Context Navigation

source: trunk/server/source3/libnet/libnet_join.c@ 751

Visit:

Last change on this file since 751 was 751, checked in by Silvan Scherrer, 13 years ago
Samba Server: updated trunk to 3.6.9
File size: 57.4 KB

Line
1	/*
2	* Unix SMB/CIFS implementation.
3	* libnet Join Support
4	* Copyright (C) Gerald (Jerry) Carter 2006
5	* Copyright (C) Guenther Deschner 2007-2008
6	*
7	* This program is free software; you can redistribute it and/or modify
8	* it under the terms of the GNU General Public License as published by
9	* the Free Software Foundation; either version 3 of the License, or
10	* (at your option) any later version.
11	*
12	* This program is distributed in the hope that it will be useful,
13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	* GNU General Public License for more details.
16	*
17	* You should have received a copy of the GNU General Public License
18	* along with this program; if not, see <http://www.gnu.org/licenses/>.
19	*/
20
21	#include "includes.h"
22	#include "ads.h"
23	#include "librpc/gen_ndr/ndr_libnet_join.h"
24	#include "libnet/libnet_join.h"
25	#include "libcli/auth/libcli_auth.h"
26	#include "../librpc/gen_ndr/ndr_samr_c.h"
27	#include "rpc_client/init_samr.h"
28	#include "../librpc/gen_ndr/ndr_lsa_c.h"
29	#include "rpc_client/cli_lsarpc.h"
30	#include "../librpc/gen_ndr/ndr_netlogon.h"
31	#include "rpc_client/cli_netlogon.h"
32	#include "lib/smbconf/smbconf.h"
33	#include "lib/smbconf/smbconf_reg.h"
34	#include "../libds/common/flags.h"
35	#include "secrets.h"
36	#include "rpc_client/init_lsa.h"
37	#include "rpc_client/cli_pipe.h"
38	#include "../libcli/security/security.h"
39	#include "passdb.h"
40	#include "libsmb/libsmb.h"
41
42	/****************************************************************
43	****************************************************************/
44
45	#define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
46	do { \
47	char *str = NULL; \
48	str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
49	DEBUG(1,("libnet_Join:\n%s", str)); \
50	TALLOC_FREE(str); \
51	} while (0)
52
53	#define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
54	LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN \| NDR_SET_VALUES)
55	#define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
56	LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
57
58	#define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
59	do { \
60	char *str = NULL; \
61	str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
62	DEBUG(1,("libnet_Unjoin:\n%s", str)); \
63	TALLOC_FREE(str); \
64	} while (0)
65
66	#define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
67	LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN \| NDR_SET_VALUES)
68	#define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
69	LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
70
71	/****************************************************************
72	****************************************************************/
73
74	static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
75	struct libnet_JoinCtx *r,
76	const char *format, ...)
77	{
78	va_list args;
79
80	if (r->out.error_string) {
81	return;
82	}
83
84	va_start(args, format);
85	r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
86	va_end(args);
87	}
88
89	/****************************************************************
90	****************************************************************/
91
92	static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
93	struct libnet_UnjoinCtx *r,
94	const char *format, ...)
95	{
96	va_list args;
97
98	if (r->out.error_string) {
99	return;
100	}
101
102	va_start(args, format);
103	r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
104	va_end(args);
105	}
106
107	#ifdef HAVE_ADS
108
109	/****************************************************************
110	****************************************************************/
111
112	static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
113	const char *netbios_domain_name,
114	const char *dc_name,
115	const char *user_name,
116	const char *password,
117	ADS_STRUCT **ads)
118	{
119	ADS_STATUS status;
120	ADS_STRUCT *my_ads = NULL;
121	char *cp;
122
123	my_ads = ads_init(dns_domain_name,
124	netbios_domain_name,
125	dc_name);
126	if (!my_ads) {
127	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
128	}
129
130	if (user_name) {
131	SAFE_FREE(my_ads->auth.user_name);
132	my_ads->auth.user_name = SMB_STRDUP(user_name);
133	if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
134	*cp++ = '\0';
135	SAFE_FREE(my_ads->auth.realm);
136	my_ads->auth.realm = smb_xstrdup(cp);
137	strupper_m(my_ads->auth.realm);
138	}
139	}
140
141	if (password) {
142	SAFE_FREE(my_ads->auth.password);
143	my_ads->auth.password = SMB_STRDUP(password);
144	}
145
146	status = ads_connect_user_creds(my_ads);
147	if (!ADS_ERR_OK(status)) {
148	ads_destroy(&my_ads);
149	return status;
150	}
151
152	*ads = my_ads;
153	return ADS_SUCCESS;
154	}
155
156	/****************************************************************
157	****************************************************************/
158
159	static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
160	struct libnet_JoinCtx *r)
161	{
162	ADS_STATUS status;
163
164	status = libnet_connect_ads(r->out.dns_domain_name,
165	r->out.netbios_domain_name,
166	r->in.dc_name,
167	r->in.admin_account,
168	r->in.admin_password,
169	&r->in.ads);
170	if (!ADS_ERR_OK(status)) {
171	libnet_join_set_error_string(mem_ctx, r,
172	"failed to connect to AD: %s",
173	ads_errstr(status));
174	return status;
175	}
176
177	if (!r->out.netbios_domain_name) {
178	r->out.netbios_domain_name = talloc_strdup(mem_ctx,
179	r->in.ads->server.workgroup);
180	ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
181	}
182
183	if (!r->out.dns_domain_name) {
184	r->out.dns_domain_name = talloc_strdup(mem_ctx,
185	r->in.ads->config.realm);
186	ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
187	}
188
189	r->out.domain_is_ad = true;
190
191	return ADS_SUCCESS;
192	}
193
194	/****************************************************************
195	****************************************************************/
196
197	static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
198	struct libnet_UnjoinCtx *r)
199	{
200	ADS_STATUS status;
201
202	status = libnet_connect_ads(r->in.domain_name,
203	r->in.domain_name,
204	r->in.dc_name,
205	r->in.admin_account,
206	r->in.admin_password,
207	&r->in.ads);
208	if (!ADS_ERR_OK(status)) {
209	libnet_unjoin_set_error_string(mem_ctx, r,
210	"failed to connect to AD: %s",
211	ads_errstr(status));
212	}
213
214	return status;
215	}
216
217	/****************************************************************
218	join a domain using ADS (LDAP mods)
219	****************************************************************/
220
221	static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
222	struct libnet_JoinCtx *r)
223	{
224	ADS_STATUS status;
225	LDAPMessage *res = NULL;
226	const char *attrs[] = { "dn", NULL };
227	bool moved = false;
228
229	status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
230	if (!ADS_ERR_OK(status)) {
231	return status;
232	}
233
234	status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
235	if (!ADS_ERR_OK(status)) {
236	return status;
237	}
238
239	if (ads_count_replies(r->in.ads, res) != 1) {
240	ads_msgfree(r->in.ads, res);
241	return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
242	}
243
244	ads_msgfree(r->in.ads, res);
245
246	/* Attempt to create the machine account and bail if this fails.
