Context Navigation

source: branches/samba-3.2.x/source/libnet/libnet_join.c

Visit:

Last change on this file was 335, checked in by Herwig Bauernfeind, 16 years ago
Update 3.2 to 3.2.14 (final)
File size: 49.8 KB

Line
1	/*
2	* Unix SMB/CIFS implementation.
3	* libnet Join Support
4	* Copyright (C) Gerald (Jerry) Carter 2006
5	* Copyright (C) Guenther Deschner 2007-2008
6	*
7	* This program is free software; you can redistribute it and/or modify
8	* it under the terms of the GNU General Public License as published by
9	* the Free Software Foundation; either version 3 of the License, or
10	* (at your option) any later version.
11	*
12	* This program is distributed in the hope that it will be useful,
13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	* GNU General Public License for more details.
16	*
17	* You should have received a copy of the GNU General Public License
18	* along with this program; if not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "includes.h"
22	#include "libnet/libnet.h"
23
24	/****************************************************************
25	****************************************************************/
26
27	#define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
28	do { \
29	char *str = NULL; \
30	str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
31	DEBUG(1,("libnet_Join:\n%s", str)); \
32	TALLOC_FREE(str); \
33	} while (0)
34
35	#define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
36	LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN \| NDR_SET_VALUES)
37	#define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
38	LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
39
40	#define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
41	do { \
42	char *str = NULL; \
43	str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
44	DEBUG(1,("libnet_Unjoin:\n%s", str)); \
45	TALLOC_FREE(str); \
46	} while (0)
47
48	#define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
49	LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN \| NDR_SET_VALUES)
50	#define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
51	LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
52
53	#define W_ERROR_NOT_OK_GOTO_DONE(x) do { \
54	if (!W_ERROR_IS_OK(x)) {\
55	goto done;\
56	}\
57	} while (0)
58
59	/****************************************************************
60	****************************************************************/
61
62	static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
63	struct libnet_JoinCtx *r,
64	const char *format, ...)
65	{
66	va_list args;
67
68	if (r->out.error_string) {
69	return;
70	}
71
72	va_start(args, format);
73	r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
74	va_end(args);
75	}
76
77	/****************************************************************
78	****************************************************************/
79
80	static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
81	struct libnet_UnjoinCtx *r,
82	const char *format, ...)
83	{
84	va_list args;
85
86	if (r->out.error_string) {
87	return;
88	}
89
90	va_start(args, format);
91	r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
92	va_end(args);
93	}
94
95	#ifdef WITH_ADS
96
97	/****************************************************************
98	****************************************************************/
99
100	static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
101	const char *netbios_domain_name,
102	const char *dc_name,
103	const char *user_name,
104	const char *password,
105	ADS_STRUCT **ads)
106	{
107	ADS_STATUS status;
108	ADS_STRUCT *my_ads = NULL;
109
110	my_ads = ads_init(dns_domain_name,
111	netbios_domain_name,
112	dc_name);
113	if (!my_ads) {
114	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
115	}
116
117	if (user_name) {
118	SAFE_FREE(my_ads->auth.user_name);
119	my_ads->auth.user_name = SMB_STRDUP(user_name);
120	}
121
122	if (password) {
123	SAFE_FREE(my_ads->auth.password);
124	my_ads->auth.password = SMB_STRDUP(password);
125	}
126
127	status = ads_connect(my_ads);
128	if (!ADS_ERR_OK(status)) {
129	ads_destroy(&my_ads);
130	return status;
131	}
132
133	*ads = my_ads;
134	return ADS_SUCCESS;
135	}
136
137	/****************************************************************
138	****************************************************************/
139
140	static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
141	struct libnet_JoinCtx *r)
142	{
143	ADS_STATUS status;
144
145	status = libnet_connect_ads(r->out.dns_domain_name,
146	r->out.netbios_domain_name,
147	r->in.dc_name,
148	r->in.admin_account,
149	r->in.admin_password,
150	&r->in.ads);
151	if (!ADS_ERR_OK(status)) {
152	libnet_join_set_error_string(mem_ctx, r,
153	"failed to connect to AD: %s",
154	ads_errstr(status));
155	return status;
156	}
157
158	if (!r->out.netbios_domain_name) {
159	r->out.netbios_domain_name = talloc_strdup(mem_ctx,
160	r->in.ads->server.workgroup);
161	ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
162	}
163
164	if (!r->out.dns_domain_name) {
165	r->out.dns_domain_name = talloc_strdup(mem_ctx,
166	r->in.ads->config.realm);
167	ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
168	}
169
170	r->out.domain_is_ad = true;
171
172	return ADS_SUCCESS;
173	}
174
175	/****************************************************************
176	****************************************************************/
177
178	static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
179	struct libnet_UnjoinCtx *r)
180	{
181	ADS_STATUS status;
182
183	status = libnet_connect_ads(r->in.domain_name,
184	r->in.domain_name,
185	r->in.dc_name,
186	r->in.admin_account,
187	r->in.admin_password,
188	&r->in.ads);
189	if (!ADS_ERR_OK(status)) {
190	libnet_unjoin_set_error_string(mem_ctx, r,
191	"failed to connect to AD: %s",
192	ads_errstr(status));
193	}
194
195	return status;
196	}
197
198	/****************************************************************
199	join a domain using ADS (LDAP mods)
200	****************************************************************/
201
202	static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
203	struct libnet_JoinCtx *r)
204	{
205	ADS_STATUS status;
206	LDAPMessage *res = NULL;
207	const char *attrs[] = { "dn", NULL };
208	bool moved = false;
209
210	status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
211	if (!ADS_ERR_OK(status)) {
212	return status;
213	}
214
215	status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
216	if (!ADS_ERR_OK(status)) {
217	return status;
218	}
219
220	if (ads_count_replies(r->in.ads, res) != 1) {
221	ads_msgfree(r->in.ads, res);
222	return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
223	}
224
225	ads_msgfree(r->in.ads, res);
226
227	/* Attempt to create the machine account and bail if this fails.
