->out.netbios_domain_name);
1527 if (!SBC_ERROR_IS_OK(err)) {
1528 werr = WERR_NO_SUCH_SERVICE;
1529 goto done;
1530 }
1531
1532 if (r->out.domain_is_ad) {
1533 err = smbconf_set_global_parameter(ctx, "security", "ads");
1534 if (!SBC_ERROR_IS_OK(err)) {
1535 werr = WERR_NO_SUCH_SERVICE;
1536 goto done;
1537 }
1538
1539 err = smbconf_set_global_parameter(ctx, "realm",
1540 r->out.dns_domain_name);
1541 if (!SBC_ERROR_IS_OK(err)) {
1542 werr = WERR_NO_SUCH_SERVICE;
1543 goto done;
1544 }
1545 }
1546
1547 done:
1548 smbconf_shutdown(ctx);
1549 return werr;
1550 }
1551
1552 /****************************************************************
1553 ****************************************************************/
1554
1555 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1556 {
1557 WERROR werr = WERR_OK;
1558 sbcErr err;
1559 struct smbconf_ctx *ctx;
1560
1561 err = smbconf_init_reg(r, &ctx, NULL);
1562 if (!SBC_ERROR_IS_OK(err)) {
1563 werr = WERR_NO_SUCH_SERVICE;
1564 goto done;
1565 }
1566
1567 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1568
1569 err = smbconf_set_global_parameter(ctx, "security", "user");
1570 if (!SBC_ERROR_IS_OK(err)) {
1571 werr = WERR_NO_SUCH_SERVICE;
1572 goto done;
1573 }
1574
1575 err = smbconf_delete_global_parameter(ctx, "workgroup");
1576 if (!SBC_ERROR_IS_OK(err)) {
1577 werr = WERR_NO_SUCH_SERVICE;
1578 goto done;
1579 }
1580
1581 smbconf_delete_global_parameter(ctx, "realm");
1582 }
1583
1584 done:
1585 smbconf_shutdown(ctx);
1586 return werr;
1587 }
1588
1589 /****************************************************************
1590 ****************************************************************/
1591
1592 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1593 {
1594 WERROR werr;
1595
1596 if (!W_ERROR_IS_OK(r->out.result)) {
1597 return r->out.result;
1598 }
1599
1600 if (!r->in.modify_config) {
1601 return WERR_OK;
1602 }
1603
1604 werr = do_join_modify_vals_config(r);
1605 if (!W_ERROR_IS_OK(werr)) {
1606 return werr;
1607 }
1608
1609 lp_load_global(get_dyn_CONFIGFILE());
1610
1611 r->out.modified_config = true;
1612 r->out.result = werr;
1613
1614 return werr;
1615 }
1616
1617 /****************************************************************
1618 ****************************************************************/
1619
1620 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1621 {
1622 WERROR werr;
1623
1624 if (!W_ERROR_IS_OK(r->out.result)) {
1625 return r->out.result;
1626 }
1627
1628 if (!r->in.modify_config) {
1629 return WERR_OK;
1630 }
1631
1632 werr = do_unjoin_modify_vals_config(r);
1633 if (!W_ERROR_IS_OK(werr)) {
1634 return werr;
1635 }
1636
1637 lp_load_global(get_dyn_CONFIGFILE());
1638
1639 r->out.modified_config = true;
1640 r->out.result = werr;
1641
1642 return werr;
1643 }
1644
1645 /****************************************************************
1646 ****************************************************************/
1647
1648 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1649 const char *domain_str,
1650 const char **domain_p,
1651 const char **dc_p)
1652 {
1653 char *domain = NULL;
1654 char *dc = NULL;
1655 const char *p = NULL;
1656
1657 if (!domain_str || !domain_p || !dc_p) {
1658 return false;
1659 }
1660
1661 p = strchr_m(domain_str, '\\');
1662
1663 if (p != NULL) {
1664 domain = talloc_strndup(mem_ctx, domain_str,
1665 PTR_DIFF(p, domain_str));
1666 dc = talloc_strdup(mem_ctx, p+1);
1667 if (!dc) {
1668 return false;
1669 }
1670 } else {
1671 domain = talloc_strdup(mem_ctx, domain_str);
1672 dc = NULL;
1673 }
1674 if (!domain) {
1675 return false;
1676 }
1677
1678 *domain_p = domain;
1679
1680 if (!*dc_p && dc) {
1681 *dc_p = dc;
1682 }
1683
1684 return true;
1685 }
1686
1687 /****************************************************************
1688 ****************************************************************/
1689
1690 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1691 struct libnet_JoinCtx *r)
1692 {
1693 if (!r->in.domain_name) {
1694 libnet_join_set_error_string(mem_ctx, r,
1695 "No domain name defined");
1696 return WERR_INVALID_PARAM;
1697 }
1698
1699 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1700 &r->in.domain_name,
1701 &r->in.dc_name)) {
1702 libnet_join_set_error_string(mem_ctx, r,
1703 "Failed to parse domain name");
1704 return WERR_INVALID_PARAM;
1705 }
1706
1707 if (IS_DC) {
1708 return WERR_SETUP_DOMAIN_CONTROLLER;
1709 }
1710
1711 if (!secrets_init()) {
1712 libnet_join_set_error_string(mem_ctx, r,
