source/libnet/libnet_join.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  libnet Join Support
   4  *  Copyright (C) Gerald (Jerry) Carter 2006
   5  *  Copyright (C) Guenther Deschner 2007-2008
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23
  24 /****************************************************************
  25 ****************************************************************/
  26
  27 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
  28                                          struct libnet_JoinCtx *r,
  29                                          const char *format, ...)
  30 {
  31         va_list args;
  32
  33         if (r->out.error_string) {
  34                 return;
  35         }
  36
  37         va_start(args, format);
  38         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  39         va_end(args);
  40 }
  41
  42 /****************************************************************
  43 ****************************************************************/
  44
  45 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
  46                                            struct libnet_UnjoinCtx *r,
  47                                            const char *format, ...)
  48 {
  49         va_list args;
  50
  51         if (r->out.error_string) {
  52                 return;
  53         }
  54
  55         va_start(args, format);
  56         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  57         va_end(args);
  58 }
  59
  60 #ifdef WITH_ADS
  61
  62 /****************************************************************
  63 ****************************************************************/
  64
  65 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
  66                                      const char *netbios_domain_name,
  67                                      const char *dc_name,
  68                                      const char *user_name,
  69                                      const char *password,
  70                                      ADS_STRUCT **ads)
  71 {
  72         ADS_STATUS status;
  73         ADS_STRUCT *my_ads = NULL;
  74
  75         my_ads = ads_init(dns_domain_name,
  76                           netbios_domain_name,
  77                           dc_name);
  78         if (!my_ads) {
  79                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
  80         }
  81
  82         if (user_name) {
  83                 SAFE_FREE(my_ads->auth.user_name);
  84                 my_ads->auth.user_name = SMB_STRDUP(user_name);
  85         }
  86
  87         if (password) {
  88                 SAFE_FREE(my_ads->auth.password);
  89                 my_ads->auth.password = SMB_STRDUP(password);
  90         }
  91
  92         status = ads_connect(my_ads);
  93         if (!ADS_ERR_OK(status)) {
  94                 ads_destroy(&my_ads);
  95                 return status;
  96         }
  97
  98         *ads = my_ads;
  99         return ADS_SUCCESS;
 100 }
 101
 102 /****************************************************************
 103 ****************************************************************/
 104
 105 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
 106                                           struct libnet_JoinCtx *r)
 107 {
 108         ADS_STATUS status;
 109
 110         status = libnet_connect_ads(r->in.domain_name,
 111                                     r->in.domain_name,
 112                                     r->in.dc_name,
 113                                     r->in.admin_account,
 114                                     r->in.admin_password,
 115                                     &r->in.ads);
 116         if (!ADS_ERR_OK(status)) {
 117                 libnet_join_set_error_string(mem_ctx, r,
 118                         "failed to connect to AD: %s",
 119                         ads_errstr(status));
 120         }
 121
 122         return status;
 123 }
 124
 125 /****************************************************************
 126 ****************************************************************/
 127
 128 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
 129                                             struct libnet_UnjoinCtx *r)
 130 {
 131         ADS_STATUS status;
 132
 133         status = libnet_connect_ads(r->in.domain_name,
 134                                     r->in.domain_name,
 135                                     r->in.dc_name,
 136                                     r->in.admin_account,
 137                                     r->in.admin_password,
 138                                     &r->in.ads);
 139         if (!ADS_ERR_OK(status)) {
 140                 libnet_unjoin_set_error_string(mem_ctx, r,
 141                         "failed to connect to AD: %s",
 142                         ads_errstr(status));
 143         }
 144
 145         return status;
 146 }
 147
 148 /****************************************************************
 149 ****************************************************************/
 150
 151 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
 152                                                      struct libnet_JoinCtx *r)
 153 {
 154         ADS_STATUS status;
 155         LDAPMessage *res = NULL;
 156         const char *attrs[] = { "dn", NULL };
 157
 158         status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
 159         if (!ADS_ERR_OK(status)) {
 160                 return status;
 161         }
 162
 163         if (ads_count_replies(r->in.ads, res) != 1) {
 164                 ads_msgfree(r->in.ads, res);
 165                 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
 166         }
 167
 168         status = ads_create_machine_acct(r->in.ads,
 169                                          r->in.machine_name,
 170                                          r->in.account_ou);
 171         ads_msgfree(r->in.ads, res);
 172
 173         if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
 174             (status.err.rc == LDAP_ALREADY_EXISTS)) {
 175                 status = ADS_SUCCESS;
 176         }
 177
 178         return status;
 179 }
 180
 181 /****************************************************************
 182 ****************************************************************/
 183
 184 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
 185                                                     struct libnet_UnjoinCtx *r)
 186 {
 187         ADS_STATUS status;
 188
 189         if (!r->in.ads) {
 190                 status = libnet_unjoin_connect_ads(mem_ctx, r);
 191                 if (!ADS_ERR_OK(status)) {
 192                         return status;
 193                 }
 194         }
 195
 196         status = ads_leave_realm(r->in.ads, r->in.machine_name);
 197         if (!ADS_ERR_OK(status)) {
 198                 libnet_unjoin_set_error_string(mem_ctx, r,
 199                         "failed to leave realm: %s",
 200                         ads_errstr(status));
 201                 return status;
 202         }
 203
 204         return ADS_SUCCESS;
 205 }
 206
 207 /****************************************************************
 208 ****************************************************************/
 209
 210 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
 211                                                 struct libnet_JoinCtx *r)
 212 {
 213         ADS_STATUS status;
 214         LDAPMessage *res = NULL;
 215         char *dn = NULL;
 216
 217         if (!r->in.machine_name) {
 218                 return ADS_ERROR(LDAP_NO_MEMORY);
 219         }
 220
 221         status = ads_find_machine_acct(r->in.ads,
 222                                        &res,
 223                                        r->in.machine_name);
 224         if (!ADS_ERR_OK(status)) {
 225                 return status;
 226         }
 227
 228         if (ads_count_replies(r->in.ads, res) != 1) {
 229                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 230                 goto done;
 231         }
 232
 233         dn = ads_get_dn(r->in.ads, res);
 234         if (!dn) {
 235                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 236                 goto done;
 237         }
 238
 239         r->out.dn = talloc_strdup(mem_ctx, dn);
 240         if (!r->out.dn) {
 241                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 242                 goto done;
 243         }
 244
 245  done:
 246         ads_msgfree(r->in.ads, res);
 247         ads_memfree(r->in.ads, dn);
 248
 249         return status;
 250 }
 251
 252 /****************************************************************
 253 ****************************************************************/
 254
 255 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
 256                                               struct libnet_JoinCtx *r)
 257 {
 258         ADS_STATUS status;
 259         ADS_MODLIST mods;
 260         fstring my_fqdn;
 261         const char *spn_array[3] = {NULL, NULL, NULL};
 262         char *spn = NULL;
 263
 264         if (!r->in.ads) {
 265                 status = libnet_join_connect_ads(mem_ctx, r);
 266                 if (!ADS_ERR_OK(status)) {
 267                         return status;
 268                 }
 269         }
 270
 271         status = libnet_join_find_machine_acct(mem_ctx, r);
 272         if (!ADS_ERR_OK(status)) {
 273                 return status;
 274         }
 275
 276         spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
 277         if (!spn) {
 278                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 279         }
 280         strupper_m(spn);
 281         spn_array[0] = spn;
 282
 283         if (name_to_fqdn(my_fqdn, r->in.machine_name) &&
 284             !strequal(my_fqdn, r->in.machine_name)) {
 285
 286                 strlower_m(my_fqdn);
 287                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
 288                 if (!spn) {
 289                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 290                 }
 291                 spn_array[1] = spn;
 292         }
 293
 294         mods = ads_init_mods(mem_ctx);
 295         if (!mods) {
 296                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 297         }
 298
 299         status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
 300         if (!ADS_ERR_OK(status)) {
 301                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 302         }
 303
 304         status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
 305                                  spn_array);
 306         if (!ADS_ERR_OK(status)) {
 307                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 308         }
 309
 310         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 311 }
 312
 313 /****************************************************************
 314 ****************************************************************/
 315
 316 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
 317                                               struct libnet_JoinCtx *r)
 318 {
 319         ADS_STATUS status;
 320         ADS_MODLIST mods;
 321
 322         if (!r->in.create_upn) {
 323                 return ADS_SUCCESS;
 324         }
 325
 326         if (!r->in.ads) {
 327                 status = libnet_join_connect_ads(mem_ctx, r);
 328                 if (!ADS_ERR_OK(status)) {
 329                         return status;
 330                 }
 331         }
 332
 333         status = libnet_join_find_machine_acct(mem_ctx, r);
 334         if (!ADS_ERR_OK(status)) {
 335                 return status;
 336         }
 337
 338         if (!r->in.upn) {
 339                 r->in.upn = talloc_asprintf(mem_ctx,
 340                                             "host/%s@%s",
 341                                             r->in.machine_name,
 342                                             r->out.dns_domain_name);
 343                 if (!r->in.upn) {
 344                         return ADS_ERROR(LDAP_NO_MEMORY);
 345                 }
 346         }
 347
 348         mods = ads_init_mods(mem_ctx);
 349         if (!mods) {
 350                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 351         }
 352
 353         status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
 354         if (!ADS_ERR_OK(status)) {
 355                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 356         }
 357
 358         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 359 }
 360
 361
 362 /****************************************************************
 363 ****************************************************************/
 364
 365 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
 366                                                 struct libnet_JoinCtx *r)
 367 {
 368         ADS_STATUS status;
 369         ADS_MODLIST mods;
 370         char *os_sp = NULL;
 371
 372         if (!r->in.os_name || !r->in.os_version ) {
 373                 return ADS_SUCCESS;
 374         }
 375
 376         if (!r->in.ads) {
 377                 status = libnet_join_connect_ads(mem_ctx, r);
 378                 if (!ADS_ERR_OK(status)) {
 379                         return status;
 380                 }
 381         }
 382
 383         status = libnet_join_find_machine_acct(mem_ctx, r);
 384         if (!ADS_ERR_OK(status)) {
 385                 return status;
 386         }
 387
 388         mods = ads_init_mods(mem_ctx);
 389         if (!mods) {
 390                 return ADS_ERROR(LDAP_NO_MEMORY);
 391         }
 392
 393         os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
 394         if (!os_sp) {
 395                 return ADS_ERROR(LDAP_NO_MEMORY);
 396         }
 397
 398         status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
 399                              r->in.os_name);
 400         if (!ADS_ERR_OK(status)) {
 401                 return status;
 402         }
 403
 404         status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
 405                              r->in.os_version);
 406         if (!ADS_ERR_OK(status)) {
 407                 return status;
 408         }
 409
 410         status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
 411                              os_sp);
 412         if (!ADS_ERR_OK(status)) {
 413                 return status;
 414         }
 415
 416         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 417 }
 418
 419 /****************************************************************
 420 ****************************************************************/
 421
 422 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
 423                                       struct libnet_JoinCtx *r)
 424 {
 425         if (!lp_use_kerberos_keytab()) {
 426                 return true;
 427         }
 428
 429         if (!ads_keytab_create_default(r->in.ads)) {
 430                 return false;
 431         }
 432
 433         return true;
 434 }
 435
 436 /****************************************************************
 437 ****************************************************************/
 438
 439 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
 440                                                  struct libnet_JoinCtx *r)
 441 {
 442         uint32_t domain_func;
 443         ADS_STATUS status;
 444         const char *salt = NULL;
 445         char *std_salt = NULL;
 446
 447         status = ads_domain_func_level(r->in.ads, &domain_func);
 448         if (!ADS_ERR_OK(status)) {
 449                 libnet_join_set_error_string(mem_ctx, r,
 450                         "failed to determine domain functional level: %s",
 451                         ads_errstr(status));
 452                 return false;
 453         }
 454
 455         std_salt = kerberos_standard_des_salt();
 456         if (!std_salt) {
 457                 libnet_join_set_error_string(mem_ctx, r,
 458                         "failed to obtain standard DES salt");
 459                 return false;
 460         }
 461
 462         salt = talloc_strdup(mem_ctx, std_salt);
 463         if (!salt) {
 464                 return false;
 465         }
 466
 467         SAFE_FREE(std_salt);
 468
 469         if (domain_func == DS_DOMAIN_FUNCTION_2000) {
 470                 char *upn;
 471
 472                 upn = ads_get_upn(r->in.ads, mem_ctx,
 473                                   r->in.machine_name);
 474                 if (upn) {
 475                         salt = talloc_strdup(mem_ctx, upn);
 476                         if (!salt) {
 477                                 return false;
 478                         }
 479                 }
 480         }
 481
 482         return kerberos_secrets_store_des_salt(salt);
 483 }
 484
 485 /****************************************************************
 486 ****************************************************************/
 487
 488 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
 489                                                   struct libnet_JoinCtx *r)
 490 {
 491         ADS_STATUS status;
 492
 493         status = libnet_join_set_machine_spn(mem_ctx, r);
 494         if (!ADS_ERR_OK(status)) {
 495                 libnet_join_set_error_string(mem_ctx, r,
 496                         "failed to set machine spn: %s",
 497                         ads_errstr(status));
 498                 return status;
 499         }
 500
 501         status = libnet_join_set_os_attributes(mem_ctx, r);
 502         if (!ADS_ERR_OK(status)) {
 503                 libnet_join_set_error_string(mem_ctx, r,
 504                         "failed to set machine os attributes: %s",
 505                         ads_errstr(status));
 506                 return status;
 507         }
 508
 509         status = libnet_join_set_machine_upn(mem_ctx, r);
 510         if (!ADS_ERR_OK(status)) {
 511                 libnet_join_set_error_string(mem_ctx, r,
 512                         "failed to set machine upn: %s",
 513                         ads_errstr(status));
 514                 return status;
 515         }
 516
 517         if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
 518                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 519         }
 520
 521         if (!libnet_join_create_keytab(mem_ctx, r)) {
 522                 libnet_join_set_error_string(mem_ctx, r,
 523                         "failed to create kerberos keytab");
 524                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 525         }
 526
 527         return ADS_SUCCESS;
 528 }
 529 #endif /* WITH_ADS */
 530
 531 /****************************************************************
 532 ****************************************************************/
 533
 534 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
 535                                                  struct libnet_JoinCtx *r)
 536 {
 537         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
 538                                       r->out.domain_sid))
 539         {
 540                 return false;
 541         }
 542
 543         if (!secrets_store_machine_password(r->in.machine_password,
 544                                             r->out.netbios_domain_name,
 545                                             SEC_CHAN_WKSTA))
 546         {
 547                 return false;
 548         }
 549
 550         return true;
 551 }
 552
 553 /****************************************************************
 554 ****************************************************************/
 555
 556 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
 557                                            struct libnet_JoinCtx *r)
 558 {
 559         struct cli_state *cli = NULL;
 560         struct rpc_pipe_client *pipe_hnd = NULL;
 561         POLICY_HND sam_pol, domain_pol, user_pol, lsa_pol;
 562         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 563         char *acct_name;
 564         const char *const_acct_name;
 565         uint32 user_rid;
 566         uint32 num_rids, *name_types, *user_rids;
 567         uint32 flags = 0x3e8;
 568         uint32 acb_info = ACB_WSTRUST;
 569         uint32 fields_present;
 570         uchar pwbuf[532];
 571         SAM_USERINFO_CTR ctr;
 572         SAM_USER_INFO_25 p25;
 573         const int infolevel = 25;
 574         struct MD5Context md5ctx;
 575         uchar md5buffer[16];
 576         DATA_BLOB digested_session_key;
 577         uchar md4_trust_password[16];
 578
 579         if (!r->in.machine_password) {
 580                 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
 581                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
 582         }
 583
 584         status = cli_full_connection(&cli, NULL,
 585                                      r->in.dc_name,
 586                                      NULL, 0,
 587                                      "IPC$", "IPC",
 588                                      r->in.admin_account,
 589                                      NULL,
 590                                      r->in.admin_password,
 591                                      0,
 592                                      Undefined, NULL);
 593
 594         if (!NT_STATUS_IS_OK(status)) {
 595                 goto done;
 596         }
 597
 598         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
 599         if (!pipe_hnd) {
 600                 goto done;
 601         }
 602
 603         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
 604                                         SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
 605         if (!NT_STATUS_IS_OK(status)) {
 606                 goto done;
 607         }
 608
 609         status = rpccli_lsa_query_info_policy2(pipe_hnd, mem_ctx, &lsa_pol,
 610                                                12,
 611                                                &r->out.netbios_domain_name,
 612                                                &r->out.dns_domain_name,
 613                                                NULL,
 614                                                NULL,
 615                                                &r->out.domain_sid);
 616
 617         if (NT_STATUS_IS_OK(status)) {
 618                 r->out.domain_is_ad = true;
 619         }
 620
 621         if (!NT_STATUS_IS_OK(status)) {
 622                 status = rpccli_lsa_query_info_policy(pipe_hnd, mem_ctx, &lsa_pol,
 623                                                       5,
 624                                                       &r->out.netbios_domain_name,
 625                                                       &r->out.domain_sid);
 626                 if (!NT_STATUS_IS_OK(status)) {
 627                         goto done;
 628                 }
 629         }
 630
 631         rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
 632         cli_rpc_pipe_close(pipe_hnd);
 633
 634         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 635         if (!pipe_hnd) {
 636                 goto done;
 637         }
 638
 639         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
 640                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
 641         if (!NT_STATUS_IS_OK(status)) {
 642                 goto done;
 643         }
 644
 645         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
 646                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
 647                                          r->out.domain_sid,
 648                                          &domain_pol);
 649         if (!NT_STATUS_IS_OK(status)) {
 650                 goto done;
 651         }
 652
 653         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
 654         strlower_m(acct_name);
 655         const_acct_name = acct_name;
 656
 657         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
 658                 status = rpccli_samr_create_dom_user(pipe_hnd, mem_ctx,
 659                                                      &domain_pol,
 660                                                      acct_name, ACB_WSTRUST,
 661                                                      0xe005000b, &user_pol,
 662                                                      &user_rid);
 663                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 664                         if (!(r->in.join_flags &
 665                               WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
 666                                 goto done;
 667                         }
 668                 }
 669
 670                 if (NT_STATUS_IS_OK(status)) {
 671                         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 672                 }
 673         }
 674
 675         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
 676                                           &domain_pol, flags, 1,
 677                                           &const_acct_name,
 678                                           &num_rids, &user_rids, &name_types);
 679         if (!NT_STATUS_IS_OK(status)) {
 680                 goto done;
 681         }
 682
 683         if (name_types[0] != SID_NAME_USER) {
 684                 status = NT_STATUS_INVALID_WORKSTATION;
 685                 goto done;
 686         }
 687
 688         user_rid = user_rids[0];
 689
 690         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
 691                                        SEC_RIGHTS_MAXIMUM_ALLOWED, user_rid,
 692                                        &user_pol);
 693         if (!NT_STATUS_IS_OK(status)) {
 694                 goto done;
 695         }
 696
 697         E_md4hash(r->in.machine_password, md4_trust_password);
 698         encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
 699
 700         generate_random_buffer((uint8*)md5buffer, sizeof(md5buffer));
 701         digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
 702
 703         MD5Init(&md5ctx);
 704         MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
 705         MD5Update(&md5ctx, cli->user_session_key.data,
 706                   cli->user_session_key.length);
 707         MD5Final(digested_session_key.data, &md5ctx);
 708
 709         SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
 710         memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
 711
 712         acb_info |= ACB_PWNOEXP;
 713         if (r->out.domain_is_ad) {
 714 #if !defined(ENCTYPE_ARCFOUR_HMAC)
 715                 acb_info |= ACB_USE_DES_KEY_ONLY;
 716 #endif
 717                 ;;
 718         }
 719
 720         ZERO_STRUCT(ctr);
 721         ZERO_STRUCT(p25);
 722
 723         fields_present = ACCT_NT_PWD_SET | ACCT_LM_PWD_SET | ACCT_FLAGS;
 724         init_sam_user_info25P(&p25, fields_present, acb_info, (char *)pwbuf);
 725
 726         ctr.switch_value = infolevel;
 727         ctr.info.id25    = &p25;
 728
 729         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol,
 730                                            infolevel, &cli->user_session_key,
 731                                            &ctr);
 732         if (!NT_STATUS_IS_OK(status)) {
 733                 goto done;
 734         }
 735
 736         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 737         cli_rpc_pipe_close(pipe_hnd);
 738
 739         status = NT_STATUS_OK;
 740  done:
 741         if (cli) {
 742                 cli_shutdown(cli);
 743         }
 744
 745         return status;
 746 }
 747
 748 /****************************************************************
 749 ****************************************************************/
 750
 751 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
 752                                                     struct libnet_UnjoinCtx *r)
 753 {
 754         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
 755                 return false;
 756         }
 757
 758         if (!secrets_delete_domain_sid(lp_workgroup())) {
 759                 return false;
 760         }
 761
 762         return true;
 763 }
 764
 765 /****************************************************************
 766 ****************************************************************/
 767
 768 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
 769                                              struct libnet_UnjoinCtx *r)
 770 {
 771         struct cli_state *cli = NULL;
 772         struct rpc_pipe_client *pipe_hnd = NULL;
 773         POLICY_HND sam_pol, domain_pol, user_pol;
 774         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 775         char *acct_name;
 776         uint32 flags = 0x3e8;
 777         const char *const_acct_name;
 778         uint32 user_rid;
 779         uint32 num_rids, *name_types, *user_rids;
 780         SAM_USERINFO_CTR ctr, *qctr = NULL;
 781         SAM_USER_INFO_16 p16;
 782
 783         status = cli_full_connection(&cli, NULL,
 784                                      r->in.dc_name,
 785                                      NULL, 0,
 786                                      "IPC$", "IPC",
 787                                      r->in.admin_account,
 788                                      NULL,
 789                                      r->in.admin_password,
 790                                      0, Undefined, NULL);
 791
 792         if (!NT_STATUS_IS_OK(status)) {
 793                 goto done;
 794         }
 795
 796         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 797         if (!pipe_hnd) {
 798                 goto done;
 799         }
 800
 801         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
 802                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
 803         if (!NT_STATUS_IS_OK(status)) {
 804                 goto done;
 805         }
 806
 807         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
 808                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
 809                                          r->in.domain_sid,
 810                                          &domain_pol);
 811         if (!NT_STATUS_IS_OK(status)) {
 812                 goto done;
 813         }
 814
 815         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
 816         strlower_m(acct_name);
 817         const_acct_name = acct_name;
 818
 819         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
 820                                           &domain_pol, flags, 1,
 821                                           &const_acct_name,
 822                                           &num_rids, &user_rids, &name_types);
 823         if (!NT_STATUS_IS_OK(status)) {
 824                 goto done;
 825         }
 826
 827         if (name_types[0] != SID_NAME_USER) {
 828                 status = NT_STATUS_INVALID_WORKSTATION;
 829                 goto done;
 830         }
 831
 832         user_rid = user_rids[0];
 833
 834         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
 835                                        SEC_RIGHTS_MAXIMUM_ALLOWED,
 836                                        user_rid, &user_pol);
 837         if (!NT_STATUS_IS_OK(status)) {
 838                 goto done;
 839         }
 840
 841         status = rpccli_samr_query_userinfo(pipe_hnd, mem_ctx,
 842                                             &user_pol, 16, &qctr);
 843         if (!NT_STATUS_IS_OK(status)) {
 844                 rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 845                 goto done;
 846         }
 847
 848         ZERO_STRUCT(ctr);
 849         ctr.switch_value = 16;
 850         ctr.info.id16 = &p16;
 851
 852         p16.acb_info = qctr->info.id16->acb_info | ACB_DISABLED;
 853
 854         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol, 16,
 855                                            &cli->user_session_key, &ctr);
 856
 857         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 858
 859 done:
 860         if (pipe_hnd) {
 861                 rpccli_samr_close(pipe_hnd, mem_ctx, &domain_pol);
 862                 rpccli_samr_close(pipe_hnd, mem_ctx, &sam_pol);
 863                 cli_rpc_pipe_close(pipe_hnd);
 864         }
 865
 866         if (cli) {
 867                 cli_shutdown(cli);
 868         }
 869
 870         return status;
 871 }
 872
 873 /****************************************************************
 874 ****************************************************************/
 875
 876 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
 877 {
 878         WERROR werr;
 879         struct libnet_conf_ctx *ctx;
 880
 881         werr = libnet_conf_open(r, &ctx);
 882         if (!W_ERROR_IS_OK(werr)) {
 883                 goto done;
 884         }
 885
 886         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
 887
 888                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
 889                 if (!W_ERROR_IS_OK(werr)) {
 890                         goto done;
 891                 }
 892
 893                 werr = libnet_conf_set_global_parameter(ctx, "workgroup",
 894                                                         r->in.domain_name);
 895                 goto done;
 896         }
 897
 898         werr = libnet_conf_set_global_parameter(ctx, "security", "domain");
 899         if (!W_ERROR_IS_OK(werr)) {
 900                 goto done;
 901         }
 902
 903         werr = libnet_conf_set_global_parameter(ctx, "workgroup",
 904                                                 r->out.netbios_domain_name);
 905         if (!W_ERROR_IS_OK(werr)) {
 906                 goto done;
 907         }
 908
 909         if (r->out.domain_is_ad) {
 910                 werr = libnet_conf_set_global_parameter(ctx, "security", "ads");
 911                 if (!W_ERROR_IS_OK(werr)) {
 912                         goto done;
 913                 }
 914
 915                 werr = libnet_conf_set_global_parameter(ctx, "realm",
 916                                                         r->out.dns_domain_name);
 917         }
 918
 919 done:
 920         libnet_conf_close(ctx);
 921         return werr;
 922 }
 923
 924 /****************************************************************
 925 ****************************************************************/
 926
 927 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
 928 {
 929         WERROR werr = WERR_OK;
 930         struct libnet_conf_ctx *ctx;
 931
 932         werr = libnet_conf_open(r, &ctx);
 933         if (!W_ERROR_IS_OK(werr)) {
 934                 goto done;
 935         }
 936
 937         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
 938
 939                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
 940                 if (!W_ERROR_IS_OK(werr)) {
 941                         goto done;
 942                 }
 943         }
 944
 945         libnet_conf_delete_global_parameter(ctx, "realm");
 946
 947 done:
 948         libnet_conf_close(ctx);
 949         return werr;
 950 }
 951
 952 /****************************************************************
 953 ****************************************************************/
 954
 955 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
 956 {
 957         WERROR werr;
 958
 959         if (!W_ERROR_IS_OK(r->out.result)) {
 960                 return r->out.result;
 961         }
 962
 963         if (!r->in.modify_config) {
 964                 return WERR_OK;
 965         }
 966
 967         werr = do_join_modify_vals_config(r);
 968         if (!W_ERROR_IS_OK(werr)) {
 969                 return werr;
 970         }
 971
 972         r->out.modified_config = true;
 973         r->out.result = werr;
 974
 975         return werr;
 976 }
 977
 978 /****************************************************************
 979 ****************************************************************/
 980
 981 static WERROR do_UnjoinConfig(struct libnet_UnjoinCtx *r)
 982 {
 983         WERROR werr;
 984
 985         if (!W_ERROR_IS_OK(r->out.result)) {
 986                 return r->out.result;
 987         }
 988
 989         if (!r->in.modify_config) {
 990                 return WERR_OK;
 991         }
 992
 993         werr = do_unjoin_modify_vals_config(r);
 994         if (!W_ERROR_IS_OK(werr)) {
 995                 return werr;
 996         }
 997
 998         r->out.modified_config = true;
 999         r->out.result = werr;
1000
1001         return werr;
1002 }
1003
1004 /****************************************************************
1005 ****************************************************************/
1006
1007 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1008                                          struct libnet_JoinCtx *r)
1009 {
1010
1011         if (!r->in.domain_name) {
1012                 return WERR_INVALID_PARAM;
1013         }
1014
1015         if (r->in.modify_config && !lp_include_registry_globals()) {
1016                 return WERR_NOT_SUPPORTED;
1017         }
1018
1019         if (IS_DC) {
1020                 return WERR_SETUP_DOMAIN_CONTROLLER;
1021         }
1022
1023         if (!secrets_init()) {
1024                 libnet_join_set_error_string(mem_ctx, r,
1025                         "Unable to open secrets database");
1026                 return WERR_CAN_NOT_COMPLETE;
1027         }
1028
1029         return WERR_OK;
1030 }
1031
1032 /****************************************************************
1033 ****************************************************************/
1034
1035 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1036                                           struct libnet_JoinCtx *r)
1037 {
1038         WERROR werr;
1039
1040         if (!W_ERROR_IS_OK(r->out.result)) {
1041                 return r->out.result;
1042         }
1043
1044         werr = do_JoinConfig(r);
1045         if (!W_ERROR_IS_OK(werr)) {
1046                 return werr;
1047         }
1048
1049         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1050                 saf_store(r->in.domain_name, r->in.dc_name);
1051         }
1052
1053         return WERR_OK;
1054 }
1055
1056 /****************************************************************
1057 ****************************************************************/
1058
1059 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1060 {
1061         if (r->in.ads) {
1062                 ads_destroy(&r->in.ads);
1063         }
1064
1065         return 0;
1066 }
1067
1068 /****************************************************************
1069 ****************************************************************/
1070
1071 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1072 {
1073         if (r->in.ads) {
1074                 ads_destroy(&r->in.ads);
1075         }
1076
1077         return 0;
1078 }
1079
1080 /****************************************************************
1081 ****************************************************************/
1082
1083 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1084                            struct libnet_JoinCtx **r)
1085 {
1086         struct libnet_JoinCtx *ctx;
1087
1088         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1089         if (!ctx) {
1090                 return WERR_NOMEM;
1091         }
1092
1093         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1094
1095         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1096         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1097
1098         *r = ctx;
1099
1100         return WERR_OK;
1101 }
1102
1103 /****************************************************************
1104 ****************************************************************/
1105
1106 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1107                              struct libnet_UnjoinCtx **r)
1108 {
1109         struct libnet_UnjoinCtx *ctx;
1110
1111         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1112         if (!ctx) {
1113                 return WERR_NOMEM;
1114         }
1115
1116         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1117
1118         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1119         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1120
1121         *r = ctx;
1122
1123         return WERR_OK;
1124 }
1125
1126 /****************************************************************
1127 ****************************************************************/
1128
1129 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1130                                 struct libnet_JoinCtx *r)
1131 {
1132         NTSTATUS status;
1133 #ifdef WITH_ADS
1134         ADS_STATUS ads_status;
1135 #endif /* WITH_ADS */
1136
1137         if (!r->in.dc_name) {
1138                 struct DS_DOMAIN_CONTROLLER_INFO *info;
1139                 status = dsgetdcname(mem_ctx,
1140                                      NULL,
1141                                      r->in.domain_name,
1142                                      NULL,
1143                                      NULL,
1144                                      DS_DIRECTORY_SERVICE_REQUIRED |
1145                                      DS_WRITABLE_REQUIRED |
1146                                      DS_RETURN_DNS_NAME,
1147                                      &info);
1148                 if (!NT_STATUS_IS_OK(status)) {
1149                         libnet_join_set_error_string(mem_ctx, r,
1150                                 "failed to find DC: %s",
1151                                 nt_errstr(status));
1152                         return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1153                 }
1154
1155                 r->in.dc_name = talloc_strdup(mem_ctx,
1156                                               info->domain_controller_name);
1157                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1158         }
1159
1160 #ifdef WITH_ADS
1161         if (r->in.account_ou) {
1162
1163                 ads_status = libnet_join_connect_ads(mem_ctx, r);
1164                 if (!ADS_ERR_OK(ads_status)) {
1165                         return WERR_DEFAULT_JOIN_REQUIRED;
1166                 }
1167
1168                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1169                 if (!ADS_ERR_OK(ads_status)) {
1170                         libnet_join_set_error_string(mem_ctx, r,
1171                                 "failed to precreate account in ou %s: %s",
1172                                 r->in.account_ou,
1173                                 ads_errstr(ads_status));
1174                         return WERR_DEFAULT_JOIN_REQUIRED;
1175                 }
1176
1177                 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1178         }
1179 #endif /* WITH_ADS */
1180
1181         status = libnet_join_joindomain_rpc(mem_ctx, r);
1182         if (!NT_STATUS_IS_OK(status)) {
1183                 libnet_join_set_error_string(mem_ctx, r,
1184                         "failed to join domain over rpc: %s",
1185                         nt_errstr(status));
1186                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1187                         return WERR_SETUP_ALREADY_JOINED;
1188                 }
1189                 return ntstatus_to_werror(status);
1190         }
1191
1192         if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1193                 return WERR_SETUP_NOT_JOINED;
1194         }
1195
1196 #ifdef WITH_ADS
1197         if (r->out.domain_is_ad) {
1198                 ads_status  = libnet_join_post_processing_ads(mem_ctx, r);
1199                 if (!ADS_ERR_OK(ads_status)) {
1200                         return WERR_GENERAL_FAILURE;
1201                 }
1202         }
1203 #endif /* WITH_ADS */
1204
1205         return WERR_OK;
1206 }
1207
1208 /****************************************************************
1209 ****************************************************************/
1210
1211 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1212                    struct libnet_JoinCtx *r)
1213 {
1214         WERROR werr;
1215
1216         if (r->in.debug) {
1217                 NDR_PRINT_IN_DEBUG(libnet_JoinCtx, r);
1218         }
1219
1220         werr = libnet_join_pre_processing(mem_ctx, r);
1221         if (!W_ERROR_IS_OK(werr)) {
1222                 goto done;
1223         }
1224
1225         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1226                 werr = libnet_DomainJoin(mem_ctx, r);
1227                 if (!W_ERROR_IS_OK(werr)) {
1228                         goto done;
1229                 }
1230         }
1231
1232         werr = libnet_join_post_processing(mem_ctx, r);
1233         if (!W_ERROR_IS_OK(werr)) {
1234                 goto done;
1235         }
1236  done:
1237         if (r->in.debug) {
1238                 NDR_PRINT_OUT_DEBUG(libnet_JoinCtx, r);
1239         }
1240         return werr;
1241 }
1242
1243 /****************************************************************
1244 ****************************************************************/
1245
1246 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1247                                   struct libnet_UnjoinCtx *r)
1248 {
1249         NTSTATUS status;
1250
1251         if (!r->in.dc_name) {
1252                 struct DS_DOMAIN_CONTROLLER_INFO *info;
1253                 status = dsgetdcname(mem_ctx,
1254                                      NULL,
1255                                      r->in.domain_name,
1256                                      NULL,
1257                                      NULL,
1258                                      DS_DIRECTORY_SERVICE_REQUIRED |
1259                                      DS_WRITABLE_REQUIRED |
1260                                      DS_RETURN_DNS_NAME,
1261                                      &info);
1262                 if (!NT_STATUS_IS_OK(status)) {
1263                         libnet_unjoin_set_error_string(mem_ctx, r,
1264                                 "failed to find DC: %s",
1265                                 nt_errstr(status));
1266                         return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1267                 }
1268
1269                 r->in.dc_name = talloc_strdup(mem_ctx,
1270                                               info->domain_controller_name);
1271                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1272         }
1273
1274         status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1275         if (!NT_STATUS_IS_OK(status)) {
1276                 libnet_unjoin_set_error_string(mem_ctx, r,
1277                         "failed to unjoin domain: %s",
1278                         nt_errstr(status));
1279                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1280                         return WERR_SETUP_NOT_JOINED;
1281                 }
1282                 return ntstatus_to_werror(status);
1283         }
1284
1285 #ifdef WITH_ADS
1286         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1287                 ADS_STATUS ads_status;
1288                 libnet_unjoin_connect_ads(mem_ctx, r);
1289                 ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
1290                 if (!ADS_ERR_OK(ads_status)) {
1291                         libnet_unjoin_set_error_string(mem_ctx, r,
1292                                 "failed to remove machine account from AD: %s",
1293                                 ads_errstr(ads_status));
1294                 }
1295         }
1296 #endif /* WITH_ADS */
1297
1298         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1299
1300         return WERR_OK;
1301 }
1302
1303 /****************************************************************
1304 ****************************************************************/
1305
1306 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
1307                                            struct libnet_UnjoinCtx *r)
1308 {
1309         if (r->in.modify_config && !lp_include_registry_globals()) {
1310                 return WERR_NOT_SUPPORTED;
1311         }
1312
1313         if (!secrets_init()) {
1314                 libnet_unjoin_set_error_string(mem_ctx, r,
1315                         "Unable to open secrets database");
1316                 return WERR_CAN_NOT_COMPLETE;
1317         }
1318
1319         return WERR_OK;
1320 }
1321
1322 /****************************************************************
1323 ****************************************************************/
1324
1325 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1326                      struct libnet_UnjoinCtx *r)
1327 {
1328         WERROR werr;
1329
1330         if (r->in.debug) {
1331                 NDR_PRINT_IN_DEBUG(libnet_UnjoinCtx, r);
1332         }
1333
1334         werr = libnet_unjoin_pre_processing(mem_ctx, r);
1335         if (!W_ERROR_IS_OK(werr)) {
1336                 goto done;
1337         }
1338
1339         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1340                 werr = libnet_DomainUnjoin(mem_ctx, r);
1341                 if (!W_ERROR_IS_OK(werr)) {
1342                         goto done;
1343                 }
1344         }
1345
1346         werr = do_UnjoinConfig(r);
1347         if (!W_ERROR_IS_OK(werr)) {
1348                 goto done;
1349         }
1350
1351  done:
1352         if (r->in.debug) {
1353                 NDR_PRINT_OUT_DEBUG(libnet_UnjoinCtx, r);
1354         }
1355
1356         return werr;
1357 }