228	Assume that the admin wants exactly what they requested */
229
230	status = ads_create_machine_acct(r->in.ads,
231	r->in.machine_name,
232	r->in.account_ou);
233
234	if (ADS_ERR_OK(status)) {
235	DEBUG(1,("machine account creation created\n"));
236	return status;
237	} else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
238	(status.err.rc == LDAP_ALREADY_EXISTS)) {
239	status = ADS_SUCCESS;
240	}
241
242	if (!ADS_ERR_OK(status)) {
243	DEBUG(1,("machine account creation failed\n"));
244	return status;
245	}
246
247	status = ads_move_machine_acct(r->in.ads,
248	r->in.machine_name,
249	r->in.account_ou,
250	&moved);
251	if (!ADS_ERR_OK(status)) {
252	DEBUG(1,("failure to locate/move pre-existing "
253	"machine account\n"));
254	return status;
255	}
256
257	DEBUG(1,("The machine account %s the specified OU.\n",
258	moved ? "was moved into" : "already exists in"));
259
260	return status;
261	}
262
263	/****************************************************************
264	****************************************************************/
265
266	static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
267	struct libnet_UnjoinCtx *r)
268	{
269	ADS_STATUS status;
270
271	if (!r->in.ads) {
272	return libnet_unjoin_connect_ads(mem_ctx, r);
273	}
274
275	status = ads_leave_realm(r->in.ads, r->in.machine_name);
276	if (!ADS_ERR_OK(status)) {
277	libnet_unjoin_set_error_string(mem_ctx, r,
278	"failed to leave realm: %s",
279	ads_errstr(status));
280	return status;
281	}
282
283	return ADS_SUCCESS;
284	}
285
286	/****************************************************************
287	****************************************************************/
288
289	static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
290	struct libnet_JoinCtx *r)
291	{
292	ADS_STATUS status;
293	LDAPMessage *res = NULL;
294	char *dn = NULL;
295
296	if (!r->in.machine_name) {
297	return ADS_ERROR(LDAP_NO_MEMORY);
298	}
299
300	status = ads_find_machine_acct(r->in.ads,
301	&res,
302	r->in.machine_name);
303	if (!ADS_ERR_OK(status)) {
304	return status;
305	}
306
307	if (ads_count_replies(r->in.ads, res) != 1) {
308	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
309	goto done;
310	}
311
312	dn = ads_get_dn(r->in.ads, res);
313	if (!dn) {
314	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
315	goto done;
316	}
317
318	r->out.dn = talloc_strdup(mem_ctx, dn);
319	if (!r->out.dn) {
320	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
321	goto done;
322	}
323
324	done:
325	ads_msgfree(r->in.ads, res);
326	ads_memfree(r->in.ads, dn);
327
328	return status;
329	}
330
331	/****************************************************************
332	Set a machines dNSHostName and servicePrincipalName attributes
333	****************************************************************/
334
335	static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
336	struct libnet_JoinCtx *r)
337	{
338	ADS_STATUS status;
339	ADS_MODLIST mods;
340	fstring my_fqdn;
341	const char *spn_array[3] = {NULL, NULL, NULL};
342	char *spn = NULL;
343
344	/* Find our DN */
345
346	status = libnet_join_find_machine_acct(mem_ctx, r);
347	if (!ADS_ERR_OK(status)) {
348	return status;
349	}
350
351	/* Windows only creates HOST/shortname & HOST/fqdn. */
352
353	spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
354	if (!spn) {
355	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
356	}
357	strupper_m(spn);
358	spn_array[0] = spn;
359
360	if (!name_to_fqdn(my_fqdn, r->in.machine_name)
361	\|\| (strchr(my_fqdn, '.') == NULL)) {
362	fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
363	r->out.dns_domain_name);
364	}
365
366	strlower_m(my_fqdn);
367
368	if (!strequal(my_fqdn, r->in.machine_name)) {
369	spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
370	if (!spn) {
371	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
372	}
373	spn_array[1] = spn;
374	}
375
376	mods = ads_init_mods(mem_ctx);
377	if (!mods) {
378	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
379	}
380
381	/* fields of primary importance */
382
383	status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
384	if (!ADS_ERR_OK(status)) {
385	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
386	}
387
388	status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
389	spn_array);
390	if (!ADS_ERR_OK(status)) {
391	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
392	}
393
394	return ads_gen_mod(r->in.ads, r->out.dn, mods);
395	}
396
397	/****************************************************************
398	****************************************************************/
399
400	static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
401	struct libnet_JoinCtx *r)
402	{
403	ADS_STATUS status;
404	ADS_MODLIST mods;
405
406	if (!r->in.create_upn) {
407	return ADS_SUCCESS;
408	}
409
410	/* Find our DN */
411
412	status = libnet_join_find_machine_acct(mem_ctx, r);
413	if (!ADS_ERR_OK(status)) {
414	return status;
415	}
416
417	if (!r->in.upn) {
418	r->in.upn = talloc_asprintf(mem_ctx,
419	"host/%s@%s",
420	r->in.machine_name,
421	r->out.dns_domain_name);
422	if (!r->in.upn) {
423	return ADS_ERROR(LDAP_NO_MEMORY);
424	}
425	}
426
427	/* now do the mods */
428
429	mods = ads_init_mods(mem_ctx);
430	if (!mods) {
431	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
432	}
433
434	/* fields of primary importance */
435
436	status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
437	if (!ADS_ERR_OK(status)) {
438	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
439	}
440
441	return ads_gen_mod(r->in.ads, r->out.dn, mods);
442	}
443
444
445	/****************************************************************
446	****************************************************************/
447
448	static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
449	struct libnet_JoinCtx *r)
450	{
451	ADS_STATUS status;
452	ADS_MODLIST mods;
453	char *os_sp = NULL;
454
455	if (!r->in.os_name \|\| !r->in.os_version ) {
456	return ADS_SUCCESS;
457	}
458
459	/* Find our DN */
460
461	status = libnet_join_find_machine_acct(mem_ctx, r);
462	if (!ADS_ERR_OK(status)) {
463	return status;
464	}
465
466	/* now do the mods */
467
468	mods = ads_init_mods(mem_ctx);
469	if (!mods) {
470	return ADS_ERROR(LDAP_NO_MEMORY);
471	}
472
473	os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
474	if (!os_sp) {
475	return ADS_ERROR(LDAP_NO_MEMORY);
476	}
477
478	/* fields of primary importance */
479
480	status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
481	r->in.os_name);
482	if (!ADS_ERR_OK(status)) {
483	return status;
484	}
485
486	status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
487	r->in.os_version);
488	if (!ADS_ERR_OK(status)) {
489	return status;
490	}
491
492	status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
493	os_sp);
494	if (!ADS_ERR_OK(status)) {
495	return status;
496	}
497
498	return ads_gen_mod(r->in.ads, r->out.dn, mods);
499	}
500
501	/****************************************************************
502	****************************************************************/
503
504	static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
505	struct libnet_JoinCtx *r)
506	{
507	if (!lp_use_kerberos_keytab()) {
508	return true;
509	}
510
511	if (ads_keytab_create_default(r->in.ads) != 0) {
512	return false;
513	}
514
515	return true;
516	}
517
518	/****************************************************************
519	****************************************************************/
520
521	static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
522	struct libnet_JoinCtx *r)
523	{
524	uint32_t domain_func;
525	ADS_STATUS status;
526	const char *salt = NULL;
527	char *std_salt = NULL;
528
529	status = ads_domain_func_level(r->in.ads, &domain_func);
530	if (!ADS_ERR_OK(status)) {
531	libnet_join_set_error_string(mem_ctx, r,
532	"failed to determine domain functional level: %s",
533	ads_errstr(status));
534	return false;
535	}
536
537	/* go ahead and setup the default salt */
538
539	std_salt = kerberos_standard_des_salt();
540	if (!std_salt) {
541	libnet_join_set_error_string(mem_ctx, r,
542	"failed to obtain standard DES salt");
543	return false;
544	}
545
546	salt = talloc_strdup(mem_ctx, std_salt);
547	if (!salt) {
548	return false;
549	}
550
551	SAFE_FREE(std_salt);
552
553	/* if it's a Windows functional domain, we have to look for the UPN */
554
555	if (domain_func == DS_DOMAIN_FUNCTION_2000) {
556	char *upn;
557
558	upn = ads_get_upn(r->in.ads, mem_ctx,
559	r->in.machine_name);
560	if (upn) {
561	salt = talloc_strdup(mem_ctx, upn);
562	if (!salt) {
563	return false;
564	}
565	}
566	}
567
568	return kerberos_secrets_store_des_salt(salt);
569	}
570
571	/****************************************************************
572	****************************************************************/
573
574	static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
575	struct libnet_JoinCtx *r)
576	{
577	ADS_STATUS status;
578
579	if (!r->in.ads) {
580	status = libnet_join_connect_ads(mem_ctx, r);
581	if (!ADS_ERR_OK(status)) {
582	return status;
583	}
584	}
585
586	status = libnet_join_set_machine_spn(mem_ctx, r);
587	if (!ADS_ERR_OK(status)) {
588	libnet_join_set_error_string(mem_ctx, r,
589	"failed to set machine spn: %s",
590	ads_errstr(status));
591	return status;
592	}
593
594	status = libnet_join_set_os_attributes(mem_ctx, r);
595	if (!ADS_ERR_OK(status)) {
596	libnet_join_set_error_string(mem_ctx, r,
597	"failed to set machine os attributes: %s",
598	ads_errstr(status));
599	return status;
600	}
601
602	status = libnet_join_set_machine_upn(mem_ctx, r);
603	if (!ADS_ERR_OK(status)) {
604	libnet_join_set_error_string(mem_ctx, r,
605	"failed to set machine upn: %s",
606	ads_errstr(status));
607	return status;
608	}
609
610	if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
611	return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
612	}
613
614	if (!libnet_join_create_keytab(mem_ctx, r)) {
615	libnet_join_set_error_string(mem_ctx, r,
616	"failed to create kerberos keytab");
617	return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
618	}
619
620	return ADS_SUCCESS;
621	}
622	#endif /* WITH_ADS */
623
624	/****************************************************************
625	Store the machine password and domain SID
626	****************************************************************/
627
628	static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
629	struct libnet_JoinCtx *r)
630	{
631	if (!secrets_store_domain_sid(r->out.netbios_domain_name,
632	r->out.domain_sid))
633	{
634	DEBUG(1,("Failed to save domain sid\n"));
635	return false;
636	}
637
638	if (!secrets_store_machine_password(r->in.machine_password,
639	r->out.netbios_domain_name,
640	r->in.secure_channel_type))
641	{
642	DEBUG(1,("Failed to save machine password\n"));
643	return false;
644	}
645
646	return true;
647	}
648
649	/****************************************************************
650	Lookup domain dc's info
651	****************************************************************/
652
653	static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
654	struct libnet_JoinCtx *r,
655	struct cli_state **cli)
656	{
657	struct rpc_pipe_client *pipe_hnd = NULL;
658	POLICY_HND lsa_pol;
659	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
660	union lsa_PolicyInformation *info = NULL;
661
662	status = cli_full_connection(cli, NULL,
663	r->in.dc_name,
664	NULL, 0,
665	"IPC$", "IPC",
666	r->in.admin_account,
667	NULL,
668	r->in.admin_password,
669	0,
670	Undefined, NULL);
671
672	if (!NT_STATUS_IS_OK(status)) {
673	goto done;
674	}
675
676	pipe_hnd = cli_rpc_pipe_open_noauth(*cli, PI_LSARPC, &status);
677	if (!pipe_hnd) {
678	DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
679	nt_errstr(status)));
680	goto done;
681	}
682
683	status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
684	SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
685	if (!NT_STATUS_IS_OK(status)) {
686	goto done;
687	}
688
689	status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
690	&lsa_pol,
691	LSA_POLICY_INFO_DNS,
692	&info);
693	if (NT_STATUS_IS_OK(status)) {
694	r->out.domain_is_ad = true;
695	r->out.netbios_domain_name = info->dns.name.string;
696	r->out.dns_domain_name = info->dns.dns_domain.string;
697	r->out.domain_sid = sid_dup_talloc(mem_ctx, info->dns.sid);
698	NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
699	}
700
701	if (!NT_STATUS_IS_OK(status)) {
702	status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
703	&lsa_pol,
704	LSA_POLICY_INFO_ACCOUNT_DOMAIN,
705	&info);
706	if (!NT_STATUS_IS_OK(status)) {
707	goto done;
708	}
709
710	r->out.netbios_domain_name = info->account_domain.name.string;
711	r->out.domain_sid = sid_dup_talloc(mem_ctx, info->account_domain.sid);
712	NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
713	}
714
715	rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
716	cli_rpc_pipe_close(pipe_hnd);
717
718	done:
719	return status;
720	}
721
722	/****************************************************************
723	Do the domain join
724	****************************************************************/
725
726	static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
727	struct libnet_JoinCtx *r,
728	struct cli_state *cli)
729	{
730	struct rpc_pipe_client *pipe_hnd = NULL;
731	POLICY_HND sam_pol, domain_pol, user_pol;
732	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
733	char *acct_name;
734	struct lsa_String lsa_acct_name;
735	uint32_t user_rid;
736	uint32_t acct_flags = ACB_WSTRUST;
737	struct samr_Ids user_rids;
738	struct samr_Ids name_types;
739	union samr_UserInfo user_info;
740
741	struct samr_CryptPassword crypt_pwd;
742	struct samr_CryptPasswordEx crypt_pwd_ex;
