?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tests/krb5: Fix method for creating invalid length zeroed checksum
[Samba.git] / source3 / winbindd / winbindd_rpc.c
blob793ebe0df569b3285f099e29dd1fa7d92ac91341
1 /*
2 * Unix SMB/CIFS implementation.
3 *
4 * Winbind rpc backend functions
5 *
6 * Copyright (c) 2000-2003 Tim Potter
7 * Copyright (c) 2001 Andrew Tridgell
8 * Copyright (c) 2005 Volker Lendecke
9 * Copyright (c) 2008 Guenther Deschner (pidl conversion)
10 * Copyright (c) 2010 Andreas Schneider <asn@samba.org>
11 *
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 3 of the License, or
15 * (at your option) any later version.
16 *
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #include "winbindd_rpc.h"
29 #include "rpc_client/rpc_client.h"
30 #include "librpc/gen_ndr/ndr_samr_c.h"
31 #include "librpc/gen_ndr/ndr_lsa_c.h"
32 #include "rpc_client/cli_samr.h"
33 #include "rpc_client/cli_lsarpc.h"
34 #include "../libcli/security/security.h"
35 #include "lsa.h"
36
37 /* Query display info for a domain */
38 NTSTATUS rpc_query_user_list(TALLOC_CTX *mem_ctx,
39 struct rpc_pipe_client *samr_pipe,
40 struct policy_handle *samr_policy,
41 const struct dom_sid *domain_sid,
42 uint32_t **prids)
43 {
44 struct dcerpc_binding_handle *b = samr_pipe->binding_handle;
45 uint32_t *rids = NULL;
46 uint32_t num_rids = 0;
47 uint32_t i = 0;
48 uint32_t resume_handle = 0;
49 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
50 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
51 TALLOC_CTX *tmp_ctx;
52
53 *prids = NULL;
54
55 tmp_ctx = talloc_stackframe();
56 if (tmp_ctx == NULL) {
57 return NT_STATUS_NO_MEMORY;
58 }
59
60 do {
61 struct samr_SamArray *sam_array = NULL;
62 uint32_t count = 0;
63 uint32_t *tmp;
64
65 status = dcerpc_samr_EnumDomainUsers(
66 b, tmp_ctx, samr_policy, &resume_handle,
67 ACB_NORMAL, &sam_array, 0xffff, &count, &result);
68 if (!NT_STATUS_IS_OK(status)) {
69 goto done;
70 }
71 if (!NT_STATUS_IS_OK(result)) {
72 if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
73 DBG_WARNING("EnumDomainUsers failed: %s\n",
74 nt_errstr(result));
75 status = result;
76 goto done;
77 }
78 }
79
80 if (num_rids + count < num_rids) {
81 status = NT_STATUS_INTEGER_OVERFLOW;
82 goto done;
83 }
84
85 tmp = talloc_realloc(tmp_ctx, rids, uint32_t, num_rids+count);
86 if (tmp == NULL) {
87 status = NT_STATUS_NO_MEMORY;
88 goto done;
89 }
90 rids = tmp;
91
92 for (i=0; i<count; i++) {
93 rids[num_rids++] = sam_array->entries[i].idx;
94 }
95
96 TALLOC_FREE(sam_array);
97 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
98
99 *prids = talloc_steal(mem_ctx, rids);
100 status = NT_STATUS_OK;
101
102 done:
103 TALLOC_FREE(tmp_ctx);
104 return status;
105 }
106
107 /* List all domain groups */
108 NTSTATUS rpc_enum_dom_groups(TALLOC_CTX *mem_ctx,
109 struct rpc_pipe_client *samr_pipe,
110 struct policy_handle *samr_policy,
111 uint32_t *pnum_info,
112 struct wb_acct_info **pinfo)
113 {
114 struct wb_acct_info *info = NULL;
115 uint32_t start = 0;
116 uint32_t num_info = 0;
117 NTSTATUS status, result;
118 struct dcerpc_binding_handle *b = samr_pipe->binding_handle;
119
120 *pnum_info = 0;
121
122 do {
123 struct samr_SamArray *sam_array = NULL;
124 uint32_t count = 0;
125 uint32_t g;
126
127 /* start is updated by this call. */
128 status = dcerpc_samr_EnumDomainGroups(b,
129 mem_ctx,
130 samr_policy,
131 &start,
132 &sam_array,
133 0xFFFF, /* buffer size? */
134 &count,
135 &result);
136 if (!NT_STATUS_IS_OK(status)) {
137 return status;
138 }
139 if (!NT_STATUS_IS_OK(result)) {
140 if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
141 DEBUG(2,("query_user_list: failed to enum domain groups: %s\n",
142 nt_errstr(result)));
143 return result;
144 }
145 }
146
147 info = talloc_realloc(mem_ctx,
148 info,
149 struct wb_acct_info,
150 num_info + count);
151 if (info == NULL) {
152 return NT_STATUS_NO_MEMORY;
153 }
154
155 for (g = 0; g < count; g++) {
156 struct wb_acct_info *i = &info[num_info + g];
157
158 i->acct_name = talloc_strdup(info,
159 sam_array->entries[g].name.string);
160 if (i->acct_name == NULL) {
161 TALLOC_FREE(info);
162 return NT_STATUS_NO_MEMORY;
163 }
164 i->acct_desc = NULL;
165 i->rid = sam_array->entries[g].idx;
166 }
167
168 num_info += count;
169 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
170
171 *pnum_info = num_info;
172 *pinfo = info;
173
174 return NT_STATUS_OK;
175 }
176
177 NTSTATUS rpc_enum_local_groups(TALLOC_CTX *mem_ctx,
178 struct rpc_pipe_client *samr_pipe,
179 struct policy_handle *samr_policy,
180 uint32_t *pnum_info,
181 struct wb_acct_info **pinfo)
182 {
183 struct wb_acct_info *info = NULL;
184 uint32_t num_info = 0;
185 NTSTATUS status, result;
186 struct dcerpc_binding_handle *b = samr_pipe->binding_handle;
187
188 *pnum_info = 0;
189
190 do {
191 struct samr_SamArray *sam_array = NULL;
192 uint32_t count = 0;
193 uint32_t start = num_info;
194 uint32_t g;
195
196 status = dcerpc_samr_EnumDomainAliases(b,
197 mem_ctx,
198 samr_policy,
199 &start,
200 &sam_array,
201 0xFFFF, /* buffer size? */
202 &count,
203 &result);
204 if (!NT_STATUS_IS_OK(status)) {
205 return status;
206 }
207 if (!NT_STATUS_IS_OK(result)) {
208 if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
209 return result;
210 }
211 }
212
213 info = talloc_realloc(mem_ctx,
214 info,
215 struct wb_acct_info,
216 num_info + count);
217 if (info == NULL) {
218 return NT_STATUS_NO_MEMORY;
219 }
220
221 for (g = 0; g < count; g++) {
222 struct wb_acct_info *i = &info[num_info + g];
223
224 i->acct_name = talloc_strdup(info,
225 sam_array->entries[g].name.string);
226 if (i->acct_name == NULL) {
227 TALLOC_FREE(info);
228 return NT_STATUS_NO_MEMORY;
229 }
230 i->acct_desc = NULL;
231 i->rid = sam_array->entries[g].idx;
232 }
233
234 num_info += count;
235 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
236
237 *pnum_info = num_info;
238 *pinfo = info;
239
240 return NT_STATUS_OK;
241 }
242
243 /* convert a single name to a sid in a domain */
244 NTSTATUS rpc_name_to_sid(TALLOC_CTX *mem_ctx,
245 struct rpc_pipe_client *lsa_pipe,
246 struct policy_handle *lsa_policy,
247 const char *domain_name,
248 const char *name,
249 uint32_t flags,
250 const char **pdom_name,
251 struct dom_sid *sid,
252 enum lsa_SidType *type)
253 {
254 enum lsa_SidType *types = NULL;
255 struct dom_sid *sids = NULL;
256 char *full_name = NULL;
257 const char *names[1];
258 const char **domains;
259 char *mapped_name = NULL;
260 NTSTATUS status;
261
262 if (name == NULL || name[0] == '\0') {
263 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
264 } else if (domain_name == NULL || domain_name[0] == '\0') {
265 full_name = talloc_asprintf(mem_ctx, "%s", name);
266 } else {
267 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
268 }
269
270 if (full_name == NULL) {
271 return NT_STATUS_NO_MEMORY;
272 }
273
274 status = normalize_name_unmap(mem_ctx, full_name, &mapped_name);
275 /* Reset the full_name pointer if we mapped anything */
276 if (NT_STATUS_IS_OK(status) ||
277 NT_STATUS_EQUAL(status, NT_STATUS_FILE_RENAMED)) {
278 full_name = mapped_name;
279 }
280
281 DEBUG(3,("name_to_sid: %s for domain %s\n",
282 full_name ? full_name : "", domain_name ));
283
284 names[0] = full_name;
285
286 /*
287 * We don't run into deadlocks here, cause winbind_off() is
288 * called in the main function.
289 */
290 status = rpccli_lsa_lookup_names(lsa_pipe,
291 mem_ctx,
292 lsa_policy,
293 1, /* num_names */
294 names,
295 &domains,
296 1, /* level */
297 &sids,
298 &types);
299 if (!NT_STATUS_IS_OK(status)) {
300 DEBUG(2,("name_to_sid: failed to lookup name: %s\n",
301 nt_errstr(status)));
302 return status;
303 }
304
305 if (pdom_name != NULL) {
306 const char *dom_name;
307
308 dom_name = talloc_strdup(mem_ctx, domains[0]);
309 if (dom_name == NULL) {
310 return NT_STATUS_NO_MEMORY;
311 }
312
313 *pdom_name = dom_name;
314 }
315
316 sid_copy(sid, &sids[0]);
317 *type = types[0];
318
319 return NT_STATUS_OK;
320 }
321
322 /* Convert a domain SID to a user or group name */
323 NTSTATUS rpc_sid_to_name(TALLOC_CTX *mem_ctx,
324 struct rpc_pipe_client *lsa_pipe,
325 struct policy_handle *lsa_policy,
326 struct winbindd_domain *domain,
327 const struct dom_sid *sid,
328 char **pdomain_name,
329 char **pname,
330 enum lsa_SidType *ptype)
331 {
332 char *mapped_name = NULL;
333 char **domains = NULL;
334 char **names = NULL;
335 enum lsa_SidType *types = NULL;
336 NTSTATUS map_status;
337 NTSTATUS status;
338
339 status = rpccli_lsa_lookup_sids(lsa_pipe,
340 mem_ctx,
341 lsa_policy,
342 1, /* num_sids */
343 sid,
344 &domains,
345 &names,
346 &types);
347 if (!NT_STATUS_IS_OK(status)) {
348 DEBUG(2,("sid_to_name: failed to lookup sids: %s\n",
349 nt_errstr(status)));
350 return status;
351 }
352
353 *ptype = (enum lsa_SidType) types[0];
354
355 map_status = normalize_name_map(mem_ctx,
356 domain->name,
357 names[0],
358 &mapped_name);
359 if (NT_STATUS_IS_OK(map_status) ||
360 NT_STATUS_EQUAL(map_status, NT_STATUS_FILE_RENAMED)) {
361 *pname = talloc_strdup(mem_ctx, mapped_name);
362 DEBUG(5,("returning mapped name -- %s\n", *pname));
363 } else {
364 *pname = talloc_strdup(mem_ctx, names[0]);
365 }
366 if ((names[0] != NULL) && (*pname == NULL)) {
367 return NT_STATUS_NO_MEMORY;
368 }
369
370 *pdomain_name = talloc_strdup(mem_ctx, domains[0]);
371 if (*pdomain_name == NULL) {
372 return NT_STATUS_NO_MEMORY;
373 }
374
375 return NT_STATUS_OK;
376 }
377
378 /* Convert a bunch of rids to user or group names */
379 NTSTATUS rpc_rids_to_names(TALLOC_CTX *mem_ctx,
380 struct rpc_pipe_client *lsa_pipe,
381 struct policy_handle *lsa_policy,
382 struct winbindd_domain *domain,
383 const struct dom_sid *sid,
384 uint32_t *rids,
385 size_t num_rids,
386 char **pdomain_name,
387 char ***pnames,
388 enum lsa_SidType **ptypes)
389 {
390 enum lsa_SidType *types = NULL;
391 char *domain_name = NULL;
392 char **domains = NULL;
393 char **names = NULL;
394 struct dom_sid *sids;
395 size_t i;
396 NTSTATUS status;
397
398 if (num_rids > 0) {
399 sids = talloc_array(mem_ctx, struct dom_sid, num_rids);
400 if (sids == NULL) {
401 return NT_STATUS_NO_MEMORY;
402 }
403 } else {
404 sids = NULL;
405 }
406
407 for (i = 0; i < num_rids; i++) {
408 if (!sid_compose(&sids[i], sid, rids[i])) {
409 return NT_STATUS_INTERNAL_ERROR;
410 }
411 }
412
413 status = rpccli_lsa_lookup_sids(lsa_pipe,
414 mem_ctx,
415 lsa_policy,
416 num_rids,
417 sids,
418 &domains,
419 &names,
420 &types);
421 if (!NT_STATUS_IS_OK(status) &&
422 !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
423 DEBUG(2,("rids_to_names: failed to lookup sids: %s\n",
424 nt_errstr(status)));
425 return status;
426 }
427
428 for (i = 0; i < num_rids; i++) {
429 char *mapped_name = NULL;
430 NTSTATUS map_status;
431
432 if (types[i] != SID_NAME_UNKNOWN) {
433 map_status = normalize_name_map(mem_ctx,
434 domain->name,
435 names[i],
436 &mapped_name);
437 if (NT_STATUS_IS_OK(map_status) ||
438 NT_STATUS_EQUAL(map_status, NT_STATUS_FILE_RENAMED)) {
439 TALLOC_FREE(names[i]);
440 names[i] = talloc_strdup(names, mapped_name);
441 if (names[i] == NULL) {
442 return NT_STATUS_NO_MEMORY;
443 }
444 }
445
446 domain_name = domains[i];
447 }
448 }
449
450 *pdomain_name = domain_name;
451 *ptypes = types;
452 *pnames = names;
453
454 return NT_STATUS_OK;
455 }
456
457 /* Lookup groups a user is a member of. */
458 NTSTATUS rpc_lookup_usergroups(TALLOC_CTX *mem_ctx,
459 struct rpc_pipe_client *samr_pipe,
460 struct policy_handle *samr_policy,
461 const struct dom_sid *domain_sid,
462 const struct dom_sid *user_sid,
463 uint32_t *pnum_groups,
464 struct dom_sid **puser_grpsids)
465 {
466 struct policy_handle user_policy;
467 struct samr_RidWithAttributeArray *rid_array = NULL;
468 struct dom_sid *user_grpsids = NULL;
469 uint32_t num_groups = 0, i;
470 uint32_t user_rid;
471 NTSTATUS status, result;
472 struct dcerpc_binding_handle *b = samr_pipe->binding_handle;
473
474 if (!sid_peek_check_rid(domain_sid, user_sid, &user_rid)) {
475 return NT_STATUS_UNSUCCESSFUL;
476 }
477
478 /* Get user handle */
479 status = dcerpc_samr_OpenUser(b,
480 mem_ctx,
481 samr_policy,
482 SEC_FLAG_MAXIMUM_ALLOWED,
483 user_rid,
484 &user_policy,
485 &result);
486 if (!NT_STATUS_IS_OK(status)) {
487 return status;
488 }
489 if (!NT_STATUS_IS_OK(result)) {
490 return result;
491 }
492
493 /* Query user rids */
494 status = dcerpc_samr_GetGroupsForUser(b,
495 mem_ctx,
496 &user_policy,
497 &rid_array,
498 &result);
499 {
500 NTSTATUS _result;
501 dcerpc_samr_Close(b, mem_ctx, &user_policy, &_result);
502 }
503
504 if (!NT_STATUS_IS_OK(status)) {
505 return status;
506 }
507 if (!NT_STATUS_IS_OK(result)) {
508 return result;
509 }
510
511 num_groups = rid_array->count;
512
513 user_grpsids = talloc_array(mem_ctx, struct dom_sid, num_groups);
514 if (user_grpsids == NULL) {
515 status = NT_STATUS_NO_MEMORY;
516 return status;
517 }
518
519 for (i = 0; i < num_groups; i++) {
520 sid_compose(&(user_grpsids[i]), domain_sid,
521 rid_array->rids[i].rid);
522 }
523
524 *pnum_groups = num_groups;
525
526 *puser_grpsids = user_grpsids;
527
528 return NT_STATUS_OK;
529 }
530
531 NTSTATUS rpc_lookup_useraliases(TALLOC_CTX *mem_ctx,
532 struct rpc_pipe_client *samr_pipe,
533 struct policy_handle *samr_policy,
534 uint32_t num_sids,
535 const struct dom_sid *sids,
536 uint32_t *pnum_aliases,
537 uint32_t **palias_rids)
538 {
539 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
540 uint32_t num_query_sids = 0;
541 uint32_t num_queries = 1;
542 uint32_t num_aliases = 0;
543 uint32_t total_sids = 0;
544 uint32_t *alias_rids = NULL;
545 uint32_t rangesize = MAX_SAM_ENTRIES_W2K;
546 uint32_t i;
547 struct samr_Ids alias_rids_query;
548 NTSTATUS status, result;
549 struct dcerpc_binding_handle *b = samr_pipe->binding_handle;
550
551 do {
552 /* prepare query */
553 struct lsa_SidArray sid_array;
554
555 ZERO_STRUCT(sid_array);
556
557 num_query_sids = MIN(num_sids - total_sids, rangesize);
558
559 DEBUG(10,("rpc: lookup_useraliases: entering query %d for %d sids\n",
560 num_queries, num_query_sids));
561
562 if (num_query_sids) {
563 sid_array.sids = talloc_zero_array(mem_ctx, struct lsa_SidPtr, num_query_sids);
564 if (sid_array.sids == NULL) {
565 return NT_STATUS_NO_MEMORY;
566 }
567 } else {
568 sid_array.sids = NULL;
569 }
570
571 for (i = 0; i < num_query_sids; i++) {
572 sid_array.sids[i].sid = dom_sid_dup(mem_ctx, &sids[total_sids++]);
573 if (sid_array.sids[i].sid == NULL) {
574 return NT_STATUS_NO_MEMORY;
575 }
576 }
577 sid_array.num_sids = num_query_sids;
578
579 /* do request */
580 status = dcerpc_samr_GetAliasMembership(b,
581 mem_ctx,
582 samr_policy,
583 &sid_array,
584 &alias_rids_query,
585 &result);
586 if (!NT_STATUS_IS_OK(status)) {
587 return status;
588 }
589 if (!NT_STATUS_IS_OK(result)) {
590 return result;
591 }
592
593 /* process output */
594 for (i = 0; i < alias_rids_query.count; i++) {
595 size_t na = num_aliases;
596
597 if (!add_rid_to_array_unique(mem_ctx,
598 alias_rids_query.ids[i],
599 &alias_rids,
600 &na)) {
601 return NT_STATUS_NO_MEMORY;
602 }
603 num_aliases = na;
604 }
605
606 num_queries++;
607
608 } while (total_sids < num_sids);
609
610 DEBUG(10,("rpc: rpc_lookup_useraliases: got %d aliases in %d queries "
611 "(rangesize: %d)\n", num_aliases, num_queries, rangesize));
612
613 *pnum_aliases = num_aliases;
614 *palias_rids = alias_rids;
615
616 return NT_STATUS_OK;
617 #undef MAX_SAM_ENTRIES_W2K
618 }
619
620 /* Lookup group membership given a rid. */
621 NTSTATUS rpc_lookup_groupmem(TALLOC_CTX *mem_ctx,
622 struct rpc_pipe_client *samr_pipe,
623 struct policy_handle *samr_policy,
624 const char *domain_name,
625 const struct dom_sid *domain_sid,
626 const struct dom_sid *group_sid,
627 enum lsa_SidType type,
628 uint32_t *pnum_names,
629 struct dom_sid **psid_mem,
630 char ***pnames,
631 uint32_t **pname_types)
632 {
633 struct policy_handle group_policy;
634 uint32_t group_rid;
635 uint32_t *rid_mem = NULL;
636
637 uint32_t num_names = 0;
638 uint32_t total_names = 0;
639 struct dom_sid *sid_mem = NULL;
640 char **names = NULL;
641 uint32_t *name_types = NULL;
642
643 struct lsa_Strings tmp_names;
644 struct samr_Ids tmp_types;
645
646 uint32_t j, r;
647 NTSTATUS status, result;
648 struct dcerpc_binding_handle *b = samr_pipe->binding_handle;
649
650 if (!sid_peek_check_rid(domain_sid, group_sid, &group_rid)) {
651 return NT_STATUS_UNSUCCESSFUL;
652 }
653
654 switch(type) {
655 case SID_NAME_DOM_GRP:
656 {
657 struct samr_RidAttrArray *rids = NULL;
658
659 status = dcerpc_samr_OpenGroup(b,
660 mem_ctx,
661 samr_policy,
662 SEC_FLAG_MAXIMUM_ALLOWED,
663 group_rid,
664 &group_policy,
665 &result);
666 if (!NT_STATUS_IS_OK(status)) {
667 return status;
668 }
669 if (!NT_STATUS_IS_OK(result)) {
670 return result;
671 }
672
673 /*
674 * Step #1: Get a list of user rids that are the members of the group.
675 */
676 status = dcerpc_samr_QueryGroupMember(b,
677 mem_ctx,
678 &group_policy,
679 &rids,
680 &result);
681 {
682 NTSTATUS _result;
683 dcerpc_samr_Close(b, mem_ctx, &group_policy, &_result);
684 }
685
686 if (!NT_STATUS_IS_OK(status)) {
687 return status;
688 }
689 if (!NT_STATUS_IS_OK(result)) {
690 return result;
691 }
692
693
694 if (rids == NULL || rids->count == 0) {
695 pnum_names = 0;
696 pnames = NULL;
697 pname_types = NULL;
698 psid_mem = NULL;
699
700 return NT_STATUS_OK;
701 }
702
703 num_names = rids->count;
704 rid_mem = rids->rids;
705
706 break;
707 }
708 case SID_NAME_WKN_GRP:
709 case SID_NAME_ALIAS:
710 {
711 struct lsa_SidArray sid_array;
712 struct lsa_SidPtr sid_ptr;
713 struct samr_Ids rids_query;
714
715 sid_ptr.sid = dom_sid_dup(mem_ctx, group_sid);
716 if (sid_ptr.sid == NULL) {
717 return NT_STATUS_NO_MEMORY;
718 }
719
720 sid_array.num_sids = 1;
721 sid_array.sids = &sid_ptr;
722
723 status = dcerpc_samr_GetAliasMembership(b,
724 mem_ctx,
725 samr_policy,
726 &sid_array,
727 &rids_query,
728 &result);
729 if (!NT_STATUS_IS_OK(status)) {
730 return status;
731 }
732 if (!NT_STATUS_IS_OK(result)) {
733 return result;
734 }
735
736 if (rids_query.count == 0) {
737 pnum_names = 0;
738 pnames = NULL;
739 pname_types = NULL;
740 psid_mem = NULL;
741
742 return NT_STATUS_OK;
743 }
744
745 num_names = rids_query.count;
746 rid_mem = rids_query.ids;
747
748 break;
749 }
750 default:
751 return NT_STATUS_UNSUCCESSFUL;
752 }
753
754 /*
755 * Step #2: Convert list of rids into list of usernames.
756 */
757 if (num_names > 0) {
758 names = talloc_zero_array(mem_ctx, char *, num_names);
759 name_types = talloc_zero_array(mem_ctx, uint32_t, num_names);
760 sid_mem = talloc_zero_array(mem_ctx, struct dom_sid, num_names);
761 if (names == NULL || name_types == NULL || sid_mem == NULL) {
762 return NT_STATUS_NO_MEMORY;
763 }
764 }
765
766 for (j = 0; j < num_names; j++) {
767 sid_compose(&sid_mem[j], domain_sid, rid_mem[j]);
768 }
769
770 status = dcerpc_samr_LookupRids(b,
771 mem_ctx,
772 samr_policy,
773 num_names,
774 rid_mem,
775 &tmp_names,
776 &tmp_types,
777 &result);
778 if (!NT_STATUS_IS_OK(status)) {
779 return status;
780 }
781
782 if (!NT_STATUS_IS_OK(result)) {
783 if (!NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
784 return result;
785 }
786 }
787
788 /* Copy result into array. The talloc system will take
789 care of freeing the temporary arrays later on. */
790 if (tmp_names.count != num_names) {
791 return NT_STATUS_INVALID_NETWORK_RESPONSE;
792 }
793 if (tmp_types.count != num_names) {
794 return NT_STATUS_INVALID_NETWORK_RESPONSE;
795 }
796
797 for (r = 0; r < tmp_names.count; r++) {
798 if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
799 continue;
800 }
801 if (total_names >= num_names) {
802 break;
803 }
804 names[total_names] = fill_domain_username_talloc(names,
805 domain_name,
806 tmp_names.names[r].string,
807 true);
808 if (names[total_names] == NULL) {
809 return NT_STATUS_NO_MEMORY;
810 }
811 name_types[total_names] = tmp_types.ids[r];
812 total_names++;
813 }
814
815 *pnum_names = total_names;
816 *pnames = names;
817 *pname_types = name_types;
818 *psid_mem = sid_mem;
819
820 return NT_STATUS_OK;
821 }
822
823 /* Find the sequence number for a domain */
824 NTSTATUS rpc_sequence_number(TALLOC_CTX *mem_ctx,
825 struct rpc_pipe_client *samr_pipe,
826 struct policy_handle *samr_policy,
827 const char *domain_name,
828 uint32_t *pseq)
829 {
830 union samr_DomainInfo *info = NULL;
831 bool got_seq_num = false;
832 NTSTATUS status, result;
833 struct dcerpc_binding_handle *b = samr_pipe->binding_handle;
834
835 /* query domain info */
836 status = dcerpc_samr_QueryDomainInfo(b,
837 mem_ctx,
838 samr_policy,
839 8,
840 &info,
841 &result);
842 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
843 *pseq = info->info8.sequence_num;
844 got_seq_num = true;
845 goto seq_num;
846 }
847
848 /* retry with info-level 2 in case the dc does not support info-level 8
849 * (like all older samba2 and samba3 dc's) - Guenther */
850 status = dcerpc_samr_QueryDomainInfo(b,
851 mem_ctx,
852 samr_policy,
853 2,
854 &info,
855 &result);
856 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
857 *pseq = info->general.sequence_num;
858 got_seq_num = true;
859 goto seq_num;
860 }
861
862 if (!NT_STATUS_IS_OK(status)) {
863 goto seq_num;
864 }
865
866 status = result;
867
868 seq_num:
869 if (got_seq_num) {
870 DEBUG(10,("domain_sequence_number: for domain %s is %u\n",
871 domain_name, (unsigned) *pseq));
872 } else {
873 DEBUG(10,("domain_sequence_number: failed to get sequence "
874 "number (%u) for domain %s\n",
875 (unsigned) *pseq, domain_name ));
876 status = NT_STATUS_OK;
877 }
878
879 return status;
880 }
881
882 /* Get a list of trusted domains */
883 NTSTATUS rpc_trusted_domains(TALLOC_CTX *mem_ctx,
884 struct rpc_pipe_client *lsa_pipe,
885 struct policy_handle *lsa_policy,
886 uint32_t *pnum_trusts,
887 struct netr_DomainTrust **ptrusts)
888 {
889 struct netr_DomainTrust *array = NULL;
890 uint32_t enum_ctx = 0;
891 uint32_t count = 0;
892 NTSTATUS status, result;
893 struct dcerpc_binding_handle *b = lsa_pipe->binding_handle;
894
895 do {
896 struct lsa_DomainList dom_list;
897 struct lsa_DomainListEx dom_list_ex;
898 bool has_ex = false;
899 uint32_t i;
900
901 /*
902 * We don't run into deadlocks here, cause winbind_off() is
903 * called in the main function.
904 */
905 status = dcerpc_lsa_EnumTrustedDomainsEx(b,
906 mem_ctx,
907 lsa_policy,
908 &enum_ctx,
909 &dom_list_ex,
910 (uint32_t) -1,
911 &result);
912 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_ERR(result) &&
913 dom_list_ex.count > 0) {
914 count += dom_list_ex.count;
915 has_ex = true;
916 } else {
917 status = dcerpc_lsa_EnumTrustDom(b,
918 mem_ctx,
919 lsa_policy,
920 &enum_ctx,
921 &dom_list,
922 (uint32_t) -1,
923 &result);
924 if (!NT_STATUS_IS_OK(status)) {
925 return status;
926 }
927 if (!NT_STATUS_IS_OK(result)) {
928 if (!NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
929 return result;
930 }
931 }
932
933 count += dom_list.count;
934 }
935
936 array = talloc_realloc(mem_ctx,
937 array,
938 struct netr_DomainTrust,
939 count);
940 if (array == NULL) {
941 return NT_STATUS_NO_MEMORY;
942 }
943
944 for (i = 0; i < count; i++) {
945 struct netr_DomainTrust *trust = &array[i];
946 struct dom_sid *sid;
947
948 ZERO_STRUCTP(trust);
949
950 sid = talloc(array, struct dom_sid);
951 if (sid == NULL) {
952 return NT_STATUS_NO_MEMORY;
953 }
954
955 if (dom_list_ex.domains[i].sid == NULL) {
956 DBG_ERR("Trusted domain %s has no SID, "
957 "skipping!\n",
958 trust->dns_name);
959 continue;
960 }
961
962 if (has_ex) {
963 trust->netbios_name = talloc_move(array,
964 &dom_list_ex.domains[i].netbios_name.string);
965 trust->dns_name = talloc_move(array,
966 &dom_list_ex.domains[i].domain_name.string);
967 sid_copy(sid, dom_list_ex.domains[i].sid);
968 } else {
969 trust->netbios_name = talloc_move(array,
970 &dom_list.domains[i].name.string);
971 trust->dns_name = NULL;
972
973 sid_copy(sid, dom_list.domains[i].sid);
974 }
975
976 trust->sid = sid;
977 }
978 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
979
980 *pnum_trusts = count;
981 *ptrusts = array;
982
983 return NT_STATUS_OK;
984 }
985
986 static NTSTATUS rpc_try_lookup_sids3(TALLOC_CTX *mem_ctx,
987 struct winbindd_domain *domain,
988 struct rpc_pipe_client *cli,
989 struct lsa_SidArray *sids,
990 struct lsa_RefDomainList **pdomains,
991 struct lsa_TransNameArray **pnames)
992 {
993 struct lsa_TransNameArray2 lsa_names2;
994 struct lsa_TransNameArray *names = *pnames;
995 uint32_t i, count = 0;
996 NTSTATUS status, result;
997
998 ZERO_STRUCT(lsa_names2);
999 status = dcerpc_lsa_LookupSids3(cli->binding_handle,
1000 mem_ctx,
1001 sids,
1002 pdomains,
1003 &lsa_names2,
1004 LSA_LOOKUP_NAMES_ALL,
1005 &count,
1006 LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
1007 LSA_CLIENT_REVISION_2,
1008 &result);
1009 if (!NT_STATUS_IS_OK(status)) {
1010 return status;
1011 }
1012 if (NT_STATUS_LOOKUP_ERR(result)) {
1013 return result;
1014 }
1015 if (sids->num_sids != lsa_names2.count) {
1016 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1017 }
1018
1019 names->count = lsa_names2.count;
1020 names->names = talloc_array(names, struct lsa_TranslatedName,
1021 names->count);
1022 if (names->names == NULL) {
1023 return NT_STATUS_NO_MEMORY;
1024 }
1025 for (i=0; i<names->count; i++) {
1026 names->names[i].sid_type = lsa_names2.names[i].sid_type;
1027 names->names[i].name.string = talloc_move(
1028 names->names, &lsa_names2.names[i].name.string);
1029 names->names[i].sid_index = lsa_names2.names[i].sid_index;
1030
1031 if (names->names[i].sid_index == UINT32_MAX) {
1032 continue;
1033 }
1034 if ((*pdomains) == NULL) {
1035 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1036 }
1037 if (names->names[i].sid_index >= (*pdomains)->count) {
1038 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1039 }
1040 }
1041 return NT_STATUS_OK;
1042 }
1043
1044 NTSTATUS rpc_lookup_sids(TALLOC_CTX *mem_ctx,
1045 struct winbindd_domain *domain,
1046 struct lsa_SidArray *sids,
1047 struct lsa_RefDomainList **pdomains,
1048 struct lsa_TransNameArray **pnames)
1049 {
1050 struct lsa_TransNameArray *names = *pnames;
1051 struct rpc_pipe_client *cli = NULL;
1052 struct policy_handle lsa_policy;
1053 uint32_t count;
1054 uint32_t i;
1055 NTSTATUS status, result;
1056
1057 status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
1058 if (!NT_STATUS_IS_OK(status)) {
1059 return status;
1060 }
1061
1062 if (cli->transport->transport == NCACN_IP_TCP) {
1063 return rpc_try_lookup_sids3(mem_ctx, domain, cli, sids,
1064 pdomains, pnames);
1065 }
1066
1067 status = dcerpc_lsa_LookupSids(cli->binding_handle, mem_ctx,
1068 &lsa_policy, sids, pdomains,
1069 names, LSA_LOOKUP_NAMES_ALL,
1070 &count, &result);
1071 if (!NT_STATUS_IS_OK(status)) {
1072 return status;
1073 }
1074 if (NT_STATUS_LOOKUP_ERR(result)) {
1075 return result;
1076 }
1077
1078 if (sids->num_sids != names->count) {
1079 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1080 }
1081
1082 for (i=0; i < names->count; i++) {
1083 if (names->names[i].sid_index == UINT32_MAX) {
1084 continue;
1085 }
1086 if ((*pdomains) == NULL) {
1087 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1088 }
1089 if (names->names[i].sid_index >= (*pdomains)->count) {
1090 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1091 }
1092 }
1093
1094 return NT_STATUS_OK;
1095 }
Samba GIT mirror