source3/libnet/libnet_join.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  libnet Join Support
   4  *  Copyright (C) Gerald (Jerry) Carter 2006
   5  *  Copyright (C) Guenther Deschner 2007-2008
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "ads.h"
  23 #include "librpc/gen_ndr/ndr_libnet_join.h"
  24 #include "libnet/libnet_join.h"
  25 #include "libcli/auth/libcli_auth.h"
  26 #include "../librpc/gen_ndr/ndr_samr_c.h"
  27 #include "rpc_client/init_samr.h"
  28 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  29 #include "rpc_client/cli_lsarpc.h"
  30 #include "../librpc/gen_ndr/ndr_netlogon.h"
  31 #include "rpc_client/cli_netlogon.h"
  32 #include "lib/smbconf/smbconf.h"
  33 #include "lib/smbconf/smbconf_reg.h"
  34 #include "../libds/common/flags.h"
  35 #include "secrets.h"
  36 #include "rpc_client/init_lsa.h"
  37 #include "rpc_client/cli_pipe.h"
  38 #include "../libcli/security/security.h"
  39 #include "passdb.h"
  40 #include "libsmb/libsmb.h"
  41 #include "../libcli/smb/smbXcli_base.h"
  42 #include "lib/param/loadparm.h"
  43 #include "libcli/auth/netlogon_creds_cli.h"
  44 #include "auth/credentials/credentials.h"
  45 #include "krb5_env.h"
  46
  47 /****************************************************************
  48 ****************************************************************/
  49
  50 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
  51         do { \
  52                 char *str = NULL; \
  53                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
  54                 DEBUG(1,("libnet_Join:\n%s", str)); \
  55                 TALLOC_FREE(str); \
  56         } while (0)
  57
  58 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
  59         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
  60 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
  61         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
  62
  63 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
  64         do { \
  65                 char *str = NULL; \
  66                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
  67                 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
  68                 TALLOC_FREE(str); \
  69         } while (0)
  70
  71 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
  72         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
  73 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
  74         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
  75
  76 /****************************************************************
  77 ****************************************************************/
  78
  79 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
  80                                          struct libnet_JoinCtx *r,
  81                                          const char *format, ...)
  82                                          PRINTF_ATTRIBUTE(3,4);
  83
  84 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
  85                                          struct libnet_JoinCtx *r,
  86                                          const char *format, ...)
  87 {
  88         va_list args;
  89
  90         if (r->out.error_string) {
  91                 return;
  92         }
  93
  94         va_start(args, format);
  95         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  96         va_end(args);
  97 }
  98
  99 /****************************************************************
 100 ****************************************************************/
 101
 102 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
 103                                            struct libnet_UnjoinCtx *r,
 104                                            const char *format, ...)
 105                                            PRINTF_ATTRIBUTE(3,4);
 106
 107 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
 108                                            struct libnet_UnjoinCtx *r,
 109                                            const char *format, ...)
 110 {
 111         va_list args;
 112
 113         if (r->out.error_string) {
 114                 return;
 115         }
 116
 117         va_start(args, format);
 118         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
 119         va_end(args);
 120 }
 121
 122 #ifdef HAVE_ADS
 123
 124 /****************************************************************
 125 ****************************************************************/
 126
 127 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
 128                                      const char *netbios_domain_name,
 129                                      const char *dc_name,
 130                                      const char *user_name,
 131                                      const char *password,
 132                                      const char *ccname,
 133                                      ADS_STRUCT **ads)
 134 {
 135         ADS_STATUS status;
 136         ADS_STRUCT *my_ads = NULL;
 137         char *cp;
 138
 139         my_ads = ads_init(dns_domain_name,
 140                           netbios_domain_name,
 141                           dc_name);
 142         if (!my_ads) {
 143                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 144         }
 145
 146         if (user_name) {
 147                 SAFE_FREE(my_ads->auth.user_name);
 148                 my_ads->auth.user_name = SMB_STRDUP(user_name);
 149                 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
 150                         *cp++ = '\0';
 151                         SAFE_FREE(my_ads->auth.realm);
 152                         my_ads->auth.realm = smb_xstrdup(cp);
 153                         if (!strupper_m(my_ads->auth.realm)) {
 154                                 ads_destroy(&my_ads);
 155                                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 156                         }
 157                 }
 158         }
 159
 160         if (password) {
 161                 SAFE_FREE(my_ads->auth.password);
 162                 my_ads->auth.password = SMB_STRDUP(password);
 163         }
 164
 165         if (ccname != NULL) {
 166                 SAFE_FREE(my_ads->auth.ccache_name);
 167                 my_ads->auth.ccache_name = SMB_STRDUP(ccname);
 168                 setenv(KRB5_ENV_CCNAME, my_ads->auth.ccache_name, 1);
 169         }
 170
 171         status = ads_connect_user_creds(my_ads);
 172         if (!ADS_ERR_OK(status)) {
 173                 ads_destroy(&my_ads);
 174                 return status;
 175         }
 176
 177         *ads = my_ads;
 178         return ADS_SUCCESS;
 179 }
 180
 181 /****************************************************************
 182 ****************************************************************/
 183
 184 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
 185                                           struct libnet_JoinCtx *r,
 186                                           bool use_machine_creds)
 187 {
 188         ADS_STATUS status;
 189         const char *username;
 190         const char *password;
 191         const char *ccname = NULL;
 192
 193         if (use_machine_creds) {
 194                 if (r->in.machine_name == NULL ||
 195                     r->in.machine_password == NULL) {
 196                         return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
 197                 }
 198                 username = talloc_strdup(mem_ctx, r->in.machine_name);
 199                 if (username == NULL) {
 200                         return ADS_ERROR(LDAP_NO_MEMORY);
 201                 }
 202                 if (username[strlen(username)] != '$') {
 203                         username = talloc_asprintf(username, "%s$", username);
 204                         if (username == NULL) {
 205                                 return ADS_ERROR(LDAP_NO_MEMORY);
 206                         }
 207                 }
 208                 password = r->in.machine_password;
 209                 ccname = "MEMORY:libnet_join_machine_creds";
 210         } else {
 211                 username = r->in.admin_account;
 212                 password = r->in.admin_password;
 213
 214                 /*
 215                  * when r->in.use_kerberos is set to allow "net ads join -k" we
 216                  * may not override the provided credential cache - gd
 217                  */
 218
 219                 if (!r->in.use_kerberos) {
 220                         ccname = "MEMORY:libnet_join_user_creds";
 221                 }
 222         }
 223
 224         status = libnet_connect_ads(r->out.dns_domain_name,
 225                                     r->out.netbios_domain_name,
 226                                     r->in.dc_name,
 227                                     username,
 228                                     password,
 229                                     ccname,
 230                                     &r->in.ads);
 231         if (!ADS_ERR_OK(status)) {
 232                 libnet_join_set_error_string(mem_ctx, r,
 233                         "failed to connect to AD: %s",
 234                         ads_errstr(status));
 235                 return status;
 236         }
 237
 238         if (!r->out.netbios_domain_name) {
 239                 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
 240                                                            r->in.ads->server.workgroup);
 241                 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
 242         }
 243
 244         if (!r->out.dns_domain_name) {
 245                 r->out.dns_domain_name = talloc_strdup(mem_ctx,
 246                                                        r->in.ads->config.realm);
 247                 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
 248         }
 249
 250         r->out.domain_is_ad = true;
 251
 252         return ADS_SUCCESS;
 253 }
 254
 255 /****************************************************************
 256 ****************************************************************/
 257
 258 static ADS_STATUS libnet_join_connect_ads_user(TALLOC_CTX *mem_ctx,
 259                                                struct libnet_JoinCtx *r)
 260 {
 261         return libnet_join_connect_ads(mem_ctx, r, false);
 262 }
 263
 264 /****************************************************************
 265 ****************************************************************/
 266
 267 static ADS_STATUS libnet_join_connect_ads_machine(TALLOC_CTX *mem_ctx,
 268                                                   struct libnet_JoinCtx *r)
 269 {
 270         return libnet_join_connect_ads(mem_ctx, r, true);
 271 }
 272
 273 /****************************************************************
 274 ****************************************************************/
 275
 276 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
 277                                             struct libnet_UnjoinCtx *r)
 278 {
 279         ADS_STATUS status;
 280
 281         status = libnet_connect_ads(r->in.domain_name,
 282                                     r->in.domain_name,
 283                                     r->in.dc_name,
 284                                     r->in.admin_account,
 285                                     r->in.admin_password,
 286                                     NULL,
 287                                     &r->in.ads);
 288         if (!ADS_ERR_OK(status)) {
 289                 libnet_unjoin_set_error_string(mem_ctx, r,
 290                         "failed to connect to AD: %s",
 291                         ads_errstr(status));
 292         }
 293
 294         return status;
 295 }
 296
 297 /****************************************************************
 298  join a domain using ADS (LDAP mods)
 299 ****************************************************************/
 300
 301 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
 302                                                      struct libnet_JoinCtx *r)
 303 {
 304         ADS_STATUS status;
 305         LDAPMessage *res = NULL;
 306         const char *attrs[] = { "dn", NULL };
 307         bool moved = false;
 308
 309         status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
 310         if (!ADS_ERR_OK(status)) {
 311                 return status;
 312         }
 313
 314         status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
 315         if (!ADS_ERR_OK(status)) {
 316                 return status;
 317         }
 318
 319         if (ads_count_replies(r->in.ads, res) != 1) {
 320                 ads_msgfree(r->in.ads, res);
 321                 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
 322         }
 323
 324         ads_msgfree(r->in.ads, res);
 325
 326         /* Attempt to create the machine account and bail if this fails.
 327            Assume that the admin wants exactly what they requested */
 328
 329         status = ads_create_machine_acct(r->in.ads,
 330                                          r->in.machine_name,
 331                                          r->in.account_ou,
 332                                          r->in.desired_encryption_types);
 333
 334         if (ADS_ERR_OK(status)) {
 335                 DEBUG(1,("machine account creation created\n"));
 336                 return status;
 337         } else  if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
 338                     (status.err.rc == LDAP_ALREADY_EXISTS)) {
 339                 status = ADS_SUCCESS;
 340         }
 341
 342         if (!ADS_ERR_OK(status)) {
 343                 DEBUG(1,("machine account creation failed\n"));
 344                 return status;
 345         }
 346
 347         status = ads_move_machine_acct(r->in.ads,
 348                                        r->in.machine_name,
 349                                        r->in.account_ou,
 350                                        &moved);
 351         if (!ADS_ERR_OK(status)) {
 352                 DEBUG(1,("failure to locate/move pre-existing "
 353                         "machine account\n"));
 354                 return status;
 355         }
 356
 357         DEBUG(1,("The machine account %s the specified OU.\n",
 358                 moved ? "was moved into" : "already exists in"));
 359
 360         return status;
 361 }
 362
 363 /****************************************************************
 364 ****************************************************************/
 365
 366 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
 367                                                     struct libnet_UnjoinCtx *r)
 368 {
 369         ADS_STATUS status;
 370
 371         if (!r->in.ads) {
 372                 status = libnet_unjoin_connect_ads(mem_ctx, r);
 373                 if (!ADS_ERR_OK(status)) {
 374                         libnet_unjoin_set_error_string(mem_ctx, r,
 375                                 "failed to connect to AD: %s",
 376                                 ads_errstr(status));
 377                         return status;
 378                 }
 379         }
 380
 381         status = ads_leave_realm(r->in.ads, r->in.machine_name);
 382         if (!ADS_ERR_OK(status)) {
 383                 libnet_unjoin_set_error_string(mem_ctx, r,
 384                         "failed to leave realm: %s",
 385                         ads_errstr(status));
 386                 return status;
 387         }
 388
 389         return ADS_SUCCESS;
 390 }
 391
 392 /****************************************************************
 393 ****************************************************************/
 394
 395 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
 396                                                 struct libnet_JoinCtx *r)
 397 {
 398         ADS_STATUS status;
 399         LDAPMessage *res = NULL;
 400         char *dn = NULL;
 401
 402         if (!r->in.machine_name) {
 403                 return ADS_ERROR(LDAP_NO_MEMORY);
 404         }
 405
 406         status = ads_find_machine_acct(r->in.ads,
 407                                        &res,
 408                                        r->in.machine_name);
 409         if (!ADS_ERR_OK(status)) {
 410                 return status;
 411         }
 412
 413         if (ads_count_replies(r->in.ads, res) != 1) {
 414                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 415                 goto done;
 416         }
 417
 418         dn = ads_get_dn(r->in.ads, mem_ctx, res);
 419         if (!dn) {
 420                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 421                 goto done;
 422         }
 423
 424         r->out.dn = talloc_strdup(mem_ctx, dn);
 425         if (!r->out.dn) {
 426                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 427                 goto done;
 428         }
 429
 430         if (!ads_pull_uint32(r->in.ads, res, "msDS-SupportedEncryptionTypes",
 431                              &r->out.set_encryption_types)) {
 432                 r->out.set_encryption_types = 0;
 433         }
 434
 435  done:
 436         ads_msgfree(r->in.ads, res);
 437         TALLOC_FREE(dn);
 438
 439         return status;
 440 }
 441
 442 static ADS_STATUS libnet_join_get_machine_spns(TALLOC_CTX *mem_ctx,
 443                                                struct libnet_JoinCtx *r,
 444                                                char ***spn_array,
 445                                                size_t *num_spns)
 446 {
 447         ADS_STATUS status;
 448
 449         if (r->in.machine_name == NULL) {
 450                 return ADS_ERROR_SYSTEM(EINVAL);
 451         }
 452
 453         status = ads_get_service_principal_names(mem_ctx,
 454                                                  r->in.ads,
 455                                                  r->in.machine_name,
 456                                                  spn_array,
 457                                                  num_spns);
 458
 459         return status;
 460 }
 461
 462 /****************************************************************
 463  Set a machines dNSHostName and servicePrincipalName attributes
 464 ****************************************************************/
 465
 466 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
 467                                               struct libnet_JoinCtx *r)
 468 {
 469         ADS_STATUS status;
 470         ADS_MODLIST mods;
 471         fstring my_fqdn;
 472         const char **spn_array = NULL;
 473         size_t num_spns = 0;
 474         char *spn = NULL;
 475         bool ok;
 476         const char **netbios_aliases = NULL;
 477
 478         /* Find our DN */
 479
 480         status = libnet_join_find_machine_acct(mem_ctx, r);
 481         if (!ADS_ERR_OK(status)) {
 482                 return status;
 483         }
 484
 485         status = libnet_join_get_machine_spns(mem_ctx,
 486                                               r,
 487                                               discard_const_p(char **, &spn_array),
 488                                               &num_spns);
 489         if (!ADS_ERR_OK(status)) {
 490                 DEBUG(5, ("Retrieving the servicePrincipalNames failed.\n"));
 491         }
 492
 493         /* Windows only creates HOST/shortname & HOST/fqdn. */
 494
 495         spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
 496         if (!spn) {
 497                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 498         }
 499         if (!strupper_m(spn)) {
 500                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 501         }
 502
 503         ok = ads_element_in_array(spn_array, num_spns, spn);
 504         if (!ok) {
 505                 ok = add_string_to_array(spn_array, spn,
 506                                          &spn_array, &num_spns);
 507                 if (!ok) {
 508                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 509                 }
 510         }
 511
 512         if (!name_to_fqdn(my_fqdn, r->in.machine_name)
 513             || (strchr(my_fqdn, '.') == NULL)) {
 514                 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
 515                              r->out.dns_domain_name);
 516         }
 517
 518         if (!strlower_m(my_fqdn)) {
 519                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 520         }
 521
 522         if (!strequal(my_fqdn, r->in.machine_name)) {
 523                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
 524                 if (!spn) {
 525                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 526                 }
 527
 528                 ok = ads_element_in_array(spn_array, num_spns, spn);
 529                 if (!ok) {
 530                         ok = add_string_to_array(spn_array, spn,
 531                                                  &spn_array, &num_spns);
 532                         if (!ok) {
 533                                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 534                         }
 535                 }
 536         }
 537
 538         netbios_aliases = lp_netbios_aliases();
 539         if (netbios_aliases != NULL) {
 540                 for (; *netbios_aliases != NULL; netbios_aliases++) {
 541                         /*
 542                          * Add HOST/NETBIOSNAME
 543                          */
 544                         spn = talloc_asprintf(mem_ctx, "HOST/%s", *netbios_aliases);
 545                         if (spn == NULL) {
 546                                 TALLOC_FREE(spn);
 547                                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 548                         }
 549                         if (!strupper_m(spn)) {
 550                                 TALLOC_FREE(spn);
 551                                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 552                         }
 553
 554                         ok = ads_element_in_array(spn_array, num_spns, spn);
 555                         if (ok) {
 556                                 TALLOC_FREE(spn);
 557                                 continue;
 558                         }
 559                         ok = add_string_to_array(spn_array, spn,
 560                                                  &spn_array, &num_spns);
 561                         if (!ok) {
 562                                 TALLOC_FREE(spn);
 563                                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 564                         }
 565                         TALLOC_FREE(spn);
 566
 567                         /*
 568                          * Add HOST/netbiosname.domainname
 569                          */
 570                         if (r->out.dns_domain_name == NULL) {
 571                                 continue;
 572                         }
 573                         fstr_sprintf(my_fqdn, "%s.%s",
 574                                      *netbios_aliases,
 575                                      r->out.dns_domain_name);
 576
 577                         spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
 578                         if (spn == NULL) {
 579                                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 580                         }
 581
 582                         ok = ads_element_in_array(spn_array, num_spns, spn);
 583                         if (ok) {
 584                                 TALLOC_FREE(spn);
 585                                 continue;
 586                         }
 587                         ok = add_string_to_array(spn_array, spn,
 588                                                  &spn_array, &num_spns);
 589                         if (!ok) {
 590                                 TALLOC_FREE(spn);
 591                                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 592                         }
 593                         TALLOC_FREE(spn);
 594                 }
 595         }
 596
 597         /* make sure to NULL terminate the array */
 598         spn_array = talloc_realloc(mem_ctx, spn_array, const char *, num_spns + 1);
 599         if (spn_array == NULL) {
 600                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 601         }
 602         spn_array[num_spns] = NULL;
 603
 604         mods = ads_init_mods(mem_ctx);
 605         if (!mods) {
 606                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 607         }
 608
 609         /* fields of primary importance */
 610
 611         status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
 612         if (!ADS_ERR_OK(status)) {
 613                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 614         }
 615
 616         status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
 617                                  spn_array);
 618         if (!ADS_ERR_OK(status)) {
 619                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 620         }
 621
 622         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 623 }
 624
 625 /****************************************************************
 626 ****************************************************************/
 627
 628 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
 629                                               struct libnet_JoinCtx *r)
 630 {
 631         ADS_STATUS status;
 632         ADS_MODLIST mods;
 633
 634         if (!r->in.create_upn) {
 635                 return ADS_SUCCESS;
 636         }
 637
 638         /* Find our DN */
 639
 640         status = libnet_join_find_machine_acct(mem_ctx, r);
 641         if (!ADS_ERR_OK(status)) {
 642                 return status;
 643         }
 644
 645         if (!r->in.upn) {
 646                 const char *realm = r->out.dns_domain_name;
 647
 648                 /* in case we are about to generate a keytab during the join
 649                  * make sure the default upn we create is usable with kinit -k.
 650                  * gd */
 651
 652                 if (USE_KERBEROS_KEYTAB) {
 653                         realm = talloc_strdup_upper(mem_ctx,
 654                                                     r->out.dns_domain_name);
 655                 }
 656
 657                 if (!realm) {
 658                         return ADS_ERROR(LDAP_NO_MEMORY);
 659                 }
 660
 661                 r->in.upn = talloc_asprintf(mem_ctx,
 662                                             "host/%s@%s",
 663                                             r->in.machine_name,
 664                                             realm);
 665                 if (!r->in.upn) {
 666                         return ADS_ERROR(LDAP_NO_MEMORY);
 667                 }
 668         }
 669
 670         /* now do the mods */
 671
 672         mods = ads_init_mods(mem_ctx);
 673         if (!mods) {
 674                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 675         }
 676
 677         /* fields of primary importance */
 678
 679         status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
 680         if (!ADS_ERR_OK(status)) {
 681                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 682         }
 683
 684         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 685 }
 686
 687
 688 /****************************************************************
 689 ****************************************************************/
 690
 691 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
 692                                                 struct libnet_JoinCtx *r)
 693 {
 694         ADS_STATUS status;
 695         ADS_MODLIST mods;
 696         char *os_sp = NULL;
 697
 698         if (!r->in.os_name || !r->in.os_version ) {
 699                 return ADS_SUCCESS;
 700         }
 701
 702         /* Find our DN */
 703
 704         status = libnet_join_find_machine_acct(mem_ctx, r);
 705         if (!ADS_ERR_OK(status)) {
 706                 return status;
 707         }
 708
 709         /* now do the mods */
 710
 711         mods = ads_init_mods(mem_ctx);
 712         if (!mods) {
 713                 return ADS_ERROR(LDAP_NO_MEMORY);
 714         }
 715
 716         if (r->in.os_servicepack) {
 717                 /*
 718                  * if blank string then leave os_sp equal to NULL to force
 719                  * attribute delete (LDAP_MOD_DELETE)
 720                  */
 721                 if (!strequal(r->in.os_servicepack,"")) {
 722                         os_sp = talloc_strdup(mem_ctx, r->in.os_servicepack);
 723                 }
 724         } else {
 725                 os_sp = talloc_asprintf(mem_ctx, "Samba %s",
 726                                         samba_version_string());
 727         }
 728         if (!os_sp && !strequal(r->in.os_servicepack,"")) {
 729                 return ADS_ERROR(LDAP_NO_MEMORY);
 730         }
 731
 732         /* fields of primary importance */
 733
 734         status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
 735                              r->in.os_name);
 736         if (!ADS_ERR_OK(status)) {
 737                 return status;
 738         }
 739
 740         status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
 741                              r->in.os_version);
 742         if (!ADS_ERR_OK(status)) {
 743                 return status;
 744         }
 745
 746         status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
 747                              os_sp);
 748         if (!ADS_ERR_OK(status)) {
 749                 return status;
 750         }
 751
 752         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 753 }
 754
 755 /****************************************************************
 756 ****************************************************************/
 757
 758 static ADS_STATUS libnet_join_set_etypes(TALLOC_CTX *mem_ctx,
 759                                          struct libnet_JoinCtx *r)
 760 {
 761         ADS_STATUS status;
 762         ADS_MODLIST mods;
 763         const char *etype_list_str;
 764
 765         etype_list_str = talloc_asprintf(mem_ctx, "%d",
 766                                          r->in.desired_encryption_types);
 767         if (!etype_list_str) {
 768                 return ADS_ERROR(LDAP_NO_MEMORY);
 769         }
 770
 771         /* Find our DN */
 772
 773         status = libnet_join_find_machine_acct(mem_ctx, r);
 774         if (!ADS_ERR_OK(status)) {
 775                 return status;
 776         }
 777
 778         if (r->in.desired_encryption_types == r->out.set_encryption_types) {
 779                 return ADS_SUCCESS;
 780         }
 781
 782         /* now do the mods */
 783
 784         mods = ads_init_mods(mem_ctx);
 785         if (!mods) {
 786                 return ADS_ERROR(LDAP_NO_MEMORY);
 787         }
 788
 789         status = ads_mod_str(mem_ctx, &mods, "msDS-SupportedEncryptionTypes",
 790                              etype_list_str);
 791         if (!ADS_ERR_OK(status)) {
 792                 return status;
 793         }
 794
 795         status = ads_gen_mod(r->in.ads, r->out.dn, mods);
 796         if (!ADS_ERR_OK(status)) {
 797                 return status;
 798         }
 799
 800         r->out.set_encryption_types = r->in.desired_encryption_types;
 801
 802         return ADS_SUCCESS;
 803 }
 804
 805 /****************************************************************
 806 ****************************************************************/
 807
 808 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
 809                                       struct libnet_JoinCtx *r)
 810 {
 811         if (!USE_SYSTEM_KEYTAB) {
 812                 return true;
 813         }
 814
 815         if (ads_keytab_create_default(r->in.ads) != 0) {
 816                 return false;
 817         }
 818
 819         return true;
 820 }
 821
 822 /****************************************************************
 823 ****************************************************************/
 824
 825 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
 826                                                  struct libnet_JoinCtx *r)
 827 {
 828         uint32_t domain_func;
 829         ADS_STATUS status;
 830         const char *salt = NULL;
 831         char *std_salt = NULL;
 832
 833         status = ads_domain_func_level(r->in.ads, &domain_func);
 834         if (!ADS_ERR_OK(status)) {
 835                 libnet_join_set_error_string(mem_ctx, r,
 836                         "failed to determine domain functional level: %s",
 837                         ads_errstr(status));
 838                 return false;
 839         }
 840
 841         /* go ahead and setup the default salt */
 842
 843         std_salt = kerberos_standard_des_salt();
 844         if (!std_salt) {
 845                 libnet_join_set_error_string(mem_ctx, r,
 846                         "failed to obtain standard DES salt");
 847                 return false;
 848         }
 849
 850         salt = talloc_strdup(mem_ctx, std_salt);
 851         if (!salt) {
 852                 return false;
 853         }
 854
 855         SAFE_FREE(std_salt);
 856
 857         /* if it's a Windows functional domain, we have to look for the UPN */
 858
 859         if (domain_func == DS_DOMAIN_FUNCTION_2000) {
 860                 char *upn;
 861
 862                 upn = ads_get_upn(r->in.ads, mem_ctx,
 863                                   r->in.machine_name);
 864                 if (upn) {
 865                         salt = talloc_strdup(mem_ctx, upn);
 866                         if (!salt) {
 867                                 return false;
 868                         }
 869                 }
 870         }
 871
 872         return kerberos_secrets_store_des_salt(salt);
 873 }
 874
 875 /****************************************************************
 876 ****************************************************************/
 877
 878 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
 879                                                   struct libnet_JoinCtx *r)
 880 {
 881         ADS_STATUS status;
 882         bool need_etype_update = false;
 883
 884         if (!r->in.ads) {
 885                 status = libnet_join_connect_ads_user(mem_ctx, r);
 886                 if (!ADS_ERR_OK(status)) {
 887                         return status;
 888                 }
 889         }
 890
 891         status = libnet_join_set_machine_spn(mem_ctx, r);
 892         if (!ADS_ERR_OK(status)) {
 893                 libnet_join_set_error_string(mem_ctx, r,
 894                         "Failed to set machine spn: %s\n"
 895                         "Do you have sufficient permissions to create machine "
 896                         "accounts?",
 897                         ads_errstr(status));
 898                 return status;
 899         }
 900
 901         status = libnet_join_set_os_attributes(mem_ctx, r);
 902         if (!ADS_ERR_OK(status)) {
 903                 libnet_join_set_error_string(mem_ctx, r,
 904                         "failed to set machine os attributes: %s",
 905                         ads_errstr(status));
 906                 return status;
 907         }
 908
 909         status = libnet_join_set_machine_upn(mem_ctx, r);
 910         if (!ADS_ERR_OK(status)) {
 911                 libnet_join_set_error_string(mem_ctx, r,
 912                         "failed to set machine upn: %s",
 913                         ads_errstr(status));
 914                 return status;
 915         }
 916
 917         status = libnet_join_find_machine_acct(mem_ctx, r);
 918         if (!ADS_ERR_OK(status)) {
 919                 return status;
 920         }
 921
 922         if (r->in.desired_encryption_types != r->out.set_encryption_types) {
 923                 uint32_t func_level = 0;
 924
 925                 status = ads_domain_func_level(r->in.ads, &func_level);
 926                 if (!ADS_ERR_OK(status)) {
 927                         libnet_join_set_error_string(mem_ctx, r,
 928                                 "failed to query domain controller functional level: %s",
 929                                 ads_errstr(status));
 930                         return status;
 931                 }
 932
 933                 if (func_level >= DS_DOMAIN_FUNCTION_2008) {
 934                         need_etype_update = true;
 935                 }
 936         }
 937
 938         if (need_etype_update) {
 939                 /*
 940                  * We need to reconnect as machine account in order
 941                  * to update msDS-SupportedEncryptionTypes reliable
 942                  */
 943
 944                 if (r->in.ads->auth.ccache_name != NULL) {
 945                         ads_kdestroy(r->in.ads->auth.ccache_name);
 946                 }
 947
 948                 ads_destroy(&r->in.ads);
 949
 950                 status = libnet_join_connect_ads_machine(mem_ctx, r);
 951                 if (!ADS_ERR_OK(status)) {
 952                         libnet_join_set_error_string(mem_ctx, r,
 953                                 "Failed to connect as machine account: %s",
 954                                 ads_errstr(status));
 955                         return status;
 956                 }
 957
 958                 status = libnet_join_set_etypes(mem_ctx, r);
 959                 if (!ADS_ERR_OK(status)) {
 960                         libnet_join_set_error_string(mem_ctx, r,
 961                                 "failed to set machine kerberos encryption types: %s",
 962                                 ads_errstr(status));
 963                         return status;
 964                 }
 965         }
 966
 967         if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
 968                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 969         }
 970
 971         if (!libnet_join_create_keytab(mem_ctx, r)) {
 972                 libnet_join_set_error_string(mem_ctx, r,
 973                         "failed to create kerberos keytab");
 974                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 975         }
 976
 977         return ADS_SUCCESS;
 978 }
 979 #endif /* HAVE_ADS */
 980
 981 /****************************************************************
 982  Store the machine password and domain SID
 983 ****************************************************************/
 984
 985 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
 986                                                  struct libnet_JoinCtx *r)
 987 {
 988         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
 989                                       r->out.domain_sid))
 990         {
 991                 DEBUG(1,("Failed to save domain sid\n"));
 992                 return false;
 993         }
 994
 995         if (!secrets_store_machine_password(r->in.machine_password,
 996                                             r->out.netbios_domain_name,
 997                                             r->in.secure_channel_type))
 998         {
 999                 DEBUG(1,("Failed to save machine password\n"));
1000                 return false;
1001         }
1002
1003         return true;
1004 }
1005
1006 /****************************************************************
1007  Connect dc's IPC$ share
1008 ****************************************************************/
1009
1010 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
1011                                            const char *user,
1012                                            const char *domain,
1013                                            const char *pass,
1014                                            bool use_kerberos,
1015                                            struct cli_state **cli)
1016 {
1017         int flags = 0;
1018
1019         if (use_kerberos) {
1020                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1021         }
1022
1023         if (use_kerberos && pass) {
1024                 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
1025         }
1026
1027         return cli_full_connection(cli, NULL,
1028                                    dc,
1029                                    NULL, 0,
1030                                    "IPC$", "IPC",
1031                                    user,
1032                                    domain,
1033                                    pass,
1034                                    flags,
1035                                    SMB_SIGNING_IPC_DEFAULT);
1036 }
1037
1038 /****************************************************************
1039  Lookup domain dc's info
1040 ****************************************************************/
1041
1042 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
1043                                           struct libnet_JoinCtx *r,
1044                                           struct cli_state **cli)
1045 {
1046         struct rpc_pipe_client *pipe_hnd = NULL;
1047         struct policy_handle lsa_pol;
1048         NTSTATUS status, result;
1049         union lsa_PolicyInformation *info = NULL;
1050         struct dcerpc_binding_handle *b;
1051
1052         status = libnet_join_connect_dc_ipc(r->in.dc_name,
1053                                             r->in.admin_account,
1054                                             r->in.admin_domain,
1055                                             r->in.admin_password,
1056                                             r->in.use_kerberos,
1057                                             cli);
1058         if (!NT_STATUS_IS_OK(status)) {
1059                 goto done;
1060         }
1061
1062         status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc,
1063                                           &pipe_hnd);
1064         if (!NT_STATUS_IS_OK(status)) {
1065                 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
1066                         nt_errstr(status)));
1067                 goto done;
1068         }
1069
1070         b = pipe_hnd->binding_handle;
1071
1072         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
1073                                         SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1074         if (!NT_STATUS_IS_OK(status)) {
1075                 goto done;
1076         }
1077
1078         status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
1079                                              &lsa_pol,
1080                                              LSA_POLICY_INFO_DNS,
1081                                              &info,
1082                                              &result);
1083         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
1084                 r->out.domain_is_ad = true;
1085                 r->out.netbios_domain_name = info->dns.name.string;
1086                 r->out.dns_domain_name = info->dns.dns_domain.string;
1087                 r->out.forest_name = info->dns.dns_forest.string;
1088                 r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
1089                 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
1090         }
1091
1092         if (!NT_STATUS_IS_OK(status)) {
1093                 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
1094                                                     &lsa_pol,
1095                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1096                                                     &info,
1097                                                     &result);
1098                 if (!NT_STATUS_IS_OK(status)) {
1099                         goto done;
1100                 }
1101                 if (!NT_STATUS_IS_OK(result)) {
1102                         status = result;
1103                         goto done;
1104                 }
1105
1106                 r->out.netbios_domain_name = info->account_domain.name.string;
1107                 r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
1108                 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
1109         }
1110
1111         dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
1112         TALLOC_FREE(pipe_hnd);
1113
1114  done:
1115         return status;
1116 }
1117
1118 /****************************************************************
1119  Do the domain join unsecure
1120 ****************************************************************/
1121
1122 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
1123                                                     struct libnet_JoinCtx *r,
1124                                                     struct cli_state *cli)
1125 {
1126         TALLOC_CTX *frame = talloc_stackframe();
1127         struct rpc_pipe_client *netlogon_pipe = NULL;
1128         struct netlogon_creds_cli_context *netlogon_creds = NULL;
1129         struct samr_Password current_nt_hash;
1130         const char *account_name = NULL;
1131         NTSTATUS status;
1132
1133         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon,
1134                                           &netlogon_pipe);
1135         if (!NT_STATUS_IS_OK(status)) {
1136                 TALLOC_FREE(frame);
1137                 return status;
1138         }
1139
1140         if (!r->in.machine_password) {
1141                 r->in.machine_password = generate_random_password(mem_ctx,
1142                                 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
1143                                 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
1144                 if (r->in.machine_password == NULL) {
1145                         TALLOC_FREE(frame);
1146                         return NT_STATUS_NO_MEMORY;
1147                 }
1148         }
1149
1150         /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
1151         E_md4hash(r->in.admin_password, current_nt_hash.hash);
1152
1153         account_name = talloc_asprintf(frame, "%s$",
1154                                        r->in.machine_name);
1155         if (account_name == NULL) {
1156                 TALLOC_FREE(frame);
1157                 return NT_STATUS_NO_MEMORY;
1158         }
1159
1160         status = rpccli_create_netlogon_creds(netlogon_pipe->desthost,
1161                                               r->in.domain_name,
1162                                               account_name,
1163                                               r->in.secure_channel_type,
1164                                               r->in.msg_ctx,
1165                                               frame,
1166                                               &netlogon_creds);
1167         if (!NT_STATUS_IS_OK(status)) {
1168                 TALLOC_FREE(frame);
1169                 return status;
1170         }
1171
1172         status = rpccli_setup_netlogon_creds(cli, NCACN_NP,
1173                                              netlogon_creds,
1174                                              true, /* force_reauth */
1175                                              current_nt_hash,
1176                                              NULL); /* previous_nt_hash */
1177         if (!NT_STATUS_IS_OK(status)) {
1178                 TALLOC_FREE(frame);
1179                 return status;
1180         }
1181
1182         status = netlogon_creds_cli_ServerPasswordSet(netlogon_creds,
1183                                                       netlogon_pipe->binding_handle,
1184                                                       r->in.machine_password,
1185                                                       NULL); /* new_version */
1186         if (!NT_STATUS_IS_OK(status)) {
1187                 TALLOC_FREE(frame);
1188                 return status;
1189         }
1190
1191         TALLOC_FREE(frame);
1192         return NT_STATUS_OK;
1193 }
1194
1195 /****************************************************************
1196  Do the domain join
1197 ****************************************************************/
1198
1199 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
1200                                            struct libnet_JoinCtx *r,
1201                                            struct cli_state *cli)
1202 {
1203         struct rpc_pipe_client *pipe_hnd = NULL;
1204         struct policy_handle sam_pol, domain_pol, user_pol;
1205         NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1206         char *acct_name;
1207         struct lsa_String lsa_acct_name;
1208         uint32_t user_rid;
1209         uint32_t acct_flags = ACB_WSTRUST;
1210         struct samr_Ids user_rids;
1211         struct samr_Ids name_types;
1212         union samr_UserInfo user_info;
1213         struct dcerpc_binding_handle *b = NULL;
1214         unsigned int old_timeout = 0;
1215
1216         DATA_BLOB session_key = data_blob_null;
1217         struct samr_CryptPassword crypt_pwd;
1218         struct samr_CryptPasswordEx crypt_pwd_ex;
1219
1220         ZERO_STRUCT(sam_pol);
1221         ZERO_STRUCT(domain_pol);
1222         ZERO_STRUCT(user_pol);
1223
1224         switch (r->in.secure_channel_type) {
1225         case SEC_CHAN_WKSTA:
1226                 acct_flags = ACB_WSTRUST;
1227                 break;
1228         case SEC_CHAN_BDC:
1229                 acct_flags = ACB_SVRTRUST;
1230                 break;
1231         default:
1232                 return NT_STATUS_INVALID_PARAMETER;
1233         }
1234
1235         if (!r->in.machine_password) {
1236                 r->in.machine_password = generate_random_password(mem_ctx,
1237                                 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
1238                                 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
1239                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
1240         }
1241
1242         /* Open the domain */
1243
1244         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
1245                                           &pipe_hnd);
1246         if (!NT_STATUS_IS_OK(status)) {
1247                 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1248                         nt_errstr(status)));
1249                 goto done;
1250         }
1251
1252         b = pipe_hnd->binding_handle;
1253
1254         status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
1255         if (!NT_STATUS_IS_OK(status)) {
1256                 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
1257                         nt_errstr(status)));
1258                 goto done;
1259         }
1260
1261         status = dcerpc_samr_Connect2(b, mem_ctx,
1262                                       pipe_hnd->desthost,
1263                                       SAMR_ACCESS_ENUM_DOMAINS
1264                                       | SAMR_ACCESS_LOOKUP_DOMAIN,
1265                                       &sam_pol,
1266                                       &result);
1267         if (!NT_STATUS_IS_OK(status)) {
1268                 goto done;
1269         }
1270         if (!NT_STATUS_IS_OK(result)) {
1271                 status = result;
1272                 goto done;
1273         }
1274
1275         status = dcerpc_samr_OpenDomain(b, mem_ctx,
1276                                         &sam_pol,
1277                                         SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
1278                                         | SAMR_DOMAIN_ACCESS_CREATE_USER
1279                                         | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
1280                                         r->out.domain_sid,
1281                                         &domain_pol,
1282                                         &result);
1283         if (!NT_STATUS_IS_OK(status)) {
1284                 goto done;
1285         }
1286         if (!NT_STATUS_IS_OK(result)) {
1287                 status = result;
1288                 goto done;
1289         }
1290
1291         /* Create domain user */
1292
1293         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1294         if (!strlower_m(acct_name)) {
1295                 status = NT_STATUS_INVALID_PARAMETER;
1296                 goto done;
1297         }
1298
1299         init_lsa_String(&lsa_acct_name, acct_name);
1300
1301         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
1302                 uint32_t access_desired =
1303                         SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
1304                         SEC_STD_WRITE_DAC | SEC_STD_DELETE |
1305                         SAMR_USER_ACCESS_SET_PASSWORD |
1306                         SAMR_USER_ACCESS_GET_ATTRIBUTES |
1307                         SAMR_USER_ACCESS_SET_ATTRIBUTES;
1308                 uint32_t access_granted = 0;
1309
1310                 DEBUG(10,("Creating account with desired access mask: %d\n",
1311                         access_desired));
1312
1313                 status = dcerpc_samr_CreateUser2(b, mem_ctx,
1314                                                  &domain_pol,
1315                                                  &lsa_acct_name,
1316                                                  acct_flags,
1317                                                  access_desired,
1318                                                  &user_pol,
1319                                                  &access_granted,
1320                                                  &user_rid,
1321                                                  &result);
1322                 if (!NT_STATUS_IS_OK(status)) {
1323                         goto done;
1324                 }
1325
1326                 status = result;
1327                 if (!NT_STATUS_IS_OK(status) &&
1328                     !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1329
1330                         DEBUG(10,("Creation of workstation account failed: %s\n",
1331                                 nt_errstr(status)));
1332
1333                         /* If NT_STATUS_ACCESS_DENIED then we have a valid
1334                            username/password combo but the user does not have
1335                            administrator access. */
1336
1337                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1338                                 libnet_join_set_error_string(mem_ctx, r,
1339                                         "User specified does not have "
1340                                         "administrator privileges");
1341                         }
1342
1343                         goto done;
1344                 }
1345
1346                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1347                         if (!(r->in.join_flags &
1348                               WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
1349                                 goto done;
1350                         }
1351                 }
1352
1353                 /* We *must* do this.... don't ask... */
1354
1355                 if (NT_STATUS_IS_OK(status)) {
1356                         dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1357                 }
1358         }
1359
1360         status = dcerpc_samr_LookupNames(b, mem_ctx,
1361                                          &domain_pol,
1362                                          1,
1363                                          &lsa_acct_name,
1364                                          &user_rids,
1365                                          &name_types,
1366                                          &result);
1367         if (!NT_STATUS_IS_OK(status)) {
1368                 goto done;
1369         }
1370         if (!NT_STATUS_IS_OK(result)) {
1371                 status = result;
1372                 goto done;
1373         }
1374         if (user_rids.count != 1) {
1375                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1376                 goto done;
1377         }
1378         if (name_types.count != 1) {
1379                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1380                 goto done;
1381         }
1382
1383         if (name_types.ids[0] != SID_NAME_USER) {
1384                 DEBUG(0,("%s is not a user account (type=%d)\n",
1385                         acct_name, name_types.ids[0]));
1386                 status = NT_STATUS_INVALID_WORKSTATION;
1387                 goto done;
1388         }
1389
1390         user_rid = user_rids.ids[0];
1391
1392         /* Open handle on user */
1393
1394         status = dcerpc_samr_OpenUser(b, mem_ctx,
1395                                       &domain_pol,
1396                                       SEC_FLAG_MAXIMUM_ALLOWED,
1397                                       user_rid,
1398                                       &user_pol,
1399                                       &result);
1400         if (!NT_STATUS_IS_OK(status)) {
1401                 goto done;
1402         }
1403         if (!NT_STATUS_IS_OK(result)) {
1404                 status = result;
1405                 goto done;
1406         }
1407
1408         /* Fill in the additional account flags now */
1409
1410         acct_flags |= ACB_PWNOEXP;
1411
1412         /* Set account flags on machine account */
1413         ZERO_STRUCT(user_info.info16);
1414         user_info.info16.acct_flags = acct_flags;
1415
1416         status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1417                                          &user_pol,
1418                                          16,
1419                                          &user_info,
1420                                          &result);
1421         if (!NT_STATUS_IS_OK(status)) {
1422                 dcerpc_samr_DeleteUser(b, mem_ctx,
1423                                        &user_pol,
1424                                        &result);
1425
1426                 libnet_join_set_error_string(mem_ctx, r,
1427                         "Failed to set account flags for machine account (%s)\n",
1428                         nt_errstr(status));
1429                 goto done;
1430         }
1431
1432         if (!NT_STATUS_IS_OK(result)) {
1433                 status = result;
1434
1435                 dcerpc_samr_DeleteUser(b, mem_ctx,
1436                                        &user_pol,
1437                                        &result);
1438
1439                 libnet_join_set_error_string(mem_ctx, r,
1440                         "Failed to set account flags for machine account (%s)\n",
1441                         nt_errstr(status));
1442                 goto done;
1443         }
1444
1445         /* Set password on machine account - first try level 26 */
1446
1447         /*
1448          * increase the timeout as password filter modules on the DC
1449          * might delay the operation for a significant amount of time
1450          */
1451         old_timeout = rpccli_set_timeout(pipe_hnd, 600000);
1452
1453         init_samr_CryptPasswordEx(r->in.machine_password,
1454                                   &session_key,
1455                                   &crypt_pwd_ex);
1456
1457         user_info.info26.password = crypt_pwd_ex;
1458         user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1459
1460         status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1461                                           &user_pol,
1462                                           26,
1463                                           &user_info,
1464                                           &result);
1465
1466         if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1467
1468                 /* retry with level 24 */
1469
1470                 init_samr_CryptPassword(r->in.machine_password,
1471                                         &session_key,
1472                                         &crypt_pwd);
1473
1474                 user_info.info24.password = crypt_pwd;
1475                 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1476
1477                 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1478                                                   &user_pol,
1479                                                   24,
1480                                                   &user_info,
1481                                                   &result);
1482         }
1483
1484         old_timeout = rpccli_set_timeout(pipe_hnd, old_timeout);
1485
1486         if (!NT_STATUS_IS_OK(status)) {
1487
1488                 dcerpc_samr_DeleteUser(b, mem_ctx,
1489                                        &user_pol,
1490                                        &result);
1491
1492                 libnet_join_set_error_string(mem_ctx, r,
1493                         "Failed to set password for machine account (%s)\n",
1494                         nt_errstr(status));
1495                 goto done;
1496         }
1497         if (!NT_STATUS_IS_OK(result)) {
1498                 status = result;
1499
1500                 dcerpc_samr_DeleteUser(b, mem_ctx,
1501                                        &user_pol,
1502                                        &result);
1503
1504                 libnet_join_set_error_string(mem_ctx, r,
1505                         "Failed to set password for machine account (%s)\n",
1506                         nt_errstr(status));
1507                 goto done;
1508         }
1509
1510         status = NT_STATUS_OK;
1511
1512  done:
1513         if (!pipe_hnd) {
1514                 return status;
1515         }
1516
1517         data_blob_clear_free(&session_key);
1518
1519         if (is_valid_policy_hnd(&sam_pol)) {
1520                 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1521         }
1522         if (is_valid_policy_hnd(&domain_pol)) {
1523                 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1524         }
1525         if (is_valid_policy_hnd(&user_pol)) {
1526                 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1527         }
1528         TALLOC_FREE(pipe_hnd);
1529
1530         return status;
1531 }
1532
1533 /****************************************************************
1534 ****************************************************************/
1535
1536 NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
1537                         const char *netbios_domain_name,
1538                         const char *dc_name,
1539                         const bool use_kerberos)
1540 {
1541         TALLOC_CTX *frame = talloc_stackframe();
1542         struct cli_state *cli = NULL;
1543         struct rpc_pipe_client *netlogon_pipe = NULL;
1544         struct cli_credentials *cli_creds = NULL;
1545         struct netlogon_creds_cli_context *netlogon_creds = NULL;
1546         struct netlogon_creds_CredentialState *creds = NULL;
1547         uint32_t netlogon_flags = 0;
1548         NTSTATUS status;
1549         const char *machine_account = NULL;
1550         const char *machine_domain = NULL;
1551         const char *machine_password = NULL;
1552         int flags = 0;
1553
1554         if (!dc_name) {
1555                 TALLOC_FREE(frame);
1556                 return NT_STATUS_INVALID_PARAMETER;
1557         }
1558
1559         if (!secrets_init()) {
1560                 TALLOC_FREE(frame);
1561                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1562         }
1563
1564         status = pdb_get_trust_credentials(netbios_domain_name, NULL,
1565                                            frame, &cli_creds);
1566         if (!NT_STATUS_IS_OK(status)) {
1567                 TALLOC_FREE(frame);
1568                 return status;
1569         }
1570
1571         /* we don't want any old password */
1572         cli_credentials_set_old_password(cli_creds, NULL, CRED_SPECIFIED);
1573
1574         if (use_kerberos) {
1575                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1576         }
1577
1578         machine_account = cli_credentials_get_username(cli_creds);
1579         machine_domain = cli_credentials_get_domain(cli_creds);
1580         machine_password = cli_credentials_get_password(cli_creds);
1581
1582         status = cli_full_connection(&cli, NULL,
1583                                      dc_name,
1584                                      NULL, 0,
1585                                      "IPC$", "IPC",
1586                                      machine_account,
1587                                      machine_domain,
1588                                      machine_password,
1589                                      flags,
1590                                      SMB_SIGNING_IPC_DEFAULT);
1591
1592         if (!NT_STATUS_IS_OK(status)) {
1593                 status = cli_full_connection(&cli, NULL,
1594                                              dc_name,
1595                                              NULL, 0,
1596                                              "IPC$", "IPC",
1597                                              "",
1598                                              NULL,
1599                                              "",
1600                                              0,
1601                                              SMB_SIGNING_IPC_DEFAULT);
1602         }
1603
1604         if (!NT_STATUS_IS_OK(status)) {
1605                 TALLOC_FREE(frame);
1606                 return status;
1607         }
1608
1609         status = rpccli_create_netlogon_creds_with_creds(cli_creds,
1610                                                          dc_name,
1611                                                          msg_ctx,
1612                                                          frame,
1613                                                          &netlogon_creds);
1614         if (!NT_STATUS_IS_OK(status)) {
1615                 cli_shutdown(cli);
1616                 TALLOC_FREE(frame);
1617                 return status;
1618         }
1619
1620         status = rpccli_setup_netlogon_creds_with_creds(cli, NCACN_NP,
1621                                                         netlogon_creds,
1622                                                         true, /* force_reauth */
1623                                                         cli_creds);
1624         if (!NT_STATUS_IS_OK(status)) {
1625                 DEBUG(0,("connect_to_domain_password_server: "
1626                          "unable to open the domain client session to "
1627                          "machine %s. Flags[0x%08X] Error was : %s.\n",
1628                          dc_name, (unsigned)netlogon_flags,
1629                          nt_errstr(status)));
1630                 cli_shutdown(cli);
1631                 TALLOC_FREE(frame);
1632                 return status;
1633         }
1634
1635         status = netlogon_creds_cli_get(netlogon_creds,
1636                                         talloc_tos(),
1637                                         &creds);
1638         if (!NT_STATUS_IS_OK(status)) {
1639                 cli_shutdown(cli);
1640                 TALLOC_FREE(frame);
1641                 return status;
1642         }
1643         netlogon_flags = creds->negotiate_flags;
1644         TALLOC_FREE(creds);
1645
1646         if (!(netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
1647                 cli_shutdown(cli);
1648                 TALLOC_FREE(frame);
1649                 return NT_STATUS_OK;
1650         }
1651
1652         status = cli_rpc_pipe_open_schannel_with_creds(
1653                 cli, &ndr_table_netlogon, NCACN_NP,
1654                 cli_creds,
1655                 netlogon_creds, &netlogon_pipe);
1656
1657         TALLOC_FREE(netlogon_pipe);
1658
1659         if (!NT_STATUS_IS_OK(status)) {
1660                 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1661                         "on netlogon pipe to server %s for domain %s. "
1662                         "Error was %s\n",
1663                         smbXcli_conn_remote_name(cli->conn),
1664                         netbios_domain_name, nt_errstr(status)));
1665                 cli_shutdown(cli);
1666                 TALLOC_FREE(frame);
1667                 return status;
1668         }
1669
1670         cli_shutdown(cli);
1671         TALLOC_FREE(frame);
1672         return NT_STATUS_OK;
1673 }
1674
1675 /****************************************************************
1676 ****************************************************************/
1677
1678 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1679                                       struct libnet_JoinCtx *r)
1680 {
1681         NTSTATUS status;
1682
1683         status = libnet_join_ok(r->in.msg_ctx,
1684                                 r->out.netbios_domain_name,
1685                                 r->in.dc_name,
1686                                 r->in.use_kerberos);
1687         if (!NT_STATUS_IS_OK(status)) {
1688                 libnet_join_set_error_string(mem_ctx, r,
1689                         "failed to verify domain membership after joining: %s",
1690                         get_friendly_nt_error_msg(status));
1691                 return WERR_NERR_SETUPNOTJOINED;
1692         }
1693
1694         return WERR_OK;
1695 }
1696
1697 /****************************************************************
1698 ****************************************************************/
1699
1700 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1701                                                     struct libnet_UnjoinCtx *r)
1702 {
1703         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1704                 return false;
1705         }
1706
1707         if (!secrets_delete_domain_sid(lp_workgroup())) {
1708                 return false;
1709         }
1710
1711         return true;
1712 }
1713
1714 /****************************************************************
1715 ****************************************************************/
1716
1717 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1718                                              struct libnet_UnjoinCtx *r)
1719 {
1720         struct cli_state *cli = NULL;
1721         struct rpc_pipe_client *pipe_hnd = NULL;
1722         struct policy_handle sam_pol, domain_pol, user_pol;
1723         NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1724         char *acct_name;
1725         uint32_t user_rid;
1726         struct lsa_String lsa_acct_name;
1727         struct samr_Ids user_rids;
1728         struct samr_Ids name_types;
1729         union samr_UserInfo *info = NULL;
1730         struct dcerpc_binding_handle *b = NULL;
1731
1732         ZERO_STRUCT(sam_pol);
1733         ZERO_STRUCT(domain_pol);
1734         ZERO_STRUCT(user_pol);
1735
1736         status = libnet_join_connect_dc_ipc(r->in.dc_name,
1737                                             r->in.admin_account,
1738                                             r->in.admin_domain,
1739                                             r->in.admin_password,
1740                                             r->in.use_kerberos,
1741                                             &cli);
1742         if (!NT_STATUS_IS_OK(status)) {
1743                 goto done;
1744         }
1745
1746         /* Open the domain */
1747
1748         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
1749                                           &pipe_hnd);
1750         if (!NT_STATUS_IS_OK(status)) {
1751                 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1752                         nt_errstr(status)));
1753                 goto done;
1754         }
1755
1756         b = pipe_hnd->binding_handle;
1757
1758         status = dcerpc_samr_Connect2(b, mem_ctx,
1759                                       pipe_hnd->desthost,
1760                                       SEC_FLAG_MAXIMUM_ALLOWED,
1761                                       &sam_pol,
1762                                       &result);
1763         if (!NT_STATUS_IS_OK(status)) {
1764                 goto done;
1765         }
1766         if (!NT_STATUS_IS_OK(result)) {
1767                 status = result;
1768                 goto done;
1769         }
1770
1771         status = dcerpc_samr_OpenDomain(b, mem_ctx,
1772                                         &sam_pol,
1773                                         SEC_FLAG_MAXIMUM_ALLOWED,
1774                                         r->in.domain_sid,
1775                                         &domain_pol,
1776                                         &result);
1777         if (!NT_STATUS_IS_OK(status)) {
1778                 goto done;
1779         }
1780         if (!NT_STATUS_IS_OK(result)) {
1781                 status = result;
1782                 goto done;
1783         }
1784
1785         /* Create domain user */
1786
1787         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1788         if (!strlower_m(acct_name)) {
1789                 status = NT_STATUS_INVALID_PARAMETER;
1790                 goto done;
1791         }
1792
1793         init_lsa_String(&lsa_acct_name, acct_name);
1794
1795         status = dcerpc_samr_LookupNames(b, mem_ctx,
1796                                          &domain_pol,
1797                                          1,
1798                                          &lsa_acct_name,
1799                                          &user_rids,
1800                                          &name_types,
1801                                          &result);
1802
1803         if (!NT_STATUS_IS_OK(status)) {
1804                 goto done;
1805         }
1806         if (!NT_STATUS_IS_OK(result)) {
1807                 status = result;
1808                 goto done;
1809         }
1810         if (user_rids.count != 1) {
1811                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1812                 goto done;
1813         }
1814         if (name_types.count != 1) {
1815                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1816                 goto done;
1817         }
1818
1819         if (name_types.ids[0] != SID_NAME_USER) {
1820                 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1821                         name_types.ids[0]));
1822                 status = NT_STATUS_INVALID_WORKSTATION;
1823                 goto done;
1824         }
1825
1826         user_rid = user_rids.ids[0];
1827
1828         /* Open handle on user */
1829
1830         status = dcerpc_samr_OpenUser(b, mem_ctx,
1831                                       &domain_pol,
1832                                       SEC_FLAG_MAXIMUM_ALLOWED,
1833                                       user_rid,
1834                                       &user_pol,
1835                                       &result);
1836         if (!NT_STATUS_IS_OK(status)) {
1837                 goto done;
1838         }
1839         if (!NT_STATUS_IS_OK(result)) {
1840                 status = result;
1841                 goto done;
1842         }
1843
1844         /* Get user info */
1845
1846         status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1847                                            &user_pol,
1848                                            16,
1849                                            &info,
1850                                            &result);
1851         if (!NT_STATUS_IS_OK(status)) {
1852                 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1853                 goto done;
1854         }
1855         if (!NT_STATUS_IS_OK(result)) {
1856                 status = result;
1857                 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1858                 goto done;
1859         }
1860
1861         /* now disable and setuser info */
1862
1863         info->info16.acct_flags |= ACB_DISABLED;
1864
1865         status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1866                                          &user_pol,
1867                                          16,
1868                                          info,
1869                                          &result);
1870         if (!NT_STATUS_IS_OK(status)) {
1871                 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1872                 goto done;
1873         }
1874         if (!NT_STATUS_IS_OK(result)) {
1875                 status = result;
1876                 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1877                 goto done;
1878         }
1879         status = result;
1880         dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1881
1882 done:
1883         if (pipe_hnd && b) {
1884                 if (is_valid_policy_hnd(&domain_pol)) {
1885                         dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1886                 }
1887                 if (is_valid_policy_hnd(&sam_pol)) {
1888                         dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1889                 }
1890                 TALLOC_FREE(pipe_hnd);
1891         }
1892
1893         if (cli) {
1894                 cli_shutdown(cli);
1895         }
1896
1897         return status;
1898 }
1899
1900 /****************************************************************
1901 ****************************************************************/
1902
1903 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1904 {
1905         WERROR werr = WERR_OK;
1906         sbcErr err;
1907         struct smbconf_ctx *ctx;
1908
1909         err = smbconf_init_reg(r, &ctx, NULL);
1910         if (!SBC_ERROR_IS_OK(err)) {
1911                 werr = WERR_SERVICE_DOES_NOT_EXIST;
1912                 goto done;
1913         }
1914
1915         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1916
1917                 err = smbconf_set_global_parameter(ctx, "security", "user");
1918                 if (!SBC_ERROR_IS_OK(err)) {
1919                         werr = WERR_SERVICE_DOES_NOT_EXIST;
1920                         goto done;
1921                 }
1922
1923                 err = smbconf_set_global_parameter(ctx, "workgroup",
1924                                                    r->in.domain_name);
1925                 if (!SBC_ERROR_IS_OK(err)) {
1926                         werr = WERR_SERVICE_DOES_NOT_EXIST;
1927                         goto done;
1928                 }
1929
1930                 smbconf_delete_global_parameter(ctx, "realm");
1931                 goto done;
1932         }
1933
1934         err = smbconf_set_global_parameter(ctx, "security", "domain");
1935         if (!SBC_ERROR_IS_OK(err)) {
1936                 werr = WERR_SERVICE_DOES_NOT_EXIST;
1937                 goto done;
1938         }
1939
1940         err = smbconf_set_global_parameter(ctx, "workgroup",
1941                                            r->out.netbios_domain_name);
1942         if (!SBC_ERROR_IS_OK(err)) {
1943                 werr = WERR_SERVICE_DOES_NOT_EXIST;
1944                 goto done;
1945         }
1946
1947         if (r->out.domain_is_ad) {
1948                 err = smbconf_set_global_parameter(ctx, "security", "ads");
1949                 if (!SBC_ERROR_IS_OK(err)) {
1950                         werr = WERR_SERVICE_DOES_NOT_EXIST;
1951                         goto done;
1952                 }
1953
1954                 err = smbconf_set_global_parameter(ctx, "realm",
1955                                                    r->out.dns_domain_name);
1956                 if (!SBC_ERROR_IS_OK(err)) {
1957                         werr = WERR_SERVICE_DOES_NOT_EXIST;
1958                         goto done;
1959                 }
1960         }
1961
1962  done:
1963         smbconf_shutdown(ctx);
1964         return werr;
1965 }
1966
1967 /****************************************************************
1968 ****************************************************************/
1969
1970 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1971 {
1972         WERROR werr = WERR_OK;
1973         sbcErr err;
1974         struct smbconf_ctx *ctx;
1975
1976         err = smbconf_init_reg(r, &ctx, NULL);
1977         if (!SBC_ERROR_IS_OK(err)) {
1978                 werr = WERR_SERVICE_DOES_NOT_EXIST;
1979                 goto done;
1980         }
1981
1982         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1983
1984                 err = smbconf_set_global_parameter(ctx, "security", "user");
1985                 if (!SBC_ERROR_IS_OK(err)) {
1986                         werr = WERR_SERVICE_DOES_NOT_EXIST;
1987                         goto done;
1988                 }
1989
1990                 err = smbconf_delete_global_parameter(ctx, "workgroup");
1991                 if (!SBC_ERROR_IS_OK(err)) {
1992                         werr = WERR_SERVICE_DOES_NOT_EXIST;
1993                         goto done;
1994                 }
1995
1996                 smbconf_delete_global_parameter(ctx, "realm");
1997         }
1998
1999  done:
2000         smbconf_shutdown(ctx);
2001         return werr;
2002 }
2003
2004 /****************************************************************
2005 ****************************************************************/
2006
2007 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
2008 {
2009         WERROR werr;
2010
2011         if (!W_ERROR_IS_OK(r->out.result)) {
2012                 return r->out.result;
2013         }
2014
2015         if (!r->in.modify_config) {
2016                 return WERR_OK;
2017         }
2018
2019         werr = do_join_modify_vals_config(r);
2020         if (!W_ERROR_IS_OK(werr)) {
2021                 return werr;
2022         }
2023
2024         lp_load_global(get_dyn_CONFIGFILE());
2025
2026         r->out.modified_config = true;
2027         r->out.result = werr;
2028
2029         return werr;
2030 }
2031
2032 /****************************************************************
2033 ****************************************************************/
2034
2035 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
2036 {
2037         WERROR werr;
2038
2039         if (!W_ERROR_IS_OK(r->out.result)) {
2040                 return r->out.result;
2041         }
2042
2043         if (!r->in.modify_config) {
2044                 return WERR_OK;
2045         }
2046
2047         werr = do_unjoin_modify_vals_config(r);
2048         if (!W_ERROR_IS_OK(werr)) {
2049                 return werr;
2050         }
2051
2052         lp_load_global(get_dyn_CONFIGFILE());
2053
2054         r->out.modified_config = true;
2055         r->out.result = werr;
2056
2057         return werr;
2058 }
2059
2060 /****************************************************************
2061 ****************************************************************/
2062
2063 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
2064                                    const char *domain_str,
2065                                    const char **domain_p,
2066                                    const char **dc_p)
2067 {
2068         char *domain = NULL;
2069         char *dc = NULL;
2070         const char *p = NULL;
2071
2072         if (!domain_str || !domain_p || !dc_p) {
2073                 return false;
2074         }
2075
2076         p = strchr_m(domain_str, '\\');
2077
2078         if (p != NULL) {
2079                 domain = talloc_strndup(mem_ctx, domain_str,
2080                                          PTR_DIFF(p, domain_str));
2081                 dc = talloc_strdup(mem_ctx, p+1);
2082                 if (!dc) {
2083                         return false;
2084                 }
2085         } else {
2086                 domain = talloc_strdup(mem_ctx, domain_str);
2087                 dc = NULL;
2088         }
2089         if (!domain) {
2090                 return false;
2091         }
2092
2093         *domain_p = domain;
2094
2095         if (!*dc_p && dc) {
2096                 *dc_p = dc;
2097         }
2098
2099         return true;
2100 }
2101
2102 /****************************************************************
2103 ****************************************************************/
2104
2105 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
2106                                          struct libnet_JoinCtx *r)
2107 {
2108         if (!r->in.domain_name) {
2109                 libnet_join_set_error_string(mem_ctx, r,
2110                         "No domain name defined");
2111                 return WERR_INVALID_PARAMETER;
2112         }
2113
2114         if (strlen(r->in.machine_name) > 15) {
2115                 libnet_join_set_error_string(mem_ctx, r,
2116                         "Our netbios name can be at most 15 chars long, "
2117                          "\"%s\" is %u chars long\n",
2118                          r->in.machine_name,
2119                          (unsigned int)strlen(r->in.machine_name));
2120                 return WERR_INVALID_PARAMETER;
2121         }
2122
2123         if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2124                                     &r->in.domain_name,
2125                                     &r->in.dc_name)) {
2126                 libnet_join_set_error_string(mem_ctx, r,
2127                         "Failed to parse domain name");
2128                 return WERR_INVALID_PARAMETER;
2129         }
2130
2131         if (!r->in.admin_domain) {
2132                 char *admin_domain = NULL;
2133                 char *admin_account = NULL;
2134                 bool ok;
2135
2136                 ok = split_domain_user(mem_ctx,
2137                                        r->in.admin_account,
2138                                        &admin_domain,
2139                                        &admin_account);
2140                 if (!ok) {
2141                         return WERR_NOT_ENOUGH_MEMORY;
2142                 }
2143
2144                 if (admin_domain != NULL) {
2145                         r->in.admin_domain = admin_domain;
2146                 } else {
2147                         r->in.admin_domain = r->in.domain_name;
2148                 }
2149                 r->in.admin_account = admin_account;
2150         }
2151
2152         if (!secrets_init()) {
2153                 libnet_join_set_error_string(mem_ctx, r,
2154                         "Unable to open secrets database");
2155                 return WERR_CAN_NOT_COMPLETE;
2156         }
2157
2158         return WERR_OK;
2159 }
2160
2161 /****************************************************************
2162 ****************************************************************/
2163
2164 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
2165 {
2166         NTSTATUS status;
2167
2168         /* Try adding dom admins to builtin\admins. Only log failures. */
2169         status = create_builtin_administrators(domain_sid);
2170         if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
2171                 DEBUG(10,("Unable to auto-add domain administrators to "
2172                           "BUILTIN\\Administrators during join because "
2173                           "winbindd must be running.\n"));
2174         } else if (!NT_STATUS_IS_OK(status)) {
2175                 DEBUG(5, ("Failed to auto-add domain administrators to "
2176                           "BUILTIN\\Administrators during join: %s\n",
2177                           nt_errstr(status)));
2178         }
2179
2180         /* Try adding dom users to builtin\users. Only log failures. */
2181         status = create_builtin_users(domain_sid);
2182         if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
2183                 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
2184                           "during join because winbindd must be running.\n"));
2185         } else if (!NT_STATUS_IS_OK(status)) {
2186                 DEBUG(5, ("Failed to auto-add domain administrators to "
2187                           "BUILTIN\\Administrators during join: %s\n",
2188                           nt_errstr(status)));
2189         }
2190 }
2191
2192 /****************************************************************
2193 ****************************************************************/
2194
2195 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
2196                                           struct libnet_JoinCtx *r)
2197 {
2198         WERROR werr;
2199
2200         if (!W_ERROR_IS_OK(r->out.result)) {
2201                 return r->out.result;
2202         }
2203
2204         werr = do_JoinConfig(r);
2205         if (!W_ERROR_IS_OK(werr)) {
2206                 return werr;
2207         }
2208
2209         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
2210                 return WERR_OK;
2211         }
2212
2213         saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
2214         if (r->out.dns_domain_name) {
2215                 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
2216         }
2217
2218 #ifdef HAVE_ADS
2219         if (r->out.domain_is_ad &&
2220             !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2221                 ADS_STATUS ads_status;
2222
2223                 ads_status  = libnet_join_post_processing_ads(mem_ctx, r);
2224                 if (!ADS_ERR_OK(ads_status)) {
2225                         return WERR_GEN_FAILURE;
2226                 }
2227         }
2228 #endif /* HAVE_ADS */
2229
2230         libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
2231
2232         return WERR_OK;
2233 }
2234
2235 /****************************************************************
2236 ****************************************************************/
2237
2238 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
2239 {
2240         if (r->in.ads) {
2241                 ads_destroy(&r->in.ads);
2242         }
2243
2244         return 0;
2245 }
2246
2247 /****************************************************************
2248 ****************************************************************/
2249
2250 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
2251 {
2252         if (r->in.ads) {
2253                 ads_destroy(&r->in.ads);
2254         }
2255
2256         return 0;
2257 }
2258
2259 /****************************************************************
2260 ****************************************************************/
2261
2262 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
2263                            struct libnet_JoinCtx **r)
2264 {
2265         struct libnet_JoinCtx *ctx;
2266
2267         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
2268         if (!ctx) {
2269                 return WERR_NOT_ENOUGH_MEMORY;
2270         }
2271
2272         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
2273
2274         ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
2275         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
2276
2277         ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
2278
2279         ctx->in.desired_encryption_types = ENC_CRC32 |
2280                                            ENC_RSA_MD5 |
2281                                            ENC_RC4_HMAC_MD5;
2282 #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
2283         ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES128;
2284 #endif
2285 #ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
2286         ctx->in.desired_encryption_types |= ENC_HMAC_SHA1_96_AES256;
2287 #endif
2288
2289         *r = ctx;
2290
2291         return WERR_OK;
2292 }
2293
2294 /****************************************************************
2295 ****************************************************************/
2296
2297 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
2298                              struct libnet_UnjoinCtx **r)
2299 {
2300         struct libnet_UnjoinCtx *ctx;
2301
2302         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
2303         if (!ctx) {
2304                 return WERR_NOT_ENOUGH_MEMORY;
2305         }
2306
2307         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
2308
2309         ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
2310         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
2311
2312         *r = ctx;
2313
2314         return WERR_OK;
2315 }
2316
2317 /****************************************************************
2318 ****************************************************************/
2319
2320 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
2321                                        struct libnet_JoinCtx *r)
2322 {
2323         bool valid_security = false;
2324         bool valid_workgroup = false;
2325         bool valid_realm = false;
2326         bool ignored_realm = false;
2327
2328         /* check if configuration is already set correctly */
2329
2330         valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
2331
2332         switch (r->out.domain_is_ad) {
2333                 case false:
2334                         valid_security = (lp_security() == SEC_DOMAIN)
2335                                 || (lp_server_role() == ROLE_DOMAIN_PDC)
2336                                 || (lp_server_role() == ROLE_DOMAIN_BDC);
2337                         if (valid_workgroup && valid_security) {
2338                                 /* nothing to be done */
2339                                 return WERR_OK;
2340                         }
2341                         break;
2342                 case true:
2343                         valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
2344                         switch (lp_security()) {
2345                         case SEC_DOMAIN:
2346                                 if (!valid_realm && lp_winbind_rpc_only()) {
2347                                         valid_realm = true;
2348                                         ignored_realm = true;
2349                                 }
2350                                 /* FALL THROUGH */
2351                         case SEC_ADS:
2352                                 valid_security = true;
2353                         }
2354
2355                         if (valid_workgroup && valid_realm && valid_security) {
2356                                 if (ignored_realm && !r->in.modify_config)
2357                                 {
2358                                         libnet_join_set_error_string(mem_ctx, r,
2359                                                 "Warning: ignoring realm when "
2360                                                 "joining AD domain with "
2361                                                 "'security=domain' and "
2362                                                 "'winbind rpc only = yes'. "
2363                                                 "(realm set to '%s', "
2364                                                 "should be '%s').", lp_realm(),
2365                                                 r->out.dns_domain_name);
2366                                 }
2367                                 /* nothing to be done */
2368                                 return WERR_OK;
2369                         }
2370                         break;
2371         }
2372
2373         /* check if we are supposed to manipulate configuration */
2374
2375         if (!r->in.modify_config) {
2376
2377                 char *wrong_conf = talloc_strdup(mem_ctx, "");
2378
2379                 if (!valid_workgroup) {
2380                         wrong_conf = talloc_asprintf_append(wrong_conf,
2381                                 "\"workgroup\" set to '%s', should be '%s'",
2382                                 lp_workgroup(), r->out.netbios_domain_name);
2383                         W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2384                 }
2385
2386                 if (!valid_realm) {
2387                         wrong_conf = talloc_asprintf_append(wrong_conf,
2388                                 "\"realm\" set to '%s', should be '%s'",
2389                                 lp_realm(), r->out.dns_domain_name);
2390                         W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2391                 }
2392
2393                 if (!valid_security) {
2394                         const char *sec = NULL;
2395                         switch (lp_security()) {
2396                         case SEC_USER:  sec = "user"; break;
2397                         case SEC_DOMAIN: sec = "domain"; break;
2398                         case SEC_ADS: sec = "ads"; break;
2399                         }
2400                         wrong_conf = talloc_asprintf_append(wrong_conf,
2401                                 "\"security\" set to '%s', should be %s",
2402                                 sec, r->out.domain_is_ad ?
2403                                 "either 'domain' or 'ads'" : "'domain'");
2404                         W_ERROR_HAVE_NO_MEMORY(wrong_conf);
2405                 }
2406
2407                 libnet_join_set_error_string(mem_ctx, r,
2408                         "Invalid configuration (%s) and configuration modification "
2409                         "was not requested", wrong_conf);
2410                 return WERR_CAN_NOT_COMPLETE;
2411         }
2412
2413         /* check if we are able to manipulate configuration */
2414
2415         if (!lp_config_backend_is_registry()) {
2416                 libnet_join_set_error_string(mem_ctx, r,
2417                         "Configuration manipulation requested but not "
2418                         "supported by backend");
2419                 return WERR_NOT_SUPPORTED;
2420         }
2421
2422         return WERR_OK;
2423 }
2424
2425 /****************************************************************
2426 ****************************************************************/
2427
2428 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
2429                                 struct libnet_JoinCtx *r)
2430 {
2431         NTSTATUS status;
2432         WERROR werr;
2433         struct cli_state *cli = NULL;
2434 #ifdef HAVE_ADS
2435         ADS_STATUS ads_status;
2436 #endif /* HAVE_ADS */
2437         const char *pre_connect_realm = NULL;
2438         const char *numeric_dcip = NULL;
2439         const char *sitename = NULL;
2440
2441         /* Before contacting a DC, we can securely know
2442          * the realm only if the user specifies it.
2443          */
2444         if (r->in.use_kerberos &&
2445             r->in.domain_name_type == JoinDomNameTypeDNS) {
2446                 pre_connect_realm = r->in.domain_name;
2447         }
2448
2449         if (!r->in.dc_name) {
2450                 struct netr_DsRGetDCNameInfo *info;
2451                 const char *dc;
2452                 uint32_t name_type_flags = 0;
2453                 if (r->in.domain_name_type == JoinDomNameTypeDNS) {
2454                         name_type_flags = DS_IS_DNS_NAME;
2455                 } else if (r->in.domain_name_type == JoinDomNameTypeNBT) {
2456                         name_type_flags = DS_IS_FLAT_NAME;
2457                 }
2458                 status = dsgetdcname(mem_ctx,
2459                                      r->in.msg_ctx,
2460                                      r->in.domain_name,
2461                                      NULL,
2462                                      NULL,
2463                                      DS_FORCE_REDISCOVERY |
2464                                      DS_DIRECTORY_SERVICE_REQUIRED |
2465                                      DS_WRITABLE_REQUIRED |
2466                                      DS_RETURN_DNS_NAME |
2467                                      name_type_flags,
2468                                      &info);
2469                 if (!NT_STATUS_IS_OK(status)) {
2470                         libnet_join_set_error_string(mem_ctx, r,
2471                                 "failed to find DC for domain %s - %s",
2472                                 r->in.domain_name,
2473                                 get_friendly_nt_error_msg(status));
2474                         return WERR_NERR_DCNOTFOUND;
2475                 }
2476
2477                 dc = strip_hostname(info->dc_unc);
2478                 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2479                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2480
2481                 if (info->dc_address == NULL || info->dc_address[0] != '\\' ||
2482                     info->dc_address[1] != '\\') {
2483                         DBG_ERR("ill-formed DC address '%s'\n",
2484                                 info->dc_address);
2485                         return WERR_NERR_DCNOTFOUND;
2486                 }
2487
2488                 numeric_dcip = info->dc_address + 2;
2489                 sitename = info->dc_site_name;
2490                 /* info goes out of scope but the memory stays
2491                    allocated on the talloc context */
2492         }
2493
2494         if (pre_connect_realm != NULL) {
2495                 struct sockaddr_storage ss = {0};
2496
2497                 if (numeric_dcip != NULL) {
2498                         if (!interpret_string_addr(&ss, numeric_dcip,
2499                                                    AI_NUMERICHOST)) {
2500                                 DBG_ERR(
2501                                     "cannot parse IP address '%s' of DC '%s'\n",
2502                                     numeric_dcip, r->in.dc_name);
2503                                 return WERR_NERR_DCNOTFOUND;
2504                         }
2505                 } else {
2506                         if (!interpret_string_addr(&ss, r->in.dc_name, 0)) {
2507                                 DBG_WARNING(
2508                                     "cannot resolve IP address of DC '%s'\n",
2509                                     r->in.dc_name);
2510                                 return WERR_NERR_DCNOTFOUND;
2511                         }
2512                 }
2513
2514                 /* The domain parameter is only used as modifier
2515                  * to krb5.conf file name. .JOIN is is not a valid
2516                  * NetBIOS name so it cannot clash with another domain
2517                  * -- Uri.
2518                  */
2519                 create_local_private_krb5_conf_for_domain(
2520                     pre_connect_realm, ".JOIN", sitename, &ss);
2521         }
2522
2523         status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
2524         if (!NT_STATUS_IS_OK(status)) {
2525                 libnet_join_set_error_string(mem_ctx, r,
2526                         "failed to lookup DC info for domain '%s' over rpc: %s",
2527                         r->in.domain_name, get_friendly_nt_error_msg(status));
2528                 return ntstatus_to_werror(status);
2529         }
2530
2531         werr = libnet_join_check_config(mem_ctx, r);
2532         if (!W_ERROR_IS_OK(werr)) {
2533                 goto done;
2534         }
2535
2536 #ifdef HAVE_ADS
2537
2538         if (r->out.domain_is_ad) {
2539                 create_local_private_krb5_conf_for_domain(
2540                         r->out.dns_domain_name, r->out.netbios_domain_name,
2541                         sitename, smbXcli_conn_remote_sockaddr(cli->conn));
2542         }
2543
2544         if (r->out.domain_is_ad &&
2545             !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2546
2547                 const char *initial_account_ou = r->in.account_ou;
2548
2549                 /*
2550                  * we want to create the msDS-SupportedEncryptionTypes attribute
2551                  * as early as possible so always try an LDAP create as the user
2552                  * first. We copy r->in.account_ou because it may be changed
2553                  * during the machine pre-creation.
2554                  */
2555
2556                 ads_status = libnet_join_connect_ads_user(mem_ctx, r);
2557                 if (!ADS_ERR_OK(ads_status)) {
2558                         return WERR_DEFAULT_JOIN_REQUIRED;
2559                 }
2560
2561                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
2562                 if (ADS_ERR_OK(ads_status)) {
2563
2564                         /*
2565                          * LDAP object create succeeded, now go to the rpc
2566                          * password set routines
2567                          */
2568
2569                         r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
2570                         goto rpc_join;
2571                 }
2572
2573                 if (initial_account_ou != NULL) {
2574                         libnet_join_set_error_string(mem_ctx, r,
2575                                 "failed to precreate account in ou %s: %s",
2576                                 r->in.account_ou,
2577                                 ads_errstr(ads_status));
2578                         return WERR_DEFAULT_JOIN_REQUIRED;
2579                 }
2580
2581                 DEBUG(5, ("failed to precreate account in ou %s: %s",
2582                         r->in.account_ou, ads_errstr(ads_status)));
2583         }
2584 #endif /* HAVE_ADS */
2585
2586  rpc_join:
2587         if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2588             (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2589                 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2590         } else {
2591                 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2592         }
2593         if (!NT_STATUS_IS_OK(status)) {
2594                 libnet_join_set_error_string(mem_ctx, r,
2595                         "failed to join domain '%s' over rpc: %s",
2596                         r->in.domain_name, get_friendly_nt_error_msg(status));
2597                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2598                         return WERR_NERR_SETUPALREADYJOINED;
2599                 }
2600                 werr = ntstatus_to_werror(status);
2601                 goto done;
2602         }
2603
2604         if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2605                 werr = WERR_NERR_SETUPNOTJOINED;
2606                 goto done;
2607         }
2608
2609         werr = WERR_OK;
2610
2611  done:
2612         if (cli) {
2613                 cli_shutdown(cli);
2614         }
2615
2616         return werr;
2617 }
2618
2619 /****************************************************************
2620 ****************************************************************/
2621
2622 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2623                                    struct libnet_JoinCtx *r)
2624 {
2625         WERROR werr;
2626         struct libnet_UnjoinCtx *u = NULL;
2627
2628         werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2629         if (!W_ERROR_IS_OK(werr)) {
2630                 return werr;
2631         }
2632
2633         u->in.debug             = r->in.debug;
2634         u->in.dc_name           = r->in.dc_name;
2635         u->in.domain_name       = r->in.domain_name;
2636         u->in.admin_account     = r->in.admin_account;
2637         u->in.admin_password    = r->in.admin_password;
2638         u->in.modify_config     = r->in.modify_config;
2639         u->in.use_kerberos      = r->in.use_kerberos;
2640         u->in.unjoin_flags      = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
2641                                   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2642
2643         werr = libnet_Unjoin(mem_ctx, u);
2644         TALLOC_FREE(u);
2645
2646         return werr;
2647 }
2648
2649 /****************************************************************
2650 ****************************************************************/
2651
2652 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2653                    struct libnet_JoinCtx *r)
2654 {
2655         WERROR werr;
2656
2657         if (r->in.debug) {
2658                 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2659         }
2660
2661         ZERO_STRUCT(r->out);
2662
2663         werr = libnet_join_pre_processing(mem_ctx, r);
2664         if (!W_ERROR_IS_OK(werr)) {
2665                 goto done;
2666         }
2667
2668         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2669                 werr = libnet_DomainJoin(mem_ctx, r);
2670                 if (!W_ERROR_IS_OK(werr)) {
2671                         goto done;
2672                 }
2673         }
2674
2675         werr = libnet_join_post_processing(mem_ctx, r);
2676         if (!W_ERROR_IS_OK(werr)) {
2677                 goto done;
2678         }
2679
2680         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2681                 werr = libnet_join_post_verify(mem_ctx, r);
2682                 if (!W_ERROR_IS_OK(werr)) {
2683                         libnet_join_rollback(mem_ctx, r);
2684                 }
2685         }
2686
2687  done:
2688         r->out.result = werr;
2689
2690         if (r->in.debug) {
2691                 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2692         }
2693         return werr;
2694 }
2695
2696 /****************************************************************
2697 ****************************************************************/
2698
2699 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2700                                   struct libnet_UnjoinCtx *r)
2701 {
2702         NTSTATUS status;
2703
2704         if (!r->in.domain_sid) {
2705                 struct dom_sid sid;
2706                 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2707                         libnet_unjoin_set_error_string(mem_ctx, r,
2708                                 "Unable to fetch domain sid: are we joined?");
2709                         return WERR_NERR_SETUPNOTJOINED;
2710                 }
2711                 r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2712                 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2713         }
2714
2715         if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2716             !r->in.delete_machine_account) {
2717                 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2718                 return WERR_OK;
2719         }
2720
2721         if (!r->in.dc_name) {
2722                 struct netr_DsRGetDCNameInfo *info;
2723                 const char *dc;
2724                 status = dsgetdcname(mem_ctx,
2725                                      r->in.msg_ctx,
2726                                      r->in.domain_name,
2727                                      NULL,
2728                                      NULL,
2729                                      DS_DIRECTORY_SERVICE_REQUIRED |
2730                                      DS_WRITABLE_REQUIRED |
2731                                      DS_RETURN_DNS_NAME,
2732                                      &info);
2733                 if (!NT_STATUS_IS_OK(status)) {
2734                         libnet_unjoin_set_error_string(mem_ctx, r,
2735                                 "failed to find DC for domain %s - %s",
2736                                 r->in.domain_name,
2737                                 get_friendly_nt_error_msg(status));
2738                         return WERR_NERR_DCNOTFOUND;
2739                 }
2740
2741                 dc = strip_hostname(info->dc_unc);
2742                 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2743                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2744         }
2745
2746 #ifdef HAVE_ADS
2747         /* for net ads leave, try to delete the account.  If it works,
2748            no sense in disabling.  If it fails, we can still try to
2749            disable it. jmcd */
2750
2751         if (r->in.delete_machine_account) {
2752                 ADS_STATUS ads_status;
2753                 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2754                 if (ADS_ERR_OK(ads_status)) {
2755                         /* dirty hack */
2756                         r->out.dns_domain_name =
2757                                 talloc_strdup(mem_ctx,
2758                                               r->in.ads->server.realm);
2759                         ads_status =
2760                                 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2761                 }
2762                 if (!ADS_ERR_OK(ads_status)) {
2763                         libnet_unjoin_set_error_string(mem_ctx, r,
2764                                 "failed to remove machine account from AD: %s",
2765                                 ads_errstr(ads_status));
2766                 } else {
2767                         r->out.deleted_machine_account = true;
2768                         W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2769                         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2770                         return WERR_OK;
2771                 }
2772         }
2773 #endif /* HAVE_ADS */
2774
2775         /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2776            "disable".  */
2777         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2778                 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2779                 if (!NT_STATUS_IS_OK(status)) {
2780                         libnet_unjoin_set_error_string(mem_ctx, r,
2781                                 "failed to disable machine account via rpc: %s",
2782                                 get_friendly_nt_error_msg(status));
2783                         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2784                                 return WERR_NERR_SETUPNOTJOINED;
2785                         }
2786                         return ntstatus_to_werror(status);
2787                 }
2788
2789                 r->out.disabled_machine_account = true;
2790         }
2791
2792         /* If disable succeeded or was not requested at all, we
2793            should be getting rid of our end of things */
2794
2795         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2796
2797         return WERR_OK;
2798 }
2799
2800 /****************************************************************
2801 ****************************************************************/
2802
2803 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2804                                            struct libnet_UnjoinCtx *r)
2805 {
2806         if (!r->in.domain_name) {
2807                 libnet_unjoin_set_error_string(mem_ctx, r,
2808                         "No domain name defined");
2809                 return WERR_INVALID_PARAMETER;
2810         }
2811
2812         if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2813                                     &r->in.domain_name,
2814                                     &r->in.dc_name)) {
2815                 libnet_unjoin_set_error_string(mem_ctx, r,
2816                         "Failed to parse domain name");
2817                 return WERR_INVALID_PARAMETER;
2818         }
2819
2820         if (IS_DC) {
2821                 return WERR_NERR_SETUPDOMAINCONTROLLER;
2822         }
2823
2824         if (!r->in.admin_domain) {
2825                 char *admin_domain = NULL;
2826                 char *admin_account = NULL;
2827                 bool ok;
2828
2829                 ok = split_domain_user(mem_ctx,
2830                                        r->in.admin_account,
2831                                        &admin_domain,
2832                                        &admin_account);
2833                 if (!ok) {
2834                         return WERR_NOT_ENOUGH_MEMORY;
2835                 }
2836
2837                 if (admin_domain != NULL) {
2838                         r->in.admin_domain = admin_domain;
2839                 } else {
2840                         r->in.admin_domain = r->in.domain_name;
2841                 }
2842                 r->in.admin_account = admin_account;
2843         }
2844
2845         if (!secrets_init()) {
2846                 libnet_unjoin_set_error_string(mem_ctx, r,
2847                         "Unable to open secrets database");
2848                 return WERR_CAN_NOT_COMPLETE;
2849         }
2850
2851         return WERR_OK;
2852 }
2853
2854 /****************************************************************
2855 ****************************************************************/
2856
2857 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2858                                             struct libnet_UnjoinCtx *r)
2859 {
2860         saf_delete(r->out.netbios_domain_name);
2861         saf_delete(r->out.dns_domain_name);
2862
2863         return libnet_unjoin_config(r);
2864 }
2865
2866 /****************************************************************
2867 ****************************************************************/
2868
2869 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2870                      struct libnet_UnjoinCtx *r)
2871 {
2872         WERROR werr;
2873
2874         if (r->in.debug) {
2875                 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2876         }
2877
2878         werr = libnet_unjoin_pre_processing(mem_ctx, r);
2879         if (!W_ERROR_IS_OK(werr)) {
2880                 goto done;
2881         }
2882
2883         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2884                 werr = libnet_DomainUnjoin(mem_ctx, r);
2885                 if (!W_ERROR_IS_OK(werr)) {
2886                         libnet_unjoin_config(r);
2887                         goto done;
2888                 }
2889         }
2890
2891         werr = libnet_unjoin_post_processing(mem_ctx, r);
2892         if (!W_ERROR_IS_OK(werr)) {
2893                 goto done;
2894         }
2895
2896  done:
2897         r->out.result = werr;
2898
2899         if (r->in.debug) {
2900                 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2901         }
2902
2903         return werr;
2904 }