743
744	ZERO_STRUCT(sam_pol);
745	ZERO_STRUCT(domain_pol);
746	ZERO_STRUCT(user_pol);
747
748	if (!r->in.machine_password) {
749	r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
750	NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
751	}
752
753	/* Open the domain */
754
755	pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
756	if (!pipe_hnd) {
757	DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
758	nt_errstr(status)));
759	goto done;
760	}
761
762	status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
763	pipe_hnd->cli->desthost,
764	SAMR_ACCESS_ENUM_DOMAINS
765	\| SAMR_ACCESS_OPEN_DOMAIN,
766	&sam_pol);
767	if (!NT_STATUS_IS_OK(status)) {
768	goto done;
769	}
770
771	status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
772	&sam_pol,
773	SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
774	\| SAMR_DOMAIN_ACCESS_CREATE_USER
775	\| SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
776	r->out.domain_sid,
777	&domain_pol);
778	if (!NT_STATUS_IS_OK(status)) {
779	goto done;
780	}
781
782	/* Create domain user */
783
784	acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
785	strlower_m(acct_name);
786
787	init_lsa_String(&lsa_acct_name, acct_name);
788
789	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
790	uint32_t access_desired =
791	SEC_GENERIC_READ \| SEC_GENERIC_WRITE \| SEC_GENERIC_EXECUTE \|
792	SEC_STD_WRITE_DAC \| SEC_STD_DELETE \|
793	SAMR_USER_ACCESS_SET_PASSWORD \|
794	SAMR_USER_ACCESS_GET_ATTRIBUTES \|
795	SAMR_USER_ACCESS_SET_ATTRIBUTES;
796	uint32_t access_granted = 0;
797
798	/* Don't try to set any acct_flags flags other than ACB_WSTRUST */
799
800	DEBUG(10,("Creating account with desired access mask: %d\n",
801	access_desired));
802
803	status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
804	&domain_pol,
805	&lsa_acct_name,
806	ACB_WSTRUST,
807	access_desired,
808	&user_pol,
809	&access_granted,
810	&user_rid);
811	if (!NT_STATUS_IS_OK(status) &&
812	!NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
813
814	DEBUG(10,("Creation of workstation account failed: %s\n",
815	nt_errstr(status)));
816
817	/* If NT_STATUS_ACCESS_DENIED then we have a valid
818	username/password combo but the user does not have
819	administrator access. */
820
821	if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
822	libnet_join_set_error_string(mem_ctx, r,
823	"User specified does not have "
824	"administrator privileges");
825	}
826
827	goto done;
828	}
829
830	if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
831	if (!(r->in.join_flags &
832	WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
833	goto done;
834	}
835	}
836
837	/* We must do this.... don't ask... */
838
839	if (NT_STATUS_IS_OK(status)) {
840	rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
841	}
842	}
843
844	status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
845	&domain_pol,
846	1,
847	&lsa_acct_name,
848	&user_rids,
849	&name_types);
850	if (!NT_STATUS_IS_OK(status)) {
851	goto done;
852	}
853
854	if (name_types.ids[0] != SID_NAME_USER) {
855	DEBUG(0,("%s is not a user account (type=%d)\n",
856	acct_name, name_types.ids[0]));
857	status = NT_STATUS_INVALID_WORKSTATION;
858	goto done;
859	}
860
861	user_rid = user_rids.ids[0];
862
863	/* Open handle on user */
864
865	status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
866	&domain_pol,
867	SEC_RIGHTS_MAXIMUM_ALLOWED,
868	user_rid,
869	&user_pol);
870	if (!NT_STATUS_IS_OK(status)) {
871	goto done;
872	}
873
874	/* Fill in the additional account flags now */
875
876	acct_flags \|= ACB_PWNOEXP;
877	if (r->out.domain_is_ad) {
878	#if !defined(ENCTYPE_ARCFOUR_HMAC)
879	acct_flags \|= ACB_USE_DES_KEY_ONLY;
880	#endif
881	;;
882	}
883
884	/* Set account flags on machine account */
885	ZERO_STRUCT(user_info.info16);
886	user_info.info16.acct_flags = acct_flags;
887
888	status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
889	&user_pol,
890	16,
891	&user_info);
892
893	if (!NT_STATUS_IS_OK(status)) {
894
895	rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
896	&user_pol);
897
898	libnet_join_set_error_string(mem_ctx, r,
899	"Failed to set account flags for machine account (%s)\n",
900	nt_errstr(status));
901	goto done;
902	}
903
904	/* Set password on machine account - first try level 26 */
905
906	init_samr_CryptPasswordEx(r->in.machine_password,
907	&cli->user_session_key,
908	&crypt_pwd_ex);
909
910	init_samr_user_info26(&user_info.info26, &crypt_pwd_ex,
911	PASS_DONT_CHANGE_AT_NEXT_LOGON);
912
913	status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
914	&user_pol,
915	26,
916	&user_info);
917
918	if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
919
920	/* retry with level 24 */
921
922	init_samr_CryptPassword(r->in.machine_password,
923	&cli->user_session_key,
924	&crypt_pwd);
925
926	init_samr_user_info24(&user_info.info24, &crypt_pwd,
927	PASS_DONT_CHANGE_AT_NEXT_LOGON);
928
929	status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
930	&user_pol,
931	24,
932	&user_info);
933	}
934
935	if (!NT_STATUS_IS_OK(status)) {
936
937	rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
938	&user_pol);
939
940	libnet_join_set_error_string(mem_ctx, r,
941	"Failed to set password for machine account (%s)\n",
942	nt_errstr(status));
943	goto done;
944	}
945
946	status = NT_STATUS_OK;
947
948	done:
949	if (!pipe_hnd) {
950	return status;
951	}
952
953	if (is_valid_policy_hnd(&sam_pol)) {
954	rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
955	}
956	if (is_valid_policy_hnd(&domain_pol)) {
957	rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
958	}
959	if (is_valid_policy_hnd(&user_pol)) {
960	rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
961	}
962	cli_rpc_pipe_close(pipe_hnd);
963
964	return status;
965	}
966
967	/****************************************************************
968	****************************************************************/
969
970	NTSTATUS libnet_join_ok(const char *netbios_domain_name,
971	const char *machine_name,
972	const char *dc_name)
973	{
974	uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
975	struct cli_state *cli = NULL;
976	struct rpc_pipe_client *pipe_hnd = NULL;
977	struct rpc_pipe_client *netlogon_pipe = NULL;
978	NTSTATUS status;
979	char *machine_password = NULL;
980	char *machine_account = NULL;
981
982	if (!dc_name) {
983	return NT_STATUS_INVALID_PARAMETER;
984	}
985
986	if (!secrets_init()) {
987	return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
988	}
989
990	machine_password = secrets_fetch_machine_password(netbios_domain_name,
991	NULL, NULL);
992	if (!machine_password) {
993	return NT_STATUS_NO_TRUST_LSA_SECRET;
994	}
995
996	asprintf(&machine_account, "%s$", machine_name);
997	if (!machine_account) {
998	SAFE_FREE(machine_password);
999	return NT_STATUS_NO_MEMORY;
1000	}
1001
1002	status = cli_full_connection(&cli, NULL,
1003	dc_name,
1004	NULL, 0,
1005	"IPC$", "IPC",
1006	machine_account,
1007	NULL,
1008	machine_password,
1009	0,
1010	Undefined, NULL);
1011	free(machine_account);
1012	free(machine_password);
1013
1014	if (!NT_STATUS_IS_OK(status)) {
1015	status = cli_full_connection(&cli, NULL,
1016	dc_name,
1017	NULL, 0,
1018	"IPC$", "IPC",
1019	"",
1020	NULL,
1021	"",
1022	0,
1023	Undefined, NULL);
1024	}
1025
1026	if (!NT_STATUS_IS_OK(status)) {
1027	return status;
1028	}
1029
1030	netlogon_pipe = get_schannel_session_key(cli,
1031	netbios_domain_name,
1032	&neg_flags, &status);
1033	if (!netlogon_pipe) {
1034	if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1035	cli_shutdown(cli);
1036	return NT_STATUS_OK;
1037	}
1038
1039	DEBUG(0,("libnet_join_ok: failed to get schannel session "
1040	"key from server %s for domain %s. Error was %s\n",
1041	cli->desthost, netbios_domain_name, nt_errstr(status)));
1042	cli_shutdown(cli);
1043	return status;
1044	}
1045
1046	if (!lp_client_schannel()) {
1047	cli_shutdown(cli);
1048	return NT_STATUS_OK;
1049	}
1050
1051	pipe_hnd = cli_rpc_pipe_open_schannel_with_key(cli, PI_NETLOGON,
1052	PIPE_AUTH_LEVEL_PRIVACY,
1053	netbios_domain_name,
1054	netlogon_pipe->dc,
1055	&status);
1056
1057	cli_shutdown(cli);
1058
1059	if (!pipe_hnd) {
1060	DEBUG(0,("libnet_join_ok: failed to open schannel session "
1061	"on netlogon pipe to server %s for domain %s. "
1062	"Error was %s\n",
1063	cli->desthost, netbios_domain_name, nt_errstr(status)));
1064	return status;
1065	}
1066
1067	return NT_STATUS_OK;
1068	}
1069
1070	/****************************************************************
1071	****************************************************************/
1072
1073	static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1074	struct libnet_JoinCtx *r)
1075	{
1076	NTSTATUS status;
1077
1078	status = libnet_join_ok(r->out.netbios_domain_name,
1079	r->in.machine_name,
1080	r->in.dc_name);
1081	if (!NT_STATUS_IS_OK(status)) {
1082	libnet_join_set_error_string(mem_ctx, r,
1083	"failed to verify domain membership after joining: %s",
1084	get_friendly_nt_error_msg(status));
1085	return WERR_SETUP_NOT_JOINED;
1086	}
1087
1088	return WERR_OK;
1089	}
1090
1091	/****************************************************************
1092	****************************************************************/
1093
1094	static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1095	struct libnet_UnjoinCtx *r)
1096	{
1097	if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1098	return false;
1099	}
1100
1101	if (!secrets_delete_domain_sid(lp_workgroup())) {
1102	return false;
1103	}
1104
1105	return true;
1106	}
1107
1108	/****************************************************************
1109	****************************************************************/
1110
1111	static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1112	struct libnet_UnjoinCtx *r)
1113	{
1114	struct cli_state *cli = NULL;
1115	struct rpc_pipe_client *pipe_hnd = NULL;
1116	POLICY_HND sam_pol, domain_pol, user_pol;
1117	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1118	char *acct_name;
1119	uint32_t user_rid;
1120	struct lsa_String lsa_acct_name;
1121	struct samr_Ids user_rids;
1122	struct samr_Ids name_types;
1123	union samr_UserInfo *info = NULL;
1124
1125	ZERO_STRUCT(sam_pol);
1126	ZERO_STRUCT(domain_pol);
1127	ZERO_STRUCT(user_pol);
1128
1129	status = cli_full_connection(&cli, NULL,
1130	r->in.dc_name,
1131	NULL, 0,
1132	"IPC$", "IPC",
1133	r->in.admin_account,
1134	NULL,
1135	r->in.admin_password,
1136	0, Undefined, NULL);
1137
1138	if (!NT_STATUS_IS_OK(status)) {
1139	goto done;
1140	}
1141
1142	/* Open the domain */
1143
1144	pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
1145	if (!pipe_hnd) {
1146	DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1147	nt_errstr(status)));
1148	goto done;
1149	}
1150
1151	status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1152	pipe_hnd->cli->desthost,
1153	SEC_RIGHTS_MAXIMUM_ALLOWED,
1154	&sam_pol);
1155	if (!NT_STATUS_IS_OK(status)) {
1156	goto done;
1157	}
1158
1159	status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1160	&sam_pol,
1161	SEC_RIGHTS_MAXIMUM_ALLOWED,
1162	r->in.domain_sid,
1163	&domain_pol);
1164	if (!NT_STATUS_IS_OK(status)) {
1165	goto done;
1166	}
1167
1168	/* Create domain user */
1169
1170	acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1171	strlower_m(acct_name);
1172
1173	init_lsa_String(&lsa_acct_name, acct_name);
1174
1175	status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1176	&domain_pol,
1177	1,
1178	&lsa_acct_name,
1179	&user_rids,
1180	&name_types);
1181
1182	if (!NT_STATUS_IS_OK(status)) {
1183	goto done;
1184	}
1185
1186	if (name_types.ids[0] != SID_NAME_USER) {
1187	DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1188	name_types.ids[0]));
1189	status = NT_STATUS_INVALID_WORKSTATION;
1190	goto done;
1191	}
1192
1193	user_rid = user_rids.ids[0];
1194
1195	/* Open handle on user */
1196
1197	status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1198	&domain_pol,
1199	SEC_RIGHTS_MAXIMUM_ALLOWED,
1200	user_rid,
1201	&user_pol);
1202	if (!NT_STATUS_IS_OK(status)) {
1203	goto done;
1204	}
1205
1206	/* Get user info */
1207
1208	status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1209	&user_pol,
1210	16,
1211	&info);
1212	if (!NT_STATUS_IS_OK(status)) {
1213	rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1214	goto done;
1215	}
1216
1217	/* now disable and setuser info */
1218
1219	info->info16.acct_flags \|= ACB_DISABLED;
1220
1221	status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1222	&user_pol,
1223	16,
1224	info);
1225
1226	rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1227
1228	done:
1229	if (pipe_hnd) {
1230	if (is_valid_policy_hnd(&domain_pol)) {
1231	rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1232	}
1233	if (is_valid_policy_hnd(&sam_pol)) {
1234	rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1235	}
1236	cli_rpc_pipe_close(pipe_hnd);
1237	}
1238
1239	if (cli) {
1240	cli_shutdown(cli);
1241	}
1242
1243	return status;
1244	}
1245
1246	/****************************************************************
1247	****************************************************************/
1248
1249	static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1250	{
1251	WERROR werr;
1252	struct smbconf_ctx *ctx;
1253
1254	werr = smbconf_init_reg(r, &ctx, NULL);
1255	if (!W_ERROR_IS_OK(werr)) {
1256	goto done;
1257	}
1258
1259	if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1260
1261	werr = smbconf_set_global_parameter(ctx, "security", "user");
1262	W_ERROR_NOT_OK_GOTO_DONE(werr);
1263
1264	werr = smbconf_set_global_parameter(ctx, "workgroup",
1265	r->in.domain_name);
1266
1267	smbconf_delete_global_parameter(ctx, "realm");
1268	goto done;
1269	}
1270
