source3/libnet/libnet_join.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  libnet Join Support
   4  *  Copyright (C) Gerald (Jerry) Carter 2006
   5  *  Copyright (C) Guenther Deschner 2007-2008
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23
  24 /****************************************************************
  25 ****************************************************************/
  26
  27 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
  28                                          struct libnet_JoinCtx *r,
  29                                          const char *format, ...)
  30 {
  31         va_list args;
  32
  33         if (r->out.error_string) {
  34                 return;
  35         }
  36
  37         va_start(args, format);
  38         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  39         va_end(args);
  40 }
  41
  42 /****************************************************************
  43 ****************************************************************/
  44
  45 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
  46                                            struct libnet_UnjoinCtx *r,
  47                                            const char *format, ...)
  48 {
  49         va_list args;
  50
  51         if (r->out.error_string) {
  52                 return;
  53         }
  54
  55         va_start(args, format);
  56         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  57         va_end(args);
  58 }
  59
  60 #ifdef WITH_ADS
  61
  62 /****************************************************************
  63 ****************************************************************/
  64
  65 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
  66                                      const char *netbios_domain_name,
  67                                      const char *dc_name,
  68                                      const char *user_name,
  69                                      const char *password,
  70                                      ADS_STRUCT **ads)
  71 {
  72         ADS_STATUS status;
  73         ADS_STRUCT *my_ads = NULL;
  74
  75         my_ads = ads_init(dns_domain_name,
  76                           netbios_domain_name,
  77                           dc_name);
  78         if (!my_ads) {
  79                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
  80         }
  81
  82         if (user_name) {
  83                 SAFE_FREE(my_ads->auth.user_name);
  84                 my_ads->auth.user_name = SMB_STRDUP(user_name);
  85         }
  86
  87         if (password) {
  88                 SAFE_FREE(my_ads->auth.password);
  89                 my_ads->auth.password = SMB_STRDUP(password);
  90         }
  91
  92         status = ads_connect(my_ads);
  93         if (!ADS_ERR_OK(status)) {
  94                 ads_destroy(&my_ads);
  95                 return status;
  96         }
  97
  98         *ads = my_ads;
  99         return ADS_SUCCESS;
 100 }
 101
 102 /****************************************************************
 103 ****************************************************************/
 104
 105 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
 106                                           struct libnet_JoinCtx *r)
 107 {
 108         ADS_STATUS status;
 109
 110         if (r->in.ads) {
 111                 ads_destroy(&r->in.ads);
 112         }
 113
 114         status = libnet_connect_ads(r->in.domain_name,
 115                                     r->in.domain_name,
 116                                     r->in.dc_name,
 117                                     r->in.admin_account,
 118                                     r->in.admin_password,
 119                                     &r->in.ads);
 120         if (!ADS_ERR_OK(status)) {
 121                 libnet_join_set_error_string(mem_ctx, r,
 122                         "failed to connect to AD: %s",
 123                         ads_errstr(status));
 124         }
 125
 126         return status;
 127 }
 128
 129 /****************************************************************
 130 ****************************************************************/
 131
 132 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
 133                                             struct libnet_UnjoinCtx *r)
 134 {
 135         ADS_STATUS status;
 136
 137         if (r->in.ads) {
 138                 ads_destroy(&r->in.ads);
 139         }
 140
 141         status = libnet_connect_ads(r->in.domain_name,
 142                                     r->in.domain_name,
 143                                     r->in.dc_name,
 144                                     r->in.admin_account,
 145                                     r->in.admin_password,
 146                                     &r->in.ads);
 147         if (!ADS_ERR_OK(status)) {
 148                 libnet_unjoin_set_error_string(mem_ctx, r,
 149                         "failed to connect to AD: %s",
 150                         ads_errstr(status));
 151         }
 152
 153         return status;
 154 }
 155
 156 /****************************************************************
 157 ****************************************************************/
 158
 159 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
 160                                                      struct libnet_JoinCtx *r)
 161 {
 162         ADS_STATUS status;
 163         LDAPMessage *res = NULL;
 164         const char *attrs[] = { "dn", NULL };
 165
 166         status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
 167         if (!ADS_ERR_OK(status)) {
 168                 return status;
 169         }
 170
 171         if (ads_count_replies(r->in.ads, res) != 1) {