1713 "Unable to open secrets database");
1714 return WERR_CAN_NOT_COMPLETE;
1715 }
1716
1717 return WERR_OK;
1718 }
1719
1720 /****************************************************************
1721 ****************************************************************/
1722
1723 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1724 {
1725 NTSTATUS status;
1726
1727 /* Try adding dom admins to builtin\admins. Only log failures. */
1728 status = create_builtin_administrators(domain_sid);
1729 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1730 DEBUG(10,("Unable to auto-add domain administrators to "
1731 "BUILTIN\\Administrators during join because "
1732 "winbindd must be running.\n"));
1733 } else if (!NT_STATUS_IS_OK(status)) {
1734 DEBUG(5, ("Failed to auto-add domain administrators to "
1735 "BUILTIN\\Administrators during join: %s\n",
1736 nt_errstr(status)));
1737 }
1738
1739 /* Try adding dom users to builtin\users. Only log failures. */
1740 status = create_builtin_users(domain_sid);
1741 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1742 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1743 "during join because winbindd must be running.\n"));
1744 } else if (!NT_STATUS_IS_OK(status)) {
1745 DEBUG(5, ("Failed to auto-add domain administrators to "
1746 "BUILTIN\\Administrators during join: %s\n",
1747 nt_errstr(status)));
1748 }
1749 }
1750
1751 /****************************************************************
1752 ****************************************************************/
1753
1754 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1755 struct libnet_JoinCtx *r)
1756 {
1757 WERROR werr;
1758
1759 if (!W_ERROR_IS_OK(r->out.result)) {
1760 return r->out.result;
1761 }
1762
1763 werr = do_JoinConfig(r);
1764 if (!W_ERROR_IS_OK(werr)) {
1765 return werr;
1766 }
1767
1768 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1769 return WERR_OK;
1770 }
1771
1772 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1773 if (r->out.dns_domain_name) {
1774 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1775 }
1776
1777 #ifdef HAVE_ADS
1778 if (r->out.domain_is_ad &&
1779 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1780 ADS_STATUS ads_status;
1781
1782 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1783 if (!ADS_ERR_OK(ads_status)) {
1784 return WERR_GENERAL_FAILURE;
1785 }
1786 }
1787 #endif /* HAVE_ADS */
1788
1789 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1790
1791 return WERR_OK;
1792 }
1793
1794 /****************************************************************
1795 ****************************************************************/
1796
1797 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1798 {
1799 if (r->in.ads) {
1800 ads_destroy(&r->in.ads);
1801 }
1802
1803 return 0;
1804 }
1805
1806 /****************************************************************
1807 ****************************************************************/
1808
1809 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1810 {
1811 if (r->in.ads) {
1812 ads_destroy(&r->in.ads);
1813 }
1814
1815 return 0;
1816 }
1817
1818 /****************************************************************
1819 ****************************************************************/
1820
1821 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1822 struct libnet_JoinCtx **r)
1823 {
1824 struct libnet_JoinCtx *ctx;
1825
1826 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1827 if (!ctx) {
1828 return WERR_NOMEM;
1829 }
1830
1831 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1832
1833 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
1834 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1835
1836 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1837
1838 *r = ctx;
1839
1840 return WERR_OK;
1841 }
1842
1843 /****************************************************************
1844 ****************************************************************/
1845
1846 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1847 struct libnet_UnjoinCtx **r)
1848 {
1849 struct libnet_UnjoinCtx *ctx;
1850
1851 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1852 if (!ctx) {
1853 return WERR_NOMEM;
1854 }
1855
1856 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1857
1858 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
1859 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1860
1861 *r = ctx;
1862
1863 return WERR_OK;
1864 }
1865
1866 /****************************************************************
1867 ****************************************************************/
1868
1869 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1870 struct libnet_JoinCtx *r)
1871 {
1872 bool valid_security = false;
1873 bool valid_workgroup = false;
1874 bool valid_realm = false;
1875
1876 /* check if configuration is already set correctly */
1877
1878 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1879
1880 switch (r->out.domain_is_ad) {
1881 case false:
1882 valid_security = (lp_security() == SEC_DOMAIN);
1883 if (valid_workgroup && valid_security) {
1884 /* nothing to be done */
1885 return WERR_OK;
1886 }
1887 break;
1888 case true:
1889 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1890 switch (lp_security()) {
1891 case SEC_DOMAIN:
1892 case SEC_ADS:
1893 valid_security = true;
1894 }
1895
1896 if (valid_workgroup && valid_realm && valid_security) {
1897 /* nothing to be done */
1898 return WERR_OK;
1899 }
1900 break;
1901 }
1902
1903 /* check if we are supposed to manipulate configuration */
1904
1905 if (!r->in.modify_config) {
1906
1907 char *wrong_conf = talloc_strdup(mem_ctx, "");
1908
1909 if (!valid_workgroup) {
1910 wrong_conf = talloc_asprintf_append(wrong_conf,
1911 "\"workgroup\" set to '%s', should be '%s'",
1912 lp_workgroup(), r->out.netbios_domain_name);
1913 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1914 }
1915
1916 if (!valid_realm) {
1917 wrong_conf = talloc_asprintf_append(wrong_conf,
1918 "\"realm\" set to '%s', should be '%s'",
1919 lp_realm(), r->out.dns_domain_name);
1920 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1921 }
1922
1923 if (!valid_security) {
1924 const char *sec = NULL;
1925 switch (lp_security()) {
1926 case SEC_USER: sec = "user"; break;
1927 case SEC_DOMAIN: sec = "domain"; break;
1928 case SEC_ADS: sec = "ads"; break;
1929 }
1930 wrong_conf = talloc_asprintf_append(wrong_conf,
1931 "\"security\" set to '%s', should be %s",
1932 sec, r->out.domain_is_ad ?
1933 "either 'domain' or 'ads'" : "'domain'");
1934 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1935 }
1936
1937 libnet_join_set_error_string(mem_ctx, r,
1938 "Invalid configuration (%s) and configuration modification "
1939 "was not requested", wrong_conf);
1940 return WERR_CAN_NOT_COMPLETE;
1941 }
1942
1943 /* check if we are able to manipulate configuration */
1944
1945 if (!lp_config_backend_is_registry()) {
1946 libnet_join_set_error_string(mem_ctx, r,
1947 "Configuration manipulation requested but not "
1948 "supported by backend");
1949 return WERR_NOT_SUPPORTED;
1950 }
1951
1952 return WERR_OK;
1953 }
1954
1955 /****************************************************************
1956 ****************************************************************/
1957
1958 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1959 struct libnet_JoinCtx *r)
1960 {
1961 NTSTATUS status;
1962 WERROR werr;
1963 struct cli_state *cli = NULL;
1964 #ifdef HAVE_ADS
1965 ADS_STATUS ads_status;
1966 #endif /* HAVE_ADS */
1967
1968 if (!r->in.dc_name) {
1969 struct netr_DsRGetDCNameInfo *info;
1970 const char *dc;
1971 status = dsgetdcname(mem_ctx,
1972 r->in.msg_ctx,
1973 r->in.domain_name,
1974 NULL,
1975 NULL,
1976 DS_FORCE_REDISCOVERY |
1977 DS_DIRECTORY_SERVICE_REQUIRED |
1978 DS_WRITABLE_REQUIRED |
1979 DS_RETURN_DNS_NAME,
1980 &info);
1981 if (!NT_STATUS_IS_OK(status)) {
1982 libnet_join_set_error_string(mem_ctx, r,
1983 "failed to find DC for domain %s",
1984 r->in.domain_name,
1985 get_friendly_nt_error_msg(status));
1986 return WERR_DCNOTFOUND;
1987 }
1988
1989 dc = strip_hostname(info->dc_unc);
1990 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1991 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1992 }
1993
1994 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1995 if (!NT_STATUS_IS_OK(status)) {
1996 libnet_join_set_error_string(mem_ctx, r,
1997 "failed to lookup DC info for domain '%s' over rpc: %s",
1998 r->in.domain_name, get_friendly_nt_error_msg(status));
1999 return ntstatus_to_werror(status);
2000 }
2001
2002 werr = libnet_join_check_config(mem_ctx, r);
2003 if (!W_ERROR_IS_OK(werr)) {
2004 goto done;
2005 }
2006
2007 #ifdef HAVE_ADS
2008
2009 create_local_private_krb5_conf_for_domain(
2010 r->out.dns_domain_name, r->out.netbios_domain_name,
2011 NULL, smbXcli_conn_remote_sockaddr(cli->conn),
2012 smbXcli_conn_remote_name(cli->conn));
2013
2014 if (r->out.domain_is_ad && r->in.account_ou &&
2015 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2016
2017 ads_status = libnet_join_connect_ads(mem_ctx, r);
2018 if (!ADS_ERR_OK(ads_status)) {
2019 return WERR_DEFAULT_JOIN_REQUIRED;
2020 }
2021
2022 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
2023 if (!ADS_ERR_OK(ads_status)) {
2024 libnet_join_set_error_string(mem_ctx, r,
2025 "failed to precreate account in ou %s: %s",
2026 r->in.account_ou,
2027 ads_errstr(ads_status));
2028 return WERR_DEFAULT_JOIN_REQUIRED;
2029 }
2030
2031 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
2032 }
2033 #endif /* HAVE_ADS */
2034
2035 if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2036 (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2037 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2038 } else {
2039 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2040 }
2041 if (!NT_STATUS_IS_OK(status)) {
2042 libnet_join_set_error_string(mem_ctx, r,
2043 "failed to join domain '%s' over rpc: %s",
2044 r->in.domain_name, get_friendly_nt_error_msg(status));
2045 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2046 return WERR_SETUP_ALREADY_JOINED;
2047 }
2048 werr = ntstatus_to_werror(status);
2049 goto done;
2050 }
2051
2052 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2053 werr = WERR_SETUP_NOT_JOINED;
2054 goto done;
2055 }
2056
2057 werr = WERR_OK;
2058
2059 done:
2060 if (cli) {
2061 cli_shutdown(cli);
2062 }
2063
2064 return werr;
2065 }
2066
2067 /****************************************************************
2068 ****************************************************************/
2069
2070 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2071 struct libnet_JoinCtx *r)
2072 {
2073 WERROR werr;
2074 struct libnet_UnjoinCtx *u = NULL;
2075
2076 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2077 if (!W_ERROR_IS_OK(werr)) {
2078 return werr;
2079 }
2080
2081 u->in.debug = r->in.debug;
2082 u->in.dc_name = r->in.dc_name;
2083 u->in.domain_name = r->in.domain_name;
2084 u->in.admin_account = r->in.admin_account;
2085 u->in.admin_password = r->in.admin_password;
2086 u->in.modify_config = r->in.modify_config;
2087 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
2088 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2089
2090 werr = libnet_Unjoin(mem_ctx, u);
2091 TALLOC_FREE(u);
2092
2093 return werr;
2094 }
2095
2096 /****************************************************************
2097 ****************************************************************/
2098
2099 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2100 struct libnet_JoinCtx *r)
2101 {
2102 WERROR werr;
2103
2104 if (r->in.debug) {
2105 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2106 }
2107
2108 ZERO_STRUCT(r->out);
2109
2110 werr = libnet_join_pre_processing(mem_ctx, r);
2111 if (!W_ERROR_IS_OK(werr)) {
2112 goto done;
2113 }
2114
2115 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2116 werr = libnet_DomainJoin(mem_ctx, r);
2117 if (!W_ERROR_IS_OK(werr)) {
2118 goto done;
2119 }
2120 }
2121
2122 werr = libnet_join_post_processing(mem_ctx, r);
2123 if (!W_ERROR_IS_OK(werr)) {
2124 goto done;
2125 }
2126
2127 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2128 werr = libnet_join_post_verify(mem_ctx, r);
2129 if (!W_ERROR_IS_OK(werr)) {
2130 libnet_join_rollback(mem_ctx, r);
2131 }
2132 }
2133
2134 done:
2135 r->out.result = werr;
2136
2137 if (r->in.debug) {
2138 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2139 }
2140 return werr;
2141 }
2142
2143 /****************************************************************
2144 ****************************************************************/
2145
2146 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2147 struct libnet_UnjoinCtx *r)
2148 {
2149 NTSTATUS status;
2150
2151 if (!r->in.domain_sid) {
2152 struct dom_sid sid;
2153 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2154 libnet_unjoin_set_error_string(mem_ctx, r,
2155 "Unable to fetch domain sid: are we joined?");
2156 return WERR_SETUP_NOT_JOINED;
2157 }
2158 r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2159 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2160 }
2161
2162 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2163 !r->in.delete_machine_account) {
2164 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2165 return WERR_OK;
2166 }
2167
2168 if (!r->in.dc_name) {
2169 struct netr_DsRGetDCNameInfo *info;
2170 const char *dc;
2171 status = dsgetdcname(mem_ctx,
2172 r->in.msg_ctx,
2173 r->in.domain_name,
2174 NULL,
2175 NULL,
2176 DS_DIRECTORY_SERVICE_REQUIRED |
2177 DS_WRITABLE_REQUIRED |
2178 DS_RETURN_DNS_NAME,
2179 &info);
2180 if (!NT_STATUS_IS_OK(status)) {
2181 libnet_unjoin_set_error_string(mem_ctx, r,
2182 "failed to find DC for domain %s",
2183 r->in.domain_name,
2184 get_friendly_nt_error_msg(status));
2185 return WERR_DCNOTFOUND;
2186 }
2187
2188 dc = strip_hostname(info->dc_unc);
2189 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2190 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2191 }
2192
2193 #ifdef HAVE_ADS
2194 /* for net ads leave, try to delete the account. If it works,
2195 no sense in disabling. If it fails, we can still try to
2196 disable it. jmcd */
2197
2198 if (r->in.delete_machine_account) {
2199 ADS_STATUS ads_status;
2200 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2201 if (ADS_ERR_OK(ads_status)) {
2202 /* dirty hack */
2203 r->out.dns_domain_name =
2204 talloc_strdup(mem_ctx,
2205 r->in.ads->server.realm);
2206 ads_status =
2207 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2208 }
2209 if (!ADS_ERR_OK(ads_status)) {
2210 libnet_unjoin_set_error_string(mem_ctx, r,
2211 "failed to remove machine account from AD: %s",
2212 ads_errstr(ads_status));
2213 } else {
2214 r->out.deleted_machine_account = true;
2215 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2216 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2217 return WERR_OK;
2218 }
2219 }
2220 #endif /* HAVE_ADS */
2221
2222 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2223 "disable". */
2224 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2225 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2226 if (!NT_STATUS_IS_OK(status)) {
2227 libnet_unjoin_set_error_string(mem_ctx, r,
2228 "failed to disable machine account via rpc: %s",
2229 get_friendly_nt_error_msg(status));
2230 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2231 return WERR_SETUP_NOT_JOINED;
2232 }
2233 return ntstatus_to_werror(status);
2234 }
2235
2236 r->out.disabled_machine_account = true;
2237 }
2238
2239 /* If disable succeeded or was not requested at all, we
2240 should be getting rid of our end of things */
2241
2242 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2243
2244 return WERR_OK;
2245 }
2246
2247 /****************************************************************
2248 ****************************************************************/
2249
2250 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2251 struct libnet_UnjoinCtx *r)
2252 {
2253 if (!r->in.domain_name) {
2254 libnet_unjoin_set_error_string(mem_ctx, r,
2255 "No domain name defined");
2256 return WERR_INVALID_PARAM;
2257 }
2258
2259 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2260 &r->in.domain_name,
2261 &r->in.dc_name)) {
2262 libnet_unjoin_set_error_string(mem_ctx, r,
2263 "Failed to parse domain name");
2264 return WERR_INVALID_PARAM;
2265 }
2266
2267 if (IS_DC) {
2268 return WERR_SETUP_DOMAIN_CONTROLLER;
2269 }
2270
2271 if (!secrets_init()) {
2272 libnet_unjoin_set_error_string(mem_ctx, r,
2273 "Unable to open secrets database");
2274 return WERR_CAN_NOT_COMPLETE;
2275 }
2276
2277 return WERR_OK;
2278 }
2279
2280 /****************************************************************
2281 ****************************************************************/
2282
2283 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2284 struct libnet_UnjoinCtx *r)
2285 {
2286 saf_delete(r->out.netbios_domain_name);
2287 saf_delete(r->out.dns_domain_name);
2288
2289 return libnet_unjoin_config(r);
2290 }
2291
2292 /****************************************************************
2293 ****************************************************************/
2294
2295 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2296 struct libnet_UnjoinCtx *r)
2297 {
2298 WERROR werr;
2299
2300 if (r->in.debug) {
2301 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2302 }
2303
2304 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2305 if (!W_ERROR_IS_OK(werr)) {
2306 goto done;
2307 }
2308
2309 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2310 werr = libnet_DomainUnjoin(mem_ctx, r);
2311 if (!W_ERROR_IS_OK(werr)) {
2312 libnet_unjoin_config(r);
2313 goto done;
2314 }
2315 }
2316
2317 werr = libnet_unjoin_post_processing(mem_ctx, r);
2318 if (!W_ERROR_IS_OK(werr)) {
2319 goto done;
2320 }
2321
2322 done:
2323 r->out.result = werr;
2324
2325 if (r->in.debug) {
2326 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2327 }
2328
2329 return werr;
2330 }
reg import