Set the "stable" vendor string in VERSION.
[bbaumbach/samba-autobuild/.git] / source3 / libnet / libnet_join.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  libnet Join Support
4  *  Copyright (C) Gerald (Jerry) Carter 2006
5  *  Copyright (C) Guenther Deschner 2007-2008
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License as published by
9  *  the Free Software Foundation; either version 3 of the License, or
10  *  (at your option) any later version.
11  *
12  *  This program is distributed in the hope that it will be useful,
13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  *  GNU General Public License for more details.
16  *
17  *  You should have received a copy of the GNU General Public License
18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 #include "includes.h"
22 #include "libnet/libnet_join.h"
23 #include "libnet/libnet_proto.h"
24
25 /****************************************************************
26 ****************************************************************/
27
28 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
29                                          struct libnet_JoinCtx *r,
30                                          const char *format, ...)
31 {
32         va_list args;
33         char *tmp = NULL;
34
35         va_start(args, format);
36         tmp = talloc_vasprintf(mem_ctx, format, args);
37         va_end(args);
38
39         TALLOC_FREE(r->out.error_string);
40         r->out.error_string = tmp;
41 }
42
43 /****************************************************************
44 ****************************************************************/
45
46 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
47                                            struct libnet_UnjoinCtx *r,
48                                            const char *format, ...)
49 {
50         va_list args;
51         char *tmp = NULL;
52
53         va_start(args, format);
54         tmp = talloc_vasprintf(mem_ctx, format, args);
55         va_end(args);
56
57         TALLOC_FREE(r->out.error_string);
58         r->out.error_string = tmp;
59 }
60
61 #ifdef HAVE_LDAP
62
63 /****************************************************************
64 ****************************************************************/
65
66 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
67                                      const char *netbios_domain_name,
68                                      const char *dc_name,
69                                      const char *user_name,
70                                      const char *password,
71                                      ADS_STRUCT **ads)
72 {
73         ADS_STATUS status;
74         ADS_STRUCT *my_ads = NULL;
75
76         my_ads = ads_init(dns_domain_name,
77                           netbios_domain_name,
78                           dc_name);
79         if (!my_ads) {
80                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
81         }
82
83         if (user_name) {
84                 SAFE_FREE(my_ads->auth.user_name);
85                 my_ads->auth.user_name = SMB_STRDUP(user_name);
86         }
87
88         if (password) {
89                 SAFE_FREE(my_ads->auth.password);
90                 my_ads->auth.password = SMB_STRDUP(password);
91         }
92
93         status = ads_connect(my_ads);
94         if (!ADS_ERR_OK(status)) {
95                 ads_destroy(&my_ads);
96                 return status;
97         }
98
99         *ads = my_ads;
100         return ADS_SUCCESS;
101 }
102
103 /****************************************************************
104 ****************************************************************/
105
106 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
107                                           struct libnet_JoinCtx *r)
108 {
109         ADS_STATUS status;
110
111         if (r->in.ads) {
112                 ads_destroy(&r->in.ads);
113         }
114
115         status = libnet_connect_ads(r->in.domain_name,
116                                     r->in.domain_name,
117                                     r->in.dc_name,
118                                     r->in.admin_account,
119                                     r->in.admin_password,
120                                     &r->in.ads);
121         if (!ADS_ERR_OK(status)) {
122                 libnet_join_set_error_string(mem_ctx, r,
123                         "failed to connect to AD: %s\n",
124                         ads_errstr(status));
125         }
126
127         return status;
128 }
129
130 /****************************************************************
131 ****************************************************************/
132
133 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
134                                             struct libnet_UnjoinCtx *r)
135 {
136         ADS_STATUS status;
137
138         if (r->in.ads) {
139                 ads_destroy(&r->in.ads);
140         }
141
142         status = libnet_connect_ads(r->in.domain_name,
143                                     r->in.domain_name,
144                                     r->in.dc_name,
145                                     r->in.admin_account,
146                                     r->in.admin_password,
147                                     &r->in.ads);
148         if (!ADS_ERR_OK(status)) {
149                 libnet_unjoin_set_error_string(mem_ctx, r,
150                         "failed to connect to AD: %s\n",
151                         ads_errstr(status));
152         }
153
154         return status;
155 }
156
157 /****************************************************************
158 ****************************************************************/
159
160 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
161                                                      struct libnet_JoinCtx *r)
162 {
163         ADS_STATUS status;
164         LDAPMessage *res = NULL;
165         const char *attrs[] = { "dn", NULL };
166
167         status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
168         if (!ADS_ERR_OK(status)) {
169                 return status;
170         }
171
172         if (ads_count_replies(r->in.ads, res) != 1) {
173                 ads_msgfree(r->in.ads, res);
174                 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
175         }
176
177         status = ads_create_machine_acct(r->in.ads,
178                                          r->in.machine_name,
179                                          r->in.account_ou);
180         ads_msgfree(r->in.ads, res);
181
182         if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
183             (status.err.rc == LDAP_ALREADY_EXISTS)) {
184                 status = ADS_SUCCESS;
185         }
186
187         return status;
188 }
189
190 /****************************************************************
191 ****************************************************************/
192
193 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
194                                                     struct libnet_UnjoinCtx *r)
195 {
196         ADS_STATUS status;
197
198         if (!r->in.ads) {
199                 status = libnet_unjoin_connect_ads(mem_ctx, r);
200                 if (!ADS_ERR_OK(status)) {
201                         return status;
202                 }
203         }
204
205         return ads_leave_realm(r->in.ads, r->in.machine_name);
206 }
207
208 /****************************************************************
209 ****************************************************************/
210
211 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
212                                                 struct libnet_JoinCtx *r)
213 {
214         ADS_STATUS status;
215         LDAPMessage *res = NULL;
216         char *dn = NULL;
217
218         if (!r->in.machine_name) {
219                 return ADS_ERROR(LDAP_NO_MEMORY);
220         }
221
222         status = ads_find_machine_acct(r->in.ads,
223                                        &res,
224                                        r->in.machine_name);
225         if (!ADS_ERR_OK(status)) {
226                 return status;
227         }
228
229         if (ads_count_replies(r->in.ads, res) != 1) {
230                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
231                 goto done;
232         }
233
234         dn = ads_get_dn(r->in.ads, res);
235         if (!dn) {
236                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
237                 goto done;
238         }
239
240         TALLOC_FREE(r->out.dn);
241         r->out.dn = talloc_strdup(mem_ctx, dn);
242         if (!r->out.dn) {
243                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
244                 goto done;
245         }
246
247  done:
248         ads_msgfree(r->in.ads, res);
249         ads_memfree(r->in.ads, dn);
250
251         return status;
252 }
253
254 /****************************************************************
255 ****************************************************************/
256
257 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
258                                               struct libnet_JoinCtx *r)
259 {
260         ADS_STATUS status;
261         ADS_MODLIST mods;
262         fstring my_fqdn;
263         const char *spn_array[3] = {NULL, NULL, NULL};
264         char *spn = NULL;
265
266         if (!r->in.ads) {
267                 status = libnet_join_connect_ads(mem_ctx, r);
268                 if (!ADS_ERR_OK(status)) {
269                         return status;
270                 }
271         }
272
273         status = libnet_join_find_machine_acct(mem_ctx, r);
274         if (!ADS_ERR_OK(status)) {
275                 return status;
276         }
277
278         spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
279         if (!spn) {
280                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
281         }
282         strupper_m(spn);
283         spn_array[0] = spn;
284
285         if (name_to_fqdn(my_fqdn, r->in.machine_name) &&
286             !strequal(my_fqdn, r->in.machine_name)) {
287
288                 strlower_m(my_fqdn);
289                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
290                 if (!spn) {
291                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
292                 }
293                 spn_array[1] = spn;
294         }
295
296         mods = ads_init_mods(mem_ctx);
297         if (!mods) {
298                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
299         }
300
301         status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
302         if (!ADS_ERR_OK(status)) {
303                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
304         }
305
306         status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
307                                  spn_array);
308         if (!ADS_ERR_OK(status)) {
309                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
310         }
311
312         return ads_gen_mod(r->in.ads, r->out.dn, mods);
313 }
314
315 /****************************************************************
316 ****************************************************************/
317
318 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
319                                               struct libnet_JoinCtx *r)
320 {
321         ADS_STATUS status;
322         ADS_MODLIST mods;
323
324         if (!r->in.create_upn) {
325                 return ADS_SUCCESS;
326         }
327
328         if (!r->in.ads) {
329                 status = libnet_join_connect_ads(mem_ctx, r);
330                 if (!ADS_ERR_OK(status)) {
331                         return status;
332                 }
333         }
334
335         status = libnet_join_find_machine_acct(mem_ctx, r);
336         if (!ADS_ERR_OK(status)) {
337                 return status;
338         }
339
340         if (!r->in.upn) {
341                 r->in.upn = talloc_asprintf(mem_ctx,
342                                             "host/%s@%s",
343                                             r->in.machine_name,
344                                             r->out.dns_domain_name);
345                 if (!r->in.upn) {
346                         return ADS_ERROR(LDAP_NO_MEMORY);
347                 }
348         }
349
350         mods = ads_init_mods(mem_ctx);
351         if (!mods) {
352                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
353         }
354
355         status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
356         if (!ADS_ERR_OK(status)) {
357                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
358         }
359
360         return ads_gen_mod(r->in.ads, r->out.dn, mods);
361 }
362
363
364 /****************************************************************
365 ****************************************************************/
366
367 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
368                                                 struct libnet_JoinCtx *r)
369 {
370         ADS_STATUS status;
371         ADS_MODLIST mods;
372         char *os_sp = NULL;
373
374         if (!r->in.os_name || !r->in.os_version ) {
375                 return ADS_SUCCESS;
376         }
377
378         if (!r->in.ads) {
379                 status = libnet_join_connect_ads(mem_ctx, r);
380                 if (!ADS_ERR_OK(status)) {
381                         return status;
382                 }
383         }
384
385         status = libnet_join_find_machine_acct(mem_ctx, r);
386         if (!ADS_ERR_OK(status)) {
387                 return status;
388         }
389
390         mods = ads_init_mods(mem_ctx);
391         if (!mods) {
392                 return ADS_ERROR(LDAP_NO_MEMORY);
393         }
394
395         os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
396         if (!os_sp) {
397                 return ADS_ERROR(LDAP_NO_MEMORY);
398         }
399
400         status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
401                              r->in.os_name);
402         if (!ADS_ERR_OK(status)) {
403                 return status;
404         }
405
406         status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
407                              r->in.os_version);
408         if (!ADS_ERR_OK(status)) {
409                 return status;
410         }
411
412         status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
413                              os_sp);
414         if (!ADS_ERR_OK(status)) {
415                 return status;
416         }
417
418         return ads_gen_mod(r->in.ads, r->out.dn, mods);
419 }
420
421 #endif /* HAVE_LDAP */
422
423 /****************************************************************
424 ****************************************************************/
425
426 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
427                                       struct libnet_JoinCtx *r)
428 {
429         if (!lp_use_kerberos_keytab()) {
430                 return true;
431         }
432 #ifdef HAVE_KRB5
433         if (!ads_keytab_create_default(r->in.ads)) {
434                 return false;
435         }
436 #endif /* HAVE_KRB5 */
437         return true;
438 }
439
440 #ifdef HAVE_KRB5
441
442 /****************************************************************
443 ****************************************************************/
444
445 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
446                                                  struct libnet_JoinCtx *r)
447 {
448         uint32_t domain_func;
449         ADS_STATUS status;
450         const char *salt = NULL;
451         char *std_salt = NULL;
452
453         status = ads_domain_func_level(r->in.ads, &domain_func);
454         if (!ADS_ERR_OK(status)) {
455                 libnet_join_set_error_string(mem_ctx, r,
456                         "Failed to determine domain functional level!\n");
457                 return false;
458         }
459
460         std_salt = kerberos_standard_des_salt();
461         if (!std_salt) {
462                 libnet_join_set_error_string(mem_ctx, r,
463                         "failed to obtain standard DES salt\n");
464                 return false;
465         }
466
467         salt = talloc_strdup(mem_ctx, std_salt);
468         if (!salt) {
469                 return false;
470         }
471
472         SAFE_FREE(std_salt);
473
474         if (domain_func == DS_DOMAIN_FUNCTION_2000) {
475                 char *upn;
476
477                 upn = ads_get_upn(r->in.ads, mem_ctx,
478                                   r->in.machine_name);
479                 if (upn) {
480                         salt = talloc_strdup(mem_ctx, upn);
481                         if (!salt) {
482                                 return false;
483                         }
484                 }
485         }
486
487         return kerberos_secrets_store_des_salt(salt);
488 }
489
490 #endif /* HAVE_KRB5 */
491
492 /****************************************************************
493 ****************************************************************/
494
495 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
496                                                  struct libnet_JoinCtx *r)
497 {
498         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
499                                       r->out.domain_sid))
500         {
501                 return false;
502         }
503
504         if (!secrets_store_machine_password(r->in.machine_password,
505                                             r->out.netbios_domain_name,
506                                             SEC_CHAN_WKSTA))
507         {
508                 return false;
509         }
510
511         return true;
512 }
513
514 /****************************************************************
515 ****************************************************************/
516
517 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
518                                            struct libnet_JoinCtx *r)
519 {
520         struct cli_state *cli = NULL;
521         struct rpc_pipe_client *pipe_hnd = NULL;
522         POLICY_HND sam_pol, domain_pol, user_pol, lsa_pol;
523         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
524         char *acct_name;
525         const char *const_acct_name;
526         uint32 user_rid;
527         uint32 num_rids, *name_types, *user_rids;
528         uint32 flags = 0x3e8;
529         uint32 acb_info = ACB_WSTRUST;
530         uint32 fields_present;
531         uchar pwbuf[532];
532         SAM_USERINFO_CTR ctr;
533         SAM_USER_INFO_25 p25;
534         const int infolevel = 25;
535         struct MD5Context md5ctx;
536         uchar md5buffer[16];
537         DATA_BLOB digested_session_key;
538         uchar md4_trust_password[16];
539
540         if (!r->in.machine_password) {
541                 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
542                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
543         }
544
545         status = cli_full_connection(&cli, NULL,
546                                      r->in.dc_name,
547                                      NULL, 0,
548                                      "IPC$", "IPC",
549                                      r->in.admin_account,
550                                      NULL,
551                                      r->in.admin_password,
552                                      0,
553                                      Undefined, NULL);
554
555         if (!NT_STATUS_IS_OK(status)) {
556                 goto done;
557         }
558
559         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
560         if (!pipe_hnd) {
561                 goto done;
562         }
563
564         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
565                                         SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
566         if (!NT_STATUS_IS_OK(status)) {
567                 goto done;
568         }
569
570         status = rpccli_lsa_query_info_policy2(pipe_hnd, mem_ctx, &lsa_pol,
571                                                12,
572                                                &r->out.netbios_domain_name,
573                                                &r->out.dns_domain_name,
574                                                NULL,
575                                                NULL,
576                                                &r->out.domain_sid);
577
578         if (!NT_STATUS_IS_OK(status)) {
579                 status = rpccli_lsa_query_info_policy(pipe_hnd, mem_ctx, &lsa_pol,
580                                                       5,
581                                                       &r->out.netbios_domain_name,
582                                                       &r->out.domain_sid);
583                 if (!NT_STATUS_IS_OK(status)) {
584                         goto done;
585                 }
586         }
587
588         rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
589         cli_rpc_pipe_close(pipe_hnd);
590
591         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
592         if (!pipe_hnd) {
593                 goto done;
594         }
595
596         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
597                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
598         if (!NT_STATUS_IS_OK(status)) {
599                 goto done;
600         }
601
602         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
603                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
604                                          r->out.domain_sid,
605                                          &domain_pol);
606         if (!NT_STATUS_IS_OK(status)) {
607                 goto done;
608         }
609
610         acct_name = talloc_asprintf(mem_ctx, "%s$", global_myname());
611         strlower_m(acct_name);
612         const_acct_name = acct_name;
613
614         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
615                 status = rpccli_samr_create_dom_user(pipe_hnd, mem_ctx,
616                                                      &domain_pol,
617                                                      acct_name, ACB_WSTRUST,
618                                                      0xe005000b, &user_pol,
619                                                      &user_rid);
620                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
621                         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
622                                 goto done;
623                         }
624                 }
625
626                 if (NT_STATUS_IS_OK(status)) {
627                         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
628                 }
629         }
630
631         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
632                                           &domain_pol, flags, 1,
633                                           &const_acct_name,
634                                           &num_rids, &user_rids, &name_types);
635         if (!NT_STATUS_IS_OK(status)) {
636                 goto done;
637         }
638
639         if (name_types[0] != SID_NAME_USER) {
640                 status = NT_STATUS_INVALID_WORKSTATION;
641                 goto done;
642         }
643
644         user_rid = user_rids[0];
645
646         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
647                                        SEC_RIGHTS_MAXIMUM_ALLOWED, user_rid,
648                                        &user_pol);
649         if (!NT_STATUS_IS_OK(status)) {
650                 goto done;
651         }
652
653         E_md4hash(r->in.machine_password, md4_trust_password);
654         encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
655
656         generate_random_buffer((uint8*)md5buffer, sizeof(md5buffer));
657         digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
658
659         MD5Init(&md5ctx);
660         MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
661         MD5Update(&md5ctx, cli->user_session_key.data,
662                   cli->user_session_key.length);
663         MD5Final(digested_session_key.data, &md5ctx);
664
665         SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
666         memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
667
668         acb_info |= ACB_PWNOEXP;
669 #if 0
670         if ( dom_type == ND_TYPE_AD ) {
671 #if !defined(ENCTYPE_ARCFOUR_HMAC)
672                 acb_info |= ACB_USE_DES_KEY_ONLY;
673 #endif
674                 ;;
675         }
676 #endif
677         ZERO_STRUCT(ctr);
678         ZERO_STRUCT(p25);
679
680         fields_present = ACCT_NT_PWD_SET | ACCT_LM_PWD_SET | ACCT_FLAGS;
681         init_sam_user_info25P(&p25, fields_present, acb_info, (char *)pwbuf);
682
683         ctr.switch_value = infolevel;
684         ctr.info.id25    = &p25;
685
686         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol,
687                                            infolevel, &cli->user_session_key,
688                                            &ctr);
689         if (!NT_STATUS_IS_OK(status)) {
690                 goto done;
691         }
692
693         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
694         cli_rpc_pipe_close(pipe_hnd);
695
696         status = NT_STATUS_OK;
697  done:
698         if (cli) {
699                 cli_shutdown(cli);
700         }
701
702         return status;
703 }
704
705 /****************************************************************
706 ****************************************************************/
707
708 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
709                                                     struct libnet_UnjoinCtx *r)
710 {
711         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
712                 return false;
713         }
714
715         if (!secrets_delete_domain_sid(lp_workgroup())) {
716                 return false;
717         }
718
719         return true;
720 }
721
722 /****************************************************************
723 ****************************************************************/
724
725 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
726                                              struct libnet_UnjoinCtx *r)
727 {
728         struct cli_state *cli = NULL;
729         struct rpc_pipe_client *pipe_hnd = NULL;
730         POLICY_HND sam_pol, domain_pol, user_pol;
731         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
732         char *acct_name;
733         uint32 flags = 0x3e8;
734         const char *const_acct_name;
735         uint32 user_rid;
736         uint32 num_rids, *name_types, *user_rids;
737         SAM_USERINFO_CTR ctr, *qctr = NULL;
738         SAM_USER_INFO_16 p16;
739
740         status = cli_full_connection(&cli, NULL,
741                                      r->in.dc_name,
742                                      NULL, 0,
743                                      "IPC$", "IPC",
744                                      r->in.admin_account,
745                                      NULL,
746                                      r->in.admin_password,
747                                      0, Undefined, NULL);
748
749         if (!NT_STATUS_IS_OK(status)) {
750                 goto done;
751         }
752
753         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
754         if (!pipe_hnd) {
755                 goto done;
756         }
757
758         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
759                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
760         if (!NT_STATUS_IS_OK(status)) {
761                 goto done;
762         }
763
764         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
765                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
766                                          r->in.domain_sid,
767                                          &domain_pol);
768         if (!NT_STATUS_IS_OK(status)) {
769                 goto done;
770         }
771
772         acct_name = talloc_asprintf(mem_ctx, "%s$", global_myname());
773         strlower_m(acct_name);
774         const_acct_name = acct_name;
775
776         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
777                                           &domain_pol, flags, 1,
778                                           &const_acct_name,
779                                           &num_rids, &user_rids, &name_types);
780         if (!NT_STATUS_IS_OK(status)) {
781                 goto done;
782         }
783
784         if (name_types[0] != SID_NAME_USER) {
785                 status = NT_STATUS_INVALID_WORKSTATION;
786                 goto done;
787         }
788
789         user_rid = user_rids[0];
790
791         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
792                                        SEC_RIGHTS_MAXIMUM_ALLOWED,
793                                        user_rid, &user_pol);
794         if (!NT_STATUS_IS_OK(status)) {
795                 goto done;
796         }
797
798         status = rpccli_samr_query_userinfo(pipe_hnd, mem_ctx,
799                                             &user_pol, 16, &qctr);
800         if (!NT_STATUS_IS_OK(status)) {
801                 rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
802                 goto done;
803         }
804
805         ZERO_STRUCT(ctr);
806         ctr.switch_value = 16;
807         ctr.info.id16 = &p16;
808
809         p16.acb_info = qctr->info.id16->acb_info | ACB_DISABLED;
810
811         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol, 16,
812                                            &cli->user_session_key, &ctr);
813
814         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
815
816 done:
817         if (pipe_hnd) {
818                 rpccli_samr_close(pipe_hnd, mem_ctx, &domain_pol);
819                 rpccli_samr_close(pipe_hnd, mem_ctx, &sam_pol);
820                 cli_rpc_pipe_close(pipe_hnd);
821         }
822
823         if (cli) {
824                 cli_shutdown(cli);
825         }
826
827         return status;
828 }
829
830 /****************************************************************
831 ****************************************************************/
832
833 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
834 {
835         WERROR werr;
836         bool is_ad = false;
837
838         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
839
840                 werr = libnet_conf_set_global_parameter("security", "user");
841                 W_ERROR_NOT_OK_RETURN(werr);
842
843                 werr = libnet_conf_set_global_parameter("workgroup",
844                                                         r->in.domain_name);
845                 return werr;
846         }
847
848         if (r->out.dns_domain_name) {
849                 is_ad = true;
850         }
851
852         werr = libnet_conf_set_global_parameter("security", "domain");
853         W_ERROR_NOT_OK_RETURN(werr);
854
855         werr = libnet_conf_set_global_parameter("workgroup",
856                                                 r->out.netbios_domain_name);
857         W_ERROR_NOT_OK_RETURN(werr);
858
859         if (is_ad) {
860                 werr = libnet_conf_set_global_parameter("security", "ads");
861                 W_ERROR_NOT_OK_RETURN(werr);
862
863                 werr = libnet_conf_set_global_parameter("realm",
864                                                        r->out.dns_domain_name);
865                 W_ERROR_NOT_OK_RETURN(werr);
866         }
867
868         return werr;
869 }
870
871 /****************************************************************
872 ****************************************************************/
873
874 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
875 {
876         WERROR werr = WERR_OK;
877
878         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
879
880                 werr = libnet_conf_set_global_parameter("security", "user");
881                 W_ERROR_NOT_OK_RETURN(werr);
882         }
883
884         werr = libnet_conf_delete_parameter(GLOBAL_NAME, "realm");
885
886         return werr;
887 }
888
889 /****************************************************************
890 ****************************************************************/
891
892 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
893 {
894         WERROR werr;
895
896         if (!W_ERROR_IS_OK(r->out.result)) {
897                 return r->out.result;
898         }
899
900         if (!r->in.modify_config) {
901                 return WERR_OK;
902         }
903
904         werr = do_join_modify_vals_config(r);
905         if (!W_ERROR_IS_OK(werr)) {
906                 return werr;
907         }
908
909         r->out.modified_config = true;
910         r->out.result = werr;
911
912         return werr;
913 }
914
915 /****************************************************************
916 ****************************************************************/
917
918 static WERROR do_UnjoinConfig(struct libnet_UnjoinCtx *r)
919 {
920         WERROR werr;
921
922         if (!W_ERROR_IS_OK(r->out.result)) {
923                 return r->out.result;
924         }
925
926         if (!r->in.modify_config) {
927                 return WERR_OK;
928         }
929
930         werr = do_unjoin_modify_vals_config(r);
931         if (!W_ERROR_IS_OK(werr)) {
932                 return werr;
933         }
934
935         r->out.modified_config = true;
936         r->out.result = werr;
937
938         return werr;
939 }
940
941 /****************************************************************
942 ****************************************************************/
943
944 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
945 {
946         if (r->in.ads) {
947                 ads_destroy(&r->in.ads);
948         }
949
950         return 0;
951 }
952
953 /****************************************************************
954 ****************************************************************/
955
956 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
957 {
958         if (r->in.ads) {
959                 ads_destroy(&r->in.ads);
960         }
961
962         return 0;
963 }
964
965 /****************************************************************
966 ****************************************************************/
967
968 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
969                            struct libnet_JoinCtx **r)
970 {
971         struct libnet_JoinCtx *ctx;
972
973         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
974         if (!ctx) {
975                 return WERR_NOMEM;
976         }
977
978         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
979
980         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
981         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
982
983         *r = ctx;
984
985         return WERR_OK;
986 }
987
988 /****************************************************************
989 ****************************************************************/
990
991 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
992                              struct libnet_UnjoinCtx **r)
993 {
994         struct libnet_UnjoinCtx *ctx;
995
996         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
997         if (!ctx) {
998                 return WERR_NOMEM;
999         }
1000
1001         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1002
1003         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1004         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1005
1006         *r = ctx;
1007
1008         return WERR_OK;
1009 }
1010
1011 /****************************************************************
1012 ****************************************************************/
1013
1014 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1015                                 struct libnet_JoinCtx *r)
1016 {
1017         NTSTATUS status;
1018 #ifdef HAVE_LDAP
1019         ADS_STATUS ads_status;
1020
1021         if (r->in.account_ou) {
1022                 ads_status = libnet_join_connect_ads(mem_ctx, r);
1023                 if (!ADS_ERR_OK(ads_status)) {
1024                         return WERR_GENERAL_FAILURE;
1025                 }
1026                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1027                 if (!ADS_ERR_OK(ads_status)) {
1028                         libnet_join_set_error_string(mem_ctx, r,
1029                                 "failed to precreate account in ou %s: %s\n",
1030                                 r->in.account_ou,
1031                                 ads_errstr(ads_status));
1032                         return WERR_GENERAL_FAILURE;
1033                 }
1034
1035                 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1036         }
1037 #endif /* HAVE_LDAP */
1038         status = libnet_join_joindomain_rpc(mem_ctx, r);
1039         if (!NT_STATUS_IS_OK(status)) {
1040                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1041                         return WERR_SETUP_ALREADY_JOINED;
1042                 }
1043                 return ntstatus_to_werror(status);
1044         }
1045
1046         if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1047                 return WERR_SETUP_NOT_JOINED;
1048         }
1049
1050 #ifdef HAVE_LDAP
1051         ads_status = libnet_join_set_machine_spn(mem_ctx, r);
1052         if (!ADS_ERR_OK(ads_status)) {
1053                 libnet_join_set_error_string(mem_ctx, r,
1054                         "failed to set machine spn: %s\n",
1055                         ads_errstr(ads_status));
1056                 return WERR_GENERAL_FAILURE;
1057         }
1058
1059         ads_status = libnet_join_set_os_attributes(mem_ctx, r);
1060         if (!ADS_ERR_OK(ads_status)) {
1061                 libnet_join_set_error_string(mem_ctx, r,
1062                         "failed to set machine os attributes: %s\n",
1063                         ads_errstr(ads_status));
1064                 return WERR_GENERAL_FAILURE;
1065         }
1066
1067         ads_status = libnet_join_set_machine_upn(mem_ctx, r);
1068         if (!ADS_ERR_OK(ads_status)) {
1069                 libnet_join_set_error_string(mem_ctx, r,
1070                         "failed to set machine upn: %s\n",
1071                         ads_errstr(ads_status));
1072                 return WERR_GENERAL_FAILURE;
1073         }
1074
1075 #ifdef HAVE_KRB5
1076         if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
1077                 return WERR_GENERAL_FAILURE;
1078         }
1079 #endif /* HAVE_KRB5 */
1080
1081 #endif /* HAVE_LDAP */
1082         if (!libnet_join_create_keytab(mem_ctx, r)) {
1083                 libnet_join_set_error_string(mem_ctx, r,
1084                         "failed to create kerberos keytab\n");
1085                 return WERR_GENERAL_FAILURE;
1086         }
1087
1088         return WERR_OK;
1089 }
1090
1091 /****************************************************************
1092 ****************************************************************/
1093
1094 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1095                    struct libnet_JoinCtx *r)
1096 {
1097         WERROR werr;
1098
1099         if (!r->in.domain_name) {
1100                 return WERR_INVALID_PARAM;
1101         }
1102
1103         if (r->in.modify_config && !lp_include_registry_globals()) {
1104                 return WERR_NOT_SUPPORTED;
1105         }
1106
1107         if (IS_DC) {
1108                 return WERR_SETUP_DOMAIN_CONTROLLER;
1109         }
1110
1111         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1112                 werr = libnet_DomainJoin(mem_ctx, r);
1113                 if (!W_ERROR_IS_OK(werr)) {
1114                         return werr;
1115                 }
1116         }
1117
1118         werr = do_JoinConfig(r);
1119         if (!W_ERROR_IS_OK(werr)) {
1120                 return werr;
1121         }
1122
1123         return werr;
1124 }
1125
1126 /****************************************************************
1127 ****************************************************************/
1128
1129 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1130                                   struct libnet_UnjoinCtx *r)
1131 {
1132         NTSTATUS status;
1133
1134         status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1135         if (!NT_STATUS_IS_OK(status)) {
1136                 libnet_unjoin_set_error_string(mem_ctx, r,
1137                         "failed to unjoin domain: %s\n",
1138                         nt_errstr(status));
1139                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1140                         return WERR_SETUP_NOT_JOINED;
1141                 }
1142                 return ntstatus_to_werror(status);
1143         }
1144
1145 #ifdef HAVE_LDAP
1146         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1147                 ADS_STATUS ads_status;
1148                 libnet_unjoin_connect_ads(mem_ctx, r);
1149                 ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
1150                 if (!ADS_ERR_OK(ads_status)) {
1151                         libnet_unjoin_set_error_string(mem_ctx, r,
1152                                 "failed to remove machine account from AD: %s\n",
1153                                 ads_errstr(ads_status));
1154                 }
1155         }
1156 #endif /* HAVE_LDAP */
1157         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1158
1159         return WERR_OK;
1160 }
1161
1162 /****************************************************************
1163 ****************************************************************/
1164
1165 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1166                      struct libnet_UnjoinCtx *r)
1167 {
1168         WERROR werr;
1169
1170         if (r->in.modify_config && !lp_include_registry_globals()) {
1171                 return WERR_NOT_SUPPORTED;
1172         }
1173
1174         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1175                 werr = libnet_DomainUnjoin(mem_ctx, r);
1176                 if (!W_ERROR_IS_OK(werr)) {
1177                         do_UnjoinConfig(r);
1178                         return werr;
1179                 }
1180         }
1181
1182         werr = do_UnjoinConfig(r);
1183         if (!W_ERROR_IS_OK(werr)) {
1184                 return werr;
1185         }
1186
1187         return werr;
1188 }