247	Assume that the admin wants exactly what they requested */
248
249	status = ads_create_machine_acct(r->in.ads,
250	r->in.machine_name,
251	r->in.account_ou);
252
253	if (ADS_ERR_OK(status)) {
254	DEBUG(1,("machine account creation created\n"));
255	return status;
256	} else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
257	(status.err.rc == LDAP_ALREADY_EXISTS)) {
258	status = ADS_SUCCESS;
259	}
260
261	if (!ADS_ERR_OK(status)) {
262	DEBUG(1,("machine account creation failed\n"));
263	return status;
264	}
265
266	status = ads_move_machine_acct(r->in.ads,
267	r->in.machine_name,
268	r->in.account_ou,
269	&moved);
270	if (!ADS_ERR_OK(status)) {
271	DEBUG(1,("failure to locate/move pre-existing "
272	"machine account\n"));
273	return status;
274	}
275
276	DEBUG(1,("The machine account %s the specified OU.\n",
277	moved ? "was moved into" : "already exists in"));
278
279	return status;
280	}
281
282	/****************************************************************
283	****************************************************************/
284
285	static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
286	struct libnet_UnjoinCtx *r)
287	{
288	ADS_STATUS status;
289
290	if (!r->in.ads) {
291	status = libnet_unjoin_connect_ads(mem_ctx, r);
292	if (!ADS_ERR_OK(status)) {
293	libnet_unjoin_set_error_string(mem_ctx, r,
294	"failed to connect to AD: %s",
295	ads_errstr(status));
296	return status;
297	}
298	}
299
300	status = ads_leave_realm(r->in.ads, r->in.machine_name);
301	if (!ADS_ERR_OK(status)) {
302	libnet_unjoin_set_error_string(mem_ctx, r,
303	"failed to leave realm: %s",
304	ads_errstr(status));
305	return status;
306	}
307
308	return ADS_SUCCESS;
309	}
310
311	/****************************************************************
312	****************************************************************/
313
314	static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
315	struct libnet_JoinCtx *r)
316	{
317	ADS_STATUS status;
318	LDAPMessage *res = NULL;
319	char *dn = NULL;
320
321	if (!r->in.machine_name) {
322	return ADS_ERROR(LDAP_NO_MEMORY);
323	}
324
325	status = ads_find_machine_acct(r->in.ads,
326	&res,
327	r->in.machine_name);
328	if (!ADS_ERR_OK(status)) {
329	return status;
330	}
331
332	if (ads_count_replies(r->in.ads, res) != 1) {
333	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
334	goto done;
335	}
336
337	dn = ads_get_dn(r->in.ads, mem_ctx, res);
338	if (!dn) {
339	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
340	goto done;
341	}
342
343	r->out.dn = talloc_strdup(mem_ctx, dn);
344	if (!r->out.dn) {
345	status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
346	goto done;
347	}
348
349	done:
350	ads_msgfree(r->in.ads, res);
351	TALLOC_FREE(dn);
352
353	return status;
354	}
355
356	/****************************************************************
357	Set a machines dNSHostName and servicePrincipalName attributes
358	****************************************************************/
359
360	static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
361	struct libnet_JoinCtx *r)
362	{
363	ADS_STATUS status;
364	ADS_MODLIST mods;
365	fstring my_fqdn;
366	const char *spn_array[3] = {NULL, NULL, NULL};
367	char *spn = NULL;
368
369	/* Find our DN */
370
371	status = libnet_join_find_machine_acct(mem_ctx, r);
372	if (!ADS_ERR_OK(status)) {
373	return status;
374	}
375
376	/* Windows only creates HOST/shortname & HOST/fqdn. */
377
378	spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
379	if (!spn) {
380	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
381	}
382	strupper_m(spn);
383	spn_array[0] = spn;
384
385	if (!name_to_fqdn(my_fqdn, r->in.machine_name)
386	\|\| (strchr(my_fqdn, '.') == NULL)) {
387	fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
388	r->out.dns_domain_name);
389	}
390
391	strlower_m(my_fqdn);
392
393	if (!strequal(my_fqdn, r->in.machine_name)) {
394	spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
395	if (!spn) {
396	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
397	}
398	spn_array[1] = spn;
399	}
400
401	mods = ads_init_mods(mem_ctx);
402	if (!mods) {
403	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
404	}
405
406	/* fields of primary importance */
407
408	status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
409	if (!ADS_ERR_OK(status)) {
410	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
411	}
412
413	status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
414	spn_array);
415	if (!ADS_ERR_OK(status)) {
416	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
417	}
418
419	return ads_gen_mod(r->in.ads, r->out.dn, mods);
420	}
421
422	/****************************************************************
423	****************************************************************/
424
425	static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
426	struct libnet_JoinCtx *r)
427	{
428	ADS_STATUS status;
429	ADS_MODLIST mods;
430
431	if (!r->in.create_upn) {
432	return ADS_SUCCESS;
433	}
434
435	/* Find our DN */
436
437	status = libnet_join_find_machine_acct(mem_ctx, r);
438	if (!ADS_ERR_OK(status)) {
439	return status;
440	}
441
442	if (!r->in.upn) {
443	r->in.upn = talloc_asprintf(mem_ctx,
444	"host/%s@%s",
445	r->in.machine_name,
446	r->out.dns_domain_name);
447	if (!r->in.upn) {
448	return ADS_ERROR(LDAP_NO_MEMORY);
449	}
450	}
451
452	/* now do the mods */
453
454	mods = ads_init_mods(mem_ctx);
455	if (!mods) {
456	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
457	}
458
459	/* fields of primary importance */
460
461	status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
462	if (!ADS_ERR_OK(status)) {
463	return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
464	}
465
466	return ads_gen_mod(r->in.ads, r->out.dn, mods);
467	}
468
469
470	/****************************************************************
471	****************************************************************/
472
473	static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
474	struct libnet_JoinCtx *r)
475	{
476	ADS_STATUS status;
477	ADS_MODLIST mods;
478	char *os_sp = NULL;
479
480	if (!r->in.os_name \|\| !r->in.os_version ) {
481	return ADS_SUCCESS;
482	}
483
484	/* Find our DN */
485
486	status = libnet_join_find_machine_acct(mem_ctx, r);
487	if (!ADS_ERR_OK(status)) {
488	return status;
489	}
490
491	/* now do the mods */
492
493	mods = ads_init_mods(mem_ctx);
494	if (!mods) {
495	return ADS_ERROR(LDAP_NO_MEMORY);
496	}
497
498	os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
499	if (!os_sp) {
500	return ADS_ERROR(LDAP_NO_MEMORY);
501	}
502
503	/* fields of primary importance */
504
505	status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
506	r->in.os_name);
507	if (!ADS_ERR_OK(status)) {
508	return status;
509	}
510
511	status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
512	r->in.os_version);
513	if (!ADS_ERR_OK(status)) {
514	return status;
515	}
516
517	status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
518	os_sp);
519	if (!ADS_ERR_OK(status)) {
520	return status;
521	}
522
523	return ads_gen_mod(r->in.ads, r->out.dn, mods);
524	}
525
526	/****************************************************************
527	****************************************************************/
528
529	static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
530	struct libnet_JoinCtx *r)
531	{
532	if (!USE_SYSTEM_KEYTAB) {
533	return true;
534	}
535
536	if (ads_keytab_create_default(r->in.ads) != 0) {
537	return false;
538	}
539
540	return true;
541	}
542
543	/****************************************************************
544	****************************************************************/
545
546	static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
547	struct libnet_JoinCtx *r)
548	{
549	uint32_t domain_func;
550	ADS_STATUS status;
551	const char *salt = NULL;
552	char *std_salt = NULL;
553
554	status = ads_domain_func_level(r->in.ads, &domain_func);
555	if (!ADS_ERR_OK(status)) {
556	libnet_join_set_error_string(mem_ctx, r,
557	"failed to determine domain functional level: %s",
558	ads_errstr(status));
559	return false;
560	}
561
562	/* go ahead and setup the default salt */
563
564	std_salt = kerberos_standard_des_salt();
565	if (!std_salt) {
566	libnet_join_set_error_string(mem_ctx, r,
567	"failed to obtain standard DES salt");
568	return false;
569	}
570
571	salt = talloc_strdup(mem_ctx, std_salt);
572	if (!salt) {
573	return false;
574	}
575
576	SAFE_FREE(std_salt);
577
578	/* if it's a Windows functional domain, we have to look for the UPN */
579
580	if (domain_func == DS_DOMAIN_FUNCTION_2000) {
581	char *upn;
582
583	upn = ads_get_upn(r->in.ads, mem_ctx,
584	r->in.machine_name);
585	if (upn) {
586	salt = talloc_strdup(mem_ctx, upn);
587	if (!salt) {
588	return false;
589	}
590	}
591	}
592
593	return kerberos_secrets_store_des_salt(salt);
594	}
595
596	/****************************************************************
597	****************************************************************/
598
599	static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
600	struct libnet_JoinCtx *r)
601	{
602	ADS_STATUS status;
603
604	if (!r->in.ads) {
605	status = libnet_join_connect_ads(mem_ctx, r);
606	if (!ADS_ERR_OK(status)) {
607	return status;
608	}
609	}
610
611	status = libnet_join_set_machine_spn(mem_ctx, r);
612	if (!ADS_ERR_OK(status)) {
613	libnet_join_set_error_string(mem_ctx, r,
614	"failed to set machine spn: %s",
615	ads_errstr(status));
616	return status;
617	}
618
619	status = libnet_join_set_os_attributes(mem_ctx, r);
620	if (!ADS_ERR_OK(status)) {
621	libnet_join_set_error_string(mem_ctx, r,
622	"failed to set machine os attributes: %s",
623	ads_errstr(status));
624	return status;
625	}
626
627	status = libnet_join_set_machine_upn(mem_ctx, r);
628	if (!ADS_ERR_OK(status)) {
629	libnet_join_set_error_string(mem_ctx, r,
630	"failed to set machine upn: %s",
631	ads_errstr(status));
632	return status;
633	}
634
635	if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
636	return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
637	}
638
639	if (!libnet_join_create_keytab(mem_ctx, r)) {
640	libnet_join_set_error_string(mem_ctx, r,
641	"failed to create kerberos keytab");
642	return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
643	}
644
645	return ADS_SUCCESS;
646	}
647	#endif /* HAVE_ADS */
648
649	/****************************************************************
650	Store the machine password and domain SID
651	****************************************************************/
652
653	static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
654	struct libnet_JoinCtx *r)
655	{
656	if (!secrets_store_domain_sid(r->out.netbios_domain_name,
657	r->out.domain_sid))
658	{
659	DEBUG(1,("Failed to save domain sid\n"));
660	return false;
661	}
662
663	if (!secrets_store_machine_password(r->in.machine_password,
664	r->out.netbios_domain_name,
665	r->in.secure_channel_type))
666	{
667	DEBUG(1,("Failed to save machine password\n"));
668	return false;
669	}
670
671	return true;
672	}
673
674	/****************************************************************
675	Connect dc's IPC$ share
676	****************************************************************/
677
678	static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
679	const char *user,
680	const char *pass,
681	bool use_kerberos,
682	struct cli_state **cli)
683	{
684	int flags = 0;
685
686	if (use_kerberos) {
687	flags \|= CLI_FULL_CONNECTION_USE_KERBEROS;
688	}
689
690	if (use_kerberos && pass) {
691	flags \|= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
692	}
693
694	return cli_full_connection(cli, NULL,
695	dc,
696	NULL, 0,
697	"IPC$", "IPC",
698	user,
699	NULL,
700	pass,
701	flags,
702	Undefined);
703	}
704
705	/****************************************************************
706	Lookup domain dc's info
707	****************************************************************/
708
709	static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
710	struct libnet_JoinCtx *r,
711	struct cli_state **cli)
712	{
713	struct rpc_pipe_client *pipe_hnd = NULL;
714	struct policy_handle lsa_pol;
715	NTSTATUS status, result;
716	union lsa_PolicyInformation *info = NULL;
717	struct dcerpc_binding_handle *b;
718
719	status = libnet_join_connect_dc_ipc(r->in.dc_name,
720	r->in.admin_account,
721	r->in.admin_password,
722	r->in.use_kerberos,
723	cli);
724	if (!NT_STATUS_IS_OK(status)) {
725	goto done;
726	}
727
728	status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
729	&pipe_hnd);
730	if (!NT_STATUS_IS_OK(status)) {
731	DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
732	nt_errstr(status)));
733	goto done;
734	}
735
736	b = pipe_hnd->binding_handle;
737
738	status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
739	SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
740	if (!NT_STATUS_IS_OK(status)) {
741	goto done;
742	}
743
744	status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
745	&lsa_pol,
746	LSA_POLICY_INFO_DNS,
747	&info,
748	&result);
749	if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
750	r->out.domain_is_ad = true;
751	r->out.netbios_domain_name = info->dns.name.string;
752	r->out.dns_domain_name = info->dns.dns_domain.string;
753	r->out.forest_name = info->dns.dns_forest.string;
754	r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
755	NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
756	}
757
758	if (!NT_STATUS_IS_OK(status)) {
759	status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
760	&lsa_pol,
761	LSA_POLICY_INFO_ACCOUNT_DOMAIN,
762	&info,
763	&result);
764	if (!NT_STATUS_IS_OK(status)) {
765	goto done;
766	}
767	if (!NT_STATUS_IS_OK(result)) {
768	status = result;
769	goto done;
770	}
771
772	r->out.netbios_domain_name = info->account_domain.name.string;
773	r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
774	NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
775	}
776
777	dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
778	TALLOC_FREE(pipe_hnd);
779
780	done:
781	return status;
782	}
783
784	/****************************************************************
785	Do the domain join unsecure
786	****************************************************************/
787
788	static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
789	struct libnet_JoinCtx *r,
790	struct cli_state *cli)
791	{
792	struct rpc_pipe_client *pipe_hnd = NULL;
793	unsigned char orig_trust_passwd_hash[16];
794	unsigned char new_trust_passwd_hash[16];
795	fstring trust_passwd;
796	NTSTATUS status;
797
798	status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
799	&pipe_hnd);
800	if (!NT_STATUS_IS_OK(status)) {
801	return status;
802	}
803
804	if (!r->in.machine_password) {
805	r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
806	NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
807	}
808
809	E_md4hash(r->in.machine_password, new_trust_passwd_hash);
810
811	/* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
812	fstrcpy(trust_passwd, r->in.admin_password);
813	strlower_m(trust_passwd);
814
815	/*
816	* Machine names can be 15 characters, but the max length on
817	* a password is 14. --jerry
818	*/
819
820	trust_passwd[14] = '\0';
821
822	E_md4hash(trust_passwd, orig_trust_passwd_hash);
823
824	status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
825	r->in.machine_name,
826	orig_trust_passwd_hash,
827	r->in.machine_password,
828	new_trust_passwd_hash,
829	r->in.secure_channel_type);
830
831	return status;
832	}
833
834	/****************************************************************
835	Do the domain join
836	****************************************************************/
837
838	static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
839	struct libnet_JoinCtx *r,
840	struct cli_state *cli)
841	{
842	struct rpc_pipe_client *pipe_hnd = NULL;
843	struct policy_handle sam_pol, domain_pol, user_pol;
844	NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
845	char *acct_name;
846	struct lsa_String lsa_acct_name;
847	uint32_t user_rid;
848	uint32_t acct_flags = ACB_WSTRUST;
849	struct samr_Ids user_rids;
850	struct samr_Ids name_types;
851	union samr_UserInfo user_info;
852	struct dcerpc_binding_handle *b = NULL;
853
854	struct samr_CryptPassword crypt_pwd;
855	struct samr_CryptPasswordEx crypt_pwd_ex;
856
857	ZERO_STRUCT(sam_pol);
858	ZERO_STRUCT(domain_pol);
859	ZERO_STRUCT(user_pol);
860
861	switch (r->in.secure_channel_type) {
862	case SEC_CHAN_WKSTA:
863	acct_flags = ACB_WSTRUST;
864	break;
865	case SEC_CHAN_BDC:
866	acct_flags = ACB_SVRTRUST;
867	break;
868	default:
869	return NT_STATUS_INVALID_PARAMETER;
870	}
871
872	if (!r->in.machine_password) {
873	r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
874	NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
875	}
876
877	/* Open the domain */
878
879	status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
880	&pipe_hnd);
881	if (!NT_STATUS_IS_OK(status)) {
882	DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
883	nt_errstr(status)));
884	goto done;
885	}
886
887	b = pipe_hnd->binding_handle;
888
889	status = dcerpc_samr_Connect2(b, mem_ctx,
890	pipe_hnd->desthost,
891	SAMR_ACCESS_ENUM_DOMAINS
892	\| SAMR_ACCESS_LOOKUP_DOMAIN,
893	&sam_pol,
894	&result);
895	if (!NT_STATUS_IS_OK(status)) {
896	goto done;
897	}
898	if (!NT_STATUS_IS_OK(result)) {
899	status = result;
900	goto done;
901	}
902
903	status = dcerpc_samr_OpenDomain(b, mem_ctx,
904	&sam_pol,
905	SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
906	\| SAMR_DOMAIN_ACCESS_CREATE_USER
907	\| SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
908	r->out.domain_sid,
909	&domain_pol,
910	&result);
911	if (!NT_STATUS_IS_OK(status)) {
912	goto done;
913	}
914	if (!NT_STATUS_IS_OK(result)) {
915	status = result;
916	goto done;
917	}
918
919	/* Create domain user */
920
921	acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
922	strlower_m(acct_name);
923
924	init_lsa_String(&lsa_acct_name, acct_name);
925
926	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
927	uint32_t access_desired =
928	SEC_GENERIC_READ \| SEC_GENERIC_WRITE \| SEC_GENERIC_EXECUTE \|
929	SEC_STD_WRITE_DAC \| SEC_STD_DELETE \|
930	SAMR_USER_ACCESS_SET_PASSWORD \|
931	SAMR_USER_ACCESS_GET_ATTRIBUTES \|
932	SAMR_USER_ACCESS_SET_ATTRIBUTES;
933	uint32_t access_granted = 0;
934
935	DEBUG(10,("Creating account with desired access mask: %d\n",
936	access_desired));
937
938	status = dcerpc_samr_CreateUser2(b, mem_ctx,
939	&domain_pol,
940	&lsa_acct_name,
941	acct_flags,
942	access_desired,
943	&user_pol,
944	&access_granted,
945	&user_rid,
946	&result);
947	if (!NT_STATUS_IS_OK(status)) {
948	goto done;
949	}
950
951	status = result;
952	if (!NT_STATUS_IS_OK(status) &&
953	!NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
954
955	DEBUG(10,("Creation of workstation account failed: %s\n",
956	nt_errstr(status)));
957
958	/* If NT_STATUS_ACCESS_DENIED then we have a valid
959	username/password combo but the user does not have
960	administrator access. */
961
962	if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
963	libnet_join_set_error_string(mem_ctx, r,
964	"User specified does not have "
965	"administrator privileges");
966	}
967
968	goto done;
969	}
970
971	if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
972	if (!(r->in.join_flags &
973	WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
974	goto done;
975	}
976	}
977
978	/* We must do this.... don't ask... */
979
980	if (NT_STATUS_IS_OK(status)) {
981	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
982	}
983	}
984
985	status = dcerpc_samr_LookupNames(b, mem_ctx,
986	&domain_pol,
987	1,
988	&lsa_acct_name,
989	&user_rids,
990	&name_types,
991	&result);
992	if (!NT_STATUS_IS_OK(status)) {
993	goto done;
994	}
995	if (!NT_STATUS_IS_OK(result)) {
996	status = result;
997	goto done;
998	}
999
1000	if (name_types.ids[0] != SID_NAME_USER) {
1001	DEBUG(0,("%s is not a user account (type=%d)\n",
1002	acct_name, name_types.ids[0]));
1003	status = NT_STATUS_INVALID_WORKSTATION;
1004	goto done;
1005	}
1006
1007	user_rid = user_rids.ids[0];
1008
1009	/* Open handle on user */
1010
1011	status = dcerpc_samr_OpenUser(b, mem_ctx,
1012	&domain_pol,
1013	SEC_FLAG_MAXIMUM_ALLOWED,
1014	user_rid,
1015	&user_pol,
1016	&result);
1017	if (!NT_STATUS_IS_OK(status)) {
1018	goto done;
1019	}
1020	if (!NT_STATUS_IS_OK(result)) {
1021	status = result;
1022	goto done;
1023	}
1024
1025	/* Fill in the additional account flags now */
1026
1027	acct_flags \|= ACB_PWNOEXP;
1028
1029	/* Set account flags on machine account */
1030	ZERO_STRUCT(user_info.info16);
1031	user_info.info16.acct_flags = acct_flags;
1032
1033	status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1034	&user_pol,
1035	16,
1036	&user_info,
1037	&result);
1038	if (!NT_STATUS_IS_OK(status)) {
1039	dcerpc_samr_DeleteUser(b, mem_ctx,
1040	&user_pol,
1041	&result);
1042
1043	libnet_join_set_error_string(mem_ctx, r,
1044	"Failed to set account flags for machine account (%s)\n",
1045	nt_errstr(status));
1046	goto done;
1047	}
1048
1049	if (!NT_STATUS_IS_OK(result)) {
1050	status = result;
1051
1052	dcerpc_samr_DeleteUser(b, mem_ctx,
1053	&user_pol,
1054	&result);
1055
1056	libnet_join_set_error_string(mem_ctx, r,
1057	"Failed to set account flags for machine account (%s)\n",
1058	nt_errstr(status));
1059	goto done;
1060	}
1061
1062	/* Set password on machine account - first try level 26 */
1063
1064	init_samr_CryptPasswordEx(r->in.machine_password,
1065	&cli->user_session_key,
1066	&crypt_pwd_ex);
1067
1068	user_info.info26.password = crypt_pwd_ex;
1069	user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1070
1071	status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1072	&user_pol,
1073	26,
1074	&user_info,
1075	&result);
1076
1077	if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1078
1079	/* retry with level 24 */
1080
1081	init_samr_CryptPassword(r->in.machine_password,
1082	&cli->user_session_key,
1083	&crypt_pwd);
1084
1085	user_info.info24.password = crypt_pwd;
1086	user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1087
1088	status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1089	&user_pol,
1090	24,
1091	&user_info,
1092	&result);
1093	}
1094
1095	if (!NT_STATUS_IS_OK(status)) {
1096
1097	dcerpc_samr_DeleteUser(b, mem_ctx,
1098	&user_pol,
1099	&result);
1100
1101	libnet_join_set_error_string(mem_ctx, r,
1102	"Failed to set password for machine account (%s)\n",
1103	nt_errstr(status));
1104	goto done;
1105	}
1106	if (!NT_STATUS_IS_OK(result)) {
1107	status = result;
1108
1109	dcerpc_samr_DeleteUser(b, mem_ctx,
1110	&user_pol,
1111	&result);
1112
1113	libnet_join_set_error_string(mem_ctx, r,
1114	"Failed to set password for machine account (%s)\n",
1115	nt_errstr(status));
1116	goto done;
1117	}
1118
1119	status = NT_STATUS_OK;
1120
1121	done:
1122	if (!pipe_hnd) {
1123	return status;
1124	}
1125
1126	if (is_valid_policy_hnd(&sam_pol)) {
1127	dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1128	}
1129	if (is_valid_policy_hnd(&domain_pol)) {
1130	dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1131	}
1132	if (is_valid_policy_hnd(&user_pol)) {
1133	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1134	}
1135	TALLOC_FREE(pipe_hnd);
1136
1137	return status;
1138	}
1139
1140	/****************************************************************
1141	****************************************************************/
1142
1143	NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1144	const char *machine_name,
1145	const char *dc_name)
1146	{
1147	uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1148	struct cli_state *cli = NULL;
1149	struct rpc_pipe_client *pipe_hnd = NULL;
1150	struct rpc_pipe_client *netlogon_pipe = NULL;
1151	NTSTATUS status;
1152	char *machine_password = NULL;
1153	char *machine_account = NULL;
1154
1155	if (!dc_name) {
1156	return NT_STATUS_INVALID_PARAMETER;
1157	}
1158
1159	if (!secrets_init()) {
1160	return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1161	}
1162
1163	machine_password = secrets_fetch_machine_password(netbios_domain_name,
1164	NULL, NULL);
1165	if (!machine_password) {
1166	return NT_STATUS_NO_TRUST_LSA_SECRET;
1167	}
1168
1169	if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1170	SAFE_FREE(machine_password);
1171	return NT_STATUS_NO_MEMORY;
1172	}
1173
1174	status = cli_full_connection(&cli, NULL,
1175	dc_name,
1176	NULL, 0,
1177	"IPC$", "IPC",
1178	machine_account,
1179	NULL,
1180	machine_password,
1181	0,
1182	Undefined);
1183	free(machine_account);
1184	free(machine_password);
1185
1186	if (!NT_STATUS_IS_OK(status)) {
1187	status = cli_full_connection(&cli, NULL,
1188	dc_name,
1189	NULL, 0,
1190	"IPC$", "IPC",
1191	"",
1192	NULL,
1193	"",
1194	0,
1195	Undefined);
1196	}
1197
1198	if (!NT_STATUS_IS_OK(status)) {
1199	return status;
1200	}
1201
1202	status = get_schannel_session_key(cli, netbios_domain_name,
1203	&neg_flags, &netlogon_pipe);
1204	if (!NT_STATUS_IS_OK(status)) {
1205	if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1206	cli_shutdown(cli);
1207	return NT_STATUS_OK;
1208	}
1209
1210	DEBUG(0,("libnet_join_ok: failed to get schannel session "
1211	"key from server %s for domain %s. Error was %s\n",
1212	cli->desthost, netbios_domain_name, nt_errstr(status)));
1213	cli_shutdown(cli);
1214	return status;
1215	}
1216
1217	if (!lp_client_schannel()) {
1218	cli_shutdown(cli);
1219	return NT_STATUS_OK;
1220	}
1221
1222	status = cli_rpc_pipe_open_schannel_with_key(
1223	cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1224	DCERPC_AUTH_LEVEL_PRIVACY,
1225	netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1226
1227	cli_shutdown(cli);
1228
1229	if (!NT_STATUS_IS_OK(status)) {
1230	DEBUG(0,("libnet_join_ok: failed to open schannel session "
1231	"on netlogon pipe to server %s for domain %s. "
1232	"Error was %s\n",
1233	cli->desthost, netbios_domain_name, nt_errstr(status)));
1234	return status;
1235	}
1236
1237	return NT_STATUS_OK;
1238	}
1239
1240	/****************************************************************
1241	****************************************************************/
1242
1243	static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1244	struct libnet_JoinCtx *r)
1245	{
1246	NTSTATUS status;
1247
1248	status = libnet_join_ok(r->out.netbios_domain_name,
1249	r->in.machine_name,
1250	r->in.dc_name);
1251	if (!NT_STATUS_IS_OK(status)) {
1252	libnet_join_set_error_string(mem_ctx, r,
1253	"failed to verify domain membership after joining: %s",
1254	get_friendly_nt_error_msg(status));
1255	return WERR_SETUP_NOT_JOINED;
1256	}
1257
1258	return WERR_OK;
1259	}
1260
1261	/****************************************************************
1262	****************************************************************/
1263
1264	static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1265	struct libnet_UnjoinCtx *r)
1266	{
1267	if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1268	return false;
1269	}
1270
1271	if (!secrets_delete_domain_sid(lp_workgroup())) {
1272	return false;
1273	}
1274
1275	return true;
1276	}
1277
1278	/****************************************************************
1279	****************************************************************/
1280
1281	static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1282	struct libnet_UnjoinCtx *r)
1283	{
1284	struct cli_state *cli = NULL;
1285	struct rpc_pipe_client *pipe_hnd = NULL;
1286	struct policy_handle sam_pol, domain_pol, user_pol;
1287	NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1288	char *acct_name;
1289	uint32_t user_rid;
1290	struct lsa_String lsa_acct_name;
1291	struct samr_Ids user_rids;
1292	struct samr_Ids name_types;
1293	union samr_UserInfo *info = NULL;
1294	struct dcerpc_binding_handle *b = NULL;
1295
1296	ZERO_STRUCT(sam_pol);
1297	ZERO_STRUCT(domain_pol);
1298	ZERO_STRUCT(user_pol);
1299
1300	status = libnet_join_connect_dc_ipc(r->in.dc_name,
1301	r->in.admin_account,
1302	r->in.admin_password,
1303	r->in.use_kerberos,
1304	&cli);
1305	if (!NT_STATUS_IS_OK(status)) {
1306	goto done;
1307	}
1308
1309	/* Open the domain */
1310
1311	status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1312	&pipe_hnd);
1313	if (!NT_STATUS_IS_OK(status)) {
1314	DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1315	nt_errstr(status)));
1316	goto done;
1317	}
1318
1319	b = pipe_hnd->binding_handle;
1320
1321	status = dcerpc_samr_Connect2(b, mem_ctx,
1322	pipe_hnd->desthost,
1323	SEC_FLAG_MAXIMUM_ALLOWED,
1324	&sam_pol,
1325	&result);
1326	if (!NT_STATUS_IS_OK(status)) {
1327	goto done;
1328	}
1329	if (!NT_STATUS_IS_OK(result)) {
1330	status = result;
1331	goto done;
1332	}
1333
1334	status = dcerpc_samr_OpenDomain(b, mem_ctx,
1335	&sam_pol,
1336	SEC_FLAG_MAXIMUM_ALLOWED,
1337	r->in.domain_sid,
1338	&domain_pol,
1339	&result);
1340	if (!NT_STATUS_IS_OK(status)) {
1341	goto done;
1342	}
1343	if (!NT_STATUS_IS_OK(result)) {
1344	status = result;
1345	goto done;
1346	}
1347
1348	/* Create domain user */
1349
1350	acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1351	strlower_m(acct_name);
1352
1353	init_lsa_String(&lsa_acct_name, acct_name);
1354
1355	status = dcerpc_samr_LookupNames(b, mem_ctx,
1356	&domain_pol,
1357	1,
1358	&lsa_acct_name,
1359	&user_rids,
1360	&name_types,
1361	&result);
1362
1363	if (!NT_STATUS_IS_OK(status)) {
1364	goto done;
1365	}
1366	if (!NT_STATUS_IS_OK(result)) {
1367	status = result;
1368	goto done;
1369	}
1370
1371	if (name_types.ids[0] != SID_NAME_USER) {
1372	DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1373	name_types.ids[0]));
1374	status = NT_STATUS_INVALID_WORKSTATION;
1375	goto done;
1376	}
1377
1378	user_rid = user_rids.ids[0];
1379
1380	/* Open handle on user */
1381
1382	status = dcerpc_samr_OpenUser(b, mem_ctx,
1383	&domain_pol,
1384	SEC_FLAG_MAXIMUM_ALLOWED,
1385	user_rid,
1386	&user_pol,
1387	&result);
1388	if (!NT_STATUS_IS_OK(status)) {
1389	goto done;
1390	}
1391	if (!NT_STATUS_IS_OK(result)) {
1392	status = result;
1393	goto done;
1394	}
1395
1396	/* Get user info */
1397
1398	status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1399	&user_pol,
1400	16,
1401	&info,
1402	&result);
1403	if (!NT_STATUS_IS_OK(status)) {
1404	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1405	goto done;
1406	}
1407	if (!NT_STATUS_IS_OK(result)) {
1408	status = result;
1409	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1410	goto done;
1411	}
1412
1413	/* now disable and setuser info */
1414
1415	info->info16.acct_flags \|= ACB_DISABLED;
1416
1417	status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1418	&user_pol,
1419	16,
1420	info,
1421	&result);
1422	if (!NT_STATUS_IS_OK(status)) {
1423	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1424	goto done;
1425	}
1426	if (!NT_STATUS_IS_OK(result)) {
1427	status = result;
1428	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1429	goto done;
1430	}
1431	status = result;
1432	dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1433
1434	done:
1435	if (pipe_hnd && b) {
1436	if (is_valid_policy_hnd(&domain_pol)) {
1437	dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1438	}
1439	if (is_valid_policy_hnd(&sam_pol)) {
1440	dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1441	}
1442	TALLOC_FREE(pipe_hnd);
1443	}
1444
1445	if (cli) {
1446	cli_shutdown(cli);
1447	}
1448
1449	return status;
1450	}
1451
1452	/****************************************************************
1453	****************************************************************/
1454
1455	static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1456	{
1457	WERROR werr = WERR_OK;
1458	sbcErr err;
1459	struct smbconf_ctx *ctx;
1460
1461	err = smbconf_init_reg(r, &ctx, NULL);
1462	if (!SBC_ERROR_IS_OK(err)) {
1463	werr = WERR_NO_SUCH_SERVICE;
1464	goto done;
1465	}
1466
1467	if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1468
1469	err = smbconf_set_global_parameter(ctx, "security", "user");
1470	if (!SBC_ERROR_IS_OK(err)) {
1471	werr = WERR_NO_SUCH_SERVICE;
1472	goto done;
1473	}
1474
1475	err = smbconf_set_global_parameter(ctx, "workgroup",
1476	r->in.domain_name);
1477	if (!SBC_ERROR_IS_OK(err)) {
1478	werr = WERR_NO_SUCH_SERVICE;
1479	goto done;
1480	}
1481
1482	smbconf_delete_global_parameter(ctx, "realm");
1483	goto done;
1484	}
1485
1486	err = smbconf_set_global_parameter(ctx, "security", "domain");
1487	if (!SBC_ERROR_IS_OK(err)) {
1488	werr = WERR_NO_SUCH_SERVICE;
1489	goto done;
1490	}
1491
1492	err = smbconf_set_global_parameter(ctx, "workgroup",
1493	r->out.netbios_domain_name);
1494	if (!SBC_ERROR_IS_OK(err)) {
1495	werr = WERR_NO_SUCH_SERVICE;
1496	goto done;
1497	}
1498
1499	if (r->out.domain_is_ad) {
1500	err = smbconf_set_global_parameter(ctx, "security", "ads");
1501	if (!SBC_ERROR_IS_OK(err)) {
1502	werr = WERR_NO_SUCH_SERVICE;
1503	goto done;
1504	}
1505
1506	err = smbconf_set_global_parameter(ctx, "realm",
1507	r->out.dns_domain_name);
1508	if (!SBC_ERROR_IS_OK(err)) {
1509	werr = WERR_NO_SUCH_SERVICE;
1510	goto done;
1511	}
1512	}
1513
1514	done:
1515	smbconf_shutdown(ctx);
1516	return werr;
1517	}
1518
1519	/****************************************************************
1520	****************************************************************/
1521
1522	static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1523	{
1524	WERROR werr = WERR_OK;
1525	sbcErr err;
1526	struct smbconf_ctx *ctx;
1527
1528	err = smbconf_init_reg(r, &ctx, NULL);
1529	if (!SBC_ERROR_IS_OK(err)) {
1530	werr = WERR_NO_SUCH_SERVICE;
1531	goto done;
1532	}
1533
1534	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1535
1536	err = smbconf_set_global_parameter(ctx, "security", "user");
1537	if (!SBC_ERROR_IS_OK(err)) {
1538	werr = WERR_NO_SUCH_SERVICE;
1539	goto done;
1540	}
1541
1542	err = smbconf_delete_global_parameter(ctx, "workgroup");
1543	if (!SBC_ERROR_IS_OK(err)) {
1544	werr = WERR_NO_SUCH_SERVICE;
1545	goto done;
1546	}
1547
1548	smbconf_delete_global_parameter(ctx, "realm");
1549	}
1550
1551	done:
1552	smbconf_shutdown(ctx);
1553	return werr;
1554	}
1555
1556	/****************************************************************
1557	****************************************************************/
1558
1559	static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1560	{
1561	WERROR werr;
1562
1563	if (!W_ERROR_IS_OK(r->out.result)) {
1564	return r->out.result;
1565	}
1566
1567	if (!r->in.modify_config) {
1568	return WERR_OK;
1569	}
1570
1571	werr = do_join_modify_vals_config(r);
1572	if (!W_ERROR_IS_OK(werr)) {
1573	return werr;
1574	}
1575
1576	lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1577
1578	r->out.modified_config = true;
1579	r->out.result = werr;
1580
1581	return werr;
1582	}
1583
1584	/****************************************************************
1585	****************************************************************/
1586
1587	static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1588	{
1589	WERROR werr;
1590
1591	if (!W_ERROR_IS_OK(r->out.result)) {
1592	return r->out.result;
1593	}
1594
1595	if (!r->in.modify_config) {
1596	return WERR_OK;
1597	}
1598
1599	werr = do_unjoin_modify_vals_config(r);
1600	if (!W_ERROR_IS_OK(werr)) {
1601	return werr;
1602	}
1603
1604	lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1605
1606	r->out.modified_config = true;
1607	r->out.result = werr;
1608
1609	return werr;
1610	}
1611
1612	/****************************************************************
1613	****************************************************************/
1614
1615	static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1616	const char *domain_str,
1617	const char **domain_p,
1618	const char **dc_p)
1619	{
1620	char *domain = NULL;
1621	char *dc = NULL;
1622	const char *p = NULL;
1623
1624	if (!domain_str \|\| !domain_p \|\| !dc_p) {
1625	return false;
1626	}
1627
1628	p = strchr_m(domain_str, '\\');
1629
1630	if (p != NULL) {
1631	domain = talloc_strndup(mem_ctx, domain_str,
1632	PTR_DIFF(p, domain_str));
1633	dc = talloc_strdup(mem_ctx, p+1);
1634	if (!dc) {
1635	return false;
1636	}
1637	} else {
1638	domain = talloc_strdup(mem_ctx, domain_str);
1639	dc = NULL;
1640	}
1641	if (!domain) {
1642	return false;
1643	}
1644
1645	*domain_p = domain;
1646
1647	if (!*dc_p && dc) {
1648	*dc_p = dc;
1649	}
1650
1651	return true;
1652	}
1653
1654	/****************************************************************
1655	****************************************************************/
1656
1657	static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1658	struct libnet_JoinCtx *r)
1659	{
1660	if (!r->in.domain_name) {
1661	libnet_join_set_error_string(mem_ctx, r,
1662	"No domain name defined");
1663	return WERR_INVALID_PARAM;
1664	}
1665
1666	if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1667	&r->in.domain_name,
1668	&r->in.dc_name)) {
1669	libnet_join_set_error_string(mem_ctx, r,
1670	"Failed to parse domain name");
1671	return WERR_INVALID_PARAM;
1672	}
1673
1674	if (IS_DC) {
1675	return WERR_SETUP_DOMAIN_CONTROLLER;
1676	}
1677
1678	if (!secrets_init()) {
1679	libnet_join_set_error_string(mem_ctx, r,
1680	"Unable to open secrets database");
1681	return WERR_CAN_NOT_COMPLETE;
1682	}
1683
1684	return WERR_OK;
1685	}
1686
1687	/****************************************************************
1688	****************************************************************/
1689
1690	static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1691	{
1692	NTSTATUS status;
1693
1694	/* Try adding dom admins to builtin\admins. Only log failures. */
1695	status = create_builtin_administrators(domain_sid);
1696	if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1697	DEBUG(10,("Unable to auto-add domain administrators to "
1698	"BUILTIN\\Administrators during join because "
1699	"winbindd must be running."));
1700	} else if (!NT_STATUS_IS_OK(status)) {
1701	DEBUG(5, ("Failed to auto-add domain administrators to "
1702	"BUILTIN\\Administrators during join: %s\n",
1703	nt_errstr(status)));
1704	}
1705
1706	/* Try adding dom users to builtin\users. Only log failures. */
1707	status = create_builtin_users(domain_sid);
1708	if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1709	DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1710	"during join because winbindd must be running."));
1711	} else if (!NT_STATUS_IS_OK(status)) {
1712	DEBUG(5, ("Failed to auto-add domain administrators to "
1713	"BUILTIN\\Administrators during join: %s\n",
1714	nt_errstr(status)));
1715	}
1716	}
1717
1718	/****************************************************************
1719	****************************************************************/
1720
1721	static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1722	struct libnet_JoinCtx *r)
1723	{
1724	WERROR werr;
1725
1726	if (!W_ERROR_IS_OK(r->out.result)) {
1727	return r->out.result;
1728	}
1729
1730	werr = do_JoinConfig(r);
1731	if (!W_ERROR_IS_OK(werr)) {
1732	return werr;
1733	}
1734
1735	if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1736	return WERR_OK;
1737	}
1738
1739	saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1740	if (r->out.dns_domain_name) {
1741	saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1742	}
1743
1744	#ifdef HAVE_ADS
1745	if (r->out.domain_is_ad &&
1746	!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1747	ADS_STATUS ads_status;
1748
1749	ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1750	if (!ADS_ERR_OK(ads_status)) {
1751	return WERR_GENERAL_FAILURE;
1752	}
1753	}
1754	#endif /* HAVE_ADS */
1755
1756	libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1757
1758	return WERR_OK;
1759	}
1760
1761	/****************************************************************
1762	****************************************************************/
1763
1764	static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1765	{
1766	if (r->in.ads) {
1767	ads_destroy(&r->in.ads);
1768	}
1769
1770	return 0;
1771	}
1772
1773	/****************************************************************
1774	****************************************************************/
1775
1776	static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1777	{
1778	if (r->in.ads) {
1779	ads_destroy(&r->in.ads);
1780	}
1781
1782	return 0;
1783	}
1784
1785	/****************************************************************
1786	****************************************************************/
1787
1788	WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1789	struct libnet_JoinCtx **r)
1790	{
1791	struct libnet_JoinCtx *ctx;
1792
1793	ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1794	if (!ctx) {
1795	return WERR_NOMEM;
1796	}
1797
1798	talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1799
1800	ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1801	W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1802
1803	ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1804
1805	*r = ctx;
1806
1807	return WERR_OK;
1808	}
1809
1810	/****************************************************************
1811	****************************************************************/
1812
1813	WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1814	struct libnet_UnjoinCtx **r)
1815	{
1816	struct libnet_UnjoinCtx *ctx;
1817
1818	ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1819	if (!ctx) {
1820	return WERR_NOMEM;
1821	}
1822
1823	talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1824
1825	ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1826	W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1827
1828	*r = ctx;
1829
1830	return WERR_OK;
1831	}
1832
1833	/****************************************************************
1834	****************************************************************/
1835
1836	static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1837	struct libnet_JoinCtx *r)
1838	{
1839	bool valid_security = false;
1840	bool valid_workgroup = false;
1841	bool valid_realm = false;
1842
1843	/* check if configuration is already set correctly */
1844
1845	valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1846
1847	switch (r->out.domain_is_ad) {
1848	case false:
1849	valid_security = (lp_security() == SEC_DOMAIN);
1850	if (valid_workgroup && valid_security) {
1851	/* nothing to be done */
1852	return WERR_OK;
1853	}
1854	break;
1855	case true:
1856	valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1857	switch (lp_security()) {
1858	case SEC_DOMAIN:
1859	case SEC_ADS:
1860	valid_security = true;
1861	}
1862
1863	if (valid_workgroup && valid_realm && valid_security) {
1864	/* nothing to be done */
1865	return WERR_OK;
1866	}
1867	break;
1868	}
1869
1870	/* check if we are supposed to manipulate configuration */
1871
1872	if (!r->in.modify_config) {
1873
1874	char *wrong_conf = talloc_strdup(mem_ctx, "");
1875
1876	if (!valid_workgroup) {
1877	wrong_conf = talloc_asprintf_append(wrong_conf,
1878	"\"workgroup\" set to '%s', should be '%s'",
1879	lp_workgroup(), r->out.netbios_domain_name);
1880	W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1881	}
1882
1883	if (!valid_realm) {
1884	wrong_conf = talloc_asprintf_append(wrong_conf,
1885	"\"realm\" set to '%s', should be '%s'",
1886	lp_realm(), r->out.dns_domain_name);
1887	W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1888	}
1889
1890	if (!valid_security) {
1891	const char *sec = NULL;
1892	switch (lp_security()) {
1893	case SEC_SHARE: sec = "share"; break;
1894	case SEC_USER: sec = "user"; break;
1895	case SEC_DOMAIN: sec = "domain"; break;
1896	case SEC_ADS: sec = "ads"; break;
1897	}
1898	wrong_conf = talloc_asprintf_append(wrong_conf,
1899	"\"security\" set to '%s', should be %s",
1900	sec, r->out.domain_is_ad ?
1901	"either 'domain' or 'ads'" : "'domain'");
1902	W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1903	}
1904
1905	libnet_join_set_error_string(mem_ctx, r,
1906	"Invalid configuration (%s) and configuration modification "
1907	"was not requested", wrong_conf);
1908	return WERR_CAN_NOT_COMPLETE;
1909	}
1910
1911	/* check if we are able to manipulate configuration */
1912
1913	if (!lp_config_backend_is_registry()) {
1914	libnet_join_set_error_string(mem_ctx, r,
1915	"Configuration manipulation requested but not "
1916	"supported by backend");
1917	return WERR_NOT_SUPPORTED;
1918	}
1919
1920	return WERR_OK;
1921	}
1922
1923	/****************************************************************
1924	****************************************************************/
1925
1926	static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1927	struct libnet_JoinCtx *r)
1928	{
1929	NTSTATUS status;
1930	WERROR werr;
1931	struct cli_state *cli = NULL;
1932	#ifdef HAVE_ADS
1933	ADS_STATUS ads_status;
1934	#endif /* HAVE_ADS */
1935
1936	if (!r->in.dc_name) {
1937	struct netr_DsRGetDCNameInfo *info;
1938	const char *dc;
1939	status = dsgetdcname(mem_ctx,
1940	r->in.msg_ctx,
1941	r->in.domain_name,
1942	NULL,
1943	NULL,
1944	DS_FORCE_REDISCOVERY \|
1945	DS_DIRECTORY_SERVICE_REQUIRED \|
1946	DS_WRITABLE_REQUIRED \|
1947	DS_RETURN_DNS_NAME,
1948	&info);
1949	if (!NT_STATUS_IS_OK(status)) {
1950	libnet_join_set_error_string(mem_ctx, r,
1951	"failed to find DC for domain %s",
1952	r->in.domain_name,
1953	get_friendly_nt_error_msg(status));
1954	return WERR_DCNOTFOUND;
1955	}
1956
1957	dc = strip_hostname(info->dc_unc);
1958	r->in.dc_name = talloc_strdup(mem_ctx, dc);
1959	W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1960	}
1961
1962	status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1963	if (!NT_STATUS_IS_OK(status)) {
1964	libnet_join_set_error_string(mem_ctx, r,
1965	"failed to lookup DC info for domain '%s' over rpc: %s",
1966	r->in.domain_name, get_friendly_nt_error_msg(status));
1967	return ntstatus_to_werror(status);
1968	}
1969
1970	werr = libnet_join_check_config(mem_ctx, r);
1971	if (!W_ERROR_IS_OK(werr)) {
1972	goto done;
1973	}
1974
1975	#ifdef HAVE_ADS
1976
1977	create_local_private_krb5_conf_for_domain(
1978	r->out.dns_domain_name, r->out.netbios_domain_name,
1979	NULL, &cli->dest_ss, cli->desthost);
1980
1981	if (r->out.domain_is_ad && r->in.account_ou &&
1982	!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1983
1984	ads_status = libnet_join_connect_ads(mem_ctx, r);
1985	if (!ADS_ERR_OK(ads_status)) {
1986	return WERR_DEFAULT_JOIN_REQUIRED;
1987	}
1988
1989	ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1990	if (!ADS_ERR_OK(ads_status)) {
1991	libnet_join_set_error_string(mem_ctx, r,
1992	"failed to precreate account in ou %s: %s",
1993	r->in.account_ou,
1994	ads_errstr(ads_status));
1995	return WERR_DEFAULT_JOIN_REQUIRED;
1996	}
1997
1998	r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1999	}
2000	#endif /* HAVE_ADS */
2001
2002	if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2003	(r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2004	status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2005	} else {
2006	status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2007	}
2008	if (!NT_STATUS_IS_OK(status)) {
2009	libnet_join_set_error_string(mem_ctx, r,
2010	"failed to join domain '%s' over rpc: %s",
2011	r->in.domain_name, get_friendly_nt_error_msg(status));
2012	if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2013	return WERR_SETUP_ALREADY_JOINED;
2014	}
2015	werr = ntstatus_to_werror(status);
2016	goto done;
2017	}
2018
2019	if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2020	werr = WERR_SETUP_NOT_JOINED;
2021	goto done;
2022	}
2023
2024	werr = WERR_OK;
2025
2026	done:
2027	if (cli) {
2028	cli_shutdown(cli);
2029	}
2030
2031	return werr;
2032	}
2033
2034	/****************************************************************
2035	****************************************************************/
2036
2037	static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2038	struct libnet_JoinCtx *r)
2039	{
2040	WERROR werr;
2041	struct libnet_UnjoinCtx *u = NULL;
2042
2043	werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2044	if (!W_ERROR_IS_OK(werr)) {
2045	return werr;
2046	}
2047
2048	u->in.debug = r->in.debug;
2049	u->in.dc_name = r->in.dc_name;
2050	u->in.domain_name = r->in.domain_name;
2051	u->in.admin_account = r->in.admin_account;
2052	u->in.admin_password = r->in.admin_password;
2053	u->in.modify_config = r->in.modify_config;
2054	u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE \|
2055	WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2056
2057	werr = libnet_Unjoin(mem_ctx, u);
2058	TALLOC_FREE(u);
2059
2060	return werr;
2061	}
2062
2063	/****************************************************************
2064	****************************************************************/
2065
2066	WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2067	struct libnet_JoinCtx *r)
2068	{
2069	WERROR werr;
2070
2071	if (r->in.debug) {
2072	LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2073	}
2074
2075	ZERO_STRUCT(r->out);
2076
2077	werr = libnet_join_pre_processing(mem_ctx, r);
2078	if (!W_ERROR_IS_OK(werr)) {
2079	goto done;
2080	}
2081
2082	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2083	werr = libnet_DomainJoin(mem_ctx, r);
2084	if (!W_ERROR_IS_OK(werr)) {
2085	goto done;
2086	}
2087	}
2088
2089	werr = libnet_join_post_processing(mem_ctx, r);
2090	if (!W_ERROR_IS_OK(werr)) {
2091	goto done;
2092	}
2093
2094	if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2095	werr = libnet_join_post_verify(mem_ctx, r);
2096	if (!W_ERROR_IS_OK(werr)) {
2097	libnet_join_rollback(mem_ctx, r);
2098	}
2099	}
2100
2101	done:
2102	r->out.result = werr;
2103
2104	if (r->in.debug) {
2105	LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2106	}
2107	return werr;
2108	}
2109
2110	/****************************************************************
2111	****************************************************************/
2112
2113	static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2114	struct libnet_UnjoinCtx *r)
2115	{
2116	NTSTATUS status;
2117
2118	if (!r->in.domain_sid) {
2119	struct dom_sid sid;
2120	if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2121	libnet_unjoin_set_error_string(mem_ctx, r,
2122	"Unable to fetch domain sid: are we joined?");
2123	return WERR_SETUP_NOT_JOINED;
2124	}
2125	r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2126	W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2127	}
2128
2129	if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2130	!r->in.delete_machine_account) {
2131	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2132	return WERR_OK;
2133	}
2134
2135	if (!r->in.dc_name) {
2136	struct netr_DsRGetDCNameInfo *info;
2137	const char *dc;
2138	status = dsgetdcname(mem_ctx,
2139	r->in.msg_ctx,
2140	r->in.domain_name,
2141	NULL,
2142	NULL,
2143	DS_DIRECTORY_SERVICE_REQUIRED \|
2144	DS_WRITABLE_REQUIRED \|
2145	DS_RETURN_DNS_NAME,
2146	&info);
2147	if (!NT_STATUS_IS_OK(status)) {
2148	libnet_unjoin_set_error_string(mem_ctx, r,
2149	"failed to find DC for domain %s",
2150	r->in.domain_name,
2151	get_friendly_nt_error_msg(status));
2152	return WERR_DCNOTFOUND;
2153	}
2154
2155	dc = strip_hostname(info->dc_unc);
2156	r->in.dc_name = talloc_strdup(mem_ctx, dc);
2157	W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2158	}
2159
2160	#ifdef HAVE_ADS
2161	/* for net ads leave, try to delete the account. If it works,
2162	no sense in disabling. If it fails, we can still try to
2163	disable it. jmcd */
2164
2165	if (r->in.delete_machine_account) {
2166	ADS_STATUS ads_status;
2167	ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2168	if (ADS_ERR_OK(ads_status)) {
2169	/* dirty hack */
2170	r->out.dns_domain_name =
2171	talloc_strdup(mem_ctx,
2172	r->in.ads->server.realm);
2173	ads_status =
2174	libnet_unjoin_remove_machine_acct(mem_ctx, r);
2175	}
2176	if (!ADS_ERR_OK(ads_status)) {
2177	libnet_unjoin_set_error_string(mem_ctx, r,
2178	"failed to remove machine account from AD: %s",
2179	ads_errstr(ads_status));
2180	} else {
2181	r->out.deleted_machine_account = true;
2182	W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2183	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2184	return WERR_OK;
2185	}
2186	}
2187	#endif /* HAVE_ADS */
2188
2189	/* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2190	"disable". */
2191	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2192	status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2193	if (!NT_STATUS_IS_OK(status)) {
2194	libnet_unjoin_set_error_string(mem_ctx, r,
2195	"failed to disable machine account via rpc: %s",
2196	get_friendly_nt_error_msg(status));
2197	if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2198	return WERR_SETUP_NOT_JOINED;
2199	}
2200	return ntstatus_to_werror(status);
2201	}
2202
2203	r->out.disabled_machine_account = true;
2204	}
2205
2206	/* If disable succeeded or was not requested at all, we
2207	should be getting rid of our end of things */
2208
2209	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2210
2211	return WERR_OK;
2212	}
2213
2214	/****************************************************************
2215	****************************************************************/
2216
2217	static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2218	struct libnet_UnjoinCtx *r)
2219	{
2220	if (!r->in.domain_name) {
2221	libnet_unjoin_set_error_string(mem_ctx, r,
2222	"No domain name defined");
2223	return WERR_INVALID_PARAM;
2224	}
2225
2226	if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2227	&r->in.domain_name,
2228	&r->in.dc_name)) {
2229	libnet_unjoin_set_error_string(mem_ctx, r,
2230	"Failed to parse domain name");
2231	return WERR_INVALID_PARAM;
2232	}
2233
2234	if (IS_DC) {
2235	return WERR_SETUP_DOMAIN_CONTROLLER;
2236	}
2237
2238	if (!secrets_init()) {
2239	libnet_unjoin_set_error_string(mem_ctx, r,
2240	"Unable to open secrets database");
2241	return WERR_CAN_NOT_COMPLETE;
2242	}
2243
2244	return WERR_OK;
2245	}
2246
2247	/****************************************************************
2248	****************************************************************/
2249
2250	static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2251	struct libnet_UnjoinCtx *r)
2252	{
2253	saf_delete(r->out.netbios_domain_name);
2254	saf_delete(r->out.dns_domain_name);
2255
2256	return libnet_unjoin_config(r);
2257	}
2258
2259	/****************************************************************
2260	****************************************************************/
2261
2262	WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2263	struct libnet_UnjoinCtx *r)
2264	{
2265	WERROR werr;
2266
2267	if (r->in.debug) {
2268	LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2269	}
2270
2271	werr = libnet_unjoin_pre_processing(mem_ctx, r);
2272	if (!W_ERROR_IS_OK(werr)) {
2273	goto done;
2274	}
2275
2276	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2277	werr = libnet_DomainUnjoin(mem_ctx, r);
2278	if (!W_ERROR_IS_OK(werr)) {
2279	libnet_unjoin_config(r);
2280	goto done;
2281	}
2282	}
2283
2284	werr = libnet_unjoin_post_processing(mem_ctx, r);
2285	if (!W_ERROR_IS_OK(werr)) {
2286	goto done;
2287	}
2288
2289	done:
2290	r->out.result = werr;
2291
2292	if (r->in.debug) {
2293	LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2294	}
2295
2296	return werr;
2297	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: