Context Navigation

← Previous Revision
Next Revision →
Blame
Revision Log

libnet_join.c

Visit:

Last change on this file was 862, checked in by Silvan Scherrer, 11 years ago
Samba Server: update trunk to 3.6.23
File size: 55.8 KB

Line
1	/*
2	* Unix SMB/CIFS implementation.
3	* libnet Join Support
4	* Copyright (C) Gerald (Jerry) Carter 2006
5	* Copyright (C) Guenther Deschner 2007-2008
6	*
7	* This program is free software; you can redistribute it and/or modify
8	* it under the terms of the GNU General Public License as published by
9	* the Free Software Foundation; either version 3 of the License, or
10	* (at your option) any later version.
11	*
12	* This program is distributed in the hope that it will be useful,
13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	* GNU General Public License for more details.
16	*
17	* You should have received a copy of the GNU General Public License
18	* along with this program; if not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "includes.h"
22	#include "ads.h"
23	#include "librpc/gen_ndr/ndr_libnet_join.h"
24	#include "libnet/libnet_join.h"
25	#include "libcli/auth/libcli_auth.h"
26	#include "../librpc/gen_ndr/ndr_samr_c.h"
27	#include "rpc_client/init_samr.h"
28	#include "../librpc/gen_ndr/ndr_lsa_c.h"
29	#include "rpc_client/cli_lsarpc.h"
30	#include "../librpc/gen_ndr/ndr_netlogon.h"
31	#include "rpc_client/cli_netlogon.h"
32	#include "lib/smbconf/smbconf.h"
33	#include "lib/smbconf/smbconf_reg.h"
34	#include "../libds/common/flags.h"
35	#include "secrets.h"
36	#include "rpc_client/init_lsa.h"
37	#include "rpc_client/cli_pipe.h"
38	#include "../libcli/security/security.h"
39	#include "passdb.h"
40	#include "libsmb/libsmb.h"
41
42	/****************************************************************
43	****************************************************************/
44
45	#define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
46	do { \
47	char *str = NULL; \
48	str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
49	DEBUG(1,("libnet_Join:\n%s", str)); \
50	TALLOC_FREE(str); \
51	} while (0)
52
53	#define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
54	LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN \| NDR_SET_VALUES)
55	#define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
56	LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
57
58	#define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
59	do { \
60	char *str = NULL; \
61	str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
62	DEBUG(1,("libnet_Unjoin:\n%s", str)); \
63	TALLOC_FREE(str); \
64	} while (0)
65
66	#define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
67	LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN \| NDR_SET_VALUES)
68	#define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
69	LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
70
71	/****************************************************************
72	****************************************************************/
73
74	static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
75	struct libnet_JoinCtx *r,
76	const char *format, ...)
77	{
78	va_list args;
79
80	if (r->out.error_string) {
81	return;
82	}
83
84	va_start(args, format);
85	r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
86	va_end(args);
87	}
88
89	/****************************************************************
90	****************************************************************/
91
92	static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
93	struct libnet_UnjoinCtx *r,
94	const char *format, ...)
95	{
96	va_list args;
97
98	if (r->out.error_string) {
99	return;
100	}
101
102	va_start(args, format);
103	r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
104	va_end(args);
105	}
106
107	#ifdef HAVE_ADS
108
109	/****************************************************************
110	****************************************************************/
111
112	static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
113	const char *netbios_domain_name,
114	const char *dc_name,
115	const char *user_name,
116	const char *password,
117	ADS_STRUCT **ads)
118	{
119	ADS_STATUS status;
120	ADS_STRUCT *my_ads = NULL;
121	char *cp;
122
123	my_ads = ads_init(dns_domain_name,
124	netbios_domain_name,
125	dc_name);
126	if (!my_ads) {
127	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
128	}
129
130	if (user_name) {
131	SAFE_FREE(my_ads->auth.user_name);
132	my_ads->auth.user_name = SMB_STRDUP(user_name);
133	if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
134	*cp++ = '\0';
135	SAFE_FREE(my_ads->auth.realm);
136	my_ads->auth.realm = smb_xstrdup(cp);
137	strupper_m(my_ads->auth.realm);
138	}
139	}
140
141	if (password) {
142	SAFE_FREE(my_ads->auth.password);
143	my_ads->auth.password = SMB_STRDUP(password);
144	}
145
146	status = ads_connect_user_creds(my_ads);
147	if (!ADS_ERR_OK(status)) {
148	ads_destroy(&my_ads);
149	return status;
150	}
151
152	*ads = my_ads;
153	return ADS_SUCCESS;
154	}
155
156	/****************************************************************
157	****************************************************************/
158
159	static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
160	struct libnet_JoinCtx *r)
161	{
162	ADS_STATUS status;
163
164	status = libnet_connect_ads(r->out.dns_domain_name,
165	r->out.netbios_domain_name,
166	r->in.dc_name,
167	r->in.admin_account,
168	r->in.admin_password,
169	&r->in.ads);
170	if (!ADS_ERR_OK(status)) {
171	libnet_join_set_error_string(mem_ctx, r,
172	"failed to connect to AD: %s",
173	ads_errstr(status));
174	return status;
175	}
176
177	if (!r->out.netbios_domain_name) {
178	r->out.netbios_domain_name = talloc_strdup(mem_ctx,
179	r->in.ads->server.workgroup);
180	ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
181	}
182
183	if (!r->out.dns_domain_name) {
184	r->out.dns_domain_name = talloc_strdup(mem_ctx,
185	r->in.ads->config.realm);
186	ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
187	}
188
189	r->out.domain_is_ad = true;
190
191	return ADS_SUCCESS;
192	}
193
194	/****************************************************************
195	****************************************************************/
196
197	static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
198	struct libnet_UnjoinCtx *r)
199	{
200	ADS_STATUS status;
201
202	status = libnet_connect_ads(r->in.domain_name,
203	r->in.domain_name,
204	r->in.dc_name,
205	r->in.admin_account,
206	r->in.admin_password,
207	&r->in.ads);
208	if (!ADS_ERR_OK(status)) {
209	libnet_unjoin_set_error_string(mem_ctx, r,
210	"failed to connect to AD: %s",
211	ads_errstr(status));
212	}
213
214	return status;
215	}
216
217	/****************************************************************
218	join a domain using ADS (LDAP mods)
219	****************************************************************/
220
221	static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
222	struct libnet_JoinCtx *r)
223	{
224	ADS_STATUS status;
225	LDAPMessage *res = NULL;
226	const char *attrs[] = { "dn", NULL };
227	bool moved = false;
228
229	status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
230	if (!ADS_ERR_OK(status)) {
231	return status;
232	}
233
234	status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
235	if (!ADS_ERR_OK(status)) {
236	return status;
237	}
238
239	if (ads_count_replies(r->in.ads, res) != 1) {
240	ads_msgfree(r->in.ads, res);
241	return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
242	}
243
244	ads_msgfree(r->in.ads, res);
245
246	/* Attempt to create the machine account and bail if this fails.