 172                 ads_msgfree(r->in.ads, res);
 173                 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
 174         }
 175
 176         status = ads_create_machine_acct(r->in.ads,
 177                                          r->in.machine_name,
 178                                          r->in.account_ou);
 179         ads_msgfree(r->in.ads, res);
 180
 181         if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
 182             (status.err.rc == LDAP_ALREADY_EXISTS)) {
 183                 status = ADS_SUCCESS;
 184         }
 185
 186         return status;
 187 }
 188
 189 /****************************************************************
 190 ****************************************************************/
 191
 192 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
 193                                                     struct libnet_UnjoinCtx *r)
 194 {
 195         ADS_STATUS status;
 196
 197         if (!r->in.ads) {
 198                 status = libnet_unjoin_connect_ads(mem_ctx, r);
 199                 if (!ADS_ERR_OK(status)) {
 200                         return status;
 201                 }
 202         }
 203
 204         status = ads_leave_realm(r->in.ads, r->in.machine_name);
 205         if (!ADS_ERR_OK(status)) {
 206                 libnet_unjoin_set_error_string(mem_ctx, r,
 207                         "failed to leave realm: %s",
 208                         ads_errstr(status));
 209                 return status;
 210         }
 211
 212         return ADS_SUCCESS;
 213 }
 214
 215 /****************************************************************
 216 ****************************************************************/
 217
 218 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
 219                                                 struct libnet_JoinCtx *r)
 220 {
 221         ADS_STATUS status;
 222         LDAPMessage *res = NULL;
 223         char *dn = NULL;
 224
 225         if (!r->in.machine_name) {
 226                 return ADS_ERROR(LDAP_NO_MEMORY);
 227         }
 228
 229         status = ads_find_machine_acct(r->in.ads,
 230                                        &res,
 231                                        r->in.machine_name);
 232         if (!ADS_ERR_OK(status)) {
 233                 return status;
 234         }
 235
 236         if (ads_count_replies(r->in.ads, res) != 1) {
 237                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 238                 goto done;
 239         }
 240
 241         dn = ads_get_dn(r->in.ads, res);
 242         if (!dn) {
 243                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 244                 goto done;
 245         }
 246
 247         TALLOC_FREE(r->out.dn);
 248         r->out.dn = talloc_strdup(mem_ctx, dn);
 249         if (!r->out.dn) {
 250                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 251                 goto done;
 252         }
 253
 254  done:
 255         ads_msgfree(r->in.ads, res);
 256         ads_memfree(r->in.ads, dn);
 257
 258         return status;
 259 }
 260
 261 /****************************************************************
 262 ****************************************************************/
 263
 264 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
 265                                               struct libnet_JoinCtx *r)
 266 {
 267         ADS_STATUS status;
 268         ADS_MODLIST mods;
 269         fstring my_fqdn;
 270         const char *spn_array[3] = {NULL, NULL, NULL};
 271         char *spn = NULL;
 272
 273         if (!r->in.ads) {
 274                 status = libnet_join_connect_ads(mem_ctx, r);
 275                 if (!ADS_ERR_OK(status)) {
 276                         return status;
 277                 }
 278         }
 279
 280         status = libnet_join_find_machine_acct(mem_ctx, r);
 281         if (!ADS_ERR_OK(status)) {
 282                 return status;
 283         }
 284
 285         spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
 286         if (!spn) {
 287                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 288         }
 289         strupper_m(spn);
 290         spn_array[0] = spn;
 291
 292         if (name_to_fqdn(my_fqdn, r->in.machine_name) &&
 293             !strequal(my_fqdn, r->in.machine_name)) {
 294
 295                 strlower_m(my_fqdn);
 296                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
 297                 if (!spn) {
 298                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 299                 }
 300                 spn_array[1] = spn;
 301         }
 302
 303         mods = ads_init_mods(mem_ctx);
 304         if (!mods) {
 305                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 306         }
 307
 308         status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
 309         if (!ADS_ERR_OK(status)) {
 310                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 311         }
 312
 313         status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
 314                                  spn_array);
 315         if (!ADS_ERR_OK(status)) {
 316                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 317         }
 318
 319         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 320 }
 321
 322 /****************************************************************
 323 ****************************************************************/
 324
 325 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
 326                                               struct libnet_JoinCtx *r)
 327 {
 328         ADS_STATUS status;
 329         ADS_MODLIST mods;
 330
 331         if (!r->in.create_upn) {
 332                 return ADS_SUCCESS;
 333         }
 334
 335         if (!r->in.ads) {
 336                 status = libnet_join_connect_ads(mem_ctx, r);
 337                 if (!ADS_ERR_OK(status)) {
 338                         return status;
 339                 }
 340         }
 341
 342         status = libnet_join_find_machine_acct(mem_ctx, r);
 343         if (!ADS_ERR_OK(status)) {
 344                 return status;
 345         }
 346
 347         if (!r->in.upn) {
 348                 r->in.upn = talloc_asprintf(mem_ctx,
 349                                             "host/%s@%s",
 350                                             r->in.machine_name,
 351                                             r->out.dns_domain_name);
 352                 if (!r->in.upn) {
 353                         return ADS_ERROR(LDAP_NO_MEMORY);
 354                 }
 355         }
 356
 357         mods = ads_init_mods(mem_ctx);
 358         if (!mods) {
 359                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 360         }
 361
 362         status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
 363         if (!ADS_ERR_OK(status)) {
 364                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 365         }
 366
 367         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 368 }
 369
 370
 371 /****************************************************************
 372 ****************************************************************/
 373
 374 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
 375                                                 struct libnet_JoinCtx *r)
 376 {
 377         ADS_STATUS status;
 378         ADS_MODLIST mods;
 379         char *os_sp = NULL;
 380
 381         if (!r->in.os_name || !r->in.os_version ) {
 382                 return ADS_SUCCESS;
 383         }
 384
 385         if (!r->in.ads) {
 386                 status = libnet_join_connect_ads(mem_ctx, r);
 387                 if (!ADS_ERR_OK(status)) {
 388                         return status;
 389                 }
 390         }
 391
 392         status = libnet_join_find_machine_acct(mem_ctx, r);
 393         if (!ADS_ERR_OK(status)) {
 394                 return status;
 395         }
 396
 397         mods = ads_init_mods(mem_ctx);
 398         if (!mods) {
 399                 return ADS_ERROR(LDAP_NO_MEMORY);
 400         }
 401
 402         os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
 403         if (!os_sp) {
 404                 return ADS_ERROR(LDAP_NO_MEMORY);
 405         }
 406
 407         status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
 408                              r->in.os_name);
 409         if (!ADS_ERR_OK(status)) {
 410                 return status;
 411         }
 412
 413         status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
 414                              r->in.os_version);
 415         if (!ADS_ERR_OK(status)) {
 416                 return status;
 417         }
 418
 419         status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
 420                              os_sp);
 421         if (!ADS_ERR_OK(status)) {
 422                 return status;
 423         }
 424
 425         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 426 }
 427
 428 /****************************************************************
 429 ****************************************************************/
 430
 431 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
 432                                       struct libnet_JoinCtx *r)
 433 {
 434         if (!lp_use_kerberos_keytab()) {
 435                 return true;
 436         }
 437
 438         if (!ads_keytab_create_default(r->in.ads)) {
 439                 return false;
 440         }
 441
 442         return true;
 443 }
 444
 445 /****************************************************************
 446 ****************************************************************/
 447
 448 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
 449                                                  struct libnet_JoinCtx *r)
 450 {
 451         uint32_t domain_func;
 452         ADS_STATUS status;
 453         const char *salt = NULL;
 454         char *std_salt = NULL;
 455
 456         status = ads_domain_func_level(r->in.ads, &domain_func);
 457         if (!ADS_ERR_OK(status)) {
 458                 libnet_join_set_error_string(mem_ctx, r,
 459                         "failed to determine domain functional level: %s",
 460                         ads_errstr(status));
 461                 return false;
 462         }
 463
 464         std_salt = kerberos_standard_des_salt();
 465         if (!std_salt) {
 466                 libnet_join_set_error_string(mem_ctx, r,
 467                         "failed to obtain standard DES salt");
 468                 return false;
 469         }
 470
 471         salt = talloc_strdup(mem_ctx, std_salt);
 472         if (!salt) {
 473                 return false;
 474         }
 475
 476         SAFE_FREE(std_salt);
 477
 478         if (domain_func == DS_DOMAIN_FUNCTION_2000) {
 479                 char *upn;
 480
 481                 upn = ads_get_upn(r->in.ads, mem_ctx,
 482                                   r->in.machine_name);
 483                 if (upn) {
 484                         salt = talloc_strdup(mem_ctx, upn);
 485                         if (!salt) {
 486                                 return false;
 487                         }
 488                 }
 489         }
 490
 491         return kerberos_secrets_store_des_salt(salt);
 492 }
 493
 494 /****************************************************************
 495 ****************************************************************/
 496
 497 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
 498                                                   struct libnet_JoinCtx *r)
 499 {
 500         ADS_STATUS status;
 501
 502         status = libnet_join_set_machine_spn(mem_ctx, r);
 503         if (!ADS_ERR_OK(status)) {
 504                 libnet_join_set_error_string(mem_ctx, r,
 505                         "failed to set machine spn: %s",
 506                         ads_errstr(status));
 507                 return status;
 508         }
 509
 510         status = libnet_join_set_os_attributes(mem_ctx, r);
 511         if (!ADS_ERR_OK(status)) {
 512                 libnet_join_set_error_string(mem_ctx, r,
 513                         "failed to set machine os attributes: %s",
 514                         ads_errstr(status));
 515                 return status;
 516         }
 517
 518         status = libnet_join_set_machine_upn(mem_ctx, r);
 519         if (!ADS_ERR_OK(status)) {
 520                 libnet_join_set_error_string(mem_ctx, r,
 521                         "failed to set machine upn: %s",
 522                         ads_errstr(status));
 523                 return status;
 524         }
 525
 526         if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
 527                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 528         }
 529
 530         if (!libnet_join_create_keytab(mem_ctx, r)) {
 531                 libnet_join_set_error_string(mem_ctx, r,
 532                         "failed to create kerberos keytab");
 533                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 534         }
 535
 536         return ADS_SUCCESS;
 537 }
 538 #endif /* WITH_ADS */
 539
 540 /****************************************************************
 541 ****************************************************************/
 542
 543 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
 544                                                  struct libnet_JoinCtx *r)
 545 {
 546         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
 547                                       r->out.domain_sid))
 548         {
 549                 return false;
 550         }
 551
 552         if (!secrets_store_machine_password(r->in.machine_password,
 553                                             r->out.netbios_domain_name,
 554                                             SEC_CHAN_WKSTA))
 555         {
 556                 return false;
 557         }
 558
 559         return true;
 560 }
 561
 562 /****************************************************************
 563 ****************************************************************/
 564
 565 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
 566                                            struct libnet_JoinCtx *r)
 567 {
 568         struct cli_state *cli = NULL;
 569         struct rpc_pipe_client *pipe_hnd = NULL;
 570         POLICY_HND sam_pol, domain_pol, user_pol, lsa_pol;
 571         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 572         char *acct_name;
 573         const char *const_acct_name;
 574         uint32 user_rid;
 575         uint32 num_rids, *name_types, *user_rids;
 576         uint32 flags = 0x3e8;
 577         uint32 acb_info = ACB_WSTRUST;
 578         uint32 fields_present;
 579         uchar pwbuf[532];
 580         SAM_USERINFO_CTR ctr;
 581         SAM_USER_INFO_25 p25;
 582         const int infolevel = 25;
 583         struct MD5Context md5ctx;
 584         uchar md5buffer[16];
 585         DATA_BLOB digested_session_key;
 586         uchar md4_trust_password[16];
 587
 588         if (!r->in.machine_password) {
 589                 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
 590                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
 591         }
 592
 593         status = cli_full_connection(&cli, NULL,
 594                                      r->in.dc_name,
 595                                      NULL, 0,
 596                                      "IPC$", "IPC",
 597                                      r->in.admin_account,
 598                                      NULL,
 599                                      r->in.admin_password,
 600                                      0,
 601                                      Undefined, NULL);
 602
 603         if (!NT_STATUS_IS_OK(status)) {
 604                 goto done;
 605         }
 606
 607         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
 608         if (!pipe_hnd) {
 609                 goto done;
 610         }
 611
 612         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
 613                                         SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
 614         if (!NT_STATUS_IS_OK(status)) {
 615                 goto done;
 616         }
 617
 618         status = rpccli_lsa_query_info_policy2(pipe_hnd, mem_ctx, &lsa_pol,
 619                                                12,
 620                                                &r->out.netbios_domain_name,
 621                                                &r->out.dns_domain_name,
 622                                                NULL,
 623                                                NULL,
 624                                                &r->out.domain_sid);
 625
 626         if (NT_STATUS_IS_OK(status)) {
 627                 r->out.domain_is_ad = true;
 628         }
 629
 630         if (!NT_STATUS_IS_OK(status)) {
 631                 status = rpccli_lsa_query_info_policy(pipe_hnd, mem_ctx, &lsa_pol,
 632                                                       5,
 633                                                       &r->out.netbios_domain_name,
 634                                                       &r->out.domain_sid);
 635                 if (!NT_STATUS_IS_OK(status)) {
 636                         goto done;
 637                 }
 638         }
 639
 640         rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
 641         cli_rpc_pipe_close(pipe_hnd);
 642
 643         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 644         if (!pipe_hnd) {
 645                 goto done;
 646         }
 647
 648         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
 649                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
 650         if (!NT_STATUS_IS_OK(status)) {
 651                 goto done;
 652         }
 653
 654         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
 655                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
 656                                          r->out.domain_sid,
 657                                          &domain_pol);
 658         if (!NT_STATUS_IS_OK(status)) {
 659                 goto done;
 660         }
 661
 662         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
 663         strlower_m(acct_name);
 664         const_acct_name = acct_name;
 665
 666         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
 667                 status = rpccli_samr_create_dom_user(pipe_hnd, mem_ctx,
 668                                                      &domain_pol,
 669                                                      acct_name, ACB_WSTRUST,
 670                                                      0xe005000b, &user_pol,
 671                                                      &user_rid);
 672                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 673                         if (!(r->in.join_flags &
 674                               WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
 675                                 goto done;
 676                         }
 677                 }
 678
 679                 if (NT_STATUS_IS_OK(status)) {
 680                         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 681                 }
 682         }
 683
 684         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
 685                                           &domain_pol, flags, 1,
 686                                           &const_acct_name,
 687                                           &num_rids, &user_rids, &name_types);
 688         if (!NT_STATUS_IS_OK(status)) {
 689                 goto done;
 690         }
 691
 692         if (name_types[0] != SID_NAME_USER) {
 693                 status = NT_STATUS_INVALID_WORKSTATION;
 694                 goto done;
 695         }
 696
 697         user_rid = user_rids[0];
 698
 699         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
 700                                        SEC_RIGHTS_MAXIMUM_ALLOWED, user_rid,
 701                                        &user_pol);
 702         if (!NT_STATUS_IS_OK(status)) {
 703                 goto done;
 704         }
 705
 706         E_md4hash(r->in.machine_password, md4_trust_password);
 707         encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
 708
 709         generate_random_buffer((uint8*)md5buffer, sizeof(md5buffer));
 710         digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
 711
 712         MD5Init(&md5ctx);
 713         MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
 714         MD5Update(&md5ctx, cli->user_session_key.data,
 715                   cli->user_session_key.length);
 716         MD5Final(digested_session_key.data, &md5ctx);
 717
 718         SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
 719         memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
 720
 721         acb_info |= ACB_PWNOEXP;
 722         if (r->out.domain_is_ad) {
 723 #if !defined(ENCTYPE_ARCFOUR_HMAC)
 724                 acb_info |= ACB_USE_DES_KEY_ONLY;
 725 #endif
 726                 ;;
 727         }
 728
 729         ZERO_STRUCT(ctr);
 730         ZERO_STRUCT(p25);
 731
 732         fields_present = ACCT_NT_PWD_SET | ACCT_LM_PWD_SET | ACCT_FLAGS;
 733         init_sam_user_info25P(&p25, fields_present, acb_info, (char *)pwbuf);
 734
 735         ctr.switch_value = infolevel;
 736         ctr.info.id25    = &p25;
 737
 738         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol,
 739                                            infolevel, &cli->user_session_key,
 740                                            &ctr);
 741         if (!NT_STATUS_IS_OK(status)) {
 742                 goto done;
 743         }
 744
 745         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 746         cli_rpc_pipe_close(pipe_hnd);
 747
 748         status = NT_STATUS_OK;
 749  done:
 750         if (cli) {
 751                 cli_shutdown(cli);
 752         }
 753
 754         return status;
 755 }
 756
 757 /****************************************************************
 758 ****************************************************************/
 759
 760 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
 761                                                     struct libnet_UnjoinCtx *r)
 762 {
 763         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
 764                 return false;
 765         }
 766
 767         if (!secrets_delete_domain_sid(lp_workgroup())) {
 768                 return false;
 769         }
 770
 771         return true;
 772 }
 773
 774 /****************************************************************
 775 ****************************************************************/
 776
 777 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
 778                                              struct libnet_UnjoinCtx *r)
 779 {
 780         struct cli_state *cli = NULL;
 781         struct rpc_pipe_client *pipe_hnd = NULL;
 782         POLICY_HND sam_pol, domain_pol, user_pol;
 783         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 784         char *acct_name;
 785         uint32 flags = 0x3e8;
 786         const char *const_acct_name;
 787         uint32 user_rid;
 788         uint32 num_rids, *name_types, *user_rids;
 789         SAM_USERINFO_CTR ctr, *qctr = NULL;
 790         SAM_USER_INFO_16 p16;
 791
 792         status = cli_full_connection(&cli, NULL,
 793                                      r->in.dc_name,
 794                                      NULL, 0,
 795                                      "IPC$", "IPC",
 796                                      r->in.admin_account,
 797                                      NULL,
 798                                      r->in.admin_password,
 799                                      0, Undefined, NULL);
 800
 801         if (!NT_STATUS_IS_OK(status)) {
 802                 goto done;
 803         }
 804
 805         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
 806         if (!pipe_hnd) {
 807                 goto done;
 808         }
 809
 810         status = rpccli_samr_connect(pipe_hnd, mem_ctx,
 811                                      SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
 812         if (!NT_STATUS_IS_OK(status)) {
 813                 goto done;
 814         }
 815
 816         status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
 817                                          SEC_RIGHTS_MAXIMUM_ALLOWED,
 818                                          r->in.domain_sid,
 819                                          &domain_pol);
 820         if (!NT_STATUS_IS_OK(status)) {
 821                 goto done;
 822         }
 823
 824         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
 825         strlower_m(acct_name);
 826         const_acct_name = acct_name;
 827
 828         status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
 829                                           &domain_pol, flags, 1,
 830                                           &const_acct_name,
 831                                           &num_rids, &user_rids, &name_types);
 832         if (!NT_STATUS_IS_OK(status)) {
 833                 goto done;
 834         }
 835
 836         if (name_types[0] != SID_NAME_USER) {
 837                 status = NT_STATUS_INVALID_WORKSTATION;
 838                 goto done;
 839         }
 840
 841         user_rid = user_rids[0];
 842
 843         status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
 844                                        SEC_RIGHTS_MAXIMUM_ALLOWED,
 845                                        user_rid, &user_pol);
 846         if (!NT_STATUS_IS_OK(status)) {
 847                 goto done;
 848         }
 849
 850         status = rpccli_samr_query_userinfo(pipe_hnd, mem_ctx,
 851                                             &user_pol, 16, &qctr);
 852         if (!NT_STATUS_IS_OK(status)) {
 853                 rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 854                 goto done;
 855         }
 856
 857         ZERO_STRUCT(ctr);
 858         ctr.switch_value = 16;
 859         ctr.info.id16 = &p16;
 860
 861         p16.acb_info = qctr->info.id16->acb_info | ACB_DISABLED;
 862
 863         status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol, 16,
 864                                            &cli->user_session_key, &ctr);
 865
 866         rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
 867
 868 done:
 869         if (pipe_hnd) {
 870                 rpccli_samr_close(pipe_hnd, mem_ctx, &domain_pol);
 871                 rpccli_samr_close(pipe_hnd, mem_ctx, &sam_pol);
 872                 cli_rpc_pipe_close(pipe_hnd);
 873         }
 874
 875         if (cli) {
 876                 cli_shutdown(cli);
 877         }
 878
 879         return status;
 880 }
 881
 882 /****************************************************************
 883 ****************************************************************/
 884
 885 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
 886 {
 887         WERROR werr;
 888         struct libnet_conf_ctx *ctx;
 889
 890         werr = libnet_conf_open(r, &ctx);
 891         if (!W_ERROR_IS_OK(werr)) {
 892                 goto done;
 893         }
 894
 895         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
 896
 897                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
 898                 if (!W_ERROR_IS_OK(werr)) {
 899                         goto done;
 900                 }
 901
 902                 werr = libnet_conf_set_global_parameter(ctx, "workgroup",
 903                                                         r->in.domain_name);
 904                 goto done;
 905         }
 906
 907         werr = libnet_conf_set_global_parameter(ctx, "security", "domain");
 908         if (!W_ERROR_IS_OK(werr)) {
 909                 goto done;
 910         }
 911
 912         werr = libnet_conf_set_global_parameter(ctx, "workgroup",
 913                                                 r->out.netbios_domain_name);
 914         if (!W_ERROR_IS_OK(werr)) {
 915                 goto done;
 916         }
 917
 918         if (r->out.domain_is_ad) {
 919                 werr = libnet_conf_set_global_parameter(ctx, "security", "ads");
 920                 if (!W_ERROR_IS_OK(werr)) {
 921                         goto done;
 922                 }
 923
 924                 werr = libnet_conf_set_global_parameter(ctx, "realm",
 925                                                         r->out.dns_domain_name);
 926         }
 927
 928 done:
 929         libnet_conf_close(ctx);
 930         return werr;
 931 }
 932
 933 /****************************************************************
 934 ****************************************************************/
 935
 936 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
 937 {
 938         WERROR werr = WERR_OK;
 939         struct libnet_conf_ctx *ctx;
 940
 941         werr = libnet_conf_open(r, &ctx);
 942         if (!W_ERROR_IS_OK(werr)) {
 943                 goto done;
 944         }
 945
 946         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
 947
 948                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
 949                 if (!W_ERROR_IS_OK(werr)) {
 950                         goto done;
 951                 }
 952         }
 953
 954         libnet_conf_delete_parameter(ctx, GLOBAL_NAME, "realm");
 955
 956 done:
 957         libnet_conf_close(ctx);
 958         return werr;
 959 }
 960
 961 /****************************************************************
 962 ****************************************************************/
 963
 964 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
 965 {
 966         WERROR werr;
 967
 968         if (!W_ERROR_IS_OK(r->out.result)) {
 969                 return r->out.result;
 970         }
 971
 972         if (!r->in.modify_config) {
 973                 return WERR_OK;
 974         }
 975
 976         werr = do_join_modify_vals_config(r);
 977         if (!W_ERROR_IS_OK(werr)) {
 978                 return werr;
 979         }
 980
 981         r->out.modified_config = true;
 982         r->out.result = werr;
 983
 984         return werr;
 985 }
 986
 987 /****************************************************************
 988 ****************************************************************/
 989
 990 static WERROR do_UnjoinConfig(struct libnet_UnjoinCtx *r)
 991 {
 992         WERROR werr;
 993
 994         if (!W_ERROR_IS_OK(r->out.result)) {
 995                 return r->out.result;
 996         }
 997
 998         if (!r->in.modify_config) {
 999                 return WERR_OK;
1000         }
1001
1002         werr = do_unjoin_modify_vals_config(r);
1003         if (!W_ERROR_IS_OK(werr)) {
1004                 return werr;
1005         }
1006
1007         r->out.modified_config = true;
1008         r->out.result = werr;
1009
1010         return werr;
1011 }
1012
1013 /****************************************************************
1014 ****************************************************************/
1015
1016 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1017 {
1018         if (r->in.ads) {
1019                 ads_destroy(&r->in.ads);
1020         }
1021
1022         return 0;
1023 }
1024
1025 /****************************************************************
1026 ****************************************************************/
1027
1028 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1029 {
1030         if (r->in.ads) {
1031                 ads_destroy(&r->in.ads);
1032         }
1033
1034         return 0;
1035 }
1036
1037 /****************************************************************
1038 ****************************************************************/
1039
1040 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1041                            struct libnet_JoinCtx **r)
1042 {
1043         struct libnet_JoinCtx *ctx;
1044
1045         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1046         if (!ctx) {
1047                 return WERR_NOMEM;
1048         }
1049
1050         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1051
1052         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1053         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1054
1055         *r = ctx;
1056
1057         return WERR_OK;
1058 }
1059
1060 /****************************************************************
1061 ****************************************************************/
1062
1063 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1064                              struct libnet_UnjoinCtx **r)
1065 {
1066         struct libnet_UnjoinCtx *ctx;
1067
1068         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1069         if (!ctx) {
1070                 return WERR_NOMEM;
1071         }
1072
1073         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1074
1075         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1076         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1077
1078         *r = ctx;
1079
1080         return WERR_OK;
1081 }
1082
1083 /****************************************************************
1084 ****************************************************************/
1085
1086 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1087                                 struct libnet_JoinCtx *r)
1088 {
1089         NTSTATUS status;
1090 #ifdef WITH_ADS
1091         ADS_STATUS ads_status;
1092 #endif /* WITH_ADS */
1093
1094         if (!r->in.dc_name) {
1095                 struct DS_DOMAIN_CONTROLLER_INFO *info;
1096                 status = dsgetdcname(mem_ctx,
1097                                      NULL,
1098                                      r->in.domain_name,
1099                                      NULL,
1100                                      NULL,
1101                                      DS_DIRECTORY_SERVICE_REQUIRED |
1102                                      DS_WRITABLE_REQUIRED |
1103                                      DS_RETURN_DNS_NAME,
1104                                      &info);
1105                 if (!NT_STATUS_IS_OK(status)) {
1106                         libnet_join_set_error_string(mem_ctx, r,
1107                                 "failed to find DC: %s",
1108                                 nt_errstr(status));
1109                         return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1110                 }
1111
1112                 r->in.dc_name = talloc_strdup(mem_ctx,
1113                                               info->domain_controller_name);
1114                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1115         }
1116
1117 #ifdef WITH_ADS
1118         if (r->in.account_ou) {
1119
1120                 ads_status = libnet_join_connect_ads(mem_ctx, r);
1121                 if (!ADS_ERR_OK(ads_status)) {
1122                         return WERR_DEFAULT_JOIN_REQUIRED;
1123                 }
1124
1125                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1126                 if (!ADS_ERR_OK(ads_status)) {
1127                         libnet_join_set_error_string(mem_ctx, r,
1128                                 "failed to precreate account in ou %s: %s",
1129                                 r->in.account_ou,
1130                                 ads_errstr(ads_status));
1131                         return WERR_DEFAULT_JOIN_REQUIRED;
1132                 }
1133
1134                 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1135         }
1136 #endif /* WITH_ADS */
1137
1138         status = libnet_join_joindomain_rpc(mem_ctx, r);
1139         if (!NT_STATUS_IS_OK(status)) {
1140                 libnet_join_set_error_string(mem_ctx, r,
1141                         "failed to join domain over rpc: %s",
1142                         nt_errstr(status));
1143                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1144                         return WERR_SETUP_ALREADY_JOINED;
1145                 }
1146                 return ntstatus_to_werror(status);
1147         }
1148
1149         if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1150                 return WERR_SETUP_NOT_JOINED;
1151         }
1152
1153 #ifdef WITH_ADS
1154         if (r->out.domain_is_ad) {
1155                 ads_status  = libnet_join_post_processing_ads(mem_ctx, r);
1156                 if (!ADS_ERR_OK(ads_status)) {
1157                         return WERR_GENERAL_FAILURE;
1158                 }
1159         }
1160 #endif /* WITH_ADS */
1161
1162         return WERR_OK;
1163 }
1164
1165 /****************************************************************
1166 ****************************************************************/
1167
1168 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1169                    struct libnet_JoinCtx *r)
1170 {
1171         WERROR werr;
1172
1173         if (!r->in.domain_name) {
1174                 return WERR_INVALID_PARAM;
1175         }
1176
1177         if (r->in.modify_config && !lp_include_registry_globals()) {
1178                 return WERR_NOT_SUPPORTED;
1179         }
1180
1181         if (IS_DC) {
1182                 return WERR_SETUP_DOMAIN_CONTROLLER;
1183         }
1184
1185         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1186                 werr = libnet_DomainJoin(mem_ctx, r);
1187                 if (!W_ERROR_IS_OK(werr)) {
1188                         return werr;
1189                 }
1190         }
1191
1192         werr = do_JoinConfig(r);
1193         if (!W_ERROR_IS_OK(werr)) {
1194                 return werr;
1195         }
1196
1197         return werr;
1198 }
1199
1200 /****************************************************************
1201 ****************************************************************/
1202
1203 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1204                                   struct libnet_UnjoinCtx *r)
1205 {
1206         NTSTATUS status;
1207
1208         status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1209         if (!NT_STATUS_IS_OK(status)) {
1210                 libnet_unjoin_set_error_string(mem_ctx, r,
1211                         "failed to unjoin domain: %s",
1212                         nt_errstr(status));
1213                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1214                         return WERR_SETUP_NOT_JOINED;
1215                 }
1216                 return ntstatus_to_werror(status);
1217         }
1218
1219 #ifdef WITH_ADS
1220         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1221                 ADS_STATUS ads_status;
1222                 libnet_unjoin_connect_ads(mem_ctx, r);
1223                 ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
1224                 if (!ADS_ERR_OK(ads_status)) {
1225                         libnet_unjoin_set_error_string(mem_ctx, r,
1226                                 "failed to remove machine account from AD: %s",
1227                                 ads_errstr(ads_status));
1228                 }
1229         }
1230 #endif /* WITH_ADS */
1231
1232         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1233
1234         return WERR_OK;
1235 }
1236
1237 /****************************************************************
1238 ****************************************************************/
1239
1240 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1241                      struct libnet_UnjoinCtx *r)
1242 {
1243         WERROR werr;
1244
1245         if (r->in.modify_config && !lp_include_registry_globals()) {
1246                 return WERR_NOT_SUPPORTED;
1247         }
1248
1249         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1250                 werr = libnet_DomainUnjoin(mem_ctx, r);
1251                 if (!W_ERROR_IS_OK(werr)) {
1252                         do_UnjoinConfig(r);
1253                         return werr;
1254                 }
1255         }
1256
1257         werr = do_UnjoinConfig(r);
1258         if (!W_ERROR_IS_OK(werr)) {
1259                 return werr;
1260         }
1261
1262         return werr;
1263 }