/*++
DOMAIN.CXX
Copyright (C) 1999 Microsoft Corporation, all rights reserved.
DESCRIPTION:
Created, May 21, 1999 by DavidCHR.
CONTENTS: GetComputerRoleInformation
DoItAnyway
--*/
#include "everything.hxx"
extern "C" {
#include "..\keytab2\keytab\ldlib\delegtools.h"
#include <dsgetdc.h>
#include <lm.h>
}
PLDAP GlobalLdap = NULL;
LPWSTR GlobalClientName = NULL;
LPWSTR GlobalDomainSetting = NULL; /* if NULL, we're not doing anything
in the domain. if Nonnull, this
is the DNS domain we want. */
BOOL
ConnectedToDsa( VOID ) {
BOOL ret = ( GlobalLdap != NULL );
LPWSTR TargetComputer = NULL;
DWORD dwErr;
PLDAP pLdap;
if ( !ret ) {
if ( GlobalDomainSetting ) {
PDOMAIN_CONTROLLER_INFOW pDcInfo;
dwErr = DsGetDcNameW( NULL, // computername (don't care)
GlobalDomainSetting,
NULL, // guid (don't care)
NULL, // site (don't care)
DS_DIRECTORY_SERVICE_REQUIRED |
DS_IP_REQUIRED |
DS_ONLY_LDAP_NEEDED,
&pDcInfo );
if ( ERROR_SUCCESS == dwErr ) {
TargetComputer = pDcInfo->DomainControllerName;
DEBUGPRINT( DEBUG_DOMAIN,
( "Found Domain Controller: %ws\n",
TargetComputer ) );
/* Sometimes, inexplicably, DsGetDcName returns
a DC name that starts with "\\\\". It doesn't
seem to happen all the time, so I'll workaround. */
while ( TargetComputer[ 0 ] == L'\\' ) {
TargetComputer++;
DEBUGPRINT( DEBUG_DOMAIN,
( "Changed to %ws...\n",
TargetComputer ) );
/* assert that we were not given a DCname that's just
a bunch of slashes. */
ASSERT( TargetComputer[ 0 ] != L'\0' );
}
/* WASBUG 73940: leaks, but we don't care. it's an app, so
any leaked memory will be short-lived. */
} else {
printf( "Failed to locate a DC for %ws: 0x%x.\n",
GlobalDomainSetting,
dwErr );
return FALSE;
}
}
pLdap = ldap_openW( TargetComputer,
LDAP_PORT );
if ( pLdap ) {
dwErr = ldap_bind_s( pLdap,
NULL,
NULL,
LDAP_AUTH_NEGOTIATE );
if ( LDAP_SUCCESS == dwErr ) {
GlobalLdap = pLdap;
ret = TRUE;
} else {
ldap_unbind( pLdap );
printf( "Ldap bind failed for %ws: 0x%x\n",
TargetComputer ? TargetComputer : L"default DC",
dwErr );
}
} else {
printf( "Ldap open failed for %ws: 0x%x.\n",
TargetComputer ? TargetComputer : L"default DC",
GetLastError() );
}
}
if ( !ret ) {
GlobalLdap = NULL;
}
return ret;
}
NTSTATUS
AssignUnicodeStringToWideString( IN PUNICODE_STRING pString,
OUT LPWSTR *Buffer ) {
LPWSTR p;
p = (LPWSTR) malloc( pString->Length + sizeof( WCHAR ) );
if ( p ) {
memcpy( p,
pString->Buffer,
pString->Length );
p[ pString->Length / sizeof( WCHAR ) ] = L'\0';
*Buffer = p;
return STATUS_SUCCESS;
} else {
printf( "unable to allocate string copy of %wZ.\n",
pString );
return STATUS_NO_MEMORY;
}
}
/*++**************************************************************
NAME: ChooseDomain
specifies to use either the given domain (if Parameter 0 is
nonnull) or the caller's domain.
MODIFIES: the global UserDomain variable (above)
TAKES: Parameters -- ripped from argv
RETURNS: a status code indicating success or failure
LOGGING: printf on failure
CREATED: Apr 23, 1999
LOCKING: none
CALLED BY: main
FREE WITH: n/a -- no resources are allocated
**************************************************************--*/
NTSTATUS
ChooseDomain( LPWSTR *Parameters ) {
NTSTATUS ret = STATUS_UNSUCCESSFUL;
KERB_QUERY_TKT_CACHE_REQUEST TicketRequest = {
KerbRetrieveTicketMessage
};
PKERB_RETRIEVE_TKT_RESPONSE pTicketResponse;
ULONG cbTicketResponse;
if ( Parameters[ 0 ] ) {
GlobalDomainSetting = Parameters[ 0 ];
printf( "Connecting to specified domain %ws...\n",
GlobalDomainSetting );
}
// first, bind to the default DSA for this realm.
if ( TRUE ) { /* 73944: this was ConnectedToDsa(), but we don't
necessarily have to connect to a DSA before
calling the package. */
// now, determine who we are.
ret = CallAuthPackage( &TicketRequest,
sizeof( TicketRequest ),
(PVOID *) &pTicketResponse,
&cbTicketResponse );
if ( NT_SUCCESS( ret ) ) {
/* WASBUG 73946: leaks, but the app doesn't run for more
than a second. "Leaked" memory goes away on exit, so we
don't care. */
if ( !GlobalDomainSetting ) {
/* only set this if we haven't set it ourselves.
The reason being that the specified domain (above)
is NOT the same as this one, which came from the cache. */
AssignUnicodeStringToWideString(
&pTicketResponse->Ticket.DomainName,
&GlobalDomainSetting
);
}
ASSERT( pTicketResponse->Ticket.ClientName->NameCount == 1 );
AssignUnicodeStringToWideString(
&pTicketResponse->Ticket.ClientName->Names[ 0 ],
&GlobalClientName
);
ret = STATUS_SUCCESS;
} else {
printf( "Ticket cache query failed. Error 0x%x\n",
ret );
}
}
if ( NT_SUCCESS( ret ) ) {
ASSERT( GlobalDomainSetting != NULL );
printf( "Using domain %ws.\n",
GlobalDomainSetting );
} else {
printf( "Could not guess user's domain.\n"
" Please specify domain on command line and try again.\n" );
}
return ret;
}
/*++**************************************************************
NAME: GetComputerRoleInformation
Queries the target server for its role information-- basically,
we use this to determine whether the machine is a domain
controller.
MODIFIES: pulRoleData
RETURNS: a status code indicating success or failure
LOGGING:
CREATED: Jan 25, 2000
LOCKING:
CALLED BY: anyone
FREE WITH: n/a -- no resources are allocated
**************************************************************--*/
NTSTATUS
GetComputerRoleInformation( PULONG pulRoleData ) {
NTSTATUS N;
NET_API_STATUS NetStatus;
PSERVER_INFO_101 pServerInfo;
NetStatus = NetServerGetInfo( ServerName, // global.
101, // level
(LPBYTE *) &pServerInfo );
if ( NetStatus != STATUS_SUCCESS ) {
printf( "Cannot determine %ws's Server Role: 0x%x.\n",
ServerName ? ServerName : L"this computer",
NetStatus );
N = STATUS_UNSUCCESSFUL;
} else {
N = STATUS_SUCCESS;
if ( pulRoleData ) *pulRoleData = pServerInfo->sv101_type;
NetApiBufferFree( pServerInfo );
}
return N;
}
/*++**************************************************************
NAME: DoItAnyway
prompts the user-- "Do it anyway?"
MODIFIES: nothing
RETURNS: TRUE if the user decided to do it anyway
FALSE if the user decided to abort.
CREATED: Jan 25, 2000
CALLED BY: anyone (most notably SetDnsDomain)
FREE WITH: n/a -- no resources are allocated
**************************************************************--*/
BOOL
DoItAnyway( VOID ) {
int Response;
while ( TRUE ) {
printf( "Do it anyway [y/n]? " );
Response = '\0';
do {
Response = getchar();
} while ( isspace( Response ) );
switch( Response ) {
case 'Y':
case 'y':
return TRUE;
break;
case 'N':
case 'n':
return FALSE;
break;
case EOF:
printf( "EOF at console. Assuming no.\n" );
return FALSE;
break;
default:
printf( "[unknown: %02x '%c']\n",
Response,
Response );
break;
}
}
// NOTREACHED
}
NTSTATUS
SetDnsDomain( LPWSTR * Parameter)
{
NTSTATUS Status;
POLICY_DNS_DOMAIN_INFO DnsDomainInformation = {0};
LPSTR Description;
ULONG Index, Role;
BOOL PromptTheUser = FALSE;
LPWSTR Arg;
//
// If no parameter is passed, prepare to unjoin from all domains/realms.
// Print a scary message, but don't give the user a chance to abort.
//
if( Parameter[0] == NULL )
{
Arg = L"WORKGROUP";
fprintf( stderr, "No parameter to /SetRealm - unjoining computer from all domains/realms.\n" );
}
else
{
Arg = Parameter[0];
}
if( !CheckUppercase( Arg ) )
{
return STATUS_UNSUCCESSFUL;
}
/* 453781: don't fiddle with DNS domain information if the
machine is a Domain Controller -- results in a dead machine. */
Status = GetComputerRoleInformation( &Role );
if ( !NT_SUCCESS( Status ) ) {
Description = "Cannot verify. If %ws is a domain controller, ";
PromptTheUser = TRUE;
goto WarnMe;
} else if ( Role & ( SV_TYPE_DOMAIN_CTRL |
SV_TYPE_DOMAIN_BAKCTRL ) ) {
Description = "%ws is a domain controller-- ";
WarnMe:
printf( "*** WARNING! ***\n" );
printf( Description,
ServerName ? ServerName : L"this computer" );
printf( "resetting its\n"
"DNS Domain Information may render it unusable.\n" );
if ( !PromptTheUser ) {
printf( "This operation is not supported.\n" );
return EPT_NT_CANT_PERFORM_OP; // cannot perform.
} else if ( !DoItAnyway() ) {
return Status;
}
}
Status = STATUS_SUCCESS; // by default
printf("Setting Dns Domain\n");
//
// set the netbios name to be the portion before the first '.' and
// truncate to 14 characters
//
RtlInitUnicodeString(
&DnsDomainInformation.Name,
Arg
);
for (Index = 0; Index < DnsDomainInformation.Name.Length/sizeof(WCHAR) ; Index++ )
{
if (DnsDomainInformation.Name.Buffer[Index] == L'.')
{
DnsDomainInformation.Name.Length = (USHORT) (Index * sizeof(WCHAR));
break;
}
}
if (DnsDomainInformation.Name.Length > DNLEN * sizeof(WCHAR))
{
DnsDomainInformation.Name.Length = DNLEN * sizeof(WCHAR);
}
RtlInitUnicodeString(
&DnsDomainInformation.DnsDomainName,
Arg
);
Status = LsaSetInformationPolicy(
LsaHandle,
PolicyDnsDomainInformation,
(PVOID) &DnsDomainInformation
);
if (!NT_SUCCESS(Status))
{
printf("Failed to set dns domain info: 0x%x\n",Status);
return(Status);
}
//
// Set the value in tcpip
//
if (!SetComputerNameEx(
ComputerNamePhysicalDnsDomain,
Arg))
{
printf("Failed to update host dns domain: %d (0x%x) \n",
GetLastError(), GetLastError() );
return(STATUS_UNSUCCESSFUL);
}
return(Status);
}
BOOL CheckUppercase( LPWSTR wszRealmName )
{
PWCHAR c = wszRealmName;
while( *c != L'\0' )
{
if( iswalpha(*c) && !iswupper(*c) )
{
fprintf( stderr, "Your realm name \"%ws\" has lowercase letters.\nTraditionally, Kerberos Realms are in UPPERCASE. Please verify.\n", wszRealmName );
if( DoItAnyway() )
{
return TRUE;
}
else
{
return FALSE;
}
}
c++;
}
return TRUE;
}