1271	werr = smbconf_set_global_parameter(ctx, "security", "domain");
1272	W_ERROR_NOT_OK_GOTO_DONE(werr);
1273
1274	werr = smbconf_set_global_parameter(ctx, "workgroup",
1275	r->out.netbios_domain_name);
1276	W_ERROR_NOT_OK_GOTO_DONE(werr);
1277
1278	if (r->out.domain_is_ad) {
1279	werr = smbconf_set_global_parameter(ctx, "security", "ads");
1280	W_ERROR_NOT_OK_GOTO_DONE(werr);
1281
1282	werr = smbconf_set_global_parameter(ctx, "realm",
1283	r->out.dns_domain_name);
1284	W_ERROR_NOT_OK_GOTO_DONE(werr);
1285	}
1286
1287	done:
1288	smbconf_shutdown(ctx);
1289	return werr;
1290	}
1291
1292	/****************************************************************
1293	****************************************************************/
1294
1295	static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1296	{
1297	WERROR werr = WERR_OK;
1298	struct smbconf_ctx *ctx;
1299
1300	werr = smbconf_init_reg(r, &ctx, NULL);
1301	if (!W_ERROR_IS_OK(werr)) {
1302	goto done;
1303	}
1304
1305	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1306
1307	werr = smbconf_set_global_parameter(ctx, "security", "user");
1308	W_ERROR_NOT_OK_GOTO_DONE(werr);
1309
1310	werr = smbconf_delete_global_parameter(ctx, "workgroup");
1311	W_ERROR_NOT_OK_GOTO_DONE(werr);
1312
1313	smbconf_delete_global_parameter(ctx, "realm");
1314	}
1315
1316	done:
1317	smbconf_shutdown(ctx);
1318	return werr;
1319	}
1320
1321	/****************************************************************
1322	****************************************************************/
1323
1324	static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1325	{
1326	WERROR werr;
1327
1328	if (!W_ERROR_IS_OK(r->out.result)) {
1329	return r->out.result;
1330	}
1331
1332	if (!r->in.modify_config) {
1333	return WERR_OK;
1334	}
1335
1336	werr = do_join_modify_vals_config(r);
1337	if (!W_ERROR_IS_OK(werr)) {
1338	return werr;
1339	}
1340
1341	lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1342
1343	r->out.modified_config = true;
1344	r->out.result = werr;
1345
1346	return werr;
1347	}
1348
1349	/****************************************************************
1350	****************************************************************/
1351
1352	static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1353	{
1354	WERROR werr;
1355
1356	if (!W_ERROR_IS_OK(r->out.result)) {
1357	return r->out.result;
1358	}
1359
1360	if (!r->in.modify_config) {
1361	return WERR_OK;
1362	}
1363
1364	werr = do_unjoin_modify_vals_config(r);
1365	if (!W_ERROR_IS_OK(werr)) {
1366	return werr;
1367	}
1368
1369	lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1370
1371	r->out.modified_config = true;
1372	r->out.result = werr;
1373
1374	return werr;
1375	}
1376
1377	/****************************************************************
1378	****************************************************************/
1379
1380	static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1381	const char *domain_str,
1382	const char **domain_p,
1383	const char **dc_p)
1384	{
1385	char *domain = NULL;
1386	char *dc = NULL;
1387	const char *p = NULL;
1388
1389	if (!domain_str \|\| !domain_p \|\| !dc_p) {
1390	return false;
1391	}
1392
1393	p = strchr_m(domain_str, '\\');
1394
1395	if (p != NULL) {
1396	domain = talloc_strndup(mem_ctx, domain_str,
1397	PTR_DIFF(p, domain_str));
1398	dc = talloc_strdup(mem_ctx, p+1);
1399	if (!dc) {
1400	return false;
1401	}
1402	} else {
1403	domain = talloc_strdup(mem_ctx, domain_str);
1404	dc = NULL;
1405	}
1406	if (!domain) {
1407	return false;
1408	}
1409
1410	*domain_p = domain;
1411
1412	if (!*dc_p && dc) {
1413	*dc_p = dc;
1414	}
1415
1416	return true;
1417	}
1418
1419	/****************************************************************
1420	****************************************************************/
1421
1422	static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1423	struct libnet_JoinCtx *r)
1424	{
1425	if (!r->in.domain_name) {
1426	libnet_join_set_error_string(mem_ctx, r,
1427	"No domain name defined");
1428	return WERR_INVALID_PARAM;
1429	}
1430
1431	if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1432	&r->in.domain_name,
1433	&r->in.dc_name)) {
1434	libnet_join_set_error_string(mem_ctx, r,
1435	"Failed to parse domain name");
1436	return WERR_INVALID_PARAM;
1437	}
1438
1439	if (IS_DC) {
1440	return WERR_SETUP_DOMAIN_CONTROLLER;
1441	}
1442
1443	if (!secrets_init()) {
1444	libnet_join_set_error_string(mem_ctx, r,
1445	"Unable to open secrets database");
1446	return WERR_CAN_NOT_COMPLETE;
1447	}
1448
1449	return WERR_OK;
1450	}
1451
1452	/****************************************************************
1453	****************************************************************/
1454
1455	static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1456	struct libnet_JoinCtx *r)
1457	{
1458	WERROR werr;
1459
1460	if (!W_ERROR_IS_OK(r->out.result)) {
1461	return r->out.result;
1462	}
1463
1464	werr = do_JoinConfig(r);
1465	if (!W_ERROR_IS_OK(werr)) {
1466	return werr;
1467	}
1468
1469	if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1470	return WERR_OK;
1471	}
1472
1473	saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1474	if (r->out.dns_domain_name) {
1475	saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1476	}
1477
1478	#ifdef WITH_ADS
1479	if (r->out.domain_is_ad) {
1480	ADS_STATUS ads_status;
1481
1482	ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1483	if (!ADS_ERR_OK(ads_status)) {
1484	return WERR_GENERAL_FAILURE;
1485	}
1486	}
1487	#endif /* WITH_ADS */
1488
1489	return WERR_OK;
1490	}
1491
1492	/****************************************************************
1493	****************************************************************/
1494
1495	static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1496	{
1497	const char *krb5_cc_env = NULL;
1498
1499	if (r->in.ads) {
1500	ads_destroy(&r->in.ads);
1501	}
1502
1503	krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1504	if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1505	unsetenv(KRB5_ENV_CCNAME);
1506	}
1507
1508	return 0;
1509	}
1510
1511	/****************************************************************
1512	****************************************************************/
1513
1514	static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1515	{
1516	const char *krb5_cc_env = NULL;
1517
1518	if (r->in.ads) {
1519	ads_destroy(&r->in.ads);
1520	}
1521
1522	krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1523	if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1524	unsetenv(KRB5_ENV_CCNAME);
1525	}
1526
1527	return 0;
1528	}
1529
1530	/****************************************************************
1531	****************************************************************/
1532
1533	WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1534	struct libnet_JoinCtx **r)
1535	{
1536	struct libnet_JoinCtx *ctx;
1537	const char *krb5_cc_env = NULL;