247	Assume that the admin wants exactly what they requested */
248
249	status = ads_create_machine_acct(r->in.ads,
250	r->in.machine_name,
251	r->in.account_ou);
252
253	if (ADS_ERR_OK(status)) {
254	DEBUG(1,("machine account creation created\n"));
255	return status;
256	} else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
257	(status.err.rc == LDAP_ALREADY_EXISTS)) {
258	status = ADS_SUCCESS;
259	}
260
261	if (!ADS_ERR_OK(status)) {
262	DEBUG(1,("machine account creation failed\n"));
263	return status;
264	}
265
266	status = ads_move_machine_acct(r->in.ads,
267	r->in.machine_name,
268	r->in.account_ou,
269	&moved);
270	if (!ADS_ERR_OK(status)) {
271	DEBUG(1,("failure to locate/move pre-existing "
272	"machine account\n"));
273	return status;
274	}
275
276	DEBUG(1,("The machine account %s the specified OU.\n",
277	moved ? "was moved into" : "already exists in"));
278
279	return status;
280	}
281
282	/****************************************************************
283	****************************************************************/
284
285	static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
286	struct libnet_UnjoinCtx *r)
287	{
288	ADS_STATUS status;
289
290	if (!r->in.ads) {
291	status = libnet_unjoin_connect_ads(mem_ctx, r);
292	if (!ADS_ERR_OK(status)) {
293	libnet_unjoin_set_error_string(mem_ctx, r,
294	"failed to connect to AD: %s",
295	ads_errstr(status));
296	return status;
297	}
298	}
299
300	status = ads_leave_realm(r->in.ads, r->in.machine_name);
301	if (!ADS_ERR_OK(status)) {
302	libnet_unjoin_set_error_string(mem_ctx, r,
303	"failed to leave realm: %s",
304	ads_errstr(status));
305	return status;
306	}
307
308	return ADS_SUCCESS;
309	}
310
311	/****************************************************************
312	****************************************************************/
313
314	static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
315	struct libnet_JoinCtx *r)
316	{
317	ADS_STATUS status;
318	LDAPMessage *res = NULL;
319	char *dn = NULL;
320
321	if (!r->in.machine_name) {
322	return ADS_ERROR(LDAP_NO_MEMORY);
323	}
324
325	status = ads_find_machine_acct(r->in.ads,
326	&res,
327	r->in.machine_name);
328	if (!ADS_ERR_OK(status)) {
329	return status;
330	}
331
332	if (ads_count_replies(r->in.ads, res) != 1) {
333	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
334	goto done;
335	}
336
337	dn = ads_get_dn(r->in.ads, mem_ctx, res);
338	if (!dn) {
339	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
340	goto done;
341	}
342
343	r->out.dn = talloc_strdup(mem_ctx, dn);
344	if (!r->out.dn) {
345	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
346	goto done;
347	}
348
349	done:
350	ads_msgfree(r->in.ads, res);
351	TALLOC_FREE(dn);
352
353	return status;
354	}
355
356	/****************************************************************
357	Set a machines dNSHostName and servicePrincipalName attributes
358	****************************************************************/
359
360	static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
361	struct libnet_JoinCtx *r)
362	{
363	ADS_STATUS status;
364	ADS_MODLIST mods;
365	fstring my_fqdn;
366	const char *spn_array[3] = {NULL, NULL, NULL};
367	char *spn = NULL;
368
369	/* Find our DN */
370
371	status = libnet_join_find_machine_acct(mem_ctx, r);
372	if (!ADS_ERR_OK(status)) {
373	return status;
374	}
375
376	/* Windows only creates HOST/shortname & HOST/fqdn. */
377
378	spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
379	if (!spn) {
380	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
381	}
382	strupper_m(spn);
383	spn_array[0] = spn;
384
385	if (!name_to_fqdn(my_fqdn, r->in.machine_name)
386	\|\| (strchr(my_fqdn, '.') == NULL)) {
387	fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
388	r->out.dns_domain_name);
389	}
390
391	strlower_m(my_fqdn);
392
393	if (!strequal(my_fqdn, r->in.machine_name)) {
394	spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
395	if (!spn) {
396	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
397	}
398	spn_array[1] = spn;
399	}
400
401	mods = ads_init_mods(mem_ctx);
402	if (!mods) {
403	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
404	}
405
406	/* fields of primary importance */
407
408	status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
409	if (!ADS_ERR_OK(status)) {
410	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
411	}
412
413	status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
414	spn_array);
415	if (!ADS_ERR_OK(status)) {
416	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
417	}
418
419	return ads_gen_mod(r->in.ads, r->out.dn, mods);
420	}
421
422	/****************************************************************
423	****************************************************************/
424
425	static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
426	struct libnet_JoinCtx *r)
427	{
428	ADS_STATUS status;
429	ADS_MODLIST mods;
430
431	if (!r->in.create_upn) {
432	return ADS_SUCCESS;
433	}
434
435	/* Find our DN */
436
437	status = libnet_join_find_machine_acct(mem_ctx, r);
438	if (!ADS_ERR_OK(status)) {
439	return status;
440	}
441
442	if (!r->in.upn) {
443	r->in.upn = talloc_asprintf(mem_ctx,
444	"host/%s@%s",
445	r->in.machine_name,
446	r->out.dns_domain_name);
447	if (!r->in.upn) {
448	return ADS_ERROR(LDAP_NO_MEMORY);
449	}
450	}
451
452	/* now do the mods */
453
454	mods = ads_init_mods(mem_ctx);
455	if (!mods) {
456	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
457	}
458
459	/* fields of primary importance */
460
461	status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
462	if (!ADS_ERR_OK(status)) {
463	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
464	}
465
466	return ads_gen_mod(r->in.ads, r->out.dn, mods);
467	}
468
469
470	/****************************************************************
471	****************************************************************/
472
473	static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
474	struct libnet_JoinCtx *r)
475	{
476	ADS_STATUS status;
477	ADS_MODLIST mods;
478	char *os_sp = NULL;
479
480	if (!r->in.os_name \|\| !r->in.os_version ) {
481	return ADS_SUCCESS;
482	}
483
484	/* Find our DN */
485
486	status = libnet_join_find_machine_acct(mem_ctx, r);
487	if (!ADS_ERR_OK(status)) {
488	return status;
489	}
490
491	/* now do the mods */
492
493	mods = ads_init_mods(mem_ctx);
494	if (!mods) {
495	return ADS_ERROR(LDAP_NO_MEMORY);
496	}
497
498	os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
499	if (!os_sp) {
500	return ADS_ERROR(LDAP_NO_MEMORY);
501	}
502
503	/* fields of primary importance */
504
505	status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
506	r->in.os_name);
507	if (!ADS_ERR_OK(status)) {
508	return status;
509	}
510
511	status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
512	r->in.os_version);
513	if (!ADS_ERR_OK(status)) {
514	return status;
515	}
516
517	status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
518	os_sp);
519	if (!ADS_ERR_OK(status)) {
520	return status;
521	}
522
523	return ads_gen_mod(r->in.ads, r->out.dn, mods);
524	}
525
526	/****************************************************************
527	****************************************************************/
528
529	static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
530	struct libnet_JoinCtx *r)
531	{
532	if (!USE_SYSTEM_KEYTAB) {
533	return true;
534	}
535
536	if (ads_keytab_create_default(r->in.ads) != 0) {
537	return false;
538	}
539
540	return true;
541	}
542
543	/****************************************************************
544	****************************************************************/
545
546	static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
547	struct libnet_JoinCtx *r)
548	{
549	uint32_t domain_func;
550	ADS_STATUS status;
551	const char *salt = NULL;
552	char *std_salt = NULL;
553
554	status = ads_domain_func_level(r->in.ads, &domain_func);
555	if (!ADS_ERR_OK(status)) {
556	libnet_join_set_error_string(mem_ctx, r,
