#include "system/time.h"
#include "lib/ldb_wrap.h"
#include "auth/auth.h"
+#include "auth/credentials/credentials.h"
#include "param/param.h"
#include "param/provision.h"
#include "libcli/security/dom_sid.h"
- Write out the secrets database, using the code from libnet_Join
*/
-struct vampire_state {
+struct libnet_vampire_cb_state {
const char *netbios_name;
- struct libnet_JoinDomain *join;
+ const char *domain_name;
+ const char *realm;
struct cli_credentials *machine_account;
struct dsdb_schema *self_made_schema;
const struct dsdb_schema *schema;
char *last_partition;
};
-static NTSTATUS vampire_prepare_db(void *private_data,
- const struct libnet_BecomeDC_PrepareDB *p)
+/* Caller is expected to keep supplied pointers around for the lifetime of the structure */
+void *libnet_vampire_cb_state_init(TALLOC_CTX *mem_ctx,
+ struct loadparm_context *lp_ctx, struct tevent_context *event_ctx,
+ const char *netbios_name, const char *domain_name, const char *realm,
+ const char *targetdir)
+{
+ struct libnet_vampire_cb_state *s = talloc_zero(mem_ctx, struct libnet_vampire_cb_state);
+ if (!s) {
+ return NULL;
+ }
+
+ s->lp_ctx = lp_ctx;
+ s->event_ctx = event_ctx;
+ s->netbios_name = netbios_name;
+ s->domain_name = domain_name;
+ s->realm = realm;
+ s->targetdir = targetdir;
+ return s;
+}
+
+struct ldb_context *libnet_vampire_cb_ldb(struct libnet_vampire_cb_state *state)
+{
+ state = talloc_get_type_abort(state, struct libnet_vampire_cb_state);
+ return state->ldb;
+}
+
+struct loadparm_context *libnet_vampire_cb_lp_ctx(struct libnet_vampire_cb_state *state)
+{
+ state = talloc_get_type_abort(state, struct libnet_vampire_cb_state);
+ return state->lp_ctx;
+}
+
+NTSTATUS libnet_vampire_cb_prepare_db(void *private_data,
+ const struct libnet_BecomeDC_PrepareDB *p)
{
- struct vampire_state *s = talloc_get_type(private_data, struct vampire_state);
+ struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state);
struct provision_settings settings;
struct provision_result result;
NTSTATUS status;
settings.config_dn_str = p->forest->config_dn_str;
settings.schema_dn_str = p->forest->schema_dn_str;
settings.netbios_name = p->dest_dsa->netbios_name;
- settings.realm = s->join->out.realm;
- settings.domain = s->join->out.domain_name;
+ settings.realm = s->realm;
+ settings.domain = s->domain_name;
settings.server_dn_str = p->dest_dsa->server_dn_str;
- settings.machine_password = generate_random_str(s, 16);
+ settings.machine_password = generate_random_password(s, 16, 255);
settings.targetdir = s->targetdir;
status = provision_bare(s, s->lp_ctx, &settings, &result);
return status;
}
- s->ldb = result.samdb;
- s->lp_ctx = result.lp_ctx;
+ s->ldb = talloc_steal(s, result.samdb);
+ s->lp_ctx = talloc_steal(s, result.lp_ctx);
/* wrap the entire vapire operation in a transaction. This
isn't just cosmetic - we use this to ensure that linked
}
-static NTSTATUS vampire_check_options(void *private_data,
- const struct libnet_BecomeDC_CheckOptions *o)
+NTSTATUS libnet_vampire_cb_check_options(void *private_data,
+ const struct libnet_BecomeDC_CheckOptions *o)
{
- struct vampire_state *s = talloc_get_type(private_data, struct vampire_state);
+ struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state);
DEBUG(0,("Become DC [%s] of Domain[%s]/[%s]\n",
s->netbios_name,
return NT_STATUS_OK;
}
-static NTSTATUS vampire_apply_schema(struct vampire_state *s,
- const struct libnet_BecomeDC_StoreChunk *c)
+static NTSTATUS libnet_vampire_cb_apply_schema(struct libnet_vampire_cb_state *s,
+ const struct libnet_BecomeDC_StoreChunk *c)
{
WERROR status;
const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr;
uint32_t object_count;
struct drsuapi_DsReplicaObjectListItemEx *first_object;
- struct drsuapi_DsReplicaObjectListItemEx *cur;
uint32_t linked_attributes_count;
struct drsuapi_DsReplicaLinkedAttribute *linked_attributes;
const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector;
- struct dsdb_extended_replicated_objects *objs;
+ struct dsdb_extended_replicated_objects *schema_objs_1, *schema_objs_2;
struct repsFromTo1 *s_dsa;
char *tmp_dns_name;
struct ldb_message *msg;
NT_STATUS_HAVE_NO_MEMORY(tmp_dns_name);
s_dsa->other_info->dns_name = tmp_dns_name;
- for (cur = first_object; cur; cur = cur->next_object) {
- bool is_attr = false;
- bool is_class = false;
-
- for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
- struct drsuapi_DsReplicaAttribute *a;
- uint32_t j;
- const char *oid = NULL;
-
- a = &cur->object.attribute_ctr.attributes[i];
- status = dsdb_schema_pfm_oid_from_attid(s->self_made_schema->prefixmap,
- a->attid, s, &oid);
- if (!W_ERROR_IS_OK(status)) {
- return werror_to_ntstatus(status);
- }
-
- switch (a->attid) {
- case DRSUAPI_ATTRIBUTE_objectClass:
- for (j=0; j < a->value_ctr.num_values; j++) {
- uint32_t val = 0xFFFFFFFF;
-
- if (a->value_ctr.values[j].blob
- && a->value_ctr.values[j].blob->length == 4) {
- val = IVAL(a->value_ctr.values[j].blob->data,0);
- }
-
- if (val == DRSUAPI_OBJECTCLASS_attributeSchema) {
- is_attr = true;
- }
- if (val == DRSUAPI_OBJECTCLASS_classSchema) {
- is_class = true;
- }
- }
-
- break;
- default:
- break;
- }
- }
-
- if (is_attr) {
- struct dsdb_attribute *sa;
-
- sa = talloc_zero(s->self_made_schema, struct dsdb_attribute);
- NT_STATUS_HAVE_NO_MEMORY(sa);
-
- status = dsdb_attribute_from_drsuapi(s->ldb, s->self_made_schema, &cur->object, s, sa);
- if (!W_ERROR_IS_OK(status)) {
- return werror_to_ntstatus(status);
- }
-
- DLIST_ADD_END(s->self_made_schema->attributes, sa, struct dsdb_attribute *);
- }
-
- if (is_class) {
- struct dsdb_class *sc;
-
- sc = talloc_zero(s->self_made_schema, struct dsdb_class);
- NT_STATUS_HAVE_NO_MEMORY(sc);
+ /* Now convert the schema elements again, using the schema we just imported */
+ status = dsdb_extended_replicated_objects_convert(s->ldb,
+ c->partition->nc.dn,
+ mapping_ctr,
+ object_count,
+ first_object,
+ linked_attributes_count,
+ linked_attributes,
+ s_dsa,
+ uptodateness_vector,
+ c->gensec_skey,
+ s, &schema_objs_1);
+ if (!W_ERROR_IS_OK(status)) {
+ DEBUG(0,("Failed to convert objects: %s\n", win_errstr(status)));
+ return werror_to_ntstatus(status);
+ }
- status = dsdb_class_from_drsuapi(s->ldb, s->self_made_schema, &cur->object, s, sc);
- if (!W_ERROR_IS_OK(status)) {
- return werror_to_ntstatus(status);
- }
- DLIST_ADD_END(s->self_made_schema->classes, sc, struct dsdb_class *);
+ for (i=0; i < schema_objs_1->num_objects; i++) {
+ status = dsdb_schema_set_el_from_ldb_msg(s->ldb, s->self_made_schema, schema_objs_1->objects[i].msg);
+ if (!W_ERROR_IS_OK(status)) {
+ DEBUG(0,("Failed to convert object %s into a schema element: %s\n",
+ ldb_dn_get_linearized(schema_objs_1->objects[i].msg->dn),
+ win_errstr(status)));
+ return werror_to_ntstatus(status);
}
}
+ /* We don't need the first conversion of the schema any more */
+ talloc_free(schema_objs_1);
- /* attach the schema to the ldb */
+ /* attach the schema we just brought over DRS to the ldb */
ret = dsdb_set_schema(s->ldb, s->self_made_schema);
if (ret != LDB_SUCCESS) {
+ DEBUG(0,("Failed to attach schema from DRS.\n"));
return NT_STATUS_FOOBAR;
}
+
/* we don't want to access the self made schema anymore */
s->schema = s->self_made_schema;
s->self_made_schema = NULL;
- /* Now convert the schema elements again, using the schema we just imported */
+ /* Now convert the schema elements again, using the schema we just imported - we do this
+ 'just in case' the schema in our LDIF was wrong, but correct enough to read a valid schema */
status = dsdb_extended_replicated_objects_convert(s->ldb,
c->partition->nc.dn,
mapping_ctr,
s_dsa,
uptodateness_vector,
c->gensec_skey,
- s, &objs);
+ s, &schema_objs_2);
if (!W_ERROR_IS_OK(status)) {
- DEBUG(0,("Failed to commit objects: %s\n", win_errstr(status)));
+ DEBUG(0,("Failed to convert objects: %s\n", win_errstr(status)));
return werror_to_ntstatus(status);
}
if (lp_parm_bool(s->lp_ctx, NULL, "become dc", "dump objects", false)) {
- for (i=0; i < objs->num_objects; i++) {
+ for (i=0; i < schema_objs_2->num_objects; i++) {
struct ldb_ldif ldif;
fprintf(stdout, "#\n");
ldif.changetype = LDB_CHANGETYPE_NONE;
- ldif.msg = objs->objects[i].msg;
+ ldif.msg = schema_objs_2->objects[i].msg;
ldb_ldif_write_file(s->ldb, stdout, &ldif);
- NDR_PRINT_DEBUG(replPropertyMetaDataBlob, objs->objects[i].meta_data);
+ NDR_PRINT_DEBUG(replPropertyMetaDataBlob, schema_objs_2->objects[i].meta_data);
}
}
- status = dsdb_extended_replicated_objects_commit(s->ldb, objs, &seq_num);
+ status = dsdb_extended_replicated_objects_commit(s->ldb, schema_objs_2, &seq_num);
if (!W_ERROR_IS_OK(status)) {
DEBUG(0,("Failed to commit objects: %s\n", win_errstr(status)));
return werror_to_ntstatus(status);
}
- msg = ldb_msg_new(objs);
+ msg = ldb_msg_new(schema_objs_2);
NT_STATUS_HAVE_NO_MEMORY(msg);
- msg->dn = objs->partition_dn;
+ msg->dn = schema_objs_2->partition_dn;
status = dsdb_get_oid_mappings_ldb(s->schema, msg, &prefixMap_val, &schemaInfo_val);
if (!W_ERROR_IS_OK(status)) {
ret = ldb_modify(s->ldb, msg);
if (ret != LDB_SUCCESS) {
- DEBUG(0,("Failed to add prefixMap and schemaInfo %s\n", ldb_strerror(ret)));
+ DEBUG(0,("Failed to add prefixMap: %s\n", ldb_strerror(ret)));
return NT_STATUS_FOOBAR;
}
talloc_free(s_dsa);
- talloc_free(objs);
+ talloc_free(schema_objs_2);
/* We must set these up to ensure the replMetaData is written
* correctly, before our NTDS Settings entry is replicated */
return NT_STATUS_FOOBAR;
}
- s->schema = dsdb_get_schema(s->ldb);
+ s->schema = dsdb_get_schema(s->ldb, s);
if (!s->schema) {
DEBUG(0,("Failed to get loaded dsdb_schema\n"));
return NT_STATUS_FOOBAR;
return NT_STATUS_OK;
}
-static NTSTATUS vampire_schema_chunk(void *private_data,
- const struct libnet_BecomeDC_StoreChunk *c)
+NTSTATUS libnet_vampire_cb_schema_chunk(void *private_data,
+ const struct libnet_BecomeDC_StoreChunk *c)
{
- struct vampire_state *s = talloc_get_type(private_data, struct vampire_state);
+ struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state);
WERROR status;
const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr;
uint32_t nc_object_count;
}
if (!s->schema) {
- s->self_made_schema = dsdb_new_schema(s, lp_iconv_convenience(s->lp_ctx));
+ s->self_made_schema = dsdb_new_schema(s);
NT_STATUS_HAVE_NO_MEMORY(s->self_made_schema);
s->schema_part.last_object = cur;
if (!c->partition->more_data) {
- return vampire_apply_schema(s, c);
+ return libnet_vampire_cb_apply_schema(s, c);
}
return NT_STATUS_OK;
}
-static NTSTATUS vampire_store_chunk(void *private_data,
- const struct libnet_BecomeDC_StoreChunk *c)
+NTSTATUS libnet_vampire_cb_store_chunk(void *private_data,
+ const struct libnet_BecomeDC_StoreChunk *c)
{
- struct vampire_state *s = talloc_get_type(private_data, struct vampire_state);
+ struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state);
WERROR status;
const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr;
uint32_t nc_object_count;
struct libnet_JoinDomain *join;
struct provision_store_self_join_settings *set_secrets;
struct libnet_BecomeDC b;
- struct vampire_state *s;
+ struct libnet_vampire_cb_state *s;
struct ldb_message *msg;
const char *error_string;
int ldb_ret;
r->out.error_string = NULL;
- s = talloc_zero(mem_ctx, struct vampire_state);
- if (!s) {
- return NT_STATUS_NO_MEMORY;
- }
-
- s->lp_ctx = ctx->lp_ctx;
- s->event_ctx = ctx->event_ctx;
-
- join = talloc_zero(s, struct libnet_JoinDomain);
+ join = talloc_zero(mem_ctx, struct libnet_JoinDomain);
if (!join) {
return NT_STATUS_NO_MEMORY;
}
} else {
netbios_name = talloc_reference(join, lp_netbios_name(ctx->lp_ctx));
if (!netbios_name) {
+ talloc_free(join);
r->out.error_string = NULL;
- talloc_free(s);
return NT_STATUS_NO_MEMORY;
}
}
account_name = talloc_asprintf(join, "%s$", netbios_name);
if (!account_name) {
+ talloc_free(join);
r->out.error_string = NULL;
- talloc_free(s);
return NT_STATUS_NO_MEMORY;
}
+ /* Re-use the domain we are joining as the domain for the user
+ * to be authenticated with, unless they specified
+ * otherwise */
+ cli_credentials_set_domain(ctx->cred, r->in.domain_name, CRED_GUESS_ENV);
+
join->in.domain_name = r->in.domain_name;
join->in.account_name = account_name;
join->in.netbios_name = netbios_name;
status = libnet_JoinDomain(ctx, join, join);
if (!NT_STATUS_IS_OK(status)) {
r->out.error_string = talloc_steal(mem_ctx, join->out.error_string);
- talloc_free(s);
+ talloc_free(join);
return status;
}
- s->join = join;
-
- s->targetdir = r->in.targetdir;
+ s = libnet_vampire_cb_state_init(mem_ctx, ctx->lp_ctx, ctx->event_ctx,
+ netbios_name, join->out.domain_name, join->out.realm,
+ r->in.targetdir);
+ if (!s) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ talloc_steal(s, join);
ZERO_STRUCT(b);
+
+ /* Be more robust:
+ * We now know the domain and realm for sure - if they didn't
+ * put one on the command line, use this for the rest of the
+ * join */
+ cli_credentials_set_realm(ctx->cred, join->out.realm, CRED_GUESS_ENV);
+ cli_credentials_set_domain(ctx->cred, join->out.domain_name, CRED_GUESS_ENV);
+
+ /* Now set these values into the smb.conf - we probably had
+ * empty or useless defaults here from whatever smb.conf we
+ * started with */
+ lp_set_cmdline(s->lp_ctx, "realm", join->out.realm);
+ lp_set_cmdline(s->lp_ctx, "workgroup", join->out.domain_name);
+
b.in.domain_dns_name = join->out.realm;
b.in.domain_netbios_name = join->out.domain_name;
b.in.domain_sid = join->out.domain_sid;
b.in.dest_dsa_netbios_name = netbios_name;
b.in.callbacks.private_data = s;
- b.in.callbacks.check_options = vampire_check_options;
- b.in.callbacks.prepare_db = vampire_prepare_db;
- b.in.callbacks.schema_chunk = vampire_schema_chunk;
- b.in.callbacks.config_chunk = vampire_store_chunk;
- b.in.callbacks.domain_chunk = vampire_store_chunk;
+ b.in.callbacks.check_options = libnet_vampire_cb_check_options;
+ b.in.callbacks.prepare_db = libnet_vampire_cb_prepare_db;
+ b.in.callbacks.schema_chunk = libnet_vampire_cb_schema_chunk;
+ b.in.callbacks.config_chunk = libnet_vampire_cb_store_chunk;
+ b.in.callbacks.domain_chunk = libnet_vampire_cb_store_chunk;
b.in.rodc_join = lp_parm_bool(s->lp_ctx, NULL, "repl", "RODC", false);
ZERO_STRUCTP(set_secrets);
set_secrets->domain_name = join->out.domain_name;
set_secrets->realm = join->out.realm;
- set_secrets->account_name = account_name;
set_secrets->netbios_name = netbios_name;
set_secrets->secure_channel_type = SEC_CHAN_BDC;
set_secrets->machine_password = join->out.join_password;
set_secrets->key_version_number = join->out.kvno;
set_secrets->domain_sid = join->out.domain_sid;
- status = provision_store_self_join(ctx, ctx->lp_ctx, ctx->event_ctx, set_secrets, &error_string);
+ status = provision_store_self_join(ctx, s->lp_ctx, ctx->event_ctx, set_secrets, &error_string);
if (!NT_STATUS_IS_OK(status)) {
r->out.error_string = talloc_steal(mem_ctx, error_string);
talloc_free(s);
return status;
}
- r->out.domain_name = talloc_steal(r, join->out.domain_name);
- r->out.domain_sid = dom_sid_dup(r, join->out.domain_sid);
+ r->out.domain_name = talloc_steal(mem_ctx, join->out.domain_name);
+ r->out.domain_sid = dom_sid_dup(mem_ctx, join->out.domain_sid);
/* commit the transaction now we know the secrets were written
* out properly