From 0d1179d5c3585678e6b4097425a4137b8666d333 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Thu, 8 Aug 2019 14:35:38 +0200
Subject: [PATCH 01/11] testprogs: Fix failure count in test_net_ads.sh
There are missing ` at the end of the line.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13884
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 320b5be4dce95d8dac4b3c0847faf5b730754a37)
---
testprogs/blackbox/test_net_ads.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh
index d3c4de5b741..512aa9d2952 100755
--- a/testprogs/blackbox/test_net_ads.sh
+++ b/testprogs/blackbox/test_net_ads.sh
@@ -141,10 +141,10 @@ testit "test spn service doensn't exist in AD but is present in keytab file afte
# SPN parser is very basic but does detect some illegal combination
windows_spn="$spn_service/$spn_host:"
-testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing port" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1
+testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing port" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1`
windows_spn="$spn_service/$spn_host/"
-testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing servicename" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1
+testit_expect_failure "test (dedicated keytab) fail to parse windows spn with missing servicename" $VALGRIND $net_tool ads keytab add $windows_spn -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1`
testit "changetrustpw (dedicated keytab)" $VALGRIND $net_tool ads changetrustpw || failed=`expr $failed + 1`
--
2.23.0
From 5acc6ededece33202fe3aa26cb9de9c052e32ba2 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Tue, 13 Aug 2019 17:06:58 +0200
Subject: [PATCH 02/11] s3:libads: Use ldap_add_ext_s() in ads_gen_add()
ldap_add_s() is marked as deprecated.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 456322a61319a10aaedda5244488ea4e5aa5cb64)
---
source3/libads/ldap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 8d13a7cf18c..d409d4ab78e 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -1596,7 +1596,7 @@ ADS_STATUS ads_gen_add(ADS_STRUCT *ads, const char *new_dn, ADS_MODLIST mods)
/* make sure the end of the list is NULL */
mods[i] = NULL;
- ret = ldap_add_s(ads->ldap.ld, utf8_dn, (LDAPMod**)mods);
+ ret = ldap_add_ext_s(ads->ldap.ld, utf8_dn, (LDAPMod**)mods, NULL, NULL);
ads_print_error(ret, ads->ldap.ld);
TALLOC_FREE(utf8_dn);
return ADS_ERROR(ret);
--
2.23.0
From 17d370a97ee2c7e6359aafc0248efae90c654857 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Tue, 13 Aug 2019 17:41:40 +0200
Subject: [PATCH 03/11] s3:libnet: Require sealed LDAP SASL connections for
joining
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit b84abb3a46211dc84e52ef95750627e4dd081f2f)
---
libgpo/pygpo.c | 2 +-
source3/lib/netapi/joindomain.c | 5 ++++-
source3/libads/ads_proto.h | 9 ++++++++-
source3/libads/ads_struct.c | 14 +++++++++++++-
source3/libads/ldap.c | 4 ++--
source3/libnet/libnet_join.c | 3 ++-
source3/libsmb/namequery_dc.c | 2 +-
source3/printing/nt_printing_ads.c | 6 +++---
source3/utils/net_ads.c | 13 +++++++++----
source3/winbindd/winbindd_ads.c | 5 ++++-
source3/winbindd/winbindd_cm.c | 5 ++++-
11 files changed, 51 insertions(+), 17 deletions(-)
diff --git a/libgpo/pygpo.c b/libgpo/pygpo.c
index cd107318860..4db8cad7ca4 100644
--- a/libgpo/pygpo.c
+++ b/libgpo/pygpo.c
@@ -212,7 +212,7 @@ static int py_ads_init(ADS *self, PyObject *args, PyObject *kwds)
return -1;
}
- self->ads_ptr = ads_init(realm, workgroup, ldap_server);
+ self->ads_ptr = ads_init(realm, workgroup, ldap_server, ADS_SASL_PLAIN);
if (self->ads_ptr == NULL) {
return -1;
}
diff --git a/source3/lib/netapi/joindomain.c b/source3/lib/netapi/joindomain.c
index ff2154ba803..8d0752f4531 100644
--- a/source3/lib/netapi/joindomain.c
+++ b/source3/lib/netapi/joindomain.c
@@ -411,7 +411,10 @@ WERROR NetGetJoinableOUs_l(struct libnetapi_ctx *ctx,
dc = strip_hostname(info->dc_unc);
- ads = ads_init(info->domain_name, info->domain_name, dc);
+ ads = ads_init(info->domain_name,
+ info->domain_name,
+ dc,
+ ADS_SASL_PLAIN);
if (!ads) {
return WERR_GEN_FAILURE;
}
diff --git a/source3/libads/ads_proto.h b/source3/libads/ads_proto.h
index 154bf67f964..92bb3a22cdb 100644
--- a/source3/libads/ads_proto.h
+++ b/source3/libads/ads_proto.h
@@ -32,6 +32,12 @@
#ifndef _LIBADS_ADS_PROTO_H_
#define _LIBADS_ADS_PROTO_H_
+enum ads_sasl_state_e {
+ ADS_SASL_PLAIN = 0,
+ ADS_SASL_SIGN,
+ ADS_SASL_SEAL,
+};
+
/* The following definitions come from libads/ads_struct.c */
char *ads_build_path(const char *realm, const char *sep, const char *field, int reverse);
@@ -39,7 +45,8 @@ char *ads_build_dn(const char *realm);
char *ads_build_domain(const char *dn);
ADS_STRUCT *ads_init(const char *realm,
const char *workgroup,
- const char *ldap_server);
+ const char *ldap_server,
+ enum ads_sasl_state_e sasl_state);
bool ads_set_sasl_wrap_flags(ADS_STRUCT *ads, int flags);
void ads_destroy(ADS_STRUCT **ads);
diff --git a/source3/libads/ads_struct.c b/source3/libads/ads_struct.c
index 3ab682c0e38..043a1b21247 100644
--- a/source3/libads/ads_struct.c
+++ b/source3/libads/ads_struct.c
@@ -132,7 +132,8 @@ char *ads_build_domain(const char *dn)
*/
ADS_STRUCT *ads_init(const char *realm,
const char *workgroup,
- const char *ldap_server)
+ const char *ldap_server,
+ enum ads_sasl_state_e sasl_state)
{
ADS_STRUCT *ads;
int wrap_flags;
@@ -152,6 +153,17 @@ ADS_STRUCT *ads_init(const char *realm,
wrap_flags = 0;
}
+ switch (sasl_state) {
+ case ADS_SASL_PLAIN:
+ break;
+ case ADS_SASL_SIGN:
+ wrap_flags |= ADS_AUTH_SASL_SIGN;
+ break;
+ case ADS_SASL_SEAL:
+ wrap_flags |= ADS_AUTH_SASL_SEAL;
+ break;
+ }
+
ads->auth.flags = wrap_flags;
/* Start with the configured page size when the connection is new,
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index d409d4ab78e..7bdda4b1768 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -2964,7 +2964,7 @@ ADS_STATUS ads_current_time(ADS_STRUCT *ads)
if ( !ads->ldap.ld ) {
if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup,
- ads->server.ldap_server )) == NULL )
+ ads->server.ldap_server, ADS_SASL_PLAIN )) == NULL )
{
status = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
@@ -3026,7 +3026,7 @@ ADS_STATUS ads_domain_func_level(ADS_STRUCT *ads, uint32_t *val)
if ( !ads->ldap.ld ) {
if ( (ads_s = ads_init( ads->server.realm, ads->server.workgroup,
- ads->server.ldap_server )) == NULL )
+ ads->server.ldap_server, ADS_SASL_PLAIN )) == NULL )
{
status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
goto done;
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index b876d7ea89f..a512afc238a 100644
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -140,7 +140,8 @@ static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
my_ads = ads_init(dns_domain_name,
netbios_domain_name,
- dc_name);
+ dc_name,
+ ADS_SASL_SEAL);
if (!my_ads) {
return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
}
diff --git a/source3/libsmb/namequery_dc.c b/source3/libsmb/namequery_dc.c
index 4ee5b5278e4..f63dde61603 100644
--- a/source3/libsmb/namequery_dc.c
+++ b/source3/libsmb/namequery_dc.c
@@ -69,7 +69,7 @@ static bool ads_dc_name(const char *domain,
/* Try this 3 times then give up. */
for( i =0 ; i < 3; i++) {
- ads = ads_init(realm, domain, NULL);
+ ads = ads_init(realm, domain, NULL, ADS_SASL_PLAIN);
if (!ads) {
TALLOC_FREE(sitename);
return False;
diff --git a/source3/printing/nt_printing_ads.c b/source3/printing/nt_printing_ads.c
index 2588e1de7e7..a82f1361fc8 100644
--- a/source3/printing/nt_printing_ads.c
+++ b/source3/printing/nt_printing_ads.c
@@ -227,7 +227,7 @@ WERROR nt_printer_guid_retrieve(TALLOC_CTX *mem_ctx, const char *printer,
return WERR_NOT_ENOUGH_MEMORY;
}
- ads = ads_init(lp_realm(), lp_workgroup(), NULL);
+ ads = ads_init(lp_realm(), lp_workgroup(), NULL, ADS_SASL_PLAIN);
if (ads == NULL) {
result = WERR_RPC_S_SERVER_UNAVAILABLE;
goto out;
@@ -577,7 +577,7 @@ WERROR nt_printer_publish(TALLOC_CTX *mem_ctx,
TALLOC_FREE(sinfo2);
- ads = ads_init(lp_realm(), lp_workgroup(), NULL);
+ ads = ads_init(lp_realm(), lp_workgroup(), NULL, ADS_SASL_PLAIN);
if (!ads) {
DEBUG(3, ("ads_init() failed\n"));
win_rc = WERR_RPC_S_SERVER_UNAVAILABLE;
@@ -633,7 +633,7 @@ WERROR check_published_printers(struct messaging_context *msg_ctx)
tmp_ctx = talloc_new(NULL);
if (!tmp_ctx) return WERR_NOT_ENOUGH_MEMORY;
- ads = ads_init(lp_realm(), lp_workgroup(), NULL);
+ ads = ads_init(lp_realm(), lp_workgroup(), NULL, ADS_SASL_PLAIN);
if (!ads) {
DEBUG(3, ("ads_init() failed\n"));
return WERR_RPC_S_SERVER_UNAVAILABLE;
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index d33031a0dbd..07a22098fb1 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -620,7 +620,10 @@ retry_connect:
realm = assume_own_realm(c);
}
- ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
+ ads = ads_init(realm,
+ c->opt_target_workgroup,
+ c->opt_host,
+ ADS_SASL_PLAIN);
if (!c->opt_user_name) {
c->opt_user_name = "administrator";
@@ -729,7 +732,8 @@ static int net_ads_check_int(const char *realm, const char *workgroup, const cha
ADS_STRUCT *ads;
ADS_STATUS status;
- if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
+ ads = ads_init(realm, workgroup, host, ADS_SASL_PLAIN);
+ if (ads == NULL ) {
return -1;
}
@@ -1764,7 +1768,7 @@ static void _net_ads_join_dns_updates(struct net_context *c, TALLOC_CTX *ctx, st
* kinit with the machine password to do dns update.
*/
- ads_dns = ads_init(lp_realm(), NULL, r->in.dc_name);
+ ads_dns = ads_init(lp_realm(), NULL, r->in.dc_name, ADS_SASL_PLAIN);
if (ads_dns == NULL) {
d_fprintf(stderr, _("DNS update failed: out of memory!\n"));
@@ -2654,7 +2658,8 @@ static int net_ads_password(struct net_context *c, int argc, const char **argv)
/* use the realm so we can eventually change passwords for users
in realms other than default */
- if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
+ ads = ads_init(realm, c->opt_workgroup, c->opt_host, ADS_SASL_PLAIN);
+ if (ads == NULL) {
return -1;
}
diff --git a/source3/winbindd/winbindd_ads.c b/source3/winbindd/winbindd_ads.c
index 922ca43764b..556b4523866 100644
--- a/source3/winbindd/winbindd_ads.c
+++ b/source3/winbindd/winbindd_ads.c
@@ -110,7 +110,10 @@ static ADS_STATUS ads_cached_connection_connect(ADS_STRUCT **adsp,
/* we don't want this to affect the users ccache */
setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
- ads = ads_init(target_realm, target_dom_name, ldap_server);
+ ads = ads_init(target_realm,
+ target_dom_name,
+ ldap_server,
+ ADS_SASL_SEAL);
if (!ads) {
DEBUG(1,("ads_init for domain %s failed\n", target_dom_name));
return ADS_ERROR(LDAP_NO_MEMORY);
diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index 22d3dcaa92b..4bd03ed8b7a 100644
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -1414,7 +1414,10 @@ static bool dcip_check_name(TALLOC_CTX *mem_ctx,
print_sockaddr(addr, sizeof(addr), pss);
- ads = ads_init(domain->alt_name, domain->name, addr);
+ ads = ads_init(domain->alt_name,
+ domain->name,
+ addr,
+ ADS_SASL_PLAIN);
ads->auth.flags |= ADS_AUTH_NO_BIND;
ads->config.flags |= request_flags;
ads->server.no_fallback = true;
--
2.23.0
From 244ecd7d839340858e96d75118548942b44bbd5c Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Tue, 13 Aug 2019 16:30:07 +0200
Subject: [PATCH 04/11] s3:libads: Cleanup error code paths in
ads_create_machine_acct()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 8ed993789f93624b7b60dd5314fe5472e69e903a)
---
source3/libads/ldap.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 7bdda4b1768..e492d0688a5 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -2092,11 +2092,12 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
uint32_t etype_list)
{
ADS_STATUS ret;
- char *samAccountName, *controlstr;
- TALLOC_CTX *ctx;
+ char *samAccountName = NULL;
+ char *controlstr = NULL;
+ TALLOC_CTX *ctx = NULL;
ADS_MODLIST mods;
char *machine_escaped = NULL;
- char *new_dn;
+ char *new_dn = NULL;
const char *objectClass[] = {"top", "person", "organizationalPerson",
"user", "computer", NULL};
LDAPMessage *res = NULL;
@@ -2110,13 +2111,14 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
return ret;
}
- if (!(ctx = talloc_init("ads_add_machine_acct")))
+ ctx = talloc_init("ads_add_machine_acct");
+ if (ctx == NULL) {
return ADS_ERROR(LDAP_NO_MEMORY);
-
- ret = ADS_ERROR(LDAP_NO_MEMORY);
+ }
machine_escaped = escape_rdn_val_string_alloc(machine_name);
- if (!machine_escaped) {
+ if (machine_escaped == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
@@ -2131,17 +2133,26 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
ads_msgfree(ads, res);
new_dn = talloc_asprintf(ctx, "cn=%s,%s", machine_escaped, org_unit);
- samAccountName = talloc_asprintf(ctx, "%s$", machine_name);
+ if (new_dn == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
- if ( !new_dn || !samAccountName ) {
+ samAccountName = talloc_asprintf(ctx, "%s$", machine_name);
+ if (samAccountName == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
- if (!(controlstr = talloc_asprintf(ctx, "%u", acct_control))) {
+ controlstr = talloc_asprintf(ctx, "%u", acct_control);
+ if (controlstr == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
- if (!(mods = ads_init_mods(ctx))) {
+ mods = ads_init_mods(ctx);
+ if (mods == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
@@ -2155,6 +2166,7 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
etype_list_str = talloc_asprintf(ctx, "%d", (int)etype_list);
if (etype_list_str == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
ads_mod_str(ctx, &mods, "msDS-SupportedEncryptionTypes",
--
2.23.0
From 8d0e49716b7039fee4785186c67de774b34bd85b Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Wed, 21 Aug 2019 12:22:32 +0200
Subject: [PATCH 05/11] s3:libads: Use a talloc_asprintf in
ads_find_machine_acct()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 35f3e4aed1f1c2ba1c8dc50921f238937f343357)
---
source3/libads/ldap.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index e492d0688a5..3bc9a2a06aa 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -1367,18 +1367,22 @@ char *ads_parent_dn(const char *dn)
ADS_STATUS status;
char *expr;
const char *attrs[] = {"*", "msDS-SupportedEncryptionTypes", "nTSecurityDescriptor", NULL};
+ TALLOC_CTX *frame = talloc_stackframe();
*res = NULL;
/* the easiest way to find a machine account anywhere in the tree
is to look for hostname$ */
- if (asprintf(&expr, "(samAccountName=%s$)", machine) == -1) {
- DEBUG(1, ("asprintf failed!\n"));
- return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+ expr = talloc_asprintf(frame, "(samAccountName=%s$)", machine);
+ if (expr == NULL) {
+ status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+ goto done;
}
status = ads_search(ads, res, expr, attrs);
- SAFE_FREE(expr);
+
+done:
+ TALLOC_FREE(frame);
return status;
}
--
2.23.0
From be247641382d1cc730ab5cd1e8bebe92e1d3a6fc Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Wed, 14 Aug 2019 13:01:19 +0200
Subject: [PATCH 06/11] s3:libads: Fix detection if acount already exists in
ads_find_machine_count()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 4f389c1f78cdc2424795e3b2a1ce43818c400c2d)
---
source3/libads/ldap.c | 36 ++++++++++++++++++++++++++++--------
1 file changed, 28 insertions(+), 8 deletions(-)
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 3bc9a2a06aa..ec6ad61a55c 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -1366,7 +1366,21 @@ char *ads_parent_dn(const char *dn)
{
ADS_STATUS status;
char *expr;
- const char *attrs[] = {"*", "msDS-SupportedEncryptionTypes", "nTSecurityDescriptor", NULL};
+ const char *attrs[] = {
+ /* This is how Windows checks for machine accounts */
+ "objectClass",
+ "SamAccountName",
+ "userAccountControl",
+ "DnsHostName",
+ "ServicePrincipalName",
+ "unicodePwd",
+
+ /* Additional attributes Samba checks */
+ "msDS-SupportedEncryptionTypes",
+ "nTSecurityDescriptor",
+
+ NULL
+ };
TALLOC_CTX *frame = talloc_stackframe();
*res = NULL;
@@ -1380,6 +1394,11 @@ char *ads_parent_dn(const char *dn)
}
status = ads_search(ads, res, expr, attrs);
+ if (ADS_ERR_OK(status)) {
+ if (ads_count_replies(ads, *res) != 1) {
+ status = ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
+ }
+ }
done:
TALLOC_FREE(frame);
@@ -1867,11 +1886,11 @@ ADS_STATUS ads_clear_service_principal_names(ADS_STRUCT *ads, const char *machin
char *dn_string = NULL;
ret = ads_find_machine_acct(ads, &res, machine_name);
- if (!ADS_ERR_OK(ret) || ads_count_replies(ads, res) != 1) {
+ if (!ADS_ERR_OK(ret)) {
DEBUG(5,("ads_clear_service_principal_names: WARNING: Host Account for %s not found... skipping operation.\n", machine_name));
DEBUG(5,("ads_clear_service_principal_names: WARNING: Service Principals for %s have NOT been cleared.\n", machine_name));
ads_msgfree(ads, res);
- return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
+ return ret;
}
DEBUG(5,("ads_clear_service_principal_names: Host account for %s found\n", machine_name));
@@ -2027,12 +2046,12 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads,
const char **servicePrincipalName = spns;
ret = ads_find_machine_acct(ads, &res, machine_name);
- if (!ADS_ERR_OK(ret) || ads_count_replies(ads, res) != 1) {
+ if (!ADS_ERR_OK(ret)) {
DEBUG(1,("ads_add_service_principal_name: WARNING: Host Account for %s not found... skipping operation.\n",
machine_name));
DEBUG(1,("ads_add_service_principal_name: WARNING: Service Principals have NOT been added.\n"));
ads_msgfree(ads, res);
- return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
+ return ret;
}
DEBUG(1,("ads_add_service_principal_name: Host account for %s found\n", machine_name));
@@ -2127,7 +2146,7 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
}
ret = ads_find_machine_acct(ads, &res, machine_escaped);
- if (ADS_ERR_OK(ret) && ads_count_replies(ads, res) == 1) {
+ if (ADS_ERR_OK(ret)) {
DBG_DEBUG("Host account for %s already exists.\n",
machine_escaped);
ret = ADS_ERROR_LDAP(LDAP_ALREADY_EXISTS);
@@ -3684,14 +3703,15 @@ ADS_STATUS ads_leave_realm(ADS_STRUCT *ads, const char *hostname)
TALLOC_FREE(hostnameDN);
status = ads_find_machine_acct(ads, &res, host);
- if (ADS_ERR_OK(status) && ads_count_replies(ads, res) == 1) {
+ if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
+ (status.err.rc != LDAP_NO_SUCH_OBJECT)) {
DEBUG(3, ("Failed to remove host account.\n"));
SAFE_FREE(host);
return status;
}
SAFE_FREE(host);
- return status;
+ return ADS_SUCCESS;
}
/**
--
2.23.0
From d7485cee3652a91ac199f912d656713cf1ddafa9 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Wed, 14 Aug 2019 12:17:20 +0200
Subject: [PATCH 07/11] s3:libads: Don't set supported encryption types during
account creation
This is already handled by libnet_join_post_processing_ads_modify()
which calls libnet_join_set_etypes() if encrytion types should be set.
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit b755a6438022579dab1a403c81d60b1ed7efca38)
---
source3/libads/ldap.c | 18 ------------------
1 file changed, 18 deletions(-)
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index ec6ad61a55c..8fbd97e25e2 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -2127,12 +2127,6 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
uint32_t acct_control = ( UF_WORKSTATION_TRUST_ACCOUNT |\
UF_DONT_EXPIRE_PASSWD |\
UF_ACCOUNTDISABLE );
- uint32_t func_level = 0;
-
- ret = ads_domain_func_level(ads, &func_level);
- if (!ADS_ERR_OK(ret)) {
- return ret;
- }
ctx = talloc_init("ads_add_machine_acct");
if (ctx == NULL) {
@@ -2184,18 +2178,6 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
ads_mod_strlist(ctx, &mods, "objectClass", objectClass);
ads_mod_str(ctx, &mods, "userAccountControl", controlstr);
- if (func_level >= DS_DOMAIN_FUNCTION_2008) {
- const char *etype_list_str;
-
- etype_list_str = talloc_asprintf(ctx, "%d", (int)etype_list);
- if (etype_list_str == NULL) {
- ret = ADS_ERROR(LDAP_NO_MEMORY);
- goto done;
- }
- ads_mod_str(ctx, &mods, "msDS-SupportedEncryptionTypes",
- etype_list_str);
- }
-
ret = ads_gen_add(ads, new_dn, mods);
done:
--
2.23.0
From f8f7158ac639c516e6dcdeca9d41b94ba6d06134 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Tue, 13 Aug 2019 16:34:34 +0200
Subject: [PATCH 08/11] s3:libads: Fix creating machine account using LDAP
This implements the same behaviour as Windows.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13884
Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit ce7762935051c862ecdd3e82d93096aac61dd292)
---
source3/libads/ads_proto.h | 4 +-
source3/libads/ldap.c | 118 +++++++++++++++++++++++++++++++----
source3/libnet/libnet_join.c | 23 ++++---
3 files changed, 124 insertions(+), 21 deletions(-)
diff --git a/source3/libads/ads_proto.h b/source3/libads/ads_proto.h
index 92bb3a22cdb..495ef5d3325 100644
--- a/source3/libads/ads_proto.h
+++ b/source3/libads/ads_proto.h
@@ -114,8 +114,10 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads, const char *machine_
const char **spns);
ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
const char *machine_name,
+ const char *machine_password,
const char *org_unit,
- uint32_t etype_list);
+ uint32_t etype_list,
+ const char *dns_domain_name);
ADS_STATUS ads_move_machine_acct(ADS_STRUCT *ads, const char *machine_name,
const char *org_unit, bool *moved);
int ads_count_replies(ADS_STRUCT *ads, void *res);
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 8fbd97e25e2..81efda0cf30 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -1516,7 +1516,6 @@ ADS_STATUS ads_mod_strlist(TALLOC_CTX *ctx, ADS_MODLIST *mods,
name, (const void **) vals);
}
-#if 0
/**
* Add a single ber-encoded value to a mod list
* @param ctx An initialized TALLOC_CTX
@@ -1537,7 +1536,6 @@ static ADS_STATUS ads_mod_ber(TALLOC_CTX *ctx, ADS_MODLIST *mods,
return ads_modlist_add(ctx, mods, LDAP_MOD_REPLACE|LDAP_MOD_BVALUES,
name, (const void **) values);
}
-#endif
static void ads_print_error(int ret, LDAP *ld)
{
@@ -2111,8 +2109,10 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads,
ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
const char *machine_name,
+ const char *machine_password,
const char *org_unit,
- uint32_t etype_list)
+ uint32_t etype_list,
+ const char *dns_domain_name)
{
ADS_STATUS ret;
char *samAccountName = NULL;
@@ -2120,13 +2120,23 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
TALLOC_CTX *ctx = NULL;
ADS_MODLIST mods;
char *machine_escaped = NULL;
+ char *dns_hostname = NULL;
char *new_dn = NULL;
- const char *objectClass[] = {"top", "person", "organizationalPerson",
- "user", "computer", NULL};
+ char *utf8_pw = NULL;
+ size_t utf8_pw_len = 0;
+ char *utf16_pw = NULL;
+ size_t utf16_pw_len = 0;
+ struct berval machine_pw_val;
+ bool ok;
+ const char **spn_array = NULL;
+ size_t num_spns = 0;
+ const char *spn_prefix[] = {
+ "HOST",
+ "RestrictedKrbHost",
+ };
+ size_t i;
LDAPMessage *res = NULL;
- uint32_t acct_control = ( UF_WORKSTATION_TRUST_ACCOUNT |\
- UF_DONT_EXPIRE_PASSWD |\
- UF_ACCOUNTDISABLE );
+ uint32_t acct_control = UF_WORKSTATION_TRUST_ACCOUNT;
ctx = talloc_init("ads_add_machine_acct");
if (ctx == NULL) {
@@ -2139,10 +2149,9 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
goto done;
}
+ /* Check if the machine account already exists. */
ret = ads_find_machine_acct(ads, &res, machine_escaped);
if (ADS_ERR_OK(ret)) {
- DBG_DEBUG("Host account for %s already exists.\n",
- machine_escaped);
ret = ADS_ERROR_LDAP(LDAP_ALREADY_EXISTS);
ads_msgfree(ads, res);
goto done;
@@ -2155,28 +2164,111 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
goto done;
}
+ /* Create machine account */
+
samAccountName = talloc_asprintf(ctx, "%s$", machine_name);
if (samAccountName == NULL) {
ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
+ dns_hostname = talloc_asprintf(ctx,
+ "%s.%s",
+ machine_name,
+ dns_domain_name);
+ if (dns_hostname == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ /* Add dns_hostname SPNs */
+ for (i = 0; i < ARRAY_SIZE(spn_prefix); i++) {
+ char *spn = talloc_asprintf(ctx,
+ "%s/%s",
+ spn_prefix[i],
+ dns_hostname);
+ if (spn == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ ok = add_string_to_array(spn_array,
+ spn,
+ &spn_array,
+ &num_spns);
+ if (!ok) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+ }
+
+ /* Add machine_name SPNs */
+ for (i = 0; i < ARRAY_SIZE(spn_prefix); i++) {
+ char *spn = talloc_asprintf(ctx,
+ "%s/%s",
+ spn_prefix[i],
+ machine_name);
+ if (spn == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ ok = add_string_to_array(spn_array,
+ spn,
+ &spn_array,
+ &num_spns);
+ if (!ok) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+ }
+
+ /* Make sure to NULL terminate the array */
+ spn_array = talloc_realloc(ctx, spn_array, const char *, num_spns + 1);
+ if (spn_array == NULL) {
+ return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+ }
+ spn_array[num_spns] = NULL;
+
controlstr = talloc_asprintf(ctx, "%u", acct_control);
if (controlstr == NULL) {
ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
+ utf8_pw = talloc_asprintf(ctx, "\"%s\"", machine_password);
+ if (utf8_pw == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+ utf8_pw_len = strlen(utf8_pw);
+
+ ok = convert_string_talloc(ctx,
+ CH_UTF8, CH_UTF16MUNGED,
+ utf8_pw, utf8_pw_len,
+ (void *)&utf16_pw, &utf16_pw_len);
+ if (!ok) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ machine_pw_val = (struct berval) {
+ .bv_val = utf16_pw,
+ .bv_len = utf16_pw_len,
+ };
+
mods = ads_init_mods(ctx);
if (mods == NULL) {
ret = ADS_ERROR(LDAP_NO_MEMORY);
goto done;
}
- ads_mod_str(ctx, &mods, "cn", machine_name);
- ads_mod_str(ctx, &mods, "sAMAccountName", samAccountName);
- ads_mod_strlist(ctx, &mods, "objectClass", objectClass);
+ ads_mod_str(ctx, &mods, "objectClass", "Computer");
+ ads_mod_str(ctx, &mods, "SamAccountName", samAccountName);
ads_mod_str(ctx, &mods, "userAccountControl", controlstr);
+ ads_mod_str(ctx, &mods, "DnsHostName", dns_hostname);
+ ads_mod_strlist(ctx, &mods, "ServicePrincipalName", spn_array);
+ ads_mod_ber(ctx, &mods, "unicodePwd", &machine_pw_val);
ret = ads_gen_add(ads, new_dn, mods);
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index a512afc238a..d5c8599beee 100644
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -338,10 +338,22 @@ static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
/* Attempt to create the machine account and bail if this fails.
Assume that the admin wants exactly what they requested */
+ if (r->in.machine_password == NULL) {
+ r->in.machine_password =
+ trust_pw_new_value(mem_ctx,
+ r->in.secure_channel_type,
+ SEC_ADS);
+ if (r->in.machine_password == NULL) {
+ return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+ }
+ }
+
status = ads_create_machine_acct(r->in.ads,
r->in.machine_name,
+ r->in.machine_password,
r->in.account_ou,
- r->in.desired_encryption_types);
+ r->in.desired_encryption_types,
+ r->out.dns_domain_name);
if (ADS_ERR_OK(status)) {
DEBUG(1,("machine account creation created\n"));
@@ -2668,12 +2680,11 @@ static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
if (ADS_ERR_OK(ads_status)) {
/*
- * LDAP object create succeeded, now go to the rpc
- * password set routines
+ * LDAP object creation succeeded.
*/
-
r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
- goto rpc_join;
+
+ return WERR_OK;
}
if (initial_account_ou != NULL) {
@@ -2687,8 +2698,6 @@ static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
DBG_INFO("Failed to pre-create account in OU %s: %s\n",
r->in.account_ou, ads_errstr(ads_status));
}
- rpc_join:
-
#endif /* HAVE_ADS */
if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
--
2.23.0
From f37eaa71dbd1cb206e8f3bcf251fc42308aa561d Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Wed, 14 Aug 2019 10:15:19 +0200
Subject: [PATCH 09/11] s3:libnet: Improve debug messages
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 39b8c8b30a5d5bd70f8da3a02cf77f7592788b94)
---
source3/libnet/libnet_join.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index d5c8599beee..31d1d221ed3 100644
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -356,7 +356,7 @@ static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
r->out.dns_domain_name);
if (ADS_ERR_OK(status)) {
- DEBUG(1,("machine account creation created\n"));
+ DBG_WARNING("Machine account successfully created\n");
return status;
} else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
(status.err.rc == LDAP_ALREADY_EXISTS)) {
@@ -364,7 +364,7 @@ static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
}
if (!ADS_ERR_OK(status)) {
- DEBUG(1,("machine account creation failed\n"));
+ DBG_WARNING("Failed to create machine account\n");
return status;
}
--
2.23.0
From d590cf9739393e15aa4d9cc86ca56f93db6f1a2b Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Thu, 8 Aug 2019 14:40:04 +0200
Subject: [PATCH 10/11] s3:libads: Just change the machine password if account
already exists
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13884
Pair-Programmed-With: Guenther Deschner <gd@samba.org>
Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 14f320fa1e40ecc3a43dabb0cecd57430270a521)
---
source3/libads/ldap.c | 167 ++++++++++++++++++++++++++++++-----
source3/libnet/libnet_join.c | 1 +
2 files changed, 146 insertions(+), 22 deletions(-)
diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 81efda0cf30..afae46d2e79 100644
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -2098,6 +2098,127 @@ ADS_STATUS ads_add_service_principal_names(ADS_STRUCT *ads,
return ret;
}
+static uint32_t ads_get_acct_ctrl(ADS_STRUCT *ads,
+ LDAPMessage *msg)
+{
+ uint32_t acct_ctrl = 0;
+ bool ok;
+
+ ok = ads_pull_uint32(ads, msg, "userAccountControl", &acct_ctrl);
+ if (!ok) {
+ return 0;
+ }
+
+ return acct_ctrl;
+}
+
+static ADS_STATUS ads_change_machine_acct(ADS_STRUCT *ads,
+ LDAPMessage *msg,
+ const struct berval *machine_pw_val)
+{
+ ADS_MODLIST mods;
+ ADS_STATUS ret;
+ TALLOC_CTX *frame = talloc_stackframe();
+ uint32_t acct_control;
+ char *control_str = NULL;
+ const char *attrs[] = {
+ "objectSid",
+ NULL
+ };
+ LDAPMessage *res = NULL;
+ char *dn = NULL;
+
+ dn = ads_get_dn(ads, frame, msg);
+ if (dn == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ acct_control = ads_get_acct_ctrl(ads, msg);
+ if (acct_control == 0) {
+ ret = ADS_ERROR(LDAP_NO_RESULTS_RETURNED);
+ goto done;
+ }
+
+ /*
+ * Changing the password, disables the account. So we need to change the
+ * userAccountControl flags to enable it again.
+ */
+ mods = ads_init_mods(frame);
+ if (mods == NULL) {
+ ret = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ ads_mod_ber(frame, &mods, "unicodePwd", machine_pw_val);
+
+ ret = ads_gen_mod(ads, dn, mods);
+ if (!ADS_ERR_OK(ret)) {
+ goto done;
+ }
+ TALLOC_FREE(mods);
+
+ /*
+ * To activate the account, we need to disable and enable it.
+ */
+ acct_control |= UF_ACCOUNTDISABLE;
+
+ control_str = talloc_asprintf(frame, "%u", acct_control);
+ if (control_str == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ mods = ads_init_mods(frame);
+ if (mods == NULL) {
+ ret = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ ads_mod_str(frame, &mods, "userAccountControl", control_str);
+
+ ret = ads_gen_mod(ads, dn, mods);
+ if (!ADS_ERR_OK(ret)) {
+ goto done;
+ }
+ TALLOC_FREE(mods);
+ TALLOC_FREE(control_str);
+
+ /*
+ * Enable the account again.
+ */
+ acct_control &= ~UF_ACCOUNTDISABLE;
+
+ control_str = talloc_asprintf(frame, "%u", acct_control);
+ if (control_str == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ mods = ads_init_mods(frame);
+ if (mods == NULL) {
+ ret = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ ads_mod_str(frame, &mods, "userAccountControl", control_str);
+
+ ret = ads_gen_mod(ads, dn, mods);
+ if (!ADS_ERR_OK(ret)) {
+ goto done;
+ }
+ TALLOC_FREE(mods);
+ TALLOC_FREE(control_str);
+
+ ret = ads_search_dn(ads, &res, dn, attrs);
+ ads_msgfree(ads, res);
+
+done:
+ talloc_free(frame);
+
+ return ret;
+}
+
/**
* adds a machine account to the ADS server
* @param ads An intialized ADS_STRUCT
@@ -2149,11 +2270,34 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
goto done;
}
+ utf8_pw = talloc_asprintf(ctx, "\"%s\"", machine_password);
+ if (utf8_pw == NULL) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+ utf8_pw_len = strlen(utf8_pw);
+
+ ok = convert_string_talloc(ctx,
+ CH_UTF8, CH_UTF16MUNGED,
+ utf8_pw, utf8_pw_len,
+ (void *)&utf16_pw, &utf16_pw_len);
+ if (!ok) {
+ ret = ADS_ERROR(LDAP_NO_MEMORY);
+ goto done;
+ }
+
+ machine_pw_val = (struct berval) {
+ .bv_val = utf16_pw,
+ .bv_len = utf16_pw_len,
+ };
+
/* Check if the machine account already exists. */
ret = ads_find_machine_acct(ads, &res, machine_escaped);
if (ADS_ERR_OK(ret)) {
- ret = ADS_ERROR_LDAP(LDAP_ALREADY_EXISTS);
+ /* Change the machine account password */
+ ret = ads_change_machine_acct(ads, res, &machine_pw_val);
ads_msgfree(ads, res);
+
goto done;
}
ads_msgfree(ads, res);
@@ -2236,27 +2380,6 @@ ADS_STATUS ads_create_machine_acct(ADS_STRUCT *ads,
goto done;
}
- utf8_pw = talloc_asprintf(ctx, "\"%s\"", machine_password);
- if (utf8_pw == NULL) {
- ret = ADS_ERROR(LDAP_NO_MEMORY);
- goto done;
- }
- utf8_pw_len = strlen(utf8_pw);
-
- ok = convert_string_talloc(ctx,
- CH_UTF8, CH_UTF16MUNGED,
- utf8_pw, utf8_pw_len,
- (void *)&utf16_pw, &utf16_pw_len);
- if (!ok) {
- ret = ADS_ERROR(LDAP_NO_MEMORY);
- goto done;
- }
-
- machine_pw_val = (struct berval) {
- .bv_val = utf16_pw,
- .bv_len = utf16_pw_len,
- };
-
mods = ads_init_mods(ctx);
if (mods == NULL) {
ret = ADS_ERROR(LDAP_NO_MEMORY);
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index 31d1d221ed3..1052afde641 100644
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -968,6 +968,7 @@ static ADS_STATUS libnet_join_post_processing_ads_modify(TALLOC_CTX *mem_ctx,
if (r->in.ads->auth.ccache_name != NULL) {
ads_kdestroy(r->in.ads->auth.ccache_name);
+ r->in.ads->auth.ccache_name = NULL;
}
ads_destroy(&r->in.ads);
--
2.23.0
From 2209c01f8069d47b47c8fc5df376cc9c41c552e1 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Thu, 22 Aug 2019 16:31:30 +0200
Subject: [PATCH 11/11] testprogs: Add test for 'net ads join createcomputer='
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Oct 9 08:26:17 UTC 2019 on sn-devel-184
(cherry picked from commit 459b43e5776180dc1540cd845b72ff78747ecd6f)
---
testprogs/blackbox/test_net_ads.sh | 32 ++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh
index 512aa9d2952..cc8345c4624 100755
--- a/testprogs/blackbox/test_net_ads.sh
+++ b/testprogs/blackbox/test_net_ads.sh
@@ -31,6 +31,16 @@ if [ -x "$BINDIR/ldbsearch" ]; then
ldbsearch="$BINDIR/ldbsearch"
fi
+ldbadd="ldbadd"
+if [ -x "$BINDIR/ldbadd" ]; then
+ ldbadd="$BINDIR/ldbadd"
+fi
+
+ldbdel="ldbdel"
+if [ -x "$BINDIR/ldbdel" ]; then
+ ldbdel="$BINDIR/ldbdel"
+fi
+
# Load test functions
. `dirname $0`/subunit.sh
@@ -188,8 +198,9 @@ testit "testjoin user+password" $VALGRIND $net_tool ads testjoin -U$DC_USERNAME%
testit "leave+keep_account" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD --keep-account || failed=`expr $failed + 1`
-computers_ldb_ou="CN=Computers,DC=addom,DC=samba,DC=example,DC=com"
-testit "ldb check for existence of machine account" $ldbsearch -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -s base -b "cn=$HOSTNAME,$computers_ldb_ou" || failed=`expr $failed + 1`
+base_dn="DC=addom,DC=samba,DC=example,DC=com"
+computers_dn="CN=Computers,$base_dn"
+testit "ldb check for existence of machine account" $ldbsearch -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -s base -b "cn=$HOSTNAME,$computers_dn" || failed=`expr $failed + 1`
testit "join" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
@@ -198,6 +209,23 @@ testit "testjoin" $VALGRIND $net_tool ads testjoin || failed=`expr $failed + 1`
##Goodbye...
testit "leave" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
+#
+# Test createcomputer option of 'net ads join'
+#
+testit "Create OU=Servers,$base_dn" $VALGRIND $ldbadd -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER <<EOF
+dn: OU=Servers,$base_dn
+objectClass: organizationalUnit
+EOF
+
+testit "join+createcomputer" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD createcomputer=Servers || failed=`expr $failed + 1`
+
+testit "ldb check for existence of machine account in OU=Servers" $ldbsearch -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER.$REALM -s base -b "cn=$HOSTNAME,OU=Servers,$base_dn" || failed=`expr $failed + 1`
+
+## Goodbye...
+testit "leave+createcomputer" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1`
+
+testit "Remove OU=Servers" $VALGRIND $ldbdel -U$DC_USERNAME%$DC_PASSWORD -H ldap://$SERVER "OU=Servers,$base_dn"
+
rm -rf $BASEDIR/$WORKDIR
exit $failed
--
2.23.0