557	"failed to determine domain functional level: %s",
558	ads_errstr(status));
559	return false;
560	}
561
562	/* go ahead and setup the default salt */
563
564	std_salt = kerberos_standard_des_salt();
565	if (!std_salt) {
566	libnet_join_set_error_string(mem_ctx, r,
567	"failed to obtain standard DES salt");
568	return false;
569	}
570
571	salt = talloc_strdup(mem_ctx, std_salt);
572	if (!salt) {
573	return false;
574	}
575
576	SAFE_FREE(std_salt);
577
578	/* if it's a Windows functional domain, we have to look for the UPN */
579
580	if (domain_func == DS_DOMAIN_FUNCTION_2000) {
581	char *upn;
582
583	upn = ads_get_upn(r->in.ads, mem_ctx,
584	r->in.machine_name);
585	if (upn) {
586	salt = talloc_strdup(mem_ctx, upn);
587	if (!salt) {
588	return false;
589	}
590	}
591	}
592
593	return kerberos_secrets_store_des_salt(salt);
594	}
595
596	/****************************************************************
597	****************************************************************/
598
599	static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
600	struct libnet_JoinCtx *r)
601	{
602	ADS_STATUS status;
603
604	if (!r->in.ads) {
605	status = libnet_join_connect_ads(mem_ctx, r);
606	if (!ADS_ERR_OK(status)) {
607	return status;
608	}
609	}
610
611	status = libnet_join_set_machine_spn(mem_ctx, r);
612	if (!ADS_ERR_OK(status)) {
613	libnet_join_set_error_string(mem_ctx, r,
614	"failed to set machine spn: %s",
615	ads_errstr(status));
616	return status;
617	}
618
619	status = libnet_join_set_os_attributes(mem_ctx, r);
620	if (!ADS_ERR_OK(status)) {
621	libnet_join_set_error_string(mem_ctx, r,
622	"failed to set machine os attributes: %s",
623	ads_errstr(status));
624	return status;
625	}
626
627	status = libnet_join_set_machine_upn(mem_ctx, r);
628	if (!ADS_ERR_OK(status)) {
629	libnet_join_set_error_string(mem_ctx, r,
630	"failed to set machine upn: %s",
631	ads_errstr(status));
632	return status;
633	}
634
635	if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
636	return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
637	}
638
639	if (!libnet_join_create_keytab(mem_ctx, r)) {
640	libnet_join_set_error_string(mem_ctx, r,
641	"failed to create kerberos keytab");
642	return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
643	}
644
645	return ADS_SUCCESS;
646	}
647	#endif /* HAVE_ADS */
648
649	/****************************************************************
650	Store the machine password and domain SID
651	****************************************************************/
652
653	static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
654	struct libnet_JoinCtx *r)
655	{
656	if (!secrets_store_domain_sid(r->out.netbios_domain_name,
657	r->out.domain_sid))
658	{
659	DEBUG(1,("Failed to save domain sid\n"));
660	return false;
661	}
662
663	if (!secrets_store_machine_password(r->in.machine_password,
664	r->out.netbios_domain_name,
665	r->in.secure_channel_type))
666	{
667	DEBUG(1,("Failed to save machine password\n"));
668	return false;
669	}
670
671	return true;
672	}
673
674	/****************************************************************
675	Connect dc's IPC$ share
676	****************************************************************/
677
678	static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
679	const char *user,
680	const char *pass,
681	bool use_kerberos,
682	struct cli_state **cli)
683	{
684	int flags = 0;
685
686	if (use_kerberos) {
687	flags \|= CLI_FULL_CONNECTION_USE_KERBEROS;
688	}
689
690	if (use_kerberos && pass) {
691	flags \|= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
692	}
693
694	return cli_full_connection(cli, NULL,
695	dc,
696	NULL, 0,
697	"IPC$", "IPC",
698	user,
699	NULL,
700	pass,
701	flags,
702	Undefined);
703	}
704
705	/****************************************************************
706	Lookup domain dc's info
707	****************************************************************/
708
709	static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
710	struct libnet_JoinCtx *r,
711	struct cli_state **cli)
712	{
713	struct rpc_pipe_client *pipe_hnd = NULL;
714	struct policy_handle lsa_pol;
715	NTSTATUS status, result;
716	union lsa_PolicyInformation *info = NULL;
717	struct dcerpc_binding_handle *b;
718
719	status = libnet_join_connect_dc_ipc(r->in.dc_name,
720	r->in.admin_account,
721	r->in.admin_password,
722	r->in.use_kerberos,
723	cli);
724	if (!NT_STATUS_IS_OK(status)) {
725	goto done;
726	}
727
728	status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
729	&pipe_hnd);
730	if (!NT_STATUS_IS_OK(status)) {
731	DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
732	nt_errstr(status)));
733	goto done;
734	}
735
736	b = pipe_hnd->binding_handle;
737
738	status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
739	SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
740	if (!NT_STATUS_IS_OK(status)) {
741	goto done;
742	}
743
744	status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
745	&lsa_pol,
746	LSA_POLICY_INFO_DNS,
747	&info,
748	&result);
749	if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
750	r->out.domain_is_ad = true;
751	r->out.netbios_domain_name = info->dns.name.string;
752	r->out.dns_domain_name = info->dns.dns_domain.string;
753	r->out.forest_name = info->dns.dns_forest.string;
754	r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
755	NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
756	}
757
758	if (!NT_STATUS_IS_OK(status)) {
759	status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
760	&lsa_pol,
761	LSA_POLICY_INFO_ACCOUNT_DOMAIN,
762	&info,
763	&result);
764	if (!NT_STATUS_IS_OK(status)) {
765	goto done;
766	}
767	if (!NT_STATUS_IS_OK(result)) {
768	status = result;
769	goto done;
770	}
771
772	r->out.netbios_domain_name = info->account_domain.name.string;
773	r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
774	NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
775	}
776
777	dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
778	TALLOC_FREE(pipe_hnd);
779
780	done:
781	return status;
782	}
783
784	/****************************************************************
785	Do the domain join unsecure
786	****************************************************************/
787
788	static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
789	struct libnet_JoinCtx *r,
790	struct cli_state *cli)
791	{
792	struct rpc_pipe_client *pipe_hnd = NULL;
793	unsigned char orig_trust_passwd_hash[16];
794	unsigned char new_trust_passwd_hash[16];
795	fstring trust_passwd;
796	NTSTATUS status;
797
798	status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
799	&pipe_hnd);
800	if (!NT_STATUS_IS_OK(status)) {
801	return status;
802	}
803
804	if (!r->in.machine_password) {
805	r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
806	NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
807	}
808
809	E_md4hash(r->in.machine_password, new_trust_passwd_hash);
810
811	/* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
812	fstrcpy(trust_passwd, r->in.admin_password);
813	strlower_m(trust_passwd);
814
815	/*
816	* Machine names can be 15 characters, but the max length on
817	* a password is 14. --jerry
818	*/
819
820	trust_passwd[14] = '\0';
821
822	E_md4hash(trust_passwd, orig_trust_passwd_hash);
823
824	status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
825	r->in.machine_name,
826	orig_trust_passwd_hash,
827	r->in.machine_password,
828	new_trust_passwd_hash,
829	r->in.secure_channel_type);
830
831	return status;
832	}
833
834	/****************************************************************
835	Do the domain join
836	****************************************************************/
837
838	static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
839	struct libnet_JoinCtx *r,
840	struct cli_state *cli)
841	{
842	struct rpc_pipe_client *pipe_hnd = NULL;
843	struct policy_handle sam_pol, domain_pol, user_pol;
844	NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
845	char *acct_name;
846	struct lsa_String lsa_acct_name;
847	uint32_t user_rid;
