source3/libnet/libnet_join.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  libnet Join Support
   4  *  Copyright (C) Gerald (Jerry) Carter 2006
   5  *  Copyright (C) Guenther Deschner 2007-2008
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23
  24 /****************************************************************
  25 ****************************************************************/
  26
  27 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
  28         do { \
  29                 char *str = NULL; \
  30                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
  31                 DEBUG(1,("libnet_Join:\n%s", str)); \
  32                 talloc_free(str); \
  33         } while (0)
  34
  35 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
  36         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
  37 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
  38         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
  39
  40 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
  41         do { \
  42                 char *str = NULL; \
  43                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
  44                 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
  45                 talloc_free(str); \
  46         } while (0)
  47
  48 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
  49         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
  50 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
  51         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
  52
  53 #define W_ERROR_NOT_OK_GOTO_DONE(x) do { \
  54         if (!W_ERROR_IS_OK(x)) {\
  55                 goto done;\
  56         }\
  57 } while (0)
  58
  59 /****************************************************************
  60 ****************************************************************/
  61
  62 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
  63                                          struct libnet_JoinCtx *r,
  64                                          const char *format, ...)
  65 {
  66         va_list args;
  67
  68         if (r->out.error_string) {
  69                 return;
  70         }
  71
  72         va_start(args, format);
  73         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  74         va_end(args);
  75 }
  76
  77 /****************************************************************
  78 ****************************************************************/
  79
  80 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
  81                                            struct libnet_UnjoinCtx *r,
  82                                            const char *format, ...)
  83 {
  84         va_list args;
  85
  86         if (r->out.error_string) {
  87                 return;
  88         }
  89
  90         va_start(args, format);
  91         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  92         va_end(args);
  93 }
  94
  95 #ifdef WITH_ADS
  96
  97 /****************************************************************
  98 ****************************************************************/
  99
 100 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
 101                                      const char *netbios_domain_name,
 102                                      const char *dc_name,
 103                                      const char *user_name,
 104                                      const char *password,
 105                                      ADS_STRUCT **ads)
 106 {
 107         ADS_STATUS status;
 108         ADS_STRUCT *my_ads = NULL;
 109
 110         my_ads = ads_init(dns_domain_name,
 111                           netbios_domain_name,
 112                           dc_name);
 113         if (!my_ads) {
 114                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 115         }
 116
 117         if (user_name) {
 118                 SAFE_FREE(my_ads->auth.user_name);
 119                 my_ads->auth.user_name = SMB_STRDUP(user_name);
 120         }
 121
 122         if (password) {
 123                 SAFE_FREE(my_ads->auth.password);
 124                 my_ads->auth.password = SMB_STRDUP(password);
 125         }
 126
 127         status = ads_connect(my_ads);
 128         if (!ADS_ERR_OK(status)) {
 129                 ads_destroy(&my_ads);
 130                 return status;
 131         }
 132
 133         *ads = my_ads;
 134         return ADS_SUCCESS;
 135 }
 136
 137 /****************************************************************
 138 ****************************************************************/
 139
 140 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
 141                                           struct libnet_JoinCtx *r)
 142 {
 143         ADS_STATUS status;
 144
 145         status = libnet_connect_ads(r->in.domain_name,
 146                                     r->in.domain_name,
 147                                     r->in.dc_name,
 148                                     r->in.admin_account,
 149                                     r->in.admin_password,
 150                                     &r->in.ads);
 151         if (!ADS_ERR_OK(status)) {
 152                 libnet_join_set_error_string(mem_ctx, r,
 153                         "failed to connect to AD: %s",
 154                         ads_errstr(status));
 155                 return status;
 156         }
 157
 158         if (!r->out.netbios_domain_name) {
 159                 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
 160                                                            r->in.ads->server.workgroup);
 161                 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
 162         }
 163
 164         if (!r->out.dns_domain_name) {
 165                 r->out.dns_domain_name = talloc_strdup(mem_ctx,
 166                                                        r->in.ads->config.realm);
 167                 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
 168         }
 169
 170         r->out.domain_is_ad = true;
 171
 172         return ADS_SUCCESS;
 173 }
 174
 175 /****************************************************************
 176 ****************************************************************/
 177
 178 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
 179                                             struct libnet_UnjoinCtx *r)
 180 {
 181         ADS_STATUS status;
 182
 183         status = libnet_connect_ads(r->in.domain_name,
 184                                     r->in.domain_name,
 185                                     r->in.dc_name,
 186                                     r->in.admin_account,
 187                                     r->in.admin_password,
 188                                     &r->in.ads);
 189         if (!ADS_ERR_OK(status)) {
 190                 libnet_unjoin_set_error_string(mem_ctx, r,
 191                         "failed to connect to AD: %s",
 192                         ads_errstr(status));
 193         }
 194
 195         return status;
 196 }
 197
 198 /****************************************************************
 199 ****************************************************************/
 200
 201 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
 202                                                      struct libnet_JoinCtx *r)
 203 {
 204         ADS_STATUS status;
 205         LDAPMessage *res = NULL;
 206         const char *attrs[] = { "dn", NULL };
 207
 208         status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
 209         if (!ADS_ERR_OK(status)) {
 210                 return status;
 211         }
 212
 213         if (ads_count_replies(r->in.ads, res) != 1) {
 214                 ads_msgfree(r->in.ads, res);
 215                 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
 216         }
 217
 218         status = ads_create_machine_acct(r->in.ads,
 219                                          r->in.machine_name,
 220                                          r->in.account_ou);
 221         ads_msgfree(r->in.ads, res);
 222
 223         if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
 224             (status.err.rc == LDAP_ALREADY_EXISTS)) {
 225                 status = ADS_SUCCESS;
 226         }
 227
 228         return status;
 229 }
 230
 231 /****************************************************************
 232 ****************************************************************/
 233
 234 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
 235                                                     struct libnet_UnjoinCtx *r)
 236 {
 237         ADS_STATUS status;
 238
 239         if (!r->in.ads) {
 240                 status = libnet_unjoin_connect_ads(mem_ctx, r);
 241                 if (!ADS_ERR_OK(status)) {
 242                         return status;
 243                 }
 244         }
 245
 246         status = ads_leave_realm(r->in.ads, r->in.machine_name);
 247         if (!ADS_ERR_OK(status)) {
 248                 libnet_unjoin_set_error_string(mem_ctx, r,
 249                         "failed to leave realm: %s",
 250                         ads_errstr(status));
 251                 return status;
 252         }
 253
 254         return ADS_SUCCESS;
 255 }
 256
 257 /****************************************************************
 258 ****************************************************************/
 259
 260 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
 261                                                 struct libnet_JoinCtx *r)
 262 {
 263         ADS_STATUS status;
 264         LDAPMessage *res = NULL;
 265         char *dn = NULL;
 266
 267         if (!r->in.machine_name) {
 268                 return ADS_ERROR(LDAP_NO_MEMORY);
 269         }
 270
 271         status = ads_find_machine_acct(r->in.ads,
 272                                        &res,
 273                                        r->in.machine_name);
 274         if (!ADS_ERR_OK(status)) {
 275                 return status;
 276         }
 277
 278         if (ads_count_replies(r->in.ads, res) != 1) {
 279                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 280                 goto done;
 281         }
 282
 283         dn = ads_get_dn(r->in.ads, res);
 284         if (!dn) {
 285                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 286                 goto done;
 287         }
 288
 289         r->out.dn = talloc_strdup(mem_ctx, dn);
 290         if (!r->out.dn) {
 291                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 292                 goto done;
 293         }
 294
 295  done:
 296         ads_msgfree(r->in.ads, res);
 297         ads_memfree(r->in.ads, dn);
 298
 299         return status;
 300 }
 301
 302 /****************************************************************
 303 ****************************************************************/
 304
 305 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
 306                                               struct libnet_JoinCtx *r)
 307 {
 308         ADS_STATUS status;
 309         ADS_MODLIST mods;
 310         fstring my_fqdn;
 311         const char *spn_array[3] = {NULL, NULL, NULL};
 312         char *spn = NULL;
 313
 314         status = libnet_join_find_machine_acct(mem_ctx, r);
 315         if (!ADS_ERR_OK(status)) {
 316                 return status;
 317         }
 318
 319         spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
 320         if (!spn) {
 321                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 322         }
 323         strupper_m(spn);
 324         spn_array[0] = spn;
 325
 326         if (name_to_fqdn(my_fqdn, r->in.machine_name) &&
 327             !strequal(my_fqdn, r->in.machine_name)) {
 328
 329                 strlower_m(my_fqdn);
 330                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
 331                 if (!spn) {
 332                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 333                 }
 334                 spn_array[1] = spn;
 335         }
 336
 337         mods = ads_init_mods(mem_ctx);
 338         if (!mods) {
 339                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 340         }
 341
 342         status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
 343         if (!ADS_ERR_OK(status)) {
 344                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 345         }
 346
 347         status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
 348                                  spn_array);
 349         if (!ADS_ERR_OK(status)) {
 350                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 351         }
 352
 353         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 354 }
 355
 356 /****************************************************************
 357 ****************************************************************/
 358
 359 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
 360                                               struct libnet_JoinCtx *r)
 361 {
 362         ADS_STATUS status;
 363         ADS_MODLIST mods;
 364
 365         if (!r->in.create_upn) {
 366                 return ADS_SUCCESS;
 367         }
 368
 369         status = libnet_join_find_machine_acct(mem_ctx, r);
 370         if (!ADS_ERR_OK(status)) {
 371                 return status;
 372         }
 373
 374         if (!r->in.upn) {
 375                 r->in.upn = talloc_asprintf(mem_ctx,
 376                                             "host/%s@%s",
 377                                             r->in.machine_name,
 378                                             r->out.dns_domain_name);
 379                 if (!r->in.upn) {
 380                         return ADS_ERROR(LDAP_NO_MEMORY);
 381                 }
 382         }
 383
 384         mods = ads_init_mods(mem_ctx);
 385         if (!mods) {
 386                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 387         }
 388
 389         status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
 390         if (!ADS_ERR_OK(status)) {
 391                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 392         }
 393
 394         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 395 }
 396
 397
 398 /****************************************************************
 399 ****************************************************************/
 400
 401 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
 402                                                 struct libnet_JoinCtx *r)
 403 {
 404         ADS_STATUS status;
 405         ADS_MODLIST mods;
 406         char *os_sp = NULL;
 407
 408         if (!r->in.os_name || !r->in.os_version ) {
 409                 return ADS_SUCCESS;
 410         }
 411
 412         status = libnet_join_find_machine_acct(mem_ctx, r);
 413         if (!ADS_ERR_OK(status)) {
 414                 return status;
 415         }
 416
 417         mods = ads_init_mods(mem_ctx);
 418         if (!mods) {
 419                 return ADS_ERROR(LDAP_NO_MEMORY);
 420         }
 421
 422         os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
 423         if (!os_sp) {
 424                 return ADS_ERROR(LDAP_NO_MEMORY);
 425         }
 426
 427         status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
 428                              r->in.os_name);
 429         if (!ADS_ERR_OK(status)) {
 430                 return status;
 431         }
 432
 433         status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
 434                              r->in.os_version);
 435         if (!ADS_ERR_OK(status)) {
 436                 return status;
 437         }
 438
 439         status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
 440                              os_sp);
 441         if (!ADS_ERR_OK(status)) {
 442                 return status;
 443         }
 444
 445         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 446 }
 447
 448 /****************************************************************
 449 ****************************************************************/
 450
 451 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
 452                                       struct libnet_JoinCtx *r)
 453 {
 454         if (!lp_use_kerberos_keytab()) {
 455                 return true;
 456         }
 457
 458         if (!ads_keytab_create_default(r->in.ads)) {
 459                 return false;
 460         }
 461
 462         return true;
 463 }
 464
 465 /****************************************************************
 466 ****************************************************************/
 467
 468 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
 469                                                  struct libnet_JoinCtx *r)
 470 {
 471         uint32_t domain_func;
 472         ADS_STATUS status;
 473         const char *salt = NULL;
 474         char *std_salt = NULL;
 475
 476         status = ads_domain_func_level(r->in.ads, &domain_func);
 477         if (!ADS_ERR_OK(status)) {
 478                 libnet_join_set_error_string(mem_ctx, r,
 479                         "failed to determine domain functional level: %s",
 480                         ads_errstr(status));
 481                 return false;
 482         }
 483
 484         std_salt = kerberos_standard_des_salt();
 485         if (!std_salt) {
 486                 libnet_join_set_error_string(mem_ctx, r,
 487                         "failed to obtain standard DES salt");
 488                 return false;
 489         }
 490
 491         salt = talloc_strdup(mem_ctx, std_salt);
 492         if (!salt) {
 493                 return false;
 494         }
 495
 496         SAFE_FREE(std_salt);
 497
 498         if (domain_func == DS_DOMAIN_FUNCTION_2000) {
 499                 char *upn;
 500
 501                 upn = ads_get_upn(r->in.ads, mem_ctx,
 502                                   r->in.machine_name);
 503                 if (upn) {
 504                         salt = talloc_strdup(mem_ctx, upn);
 505                         if (!salt) {
 506                                 return false;
 507                         }
 508                 }
 509         }
 510
 511         return kerberos_secrets_store_des_salt(salt);
 512 }
 513
 514 /****************************************************************
 515 ****************************************************************/
 516
 517 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
 518                                                   struct libnet_JoinCtx *r)
 519 {
 520         ADS_STATUS status;
 521
 522         if (!r->in.ads) {
 523                 status = libnet_join_connect_ads(mem_ctx, r);
 524                 if (!ADS_ERR_OK(status)) {
 525                         return status;
 526                 }
 527         }
 528
 529         status = libnet_join_set_machine_spn(mem_ctx, r);
 530         if (!ADS_ERR_OK(status)) {
 531                 libnet_join_set_error_string(mem_ctx, r,
 532                         "failed to set machine spn: %s",
 533                         ads_errstr(status));
 534                 return status;
 535         }
 536
 537         status = libnet_join_set_os_attributes(mem_ctx, r);
 538         if (!ADS_ERR_OK(status)) {
 539                 libnet_join_set_error_string(mem_ctx, r,
 540                         "failed to set machine os attributes: %s",
 541                         ads_errstr(status));
 542                 return status;
 543         }
 544
 545         status = libnet_join_set_machine_upn(mem_ctx, r);
 546         if (!ADS_ERR_OK(status)) {
 547                 libnet_join_set_error_string(mem_ctx, r,
 548                         "failed to set machine upn: %s",
 549                         ads_errstr(status));
 550                 return status;
 551         }
 552
 553         if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
 554                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 555         }
 556
 557         if (!libnet_join_create_keytab(mem_ctx, r)) {
 558                 libnet_join_set_error_string(mem_ctx, r,
 559                         "failed to create kerberos keytab");
 560                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 561         }
 562
 563         return ADS_SUCCESS;
 564 }
 565 #endif /* WITH_ADS */
 566
 567 /****************************************************************
 568 ****************************************************************/
 569
 570 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
 571                                                  struct libnet_JoinCtx *r)
 572 {
 573         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
 574                                       r->out.domain_sid))
 575         {
 576                 return false;
 577         }
 578
 579         if (!secrets_store_machine_password(r->in.machine_password,
 580                                             r->out.netbios_domain_name,
 581                                             SEC_CHAN_WKSTA))
 582         {
 583                 return false;
 584         }
 585
 586         return true;
 587 }
 588
 589 /****************************************************************
 590 ****************************************************************/
 591
 592 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
 593                                            struct libnet_JoinCtx *r)
 594 {
 595         struct cli_state *cli = NULL;
 596         struct rpc_pipe_client *pipe_hnd = NULL;
 597         POLICY_HND sam_pol, domain_pol, user_pol, lsa_pol;
 598         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 599         char *acct_name;
 600         struct lsa_String lsa_acct_name;
 601         uint32 user_rid;
 602         uint32 acb_info = ACB_WSTRUST;
 603         uchar pwbuf[532];
 604         struct MD5Context md5ctx;
 605         uchar md5buffer[16];
 606         DATA_BLOB digested_session_key;
 607         uchar md4_trust_password[16];
 608         union lsa_PolicyInformation *info = NULL;
 609         struct samr_Ids user_rids;
 610         struct samr_Ids name_types;
 611         union samr_UserInfo user_info;
 612
 613         if (!r->in.machine_password) {
 614                 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
 615                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
 616         }
 617
 618         status = cli_full_connection(&cli, NULL,
 619                                      r->in.dc_name,
 620                                      NULL, 0,
 621                                      "IPC$", "IPC",
 622                                      r->in.admin_account,
 623                                      NULL,
 624                                      r->in.admin_password,
 625                                      0,
 626                                      Undefined, NULL);
 627
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 goto done;
 630         }
 631
 632         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
 633         if (!pipe_hnd) {
 634                 goto done;
 635         }
 636
 637         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
 638                                         SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
 639         if (!NT_STATUS_IS_OK(status)) {
 640                 goto done;
 641         }
 642
 643         status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
 644                                              &lsa_pol,
 645                                              LSA_POLICY_INFO_DNS,
 646                                              &info);
 647         if (NT_STATUS_IS_OK(status)) {
 648                 r->out.domain_is_ad = true;
 649                 r->out.netbios_domain_name = info->dns.name.string;
 650                 r->out.dns_domain_name = info->dns.dns_domain.string;
 651                 r->out.domain_sid = info->dns.sid;
 652         }
 653
 654         if (!NT_STATUS_IS_OK(status)) {
 655                 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
 656                                                     &lsa_pol,
 657                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
 658                                                     &info);
 659                 if (!NT_STATUS_IS_OK(status)) {
 660                         goto done;
 661                 }
 662
 663                 r->out.netbios_domain_name = info->account_domain.name.string;
 664                 r->out.domain_sid = info->account_domain.sid;
 665         }
 666
 667         rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
 668         cli_rpc_pipe_close(pipe_hnd);
 669
 670         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 671         if (!pipe_hnd) {
 672                 goto done;
 673         }
 674
 675         status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
 676                                       pipe_hnd->cli->desthost,
 677                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
 678                                       &sam_pol);
 679         if (!NT_STATUS_IS_OK(status)) {
 680                 goto done;
 681         }
 682
 683         status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
 684                                         &sam_pol,
 685                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
 686                                         r->out.domain_sid,
 687                                         &domain_pol);
 688         if (!NT_STATUS_IS_OK(status)) {
 689                 goto done;
 690         }
 691
 692         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
 693         strlower_m(acct_name);
 694
 695         init_lsa_String(&lsa_acct_name, acct_name);
 696
 697         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
 698                 uint32_t acct_flags =
 699                         SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
 700                         SEC_STD_WRITE_DAC | SEC_STD_DELETE |
 701                         SAMR_USER_ACCESS_SET_PASSWORD |
 702                         SAMR_USER_ACCESS_GET_ATTRIBUTES |
 703                         SAMR_USER_ACCESS_SET_ATTRIBUTES;
 704                 uint32_t access_granted = 0;
 705
 706                 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
 707                                                  &domain_pol,
 708                                                  &lsa_acct_name,
 709                                                  ACB_WSTRUST,
 710                                                  acct_flags,
 711                                                  &user_pol,
 712                                                  &access_granted,
 713                                                  &user_rid);
 714                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 715                         if (!(r->in.join_flags &
 716                               WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
 717                                 goto done;
 718                         }
 719                 }
 720
 721                 if (NT_STATUS_IS_OK(status)) {
 722                         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
 723                 }
 724         }
 725
 726         status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
 727                                          &domain_pol,
 728                                          1,
 729                                          &lsa_acct_name,
 730                                          &user_rids,
 731                                          &name_types);
 732         if (!NT_STATUS_IS_OK(status)) {
 733                 goto done;
 734         }
 735
 736         if (name_types.ids[0] != SID_NAME_USER) {
 737                 status = NT_STATUS_INVALID_WORKSTATION;
 738                 goto done;
 739         }
 740
 741         user_rid = user_rids.ids[0];
 742
 743         status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
 744                                       &domain_pol,
 745                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
 746                                       user_rid,
 747                                       &user_pol);
 748         if (!NT_STATUS_IS_OK(status)) {
 749                 goto done;
 750         }
 751
 752         E_md4hash(r->in.machine_password, md4_trust_password);
 753         encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
 754
 755         generate_random_buffer((uint8*)md5buffer, sizeof(md5buffer));
 756         digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
 757
 758         MD5Init(&md5ctx);
 759         MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
 760         MD5Update(&md5ctx, cli->user_session_key.data,
 761                   cli->user_session_key.length);
 762         MD5Final(digested_session_key.data, &md5ctx);
 763
 764         SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
 765         memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
 766
 767         acb_info |= ACB_PWNOEXP;
 768         if (r->out.domain_is_ad) {
 769 #if !defined(ENCTYPE_ARCFOUR_HMAC)
 770                 acb_info |= ACB_USE_DES_KEY_ONLY;
 771 #endif
 772                 ;;
 773         }
 774
 775         ZERO_STRUCT(user_info.info25);
 776
 777         user_info.info25.info.fields_present = ACCT_NT_PWD_SET |
 778                                                ACCT_LM_PWD_SET |
 779                                                SAMR_FIELD_ACCT_FLAGS;
 780         user_info.info25.info.acct_flags = acb_info;
 781         memcpy(&user_info.info25.password.data, pwbuf, sizeof(pwbuf));
 782
 783         status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
 784                                          &user_pol,
 785                                          25,
 786                                          &user_info);
 787         if (!NT_STATUS_IS_OK(status)) {
 788                 goto done;
 789         }
 790
 791         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
 792         cli_rpc_pipe_close(pipe_hnd);
 793
 794         status = NT_STATUS_OK;
 795  done:
 796         if (cli) {
 797                 cli_shutdown(cli);
 798         }
 799
 800         return status;
 801 }
 802
 803 /****************************************************************
 804 ****************************************************************/
 805
 806 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
 807                         const char *machine_name,
 808                         const char *dc_name)
 809 {
 810         uint32_t neg_flags = NETLOGON_NEG_AUTH2_FLAGS |
 811                              NETLOGON_NEG_SCHANNEL;
 812         /* FIXME: NETLOGON_NEG_SELECT_AUTH2_FLAGS */
 813         struct cli_state *cli = NULL;
 814         struct rpc_pipe_client *pipe_hnd = NULL;
 815         struct rpc_pipe_client *netlogon_pipe = NULL;
 816         NTSTATUS status;
 817         char *machine_password = NULL;
 818         char *machine_account = NULL;
 819
 820         if (!dc_name) {
 821                 return NT_STATUS_INVALID_PARAMETER;
 822         }
 823
 824         if (!secrets_init()) {
 825                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 826         }
 827
 828         machine_password = secrets_fetch_machine_password(netbios_domain_name,
 829                                                           NULL, NULL);
 830         if (!machine_password) {
 831                 return NT_STATUS_NO_TRUST_LSA_SECRET;
 832         }
 833
 834         asprintf(&machine_account, "%s$", machine_name);
 835         if (!machine_account) {
 836                 SAFE_FREE(machine_password);
 837                 return NT_STATUS_NO_MEMORY;
 838         }
 839
 840         status = cli_full_connection(&cli, NULL,
 841                                      dc_name,
 842                                      NULL, 0,
 843                                      "IPC$", "IPC",
 844                                      machine_account,
 845                                      NULL,
 846                                      machine_password,
 847                                      0,
 848                                      Undefined, NULL);
 849         free(machine_account);
 850         free(machine_password);
 851
 852         if (!NT_STATUS_IS_OK(status)) {
 853                 status = cli_full_connection(&cli, NULL,
 854                                              dc_name,
 855                                              NULL, 0,
 856                                              "IPC$", "IPC",
 857                                              "",
 858                                              NULL,
 859                                              "",
 860                                              0,
 861                                              Undefined, NULL);
 862         }
 863
 864         if (!NT_STATUS_IS_OK(status)) {
 865                 return status;
 866         }
 867
 868         netlogon_pipe = get_schannel_session_key(cli,
 869                                                  netbios_domain_name,
 870                                                  &neg_flags, &status);
 871         if (!netlogon_pipe) {
 872                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
 873                         cli_shutdown(cli);
 874                         return NT_STATUS_OK;
 875                 }
 876
 877                 DEBUG(0,("libnet_join_ok: failed to get schannel session "
 878                         "key from server %s for domain %s. Error was %s\n",
 879                 cli->desthost, netbios_domain_name, nt_errstr(status)));
 880                 cli_shutdown(cli);
 881                 return status;
 882         }
 883
 884         if (!lp_client_schannel()) {
 885                 cli_shutdown(cli);
 886                 return NT_STATUS_OK;
 887         }
 888
 889         pipe_hnd = cli_rpc_pipe_open_schannel_with_key(cli, PI_NETLOGON,
 890                                                        PIPE_AUTH_LEVEL_PRIVACY,
 891                                                        netbios_domain_name,
 892                                                        netlogon_pipe->dc,
 893                                                        &status);
 894
 895         cli_shutdown(cli);
 896
 897         if (!pipe_hnd) {
 898                 DEBUG(0,("libnet_join_ok: failed to open schannel session "
 899                         "on netlogon pipe to server %s for domain %s. "
 900                         "Error was %s\n",
 901                         cli->desthost, netbios_domain_name, nt_errstr(status)));
 902                 return status;
 903         }
 904
 905         return NT_STATUS_OK;
 906 }
 907
 908 /****************************************************************
 909 ****************************************************************/
 910
 911 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
 912                                       struct libnet_JoinCtx *r)
 913 {
 914         NTSTATUS status;
 915
 916         status = libnet_join_ok(r->out.netbios_domain_name,
 917                                 r->in.machine_name,
 918                                 r->in.dc_name);
 919         if (!NT_STATUS_IS_OK(status)) {
 920                 libnet_join_set_error_string(mem_ctx, r,
 921                         "failed to verify domain membership after joining: %s",
 922                         get_friendly_nt_error_msg(status));
 923                 return WERR_SETUP_NOT_JOINED;
 924         }
 925
 926         return WERR_OK;
 927 }
 928
 929 /****************************************************************
 930 ****************************************************************/
 931
 932 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
 933                                                     struct libnet_UnjoinCtx *r)
 934 {
 935         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
 936                 return false;
 937         }
 938
 939         if (!secrets_delete_domain_sid(lp_workgroup())) {
 940                 return false;
 941         }
 942
 943         return true;
 944 }
 945
 946 /****************************************************************
 947 ****************************************************************/
 948
 949 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
 950                                              struct libnet_UnjoinCtx *r)
 951 {
 952         struct cli_state *cli = NULL;
 953         struct rpc_pipe_client *pipe_hnd = NULL;
 954         POLICY_HND sam_pol, domain_pol, user_pol;
 955         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 956         char *acct_name;
 957         uint32 user_rid;
 958         struct lsa_String lsa_acct_name;
 959         struct samr_Ids user_rids;
 960         struct samr_Ids name_types;
 961         union samr_UserInfo *info = NULL;
 962
 963         status = cli_full_connection(&cli, NULL,
 964                                      r->in.dc_name,
 965                                      NULL, 0,
 966                                      "IPC$", "IPC",
 967                                      r->in.admin_account,
 968                                      NULL,
 969                                      r->in.admin_password,
 970                                      0, Undefined, NULL);
 971
 972         if (!NT_STATUS_IS_OK(status)) {
 973                 goto done;
 974         }
 975
 976         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 977         if (!pipe_hnd) {
 978                 goto done;
 979         }
 980
 981         status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
 982                                       pipe_hnd->cli->desthost,
 983                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
 984                                       &sam_pol);
 985         if (!NT_STATUS_IS_OK(status)) {
 986                 goto done;
 987         }
 988
 989         status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
 990                                         &sam_pol,
 991                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
 992                                         r->in.domain_sid,
 993                                         &domain_pol);
 994         if (!NT_STATUS_IS_OK(status)) {
 995                 goto done;
 996         }
 997
 998         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
 999         strlower_m(acct_name);
1000
1001         init_lsa_String(&lsa_acct_name, acct_name);
1002
1003         status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1004                                          &domain_pol,
1005                                          1,
1006                                          &lsa_acct_name,
1007                                          &user_rids,
1008                                          &name_types);
1009
1010         if (!NT_STATUS_IS_OK(status)) {
1011                 goto done;
1012         }
1013
1014         if (name_types.ids[0] != SID_NAME_USER) {
1015                 status = NT_STATUS_INVALID_WORKSTATION;
1016                 goto done;
1017         }
1018
1019         user_rid = user_rids.ids[0];
1020
1021         status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1022                                       &domain_pol,
1023                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
1024                                       user_rid,
1025                                       &user_pol);
1026         if (!NT_STATUS_IS_OK(status)) {
1027                 goto done;
1028         }
1029
1030         status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1031                                            &user_pol,
1032                                            16,
1033                                            &info);
1034         if (!NT_STATUS_IS_OK(status)) {
1035                 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1036                 goto done;
1037         }
1038
1039         info->info16.acct_flags |= ACB_DISABLED;
1040
1041         status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1042                                          &user_pol,
1043                                          16,
1044                                          info);
1045
1046         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1047
1048 done:
1049         if (pipe_hnd) {
1050                 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1051                 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1052                 cli_rpc_pipe_close(pipe_hnd);
1053         }
1054
1055         if (cli) {
1056                 cli_shutdown(cli);
1057         }
1058
1059         return status;
1060 }
1061
1062 /****************************************************************
1063 ****************************************************************/
1064
1065 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1066 {
1067         WERROR werr;
1068         struct libnet_conf_ctx *ctx;
1069
1070         werr = libnet_conf_open(r, &ctx);
1071         if (!W_ERROR_IS_OK(werr)) {
1072                 goto done;
1073         }
1074
1075         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1076
1077                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
1078                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1079
1080                 werr = libnet_conf_set_global_parameter(ctx, "workgroup",
1081                                                         r->in.domain_name);
1082                 goto done;
1083         }
1084
1085         werr = libnet_conf_set_global_parameter(ctx, "security", "domain");
1086         W_ERROR_NOT_OK_GOTO_DONE(werr);
1087
1088         werr = libnet_conf_set_global_parameter(ctx, "workgroup",
1089                                                 r->out.netbios_domain_name);
1090         W_ERROR_NOT_OK_GOTO_DONE(werr);
1091
1092         if (r->out.domain_is_ad) {
1093                 werr = libnet_conf_set_global_parameter(ctx, "security", "ads");
1094                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1095
1096                 werr = libnet_conf_set_global_parameter(ctx, "realm",
1097                                                         r->out.dns_domain_name);
1098                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1099         }
1100
1101  done:
1102         libnet_conf_close(ctx);
1103         return werr;
1104 }
1105
1106 /****************************************************************
1107 ****************************************************************/
1108
1109 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1110 {
1111         WERROR werr = WERR_OK;
1112         struct libnet_conf_ctx *ctx;
1113
1114         werr = libnet_conf_open(r, &ctx);
1115         if (!W_ERROR_IS_OK(werr)) {
1116                 goto done;
1117         }
1118
1119         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1120
1121                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
1122                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1123                 libnet_conf_delete_global_parameter(ctx, "realm");
1124         }
1125
1126  done:
1127         libnet_conf_close(ctx);
1128         return werr;
1129 }
1130
1131 /****************************************************************
1132 ****************************************************************/
1133
1134 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1135 {
1136         WERROR werr;
1137
1138         if (!W_ERROR_IS_OK(r->out.result)) {
1139                 return r->out.result;
1140         }
1141
1142         if (!r->in.modify_config) {
1143                 return WERR_OK;
1144         }
1145
1146         werr = do_join_modify_vals_config(r);
1147         if (!W_ERROR_IS_OK(werr)) {
1148                 return werr;
1149         }
1150
1151         r->out.modified_config = true;
1152         r->out.result = werr;
1153
1154         return werr;
1155 }
1156
1157 /****************************************************************
1158 ****************************************************************/
1159
1160 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1161 {
1162         WERROR werr;
1163
1164         if (!W_ERROR_IS_OK(r->out.result)) {
1165                 return r->out.result;
1166         }
1167
1168         if (!r->in.modify_config) {
1169                 return WERR_OK;
1170         }
1171
1172         werr = do_unjoin_modify_vals_config(r);
1173         if (!W_ERROR_IS_OK(werr)) {
1174                 return werr;
1175         }
1176
1177         r->out.modified_config = true;
1178         r->out.result = werr;
1179
1180         return werr;
1181 }
1182
1183 /****************************************************************
1184 ****************************************************************/
1185
1186 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1187                                          struct libnet_JoinCtx *r)
1188 {
1189         if (!r->in.domain_name) {
1190                 libnet_join_set_error_string(mem_ctx, r,
1191                         "No domain name defined");
1192                 return WERR_INVALID_PARAM;
1193         }
1194
1195         if (r->in.modify_config && !lp_config_backend_is_registry()) {
1196                 return WERR_NOT_SUPPORTED;
1197         }
1198
1199         if (IS_DC) {
1200                 return WERR_SETUP_DOMAIN_CONTROLLER;
1201         }
1202
1203         if (!secrets_init()) {
1204                 libnet_join_set_error_string(mem_ctx, r,
1205                         "Unable to open secrets database");
1206                 return WERR_CAN_NOT_COMPLETE;
1207         }
1208
1209         return WERR_OK;
1210 }
1211
1212 /****************************************************************
1213 ****************************************************************/
1214
1215 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1216                                           struct libnet_JoinCtx *r)
1217 {
1218         WERROR werr;
1219
1220         if (!W_ERROR_IS_OK(r->out.result)) {
1221                 return r->out.result;
1222         }
1223
1224         werr = do_JoinConfig(r);
1225         if (!W_ERROR_IS_OK(werr)) {
1226                 return werr;
1227         }
1228
1229         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1230                 saf_store(r->in.domain_name, r->in.dc_name);
1231         }
1232
1233         return WERR_OK;
1234 }
1235
1236 /****************************************************************
1237 ****************************************************************/
1238
1239 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1240 {
1241         if (r->in.ads) {
1242                 ads_destroy(&r->in.ads);
1243         }
1244
1245         return 0;
1246 }
1247
1248 /****************************************************************
1249 ****************************************************************/
1250
1251 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1252 {
1253         if (r->in.ads) {
1254                 ads_destroy(&r->in.ads);
1255         }
1256
1257         return 0;
1258 }
1259
1260 /****************************************************************
1261 ****************************************************************/
1262
1263 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1264                            struct libnet_JoinCtx **r)
1265 {
1266         struct libnet_JoinCtx *ctx;
1267
1268         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1269         if (!ctx) {
1270                 return WERR_NOMEM;
1271         }
1272
1273         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1274
1275         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1276         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1277
1278         *r = ctx;
1279
1280         return WERR_OK;
1281 }
1282
1283 /****************************************************************
1284 ****************************************************************/
1285
1286 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1287                              struct libnet_UnjoinCtx **r)
1288 {
1289         struct libnet_UnjoinCtx *ctx;
1290
1291         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1292         if (!ctx) {
1293                 return WERR_NOMEM;
1294         }
1295
1296         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1297
1298         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1299         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1300
1301         *r = ctx;
1302
1303         return WERR_OK;
1304 }
1305
1306 /****************************************************************
1307 ****************************************************************/
1308
1309 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1310                                 struct libnet_JoinCtx *r)
1311 {
1312         NTSTATUS status;
1313 #ifdef WITH_ADS
1314         ADS_STATUS ads_status;
1315 #endif /* WITH_ADS */
1316
1317         if (!r->in.dc_name) {
1318                 struct netr_DsRGetDCNameInfo *info;
1319                 status = dsgetdcname(mem_ctx,
1320                                      r->in.domain_name,
1321                                      NULL,
1322                                      NULL,
1323                                      DS_DIRECTORY_SERVICE_REQUIRED |
1324                                      DS_WRITABLE_REQUIRED |
1325                                      DS_RETURN_DNS_NAME,
1326                                      &info);
1327                 if (!NT_STATUS_IS_OK(status)) {
1328                         libnet_join_set_error_string(mem_ctx, r,
1329                                 "failed to find DC for domain %s",
1330                                 r->in.domain_name,
1331                                 get_friendly_nt_error_msg(status));
1332                         return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1333                 }
1334
1335                 r->in.dc_name = talloc_strdup(mem_ctx,
1336                                               info->dc_unc);
1337                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1338         }
1339
1340 #ifdef WITH_ADS
1341         if (r->in.account_ou) {
1342
1343                 ads_status = libnet_join_connect_ads(mem_ctx, r);
1344                 if (!ADS_ERR_OK(ads_status)) {
1345                         return WERR_DEFAULT_JOIN_REQUIRED;
1346                 }
1347
1348                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1349                 if (!ADS_ERR_OK(ads_status)) {
1350                         libnet_join_set_error_string(mem_ctx, r,
1351                                 "failed to precreate account in ou %s: %s",
1352                                 r->in.account_ou,
1353                                 ads_errstr(ads_status));
1354                         return WERR_DEFAULT_JOIN_REQUIRED;
1355                 }
1356
1357                 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1358         }
1359 #endif /* WITH_ADS */
1360
1361         status = libnet_join_joindomain_rpc(mem_ctx, r);
1362         if (!NT_STATUS_IS_OK(status)) {
1363                 libnet_join_set_error_string(mem_ctx, r,
1364                         "failed to join domain over rpc: %s",
1365                         get_friendly_nt_error_msg(status));
1366                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1367                         return WERR_SETUP_ALREADY_JOINED;
1368                 }
1369                 return ntstatus_to_werror(status);
1370         }
1371
1372         if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1373                 return WERR_SETUP_NOT_JOINED;
1374         }
1375
1376 #ifdef WITH_ADS
1377         if (r->out.domain_is_ad) {
1378                 ads_status  = libnet_join_post_processing_ads(mem_ctx, r);
1379                 if (!ADS_ERR_OK(ads_status)) {
1380                         return WERR_GENERAL_FAILURE;
1381                 }
1382         }
1383 #endif /* WITH_ADS */
1384
1385         return WERR_OK;
1386 }
1387
1388 /****************************************************************
1389 ****************************************************************/
1390
1391 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1392                    struct libnet_JoinCtx *r)
1393 {
1394         WERROR werr;
1395
1396         if (r->in.debug) {
1397                 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1398         }
1399
1400         werr = libnet_join_pre_processing(mem_ctx, r);
1401         if (!W_ERROR_IS_OK(werr)) {
1402                 goto done;
1403         }
1404
1405         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1406                 werr = libnet_DomainJoin(mem_ctx, r);
1407                 if (!W_ERROR_IS_OK(werr)) {
1408                         goto done;
1409                 }
1410
1411                 werr = libnet_join_post_verify(mem_ctx, r);
1412                 if (!W_ERROR_IS_OK(werr)) {
1413                         goto done;
1414                 }
1415         }
1416
1417         werr = libnet_join_post_processing(mem_ctx, r);
1418         if (!W_ERROR_IS_OK(werr)) {
1419                 goto done;
1420         }
1421  done:
1422         r->out.result = werr;
1423
1424         if (r->in.debug) {
1425                 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1426         }
1427         return werr;
1428 }
1429
1430 /****************************************************************
1431 ****************************************************************/
1432
1433 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1434                                   struct libnet_UnjoinCtx *r)
1435 {
1436         NTSTATUS status;
1437
1438         if (!r->in.domain_sid) {
1439                 struct dom_sid sid;
1440                 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1441                         libnet_unjoin_set_error_string(mem_ctx, r,
1442                                 "Unable to fetch domain sid: are we joined?");
1443                         return WERR_SETUP_NOT_JOINED;
1444                 }
1445                 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
1446                 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
1447         }
1448
1449         if (!r->in.dc_name) {
1450                 struct netr_DsRGetDCNameInfo *info;
1451                 status = dsgetdcname(mem_ctx,
1452                                      r->in.domain_name,
1453                                      NULL,
1454                                      NULL,
1455                                      DS_DIRECTORY_SERVICE_REQUIRED |
1456                                      DS_WRITABLE_REQUIRED |
1457                                      DS_RETURN_DNS_NAME,
1458                                      &info);
1459                 if (!NT_STATUS_IS_OK(status)) {
1460                         libnet_unjoin_set_error_string(mem_ctx, r,
1461                                 "failed to find DC for domain %s",
1462                                 r->in.domain_name,
1463                                 get_friendly_nt_error_msg(status));
1464                         return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1465                 }
1466
1467                 r->in.dc_name = talloc_strdup(mem_ctx,
1468                                               info->dc_unc);
1469                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1470         }
1471
1472         status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1473         if (!NT_STATUS_IS_OK(status)) {
1474                 libnet_unjoin_set_error_string(mem_ctx, r,
1475                         "failed to disable machine account via rpc: %s",
1476                         get_friendly_nt_error_msg(status));
1477                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1478                         return WERR_SETUP_NOT_JOINED;
1479                 }
1480                 return ntstatus_to_werror(status);
1481         }
1482
1483         r->out.disabled_machine_account = true;
1484
1485 #ifdef WITH_ADS
1486         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1487                 ADS_STATUS ads_status;
1488                 libnet_unjoin_connect_ads(mem_ctx, r);
1489                 ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
1490                 if (!ADS_ERR_OK(ads_status)) {
1491                         libnet_unjoin_set_error_string(mem_ctx, r,
1492                                 "failed to remove machine account from AD: %s",
1493                                 ads_errstr(ads_status));
1494                 } else {
1495                         r->out.deleted_machine_account = true;
1496                         /* dirty hack */
1497                         r->out.dns_domain_name = talloc_strdup(mem_ctx,
1498                                                                r->in.ads->server.realm);
1499                         W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
1500                 }
1501         }
1502 #endif /* WITH_ADS */
1503
1504         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1505
1506         return WERR_OK;
1507 }
1508
1509 /****************************************************************
1510 ****************************************************************/
1511
1512 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
1513                                            struct libnet_UnjoinCtx *r)
1514 {
1515         if (!r->in.domain_name) {
1516                 libnet_unjoin_set_error_string(mem_ctx, r,
1517                         "No domain name defined");
1518                 return WERR_INVALID_PARAM;
1519         }
1520
1521         if (r->in.modify_config && !lp_config_backend_is_registry()) {
1522                 return WERR_NOT_SUPPORTED;
1523         }
1524
1525         if (!secrets_init()) {
1526                 libnet_unjoin_set_error_string(mem_ctx, r,
1527                         "Unable to open secrets database");
1528                 return WERR_CAN_NOT_COMPLETE;
1529         }
1530
1531         return WERR_OK;
1532 }
1533
1534 /****************************************************************
1535 ****************************************************************/
1536
1537 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
1538                                             struct libnet_UnjoinCtx *r)
1539 {
1540         saf_delete(r->out.netbios_domain_name);
1541         saf_delete(r->out.dns_domain_name);
1542
1543         return libnet_unjoin_config(r);
1544 }
1545
1546 /****************************************************************
1547 ****************************************************************/
1548
1549 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1550                      struct libnet_UnjoinCtx *r)
1551 {
1552         WERROR werr;
1553
1554         if (r->in.debug) {
1555                 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
1556         }
1557
1558         werr = libnet_unjoin_pre_processing(mem_ctx, r);
1559         if (!W_ERROR_IS_OK(werr)) {
1560                 goto done;
1561         }
1562
1563         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1564                 werr = libnet_DomainUnjoin(mem_ctx, r);
1565                 if (!W_ERROR_IS_OK(werr)) {
1566                         libnet_unjoin_config(r);
1567                         goto done;
1568                 }
1569         }
1570
1571         werr = libnet_unjoin_post_processing(mem_ctx, r);
1572         if (!W_ERROR_IS_OK(werr)) {
1573                 goto done;
1574         }
1575
1576  done:
1577         r->out.result = werr;
1578
1579         if (r->in.debug) {
1580                 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
1581         }
1582
1583         return werr;
1584 }