1538
1539	ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1540	if (!ctx) {
1541	return WERR_NOMEM;
1542	}
1543
1544	talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1545
1546	ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1547	W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1548
1549	krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1550	if (!krb5_cc_env \|\| (strlen(krb5_cc_env) == 0)) {
1551	krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1552	W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1553	setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1554	}
1555
1556	ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1557
1558	*r = ctx;
1559
1560	return WERR_OK;
1561	}
1562
1563	/****************************************************************
1564	****************************************************************/
1565
1566	WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1567	struct libnet_UnjoinCtx **r)
1568	{
1569	struct libnet_UnjoinCtx *ctx;
1570	const char *krb5_cc_env = NULL;
1571
1572	ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1573	if (!ctx) {
1574	return WERR_NOMEM;
1575	}
1576
1577	talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1578
1579	ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1580	W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1581
1582	krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1583	if (!krb5_cc_env \|\| (strlen(krb5_cc_env) == 0)) {
1584	krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1585	W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1586	setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1587	}
1588
1589	*r = ctx;
1590
1591	return WERR_OK;
1592	}
1593
1594	/****************************************************************
1595	****************************************************************/
1596
1597	static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1598	struct libnet_JoinCtx *r)
1599	{
1600	/* check if configuration is already set correctly */
1601
1602	switch (r->out.domain_is_ad) {
1603	case false:
1604	if ((strequal(lp_workgroup(),
1605	r->out.netbios_domain_name)) &&
1606	(lp_security() == SEC_DOMAIN)) {
1607	/* nothing to be done */
1608	return WERR_OK;
1609	}
1610	break;
1611	case true:
1612	if ((strequal(lp_workgroup(),
1613	r->out.netbios_domain_name)) &&
1614	(strequal(lp_realm(),
1615	r->out.dns_domain_name)) &&
1616	((lp_security() == SEC_ADS) \|\|
1617	(lp_security() == SEC_DOMAIN))) {
1618	/* nothing to be done */
1619	return WERR_OK;
1620	}
1621	break;
1622	}
1623
1624	/* check if we are supposed to manipulate configuration */
1625
1626	if (!r->in.modify_config) {
1627	libnet_join_set_error_string(mem_ctx, r,
1628	"Invalid configuration and configuration modification "
1629	"was not requested");
1630	return WERR_CAN_NOT_COMPLETE;
1631	}
1632
1633	/* check if we are able to manipulate configuration */
1634
1635	if (!lp_config_backend_is_registry()) {
1636	libnet_join_set_error_string(mem_ctx, r,
1637	"Configuration manipulation requested but not "
1638	"supported by backend");
1639	return WERR_NOT_SUPPORTED;
1640	}
1641
1642	return WERR_OK;
1643	}
1644
1645	/****************************************************************
1646	****************************************************************/
1647
1648	static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1649	struct libnet_JoinCtx *r)
1650	{
1651	NTSTATUS status;
1652	WERROR werr;
1653	struct cli_state *cli = NULL;
1654	#ifdef WITH_ADS
1655	ADS_STATUS ads_status;
1656	#endif /* WITH_ADS */
1657
1658	if (!r->in.dc_name) {
1659	struct netr_DsRGetDCNameInfo *info;
1660	const char *dc;
1661	status = dsgetdcname(mem_ctx,
1662	r->in.msg_ctx,
1663	r->in.domain_name,
1664	NULL,
1665	NULL,
1666	DS_FORCE_REDISCOVERY \|
1667	DS_DIRECTORY_SERVICE_REQUIRED \|
1668	DS_WRITABLE_REQUIRED \|
1669	DS_RETURN_DNS_NAME,
1670	&info);
1671	if (!NT_STATUS_IS_OK(status)) {
1672	libnet_join_set_error_string(mem_ctx, r,
1673	"failed to find DC for domain %s",
1674	r->in.domain_name,
1675	get_friendly_nt_error_msg(status));
1676	return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1677	}
1678
1679	dc = strip_hostname(info->dc_unc);
1680	r->in.dc_name = talloc_strdup(mem_ctx, dc);
1681	W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1682	}
1683
1684	status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1685	if (!NT_STATUS_IS_OK(status)) {
1686	libnet_join_set_error_string(mem_ctx, r,
1687	"failed to lookup DC info for domain '%s' over rpc: %s",
1688	r->in.domain_name, get_friendly_nt_error_msg(status));
1689	return ntstatus_to_werror(status);
1690	}
1691
1692	werr = libnet_join_check_config(mem_ctx, r);
1693	if (!W_ERROR_IS_OK(werr)) {
1694	goto done;
1695	}
1696
1697	#ifdef WITH_ADS
1698	if (r->out.domain_is_ad && r->in.account_ou) {
1699
1700	ads_status = libnet_join_connect_ads(mem_ctx, r);
1701	if (!ADS_ERR_OK(ads_status)) {
1702	return WERR_DEFAULT_JOIN_REQUIRED;
1703	}
1704
1705	ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1706	if (!ADS_ERR_OK(ads_status)) {
1707	libnet_join_set_error_string(mem_ctx, r,
1708	"failed to precreate account in ou %s: %s",
1709	r->in.account_ou,
1710	ads_errstr(ads_status));
1711	return WERR_DEFAULT_JOIN_REQUIRED;
1712	}
1713
1714	r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1715	}
1716	#endif /* WITH_ADS */
1717
1718	status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
1719	if (!NT_STATUS_IS_OK(status)) {
1720	libnet_join_set_error_string(mem_ctx, r,
1721	"failed to join domain '%s' over rpc: %s",
1722	r->in.domain_name, get_friendly_nt_error_msg(status));
1723	if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1724	return WERR_SETUP_ALREADY_JOINED;
1725	}
1726	werr = ntstatus_to_werror(status);
1727	goto done;
1728	}
1729
1730	if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1731	werr = WERR_SETUP_NOT_JOINED;
1732	goto done;
1733	}
1734
1735	werr = WERR_OK;
1736
1737	done:
1738	if (cli) {
1739	cli_shutdown(cli);
1740	}
1741
1742	return werr;
1743	}
1744
1745	/****************************************************************
1746	****************************************************************/
1747
1748	WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
1749	struct libnet_JoinCtx *r)
1750	{
1751	WERROR werr;
1752	struct libnet_UnjoinCtx *u = NULL;
1753
1754	werr = libnet_init_UnjoinCtx(mem_ctx, &u);
1755	if (!W_ERROR_IS_OK(werr)) {
1756	return werr;
1757	}
1758
1759	u->in.debug = r->in.debug;
1760	u->in.dc_name = r->in.dc_name;
1761	u->in.domain_name = r->in.domain_name;
1762	u->in.admin_account = r->in.admin_account;
1763	u->in.admin_password = r->in.admin_password;
1764	u->in.modify_config = r->in.modify_config;
1765	u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE \|
1766	WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
1767