848	uint32_t acct_flags = ACB_WSTRUST;
849	struct samr_Ids user_rids;
850	struct samr_Ids name_types;
851	union samr_UserInfo user_info;
852	struct dcerpc_binding_handle *b = NULL;
853	unsigned int old_timeout = 0;
854
855	struct samr_CryptPassword crypt_pwd;
856	struct samr_CryptPasswordEx crypt_pwd_ex;
857
858	ZERO_STRUCT(sam_pol);
859	ZERO_STRUCT(domain_pol);
860	ZERO_STRUCT(user_pol);
861
862	switch (r->in.secure_channel_type) {
863	case SEC_CHAN_WKSTA:
864	acct_flags = ACB_WSTRUST;
865	break;
866	case SEC_CHAN_BDC:
867	acct_flags = ACB_SVRTRUST;
868	break;
869	default:
870	return NT_STATUS_INVALID_PARAMETER;
871	}
872
873	if (!r->in.machine_password) {
874	r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
875	NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
876	}
877
878	/* Open the domain */
879
880	status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
881	&pipe_hnd);
882	if (!NT_STATUS_IS_OK(status)) {
883	DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
884	nt_errstr(status)));
885	goto done;
886	}
887
888	b = pipe_hnd->binding_handle;
889
890	status = dcerpc_samr_Connect2(b, mem_ctx,
891	pipe_hnd->desthost,
892	SAMR_ACCESS_ENUM_DOMAINS
893	\| SAMR_ACCESS_LOOKUP_DOMAIN,
894	&sam_pol,
895	&result);
896	if (!NT_STATUS_IS_OK(status)) {
897	goto done;
898	}
899	if (!NT_STATUS_IS_OK(result)) {
900	status = result;
901	goto done;
902	}
903
904	status = dcerpc_samr_OpenDomain(b, mem_ctx,
905	&sam_pol,
906	SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
907	\| SAMR_DOMAIN_ACCESS_CREATE_USER
908	\| SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
909	r->out.domain_sid,
910	&domain_pol,
911	&result);
912	if (!NT_STATUS_IS_OK(status)) {
913	goto done;
914	}
915	if (!NT_STATUS_IS_OK(result)) {
916	status = result;
917	goto done;
918	}
919
920	/* Create domain user */
921
922	acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
923	strlower_m(acct_name);
924
925	init_lsa_String(&lsa_acct_name, acct_name);
926
927	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
928	uint32_t access_desired =
929	SEC_GENERIC_READ \| SEC_GENERIC_WRITE \| SEC_GENERIC_EXECUTE \|
930	SEC_STD_WRITE_DAC \| SEC_STD_DELETE \|
931	SAMR_USER_ACCESS_SET_PASSWORD \|
932	SAMR_USER_ACCESS_GET_ATTRIBUTES \|
933	SAMR_USER_ACCESS_SET_ATTRIBUTES;
934	uint32_t access_granted = 0;
935
936	DEBUG(10,("Creating account with desired access mask: %d\n",
937	access_desired));
938
939	status = dcerpc_samr_CreateUser2(b, mem_ctx,
940	&domain_pol,
941	&lsa_acct_name,
942	acct_flags,
943	access_desired,
944	&user_pol,
945	&access_granted,
946	&user_rid,
947	&result);
948	if (!NT_STATUS_IS_OK(status)) {
949	goto done;
950	}
951
952	status = result;
953	if (!NT_STATUS_IS_OK(status) &&
954	!NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
955
956	DEBUG(10,("Creation of workstation account failed: %s\n",
957	nt_errstr(status)));
958
959	/* If NT_STATUS_ACCESS_DENIED then we have a valid
960	username/password combo but the user does not have
961	administrator access. */
962
963	if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
964	libnet_join_set_error_string(mem_ctx, r,
965	"User specified does not have "
966	"administrator privileges");
967	}
968
969	goto done;
970	}
971
972	if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
973	if (!(r->in.join_flags &
974	WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
975	goto done;
976	}
977	}
978
979	/* We must do this.... don't ask... */
980
981	if (NT_STATUS_IS_OK(status)) {
982	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
983	}
984	}
985
986	status = dcerpc_samr_LookupNames(b, mem_ctx,
987	&domain_pol,
988	1,
989	&lsa_acct_name,
990	&user_rids,
991	&name_types,
992	&result);
993	if (!NT_STATUS_IS_OK(status)) {
994	goto done;
995	}
996	if (!NT_STATUS_IS_OK(result)) {
997	status = result;
998	goto done;
999	}
1000	if (user_rids.count != 1) {
1001	status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1002	goto done;
1003	}
1004	if (name_types.count != 1) {
1005	status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1006	goto done;
1007	}
1008
1009	if (name_types.ids[0] != SID_NAME_USER) {
1010	DEBUG(0,("%s is not a user account (type=%d)\n",
1011	acct_name, name_types.ids[0]));
1012	status = NT_STATUS_INVALID_WORKSTATION;
1013	goto done;
1014	}
1015
1016	user_rid = user_rids.ids[0];
1017
1018	/* Open handle on user */
1019
1020	status = dcerpc_samr_OpenUser(b, mem_ctx,
1021	&domain_pol,
1022	SEC_FLAG_MAXIMUM_ALLOWED,
1023	user_rid,
1024	&user_pol,
1025	&result);
1026	if (!NT_STATUS_IS_OK(status)) {
1027	goto done;
1028	}
1029	if (!NT_STATUS_IS_OK(result)) {
1030	status = result;
1031	goto done;
1032	}
1033
1034	/* Fill in the additional account flags now */
1035
1036	acct_flags \|= ACB_PWNOEXP;
1037
1038	/* Set account flags on machine account */
1039	ZERO_STRUCT(user_info.info16);
1040	user_info.info16.acct_flags = acct_flags;
1041
1042	status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1043	&user_pol,
1044	16,
1045	&user_info,
1046	&result);
1047	if (!NT_STATUS_IS_OK(status)) {
1048	dcerpc_samr_DeleteUser(b, mem_ctx,
1049	&user_pol,
1050	&result);
1051
1052	libnet_join_set_error_string(mem_ctx, r,
1053	"Failed to set account flags for machine account (%s)\n",
1054	nt_errstr(status));
1055	goto done;
1056	}
1057
1058	if (!NT_STATUS_IS_OK(result)) {
1059	status = result;
1060
1061	dcerpc_samr_DeleteUser(b, mem_ctx,
1062	&user_pol,
1063	&result);
1064
1065	libnet_join_set_error_string(mem_ctx, r,
1066	"Failed to set account flags for machine account (%s)\n",
1067	nt_errstr(status));
1068	goto done;
1069	}
1070
1071	/* Set password on machine account - first try level 26 */
1072
1073	/*
1074	* increase the timeout as password filter modules on the DC
1075	* might delay the operation for a significant amount of time
1076	*/
1077	old_timeout = rpccli_set_timeout(pipe_hnd, 600000);
1078
1079	init_samr_CryptPasswordEx(r->in.machine_password,
1080	&cli->user_session_key,
1081	&crypt_pwd_ex);
1082
1083	user_info.info26.password = crypt_pwd_ex;
1084	user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1085
1086	status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1087	&user_pol,
1088	26,
1089	&user_info,
1090	&result);
1091
1092	if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1093
1094	/* retry with level 24 */
1095
1096	init_samr_CryptPassword(r->in.machine_password,
1097	&cli->user_session_key,
1098	&crypt_pwd);
1099
1100	user_info.info24.password = crypt_pwd;
1101	user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1102
1103	status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1104	&user_pol,
1105	24,
1106	&user_info,
1107	&result);
1108	}
1109
1110	old_timeout = rpccli_set_timeout(pipe_hnd, old_timeout);
1111
1112	if (!NT_STATUS_IS_OK(status)) {
1113
1114	dcerpc_samr_DeleteUser(b, mem_ctx,
1115	&user_pol,
1116	&result);
1117
1118	libnet_join_set_error_string(mem_ctx, r,
1119	"Failed to set password for machine account (%s)\n",
1120	nt_errstr(status));
1121	goto done;
1122	}
1123	if (!NT_STATUS_IS_OK(result)) {
1124	status = result;
1125
1126	dcerpc_samr_DeleteUser(b, mem_ctx,
1127	&user_pol,
1128	&result);
1129
1130	libnet_join_set_error_string(mem_ctx, r,
1131	"Failed to set password for machine account (%s)\n",
1132	nt_errstr(status));
1133	goto done;
1134	}
1135
1136	status = NT_STATUS_OK;
1137
1138	done:
1139	if (!pipe_hnd) {
1140	return status;
1141	}
1142
1143	if (is_valid_policy_hnd(&sam_pol)) {
1144	dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1145	}
1146	if (is_valid_policy_hnd(&domain_pol)) {
1147	dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1148	}
1149	if (is_valid_policy_hnd(&user_pol)) {
1150	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1151	}
1152	TALLOC_FREE(pipe_hnd);
1153
1154	return status;
1155	}
1156
1157	/****************************************************************
1158	****************************************************************/
1159
1160	NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1161	const char *machine_name,
1162	const char *dc_name)
1163	{
1164	uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1165	struct cli_state *cli = NULL;
1166	struct rpc_pipe_client *pipe_hnd = NULL;
1167	struct rpc_pipe_client *netlogon_pipe = NULL;
1168	NTSTATUS status;
1169	char *machine_password = NULL;
1170	char *machine_account = NULL;
1171
1172	if (!dc_name) {
1173	return NT_STATUS_INVALID_PARAMETER;
1174	}
1175
1176	if (!secrets_init()) {
1177	return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1178	}
1179
1180	machine_password = secrets_fetch_machine_password(netbios_domain_name,
1181	NULL, NULL);
1182	if (!machine_password) {
1183	return NT_STATUS_NO_TRUST_LSA_SECRET;
1184	}
1185
1186	if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1187	SAFE_FREE(machine_password);
1188	return NT_STATUS_NO_MEMORY;
1189	}
1190
1191	status = cli_full_connection(&cli, NULL,
1192	dc_name,
1193	NULL, 0,
1194	"IPC$", "IPC",
1195	machine_account,
1196	NULL,
1197	machine_password,
1198	0,
1199	Undefined);
1200	free(machine_account);
1201	free(machine_password);
1202
1203	if (!NT_STATUS_IS_OK(status)) {
1204	status = cli_full_connection(&cli, NULL,
1205	dc_name,
1206	NULL, 0,
1207	"IPC$", "IPC",
1208	"",
1209	NULL,
1210	"",
1211	0,
1212	Undefined);
1213	}
1214
1215	if (!NT_STATUS_IS_OK(status)) {
1216	return status;
1217	}
1218
1219	status = get_schannel_session_key(cli, netbios_domain_name,
1220	&neg_flags, &netlogon_pipe);
1221	if (!NT_STATUS_IS_OK(status)) {
1222	if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1223	cli_shutdown(cli);
1224	return NT_STATUS_OK;
1225	}
1226
1227	DEBUG(0,("libnet_join_ok: failed to get schannel session "
1228	"key from server %s for domain %s. Error was %s\n",
1229	cli->desthost, netbios_domain_name, nt_errstr(status)));
1230	cli_shutdown(cli);
1231	return status;
1232	}
1233
1234	if (!lp_client_schannel()) {
1235	cli_shutdown(cli);
1236	return NT_STATUS_OK;
1237	}
1238
1239	status = cli_rpc_pipe_open_schannel_with_key(
1240	cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1241	DCERPC_AUTH_LEVEL_PRIVACY,
1242	netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1243
1244	cli_shutdown(cli);
1245
1246	if (!NT_STATUS_IS_OK(status)) {
1247	DEBUG(0,("libnet_join_ok: failed to open schannel session "
1248	"on netlogon pipe to server %s for domain %s. "
1249	"Error was %s\n",
1250	cli->desthost, netbios_domain_name, nt_errstr(status)));
1251	return status;
1252	}
1253
1254	return NT_STATUS_OK;
1255	}
1256
1257	/****************************************************************
1258	****************************************************************/
1259
1260	static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1261	struct libnet_JoinCtx *r)
1262	{
1263	NTSTATUS status;
1264
1265	status = libnet_join_ok(r->out.netbios_domain_name,
1266	r->in.machine_name,
1267	r->in.dc_name);
1268	if (!NT_STATUS_IS_OK(status)) {
1269	libnet_join_set_error_string(mem_ctx, r,
1270	"failed to verify domain membership after joining: %s",
1271	get_friendly_nt_error_msg(status));
1272	return WERR_SETUP_NOT_JOINED;
1273	}
1274
1275	return WERR_OK;
1276	}
1277
1278	/****************************************************************
1279	****************************************************************/
1280
1281	static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1282	struct libnet_UnjoinCtx *r)
1283	{
1284	if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1285	return false;
1286	}
1287
1288	if (!secrets_delete_domain_sid(lp_workgroup())) {
1289	return false;
1290	}
1291
1292	return true;
1293	}
1294
1295	/****************************************************************
1296	****************************************************************/
1297
1298	static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1299	struct libnet_UnjoinCtx *r)
1300	{
1301	struct cli_state *cli = NULL;
1302	struct rpc_pipe_client *pipe_hnd = NULL;
1303	struct policy_handle sam_pol, domain_pol, user_pol;
1304	NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1305	char *acct_name;
1306	uint32_t user_rid;
1307	struct lsa_String lsa_acct_name;
1308	struct samr_Ids user_rids;
1309	struct samr_Ids name_types;
1310	union samr_UserInfo *info = NULL;
1311	struct dcerpc_binding_handle *b = NULL;
1312
1313	ZERO_STRUCT(sam_pol);
1314	ZERO_STRUCT(domain_pol);
1315	ZERO_STRUCT(user_pol);
1316
1317	status = libnet_join_connect_dc_ipc(r->in.dc_name,
1318	r->in.admin_account,
1319	r->in.admin_password,
1320	r->in.use_kerberos,
1321	&cli);
1322	if (!NT_STATUS_IS_OK(status)) {
1323	goto done;
1324	}
1325
1326	/* Open the domain */
1327
1328	status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1329	&pipe_hnd);
1330	if (!NT_STATUS_IS_OK(status)) {
1331	DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1332	nt_errstr(status)));
1333	goto done;
1334	}
1335
1336	b = pipe_hnd->binding_handle;
1337
1338	status = dcerpc_samr_Connect2(b, mem_ctx,
1339	pipe_hnd->desthost,
1340	SEC_FLAG_MAXIMUM_ALLOWED,
1341	&sam_pol,
1342	&result);
1343	if (!NT_STATUS_IS_OK(status)) {
1344	goto done;
1345	}
1346	if (!NT_STATUS_IS_OK(result)) {
1347	status = result;
1348	goto done;
1349	}
1350
1351	status = dcerpc_samr_OpenDomain(b, mem_ctx,
1352	&sam_pol,
1353	SEC_FLAG_MAXIMUM_ALLOWED,
1354	r->in.domain_sid,
1355	&domain_pol,
1356	&result);
1357	if (!NT_STATUS_IS_OK(status)) {
1358	goto done;
1359	}
1360	if (!NT_STATUS_IS_OK(result)) {
1361	status = result;
1362	goto done;
1363	}
1364
1365	/* Create domain user */
1366
1367	acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1368	strlower_m(acct_name);
1369
1370	init_lsa_String(&lsa_acct_name, acct_name);
1371
1372	status = dcerpc_samr_LookupNames(b, mem_ctx,
1373	&domain_pol,
1374	1,
1375	&lsa_acct_name,
1376	&user_rids,
1377	&name_types,
1378	&result);
1379
1380	if (!NT_STATUS_IS_OK(status)) {
1381	goto done;
1382	}
1383	if (!NT_STATUS_IS_OK(result)) {
1384	status = result;
1385	goto done;
1386	}
1387	if (user_rids.count != 1) {
1388	status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1389	goto done;
1390	}
1391	if (name_types.count != 1) {
1392	status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1393	goto done;
1394	}
1395
1396	if (name_types.ids[0] != SID_NAME_USER) {
1397	DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1398	name_types.ids[0]));
1399	status = NT_STATUS_INVALID_WORKSTATION;
1400	goto done;
1401	}
1402
1403	user_rid = user_rids.ids[0];
1404
1405	/* Open handle on user */
1406
1407	status = dcerpc_samr_OpenUser(b, mem_ctx,
1408	&domain_pol,
1409	SEC_FLAG_MAXIMUM_ALLOWED,
1410	user_rid,
1411	&user_pol,
1412	&result);
1413	if (!NT_STATUS_IS_OK(status)) {
1414	goto done;
1415	}
1416	if (!NT_STATUS_IS_OK(result)) {
1417	status = result;
1418	goto done;
1419	}
1420
1421	/* Get user info */
1422
1423	status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1424	&user_pol,
1425	16,
1426	&info,
1427	&result);
1428	if (!NT_STATUS_IS_OK(status)) {
1429	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1430	goto done;
1431	}
1432	if (!NT_STATUS_IS_OK(result)) {
1433	status = result;
1434	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1435	goto done;
1436	}
1437
1438	/* now disable and setuser info */
1439
1440	info->info16.acct_flags \|= ACB_DISABLED;
1441
1442	status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1443	&user_pol,
1444	16,
1445	info,
1446	&result);
1447	if (!NT_STATUS_IS_OK(status)) {
1448	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1449	goto done;
1450	}
1451	if (!NT_STATUS_IS_OK(result)) {
1452	status = result;
1453	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1454	goto done;
1455	}
1456	status = result;
1457	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1458
1459	done:
1460	if (pipe_hnd && b) {
1461	if (is_valid_policy_hnd(&domain_pol)) {
1462	dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1463	}
1464	if (is_valid_policy_hnd(&sam_pol)) {
1465	dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1466	}
1467	TALLOC_FREE(pipe_hnd);
1468	}
1469
1470	if (cli) {
1471	cli_shutdown(cli);
1472	}
1473
1474	return status;
1475	}
1476
1477	/****************************************************************
1478	****************************************************************/
1479
1480	static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1481	{
1482	WERROR werr = WERR_OK;
1483	sbcErr err;
1484	struct smbconf_ctx *ctx;
1485
1486	err = smbconf_init_reg(r, &ctx, NULL);
1487	if (!SBC_ERROR_IS_OK(err)) {
1488	werr = WERR_NO_SUCH_SERVICE;
1489	goto done;
1490	}
1491
1492	if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1493
1494	err = smbconf_set_global_parameter(ctx, "security", "user");
1495	if (!SBC_ERROR_IS_OK(err)) {
1496	werr = WERR_NO_SUCH_SERVICE;
1497	goto done;
1498	}
1499
1500	err = smbconf_set_global_parameter(ctx, "workgroup",
1501	r->in.domain_name);
1502	if (!SBC_ERROR_IS_OK(err)) {
1503	werr = WERR_NO_SUCH_SERVICE;
1504	goto done;
1505	}
1506
1507	smbconf_delete_global_parameter(ctx, "realm");
1508	goto done;
1509	}
1510
1511	err = smbconf_set_global_parameter(ctx, "security", "domain");
1512	if (!SBC_ERROR_IS_OK(err)) {
1513	werr = WERR_NO_SUCH_SERVICE;
1514	goto done;
1515	}
1516
1517	err = smbconf_set_global_parameter(ctx, "workgroup",
1518	r->out.netbios_domain_name);
1519	if (!SBC_ERROR_IS_OK(err)) {
1520	werr = WERR_NO_SUCH_SERVICE;
1521	goto done;
1522	}
1523
1524	if (r->out.domain_is_ad) {
1525	err = smbconf_set_global_parameter(ctx, "security", "ads");
1526	if (!SBC_ERROR_IS_OK(err)) {
1527	werr = WERR_NO_SUCH_SERVICE;
1528	goto done;
1529	}
1530
1531	err = smbconf_set_global_parameter(ctx, "realm",
1532	r->out.dns_domain_name);
1533	if (!SBC_ERROR_IS_OK(err)) {
1534	werr = WERR_NO_SUCH_SERVICE;
1535	goto done;
1536	}
1537	}
1538
1539	done:
1540	smbconf_shutdown(ctx);
1541	return werr;
1542	}
1543
1544	/****************************************************************
1545	****************************************************************/
1546
1547	static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1548	{
1549	WERROR werr = WERR_OK;
1550	sbcErr err;
1551	struct smbconf_ctx *ctx;
1552
1553	err = smbconf_init_reg(r, &ctx, NULL);
1554	if (!SBC_ERROR_IS_OK(err)) {
1555	werr = WERR_NO_SUCH_SERVICE;
1556	goto done;
1557	}
1558
1559	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1560
1561	err = smbconf_set_global_parameter(ctx, "security", "user");
1562	if (!SBC_ERROR_IS_OK(err)) {
1563	werr = WERR_NO_SUCH_SERVICE;
1564	goto done;
1565	}
1566
1567	err = smbconf_delete_global_parameter(ctx, "workgroup");
1568	if (!SBC_ERROR_IS_OK(err)) {
1569	werr = WERR_NO_SUCH_SERVICE;
1570	goto done;
1571	}
1572
1573	smbconf_delete_global_parameter(ctx, "realm");
1574	}
1575
1576	done:
1577	smbconf_shutdown(ctx);
1578	return werr;
1579	}
1580
1581	/****************************************************************
1582	****************************************************************/
1583
1584	static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1585	{
1586	WERROR werr;
1587
1588	if (!W_ERROR_IS_OK(r->out.result)) {
1589	return r->out.result;
1590	}
1591
1592	if (!r->in.modify_config) {
1593	return WERR_OK;
1594	}
1595
1596	werr = do_join_modify_vals_config(r);
1597	if (!W_ERROR_IS_OK(werr)) {
1598	return werr;
1599	}
1600
1601	lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1602
1603	r->out.modified_config = true;
1604	r->out.result = werr;
1605
1606	return werr;
1607	}
1608
1609	/****************************************************************
1610	****************************************************************/
1611
1612	static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1613	{
1614	WERROR werr;
1615
1616	if (!W_ERROR_IS_OK(r->out.result)) {
1617	return r->out.result;
1618	}
1619
1620	if (!r->in.modify_config) {
1621	return WERR_OK;
1622	}
1623
1624	werr = do_unjoin_modify_vals_config(r);
1625	if (!W_ERROR_IS_OK(werr)) {
1626	return werr;
1627	}
1628
1629	lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1630
1631	r->out.modified_config = true;
1632	r->out.result = werr;
1633
1634	return werr;
1635	}
1636
1637	/****************************************************************
1638	****************************************************************/
1639
1640	static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1641	const char *domain_str,
1642	const char **domain_p,
1643	const char **dc_p)
1644	{
1645	char *domain = NULL;
1646	char *dc = NULL;
1647	const char *p = NULL;
1648
1649	if (!domain_str \|\| !domain_p \|\| !dc_p) {
1650	return false;
1651	}
1652
1653	p = strchr_m(domain_str, '\\');
1654
1655	if (p != NULL) {
1656	domain = talloc_strndup(mem_ctx, domain_str,
1657	PTR_DIFF(p, domain_str));
1658	dc = talloc_strdup(mem_ctx, p+1);
1659	if (!dc) {
1660	return false;
1661	}
1662	} else {
1663	domain = talloc_strdup(mem_ctx, domain_str);
1664	dc = NULL;
1665	}
1666	if (!domain) {
1667	return false;
1668	}
1669
1670	*domain_p = domain;
1671
1672	if (!*dc_p && dc) {
1673	*dc_p = dc;
1674	}
1675
1676	return true;
1677	}
1678
1679	/****************************************************************
1680	****************************************************************/
1681
1682	static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1683	struct libnet_JoinCtx *r)
1684	{
1685	if (!r->in.domain_name) {
1686	libnet_join_set_error_string(mem_ctx, r,
1687	"No domain name defined");
1688	return WERR_INVALID_PARAM;
1689	}
1690
1691	if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1692	&r->in.domain_name,
1693	&r->in.dc_name)) {
1694	libnet_join_set_error_string(mem_ctx, r,
1695	"Failed to parse domain name");
1696	return WERR_INVALID_PARAM;
1697	}
1698
1699	if (IS_DC) {
1700	return WERR_SETUP_DOMAIN_CONTROLLER;
1701	}
1702
1703	if (!secrets_init()) {
1704	libnet_join_set_error_string(mem_ctx, r,
1705	"Unable to open secrets database");
1706	return WERR_CAN_NOT_COMPLETE;
1707	}
1708
1709	return WERR_OK;
1710	}
1711
1712	/****************************************************************
1713	****************************************************************/
1714
1715	static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1716	{
1717	NTSTATUS status;
1718
1719	/* Try adding dom admins to builtin\admins. Only log failures. */
1720	status = create_builtin_administrators(domain_sid);
1721	if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1722	DEBUG(10,("Unable to auto-add domain administrators to "
1723	"BUILTIN\\Administrators during join because "
1724	"winbindd must be running."));
1725	} else if (!NT_STATUS_IS_OK(status)) {
1726	DEBUG(5, ("Failed to auto-add domain administrators to "
1727	"BUILTIN\\Administrators during join: %s\n",
1728	nt_errstr(status)));
1729	}
1730
1731	/* Try adding dom users to builtin\users. Only log failures. */
1732	status = create_builtin_users(domain_sid);
1733	if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1734	DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1735	"during join because winbindd must be running."));
1736	} else if (!NT_STATUS_IS_OK(status)) {
1737	DEBUG(5, ("Failed to auto-add domain administrators to "
1738	"BUILTIN\\Administrators during join: %s\n",
1739	nt_errstr(status)));
1740	}
1741	}
1742
1743	/****************************************************************
1744	****************************************************************/
1745
1746	static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1747	struct libnet_JoinCtx *r)
1748	{
1749	WERROR werr;
1750
1751	if (!W_ERROR_IS_OK(r->out.result)) {
1752	return r->out.result;
1753	}
1754
1755	werr = do_JoinConfig(r);
1756	if (!W_ERROR_IS_OK(werr)) {
1757	return werr;
1758	}
1759
1760	if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1761	return WERR_OK;
1762	}
1763
1764	saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1765	if (r->out.dns_domain_name) {
1766	saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1767	}
1768
1769	#ifdef HAVE_ADS
1770	if (r->out.domain_is_ad &&
1771	!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1772	ADS_STATUS ads_status;
1773
1774	ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1775	if (!ADS_ERR_OK(ads_status)) {
1776	return WERR_GENERAL_FAILURE;
1777	}
1778	}
1779	#endif /* HAVE_ADS */
1780
1781	libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1782
1783	return WERR_OK;
1784	}
1785
1786	/****************************************************************
1787	****************************************************************/
1788
1789	static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1790	{
1791	if (r->in.ads) {
1792	ads_destroy(&r->in.ads);
1793	}
1794
1795	return 0;
1796	}
1797
1798	/****************************************************************
1799	****************************************************************/
1800
1801	static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1802	{
1803	if (r->in.ads) {
1804	ads_destroy(&r->in.ads);
1805	}
1806
1807	return 0;
1808	}
1809
1810	/****************************************************************
1811	****************************************************************/
1812
1813	WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1814	struct libnet_JoinCtx **r)
1815	{
1816	struct libnet_JoinCtx *ctx;
1817
1818	ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1819	if (!ctx) {
1820	return WERR_NOMEM;
1821	}
1822
1823	talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1824
1825	ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1826	W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1827
1828	ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1829
1830	*r = ctx;
1831
1832	return WERR_OK;
1833	}
1834
1835	/****************************************************************
1836	****************************************************************/
1837
1838	WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1839	struct libnet_UnjoinCtx **r)
1840	{
1841	struct libnet_UnjoinCtx *ctx;
1842
1843	ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1844	if (!ctx) {
1845	return WERR_NOMEM;
1846	}
1847
1848	talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1849
1850	ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1851	W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1852
1853	*r = ctx;
1854
1855	return WERR_OK;
1856	}
1857
1858	/****************************************************************
1859	****************************************************************/
1860
1861	static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1862	struct libnet_JoinCtx *r)
1863	{
1864	bool valid_security = false;
1865	bool valid_workgroup = false;
1866	bool valid_realm = false;
1867
1868	/* check if configuration is already set correctly */
1869
1870	valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1871
1872	switch (r->out.domain_is_ad) {
1873	case false:
1874	valid_security = (lp_security() == SEC_DOMAIN);
1875	if (valid_workgroup && valid_security) {
1876	/* nothing to be done */
1877	return WERR_OK;
1878	}
1879	break;
1880	case true:
1881	valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1882	switch (lp_security()) {
1883	case SEC_DOMAIN:
1884	case SEC_ADS:
1885	valid_security = true;
1886	}
1887
1888	if (valid_workgroup && valid_realm && valid_security) {
1889	/* nothing to be done */
1890	return WERR_OK;
1891	}
1892	break;
1893	}
1894
1895	/* check if we are supposed to manipulate configuration */
1896
1897	if (!r->in.modify_config) {
1898
1899	char *wrong_conf = talloc_strdup(mem_ctx, "");
1900
1901	if (!valid_workgroup) {
1902	wrong_conf = talloc_asprintf_append(wrong_conf,
1903	"\"workgroup\" set to '%s', should be '%s'",
1904	lp_workgroup(), r->out.netbios_domain_name);
1905	W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1906	}
1907
1908	if (!valid_realm) {
1909	wrong_conf = talloc_asprintf_append(wrong_conf,
1910	"\"realm\" set to '%s', should be '%s'",
1911	lp_realm(), r->out.dns_domain_name);
1912	W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1913	}
1914
1915	if (!valid_security) {
1916	const char *sec = NULL;
1917	switch (lp_security()) {
1918	case SEC_SHARE: sec = "share"; break;
1919	case SEC_USER: sec = "user"; break;
1920	case SEC_DOMAIN: sec = "domain"; break;
1921	case SEC_ADS: sec = "ads"; break;
1922	}
1923	wrong_conf = talloc_asprintf_append(wrong_conf,
1924	"\"security\" set to '%s', should be %s",
1925	sec, r->out.domain_is_ad ?
1926	"either 'domain' or 'ads'" : "'domain'");
1927	W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1928	}
1929
1930	libnet_join_set_error_string(mem_ctx, r,
1931	"Invalid configuration (%s) and configuration modification "
1932	"was not requested", wrong_conf);
1933	return WERR_CAN_NOT_COMPLETE;
1934	}
1935
1936	/* check if we are able to manipulate configuration */
1937
1938	if (!lp_config_backend_is_registry()) {
1939	libnet_join_set_error_string(mem_ctx, r,
1940	"Configuration manipulation requested but not "
1941	"supported by backend");
1942	return WERR_NOT_SUPPORTED;
1943	}
1944
1945	return WERR_OK;
1946	}
1947
1948	/****************************************************************
1949	****************************************************************/
1950
1951	static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1952	struct libnet_JoinCtx *r)
1953	{
1954	NTSTATUS status;
1955	WERROR werr;
1956	struct cli_state *cli = NULL;
1957	#ifdef HAVE_ADS
1958	ADS_STATUS ads_status;
1959	#endif /* HAVE_ADS */
1960
1961	if (!r->in.dc_name) {
1962	struct netr_DsRGetDCNameInfo *info;
1963	const char *dc;
1964	status = dsgetdcname(mem_ctx,
1965	r->in.msg_ctx,
1966	r->in.domain_name,
1967	NULL,
1968	NULL,
1969	DS_FORCE_REDISCOVERY \|
1970	DS_DIRECTORY_SERVICE_REQUIRED \|
1971	DS_WRITABLE_REQUIRED \|
1972	DS_RETURN_DNS_NAME,
1973	&info);
1974	if (!NT_STATUS_IS_OK(status)) {
1975	libnet_join_set_error_string(mem_ctx, r,
1976	"failed to find DC for domain %s",
1977	r->in.domain_name,
1978	get_friendly_nt_error_msg(status));
1979	return WERR_DCNOTFOUND;
1980	}
1981
1982	dc = strip_hostname(info->dc_unc);
1983	r->in.dc_name = talloc_strdup(mem_ctx, dc);
1984	W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1985	}
1986
1987	status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1988	if (!NT_STATUS_IS_OK(status)) {
1989	libnet_join_set_error_string(mem_ctx, r,
1990	"failed to lookup DC info for domain '%s' over rpc: %s",
1991	r->in.domain_name, get_friendly_nt_error_msg(status));
1992	return ntstatus_to_werror(status);
1993	}
1994
1995	werr = libnet_join_check_config(mem_ctx, r);
1996	if (!W_ERROR_IS_OK(werr)) {
1997	goto done;
1998	}
1999
2000	#ifdef HAVE_ADS
2001
2002	create_local_private_krb5_conf_for_domain(
2003	r->out.dns_domain_name, r->out.netbios_domain_name,
2004	NULL, &cli->dest_ss, cli->desthost);
2005
2006	if (r->out.domain_is_ad && r->in.account_ou &&
2007	!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2008
2009	ads_status = libnet_join_connect_ads(mem_ctx, r);
2010	if (!ADS_ERR_OK(ads_status)) {
2011	return WERR_DEFAULT_JOIN_REQUIRED;
2012	}
2013
2014	ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
2015	if (!ADS_ERR_OK(ads_status)) {
2016	libnet_join_set_error_string(mem_ctx, r,
2017	"failed to precreate account in ou %s: %s",
2018	r->in.account_ou,
2019	ads_errstr(ads_status));
2020	return WERR_DEFAULT_JOIN_REQUIRED;
2021	}
2022
2023	r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
2024	}
2025	#endif /* HAVE_ADS */
2026
2027	if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2028	(r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2029	status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2030	} else {
2031	status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2032	}
2033	if (!NT_STATUS_IS_OK(status)) {
2034	libnet_join_set_error_string(mem_ctx, r,
2035	"failed to join domain '%s' over rpc: %s",
2036	r->in.domain_name, get_friendly_nt_error_msg(status));
2037	if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2038	return WERR_SETUP_ALREADY_JOINED;
2039	}
2040	werr = ntstatus_to_werror(status);
2041	goto done;
2042	}
2043
2044	if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2045	werr = WERR_SETUP_NOT_JOINED;
2046	goto done;
2047	}
2048
2049	werr = WERR_OK;
2050
2051	done:
2052	if (cli) {
2053	cli_shutdown(cli);
2054	}
2055
2056	return werr;
2057	}
2058
2059	/****************************************************************
2060	****************************************************************/
2061
2062	static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2063	struct libnet_JoinCtx *r)
2064	{
2065	WERROR werr;
2066	struct libnet_UnjoinCtx *u = NULL;
2067
2068	werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2069	if (!W_ERROR_IS_OK(werr)) {
2070	return werr;
2071	}
2072
2073	u->in.debug = r->in.debug;
2074	u->in.dc_name = r->in.dc_name;
2075	u->in.domain_name = r->in.domain_name;
2076	u->in.admin_account = r->in.admin_account;
2077	u->in.admin_password = r->in.admin_password;
2078	u->in.modify_config = r->in.modify_config;
2079	u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE \|
2080	WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2081
2082	werr = libnet_Unjoin(mem_ctx, u);
2083	TALLOC_FREE(u);
2084
2085	return werr;
2086	}
2087
2088	/****************************************************************
2089	****************************************************************/
2090
2091	WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2092	struct libnet_JoinCtx *r)
2093	{
2094	WERROR werr;
2095
2096	if (r->in.debug) {
2097	LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2098	}
2099
2100	ZERO_STRUCT(r->out);
2101
2102	werr = libnet_join_pre_processing(mem_ctx, r);
2103	if (!W_ERROR_IS_OK(werr)) {
2104	goto done;
2105	}
2106
2107	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2108	werr = libnet_DomainJoin(mem_ctx, r);
2109	if (!W_ERROR_IS_OK(werr)) {
2110	goto done;
2111	}
2112	}
2113
2114	werr = libnet_join_post_processing(mem_ctx, r);
2115	if (!W_ERROR_IS_OK(werr)) {
2116	goto done;
2117	}
2118
2119	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2120	werr = libnet_join_post_verify(mem_ctx, r);
2121	if (!W_ERROR_IS_OK(werr)) {
2122	libnet_join_rollback(mem_ctx, r);
2123	}
2124	}
2125
2126	done:
2127	r->out.result = werr;
2128
2129	if (r->in.debug) {
2130	LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2131	}
2132	return werr;
2133	}
2134
2135	/****************************************************************
2136	****************************************************************/
2137
2138	static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2139	struct libnet_UnjoinCtx *r)
2140	{
2141	NTSTATUS status;
2142
2143	if (!r->in.domain_sid) {
2144	struct dom_sid sid;
2145	if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2146	libnet_unjoin_set_error_string(mem_ctx, r,
2147	"Unable to fetch domain sid: are we joined?");
2148	return WERR_SETUP_NOT_JOINED;
2149	}
2150	r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2151	W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2152	}
2153
2154	if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2155	!r->in.delete_machine_account) {
2156	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2157	return WERR_OK;
2158	}
2159
2160	if (!r->in.dc_name) {
2161	struct netr_DsRGetDCNameInfo *info;
2162	const char *dc;
2163	status = dsgetdcname(mem_ctx,
2164	r->in.msg_ctx,
2165	r->in.domain_name,
2166	NULL,
2167	NULL,
2168	DS_DIRECTORY_SERVICE_REQUIRED \|
2169	DS_WRITABLE_REQUIRED \|
2170	DS_RETURN_DNS_NAME,
2171	&info);
2172	if (!NT_STATUS_IS_OK(status)) {
2173	libnet_unjoin_set_error_string(mem_ctx, r,
2174	"failed to find DC for domain %s",
2175	r->in.domain_name,
2176	get_friendly_nt_error_msg(status));
2177	return WERR_DCNOTFOUND;
2178	}
2179
2180	dc = strip_hostname(info->dc_unc);
2181	r->in.dc_name = talloc_strdup(mem_ctx, dc);
2182	W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2183	}
2184
2185	#ifdef HAVE_ADS
2186	/* for net ads leave, try to delete the account. If it works,
2187	no sense in disabling. If it fails, we can still try to
2188	disable it. jmcd */
2189
2190	if (r->in.delete_machine_account) {
2191	ADS_STATUS ads_status;
2192	ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2193	if (ADS_ERR_OK(ads_status)) {
2194	/* dirty hack */
2195	r->out.dns_domain_name =
2196	talloc_strdup(mem_ctx,
2197	r->in.ads->server.realm);
2198	ads_status =
2199	libnet_unjoin_remove_machine_acct(mem_ctx, r);
2200	}
2201	if (!ADS_ERR_OK(ads_status)) {
2202	libnet_unjoin_set_error_string(mem_ctx, r,
2203	"failed to remove machine account from AD: %s",
2204	ads_errstr(ads_status));
2205	} else {
2206	r->out.deleted_machine_account = true;
2207	W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2208	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2209	return WERR_OK;
2210	}
2211	}
2212	#endif /* HAVE_ADS */
2213
2214	/* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2215	"disable". */
2216	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2217	status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2218	if (!NT_STATUS_IS_OK(status)) {
2219	libnet_unjoin_set_error_string(mem_ctx, r,
2220	"failed to disable machine account via rpc: %s",
2221	get_friendly_nt_error_msg(status));
2222	if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2223	return WERR_SETUP_NOT_JOINED;
2224	}
2225	return ntstatus_to_werror(status);
2226	}
2227
2228	r->out.disabled_machine_account = true;
2229	}
2230
2231	/* If disable succeeded or was not requested at all, we
2232	should be getting rid of our end of things */
2233
2234	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2235
2236	return WERR_OK;
2237	}
2238
2239	/****************************************************************
2240	****************************************************************/
2241
2242	static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2243	struct libnet_UnjoinCtx *r)
2244	{
2245	if (!r->in.domain_name) {
2246	libnet_unjoin_set_error_string(mem_ctx, r,
2247	"No domain name defined");
2248	return WERR_INVALID_PARAM;
2249	}
2250
2251	if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2252	&r->in.domain_name,
2253	&r->in.dc_name)) {
2254	libnet_unjoin_set_error_string(mem_ctx, r,
2255	"Failed to parse domain name");
2256	return WERR_INVALID_PARAM;
2257	}
2258
2259	if (IS_DC) {
2260	return WERR_SETUP_DOMAIN_CONTROLLER;
2261	}
2262
2263	if (!secrets_init()) {
2264	libnet_unjoin_set_error_string(mem_ctx, r,
2265	"Unable to open secrets database");
2266	return WERR_CAN_NOT_COMPLETE;
2267	}
2268
2269	return WERR_OK;
2270	}
2271
2272	/****************************************************************
2273	****************************************************************/
2274
2275	static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2276	struct libnet_UnjoinCtx *r)
2277	{
2278	saf_delete(r->out.netbios_domain_name);
2279	saf_delete(r->out.dns_domain_name);
2280
2281	return libnet_unjoin_config(r);
2282	}
2283
2284	/****************************************************************
2285	****************************************************************/
2286
2287	WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2288	struct libnet_UnjoinCtx *r)
2289	{
2290	WERROR werr;
2291
2292	if (r->in.debug) {
2293	LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2294	}
2295
2296	werr = libnet_unjoin_pre_processing(mem_ctx, r);
2297	if (!W_ERROR_IS_OK(werr)) {
2298	goto done;
2299	}
2300
2301	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2302	werr = libnet_DomainUnjoin(mem_ctx, r);
2303	if (!W_ERROR_IS_OK(werr)) {
2304	libnet_unjoin_config(r);
2305	goto done;
2306	}
2307	}
2308
2309	werr = libnet_unjoin_post_processing(mem_ctx, r);
2310	if (!W_ERROR_IS_OK(werr)) {
2311	goto done;
2312	}
2313
2314	done:
2315	r->out.result = werr;
2316
2317	if (r->in.debug) {
2318	LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2319	}
2320
2321	return werr;
2322	}

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: trunk/server/source3/libnet/libnet_join.c

Download in other formats: