diff options
Diffstat (limited to 'source3/libnet/libnet_join.c')
| -rw-r--r-- | source3/libnet/libnet_join.c | 368 |
1 files changed, 258 insertions, 110 deletions
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c index 1df85ebb61..c60f4c9803 100644 --- a/source3/libnet/libnet_join.c +++ b/source3/libnet/libnet_join.c @@ -19,8 +19,7 @@ */ #include "includes.h" -#include "libnet/libnet_join.h" -#include "libnet/libnet_proto.h" +#include "libnet/libnet.h" /**************************************************************** ****************************************************************/ @@ -30,14 +29,14 @@ static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx, const char *format, ...) { va_list args; - char *tmp = NULL; + + if (r->out.error_string) { + return; + } va_start(args, format); - tmp = talloc_vasprintf(mem_ctx, format, args); + r->out.error_string = talloc_vasprintf(mem_ctx, format, args); va_end(args); - - TALLOC_FREE(r->out.error_string); - r->out.error_string = tmp; } /**************************************************************** @@ -48,17 +47,17 @@ static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx, const char *format, ...) { va_list args; - char *tmp = NULL; + + if (r->out.error_string) { + return; + } va_start(args, format); - tmp = talloc_vasprintf(mem_ctx, format, args); + r->out.error_string = talloc_vasprintf(mem_ctx, format, args); va_end(args); - - TALLOC_FREE(r->out.error_string); - r->out.error_string = tmp; } -#ifdef HAVE_LDAP +#ifdef WITH_ADS /**************************************************************** ****************************************************************/ @@ -108,10 +107,6 @@ static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx, { ADS_STATUS status; - if (r->in.ads) { - ads_destroy(&r->in.ads); - } - status = libnet_connect_ads(r->in.domain_name, r->in.domain_name, r->in.dc_name, @@ -135,10 +130,6 @@ static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx, { ADS_STATUS status; - if (r->in.ads) { - ads_destroy(&r->in.ads); - } - status = libnet_connect_ads(r->in.domain_name, r->in.domain_name, r->in.dc_name, @@ -426,8 +417,6 @@ static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx, return ads_gen_mod(r->in.ads, r->out.dn, mods); } -#endif /* HAVE_LDAP */ - /**************************************************************** ****************************************************************/ @@ -437,16 +426,14 @@ static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx, if (!lp_use_kerberos_keytab()) { return true; } -#ifdef HAVE_KRB5 + if (!ads_keytab_create_default(r->in.ads)) { return false; } -#endif /* HAVE_KRB5 */ + return true; } -#ifdef HAVE_KRB5 - /**************************************************************** ****************************************************************/ @@ -461,7 +448,8 @@ static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx, status = ads_domain_func_level(r->in.ads, &domain_func); if (!ADS_ERR_OK(status)) { libnet_join_set_error_string(mem_ctx, r, - "Failed to determine domain functional level!"); + "failed to determine domain functional level: %s", + ads_errstr(status)); return false; } @@ -495,7 +483,51 @@ static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx, return kerberos_secrets_store_des_salt(salt); } -#endif /* HAVE_KRB5 */ +/**************************************************************** +****************************************************************/ + +static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx, + struct libnet_JoinCtx *r) +{ + ADS_STATUS status; + + status = libnet_join_set_machine_spn(mem_ctx, r); + if (!ADS_ERR_OK(status)) { + libnet_join_set_error_string(mem_ctx, r, + "failed to set machine spn: %s", + ads_errstr(status)); + return status; + } + + status = libnet_join_set_os_attributes(mem_ctx, r); + if (!ADS_ERR_OK(status)) { + libnet_join_set_error_string(mem_ctx, r, + "failed to set machine os attributes: %s", + ads_errstr(status)); + return status; + } + + status = libnet_join_set_machine_upn(mem_ctx, r); + if (!ADS_ERR_OK(status)) { + libnet_join_set_error_string(mem_ctx, r, + "failed to set machine upn: %s", + ads_errstr(status)); + return status; + } + + if (!libnet_join_derive_salting_principal(mem_ctx, r)) { + return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); + } + + if (!libnet_join_create_keytab(mem_ctx, r)) { + libnet_join_set_error_string(mem_ctx, r, + "failed to create kerberos keytab"); + return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); + } + + return ADS_SUCCESS; +} +#endif /* WITH_ADS */ /**************************************************************** ****************************************************************/ @@ -630,7 +662,8 @@ static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx, 0xe005000b, &user_pol, &user_rid); if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) { - if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) { + if (!(r->in.join_flags & + WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) { goto done; } } @@ -678,14 +711,13 @@ static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx, memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer)); acb_info |= ACB_PWNOEXP; -#if 0 - if ( dom_type == ND_TYPE_AD ) { + if (r->out.domain_is_ad) { #if !defined(ENCTYPE_ARCFOUR_HMAC) acb_info |= ACB_USE_DES_KEY_ONLY; #endif ;; } -#endif + ZERO_STRUCT(ctr); ZERO_STRUCT(p25); @@ -845,33 +877,48 @@ done: static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r) { WERROR werr; + struct libnet_conf_ctx *ctx; + + werr = libnet_conf_open(r, &ctx); + if (!W_ERROR_IS_OK(werr)) { + goto done; + } if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) { - werr = libnet_conf_set_global_parameter("security", "user"); - W_ERROR_NOT_OK_RETURN(werr); + werr = libnet_conf_set_global_parameter(ctx, "security", "user"); + if (!W_ERROR_IS_OK(werr)) { + goto done; + } - werr = libnet_conf_set_global_parameter("workgroup", + werr = libnet_conf_set_global_parameter(ctx, "workgroup", r->in.domain_name); - return werr; + goto done; } - werr = libnet_conf_set_global_parameter("security", "domain"); - W_ERROR_NOT_OK_RETURN(werr); + werr = libnet_conf_set_global_parameter(ctx, "security", "domain"); + if (!W_ERROR_IS_OK(werr)) { + goto done; + } - werr = libnet_conf_set_global_parameter("workgroup", + werr = libnet_conf_set_global_parameter(ctx, "workgroup", r->out.netbios_domain_name); - W_ERROR_NOT_OK_RETURN(werr); + if (!W_ERROR_IS_OK(werr)) { + goto done; + } if (r->out.domain_is_ad) { - werr = libnet_conf_set_global_parameter("security", "ads"); - W_ERROR_NOT_OK_RETURN(werr); + werr = libnet_conf_set_global_parameter(ctx, "security", "ads"); + if (!W_ERROR_IS_OK(werr)) { + goto done; + } - werr = libnet_conf_set_global_parameter("realm", - r->out.dns_domain_name); - W_ERROR_NOT_OK_RETURN(werr); + werr = libnet_conf_set_global_parameter(ctx, "realm", + r->out.dns_domain_name); } +done: + libnet_conf_close(ctx); return werr; } @@ -881,15 +928,25 @@ static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r) static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r) { WERROR werr = WERR_OK; + struct libnet_conf_ctx *ctx; + + werr = libnet_conf_open(r, &ctx); + if (!W_ERROR_IS_OK(werr)) { + goto done; + } if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) { - werr = libnet_conf_set_global_parameter("security", "user"); - W_ERROR_NOT_OK_RETURN(werr); + werr = libnet_conf_set_global_parameter(ctx, "security", "user"); + if (!W_ERROR_IS_OK(werr)) { + goto done; + } } - libnet_conf_delete_parameter(GLOBAL_NAME, "realm"); + libnet_conf_delete_global_parameter(ctx, "realm"); +done: + libnet_conf_close(ctx); return werr; } @@ -948,6 +1005,58 @@ static WERROR do_UnjoinConfig(struct libnet_UnjoinCtx *r) /**************************************************************** ****************************************************************/ +static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx, + struct libnet_JoinCtx *r) +{ + + if (!r->in.domain_name) { + return WERR_INVALID_PARAM; + } + + if (r->in.modify_config && !lp_include_registry_globals()) { + return WERR_NOT_SUPPORTED; + } + + if (IS_DC) { + return WERR_SETUP_DOMAIN_CONTROLLER; + } + + if (!secrets_init()) { + libnet_join_set_error_string(mem_ctx, r, + "Unable to open secrets database"); + return WERR_CAN_NOT_COMPLETE; + } + + return WERR_OK; +} + +/**************************************************************** +****************************************************************/ + +static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx, + struct libnet_JoinCtx *r) +{ + WERROR werr; + + if (!W_ERROR_IS_OK(r->out.result)) { + return r->out.result; + } + + werr = do_JoinConfig(r); + if (!W_ERROR_IS_OK(werr)) { + return werr; + } + + if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) { + saf_store(r->in.domain_name, r->in.dc_name); + } + + return WERR_OK; +} + +/**************************************************************** +****************************************************************/ + static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r) { if (r->in.ads) { @@ -1022,28 +1131,59 @@ static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx, struct libnet_JoinCtx *r) { NTSTATUS status; -#ifdef HAVE_LDAP +#ifdef WITH_ADS ADS_STATUS ads_status; +#endif /* WITH_ADS */ + + if (!r->in.dc_name) { + struct DS_DOMAIN_CONTROLLER_INFO *info; + status = dsgetdcname(mem_ctx, + NULL, + r->in.domain_name, + NULL, + NULL, + DS_DIRECTORY_SERVICE_REQUIRED | + DS_WRITABLE_REQUIRED | + DS_RETURN_DNS_NAME, + &info); + if (!NT_STATUS_IS_OK(status)) { + libnet_join_set_error_string(mem_ctx, r, + "failed to find DC: %s", + nt_errstr(status)); + return WERR_DOMAIN_CONTROLLER_NOT_FOUND; + } + r->in.dc_name = talloc_strdup(mem_ctx, + info->domain_controller_name); + W_ERROR_HAVE_NO_MEMORY(r->in.dc_name); + } + +#ifdef WITH_ADS if (r->in.account_ou) { + ads_status = libnet_join_connect_ads(mem_ctx, r); if (!ADS_ERR_OK(ads_status)) { - return WERR_GENERAL_FAILURE; + return WERR_DEFAULT_JOIN_REQUIRED; } + ads_status = libnet_join_precreate_machine_acct(mem_ctx, r); if (!ADS_ERR_OK(ads_status)) { libnet_join_set_error_string(mem_ctx, r, "failed to precreate account in ou %s: %s", r->in.account_ou, ads_errstr(ads_status)); - return WERR_GENERAL_FAILURE; + return WERR_DEFAULT_JOIN_REQUIRED; } r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE; } -#endif /* HAVE_LDAP */ +#endif /* WITH_ADS */ + status = libnet_join_joindomain_rpc(mem_ctx, r); if (!NT_STATUS_IS_OK(status)) { + libnet_join_set_error_string(mem_ctx, r, + "failed to join domain over rpc: %s", + nt_errstr(status)); if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) { return WERR_SETUP_ALREADY_JOINED; } @@ -1054,43 +1194,14 @@ static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx, return WERR_SETUP_NOT_JOINED; } -#ifdef HAVE_LDAP - ads_status = libnet_join_set_machine_spn(mem_ctx, r); - if (!ADS_ERR_OK(ads_status)) { - libnet_join_set_error_string(mem_ctx, r, - "failed to set machine spn: %s", - ads_errstr(ads_status)); - return WERR_GENERAL_FAILURE; - } - - ads_status = libnet_join_set_os_attributes(mem_ctx, r); - if (!ADS_ERR_OK(ads_status)) { - libnet_join_set_error_string(mem_ctx, r, - "failed to set machine os attributes: %s", - ads_errstr(ads_status)); - return WERR_GENERAL_FAILURE; - } - - ads_status = libnet_join_set_machine_upn(mem_ctx, r); - if (!ADS_ERR_OK(ads_status)) { - libnet_join_set_error_string(mem_ctx, r, - "failed to set machine upn: %s", - ads_errstr(ads_status)); - return WERR_GENERAL_FAILURE; - } - -#ifdef HAVE_KRB5 - if (!libnet_join_derive_salting_principal(mem_ctx, r)) { - return WERR_GENERAL_FAILURE; - } -#endif /* HAVE_KRB5 */ - -#endif /* HAVE_LDAP */ - if (!libnet_join_create_keytab(mem_ctx, r)) { - libnet_join_set_error_string(mem_ctx, r, - "failed to create kerberos keytab"); - return WERR_GENERAL_FAILURE; +#ifdef WITH_ADS + if (r->out.domain_is_ad) { + ads_status = libnet_join_post_processing_ads(mem_ctx, r); + if (!ADS_ERR_OK(ads_status)) { + return WERR_GENERAL_FAILURE; + } } +#endif /* WITH_ADS */ return WERR_OK; } @@ -1103,30 +1214,23 @@ WERROR libnet_Join(TALLOC_CTX *mem_ctx, { WERROR werr; - if (!r->in.domain_name) { - return WERR_INVALID_PARAM; - } - - if (r->in.modify_config && !lp_include_registry_globals()) { - return WERR_NOT_SUPPORTED; - } - - if (IS_DC) { - return WERR_SETUP_DOMAIN_CONTROLLER; + werr = libnet_join_pre_processing(mem_ctx, r); + if (!W_ERROR_IS_OK(werr)) { + goto done; } if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) { werr = libnet_DomainJoin(mem_ctx, r); if (!W_ERROR_IS_OK(werr)) { - return werr; + goto done; } } - werr = do_JoinConfig(r); + werr = libnet_join_post_processing(mem_ctx, r); if (!W_ERROR_IS_OK(werr)) { - return werr; + goto done; } - + done: return werr; } @@ -1138,6 +1242,29 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx, { NTSTATUS status; + if (!r->in.dc_name) { + struct DS_DOMAIN_CONTROLLER_INFO *info; + status = dsgetdcname(mem_ctx, + NULL, + r->in.domain_name, + NULL, + NULL, + DS_DIRECTORY_SERVICE_REQUIRED | + DS_WRITABLE_REQUIRED | + DS_RETURN_DNS_NAME, + &info); + if (!NT_STATUS_IS_OK(status)) { + libnet_unjoin_set_error_string(mem_ctx, r, + "failed to find DC: %s", + nt_errstr(status)); + return WERR_DOMAIN_CONTROLLER_NOT_FOUND; + } + + r->in.dc_name = talloc_strdup(mem_ctx, + info->domain_controller_name); + W_ERROR_HAVE_NO_MEMORY(r->in.dc_name); + } + status = libnet_join_unjoindomain_rpc(mem_ctx, r); if (!NT_STATUS_IS_OK(status)) { libnet_unjoin_set_error_string(mem_ctx, r, @@ -1149,7 +1276,7 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx, return ntstatus_to_werror(status); } -#ifdef HAVE_LDAP +#ifdef WITH_ADS if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) { ADS_STATUS ads_status; libnet_unjoin_connect_ads(mem_ctx, r); @@ -1160,7 +1287,8 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx, ads_errstr(ads_status)); } } -#endif /* HAVE_LDAP */ +#endif /* WITH_ADS */ + libnet_join_unjoindomain_remove_secrets(mem_ctx, r); return WERR_OK; @@ -1169,27 +1297,47 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx, /**************************************************************** ****************************************************************/ +static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx, + struct libnet_UnjoinCtx *r) +{ + if (r->in.modify_config && !lp_include_registry_globals()) { + return WERR_NOT_SUPPORTED; + } + + if (!secrets_init()) { + libnet_unjoin_set_error_string(mem_ctx, r, + "Unable to open secrets database"); + return WERR_CAN_NOT_COMPLETE; + } + + return WERR_OK; +} + +/**************************************************************** +****************************************************************/ + WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx, struct libnet_UnjoinCtx *r) { WERROR werr; - if (r->in.modify_config && !lp_include_registry_globals()) { - return WERR_NOT_SUPPORTED; + werr = libnet_unjoin_pre_processing(mem_ctx, r); + if (!W_ERROR_IS_OK(werr)) { + goto done; } if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) { werr = libnet_DomainUnjoin(mem_ctx, r); if (!W_ERROR_IS_OK(werr)) { - do_UnjoinConfig(r); - return werr; + goto done; } } werr = do_UnjoinConfig(r); if (!W_ERROR_IS_OK(werr)) { - return werr; + goto done; } + done: return werr; } |