1768	werr = libnet_Unjoin(mem_ctx, u);
1769	TALLOC_FREE(u);
1770
1771	return werr;
1772	}
1773
1774	/****************************************************************
1775	****************************************************************/
1776
1777	WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1778	struct libnet_JoinCtx *r)
1779	{
1780	WERROR werr;
1781
1782	if (r->in.debug) {
1783	LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1784	}
1785
1786	werr = libnet_join_pre_processing(mem_ctx, r);
1787	if (!W_ERROR_IS_OK(werr)) {
1788	goto done;
1789	}
1790
1791	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1792	werr = libnet_DomainJoin(mem_ctx, r);
1793	if (!W_ERROR_IS_OK(werr)) {
1794	goto done;
1795	}
1796	}
1797
1798	werr = libnet_join_post_processing(mem_ctx, r);
1799	if (!W_ERROR_IS_OK(werr)) {
1800	goto done;
1801	}
1802
1803	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1804	werr = libnet_join_post_verify(mem_ctx, r);
1805	if (!W_ERROR_IS_OK(werr)) {
1806	libnet_join_rollback(mem_ctx, r);
1807	}
1808	}
1809
1810	done:
1811	r->out.result = werr;
1812
1813	if (r->in.debug) {
1814	LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1815	}
1816	return werr;
1817	}
1818
1819	/****************************************************************
1820	****************************************************************/
1821
1822	static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1823	struct libnet_UnjoinCtx *r)
1824	{
1825	NTSTATUS status;
1826
1827	if (!r->in.domain_sid) {
1828	struct dom_sid sid;
1829	if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1830	libnet_unjoin_set_error_string(mem_ctx, r,
1831	"Unable to fetch domain sid: are we joined?");
1832	return WERR_SETUP_NOT_JOINED;
1833	}
1834	r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
1835	W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
1836	}
1837
1838	if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
1839	!r->in.delete_machine_account) {
1840	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1841	return WERR_OK;
1842	}
1843
1844	if (!r->in.dc_name) {
1845	struct netr_DsRGetDCNameInfo *info;
1846	const char *dc;
1847	status = dsgetdcname(mem_ctx,
1848	r->in.msg_ctx,
1849	r->in.domain_name,
1850	NULL,
1851	NULL,
1852	DS_DIRECTORY_SERVICE_REQUIRED \|
1853	DS_WRITABLE_REQUIRED \|
1854	DS_RETURN_DNS_NAME,
1855	&info);
1856	if (!NT_STATUS_IS_OK(status)) {
1857	libnet_unjoin_set_error_string(mem_ctx, r,
1858	"failed to find DC for domain %s",
1859	r->in.domain_name,
1860	get_friendly_nt_error_msg(status));
1861	return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1862	}
1863
1864	dc = strip_hostname(info->dc_unc);
1865	r->in.dc_name = talloc_strdup(mem_ctx, dc);
1866	W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1867	}
1868
1869	#ifdef WITH_ADS
1870	/* for net ads leave, try to delete the account. If it works,
1871	no sense in disabling. If it fails, we can still try to
1872	disable it. jmcd */
1873
1874	if (r->in.delete_machine_account) {
1875	ADS_STATUS ads_status;
1876	ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
1877	if (ADS_ERR_OK(ads_status)) {
1878	/* dirty hack */
1879	r->out.dns_domain_name =
1880	talloc_strdup(mem_ctx,
1881	r->in.ads->server.realm);
1882	ads_status =
1883	libnet_unjoin_remove_machine_acct(mem_ctx, r);
1884	}
1885	if (!ADS_ERR_OK(ads_status)) {
1886	libnet_unjoin_set_error_string(mem_ctx, r,
1887	"failed to remove machine account from AD: %s",
1888	ads_errstr(ads_status));
1889	} else {
1890	r->out.deleted_machine_account = true;
1891	W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
1892	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1893	return WERR_OK;
1894	}
1895	}
1896	#endif /* WITH_ADS */
1897
1898	/* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
1899	"disable". */
1900	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1901	status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1902	if (!NT_STATUS_IS_OK(status)) {
1903	libnet_unjoin_set_error_string(mem_ctx, r,
1904	"failed to disable machine account via rpc: %s",
1905	get_friendly_nt_error_msg(status));
1906	if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1907	return WERR_SETUP_NOT_JOINED;
1908	}
1909	return ntstatus_to_werror(status);
1910	}
1911
1912	r->out.disabled_machine_account = true;
1913	}
1914
1915	/* If disable succeeded or was not requested at all, we
1916	should be getting rid of our end of things */
1917
1918	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1919
1920	return WERR_OK;
1921	}
1922
1923	/****************************************************************
1924	****************************************************************/
1925
1926	static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
1927	struct libnet_UnjoinCtx *r)
1928	{
1929	if (!r->in.domain_name) {
1930	libnet_unjoin_set_error_string(mem_ctx, r,
1931	"No domain name defined");
1932	return WERR_INVALID_PARAM;
1933	}
1934
1935	if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1936	&r->in.domain_name,
1937	&r->in.dc_name)) {
1938	libnet_unjoin_set_error_string(mem_ctx, r,
1939	"Failed to parse domain name");
1940	return WERR_INVALID_PARAM;
1941	}
1942
1943	if (IS_DC) {
1944	return WERR_SETUP_DOMAIN_CONTROLLER;
1945	}
1946
1947	if (!secrets_init()) {
1948	libnet_unjoin_set_error_string(mem_ctx, r,
1949	"Unable to open secrets database");
1950	return WERR_CAN_NOT_COMPLETE;
1951	}
1952
1953	return WERR_OK;
1954	}
1955
1956	/****************************************************************
1957	****************************************************************/
1958
1959	static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
1960	struct libnet_UnjoinCtx *r)
1961	{
1962	saf_delete(r->out.netbios_domain_name);
1963	saf_delete(r->out.dns_domain_name);
1964
1965	return libnet_unjoin_config(r);
1966	}
1967
1968	/****************************************************************
1969	****************************************************************/
1970
1971	WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1972	struct libnet_UnjoinCtx *r)
1973	{
1974	WERROR werr;
1975
1976	if (r->in.debug) {
1977	LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
1978	}
1979
1980	werr = libnet_unjoin_pre_processing(mem_ctx, r);
1981	if (!W_ERROR_IS_OK(werr)) {
1982	goto done;
1983	}
1984
1985	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1986	werr = libnet_DomainUnjoin(mem_ctx, r);
1987	if (!W_ERROR_IS_OK(werr)) {
1988	libnet_unjoin_config(r);
1989	goto done;
1990	}
1991	}
1992
1993	werr = libnet_unjoin_post_processing(mem_ctx, r);
1994	if (!W_ERROR_IS_OK(werr)) {
1995	goto done;
1996	}
1997
1998	done:
1999	r->out.result = werr;
2000
2001	if (r->in.debug) {
2002	LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2003	}
2004
2005	return werr;
2006	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: