2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher <metze@samba.org> 2006
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "libnet/libnet.h"
22 #include "libcli/composite/composite.h"
23 #include "libcli/cldap/cldap.h"
24 #include "lib/ldb/include/ldb.h"
25 #include "lib/ldb/include/ldb_errors.h"
26 #include "lib/ldb_wrap.h"
27 #include "dsdb/samdb/samdb.h"
28 #include "dsdb/common/flags.h"
29 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
30 #include "param/param.h"
32 /*****************************************************************************
33 * Windows 2003 (w2k3) does the following steps when changing the server role
34 * from domain controller back to domain member
36 * We mostly do the same.
37 *****************************************************************************/
41 * - using nbt name<1C> request and a samlogon mailslot request
43 * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
45 * see: unbecomeDC_send_cldap() and unbecomeDC_recv_cldap()
49 * Open 1st LDAP connection to the DC using admin credentials
51 * see: unbecomeDC_ldap_connect()
55 * LDAP search 1st LDAP connection:
57 * see: unbecomeDC_ldap_rootdse()
62 * filter: (objectClass=*)
63 * attrs: defaultNamingContext
64 * configurationNamingContext
67 * defaultNamingContext: <domain_partition>
68 * configurationNamingContext:CN=Configuration,<domain_partition>
72 * LDAP search 1st LDAP connection:
74 * see: unbecomeDC_ldap_computer_object()
77 * basedn: <domain_partition>
79 * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
80 * attrs: distinguishedName
83 * CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition>
84 * distinguishedName: CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition>
85 * userAccoountControl: 532480 <0x82000>
89 * LDAP search 1st LDAP connection:
91 * see: unbecomeDC_ldap_modify_computer()
94 * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
96 * filter: (objectClass=*)
97 * attrs: userAccountControl
99 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
100 * userAccoountControl: 532480 <0x82000>
104 * LDAP modify 1st LDAP connection:
106 * see: unbecomeDC_ldap_modify_computer()
109 * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
110 * userAccoountControl: 4096 <0x1000>
116 * LDAP search 1st LDAP connection:
118 * see: unbecomeDC_ldap_move_computer()
121 * basedn: <WKGUID=aa312825768811d1aded00c04fd8d5cd,<domain_partition>>
123 * filter: (objectClass=*)
126 * CN=Computers,<domain_partition>
130 * LDAP search 1st LDAP connection:
132 * not implemented because it doesn't give any new information
135 * basedn: CN=Computers,<domain_partition>
137 * filter: (objectClass=*)
138 * attrs: distinguishedName
140 * CN=Computers,<domain_partition>
141 * distinguishedName: CN=Computers,<domain_partition>
145 * LDAP modifyRDN 1st LDAP connection:
147 * see: unbecomeDC_ldap_move_computer()
150 * entry: CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition>
151 * newrdn: CN=<new_dc_netbios_name>
153 * newparent: CN=Computers,<domain_partition>
159 * LDAP unbind on the 1st LDAP connection
161 * not implemented, because it's not needed...
165 * Open 1st DRSUAPI connection to the DC using admin credentials
166 * DsBind with DRSUAPI_DS_BIND_GUID ("e24d201a-4fd6-11d1-a3da-0000f875ae0d")
168 * see: unbecomeDC_drsuapi_connect_send(), unbecomeDC_drsuapi_connect_recv(),
169 * unbecomeDC_drsuapi_bind_send() and unbecomeDC_drsuapi_bind_recv()
173 * DsRemoveDsServer to remove the
174 * CN=<machine_name>,CN=Servers,CN=<site_name>,CN=Configuration,<domain_partition>
175 * and CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=<site_name>,CN=Configuration,<domain_partition>
176 * on the 1st DRSUAPI connection
178 * see: unbecomeDC_drsuapi_remove_ds_server_send() and unbecomeDC_drsuapi_remove_ds_server_recv()
182 * DsUnbind on the 1st DRSUAPI connection
184 * not implemented, because it's not needed...
188 struct libnet_UnbecomeDC_state {
189 struct composite_context *creq;
191 struct libnet_context *libnet;
194 struct cldap_socket *sock;
195 struct cldap_netlogon io;
196 struct nbt_cldap_netlogon_5 netlogon5;
200 struct ldb_context *ldb;
204 struct dcerpc_binding *binding;
205 struct dcerpc_pipe *pipe;
206 struct drsuapi_DsBind bind_r;
207 struct GUID bind_guid;
208 struct drsuapi_DsBindInfoCtr bind_info_ctr;
209 struct drsuapi_DsBindInfo28 local_info28;
210 struct drsuapi_DsBindInfo28 remote_info28;
211 struct policy_handle bind_handle;
212 struct drsuapi_DsRemoveDSServer rm_ds_srv_r;
217 const char *dns_name;
218 const char *netbios_name;
227 const char *config_dn_str;
235 const char *dns_name;
236 const char *netbios_name;
237 const char *site_name;
242 const char *netbios_name;
245 const char *dns_name;
246 const char *site_name;
247 const char *computer_dn_str;
248 const char *server_dn_str;
249 uint32_t user_account_control;
253 static void unbecomeDC_recv_cldap(struct cldap_request *req);
255 static void unbecomeDC_send_cldap(struct libnet_UnbecomeDC_state *s)
257 struct composite_context *c = s->creq;
258 struct cldap_request *req;
260 s->cldap.io.in.dest_address = s->source_dsa.address;
261 s->cldap.io.in.dest_port = lp_cldap_port(s->libnet->lp_ctx);
262 s->cldap.io.in.realm = s->domain.dns_name;
263 s->cldap.io.in.host = s->dest_dsa.netbios_name;
264 s->cldap.io.in.user = NULL;
265 s->cldap.io.in.domain_guid = NULL;
266 s->cldap.io.in.domain_sid = NULL;
267 s->cldap.io.in.acct_control = -1;
268 s->cldap.io.in.version = 6;
270 s->cldap.sock = cldap_socket_init(s, s->libnet->event_ctx,
271 lp_iconv_convenience(s->libnet->lp_ctx));
272 if (composite_nomem(s->cldap.sock, c)) return;
274 req = cldap_netlogon_send(s->cldap.sock, &s->cldap.io);
275 if (composite_nomem(req, c)) return;
276 req->async.fn = unbecomeDC_recv_cldap;
277 req->async.private = s;
280 static void unbecomeDC_connect_ldap(struct libnet_UnbecomeDC_state *s);
282 static void unbecomeDC_recv_cldap(struct cldap_request *req)
284 struct libnet_UnbecomeDC_state *s = talloc_get_type(req->async.private,
285 struct libnet_UnbecomeDC_state);
286 struct composite_context *c = s->creq;
288 c->status = cldap_netlogon_recv(req, s, &s->cldap.io);
289 if (!composite_is_ok(c)) return;
291 s->cldap.netlogon5 = s->cldap.io.out.netlogon.logon5;
293 s->domain.dns_name = s->cldap.netlogon5.dns_domain;
294 s->domain.netbios_name = s->cldap.netlogon5.domain;
295 s->domain.guid = s->cldap.netlogon5.domain_uuid;
297 s->source_dsa.dns_name = s->cldap.netlogon5.pdc_dns_name;
298 s->source_dsa.netbios_name = s->cldap.netlogon5.pdc_name;
299 s->source_dsa.site_name = s->cldap.netlogon5.server_site;
301 s->dest_dsa.site_name = s->cldap.netlogon5.client_site;
303 unbecomeDC_connect_ldap(s);
306 static NTSTATUS unbecomeDC_ldap_connect(struct libnet_UnbecomeDC_state *s)
310 url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name);
311 NT_STATUS_HAVE_NO_MEMORY(url);
313 s->ldap.ldb = ldb_wrap_connect(s, s->libnet->lp_ctx, url,
318 if (s->ldap.ldb == NULL) {
319 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
325 static NTSTATUS unbecomeDC_ldap_rootdse(struct libnet_UnbecomeDC_state *s)
328 struct ldb_result *r;
329 struct ldb_dn *basedn;
330 static const char *attrs[] = {
331 "defaultNamingContext",
332 "configurationNamingContext",
336 basedn = ldb_dn_new(s, s->ldap.ldb, NULL);
337 NT_STATUS_HAVE_NO_MEMORY(basedn);
339 ret = ldb_search(s->ldap.ldb, basedn, LDB_SCOPE_BASE,
340 "(objectClass=*)", attrs, &r);
342 if (ret != LDB_SUCCESS) {
343 return NT_STATUS_LDAP(ret);
344 } else if (r->count != 1) {
346 return NT_STATUS_INVALID_NETWORK_RESPONSE;
350 s->domain.dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "defaultNamingContext", NULL);
351 if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
352 talloc_steal(s, s->domain.dn_str);
354 s->forest.config_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "configurationNamingContext", NULL);
355 if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
356 talloc_steal(s, s->forest.config_dn_str);
358 s->dest_dsa.server_dn_str = talloc_asprintf(s, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
359 s->dest_dsa.netbios_name,
360 s->dest_dsa.site_name,
361 s->forest.config_dn_str);
362 NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.server_dn_str);
368 static NTSTATUS unbecomeDC_ldap_computer_object(struct libnet_UnbecomeDC_state *s)
371 struct ldb_result *r;
372 struct ldb_dn *basedn;
374 static const char *attrs[] = {
376 "userAccountControl",
380 basedn = ldb_dn_new(s, s->ldap.ldb, s->domain.dn_str);
381 NT_STATUS_HAVE_NO_MEMORY(basedn);
383 filter = talloc_asprintf(basedn, "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))",
384 s->dest_dsa.netbios_name);
385 NT_STATUS_HAVE_NO_MEMORY(filter);
387 ret = ldb_search(s->ldap.ldb, basedn, LDB_SCOPE_SUBTREE,
390 if (ret != LDB_SUCCESS) {
391 return NT_STATUS_LDAP(ret);
392 } else if (r->count != 1) {
394 return NT_STATUS_INVALID_NETWORK_RESPONSE;
397 s->dest_dsa.computer_dn_str = samdb_result_string(r->msgs[0], "distinguishedName", NULL);
398 if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE;
399 talloc_steal(s, s->dest_dsa.computer_dn_str);
401 s->dest_dsa.user_account_control = samdb_result_uint(r->msgs[0], "userAccountControl", 0);
407 static NTSTATUS unbecomeDC_ldap_modify_computer(struct libnet_UnbecomeDC_state *s)
410 struct ldb_message *msg;
411 uint32_t user_account_control = UF_WORKSTATION_TRUST_ACCOUNT;
414 /* as the value is already as we want it to be, we're done */
415 if (s->dest_dsa.user_account_control == user_account_control) {
419 /* make a 'modify' msg, and only for serverReference */
420 msg = ldb_msg_new(s);
421 NT_STATUS_HAVE_NO_MEMORY(msg);
422 msg->dn = ldb_dn_new(msg, s->ldap.ldb, s->dest_dsa.computer_dn_str);
423 NT_STATUS_HAVE_NO_MEMORY(msg->dn);
425 ret = ldb_msg_add_fmt(msg, "userAccountControl", "%u", user_account_control);
428 return NT_STATUS_NO_MEMORY;
431 /* mark all the message elements (should be just one)
432 as LDB_FLAG_MOD_REPLACE */
433 for (i=0;i<msg->num_elements;i++) {
434 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
437 ret = ldb_modify(s->ldap.ldb, msg);
439 if (ret != LDB_SUCCESS) {
440 return NT_STATUS_LDAP(ret);
443 s->dest_dsa.user_account_control = user_account_control;
448 static NTSTATUS unbecomeDC_ldap_move_computer(struct libnet_UnbecomeDC_state *s)
451 struct ldb_result *r;
452 struct ldb_dn *basedn;
453 struct ldb_dn *old_dn;
454 struct ldb_dn *new_dn;
455 static const char *_1_1_attrs[] = {
460 basedn = ldb_dn_new_fmt(s, s->ldap.ldb, "<WKGUID=aa312825768811d1aded00c04fd8d5cd,%s>",
462 NT_STATUS_HAVE_NO_MEMORY(basedn);
464 ret = ldb_search(s->ldap.ldb, basedn, LDB_SCOPE_BASE,
465 "(objectClass=*)", _1_1_attrs, &r);
467 if (ret != LDB_SUCCESS) {
468 return NT_STATUS_LDAP(ret);
469 } else if (r->count != 1) {
471 return NT_STATUS_INVALID_NETWORK_RESPONSE;
474 old_dn = ldb_dn_new(r, s->ldap.ldb, s->dest_dsa.computer_dn_str);
475 NT_STATUS_HAVE_NO_MEMORY(old_dn);
477 new_dn = r->msgs[0]->dn;
479 if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) {
481 return NT_STATUS_NO_MEMORY;
484 if (ldb_dn_compare(old_dn, new_dn) == 0) {
485 /* we don't need to rename if the old and new dn match */
490 ret = ldb_rename(s->ldap.ldb, old_dn, new_dn);
491 if (ret != LDB_SUCCESS) {
493 return NT_STATUS_LDAP(ret);
496 s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn);
497 NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str);
504 static void unbecomeDC_drsuapi_connect_send(struct libnet_UnbecomeDC_state *s);
506 static void unbecomeDC_connect_ldap(struct libnet_UnbecomeDC_state *s)
508 struct composite_context *c = s->creq;
510 c->status = unbecomeDC_ldap_connect(s);
511 if (!composite_is_ok(c)) return;
513 c->status = unbecomeDC_ldap_rootdse(s);
514 if (!composite_is_ok(c)) return;
516 c->status = unbecomeDC_ldap_computer_object(s);
517 if (!composite_is_ok(c)) return;
519 c->status = unbecomeDC_ldap_modify_computer(s);
520 if (!composite_is_ok(c)) return;
522 c->status = unbecomeDC_ldap_move_computer(s);
523 if (!composite_is_ok(c)) return;
525 unbecomeDC_drsuapi_connect_send(s);
528 static void unbecomeDC_drsuapi_connect_recv(struct composite_context *creq);
530 static void unbecomeDC_drsuapi_connect_send(struct libnet_UnbecomeDC_state *s)
532 struct composite_context *c = s->creq;
533 struct composite_context *creq;
536 binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[seal]", s->source_dsa.dns_name);
537 if (composite_nomem(binding_str, c)) return;
539 c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi.binding);
540 talloc_free(binding_str);
541 if (!composite_is_ok(c)) return;
543 creq = dcerpc_pipe_connect_b_send(s, s->drsuapi.binding, &ndr_table_drsuapi,
544 s->libnet->cred, s->libnet->event_ctx,
546 composite_continue(c, creq, unbecomeDC_drsuapi_connect_recv, s);
549 static void unbecomeDC_drsuapi_bind_send(struct libnet_UnbecomeDC_state *s);
551 static void unbecomeDC_drsuapi_connect_recv(struct composite_context *req)
553 struct libnet_UnbecomeDC_state *s = talloc_get_type(req->async.private_data,
554 struct libnet_UnbecomeDC_state);
555 struct composite_context *c = s->creq;
557 c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi.pipe);
558 if (!composite_is_ok(c)) return;
560 unbecomeDC_drsuapi_bind_send(s);
563 static void unbecomeDC_drsuapi_bind_recv(struct rpc_request *req);
565 static void unbecomeDC_drsuapi_bind_send(struct libnet_UnbecomeDC_state *s)
567 struct composite_context *c = s->creq;
568 struct rpc_request *req;
569 struct drsuapi_DsBindInfo28 *bind_info28;
571 GUID_from_string(DRSUAPI_DS_BIND_GUID, &s->drsuapi.bind_guid);
573 bind_info28 = &s->drsuapi.local_info28;
574 bind_info28->supported_extensions = 0;
575 bind_info28->site_guid = GUID_zero();
576 bind_info28->u1 = 508;
577 bind_info28->repl_epoch = 0;
579 s->drsuapi.bind_info_ctr.length = 28;
580 s->drsuapi.bind_info_ctr.info.info28 = *bind_info28;
582 s->drsuapi.bind_r.in.bind_guid = &s->drsuapi.bind_guid;
583 s->drsuapi.bind_r.in.bind_info = &s->drsuapi.bind_info_ctr;
584 s->drsuapi.bind_r.out.bind_handle = &s->drsuapi.bind_handle;
586 req = dcerpc_drsuapi_DsBind_send(s->drsuapi.pipe, s, &s->drsuapi.bind_r);
587 composite_continue_rpc(c, req, unbecomeDC_drsuapi_bind_recv, s);
590 static void unbecomeDC_drsuapi_remove_ds_server_send(struct libnet_UnbecomeDC_state *s);
592 static void unbecomeDC_drsuapi_bind_recv(struct rpc_request *req)
594 struct libnet_UnbecomeDC_state *s = talloc_get_type(req->async.private_data,
595 struct libnet_UnbecomeDC_state);
596 struct composite_context *c = s->creq;
598 c->status = dcerpc_ndr_request_recv(req);
599 if (!composite_is_ok(c)) return;
601 if (!W_ERROR_IS_OK(s->drsuapi.bind_r.out.result)) {
602 composite_error(c, werror_to_ntstatus(s->drsuapi.bind_r.out.result));
606 ZERO_STRUCT(s->drsuapi.remote_info28);
607 if (s->drsuapi.bind_r.out.bind_info) {
608 switch (s->drsuapi.bind_r.out.bind_info->length) {
610 struct drsuapi_DsBindInfo24 *info24;
611 info24 = &s->drsuapi.bind_r.out.bind_info->info.info24;
612 s->drsuapi.remote_info28.supported_extensions = info24->supported_extensions;
613 s->drsuapi.remote_info28.site_guid = info24->site_guid;
614 s->drsuapi.remote_info28.u1 = info24->u1;
615 s->drsuapi.remote_info28.repl_epoch = 0;
619 s->drsuapi.remote_info28 = s->drsuapi.bind_r.out.bind_info->info.info28;
624 unbecomeDC_drsuapi_remove_ds_server_send(s);
627 static void unbecomeDC_drsuapi_remove_ds_server_recv(struct rpc_request *req);
629 static void unbecomeDC_drsuapi_remove_ds_server_send(struct libnet_UnbecomeDC_state *s)
631 struct composite_context *c = s->creq;
632 struct rpc_request *req;
633 struct drsuapi_DsRemoveDSServer *r = &s->drsuapi.rm_ds_srv_r;
635 r->in.bind_handle = &s->drsuapi.bind_handle;
637 r->in.req.req1.server_dn= s->dest_dsa.server_dn_str;
638 r->in.req.req1.domain_dn= s->domain.dn_str;
639 r->in.req.req1.unknown = 0x00000001;
641 req = dcerpc_drsuapi_DsRemoveDSServer_send(s->drsuapi.pipe, s, r);
642 composite_continue_rpc(c, req, unbecomeDC_drsuapi_remove_ds_server_recv, s);
645 static void unbecomeDC_drsuapi_remove_ds_server_recv(struct rpc_request *req)
647 struct libnet_UnbecomeDC_state *s = talloc_get_type(req->async.private_data,
648 struct libnet_UnbecomeDC_state);
649 struct composite_context *c = s->creq;
650 struct drsuapi_DsRemoveDSServer *r = &s->drsuapi.rm_ds_srv_r;
652 c->status = dcerpc_ndr_request_recv(req);
653 if (!composite_is_ok(c)) return;
655 if (!W_ERROR_IS_OK(r->out.result)) {
656 composite_error(c, werror_to_ntstatus(r->out.result));
660 if (r->out.level != 1) {
661 composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE);
665 if (!W_ERROR_IS_OK(r->out.res.res1.status)) {
666 composite_error(c, werror_to_ntstatus(r->out.res.res1.status));
673 struct composite_context *libnet_UnbecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_UnbecomeDC *r)
675 struct composite_context *c;
676 struct libnet_UnbecomeDC_state *s;
679 c = composite_create(mem_ctx, ctx->event_ctx);
680 if (c == NULL) return NULL;
682 s = talloc_zero(c, struct libnet_UnbecomeDC_state);
683 if (composite_nomem(s, c)) return c;
689 s->domain.dns_name = talloc_strdup(s, r->in.domain_dns_name);
690 if (composite_nomem(s->domain.dns_name, c)) return c;
691 s->domain.netbios_name = talloc_strdup(s, r->in.domain_netbios_name);
692 if (composite_nomem(s->domain.netbios_name, c)) return c;
694 /* Source DSA input */
695 s->source_dsa.address = talloc_strdup(s, r->in.source_dsa_address);
696 if (composite_nomem(s->source_dsa.address, c)) return c;
698 /* Destination DSA input */
699 s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name);
700 if (composite_nomem(s->dest_dsa.netbios_name, c)) return c;
702 /* Destination DSA dns_name construction */
703 tmp_name = strlower_talloc(s, s->dest_dsa.netbios_name);
704 if (composite_nomem(tmp_name, c)) return c;
705 s->dest_dsa.dns_name = talloc_asprintf_append_buffer(tmp_name, ".%s",
707 if (composite_nomem(s->dest_dsa.dns_name, c)) return c;
709 unbecomeDC_send_cldap(s);
713 NTSTATUS libnet_UnbecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_UnbecomeDC *r)
717 status = composite_wait(c);
725 NTSTATUS libnet_UnbecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_UnbecomeDC *r)
728 struct composite_context *c;
729 c = libnet_UnbecomeDC_send(ctx, mem_ctx, r);
730 status = libnet_UnbecomeDC_recv(c, mem_ctx, r);