source/libnet/libnet_join.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  libnet Join Support
   4  *  Copyright (C) Gerald (Jerry) Carter 2006
   5  *  Copyright (C) Guenther Deschner 2007-2008
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet_join.h"
  23 #include "libnet/libnet_proto.h"
  24
  25 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
  26                                                  struct libnet_JoinCtx *r)
  27 {
  28         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
  29                                       r->out.domain_sid))
  30         {
  31                 return false;
  32         }
  33
  34         if (!secrets_store_machine_password(r->in.machine_password,
  35                                             r->out.netbios_domain_name,
  36                                             SEC_CHAN_WKSTA))
  37         {
  38                 return false;
  39         }
  40
  41         return true;
  42 }
  43
  44 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
  45                                            struct libnet_JoinCtx *r)
  46 {
  47         struct cli_state *cli = NULL;
  48         struct rpc_pipe_client *pipe_hnd = NULL;
  49         POLICY_HND sam_pol, domain_pol, user_pol, lsa_pol;
  50         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
  51         char *acct_name;
  52         const char *const_acct_name;
  53         uint32 user_rid;
  54         uint32 num_rids, *name_types, *user_rids;
  55         uint32 flags = 0x3e8;
  56         uint32 acb_info = ACB_WSTRUST;
  57         uint32 fields_present;
  58         uchar pwbuf[532];
  59         SAM_USERINFO_CTR ctr;
  60         SAM_USER_INFO_25 p25;
  61         const int infolevel = 25;
  62         struct MD5Context md5ctx;
  63         uchar md5buffer[16];
  64         DATA_BLOB digested_session_key;
  65         uchar md4_trust_password[16];
  66
  67         if (!r->in.machine_password) {
  68                 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
  69                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
  70         }
  71
  72         status = cli_full_connection(&cli, NULL,
  73                                      r->in.dc_name,
  74                                      NULL, 0,
  75                                      "IPC$", "IPC",
  76                                      r->in.admin_account,
  77                                      NULL,
  78                                      r->in.admin_password,
  79                                      0,
  80                                      Undefined, NULL);
  81
  82         if (!NT_STATUS_IS_OK(status)) {
  83                 goto done;
  84         }
  85
  86         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
  87         if (!pipe_hnd) {
  88                 goto done;
  89         }
  90
  91         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
  92                                         SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
  93         if (!NT_STATUS_IS_OK(status)) {
  94                 goto done;
  95         }
  96
  97         status = rpccli_lsa_query_info_policy2(pipe_hnd, mem_ctx, &lsa_pol,
  98                                                12,
  99                                                &r->out.netbios_domain_name,
 100                                                &r->out.dns_domain_name,
 101                                                NULL,
 102                                                NULL,
 103                                                &r->out.domain_sid);
 104
 105         if (!NT_STATUS_IS_OK(status)) {
 106                 status = rpccli_lsa_query_info_policy(pipe_hnd, mem_ctx, &lsa_pol,
 107                                                       5,
 108                                                       &r->out.netbios_domain_name,
 109                                                       &r->out.domain_sid);
 110                 if (!NT_STATUS_IS_OK(status)) {
 111                         goto done;
 112                 }
 113         }
 114
 115         rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
 116         cli_rpc_pipe_close(pipe_hnd);
 117
 118         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 119         if (!pipe_hnd) {
 120                 goto done;
 121         }
 122
 123         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
 124                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
 125         if (!NT_STATUS_IS_OK(status)) {
 126                 goto done;
 127         }
 128
 129         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
 130                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
 131                                          r->out.domain_sid,
 132                                          &domain_pol);
 133         if (!NT_STATUS_IS_OK(status)) {
 134                 goto done;
 135         }
 136
 137         acct_name = talloc_asprintf(mem_ctx, "%s$", global_myname());
 138         strlower_m(acct_name);
 139         const_acct_name = acct_name;
 140
 141         status = rpccli_samr_create_dom_user(pipe_hnd, mem_ctx, &domain_pol,
 142                                              acct_name, ACB_WSTRUST,
 143                                              0xe005000b, &user_pol, &user_rid);
 144         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 145                 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
 146                         goto done;
 147                 }
 148         }
 149
 150         if (NT_STATUS_IS_OK(status)) {
 151                 rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 152         }
 153
 154         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
 155                                           &domain_pol, flags, 1,
 156                                           &const_acct_name,
 157                                           &num_rids, &user_rids, &name_types);
 158         if (!NT_STATUS_IS_OK(status)) {
 159                 goto done;
 160         }
 161
 162         if (name_types[0] != SID_NAME_USER) {
 163                 status = NT_STATUS_INVALID_WORKSTATION;
 164                 goto done;
 165         }
 166
 167         user_rid = user_rids[0];
 168
 169         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
 170                                        SEC_RIGHTS_MAXIMUM_ALLOWED, user_rid,
 171                                        &user_pol);
 172         if (!NT_STATUS_IS_OK(status)) {
 173                 goto done;
 174         }
 175
 176         E_md4hash(r->in.machine_password, md4_trust_password);
 177         encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
 178
 179         generate_random_buffer((uint8*)md5buffer, sizeof(md5buffer));
 180         digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
 181
 182         MD5Init(&md5ctx);
 183         MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
 184         MD5Update(&md5ctx, cli->user_session_key.data,
 185                   cli->user_session_key.length);
 186         MD5Final(digested_session_key.data, &md5ctx);
 187
 188         SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
 189         memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
 190
 191         acb_info |= ACB_PWNOEXP;
 192 #if 0
 193         if ( dom_type == ND_TYPE_AD ) {
 194 #if !defined(ENCTYPE_ARCFOUR_HMAC)
 195                 acb_info |= ACB_USE_DES_KEY_ONLY;
 196 #endif
 197                 ;;
 198         }
 199 #endif
 200         ZERO_STRUCT(ctr);
 201         ZERO_STRUCT(p25);
 202
 203         fields_present = ACCT_NT_PWD_SET | ACCT_LM_PWD_SET | ACCT_FLAGS;
 204         init_sam_user_info25P(&p25, fields_present, acb_info, (char *)pwbuf);
 205
 206         ctr.switch_value = infolevel;
 207         ctr.info.id25    = &p25;
 208
 209         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol,
 210                                            infolevel, &cli->user_session_key,
 211                                            &ctr);
 212         if (!NT_STATUS_IS_OK(status)) {
 213                 goto done;
 214         }
 215
 216         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 217         cli_rpc_pipe_close(pipe_hnd);
 218
 219         status = NT_STATUS_OK;
 220  done:
 221         if (cli) {
 222                 cli_shutdown(cli);
 223         }
 224
 225         return status;
 226 }
 227
 228 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
 229                                                     struct libnet_UnjoinCtx *r)
 230 {
 231         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
 232                 return false;
 233         }
 234
 235         if (!secrets_delete_domain_sid(lp_workgroup())) {
 236                 return false;
 237         }
 238
 239         return true;
 240 }
 241
 242 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
 243                                              struct libnet_UnjoinCtx *r)
 244 {
 245         struct cli_state *cli = NULL;
 246         struct rpc_pipe_client *pipe_hnd = NULL;
 247         POLICY_HND sam_pol, domain_pol, user_pol;
 248         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 249         char *acct_name;
 250         uint32 flags = 0x3e8;
 251         const char *const_acct_name;
 252         uint32 user_rid;
 253         uint32 num_rids, *name_types, *user_rids;
 254         SAM_USERINFO_CTR ctr, *qctr = NULL;
 255         SAM_USER_INFO_16 p16;
 256
 257         status = cli_full_connection(&cli, NULL,
 258                                      r->in.dc_name,
 259                                      NULL, 0,
 260                                      "IPC$", "IPC",
 261                                      r->in.admin_account,
 262                                      NULL,
 263                                      r->in.admin_password,
 264                                      0, Undefined, NULL);
 265
 266         if (!NT_STATUS_IS_OK(status)) {
 267                 goto done;
 268         }
 269
 270         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 271         if (!pipe_hnd) {
 272                 goto done;
 273         }
 274
 275         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
 276                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
 277         if (!NT_STATUS_IS_OK(status)) {
 278                 goto done;
 279         }
 280
 281         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
 282                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
 283                                          r->in.domain_sid,
 284                                          &domain_pol);
 285         if (!NT_STATUS_IS_OK(status)) {
 286                 goto done;
 287         }
 288
 289         acct_name = talloc_asprintf(mem_ctx, "%s$", global_myname());
 290         strlower_m(acct_name);
 291         const_acct_name = acct_name;
 292
 293         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
 294                                           &domain_pol, flags, 1,
 295                                           &const_acct_name,
 296                                           &num_rids, &user_rids, &name_types);
 297         if (!NT_STATUS_IS_OK(status)) {
 298                 goto done;
 299         }
 300
 301         if (name_types[0] != SID_NAME_USER) {
 302                 status = NT_STATUS_INVALID_WORKSTATION;
 303                 goto done;
 304         }
 305
 306         user_rid = user_rids[0];
 307
 308         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
 309                                        SEC_RIGHTS_MAXIMUM_ALLOWED,
 310                                        user_rid, &user_pol);
 311         if (!NT_STATUS_IS_OK(status)) {
 312                 goto done;
 313         }
 314
 315         status = rpccli_samr_query_userinfo(pipe_hnd, mem_ctx,
 316                                             &user_pol, 16, &qctr);
 317         if (!NT_STATUS_IS_OK(status)) {
 318                 rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 319                 goto done;
 320         }
 321
 322         ZERO_STRUCT(ctr);
 323         ctr.switch_value = 16;
 324         ctr.info.id16 = &p16;
 325
 326         p16.acb_info = qctr->info.id16->acb_info | ACB_DISABLED;
 327
 328         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol, 16,
 329                                            &cli->user_session_key, &ctr);
 330
 331         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 332
 333 done:
 334         if (pipe_hnd) {
 335                 rpccli_samr_close(pipe_hnd, mem_ctx, &domain_pol);
 336                 rpccli_samr_close(pipe_hnd, mem_ctx, &sam_pol);
 337                 cli_rpc_pipe_close(pipe_hnd);
 338         }
 339
 340         if (cli) {
 341                 cli_shutdown(cli);
 342         }
 343
 344         return status;
 345 }
 346
 347 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
 348 {
 349         WERROR werr;
 350         bool is_ad = false;
 351
 352         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
 353
 354                 werr = libnet_conf_set_global_parameter("security", "user");
 355                 W_ERROR_NOT_OK_RETURN(werr);
 356
 357                 werr = libnet_conf_set_global_parameter("workgroup",
 358                                                         r->in.domain_name);
 359                 return werr;
 360         }
 361
 362         if (r->out.dns_domain_name) {
 363                 is_ad = true;
 364         }
 365
 366         werr = libnet_conf_set_global_parameter("security", "domain");
 367         W_ERROR_NOT_OK_RETURN(werr);
 368
 369         werr = libnet_conf_set_global_parameter("workgroup",
 370                                                 r->out.netbios_domain_name);
 371         W_ERROR_NOT_OK_RETURN(werr);
 372
 373         if (is_ad) {
 374                 werr = libnet_conf_set_global_parameter("security", "ads");
 375                 W_ERROR_NOT_OK_RETURN(werr);
 376
 377                 werr = libnet_conf_set_global_parameter("realm",
 378                                                        r->out.dns_domain_name);
 379                 W_ERROR_NOT_OK_RETURN(werr);
 380         }
 381
 382         return werr;
 383 }
 384
 385 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
 386 {
 387         WERROR werr = WERR_OK;
 388
 389         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
 390
 391                 werr = libnet_conf_set_global_parameter("security", "user");
 392                 W_ERROR_NOT_OK_RETURN(werr);
 393         }
 394
 395         werr = libnet_conf_delete_parameter(GLOBAL_NAME, "realm");
 396
 397         return werr;
 398 }
 399
 400
 401 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
 402 {
 403         WERROR werr;
 404
 405         if (!W_ERROR_IS_OK(r->out.result)) {
 406                 return r->out.result;
 407         }
 408
 409         if (!r->in.modify_config) {
 410                 return WERR_OK;
 411         }
 412
 413         werr = do_join_modify_vals_config(r);
 414         if (!W_ERROR_IS_OK(werr)) {
 415                 return werr;
 416         }
 417
 418         r->out.modified_config = true;
 419         r->out.result = werr;
 420
 421         return werr;
 422 }
 423
 424 static WERROR do_UnjoinConfig(struct libnet_UnjoinCtx *r)
 425 {
 426         WERROR werr;
 427
 428         if (!W_ERROR_IS_OK(r->out.result)) {
 429                 return r->out.result;
 430         }
 431
 432         if (!r->in.modify_config) {
 433                 return WERR_OK;
 434         }
 435
 436         werr = do_unjoin_modify_vals_config(r);
 437         if (!W_ERROR_IS_OK(werr)) {
 438                 return werr;
 439         }
 440
 441         r->out.modified_config = true;
 442         r->out.result = werr;
 443
 444         return werr;
 445 }
 446
 447 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
 448                            struct libnet_JoinCtx **r)
 449 {
 450         struct libnet_JoinCtx *ctx;
 451
 452         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
 453         if (!ctx) {
 454                 return WERR_NOMEM;
 455         }
 456
 457         *r = ctx;
 458
 459         return WERR_OK;
 460 }
 461
 462 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
 463                              struct libnet_UnjoinCtx **r)
 464 {
 465         struct libnet_UnjoinCtx *ctx;
 466
 467         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
 468         if (!ctx) {
 469                 return WERR_NOMEM;
 470         }
 471
 472         *r = ctx;
 473
 474         return WERR_OK;
 475 }
 476
 477 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
 478                    struct libnet_JoinCtx *r)
 479 {
 480         WERROR werr;
 481         NTSTATUS status;
 482
 483         if (!r->in.domain_name) {
 484                 return WERR_INVALID_PARAM;
 485         }
 486
 487         if (r->in.modify_config && !lp_include_registry_globals()) {
 488                 return WERR_NOT_SUPPORTED;
 489         }
 490
 491         if (IS_DC) {
 492                 return WERR_SETUP_DOMAIN_CONTROLLER;
 493         }
 494
 495         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
 496
 497                 status = libnet_join_joindomain_rpc(mem_ctx, r);
 498                 if (!NT_STATUS_IS_OK(status)) {
 499                         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 500                                 return WERR_SETUP_ALREADY_JOINED;
 501                         }
 502                         return ntstatus_to_werror(status);
 503                 }
 504
 505                 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
 506                         return WERR_SETUP_NOT_JOINED;
 507                 }
 508         }
 509
 510         werr = do_JoinConfig(r);
 511         if (!W_ERROR_IS_OK(werr)) {
 512                 return werr;
 513         }
 514
 515         return werr;
 516 }
 517
 518 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
 519                      struct libnet_UnjoinCtx *r)
 520 {
 521         WERROR werr;
 522         NTSTATUS status;
 523
 524         if (r->in.modify_config && !lp_include_registry_globals()) {
 525                 return WERR_NOT_SUPPORTED;
 526         }
 527
 528         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
 529
 530                 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
 531                 if (!NT_STATUS_IS_OK(status)) {
 532                         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
 533                                 return WERR_SETUP_NOT_JOINED;
 534                         }
 535                         return ntstatus_to_werror(status);
 536                 }
 537
 538                 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
 539         }
 540
 541         werr = do_UnjoinConfig(r);
 542         if (!W_ERROR_IS_OK(werr)) {
 543                 return werr;
 544         }
 545
 546         return werr;
 547 }