source3/winbindd/winbindd_samr.c

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  *
   4  * Winbind rpc backend functions
   5  *
   6  * Copyright (c) 2000-2003 Tim Potter
   7  * Copyright (c) 2001      Andrew Tridgell
   8  * Copyright (c) 2005      Volker Lendecke
   9  * Copyright (c) 2008      Guenther Deschner (pidl conversion)
  10  * Copyright (c) 2010      Andreas Schneider <asn@samba.org>
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License as published by
  14  * the Free Software Foundation; either version 3 of the License, or
  15  * (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24  */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "winbindd_rpc.h"
  29
  30 #include "../librpc/gen_ndr/cli_samr.h"
  31 #include "rpc_client/cli_samr.h"
  32 #include "../librpc/gen_ndr/srv_samr.h"
  33 #include "../librpc/gen_ndr/cli_lsa.h"
  34 #include "rpc_client/cli_lsarpc.h"
  35 #include "../librpc/gen_ndr/srv_lsa.h"
  36 #include "rpc_server/rpc_ncacn_np.h"
  37 #include "../libcli/security/security.h"
  38
  39 #undef DBGC_CLASS
  40 #define DBGC_CLASS DBGC_WINBIND
  41
  42 static NTSTATUS open_internal_samr_pipe(TALLOC_CTX *mem_ctx,
  43                                         struct rpc_pipe_client **samr_pipe)
  44 {
  45         struct rpc_pipe_client *cli = NULL;
  46         struct auth_serversupplied_info *server_info = NULL;
  47         NTSTATUS status;
  48
  49         if (cli != NULL) {
  50                 goto done;
  51         }
  52
  53         if (server_info == NULL) {
  54                 status = make_server_info_system(mem_ctx, &server_info);
  55                 if (!NT_STATUS_IS_OK(status)) {
  56                         DEBUG(0, ("open_samr_pipe: Could not create auth_serversupplied_info: %s\n",
  57                                   nt_errstr(status)));
  58                         return status;
  59                 }
  60         }
  61
  62         /* create a samr connection */
  63         status = rpc_pipe_open_interface(mem_ctx,
  64                                         &ndr_table_samr.syntax_id,
  65                                         server_info,
  66                                         NULL,
  67                                         winbind_messaging_context(),
  68                                         &cli);
  69         if (!NT_STATUS_IS_OK(status)) {
  70                 DEBUG(0, ("open_samr_pipe: Could not connect to samr_pipe: %s\n",
  71                           nt_errstr(status)));
  72                 return status;
  73         }
  74
  75 done:
  76         if (samr_pipe) {
  77                 *samr_pipe = cli;
  78         }
  79
  80         return NT_STATUS_OK;
  81 }
  82
  83 NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
  84                                  struct winbindd_domain *domain,
  85                                  struct rpc_pipe_client **samr_pipe,
  86                                  struct policy_handle *samr_domain_hnd)
  87 {
  88         NTSTATUS status;
  89         struct policy_handle samr_connect_hnd;
  90
  91         status = open_internal_samr_pipe(mem_ctx, samr_pipe);
  92         if (!NT_STATUS_IS_OK(status)) {
  93                 return status;
  94         }
  95
  96         status = rpccli_samr_Connect2((*samr_pipe),
  97                                       mem_ctx,
  98                                       (*samr_pipe)->desthost,
  99                                       SEC_FLAG_MAXIMUM_ALLOWED,
 100                                       &samr_connect_hnd);
 101         if (!NT_STATUS_IS_OK(status)) {
 102                 return status;
 103         }
 104
 105         status = rpccli_samr_OpenDomain((*samr_pipe),
 106                                         mem_ctx,
 107                                         &samr_connect_hnd,
 108                                         SEC_FLAG_MAXIMUM_ALLOWED,
 109                                         &domain->sid,
 110                                         samr_domain_hnd);
 111
 112         return status;
 113 }
 114
 115 static NTSTATUS open_internal_lsa_pipe(TALLOC_CTX *mem_ctx,
 116                                        struct rpc_pipe_client **lsa_pipe)
 117 {
 118         struct rpc_pipe_client *cli = NULL;
 119         struct auth_serversupplied_info *server_info = NULL;
 120         NTSTATUS status;
 121
 122         if (cli != NULL) {
 123                 goto done;
 124         }
 125
 126         if (server_info == NULL) {
 127                 status = make_server_info_system(mem_ctx, &server_info);
 128                 if (!NT_STATUS_IS_OK(status)) {
 129                         DEBUG(0, ("open_lsa_pipe: Could not create auth_serversupplied_info: %s\n",
 130                                   nt_errstr(status)));
 131                         return status;
 132                 }
 133         }
 134
 135         /* create a samr connection */
 136         status = rpc_pipe_open_interface(mem_ctx,
 137                                         &ndr_table_lsarpc.syntax_id,
 138                                         server_info,
 139                                         NULL,
 140                                         winbind_messaging_context(),
 141                                         &cli);
 142         if (!NT_STATUS_IS_OK(status)) {
 143                 DEBUG(0, ("open_lsa_pipe: Could not connect to lsa_pipe: %s\n",
 144                           nt_errstr(status)));
 145                 return status;
 146         }
 147
 148 done:
 149         if (lsa_pipe) {
 150                 *lsa_pipe = cli;
 151         }
 152
 153         return NT_STATUS_OK;
 154 }
 155
 156 static NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
 157                                        struct rpc_pipe_client **lsa_pipe,
 158                                        struct policy_handle *lsa_hnd)
 159 {
 160         NTSTATUS status;
 161
 162         status = open_internal_lsa_pipe(mem_ctx, lsa_pipe);
 163         if (!NT_STATUS_IS_OK(status)) {
 164                 return status;
 165         }
 166
 167         status = rpccli_lsa_open_policy((*lsa_pipe),
 168                                         mem_ctx,
 169                                         true,
 170                                         SEC_FLAG_MAXIMUM_ALLOWED,
 171                                         lsa_hnd);
 172
 173         return status;
 174 }
 175
 176 /*********************************************************************
 177  SAM specific functions.
 178 *********************************************************************/
 179
 180 /* List all domain groups */
 181 static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 182                                     TALLOC_CTX *mem_ctx,
 183                                     uint32_t *pnum_info,
 184                                     struct acct_info **pinfo)
 185 {
 186         struct rpc_pipe_client *samr_pipe;
 187         struct policy_handle dom_pol;
 188         struct acct_info *info = NULL;
 189         uint32_t num_info = 0;
 190         TALLOC_CTX *tmp_ctx;
 191         NTSTATUS status;
 192
 193         DEBUG(3,("sam_enum_dom_groups\n"));
 194
 195         ZERO_STRUCT(dom_pol);
 196
 197         if (pnum_info) {
 198                 *pnum_info = 0;
 199         }
 200
 201         tmp_ctx = talloc_stackframe();
 202         if (tmp_ctx == NULL) {
 203                 return NT_STATUS_NO_MEMORY;
 204         }
 205
 206         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 207         if (!NT_STATUS_IS_OK(status)) {
 208                 goto error;
 209         }
 210
 211         status = rpc_enum_dom_groups(tmp_ctx,
 212                                      samr_pipe,
 213                                      &dom_pol,
 214                                      &num_info,
 215                                      &info);
 216         if (!NT_STATUS_IS_OK(status)) {
 217                 goto error;
 218         }
 219
 220         if (pnum_info) {
 221                 *pnum_info = num_info;
 222         }
 223
 224         if (pinfo) {
 225                 *pinfo = talloc_move(mem_ctx, &info);
 226         }
 227
 228 error:
 229         if (is_valid_policy_hnd(&dom_pol)) {
 230                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 231         }
 232         TALLOC_FREE(tmp_ctx);
 233         return status;
 234 }
 235
 236 /* Query display info for a domain */
 237 static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 238                                     TALLOC_CTX *mem_ctx,
 239                                     uint32_t *pnum_info,
 240                                     struct wbint_userinfo **pinfo)
 241 {
 242         struct rpc_pipe_client *samr_pipe = NULL;
 243         struct policy_handle dom_pol;
 244         struct wbint_userinfo *info = NULL;
 245         uint32_t num_info = 0;
 246         TALLOC_CTX *tmp_ctx;
 247         NTSTATUS status;
 248
 249         DEBUG(3,("samr_query_user_list\n"));
 250
 251         ZERO_STRUCT(dom_pol);
 252
 253         if (pnum_info) {
 254                 *pnum_info = 0;
 255         }
 256
 257         tmp_ctx = talloc_stackframe();
 258         if (tmp_ctx == NULL) {
 259                 return NT_STATUS_NO_MEMORY;
 260         }
 261
 262         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 263         if (!NT_STATUS_IS_OK(status)) {
 264                 goto done;
 265         }
 266
 267         status = rpc_query_user_list(tmp_ctx,
 268                                      samr_pipe,
 269                                      &dom_pol,
 270                                      &domain->sid,
 271                                      &num_info,
 272                                      &info);
 273         if (!NT_STATUS_IS_OK(status)) {
 274                 goto done;
 275         }
 276
 277         if (pnum_info) {
 278                 *pnum_info = num_info;
 279         }
 280
 281         if (pinfo) {
 282                 *pinfo = talloc_move(mem_ctx, &info);
 283         }
 284
 285 done:
 286         if (is_valid_policy_hnd(&dom_pol)) {
 287                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 288         }
 289
 290         TALLOC_FREE(tmp_ctx);
 291         return status;
 292 }
 293
 294 /* Lookup user information from a rid or username. */
 295 static NTSTATUS sam_query_user(struct winbindd_domain *domain,
 296                                TALLOC_CTX *mem_ctx,
 297                                const struct dom_sid *user_sid,
 298                                struct wbint_userinfo *user_info)
 299 {
 300         struct rpc_pipe_client *samr_pipe;
 301         struct policy_handle dom_pol;
 302         TALLOC_CTX *tmp_ctx;
 303         NTSTATUS status;
 304
 305         DEBUG(3,("sam_query_user\n"));
 306
 307         ZERO_STRUCT(dom_pol);
 308
 309         /* Paranoia check */
 310         if (!sid_check_is_in_our_domain(user_sid)) {
 311                 return NT_STATUS_NO_SUCH_USER;
 312         }
 313
 314         if (user_info) {
 315                 user_info->homedir = NULL;
 316                 user_info->shell = NULL;
 317                 user_info->primary_gid = (gid_t) -1;
 318         }
 319
 320         tmp_ctx = talloc_stackframe();
 321         if (tmp_ctx == NULL) {
 322                 return NT_STATUS_NO_MEMORY;
 323         }
 324
 325         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 326         if (!NT_STATUS_IS_OK(status)) {
 327                 goto done;
 328         }
 329
 330         status = rpc_query_user(tmp_ctx,
 331                                 samr_pipe,
 332                                 &dom_pol,
 333                                 &domain->sid,
 334                                 user_sid,
 335                                 user_info);
 336
 337 done:
 338         if (is_valid_policy_hnd(&dom_pol)) {
 339                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 340         }
 341
 342         TALLOC_FREE(tmp_ctx);
 343         return status;
 344 }
 345
 346 /* get a list of trusted domains - builtin domain */
 347 static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 348                                     TALLOC_CTX *mem_ctx,
 349                                     struct netr_DomainTrustList *ptrust_list)
 350 {
 351         struct rpc_pipe_client *lsa_pipe;
 352         struct policy_handle lsa_policy;
 353         struct netr_DomainTrust *trusts = NULL;
 354         uint32_t num_trusts = 0;
 355         TALLOC_CTX *tmp_ctx;
 356         NTSTATUS status;
 357
 358         DEBUG(3,("samr: trusted domains\n"));
 359
 360         ZERO_STRUCT(lsa_policy);
 361
 362         if (ptrust_list) {
 363                 ZERO_STRUCTP(ptrust_list);
 364         }
 365
 366         tmp_ctx = talloc_stackframe();
 367         if (tmp_ctx == NULL) {
 368                 return NT_STATUS_NO_MEMORY;
 369         }
 370
 371         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 372         if (!NT_STATUS_IS_OK(status)) {
 373                 goto done;
 374         }
 375
 376         status = rpc_trusted_domains(tmp_ctx,
 377                                      lsa_pipe,
 378                                      &lsa_policy,
 379                                      &num_trusts,
 380                                      &trusts);
 381         if (!NT_STATUS_IS_OK(status)) {
 382                 goto done;
 383         }
 384
 385         if (ptrust_list) {
 386                 ptrust_list->count = num_trusts;
 387                 ptrust_list->array = talloc_move(mem_ctx, &trusts);
 388         }
 389
 390 done:
 391         if (is_valid_policy_hnd(&lsa_policy)) {
 392                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 393         }
 394
 395         TALLOC_FREE(tmp_ctx);
 396         return status;
 397 }
 398
 399 /* Lookup group membership given a rid.   */
 400 static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 401                                     TALLOC_CTX *mem_ctx,
 402                                     const struct dom_sid *group_sid,
 403                                     enum lsa_SidType type,
 404                                     uint32_t *pnum_names,
 405                                     struct dom_sid **psid_mem,
 406                                     char ***pnames,
 407                                     uint32_t **pname_types)
 408 {
 409         struct rpc_pipe_client *samr_pipe;
 410         struct policy_handle dom_pol;
 411
 412         uint32_t num_names = 0;
 413         struct dom_sid *sid_mem = NULL;
 414         char **names = NULL;
 415         uint32_t *name_types = NULL;
 416
 417         TALLOC_CTX *tmp_ctx;
 418         NTSTATUS status;
 419
 420         DEBUG(3,("sam_lookup_groupmem\n"));
 421
 422         ZERO_STRUCT(dom_pol);
 423
 424         /* Paranoia check */
 425         if (sid_check_is_in_builtin(group_sid) && (type != SID_NAME_ALIAS)) {
 426                 /* There's no groups, only aliases in BUILTIN */
 427                 return NT_STATUS_NO_SUCH_GROUP;
 428         }
 429
 430         if (pnum_names) {
 431                 pnum_names = 0;
 432         }
 433
 434         tmp_ctx = talloc_stackframe();
 435         if (tmp_ctx == NULL) {
 436                 return NT_STATUS_NO_MEMORY;
 437         }
 438
 439         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 440         if (!NT_STATUS_IS_OK(status)) {
 441                 goto done;
 442         }
 443
 444         status = rpc_lookup_groupmem(tmp_ctx,
 445                                      samr_pipe,
 446                                      &dom_pol,
 447                                      domain->name,
 448                                      &domain->sid,
 449                                      group_sid,
 450                                      type,
 451                                      &num_names,
 452                                      &sid_mem,
 453                                      &names,
 454                                      &name_types);
 455
 456         if (pnum_names) {
 457                 *pnum_names = num_names;
 458         }
 459
 460         if (pnames) {
 461                 *pnames = talloc_move(mem_ctx, &names);
 462         }
 463
 464         if (pname_types) {
 465                 *pname_types = talloc_move(mem_ctx, &name_types);
 466         }
 467
 468         if (psid_mem) {
 469                 *psid_mem = talloc_move(mem_ctx, &sid_mem);
 470         }
 471
 472 done:
 473         if (is_valid_policy_hnd(&dom_pol)) {
 474                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 475         }
 476
 477         TALLOC_FREE(tmp_ctx);
 478         return status;
 479 }
 480
 481 /*********************************************************************
 482  BUILTIN specific functions.
 483 *********************************************************************/
 484
 485 /* List all domain groups */
 486 static NTSTATUS builtin_enum_dom_groups(struct winbindd_domain *domain,
 487                                 TALLOC_CTX *mem_ctx,
 488                                 uint32 *num_entries,
 489                                 struct acct_info **info)
 490 {
 491         /* BUILTIN doesn't have domain groups */
 492         *num_entries = 0;
 493         *info = NULL;
 494         return NT_STATUS_OK;
 495 }
 496
 497 /* Query display info for a domain */
 498 static NTSTATUS builtin_query_user_list(struct winbindd_domain *domain,
 499                                 TALLOC_CTX *mem_ctx,
 500                                 uint32 *num_entries,
 501                                 struct wbint_userinfo **info)
 502 {
 503         /* We don't have users */
 504         *num_entries = 0;
 505         *info = NULL;
 506         return NT_STATUS_OK;
 507 }
 508
 509 /* Lookup user information from a rid or username. */
 510 static NTSTATUS builtin_query_user(struct winbindd_domain *domain,
 511                                 TALLOC_CTX *mem_ctx,
 512                                 const struct dom_sid *user_sid,
 513                                 struct wbint_userinfo *user_info)
 514 {
 515         return NT_STATUS_NO_SUCH_USER;
 516 }
 517
 518 /* get a list of trusted domains - builtin domain */
 519 static NTSTATUS builtin_trusted_domains(struct winbindd_domain *domain,
 520                                         TALLOC_CTX *mem_ctx,
 521                                         struct netr_DomainTrustList *trusts)
 522 {
 523         ZERO_STRUCTP(trusts);
 524         return NT_STATUS_OK;
 525 }
 526
 527 /*********************************************************************
 528  COMMON functions.
 529 *********************************************************************/
 530
 531 /* List all local groups (aliases) */
 532 static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 533                                       TALLOC_CTX *mem_ctx,
 534                                       uint32_t *pnum_info,
 535                                       struct acct_info **pinfo)
 536 {
 537         struct rpc_pipe_client *samr_pipe;
 538         struct policy_handle dom_pol;
 539         struct acct_info *info = NULL;
 540         uint32_t num_info = 0;
 541         TALLOC_CTX *tmp_ctx;
 542         NTSTATUS status;
 543
 544         DEBUG(3,("samr: enum local groups\n"));
 545
 546         ZERO_STRUCT(dom_pol);
 547
 548         if (pnum_info) {
 549                 *pnum_info = 0;
 550         }
 551
 552         tmp_ctx = talloc_stackframe();
 553         if (tmp_ctx == NULL) {
 554                 return NT_STATUS_NO_MEMORY;
 555         }
 556
 557         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 558         if (!NT_STATUS_IS_OK(status)) {
 559                 goto done;
 560         }
 561
 562         status = rpc_enum_local_groups(mem_ctx,
 563                                        samr_pipe,
 564                                        &dom_pol,
 565                                        &num_info,
 566                                        &info);
 567         if (!NT_STATUS_IS_OK(status)) {
 568                 goto done;
 569         }
 570
 571         if (pnum_info) {
 572                 *pnum_info = num_info;
 573         }
 574
 575         if (pinfo) {
 576                 *pinfo = talloc_move(mem_ctx, &info);
 577         }
 578
 579 done:
 580         if (is_valid_policy_hnd(&dom_pol)) {
 581                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 582         }
 583
 584         TALLOC_FREE(tmp_ctx);
 585         return status;
 586 }
 587
 588 /* convert a single name to a sid in a domain */
 589 static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 590                                    TALLOC_CTX *mem_ctx,
 591                                    const char *domain_name,
 592                                    const char *name,
 593                                    uint32_t flags,
 594                                    struct dom_sid *psid,
 595                                    enum lsa_SidType *ptype)
 596 {
 597         struct rpc_pipe_client *lsa_pipe;
 598         struct policy_handle lsa_policy;
 599         struct dom_sid sid;
 600         enum lsa_SidType type;
 601         TALLOC_CTX *tmp_ctx;
 602         NTSTATUS status;
 603
 604         DEBUG(3,("sam_name_to_sid\n"));
 605
 606         ZERO_STRUCT(lsa_policy);
 607
 608         tmp_ctx = talloc_stackframe();
 609         if (tmp_ctx == NULL) {
 610                 return NT_STATUS_NO_MEMORY;
 611         }
 612
 613         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 614         if (!NT_STATUS_IS_OK(status)) {
 615                 goto done;
 616         }
 617
 618         status = rpc_name_to_sid(tmp_ctx,
 619                                  lsa_pipe,
 620                                  &lsa_policy,
 621                                  domain_name,
 622                                  name,
 623                                  flags,
 624                                  &sid,
 625                                  &type);
 626         if (!NT_STATUS_IS_OK(status)) {
 627                 goto done;
 628         }
 629
 630         if (psid) {
 631                 sid_copy(psid, &sid);
 632         }
 633         if (ptype) {
 634                 *ptype = type;
 635         }
 636
 637 done:
 638         if (is_valid_policy_hnd(&lsa_policy)) {
 639                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 640         }
 641
 642         TALLOC_FREE(tmp_ctx);
 643         return status;
 644 }
 645
 646 /* convert a domain SID to a user or group name */
 647 static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 648                                 TALLOC_CTX *mem_ctx,
 649                                 const struct dom_sid *sid,
 650                                 char **pdomain_name,
 651                                 char **pname,
 652                                 enum lsa_SidType *ptype)
 653 {
 654         struct rpc_pipe_client *lsa_pipe;
 655         struct policy_handle lsa_policy;
 656         char *domain_name = NULL;
 657         char *name = NULL;
 658         enum lsa_SidType type;
 659         TALLOC_CTX *tmp_ctx;
 660         NTSTATUS status;
 661
 662         DEBUG(3,("sam_sid_to_name\n"));
 663
 664         ZERO_STRUCT(lsa_policy);
 665
 666         /* Paranoia check */
 667         if (!sid_check_is_in_builtin(sid) &&
 668             !sid_check_is_in_our_domain(sid) &&
 669             !sid_check_is_in_unix_users(sid) &&
 670             !sid_check_is_unix_users(sid) &&
 671             !sid_check_is_in_unix_groups(sid) &&
 672             !sid_check_is_unix_groups(sid) &&
 673             !sid_check_is_in_wellknown_domain(sid)) {
 674                 DEBUG(0, ("sam_sid_to_name: possible deadlock - trying to "
 675                           "lookup SID %s\n", sid_string_dbg(sid)));
 676                 return NT_STATUS_NONE_MAPPED;
 677         }
 678
 679         tmp_ctx = talloc_stackframe();
 680         if (tmp_ctx == NULL) {
 681                 return NT_STATUS_NO_MEMORY;
 682         }
 683
 684         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 685         if (!NT_STATUS_IS_OK(status)) {
 686                 goto done;
 687         }
 688
 689         status = rpc_sid_to_name(tmp_ctx,
 690                                  lsa_pipe,
 691                                  &lsa_policy,
 692                                  domain,
 693                                  sid,
 694                                  &domain_name,
 695                                  &name,
 696                                  &type);
 697
 698         if (ptype) {
 699                 *ptype = type;
 700         }
 701
 702         if (pname) {
 703                 *pname = talloc_move(mem_ctx, &name);
 704         }
 705
 706         if (pdomain_name) {
 707                 *pdomain_name = talloc_move(mem_ctx, &domain_name);
 708         }
 709
 710 done:
 711         if (is_valid_policy_hnd(&lsa_policy)) {
 712                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 713         }
 714
 715         TALLOC_FREE(tmp_ctx);
 716         return status;
 717 }
 718
 719 static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 720                                   TALLOC_CTX *mem_ctx,
 721                                   const struct dom_sid *sid,
 722                                   uint32 *rids,
 723                                   size_t num_rids,
 724                                   char **pdomain_name,
 725                                   char ***pnames,
 726                                   enum lsa_SidType **ptypes)
 727 {
 728         struct rpc_pipe_client *lsa_pipe;
 729         struct policy_handle lsa_policy;
 730         enum lsa_SidType *types = NULL;
 731         char *domain_name = NULL;
 732         char **names = NULL;
 733         TALLOC_CTX *tmp_ctx;
 734         NTSTATUS status;
 735
 736         DEBUG(3,("sam_rids_to_names for %s\n", domain->name));
 737
 738         ZERO_STRUCT(lsa_policy);
 739
 740         /* Paranoia check */
 741         if (!sid_check_is_in_builtin(sid) &&
 742             !sid_check_is_in_our_domain(sid) &&
 743             !sid_check_is_in_unix_users(sid) &&
 744             !sid_check_is_unix_users(sid) &&
 745             !sid_check_is_in_unix_groups(sid) &&
 746             !sid_check_is_unix_groups(sid) &&
 747             !sid_check_is_in_wellknown_domain(sid)) {
 748                 DEBUG(0, ("sam_rids_to_names: possible deadlock - trying to "
 749                           "lookup SID %s\n", sid_string_dbg(sid)));
 750                 return NT_STATUS_NONE_MAPPED;
 751         }
 752
 753         tmp_ctx = talloc_stackframe();
 754         if (tmp_ctx == NULL) {
 755                 return NT_STATUS_NO_MEMORY;
 756         }
 757
 758         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 759         if (!NT_STATUS_IS_OK(status)) {
 760                 goto done;
 761         }
 762
 763         status = rpc_rids_to_names(tmp_ctx,
 764                                    lsa_pipe,
 765                                    &lsa_policy,
 766                                    domain,
 767                                    sid,
 768                                    rids,
 769                                    num_rids,
 770                                    &domain_name,
 771                                    &names,
 772                                    &types);
 773         if (!NT_STATUS_IS_OK(status)) {
 774                 goto done;
 775         }
 776
 777         if (pdomain_name) {
 778                 *pdomain_name = talloc_move(mem_ctx, &domain_name);
 779         }
 780
 781         if (ptypes) {
 782                 *ptypes = talloc_move(mem_ctx, &types);
 783         }
 784
 785         if (pnames) {
 786                 *pnames = talloc_move(mem_ctx, &names);
 787         }
 788
 789 done:
 790         if (is_valid_policy_hnd(&lsa_policy)) {
 791                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 792         }
 793
 794         TALLOC_FREE(tmp_ctx);
 795         return status;
 796 }
 797
 798 static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 799                                    TALLOC_CTX *mem_ctx,
 800                                    struct samr_DomInfo12 *lockout_policy)
 801 {
 802         struct rpc_pipe_client *samr_pipe;
 803         struct policy_handle dom_pol;
 804         union samr_DomainInfo *info = NULL;
 805         TALLOC_CTX *tmp_ctx;
 806         NTSTATUS status;
 807
 808         DEBUG(3,("sam_lockout_policy\n"));
 809
 810         ZERO_STRUCT(dom_pol);
 811
 812         tmp_ctx = talloc_stackframe();
 813         if (tmp_ctx == NULL) {
 814                 return NT_STATUS_NO_MEMORY;
 815         }
 816
 817         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 818         if (!NT_STATUS_IS_OK(status)) {
 819                 goto error;
 820         }
 821
 822         status = rpccli_samr_QueryDomainInfo(samr_pipe,
 823                                              mem_ctx,
 824                                              &dom_pol,
 825                                              12,
 826                                              &info);
 827         if (!NT_STATUS_IS_OK(status)) {
 828                 goto error;
 829         }
 830
 831         *lockout_policy = info->info12;
 832
 833 error:
 834         if (is_valid_policy_hnd(&dom_pol)) {
 835                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 836         }
 837
 838         TALLOC_FREE(tmp_ctx);
 839         return status;
 840 }
 841
 842 static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 843                                     TALLOC_CTX *mem_ctx,
 844                                     struct samr_DomInfo1 *passwd_policy)
 845 {
 846         struct rpc_pipe_client *samr_pipe;
 847         struct policy_handle dom_pol;
 848         union samr_DomainInfo *info = NULL;
 849         TALLOC_CTX *tmp_ctx;
 850         NTSTATUS status;
 851
 852         DEBUG(3,("sam_password_policy\n"));
 853
 854         ZERO_STRUCT(dom_pol);
 855
 856         tmp_ctx = talloc_stackframe();
 857         if (tmp_ctx == NULL) {
 858                 return NT_STATUS_NO_MEMORY;
 859         }
 860
 861         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 862         if (!NT_STATUS_IS_OK(status)) {
 863                 goto error;
 864         }
 865
 866         status = rpccli_samr_QueryDomainInfo(samr_pipe,
 867                                              mem_ctx,
 868                                              &dom_pol,
 869                                              1,
 870                                              &info);
 871         if (!NT_STATUS_IS_OK(status)) {
 872                 goto error;
 873         }
 874
 875         *passwd_policy = info->info1;
 876
 877 error:
 878         if (is_valid_policy_hnd(&dom_pol)) {
 879                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 880         }
 881
 882         TALLOC_FREE(tmp_ctx);
 883         return status;
 884 }
 885
 886 /* Lookup groups a user is a member of. */
 887 static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 888                                       TALLOC_CTX *mem_ctx,
 889                                       const struct dom_sid *user_sid,
 890                                       uint32_t *pnum_groups,
 891                                       struct dom_sid **puser_grpsids)
 892 {
 893         struct rpc_pipe_client *samr_pipe;
 894         struct policy_handle dom_pol;
 895         struct dom_sid *user_grpsids = NULL;
 896         uint32_t num_groups = 0;
 897         TALLOC_CTX *tmp_ctx;
 898         NTSTATUS status;
 899
 900         DEBUG(3,("sam_lookup_usergroups\n"));
 901
 902         ZERO_STRUCT(dom_pol);
 903
 904         if (pnum_groups) {
 905                 *pnum_groups = 0;
 906         }
 907
 908         tmp_ctx = talloc_stackframe();
 909         if (tmp_ctx == NULL) {
 910                 return NT_STATUS_NO_MEMORY;
 911         }
 912
 913         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 914         if (!NT_STATUS_IS_OK(status)) {
 915                 goto done;
 916         }
 917
 918         status = rpc_lookup_usergroups(tmp_ctx,
 919                                        samr_pipe,
 920                                        &dom_pol,
 921                                        &domain->sid,
 922                                        user_sid,
 923                                        &num_groups,
 924                                        &user_grpsids);
 925         if (!NT_STATUS_IS_OK(status)) {
 926                 goto done;
 927         }
 928
 929         if (pnum_groups) {
 930                 *pnum_groups = num_groups;
 931         }
 932
 933         if (puser_grpsids) {
 934                 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
 935         }
 936
 937 done:
 938         if (is_valid_policy_hnd(&dom_pol)) {
 939                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 940         }
 941
 942         TALLOC_FREE(tmp_ctx);
 943         return status;
 944 }
 945
 946 static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 947                                        TALLOC_CTX *mem_ctx,
 948                                        uint32_t num_sids,
 949                                        const struct dom_sid *sids,
 950                                        uint32_t *pnum_aliases,
 951                                        uint32_t **palias_rids)
 952 {
 953         struct rpc_pipe_client *samr_pipe;
 954         struct policy_handle dom_pol;
 955         uint32_t num_aliases = 0;
 956         uint32_t *alias_rids = NULL;
 957         TALLOC_CTX *tmp_ctx;
 958         NTSTATUS status;
 959
 960         DEBUG(3,("sam_lookup_useraliases\n"));
 961
 962         ZERO_STRUCT(dom_pol);
 963
 964         if (pnum_aliases) {
 965                 *pnum_aliases = 0;
 966         }
 967
 968         tmp_ctx = talloc_stackframe();
 969         if (tmp_ctx == NULL) {
 970                 return NT_STATUS_NO_MEMORY;
 971         }
 972
 973         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 974         if (!NT_STATUS_IS_OK(status)) {
 975                 goto done;
 976         }
 977
 978         status = rpc_lookup_useraliases(tmp_ctx,
 979                                         samr_pipe,
 980                                         &dom_pol,
 981                                         num_sids,
 982                                         sids,
 983                                         &num_aliases,
 984                                         &alias_rids);
 985         if (!NT_STATUS_IS_OK(status)) {
 986                 goto done;
 987         }
 988
 989         if (pnum_aliases) {
 990                 *pnum_aliases = num_aliases;
 991         }
 992
 993         if (palias_rids) {
 994                 *palias_rids = talloc_move(mem_ctx, &alias_rids);
 995         }
 996
 997 done:
 998         if (is_valid_policy_hnd(&dom_pol)) {
 999                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
1000         }
1001
1002         TALLOC_FREE(tmp_ctx);
1003         return status;
1004 }
1005
1006 /* find the sequence number for a domain */
1007 static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
1008                                     uint32_t *pseq)
1009 {
1010         struct rpc_pipe_client *samr_pipe;
1011         struct policy_handle dom_pol;
1012         uint32_t seq;
1013         TALLOC_CTX *tmp_ctx;
1014         NTSTATUS status;
1015
1016         DEBUG(3,("samr: sequence number\n"));
1017
1018         ZERO_STRUCT(dom_pol);
1019
1020         if (pseq) {
1021                 *pseq = DOM_SEQUENCE_NONE;
1022         }
1023
1024         tmp_ctx = talloc_stackframe();
1025         if (tmp_ctx == NULL) {
1026                 return NT_STATUS_NO_MEMORY;
1027         }
1028
1029         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
1030         if (!NT_STATUS_IS_OK(status)) {
1031                 goto done;
1032         }
1033
1034         status = rpc_sequence_number(tmp_ctx,
1035                                      samr_pipe,
1036                                      &dom_pol,
1037                                      domain->name,
1038                                      &seq);
1039         if (!NT_STATUS_IS_OK(status)) {
1040                 goto done;
1041         }
1042
1043         if (pseq) {
1044                 *pseq = seq;
1045         }
1046 done:
1047         if (is_valid_policy_hnd(&dom_pol)) {
1048                 rpccli_samr_Close(samr_pipe, tmp_ctx, &dom_pol);
1049         }
1050
1051         TALLOC_FREE(tmp_ctx);
1052         return status;
1053 }
1054
1055 /* the rpc backend methods are exposed via this structure */
1056 struct winbindd_methods builtin_passdb_methods = {
1057         .consistent            = false,
1058
1059         .query_user_list       = builtin_query_user_list,
1060         .enum_dom_groups       = builtin_enum_dom_groups,
1061         .enum_local_groups     = sam_enum_local_groups,
1062         .name_to_sid           = sam_name_to_sid,
1063         .sid_to_name           = sam_sid_to_name,
1064         .rids_to_names         = sam_rids_to_names,
1065         .query_user            = builtin_query_user,
1066         .lookup_usergroups     = sam_lookup_usergroups,
1067         .lookup_useraliases    = sam_lookup_useraliases,
1068         .lookup_groupmem       = sam_lookup_groupmem,
1069         .sequence_number       = sam_sequence_number,
1070         .lockout_policy        = sam_lockout_policy,
1071         .password_policy       = sam_password_policy,
1072         .trusted_domains       = builtin_trusted_domains
1073 };
1074
1075 /* the rpc backend methods are exposed via this structure */
1076 struct winbindd_methods sam_passdb_methods = {
1077         .consistent            = false,
1078
1079         .query_user_list       = sam_query_user_list,
1080         .enum_dom_groups       = sam_enum_dom_groups,
1081         .enum_local_groups     = sam_enum_local_groups,
1082         .name_to_sid           = sam_name_to_sid,
1083         .sid_to_name           = sam_sid_to_name,
1084         .rids_to_names         = sam_rids_to_names,
1085         .query_user            = sam_query_user,
1086         .lookup_usergroups     = sam_lookup_usergroups,
1087         .lookup_useraliases    = sam_lookup_useraliases,
1088         .lookup_groupmem       = sam_lookup_groupmem,
1089         .sequence_number       = sam_sequence_number,
1090         .lockout_policy        = sam_lockout_policy,
1091         .password_policy       = sam_password_policy,
1092         .trusted_domains       = sam_trusted_domains
1093 };