source3/libnet/libnet_join.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  libnet Join Support
   4  *  Copyright (C) Gerald (Jerry) Carter 2006
   5  *  Copyright (C) Guenther Deschner 2007-2008
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 3 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23 #include "libcli/auth/libcli_auth.h"
  24 #include "../librpc/gen_ndr/cli_samr.h"
  25 #include "../librpc/gen_ndr/cli_lsa.h"
  26
  27 /****************************************************************
  28 ****************************************************************/
  29
  30 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
  31         do { \
  32                 char *str = NULL; \
  33                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
  34                 DEBUG(1,("libnet_Join:\n%s", str)); \
  35                 TALLOC_FREE(str); \
  36         } while (0)
  37
  38 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
  39         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
  40 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
  41         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
  42
  43 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
  44         do { \
  45                 char *str = NULL; \
  46                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
  47                 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
  48                 TALLOC_FREE(str); \
  49         } while (0)
  50
  51 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
  52         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
  53 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
  54         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
  55
  56 /****************************************************************
  57 ****************************************************************/
  58
  59 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
  60                                          struct libnet_JoinCtx *r,
  61                                          const char *format, ...)
  62 {
  63         va_list args;
  64
  65         if (r->out.error_string) {
  66                 return;
  67         }
  68
  69         va_start(args, format);
  70         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  71         va_end(args);
  72 }
  73
  74 /****************************************************************
  75 ****************************************************************/
  76
  77 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
  78                                            struct libnet_UnjoinCtx *r,
  79                                            const char *format, ...)
  80 {
  81         va_list args;
  82
  83         if (r->out.error_string) {
  84                 return;
  85         }
  86
  87         va_start(args, format);
  88         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
  89         va_end(args);
  90 }
  91
  92 #ifdef WITH_ADS
  93
  94 /****************************************************************
  95 ****************************************************************/
  96
  97 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
  98                                      const char *netbios_domain_name,
  99                                      const char *dc_name,
 100                                      const char *user_name,
 101                                      const char *password,
 102                                      ADS_STRUCT **ads)
 103 {
 104         ADS_STATUS status;
 105         ADS_STRUCT *my_ads = NULL;
 106
 107         my_ads = ads_init(dns_domain_name,
 108                           netbios_domain_name,
 109                           dc_name);
 110         if (!my_ads) {
 111                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 112         }
 113
 114         if (user_name) {
 115                 SAFE_FREE(my_ads->auth.user_name);
 116                 my_ads->auth.user_name = SMB_STRDUP(user_name);
 117         }
 118
 119         if (password) {
 120                 SAFE_FREE(my_ads->auth.password);
 121                 my_ads->auth.password = SMB_STRDUP(password);
 122         }
 123
 124         status = ads_connect_user_creds(my_ads);
 125         if (!ADS_ERR_OK(status)) {
 126                 ads_destroy(&my_ads);
 127                 return status;
 128         }
 129
 130         *ads = my_ads;
 131         return ADS_SUCCESS;
 132 }
 133
 134 /****************************************************************
 135 ****************************************************************/
 136
 137 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
 138                                           struct libnet_JoinCtx *r)
 139 {
 140         ADS_STATUS status;
 141
 142         status = libnet_connect_ads(r->out.dns_domain_name,
 143                                     r->out.netbios_domain_name,
 144                                     r->in.dc_name,
 145                                     r->in.admin_account,
 146                                     r->in.admin_password,
 147                                     &r->in.ads);
 148         if (!ADS_ERR_OK(status)) {
 149                 libnet_join_set_error_string(mem_ctx, r,
 150                         "failed to connect to AD: %s",
 151                         ads_errstr(status));
 152                 return status;
 153         }
 154
 155         if (!r->out.netbios_domain_name) {
 156                 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
 157                                                            r->in.ads->server.workgroup);
 158                 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
 159         }
 160
 161         if (!r->out.dns_domain_name) {
 162                 r->out.dns_domain_name = talloc_strdup(mem_ctx,
 163                                                        r->in.ads->config.realm);
 164                 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
 165         }
 166
 167         r->out.domain_is_ad = true;
 168
 169         return ADS_SUCCESS;
 170 }
 171
 172 /****************************************************************
 173 ****************************************************************/
 174
 175 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
 176                                             struct libnet_UnjoinCtx *r)
 177 {
 178         ADS_STATUS status;
 179
 180         status = libnet_connect_ads(r->in.domain_name,
 181                                     r->in.domain_name,
 182                                     r->in.dc_name,
 183                                     r->in.admin_account,
 184                                     r->in.admin_password,
 185                                     &r->in.ads);
 186         if (!ADS_ERR_OK(status)) {
 187                 libnet_unjoin_set_error_string(mem_ctx, r,
 188                         "failed to connect to AD: %s",
 189                         ads_errstr(status));
 190         }
 191
 192         return status;
 193 }
 194
 195 /****************************************************************
 196  join a domain using ADS (LDAP mods)
 197 ****************************************************************/
 198
 199 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
 200                                                      struct libnet_JoinCtx *r)
 201 {
 202         ADS_STATUS status;
 203         LDAPMessage *res = NULL;
 204         const char *attrs[] = { "dn", NULL };
 205         bool moved = false;
 206
 207         status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
 208         if (!ADS_ERR_OK(status)) {
 209                 return status;
 210         }
 211
 212         status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
 213         if (!ADS_ERR_OK(status)) {
 214                 return status;
 215         }
 216
 217         if (ads_count_replies(r->in.ads, res) != 1) {
 218                 ads_msgfree(r->in.ads, res);
 219                 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
 220         }
 221
 222         ads_msgfree(r->in.ads, res);
 223
 224         /* Attempt to create the machine account and bail if this fails.
 225            Assume that the admin wants exactly what they requested */
 226
 227         status = ads_create_machine_acct(r->in.ads,
 228                                          r->in.machine_name,
 229                                          r->in.account_ou);
 230
 231         if (ADS_ERR_OK(status)) {
 232                 DEBUG(1,("machine account creation created\n"));
 233                 return status;
 234         } else  if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
 235                     (status.err.rc == LDAP_ALREADY_EXISTS)) {
 236                 status = ADS_SUCCESS;
 237         }
 238
 239         if (!ADS_ERR_OK(status)) {
 240                 DEBUG(1,("machine account creation failed\n"));
 241                 return status;
 242         }
 243
 244         status = ads_move_machine_acct(r->in.ads,
 245                                        r->in.machine_name,
 246                                        r->in.account_ou,
 247                                        &moved);
 248         if (!ADS_ERR_OK(status)) {
 249                 DEBUG(1,("failure to locate/move pre-existing "
 250                         "machine account\n"));
 251                 return status;
 252         }
 253
 254         DEBUG(1,("The machine account %s the specified OU.\n",
 255                 moved ? "was moved into" : "already exists in"));
 256
 257         return status;
 258 }
 259
 260 /****************************************************************
 261 ****************************************************************/
 262
 263 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
 264                                                     struct libnet_UnjoinCtx *r)
 265 {
 266         ADS_STATUS status;
 267
 268         if (!r->in.ads) {
 269                 status = libnet_unjoin_connect_ads(mem_ctx, r);
 270                 if (!ADS_ERR_OK(status)) {
 271                         libnet_unjoin_set_error_string(mem_ctx, r,
 272                                 "failed to connect to AD: %s",
 273                                 ads_errstr(status));
 274                         return status;
 275                 }
 276         }
 277
 278         status = ads_leave_realm(r->in.ads, r->in.machine_name);
 279         if (!ADS_ERR_OK(status)) {
 280                 libnet_unjoin_set_error_string(mem_ctx, r,
 281                         "failed to leave realm: %s",
 282                         ads_errstr(status));
 283                 return status;
 284         }
 285
 286         return ADS_SUCCESS;
 287 }
 288
 289 /****************************************************************
 290 ****************************************************************/
 291
 292 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
 293                                                 struct libnet_JoinCtx *r)
 294 {
 295         ADS_STATUS status;
 296         LDAPMessage *res = NULL;
 297         char *dn = NULL;
 298
 299         if (!r->in.machine_name) {
 300                 return ADS_ERROR(LDAP_NO_MEMORY);
 301         }
 302
 303         status = ads_find_machine_acct(r->in.ads,
 304                                        &res,
 305                                        r->in.machine_name);
 306         if (!ADS_ERR_OK(status)) {
 307                 return status;
 308         }
 309
 310         if (ads_count_replies(r->in.ads, res) != 1) {
 311                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 312                 goto done;
 313         }
 314
 315         dn = ads_get_dn(r->in.ads, mem_ctx, res);
 316         if (!dn) {
 317                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 318                 goto done;
 319         }
 320
 321         r->out.dn = talloc_strdup(mem_ctx, dn);
 322         if (!r->out.dn) {
 323                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 324                 goto done;
 325         }
 326
 327  done:
 328         ads_msgfree(r->in.ads, res);
 329         TALLOC_FREE(dn);
 330
 331         return status;
 332 }
 333
 334 /****************************************************************
 335  Set a machines dNSHostName and servicePrincipalName attributes
 336 ****************************************************************/
 337
 338 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
 339                                               struct libnet_JoinCtx *r)
 340 {
 341         ADS_STATUS status;
 342         ADS_MODLIST mods;
 343         fstring my_fqdn;
 344         const char *spn_array[3] = {NULL, NULL, NULL};
 345         char *spn = NULL;
 346
 347         /* Find our DN */
 348
 349         status = libnet_join_find_machine_acct(mem_ctx, r);
 350         if (!ADS_ERR_OK(status)) {
 351                 return status;
 352         }
 353
 354         /* Windows only creates HOST/shortname & HOST/fqdn. */
 355
 356         spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
 357         if (!spn) {
 358                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 359         }
 360         strupper_m(spn);
 361         spn_array[0] = spn;
 362
 363         if (!name_to_fqdn(my_fqdn, r->in.machine_name)
 364             || (strchr(my_fqdn, '.') == NULL)) {
 365                 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
 366                              r->out.dns_domain_name);
 367         }
 368
 369         strlower_m(my_fqdn);
 370
 371         if (!strequal(my_fqdn, r->in.machine_name)) {
 372                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
 373                 if (!spn) {
 374                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 375                 }
 376                 spn_array[1] = spn;
 377         }
 378
 379         mods = ads_init_mods(mem_ctx);
 380         if (!mods) {
 381                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 382         }
 383
 384         /* fields of primary importance */
 385
 386         status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
 387         if (!ADS_ERR_OK(status)) {
 388                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 389         }
 390
 391         status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
 392                                  spn_array);
 393         if (!ADS_ERR_OK(status)) {
 394                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 395         }
 396
 397         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 398 }
 399
 400 /****************************************************************
 401 ****************************************************************/
 402
 403 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
 404                                               struct libnet_JoinCtx *r)
 405 {
 406         ADS_STATUS status;
 407         ADS_MODLIST mods;
 408
 409         if (!r->in.create_upn) {
 410                 return ADS_SUCCESS;
 411         }
 412
 413         /* Find our DN */
 414
 415         status = libnet_join_find_machine_acct(mem_ctx, r);
 416         if (!ADS_ERR_OK(status)) {
 417                 return status;
 418         }
 419
 420         if (!r->in.upn) {
 421                 r->in.upn = talloc_asprintf(mem_ctx,
 422                                             "host/%s@%s",
 423                                             r->in.machine_name,
 424                                             r->out.dns_domain_name);
 425                 if (!r->in.upn) {
 426                         return ADS_ERROR(LDAP_NO_MEMORY);
 427                 }
 428         }
 429
 430         /* now do the mods */
 431
 432         mods = ads_init_mods(mem_ctx);
 433         if (!mods) {
 434                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 435         }
 436
 437         /* fields of primary importance */
 438
 439         status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
 440         if (!ADS_ERR_OK(status)) {
 441                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
 442         }
 443
 444         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 445 }
 446
 447
 448 /****************************************************************
 449 ****************************************************************/
 450
 451 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
 452                                                 struct libnet_JoinCtx *r)
 453 {
 454         ADS_STATUS status;
 455         ADS_MODLIST mods;
 456         char *os_sp = NULL;
 457
 458         if (!r->in.os_name || !r->in.os_version ) {
 459                 return ADS_SUCCESS;
 460         }
 461
 462         /* Find our DN */
 463
 464         status = libnet_join_find_machine_acct(mem_ctx, r);
 465         if (!ADS_ERR_OK(status)) {
 466                 return status;
 467         }
 468
 469         /* now do the mods */
 470
 471         mods = ads_init_mods(mem_ctx);
 472         if (!mods) {
 473                 return ADS_ERROR(LDAP_NO_MEMORY);
 474         }
 475
 476         os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
 477         if (!os_sp) {
 478                 return ADS_ERROR(LDAP_NO_MEMORY);
 479         }
 480
 481         /* fields of primary importance */
 482
 483         status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
 484                              r->in.os_name);
 485         if (!ADS_ERR_OK(status)) {
 486                 return status;
 487         }
 488
 489         status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
 490                              r->in.os_version);
 491         if (!ADS_ERR_OK(status)) {
 492                 return status;
 493         }
 494
 495         status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
 496                              os_sp);
 497         if (!ADS_ERR_OK(status)) {
 498                 return status;
 499         }
 500
 501         return ads_gen_mod(r->in.ads, r->out.dn, mods);
 502 }
 503
 504 /****************************************************************
 505 ****************************************************************/
 506
 507 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
 508                                       struct libnet_JoinCtx *r)
 509 {
 510         if (!USE_SYSTEM_KEYTAB) {
 511                 return true;
 512         }
 513
 514         if (ads_keytab_create_default(r->in.ads) != 0) {
 515                 return false;
 516         }
 517
 518         return true;
 519 }
 520
 521 /****************************************************************
 522 ****************************************************************/
 523
 524 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
 525                                                  struct libnet_JoinCtx *r)
 526 {
 527         uint32_t domain_func;
 528         ADS_STATUS status;
 529         const char *salt = NULL;
 530         char *std_salt = NULL;
 531
 532         status = ads_domain_func_level(r->in.ads, &domain_func);
 533         if (!ADS_ERR_OK(status)) {
 534                 libnet_join_set_error_string(mem_ctx, r,
 535                         "failed to determine domain functional level: %s",
 536                         ads_errstr(status));
 537                 return false;
 538         }
 539
 540         /* go ahead and setup the default salt */
 541
 542         std_salt = kerberos_standard_des_salt();
 543         if (!std_salt) {
 544                 libnet_join_set_error_string(mem_ctx, r,
 545                         "failed to obtain standard DES salt");
 546                 return false;
 547         }
 548
 549         salt = talloc_strdup(mem_ctx, std_salt);
 550         if (!salt) {
 551                 return false;
 552         }
 553
 554         SAFE_FREE(std_salt);
 555
 556         /* if it's a Windows functional domain, we have to look for the UPN */
 557
 558         if (domain_func == DS_DOMAIN_FUNCTION_2000) {
 559                 char *upn;
 560
 561                 upn = ads_get_upn(r->in.ads, mem_ctx,
 562                                   r->in.machine_name);
 563                 if (upn) {
 564                         salt = talloc_strdup(mem_ctx, upn);
 565                         if (!salt) {
 566                                 return false;
 567                         }
 568                 }
 569         }
 570
 571         return kerberos_secrets_store_des_salt(salt);
 572 }
 573
 574 /****************************************************************
 575 ****************************************************************/
 576
 577 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
 578                                                   struct libnet_JoinCtx *r)
 579 {
 580         ADS_STATUS status;
 581
 582         if (!r->in.ads) {
 583                 status = libnet_join_connect_ads(mem_ctx, r);
 584                 if (!ADS_ERR_OK(status)) {
 585                         return status;
 586                 }
 587         }
 588
 589         status = libnet_join_set_machine_spn(mem_ctx, r);
 590         if (!ADS_ERR_OK(status)) {
 591                 libnet_join_set_error_string(mem_ctx, r,
 592                         "failed to set machine spn: %s",
 593                         ads_errstr(status));
 594                 return status;
 595         }
 596
 597         status = libnet_join_set_os_attributes(mem_ctx, r);
 598         if (!ADS_ERR_OK(status)) {
 599                 libnet_join_set_error_string(mem_ctx, r,
 600                         "failed to set machine os attributes: %s",
 601                         ads_errstr(status));
 602                 return status;
 603         }
 604
 605         status = libnet_join_set_machine_upn(mem_ctx, r);
 606         if (!ADS_ERR_OK(status)) {
 607                 libnet_join_set_error_string(mem_ctx, r,
 608                         "failed to set machine upn: %s",
 609                         ads_errstr(status));
 610                 return status;
 611         }
 612
 613         if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
 614                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 615         }
 616
 617         if (!libnet_join_create_keytab(mem_ctx, r)) {
 618                 libnet_join_set_error_string(mem_ctx, r,
 619                         "failed to create kerberos keytab");
 620                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 621         }
 622
 623         return ADS_SUCCESS;
 624 }
 625 #endif /* WITH_ADS */
 626
 627 /****************************************************************
 628  Store the machine password and domain SID
 629 ****************************************************************/
 630
 631 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
 632                                                  struct libnet_JoinCtx *r)
 633 {
 634         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
 635                                       r->out.domain_sid))
 636         {
 637                 DEBUG(1,("Failed to save domain sid\n"));
 638                 return false;
 639         }
 640
 641         if (!secrets_store_machine_password(r->in.machine_password,
 642                                             r->out.netbios_domain_name,
 643                                             r->in.secure_channel_type))
 644         {
 645                 DEBUG(1,("Failed to save machine password\n"));
 646                 return false;
 647         }
 648
 649         return true;
 650 }
 651
 652 /****************************************************************
 653  Connect dc's IPC$ share
 654 ****************************************************************/
 655
 656 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
 657                                            const char *user,
 658                                            const char *pass,
 659                                            bool use_kerberos,
 660                                            struct cli_state **cli)
 661 {
 662         int flags = 0;
 663
 664         if (use_kerberos) {
 665                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
 666         }
 667
 668         if (use_kerberos && pass) {
 669                 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
 670         }
 671
 672         return cli_full_connection(cli, NULL,
 673                                    dc,
 674                                    NULL, 0,
 675                                    "IPC$", "IPC",
 676                                    user,
 677                                    NULL,
 678                                    pass,
 679                                    flags,
 680                                    Undefined, NULL);
 681 }
 682
 683 /****************************************************************
 684  Lookup domain dc's info
 685 ****************************************************************/
 686
 687 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
 688                                           struct libnet_JoinCtx *r,
 689                                           struct cli_state **cli)
 690 {
 691         struct rpc_pipe_client *pipe_hnd = NULL;
 692         struct policy_handle lsa_pol;
 693         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 694         union lsa_PolicyInformation *info = NULL;
 695
 696         status = libnet_join_connect_dc_ipc(r->in.dc_name,
 697                                             r->in.admin_account,
 698                                             r->in.admin_password,
 699                                             r->in.use_kerberos,
 700                                             cli);
 701         if (!NT_STATUS_IS_OK(status)) {
 702                 goto done;
 703         }
 704
 705         status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
 706                                           &pipe_hnd);
 707         if (!NT_STATUS_IS_OK(status)) {
 708                 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
 709                         nt_errstr(status)));
 710                 goto done;
 711         }
 712
 713         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
 714                                         SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
 715         if (!NT_STATUS_IS_OK(status)) {
 716                 goto done;
 717         }
 718
 719         status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
 720                                              &lsa_pol,
 721                                              LSA_POLICY_INFO_DNS,
 722                                              &info);
 723         if (NT_STATUS_IS_OK(status)) {
 724                 r->out.domain_is_ad = true;
 725                 r->out.netbios_domain_name = info->dns.name.string;
 726                 r->out.dns_domain_name = info->dns.dns_domain.string;
 727                 r->out.forest_name = info->dns.dns_forest.string;
 728                 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->dns.sid);
 729                 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
 730         }
 731
 732         if (!NT_STATUS_IS_OK(status)) {
 733                 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
 734                                                     &lsa_pol,
 735                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
 736                                                     &info);
 737                 if (!NT_STATUS_IS_OK(status)) {
 738                         goto done;
 739                 }
 740
 741                 r->out.netbios_domain_name = info->account_domain.name.string;
 742                 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->account_domain.sid);
 743                 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
 744         }
 745
 746         rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
 747         TALLOC_FREE(pipe_hnd);
 748
 749  done:
 750         return status;
 751 }
 752
 753 /****************************************************************
 754  Do the domain join unsecure
 755 ****************************************************************/
 756
 757 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
 758                                                     struct libnet_JoinCtx *r,
 759                                                     struct cli_state *cli)
 760 {
 761         struct rpc_pipe_client *pipe_hnd = NULL;
 762         unsigned char orig_trust_passwd_hash[16];
 763         unsigned char new_trust_passwd_hash[16];
 764         fstring trust_passwd;
 765         NTSTATUS status;
 766
 767         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
 768                                           &pipe_hnd);
 769         if (!NT_STATUS_IS_OK(status)) {
 770                 return status;
 771         }
 772
 773         if (!r->in.machine_password) {
 774                 r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
 775                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
 776         }
 777
 778         E_md4hash(r->in.machine_password, new_trust_passwd_hash);
 779
 780         /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
 781         fstrcpy(trust_passwd, r->in.admin_password);
 782         strlower_m(trust_passwd);
 783
 784         /*
 785          * Machine names can be 15 characters, but the max length on
 786          * a password is 14.  --jerry
 787          */
 788
 789         trust_passwd[14] = '\0';
 790
 791         E_md4hash(trust_passwd, orig_trust_passwd_hash);
 792
 793         status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
 794                                                     r->in.machine_name,
 795                                                     orig_trust_passwd_hash,
 796                                                     r->in.machine_password,
 797                                                     new_trust_passwd_hash,
 798                                                     r->in.secure_channel_type);
 799
 800         return status;
 801 }
 802
 803 /****************************************************************
 804  Do the domain join
 805 ****************************************************************/
 806
 807 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
 808                                            struct libnet_JoinCtx *r,
 809                                            struct cli_state *cli)
 810 {
 811         struct rpc_pipe_client *pipe_hnd = NULL;
 812         struct policy_handle sam_pol, domain_pol, user_pol;
 813         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 814         char *acct_name;
 815         struct lsa_String lsa_acct_name;
 816         uint32_t user_rid;
 817         uint32_t acct_flags = ACB_WSTRUST;
 818         struct samr_Ids user_rids;
 819         struct samr_Ids name_types;
 820         union samr_UserInfo user_info;
 821
 822         struct samr_CryptPassword crypt_pwd;
 823         struct samr_CryptPasswordEx crypt_pwd_ex;
 824
 825         ZERO_STRUCT(sam_pol);
 826         ZERO_STRUCT(domain_pol);
 827         ZERO_STRUCT(user_pol);
 828
 829         switch (r->in.secure_channel_type) {
 830         case SEC_CHAN_WKSTA:
 831                 acct_flags = ACB_WSTRUST;
 832                 break;
 833         case SEC_CHAN_BDC:
 834                 acct_flags = ACB_SVRTRUST;
 835                 break;
 836         default:
 837                 return NT_STATUS_INVALID_PARAMETER;
 838         }
 839
 840         if (!r->in.machine_password) {
 841                 r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
 842                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
 843         }
 844
 845         /* Open the domain */
 846
 847         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
 848                                           &pipe_hnd);
 849         if (!NT_STATUS_IS_OK(status)) {
 850                 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
 851                         nt_errstr(status)));
 852                 goto done;
 853         }
 854
 855         status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
 856                                       pipe_hnd->desthost,
 857                                       SAMR_ACCESS_ENUM_DOMAINS
 858                                       | SAMR_ACCESS_LOOKUP_DOMAIN,
 859                                       &sam_pol);
 860         if (!NT_STATUS_IS_OK(status)) {
 861                 goto done;
 862         }
 863
 864         status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
 865                                         &sam_pol,
 866                                         SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
 867                                         | SAMR_DOMAIN_ACCESS_CREATE_USER
 868                                         | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 869                                         r->out.domain_sid,
 870                                         &domain_pol);
 871         if (!NT_STATUS_IS_OK(status)) {
 872                 goto done;
 873         }
 874
 875         /* Create domain user */
 876
 877         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
 878         strlower_m(acct_name);
 879
 880         init_lsa_String(&lsa_acct_name, acct_name);
 881
 882         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
 883                 uint32_t access_desired =
 884                         SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
 885                         SEC_STD_WRITE_DAC | SEC_STD_DELETE |
 886                         SAMR_USER_ACCESS_SET_PASSWORD |
 887                         SAMR_USER_ACCESS_GET_ATTRIBUTES |
 888                         SAMR_USER_ACCESS_SET_ATTRIBUTES;
 889                 uint32_t access_granted = 0;
 890
 891                 DEBUG(10,("Creating account with desired access mask: %d\n",
 892                         access_desired));
 893
 894                 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
 895                                                  &domain_pol,
 896                                                  &lsa_acct_name,
 897                                                  acct_flags,
 898                                                  access_desired,
 899                                                  &user_pol,
 900                                                  &access_granted,
 901                                                  &user_rid);
 902                 if (!NT_STATUS_IS_OK(status) &&
 903                     !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 904
 905                         DEBUG(10,("Creation of workstation account failed: %s\n",
 906                                 nt_errstr(status)));
 907
 908                         /* If NT_STATUS_ACCESS_DENIED then we have a valid
 909                            username/password combo but the user does not have
 910                            administrator access. */
 911
 912                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 913                                 libnet_join_set_error_string(mem_ctx, r,
 914                                         "User specified does not have "
 915                                         "administrator privileges");
 916                         }
 917
 918                         goto done;
 919                 }
 920
 921                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 922                         if (!(r->in.join_flags &
 923                               WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
 924                                 goto done;
 925                         }
 926                 }
 927
 928                 /* We *must* do this.... don't ask... */
 929
 930                 if (NT_STATUS_IS_OK(status)) {
 931                         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
 932                 }
 933         }
 934
 935         status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
 936                                          &domain_pol,
 937                                          1,
 938                                          &lsa_acct_name,
 939                                          &user_rids,
 940                                          &name_types);
 941         if (!NT_STATUS_IS_OK(status)) {
 942                 goto done;
 943         }
 944
 945         if (name_types.ids[0] != SID_NAME_USER) {
 946                 DEBUG(0,("%s is not a user account (type=%d)\n",
 947                         acct_name, name_types.ids[0]));
 948                 status = NT_STATUS_INVALID_WORKSTATION;
 949                 goto done;
 950         }
 951
 952         user_rid = user_rids.ids[0];
 953
 954         /* Open handle on user */
 955
 956         status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
 957                                       &domain_pol,
 958                                       SEC_FLAG_MAXIMUM_ALLOWED,
 959                                       user_rid,
 960                                       &user_pol);
 961         if (!NT_STATUS_IS_OK(status)) {
 962                 goto done;
 963         }
 964
 965         /* Fill in the additional account flags now */
 966
 967         acct_flags |= ACB_PWNOEXP;
 968         if (r->out.domain_is_ad) {
 969 #if !defined(ENCTYPE_ARCFOUR_HMAC)
 970                 acct_flags |= ACB_USE_DES_KEY_ONLY;
 971 #endif
 972                 ;;
 973         }
 974
 975         /* Set account flags on machine account */
 976         ZERO_STRUCT(user_info.info16);
 977         user_info.info16.acct_flags = acct_flags;
 978
 979         status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
 980                                          &user_pol,
 981                                          16,
 982                                          &user_info);
 983
 984         if (!NT_STATUS_IS_OK(status)) {
 985
 986                 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
 987                                        &user_pol);
 988
 989                 libnet_join_set_error_string(mem_ctx, r,
 990                         "Failed to set account flags for machine account (%s)\n",
 991                         nt_errstr(status));
 992                 goto done;
 993         }
 994
 995         /* Set password on machine account - first try level 26 */
 996
 997         init_samr_CryptPasswordEx(r->in.machine_password,
 998                                   &cli->user_session_key,
 999                                   &crypt_pwd_ex);
1000
1001         user_info.info26.password = crypt_pwd_ex;
1002         user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1003
1004         status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
1005                                           &user_pol,
1006                                           26,
1007                                           &user_info);
1008
1009         if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
1010
1011                 /* retry with level 24 */
1012
1013                 init_samr_CryptPassword(r->in.machine_password,
1014                                         &cli->user_session_key,
1015                                         &crypt_pwd);
1016
1017                 user_info.info24.password = crypt_pwd;
1018                 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1019
1020                 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
1021                                                   &user_pol,
1022                                                   24,
1023                                                   &user_info);
1024         }
1025
1026         if (!NT_STATUS_IS_OK(status)) {
1027
1028                 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
1029                                        &user_pol);
1030
1031                 libnet_join_set_error_string(mem_ctx, r,
1032                         "Failed to set password for machine account (%s)\n",
1033                         nt_errstr(status));
1034                 goto done;
1035         }
1036
1037         status = NT_STATUS_OK;
1038
1039  done:
1040         if (!pipe_hnd) {
1041                 return status;
1042         }
1043
1044         if (is_valid_policy_hnd(&sam_pol)) {
1045                 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1046         }
1047         if (is_valid_policy_hnd(&domain_pol)) {
1048                 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1049         }
1050         if (is_valid_policy_hnd(&user_pol)) {
1051                 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1052         }
1053         TALLOC_FREE(pipe_hnd);
1054
1055         return status;
1056 }
1057
1058 /****************************************************************
1059 ****************************************************************/
1060
1061 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1062                         const char *machine_name,
1063                         const char *dc_name)
1064 {
1065         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1066         struct cli_state *cli = NULL;
1067         struct rpc_pipe_client *pipe_hnd = NULL;
1068         struct rpc_pipe_client *netlogon_pipe = NULL;
1069         NTSTATUS status;
1070         char *machine_password = NULL;
1071         char *machine_account = NULL;
1072
1073         if (!dc_name) {
1074                 return NT_STATUS_INVALID_PARAMETER;
1075         }
1076
1077         if (!secrets_init()) {
1078                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1079         }
1080
1081         machine_password = secrets_fetch_machine_password(netbios_domain_name,
1082                                                           NULL, NULL);
1083         if (!machine_password) {
1084                 return NT_STATUS_NO_TRUST_LSA_SECRET;
1085         }
1086
1087         if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1088                 SAFE_FREE(machine_password);
1089                 return NT_STATUS_NO_MEMORY;
1090         }
1091
1092         status = cli_full_connection(&cli, NULL,
1093                                      dc_name,
1094                                      NULL, 0,
1095                                      "IPC$", "IPC",
1096                                      machine_account,
1097                                      NULL,
1098                                      machine_password,
1099                                      0,
1100                                      Undefined, NULL);
1101         free(machine_account);
1102         free(machine_password);
1103
1104         if (!NT_STATUS_IS_OK(status)) {
1105                 status = cli_full_connection(&cli, NULL,
1106                                              dc_name,
1107                                              NULL, 0,
1108                                              "IPC$", "IPC",
1109                                              "",
1110                                              NULL,
1111                                              "",
1112                                              0,
1113                                              Undefined, NULL);
1114         }
1115
1116         if (!NT_STATUS_IS_OK(status)) {
1117                 return status;
1118         }
1119
1120         status = get_schannel_session_key(cli, netbios_domain_name,
1121                                           &neg_flags, &netlogon_pipe);
1122         if (!NT_STATUS_IS_OK(status)) {
1123                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1124                         cli_shutdown(cli);
1125                         return NT_STATUS_OK;
1126                 }
1127
1128                 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1129                         "key from server %s for domain %s. Error was %s\n",
1130                 cli->desthost, netbios_domain_name, nt_errstr(status)));
1131                 cli_shutdown(cli);
1132                 return status;
1133         }
1134
1135         if (!lp_client_schannel()) {
1136                 cli_shutdown(cli);
1137                 return NT_STATUS_OK;
1138         }
1139
1140         status = cli_rpc_pipe_open_schannel_with_key(
1141                 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1142                 DCERPC_AUTH_LEVEL_PRIVACY,
1143                 netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1144
1145         cli_shutdown(cli);
1146
1147         if (!NT_STATUS_IS_OK(status)) {
1148                 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1149                         "on netlogon pipe to server %s for domain %s. "
1150                         "Error was %s\n",
1151                         cli->desthost, netbios_domain_name, nt_errstr(status)));
1152                 return status;
1153         }
1154
1155         return NT_STATUS_OK;
1156 }
1157
1158 /****************************************************************
1159 ****************************************************************/
1160
1161 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1162                                       struct libnet_JoinCtx *r)
1163 {
1164         NTSTATUS status;
1165
1166         status = libnet_join_ok(r->out.netbios_domain_name,
1167                                 r->in.machine_name,
1168                                 r->in.dc_name);
1169         if (!NT_STATUS_IS_OK(status)) {
1170                 libnet_join_set_error_string(mem_ctx, r,
1171                         "failed to verify domain membership after joining: %s",
1172                         get_friendly_nt_error_msg(status));
1173                 return WERR_SETUP_NOT_JOINED;
1174         }
1175
1176         return WERR_OK;
1177 }
1178
1179 /****************************************************************
1180 ****************************************************************/
1181
1182 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1183                                                     struct libnet_UnjoinCtx *r)
1184 {
1185         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1186                 return false;
1187         }
1188
1189         if (!secrets_delete_domain_sid(lp_workgroup())) {
1190                 return false;
1191         }
1192
1193         return true;
1194 }
1195
1196 /****************************************************************
1197 ****************************************************************/
1198
1199 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1200                                              struct libnet_UnjoinCtx *r)
1201 {
1202         struct cli_state *cli = NULL;
1203         struct rpc_pipe_client *pipe_hnd = NULL;
1204         struct policy_handle sam_pol, domain_pol, user_pol;
1205         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1206         char *acct_name;
1207         uint32_t user_rid;
1208         struct lsa_String lsa_acct_name;
1209         struct samr_Ids user_rids;
1210         struct samr_Ids name_types;
1211         union samr_UserInfo *info = NULL;
1212
1213         ZERO_STRUCT(sam_pol);
1214         ZERO_STRUCT(domain_pol);
1215         ZERO_STRUCT(user_pol);
1216
1217         status = libnet_join_connect_dc_ipc(r->in.dc_name,
1218                                             r->in.admin_account,
1219                                             r->in.admin_password,
1220                                             r->in.use_kerberos,
1221                                             &cli);
1222         if (!NT_STATUS_IS_OK(status)) {
1223                 goto done;
1224         }
1225
1226         /* Open the domain */
1227
1228         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1229                                           &pipe_hnd);
1230         if (!NT_STATUS_IS_OK(status)) {
1231                 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1232                         nt_errstr(status)));
1233                 goto done;
1234         }
1235
1236         status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1237                                       pipe_hnd->desthost,
1238                                       SEC_FLAG_MAXIMUM_ALLOWED,
1239                                       &sam_pol);
1240         if (!NT_STATUS_IS_OK(status)) {
1241                 goto done;
1242         }
1243
1244         status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1245                                         &sam_pol,
1246                                         SEC_FLAG_MAXIMUM_ALLOWED,
1247                                         r->in.domain_sid,
1248                                         &domain_pol);
1249         if (!NT_STATUS_IS_OK(status)) {
1250                 goto done;
1251         }
1252
1253         /* Create domain user */
1254
1255         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1256         strlower_m(acct_name);
1257
1258         init_lsa_String(&lsa_acct_name, acct_name);
1259
1260         status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1261                                          &domain_pol,
1262                                          1,
1263                                          &lsa_acct_name,
1264                                          &user_rids,
1265                                          &name_types);
1266
1267         if (!NT_STATUS_IS_OK(status)) {
1268                 goto done;
1269         }
1270
1271         if (name_types.ids[0] != SID_NAME_USER) {
1272                 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1273                         name_types.ids[0]));
1274                 status = NT_STATUS_INVALID_WORKSTATION;
1275                 goto done;
1276         }
1277
1278         user_rid = user_rids.ids[0];
1279
1280         /* Open handle on user */
1281
1282         status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1283                                       &domain_pol,
1284                                       SEC_FLAG_MAXIMUM_ALLOWED,
1285                                       user_rid,
1286                                       &user_pol);
1287         if (!NT_STATUS_IS_OK(status)) {
1288                 goto done;
1289         }
1290
1291         /* Get user info */
1292
1293         status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1294                                            &user_pol,
1295                                            16,
1296                                            &info);
1297         if (!NT_STATUS_IS_OK(status)) {
1298                 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1299                 goto done;
1300         }
1301
1302         /* now disable and setuser info */
1303
1304         info->info16.acct_flags |= ACB_DISABLED;
1305
1306         status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1307                                          &user_pol,
1308                                          16,
1309                                          info);
1310
1311         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1312
1313 done:
1314         if (pipe_hnd) {
1315                 if (is_valid_policy_hnd(&domain_pol)) {
1316                         rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1317                 }
1318                 if (is_valid_policy_hnd(&sam_pol)) {
1319                         rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1320                 }
1321                 TALLOC_FREE(pipe_hnd);
1322         }
1323
1324         if (cli) {
1325                 cli_shutdown(cli);
1326         }
1327
1328         return status;
1329 }
1330
1331 /****************************************************************
1332 ****************************************************************/
1333
1334 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1335 {
1336         WERROR werr;
1337         struct smbconf_ctx *ctx;
1338
1339         werr = smbconf_init_reg(r, &ctx, NULL);
1340         if (!W_ERROR_IS_OK(werr)) {
1341                 goto done;
1342         }
1343
1344         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1345
1346                 werr = smbconf_set_global_parameter(ctx, "security", "user");
1347                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1348
1349                 werr = smbconf_set_global_parameter(ctx, "workgroup",
1350                                                     r->in.domain_name);
1351
1352                 smbconf_delete_global_parameter(ctx, "realm");
1353                 goto done;
1354         }
1355
1356         werr = smbconf_set_global_parameter(ctx, "security", "domain");
1357         W_ERROR_NOT_OK_GOTO_DONE(werr);
1358
1359         werr = smbconf_set_global_parameter(ctx, "workgroup",
1360                                             r->out.netbios_domain_name);
1361         W_ERROR_NOT_OK_GOTO_DONE(werr);
1362
1363         if (r->out.domain_is_ad) {
1364                 werr = smbconf_set_global_parameter(ctx, "security", "ads");
1365                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1366
1367                 werr = smbconf_set_global_parameter(ctx, "realm",
1368                                                     r->out.dns_domain_name);
1369                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1370         }
1371
1372  done:
1373         smbconf_shutdown(ctx);
1374         return werr;
1375 }
1376
1377 /****************************************************************
1378 ****************************************************************/
1379
1380 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1381 {
1382         WERROR werr = WERR_OK;
1383         struct smbconf_ctx *ctx;
1384
1385         werr = smbconf_init_reg(r, &ctx, NULL);
1386         if (!W_ERROR_IS_OK(werr)) {
1387                 goto done;
1388         }
1389
1390         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1391
1392                 werr = smbconf_set_global_parameter(ctx, "security", "user");
1393                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1394
1395                 werr = smbconf_delete_global_parameter(ctx, "workgroup");
1396                 W_ERROR_NOT_OK_GOTO_DONE(werr);
1397
1398                 smbconf_delete_global_parameter(ctx, "realm");
1399         }
1400
1401  done:
1402         smbconf_shutdown(ctx);
1403         return werr;
1404 }
1405
1406 /****************************************************************
1407 ****************************************************************/
1408
1409 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1410 {
1411         WERROR werr;
1412
1413         if (!W_ERROR_IS_OK(r->out.result)) {
1414                 return r->out.result;
1415         }
1416
1417         if (!r->in.modify_config) {
1418                 return WERR_OK;
1419         }
1420
1421         werr = do_join_modify_vals_config(r);
1422         if (!W_ERROR_IS_OK(werr)) {
1423                 return werr;
1424         }
1425
1426         lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1427
1428         r->out.modified_config = true;
1429         r->out.result = werr;
1430
1431         return werr;
1432 }
1433
1434 /****************************************************************
1435 ****************************************************************/
1436
1437 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1438 {
1439         WERROR werr;
1440
1441         if (!W_ERROR_IS_OK(r->out.result)) {
1442                 return r->out.result;
1443         }
1444
1445         if (!r->in.modify_config) {
1446                 return WERR_OK;
1447         }
1448
1449         werr = do_unjoin_modify_vals_config(r);
1450         if (!W_ERROR_IS_OK(werr)) {
1451                 return werr;
1452         }
1453
1454         lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1455
1456         r->out.modified_config = true;
1457         r->out.result = werr;
1458
1459         return werr;
1460 }
1461
1462 /****************************************************************
1463 ****************************************************************/
1464
1465 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1466                                    const char *domain_str,
1467                                    const char **domain_p,
1468                                    const char **dc_p)
1469 {
1470         char *domain = NULL;
1471         char *dc = NULL;
1472         const char *p = NULL;
1473
1474         if (!domain_str || !domain_p || !dc_p) {
1475                 return false;
1476         }
1477
1478         p = strchr_m(domain_str, '\\');
1479
1480         if (p != NULL) {
1481                 domain = talloc_strndup(mem_ctx, domain_str,
1482                                          PTR_DIFF(p, domain_str));
1483                 dc = talloc_strdup(mem_ctx, p+1);
1484                 if (!dc) {
1485                         return false;
1486                 }
1487         } else {
1488                 domain = talloc_strdup(mem_ctx, domain_str);
1489                 dc = NULL;
1490         }
1491         if (!domain) {
1492                 return false;
1493         }
1494
1495         *domain_p = domain;
1496
1497         if (!*dc_p && dc) {
1498                 *dc_p = dc;
1499         }
1500
1501         return true;
1502 }
1503
1504 /****************************************************************
1505 ****************************************************************/
1506
1507 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1508                                          struct libnet_JoinCtx *r)
1509 {
1510         if (!r->in.domain_name) {
1511                 libnet_join_set_error_string(mem_ctx, r,
1512                         "No domain name defined");
1513                 return WERR_INVALID_PARAM;
1514         }
1515
1516         if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1517                                     &r->in.domain_name,
1518                                     &r->in.dc_name)) {
1519                 libnet_join_set_error_string(mem_ctx, r,
1520                         "Failed to parse domain name");
1521                 return WERR_INVALID_PARAM;
1522         }
1523
1524         if (IS_DC) {
1525                 return WERR_SETUP_DOMAIN_CONTROLLER;
1526         }
1527
1528         if (!secrets_init()) {
1529                 libnet_join_set_error_string(mem_ctx, r,
1530                         "Unable to open secrets database");
1531                 return WERR_CAN_NOT_COMPLETE;
1532         }
1533
1534         return WERR_OK;
1535 }
1536
1537 /****************************************************************
1538 ****************************************************************/
1539
1540 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1541 {
1542         NTSTATUS status;
1543
1544         /* Try adding dom admins to builtin\admins. Only log failures. */
1545         status = create_builtin_administrators(domain_sid);
1546         if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1547                 DEBUG(10,("Unable to auto-add domain administrators to "
1548                           "BUILTIN\\Administrators during join because "
1549                           "winbindd must be running."));
1550         } else if (!NT_STATUS_IS_OK(status)) {
1551                 DEBUG(5, ("Failed to auto-add domain administrators to "
1552                           "BUILTIN\\Administrators during join: %s\n",
1553                           nt_errstr(status)));
1554         }
1555
1556         /* Try adding dom users to builtin\users. Only log failures. */
1557         status = create_builtin_users(domain_sid);
1558         if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1559                 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1560                           "during join because winbindd must be running."));
1561         } else if (!NT_STATUS_IS_OK(status)) {
1562                 DEBUG(5, ("Failed to auto-add domain administrators to "
1563                           "BUILTIN\\Administrators during join: %s\n",
1564                           nt_errstr(status)));
1565         }
1566 }
1567
1568 /****************************************************************
1569 ****************************************************************/
1570
1571 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1572                                           struct libnet_JoinCtx *r)
1573 {
1574         WERROR werr;
1575
1576         if (!W_ERROR_IS_OK(r->out.result)) {
1577                 return r->out.result;
1578         }
1579
1580         werr = do_JoinConfig(r);
1581         if (!W_ERROR_IS_OK(werr)) {
1582                 return werr;
1583         }
1584
1585         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1586                 return WERR_OK;
1587         }
1588
1589         saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1590         if (r->out.dns_domain_name) {
1591                 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1592         }
1593
1594 #ifdef WITH_ADS
1595         if (r->out.domain_is_ad &&
1596             !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1597                 ADS_STATUS ads_status;
1598
1599                 ads_status  = libnet_join_post_processing_ads(mem_ctx, r);
1600                 if (!ADS_ERR_OK(ads_status)) {
1601                         return WERR_GENERAL_FAILURE;
1602                 }
1603         }
1604 #endif /* WITH_ADS */
1605
1606         libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1607
1608         return WERR_OK;
1609 }
1610
1611 /****************************************************************
1612 ****************************************************************/
1613
1614 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1615 {
1616         const char *krb5_cc_env = NULL;
1617
1618         if (r->in.ads) {
1619                 ads_destroy(&r->in.ads);
1620         }
1621
1622         krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1623         if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1624                 unsetenv(KRB5_ENV_CCNAME);
1625         }
1626
1627         return 0;
1628 }
1629
1630 /****************************************************************
1631 ****************************************************************/
1632
1633 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1634 {
1635         const char *krb5_cc_env = NULL;
1636
1637         if (r->in.ads) {
1638                 ads_destroy(&r->in.ads);
1639         }
1640
1641         krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1642         if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1643                 unsetenv(KRB5_ENV_CCNAME);
1644         }
1645
1646         return 0;
1647 }
1648
1649 /****************************************************************
1650 ****************************************************************/
1651
1652 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1653                            struct libnet_JoinCtx **r)
1654 {
1655         struct libnet_JoinCtx *ctx;
1656         const char *krb5_cc_env = NULL;
1657
1658         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1659         if (!ctx) {
1660                 return WERR_NOMEM;
1661         }
1662
1663         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1664
1665         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1666         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1667
1668         krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1669         if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1670                 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1671                 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1672                 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1673         }
1674
1675         ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1676
1677         *r = ctx;
1678
1679         return WERR_OK;
1680 }
1681
1682 /****************************************************************
1683 ****************************************************************/
1684
1685 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1686                              struct libnet_UnjoinCtx **r)
1687 {
1688         struct libnet_UnjoinCtx *ctx;
1689         const char *krb5_cc_env = NULL;
1690
1691         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1692         if (!ctx) {
1693                 return WERR_NOMEM;
1694         }
1695
1696         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1697
1698         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1699         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1700
1701         krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1702         if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1703                 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1704                 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1705                 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1706         }
1707
1708         *r = ctx;
1709
1710         return WERR_OK;
1711 }
1712
1713 /****************************************************************
1714 ****************************************************************/
1715
1716 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1717                                        struct libnet_JoinCtx *r)
1718 {
1719         bool valid_security = false;
1720         bool valid_workgroup = false;
1721         bool valid_realm = false;
1722
1723         /* check if configuration is already set correctly */
1724
1725         valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1726
1727         switch (r->out.domain_is_ad) {
1728                 case false:
1729                         valid_security = (lp_security() == SEC_DOMAIN);
1730                         if (valid_workgroup && valid_security) {
1731                                 /* nothing to be done */
1732                                 return WERR_OK;
1733                         }
1734                         break;
1735                 case true:
1736                         valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1737                         switch (lp_security()) {
1738                         case SEC_DOMAIN:
1739                         case SEC_ADS:
1740                                 valid_security = true;
1741                         }
1742
1743                         if (valid_workgroup && valid_realm && valid_security) {
1744                                 /* nothing to be done */
1745                                 return WERR_OK;
1746                         }
1747                         break;
1748         }
1749
1750         /* check if we are supposed to manipulate configuration */
1751
1752         if (!r->in.modify_config) {
1753
1754                 char *wrong_conf = talloc_strdup(mem_ctx, "");
1755
1756                 if (!valid_workgroup) {
1757                         wrong_conf = talloc_asprintf_append(wrong_conf,
1758                                 "\"workgroup\" set to '%s', should be '%s'",
1759                                 lp_workgroup(), r->out.netbios_domain_name);
1760                         W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1761                 }
1762
1763                 if (!valid_realm) {
1764                         wrong_conf = talloc_asprintf_append(wrong_conf,
1765                                 "\"realm\" set to '%s', should be '%s'",
1766                                 lp_realm(), r->out.dns_domain_name);
1767                         W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1768                 }
1769
1770                 if (!valid_security) {
1771                         const char *sec = NULL;
1772                         switch (lp_security()) {
1773                         case SEC_SHARE: sec = "share"; break;
1774                         case SEC_USER:  sec = "user"; break;
1775                         case SEC_DOMAIN: sec = "domain"; break;
1776                         case SEC_ADS: sec = "ads"; break;
1777                         }
1778                         wrong_conf = talloc_asprintf_append(wrong_conf,
1779                                 "\"security\" set to '%s', should be %s",
1780                                 sec, r->out.domain_is_ad ?
1781                                 "either 'domain' or 'ads'" : "'domain'");
1782                         W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1783                 }
1784
1785                 libnet_join_set_error_string(mem_ctx, r,
1786                         "Invalid configuration (%s) and configuration modification "
1787                         "was not requested", wrong_conf);
1788                 return WERR_CAN_NOT_COMPLETE;
1789         }
1790
1791         /* check if we are able to manipulate configuration */
1792
1793         if (!lp_config_backend_is_registry()) {
1794                 libnet_join_set_error_string(mem_ctx, r,
1795                         "Configuration manipulation requested but not "
1796                         "supported by backend");
1797                 return WERR_NOT_SUPPORTED;
1798         }
1799
1800         return WERR_OK;
1801 }
1802
1803 /****************************************************************
1804 ****************************************************************/
1805
1806 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1807                                 struct libnet_JoinCtx *r)
1808 {
1809         NTSTATUS status;
1810         WERROR werr;
1811         struct cli_state *cli = NULL;
1812 #ifdef WITH_ADS
1813         ADS_STATUS ads_status;
1814 #endif /* WITH_ADS */
1815
1816         if (!r->in.dc_name) {
1817                 struct netr_DsRGetDCNameInfo *info;
1818                 const char *dc;
1819                 status = dsgetdcname(mem_ctx,
1820                                      r->in.msg_ctx,
1821                                      r->in.domain_name,
1822                                      NULL,
1823                                      NULL,
1824                                      DS_FORCE_REDISCOVERY |
1825                                      DS_DIRECTORY_SERVICE_REQUIRED |
1826                                      DS_WRITABLE_REQUIRED |
1827                                      DS_RETURN_DNS_NAME,
1828                                      &info);
1829                 if (!NT_STATUS_IS_OK(status)) {
1830                         libnet_join_set_error_string(mem_ctx, r,
1831                                 "failed to find DC for domain %s",
1832                                 r->in.domain_name,
1833                                 get_friendly_nt_error_msg(status));
1834                         return WERR_DCNOTFOUND;
1835                 }
1836
1837                 dc = strip_hostname(info->dc_unc);
1838                 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1839                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1840         }
1841
1842         status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1843         if (!NT_STATUS_IS_OK(status)) {
1844                 libnet_join_set_error_string(mem_ctx, r,
1845                         "failed to lookup DC info for domain '%s' over rpc: %s",
1846                         r->in.domain_name, get_friendly_nt_error_msg(status));
1847                 return ntstatus_to_werror(status);
1848         }
1849
1850         werr = libnet_join_check_config(mem_ctx, r);
1851         if (!W_ERROR_IS_OK(werr)) {
1852                 goto done;
1853         }
1854
1855 #ifdef WITH_ADS
1856         if (r->out.domain_is_ad && r->in.account_ou &&
1857             !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1858
1859                 ads_status = libnet_join_connect_ads(mem_ctx, r);
1860                 if (!ADS_ERR_OK(ads_status)) {
1861                         return WERR_DEFAULT_JOIN_REQUIRED;
1862                 }
1863
1864                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1865                 if (!ADS_ERR_OK(ads_status)) {
1866                         libnet_join_set_error_string(mem_ctx, r,
1867                                 "failed to precreate account in ou %s: %s",
1868                                 r->in.account_ou,
1869                                 ads_errstr(ads_status));
1870                         return WERR_DEFAULT_JOIN_REQUIRED;
1871                 }
1872
1873                 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1874         }
1875 #endif /* WITH_ADS */
1876
1877         if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
1878             (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
1879                 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
1880         } else {
1881                 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
1882         }
1883         if (!NT_STATUS_IS_OK(status)) {
1884                 libnet_join_set_error_string(mem_ctx, r,
1885                         "failed to join domain '%s' over rpc: %s",
1886                         r->in.domain_name, get_friendly_nt_error_msg(status));
1887                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1888                         return WERR_SETUP_ALREADY_JOINED;
1889                 }
1890                 werr = ntstatus_to_werror(status);
1891                 goto done;
1892         }
1893
1894         if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1895                 werr = WERR_SETUP_NOT_JOINED;
1896                 goto done;
1897         }
1898
1899         werr = WERR_OK;
1900
1901  done:
1902         if (cli) {
1903                 cli_shutdown(cli);
1904         }
1905
1906         return werr;
1907 }
1908
1909 /****************************************************************
1910 ****************************************************************/
1911
1912 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
1913                                    struct libnet_JoinCtx *r)
1914 {
1915         WERROR werr;
1916         struct libnet_UnjoinCtx *u = NULL;
1917
1918         werr = libnet_init_UnjoinCtx(mem_ctx, &u);
1919         if (!W_ERROR_IS_OK(werr)) {
1920                 return werr;
1921         }
1922
1923         u->in.debug             = r->in.debug;
1924         u->in.dc_name           = r->in.dc_name;
1925         u->in.domain_name       = r->in.domain_name;
1926         u->in.admin_account     = r->in.admin_account;
1927         u->in.admin_password    = r->in.admin_password;
1928         u->in.modify_config     = r->in.modify_config;
1929         u->in.unjoin_flags      = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1930                                   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
1931
1932         werr = libnet_Unjoin(mem_ctx, u);
1933         TALLOC_FREE(u);
1934
1935         return werr;
1936 }
1937
1938 /****************************************************************
1939 ****************************************************************/
1940
1941 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1942                    struct libnet_JoinCtx *r)
1943 {
1944         WERROR werr;
1945
1946         if (r->in.debug) {
1947                 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1948         }
1949
1950         werr = libnet_join_pre_processing(mem_ctx, r);
1951         if (!W_ERROR_IS_OK(werr)) {
1952                 goto done;
1953         }
1954
1955         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1956                 werr = libnet_DomainJoin(mem_ctx, r);
1957                 if (!W_ERROR_IS_OK(werr)) {
1958                         goto done;
1959                 }
1960         }
1961
1962         werr = libnet_join_post_processing(mem_ctx, r);
1963         if (!W_ERROR_IS_OK(werr)) {
1964                 goto done;
1965         }
1966
1967         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1968                 werr = libnet_join_post_verify(mem_ctx, r);
1969                 if (!W_ERROR_IS_OK(werr)) {
1970                         libnet_join_rollback(mem_ctx, r);
1971                 }
1972         }
1973
1974  done:
1975         r->out.result = werr;
1976
1977         if (r->in.debug) {
1978                 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1979         }
1980         return werr;
1981 }
1982
1983 /****************************************************************
1984 ****************************************************************/
1985
1986 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1987                                   struct libnet_UnjoinCtx *r)
1988 {
1989         NTSTATUS status;
1990
1991         if (!r->in.domain_sid) {
1992                 struct dom_sid sid;
1993                 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1994                         libnet_unjoin_set_error_string(mem_ctx, r,
1995                                 "Unable to fetch domain sid: are we joined?");
1996                         return WERR_SETUP_NOT_JOINED;
1997                 }
1998                 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
1999                 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2000         }
2001
2002         if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2003             !r->in.delete_machine_account) {
2004                 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2005                 return WERR_OK;
2006         }
2007
2008         if (!r->in.dc_name) {
2009                 struct netr_DsRGetDCNameInfo *info;
2010                 const char *dc;
2011                 status = dsgetdcname(mem_ctx,
2012                                      r->in.msg_ctx,
2013                                      r->in.domain_name,
2014                                      NULL,
2015                                      NULL,
2016                                      DS_DIRECTORY_SERVICE_REQUIRED |
2017                                      DS_WRITABLE_REQUIRED |
2018                                      DS_RETURN_DNS_NAME,
2019                                      &info);
2020                 if (!NT_STATUS_IS_OK(status)) {
2021                         libnet_unjoin_set_error_string(mem_ctx, r,
2022                                 "failed to find DC for domain %s",
2023                                 r->in.domain_name,
2024                                 get_friendly_nt_error_msg(status));
2025                         return WERR_DCNOTFOUND;
2026                 }
2027
2028                 dc = strip_hostname(info->dc_unc);
2029                 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2030                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2031         }
2032
2033 #ifdef WITH_ADS
2034         /* for net ads leave, try to delete the account.  If it works,
2035            no sense in disabling.  If it fails, we can still try to
2036            disable it. jmcd */
2037
2038         if (r->in.delete_machine_account) {
2039                 ADS_STATUS ads_status;
2040                 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2041                 if (ADS_ERR_OK(ads_status)) {
2042                         /* dirty hack */
2043                         r->out.dns_domain_name =
2044                                 talloc_strdup(mem_ctx,
2045                                               r->in.ads->server.realm);
2046                         ads_status =
2047                                 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2048                 }
2049                 if (!ADS_ERR_OK(ads_status)) {
2050                         libnet_unjoin_set_error_string(mem_ctx, r,
2051                                 "failed to remove machine account from AD: %s",
2052                                 ads_errstr(ads_status));
2053                 } else {
2054                         r->out.deleted_machine_account = true;
2055                         W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2056                         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2057                         return WERR_OK;
2058                 }
2059         }
2060 #endif /* WITH_ADS */
2061
2062         /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2063            "disable".  */
2064         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2065                 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2066                 if (!NT_STATUS_IS_OK(status)) {
2067                         libnet_unjoin_set_error_string(mem_ctx, r,
2068                                 "failed to disable machine account via rpc: %s",
2069                                 get_friendly_nt_error_msg(status));
2070                         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2071                                 return WERR_SETUP_NOT_JOINED;
2072                         }
2073                         return ntstatus_to_werror(status);
2074                 }
2075
2076                 r->out.disabled_machine_account = true;
2077         }
2078
2079         /* If disable succeeded or was not requested at all, we
2080            should be getting rid of our end of things */
2081
2082         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2083
2084         return WERR_OK;
2085 }
2086
2087 /****************************************************************
2088 ****************************************************************/
2089
2090 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2091                                            struct libnet_UnjoinCtx *r)
2092 {
2093         if (!r->in.domain_name) {
2094                 libnet_unjoin_set_error_string(mem_ctx, r,
2095                         "No domain name defined");
2096                 return WERR_INVALID_PARAM;
2097         }
2098
2099         if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2100                                     &r->in.domain_name,
2101                                     &r->in.dc_name)) {
2102                 libnet_unjoin_set_error_string(mem_ctx, r,
2103                         "Failed to parse domain name");
2104                 return WERR_INVALID_PARAM;
2105         }
2106
2107         if (IS_DC) {
2108                 return WERR_SETUP_DOMAIN_CONTROLLER;
2109         }
2110
2111         if (!secrets_init()) {
2112                 libnet_unjoin_set_error_string(mem_ctx, r,
2113                         "Unable to open secrets database");
2114                 return WERR_CAN_NOT_COMPLETE;
2115         }
2116
2117         return WERR_OK;
2118 }
2119
2120 /****************************************************************
2121 ****************************************************************/
2122
2123 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2124                                             struct libnet_UnjoinCtx *r)
2125 {
2126         saf_delete(r->out.netbios_domain_name);
2127         saf_delete(r->out.dns_domain_name);
2128
2129         return libnet_unjoin_config(r);
2130 }
2131
2132 /****************************************************************
2133 ****************************************************************/
2134
2135 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2136                      struct libnet_UnjoinCtx *r)
2137 {
2138         WERROR werr;
2139
2140         if (r->in.debug) {
2141                 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2142         }
2143
2144         werr = libnet_unjoin_pre_processing(mem_ctx, r);
2145         if (!W_ERROR_IS_OK(werr)) {
2146                 goto done;
2147         }
2148
2149         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2150                 werr = libnet_DomainUnjoin(mem_ctx, r);
2151                 if (!W_ERROR_IS_OK(werr)) {
2152                         libnet_unjoin_config(r);
2153                         goto done;
2154                 }
2155         }
2156
2157         werr = libnet_unjoin_post_processing(mem_ctx, r);
2158         if (!W_ERROR_IS_OK(werr)) {
2159                 goto done;
2160         }
2161
2162  done:
2163         r->out.result = werr;
2164
2165         if (r->in.debug) {
2166                 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2167         }
2168
2169         return werr;
2170 }