source3/utils/net_rpc.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    Distributed SMB/CIFS Server Management Utility
   4    Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
   5    Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
   6    Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
   7    Copyright (C) 2005 Jeremy Allison (jra@samba.org)
   8    Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  22
  23 #include "includes.h"
  24 #include "utils/net.h"
  25 #include "rpc_client/cli_pipe.h"
  26 #include "../libcli/auth/libcli_auth.h"
  27 #include "../librpc/gen_ndr/ndr_samr_c.h"
  28 #include "rpc_client/cli_samr.h"
  29 #include "rpc_client/init_samr.h"
  30 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  31 #include "rpc_client/cli_lsarpc.h"
  32 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
  33 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss.h"
  35 #include "../librpc/gen_ndr/ndr_initshutdown_c.h"
  36 #include "../librpc/gen_ndr/ndr_winreg_c.h"
  37 #include "secrets.h"
  38 #include "lib/netapi/netapi.h"
  39 #include "lib/netapi/netapi_net.h"
  40 #include "librpc/gen_ndr/libnet_join.h"
  41 #include "libnet/libnet_join.h"
  42 #include "rpc_client/init_lsa.h"
  43 #include "../libcli/security/security.h"
  44 #include "libsmb/libsmb.h"
  45 #include "libsmb/clirap.h"
  46 #include "nsswitch/libwbclient/wbclient.h"
  47 #include "passdb.h"
  48 #include "../libcli/smb/smbXcli_base.h"
  49
  50 static int net_mode_share;
  51 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask);
  52
  53 /**
  54  * @file net_rpc.c
  55  *
  56  * @brief RPC based subcommands for the 'net' utility.
  57  *
  58  * This file should contain much of the functionality that used to
  59  * be found in rpcclient, execpt that the commands should change
  60  * less often, and the fucntionality should be sane (the user is not
  61  * expected to know a rid/sid before they conduct an operation etc.)
  62  *
  63  * @todo Perhaps eventually these should be split out into a number
  64  * of files, as this could get quite big.
  65  **/
  66
  67
  68 /**
  69  * Many of the RPC functions need the domain sid.  This function gets
  70  *  it at the start of every run
  71  *
  72  * @param cli A cli_state already connected to the remote machine
  73  *
  74  * @return The Domain SID of the remote machine.
  75  **/
  76
  77 NTSTATUS net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx,
  78                                    struct dom_sid **domain_sid,
  79                                    const char **domain_name)
  80 {
  81         struct rpc_pipe_client *lsa_pipe = NULL;
  82         struct policy_handle pol;
  83         NTSTATUS status, result;
  84         union lsa_PolicyInformation *info = NULL;
  85         struct dcerpc_binding_handle *b;
  86
  87         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
  88                                           &lsa_pipe);
  89         if (!NT_STATUS_IS_OK(status)) {
  90                 d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
  91                 return status;
  92         }
  93
  94         b = lsa_pipe->binding_handle;
  95
  96         status = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
  97                                      SEC_FLAG_MAXIMUM_ALLOWED,
  98                                      &pol);
  99         if (!NT_STATUS_IS_OK(status)) {
 100                 d_fprintf(stderr, "open_policy %s: %s\n",
 101                           _("failed"),
 102                           nt_errstr(status));
 103                 return status;
 104         }
 105
 106         status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
 107                                             &pol,
 108                                             LSA_POLICY_INFO_ACCOUNT_DOMAIN,
 109                                             &info,
 110                                             &result);
 111         if (!NT_STATUS_IS_OK(status)) {
 112                 d_fprintf(stderr, "lsaquery %s: %s\n",
 113                           _("failed"),
 114                           nt_errstr(status));
 115                 return status;
 116         }
 117         if (!NT_STATUS_IS_OK(result)) {
 118                 d_fprintf(stderr, "lsaquery %s: %s\n",
 119                           _("failed"),
 120                           nt_errstr(result));
 121                 return result;
 122         }
 123
 124         *domain_name = info->account_domain.name.string;
 125         *domain_sid = info->account_domain.sid;
 126
 127         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 128         TALLOC_FREE(lsa_pipe);
 129
 130         return NT_STATUS_OK;
 131 }
 132
 133 /**
 134  * Run a single RPC command, from start to finish.
 135  *
 136  * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
 137  * @param conn_flag a NET_FLAG_ combination.  Passed to
 138  *                   net_make_ipc_connection.
 139  * @param argc  Standard main() style argc.
 140  * @param argv  Standard main() style argv. Initial components are already
 141  *              stripped.
 142  * @return A shell status integer (0 for success).
 143  */
 144
 145 int run_rpc_command(struct net_context *c,
 146                         struct cli_state *cli_arg,
 147                         const struct ndr_interface_table *table,
 148                         int conn_flags,
 149                         rpc_command_fn fn,
 150                         int argc,
 151                         const char **argv)
 152 {
 153         struct cli_state *cli = NULL;
 154         struct rpc_pipe_client *pipe_hnd = NULL;
 155         TALLOC_CTX *mem_ctx;
 156         NTSTATUS nt_status;
 157         struct dom_sid *domain_sid;
 158         const char *domain_name;
 159         int ret = -1;
 160
 161         /* make use of cli_state handed over as an argument, if possible */
 162         if (!cli_arg) {
 163                 nt_status = net_make_ipc_connection(c, conn_flags, &cli);
 164                 if (!NT_STATUS_IS_OK(nt_status)) {
 165                         DEBUG(1, ("failed to make ipc connection: %s\n",
 166                                   nt_errstr(nt_status)));
 167                         return -1;
 168                 }
 169         } else {
 170                 cli = cli_arg;
 171         }
 172
 173         if (!cli) {
 174                 return -1;
 175         }
 176
 177         /* Create mem_ctx */
 178
 179         if (!(mem_ctx = talloc_init("run_rpc_command"))) {
 180                 DEBUG(0, ("talloc_init() failed\n"));
 181                 goto fail;
 182         }
 183
 184         nt_status = net_get_remote_domain_sid(cli, mem_ctx, &domain_sid,
 185                                               &domain_name);
 186         if (!NT_STATUS_IS_OK(nt_status)) {
 187                 goto fail;
 188         }
 189
 190         if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
 191                 if (lp_client_schannel()
 192                     && (ndr_syntax_id_equal(&table->syntax_id,
 193                                             &ndr_table_netlogon.syntax_id))) {
 194                         /* Always try and create an schannel netlogon pipe. */
 195                         TALLOC_FREE(c->netlogon_creds);
 196                         nt_status = cli_rpc_pipe_open_schannel(
 197                                 cli, c->msg_ctx, table, NCACN_NP,
 198                                 DCERPC_AUTH_LEVEL_PRIVACY, domain_name,
 199                                 &pipe_hnd, c, &c->netlogon_creds);
 200                         if (!NT_STATUS_IS_OK(nt_status)) {
 201                                 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
 202                                         nt_errstr(nt_status) ));
 203                                 goto fail;
 204                         }
 205                 } else {
 206                         if (conn_flags & NET_FLAGS_SEAL) {
 207                                 nt_status = cli_rpc_pipe_open_generic_auth(
 208                                         cli, table,
 209                                         (conn_flags & NET_FLAGS_TCP) ?
 210                                         NCACN_IP_TCP : NCACN_NP,
 211                                         CRED_DONT_USE_KERBEROS,
 212                                         DCERPC_AUTH_TYPE_NTLMSSP,
 213                                         DCERPC_AUTH_LEVEL_PRIVACY,
 214                                         smbXcli_conn_remote_name(cli->conn),
 215                                         lp_workgroup(), c->opt_user_name,
 216                                         c->opt_password, &pipe_hnd);
 217                         } else {
 218                                 nt_status = cli_rpc_pipe_open_noauth(
 219                                         cli, table,
 220                                         &pipe_hnd);
 221                         }
 222                         if (!NT_STATUS_IS_OK(nt_status)) {
 223                                 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
 224                                           table->name,
 225                                         nt_errstr(nt_status) ));
 226                                 goto fail;
 227                         }
 228                 }
 229         }
 230
 231         nt_status = fn(c, domain_sid, domain_name, cli, pipe_hnd, mem_ctx, argc, argv);
 232
 233         if (!NT_STATUS_IS_OK(nt_status)) {
 234                 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
 235         } else {
 236                 ret = 0;
 237                 DEBUG(5, ("rpc command function succedded\n"));
 238         }
 239
 240         if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
 241                 if (pipe_hnd) {
 242                         TALLOC_FREE(pipe_hnd);
 243                 }
 244         }
 245
 246 fail:
 247         /* close the connection only if it was opened here */
 248         if (!cli_arg) {
 249                 cli_shutdown(cli);
 250         }
 251
 252         talloc_destroy(mem_ctx);
 253         return ret;
 254 }
 255
 256 /**
 257  * Force a change of the trust acccount password.
 258  *
 259  * All parameters are provided by the run_rpc_command function, except for
 260  * argc, argv which are passed through.
 261  *
 262  * @param domain_sid The domain sid acquired from the remote server.
 263  * @param cli A cli_state connected to the server.
 264  * @param mem_ctx Talloc context, destroyed on completion of the function.
 265  * @param argc  Standard main() style argc.
 266  * @param argv  Standard main() style argv. Initial components are already
 267  *              stripped.
 268  *
 269  * @return Normal NTSTATUS return.
 270  **/
 271
 272 static NTSTATUS rpc_changetrustpw_internals(struct net_context *c,
 273                                         const struct dom_sid *domain_sid,
 274                                         const char *domain_name,
 275                                         struct cli_state *cli,
 276                                         struct rpc_pipe_client *pipe_hnd,
 277                                         TALLOC_CTX *mem_ctx,
 278                                         int argc,
 279                                         const char **argv)
 280 {
 281         NTSTATUS status;
 282
 283         status = trust_pw_change(c->netlogon_creds,
 284                                  c->msg_ctx,
 285                                  pipe_hnd->binding_handle,
 286                                  c->opt_target_workgroup,
 287                                  true); /* force */
 288         if (!NT_STATUS_IS_OK(status)) {
 289                 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
 290                         nt_errstr(status));
 291                 return status;
 292         }
 293
 294         return NT_STATUS_OK;
 295 }
 296
 297 /**
 298  * Force a change of the trust acccount password.
 299  *
 300  * @param argc  Standard main() style argc.
 301  * @param argv  Standard main() style argv. Initial components are already
 302  *              stripped.
 303  *
 304  * @return A shell status integer (0 for success).
 305  **/
 306
 307 int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv)
 308 {
 309         if (c->display_usage) {
 310                 d_printf(  "%s\n"
 311                            "net rpc changetrustpw\n"
 312                            "    %s\n",
 313                          _("Usage:"),
 314                          _("Change the machine trust password"));
 315                 return 0;
 316         }
 317
 318         return run_rpc_command(c, NULL, &ndr_table_netlogon,
 319                                NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
 320                                rpc_changetrustpw_internals,
 321                                argc, argv);
 322 }
 323
 324 /**
 325  * Join a domain, the old way.  This function exists to allow
 326  * the message to be displayed when oldjoin was explicitly
 327  * requested, but not when it was implied by "net rpc join".
 328  *
 329  * This uses 'machinename' as the inital password, and changes it.
 330  *
 331  * The password should be created with 'server manager' or equiv first.
 332  *
 333  * @param argc  Standard main() style argc.
 334  * @param argv  Standard main() style argv. Initial components are already
 335  *              stripped.
 336  *
 337  * @return A shell status integer (0 for success).
 338  **/
 339
 340 static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
 341 {
 342         struct libnet_JoinCtx *r = NULL;
 343         TALLOC_CTX *mem_ctx;
 344         WERROR werr;
 345         const char *domain = lp_workgroup(); /* FIXME */
 346         bool modify_config = lp_config_backend_is_registry();
 347         enum netr_SchannelType sec_chan_type;
 348         char *pw = NULL;
 349
 350         if (c->display_usage) {
 351                 d_printf("Usage:\n"
 352                          "net rpc oldjoin\n"
 353                          "    Join a domain the old way\n");
 354                 return 0;
 355         }
 356
 357         mem_ctx = talloc_init("net_rpc_oldjoin");
 358         if (!mem_ctx) {
 359                 return -1;
 360         }
 361
 362         werr = libnet_init_JoinCtx(mem_ctx, &r);
 363         if (!W_ERROR_IS_OK(werr)) {
 364                 goto fail;
 365         }
 366
 367         /*
 368            check what type of join - if the user want's to join as
 369            a BDC, the server must agree that we are a BDC.
 370         */
 371         if (argc >= 0) {
 372                 sec_chan_type = get_sec_channel_type(argv[0]);
 373         } else {
 374                 sec_chan_type = get_sec_channel_type(NULL);
 375         }
 376
 377         if (!c->msg_ctx) {
 378                 d_fprintf(stderr, _("Could not initialise message context. "
 379                         "Try running as root\n"));
 380                 werr = WERR_ACCESS_DENIED;
 381                 goto fail;
 382         }
 383
 384         pw = talloc_strndup(r, lp_netbios_name(), 14);
 385         if (pw == NULL) {
 386                 werr = WERR_NOMEM;
 387                 goto fail;
 388         }
 389
 390         r->in.msg_ctx                   = c->msg_ctx;
 391         r->in.domain_name               = domain;
 392         r->in.secure_channel_type       = sec_chan_type;
 393         r->in.dc_name                   = c->opt_host;
 394         r->in.admin_account             = "";
 395         r->in.admin_password            = strlower_talloc(r, pw);
 396         if (r->in.admin_password == NULL) {
 397                 werr = WERR_NOMEM;
 398                 goto fail;
 399         }
 400         r->in.debug                     = true;
 401         r->in.modify_config             = modify_config;
 402         r->in.join_flags                = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
 403                                           WKSSVC_JOIN_FLAGS_JOIN_UNSECURE |
 404                                           WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED;
 405
 406         werr = libnet_Join(mem_ctx, r);
 407         if (!W_ERROR_IS_OK(werr)) {
 408                 goto fail;
 409         }
 410
 411         /* Check the short name of the domain */
 412
 413         if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
 414                 d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
 415                 d_printf("domain name obtained from the server.\n");
 416                 d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
 417                 d_printf("You should set \"workgroup = %s\" in %s.\n",
 418                          r->out.netbios_domain_name, get_dyn_CONFIGFILE());
 419         }
 420
 421         d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
 422
 423         if (r->out.dns_domain_name) {
 424                 d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
 425                         r->out.dns_domain_name);
 426         } else {
 427                 d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
 428                         r->out.netbios_domain_name);
 429         }
 430
 431         TALLOC_FREE(mem_ctx);
 432
 433         return 0;
 434
 435 fail:
 436         if (c->opt_flags & NET_FLAGS_EXPECT_FALLBACK) {
 437                 goto cleanup;
 438         }
 439
 440         /* issue an overall failure message at the end. */
 441         d_fprintf(stderr, _("Failed to join domain: %s\n"),
 442                 r && r->out.error_string ? r->out.error_string :
 443                 get_friendly_werror_msg(werr));
 444
 445 cleanup:
 446         TALLOC_FREE(mem_ctx);
 447
 448         return -1;
 449 }
 450
 451 /**
 452  * check that a join is OK
 453  *
 454  * @return A shell status integer (0 for success)
 455  *
 456  **/
 457 int net_rpc_testjoin(struct net_context *c, int argc, const char **argv)
 458 {
 459         NTSTATUS status;
 460         TALLOC_CTX *mem_ctx;
 461         const char *domain = c->opt_target_workgroup;
 462         const char *dc = c->opt_host;
 463
 464         if (c->display_usage) {
 465                 d_printf("Usage\n"
 466                          "net rpc testjoin\n"
 467                          "    Test if a join is OK\n");
 468                 return 0;
 469         }
 470
 471         mem_ctx = talloc_init("net_rpc_testjoin");
 472         if (!mem_ctx) {
 473                 return -1;
 474         }
 475
 476         if (!dc) {
 477                 struct netr_DsRGetDCNameInfo *info;
 478
 479                 if (!c->msg_ctx) {
 480                         d_fprintf(stderr, _("Could not initialise message context. "
 481                                 "Try running as root\n"));
 482                         talloc_destroy(mem_ctx);
 483                         return -1;
 484                 }
 485
 486                 status = dsgetdcname(mem_ctx,
 487                                      c->msg_ctx,
 488                                      domain,
 489                                      NULL,
 490                                      NULL,
 491                                      DS_RETURN_DNS_NAME,
 492                                      &info);
 493                 if (!NT_STATUS_IS_OK(status)) {
 494                         talloc_destroy(mem_ctx);
 495                         return -1;
 496                 }
 497
 498                 dc = strip_hostname(info->dc_unc);
 499         }
 500
 501         /* Display success or failure */
 502         status = libnet_join_ok(c->msg_ctx,
 503                                 c->opt_workgroup,
 504                                 dc,
 505                                 c->opt_kerberos);
 506         if (!NT_STATUS_IS_OK(status)) {
 507                 fprintf(stderr,"Join to domain '%s' is not valid: %s\n",
 508                         domain, nt_errstr(status));
 509                 talloc_destroy(mem_ctx);
 510                 return -1;
 511         }
 512
 513         printf("Join to '%s' is OK\n",domain);
 514         talloc_destroy(mem_ctx);
 515
 516         return 0;
 517 }
 518
 519 /**
 520  * Join a domain using the administrator username and password
 521  *
 522  * @param argc  Standard main() style argc
 523  * @param argc  Standard main() style argv.  Initial components are already
 524  *              stripped.  Currently not used.
 525  * @return A shell status integer (0 for success)
 526  *
 527  **/
 528
 529 static int net_rpc_join_newstyle(struct net_context *c, int argc, const char **argv)
 530 {
 531         struct libnet_JoinCtx *r = NULL;
 532         TALLOC_CTX *mem_ctx;
 533         WERROR werr;
 534         const char *domain = lp_workgroup(); /* FIXME */
 535         bool modify_config = lp_config_backend_is_registry();
 536         enum netr_SchannelType sec_chan_type;
 537
 538         if (c->display_usage) {
 539                 d_printf("Usage:\n"
 540                          "net rpc join\n"
 541                          "    Join a domain the new way\n");
 542                 return 0;
 543         }
 544
 545         mem_ctx = talloc_init("net_rpc_join_newstyle");
 546         if (!mem_ctx) {
 547                 return -1;
 548         }
 549
 550         werr = libnet_init_JoinCtx(mem_ctx, &r);
 551         if (!W_ERROR_IS_OK(werr)) {
 552                 goto fail;
 553         }
 554
 555         /*
 556            check what type of join - if the user want's to join as
 557            a BDC, the server must agree that we are a BDC.
 558         */
 559         if (argc >= 0) {
 560                 sec_chan_type = get_sec_channel_type(argv[0]);
 561         } else {
 562                 sec_chan_type = get_sec_channel_type(NULL);
 563         }
 564
 565         if (!c->msg_ctx) {
 566                 d_fprintf(stderr, _("Could not initialise message context. "
 567                         "Try running as root\n"));
 568                 werr = WERR_ACCESS_DENIED;
 569                 goto fail;
 570         }
 571
 572         r->in.msg_ctx                   = c->msg_ctx;
 573         r->in.domain_name               = domain;
 574         r->in.secure_channel_type       = sec_chan_type;
 575         r->in.dc_name                   = c->opt_host;
 576         r->in.admin_account             = c->opt_user_name;
 577         r->in.admin_password            = net_prompt_pass(c, c->opt_user_name);
 578         r->in.debug                     = true;
 579         r->in.use_kerberos              = c->opt_kerberos;
 580         r->in.modify_config             = modify_config;
 581         r->in.join_flags                = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
 582                                           WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
 583                                           WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
 584
 585         werr = libnet_Join(mem_ctx, r);
 586         if (!W_ERROR_IS_OK(werr)) {
 587                 goto fail;
 588         }
 589
 590         /* Check the short name of the domain */
 591
 592         if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
 593                 d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
 594                 d_printf("domain name obtained from the server.\n");
 595                 d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
 596                 d_printf("You should set \"workgroup = %s\" in %s.\n",
 597                          r->out.netbios_domain_name, get_dyn_CONFIGFILE());
 598         }
 599
 600         d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
 601
 602         if (r->out.dns_domain_name) {
 603                 d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
 604                         r->out.dns_domain_name);
 605         } else {
 606                 d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
 607                         r->out.netbios_domain_name);
 608         }
 609
 610         TALLOC_FREE(mem_ctx);
 611
 612         return 0;
 613
 614 fail:
 615         /* issue an overall failure message at the end. */
 616         d_printf("Failed to join domain: %s\n",
 617                 r && r->out.error_string ? r->out.error_string :
 618                 get_friendly_werror_msg(werr));
 619
 620         TALLOC_FREE(mem_ctx);
 621
 622         return -1;
 623 }
 624
 625 /**
 626  * 'net rpc join' entrypoint.
 627  * @param argc  Standard main() style argc.
 628  * @param argv  Standard main() style argv. Initial components are already
 629  *              stripped
 630  *
 631  * Main 'net_rpc_join()' (where the admin username/password is used) is
 632  * in net_rpc_join.c.
 633  * Try to just change the password, but if that doesn't work, use/prompt
 634  * for a username/password.
 635  **/
 636
 637 int net_rpc_join(struct net_context *c, int argc, const char **argv)
 638 {
 639         int ret;
 640
 641         if (c->display_usage) {
 642                 d_printf("%s\n%s",
 643                          _("Usage:"),
 644                          _("net rpc join -U <username>[%%password] <type>\n"
 645                            "  Join a domain\n"
 646                            "    username\tName of the admin user"
 647                            "    password\tPassword of the admin user, will "
 648                            "prompt if not specified\n"
 649                            "    type\tCan be one of the following:\n"
 650                            "\t\tMEMBER\tJoin as member server (default)\n"
 651                            "\t\tBDC\tJoin as BDC\n"
 652                            "\t\tPDC\tJoin as PDC\n"));
 653                 return 0;
 654         }
 655
 656         if (lp_server_role() == ROLE_STANDALONE) {
 657                 d_printf(_("cannot join as standalone machine\n"));
 658                 return -1;
 659         }
 660
 661         if (strlen(lp_netbios_name()) > 15) {
 662                 d_printf(_("Our netbios name can be at most 15 chars long, "
 663                            "\"%s\" is %u chars long\n"),
 664                          lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
 665                 return -1;
 666         }
 667
 668         c->opt_flags |= NET_FLAGS_EXPECT_FALLBACK;
 669         ret = net_rpc_oldjoin(c, argc, argv);
 670         c->opt_flags &= ~NET_FLAGS_EXPECT_FALLBACK;
 671         if (ret == 0) {
 672                 return 0;
 673         }
 674
 675         return net_rpc_join_newstyle(c, argc, argv);
 676 }
 677
 678 /**
 679  * display info about a rpc domain
 680  *
 681  * All parameters are provided by the run_rpc_command function, except for
 682  * argc, argv which are passed through.
 683  *
 684  * @param domain_sid The domain sid acquired from the remote server
 685  * @param cli A cli_state connected to the server.
 686  * @param mem_ctx Talloc context, destroyed on completion of the function.
 687  * @param argc  Standard main() style argc.
 688  * @param argv  Standard main() style argv. Initial components are already
 689  *              stripped.
 690  *
 691  * @return Normal NTSTATUS return.
 692  **/
 693
 694 NTSTATUS rpc_info_internals(struct net_context *c,
 695                         const struct dom_sid *domain_sid,
 696                         const char *domain_name,
 697                         struct cli_state *cli,
 698                         struct rpc_pipe_client *pipe_hnd,
 699                         TALLOC_CTX *mem_ctx,
 700                         int argc,
 701                         const char **argv)
 702 {
 703         struct policy_handle connect_pol, domain_pol;
 704         NTSTATUS status, result;
 705         union samr_DomainInfo *info = NULL;
 706         fstring sid_str;
 707         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 708
 709         sid_to_fstring(sid_str, domain_sid);
 710
 711         /* Get sam policy handle */
 712         status = dcerpc_samr_Connect2(b, mem_ctx,
 713                                       pipe_hnd->desthost,
 714                                       MAXIMUM_ALLOWED_ACCESS,
 715                                       &connect_pol,
 716                                       &result);
 717         if (!NT_STATUS_IS_OK(status)) {
 718                 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
 719                           nt_errstr(status));
 720                 goto done;
 721         }
 722
 723         if (!NT_STATUS_IS_OK(result)) {
 724                 status = result;
 725                 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
 726                           nt_errstr(result));
 727                 goto done;
 728         }
 729
 730         /* Get domain policy handle */
 731         status = dcerpc_samr_OpenDomain(b, mem_ctx,
 732                                         &connect_pol,
 733                                         MAXIMUM_ALLOWED_ACCESS,
 734                                         discard_const_p(struct dom_sid2, domain_sid),
 735                                         &domain_pol,
 736                                         &result);
 737         if (!NT_STATUS_IS_OK(status)) {
 738                 d_fprintf(stderr, _("Could not open domain: %s\n"),
 739                           nt_errstr(status));
 740                 goto done;
 741         }
 742         if (!NT_STATUS_IS_OK(result)) {
 743                 status = result;
 744                 d_fprintf(stderr, _("Could not open domain: %s\n"),
 745                           nt_errstr(result));
 746                 goto done;
 747         }
 748
 749         status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
 750                                              &domain_pol,
 751                                              2,
 752                                              &info,
 753                                              &result);
 754         if (!NT_STATUS_IS_OK(status)) {
 755                 goto done;
 756         }
 757         status = result;
 758         if (NT_STATUS_IS_OK(result)) {
 759                 d_printf(_("Domain Name: %s\n"),
 760                          info->general.domain_name.string);
 761                 d_printf(_("Domain SID: %s\n"), sid_str);
 762                 d_printf(_("Sequence number: %llu\n"),
 763                         (unsigned long long)info->general.sequence_num);
 764                 d_printf(_("Num users: %u\n"), info->general.num_users);
 765                 d_printf(_("Num domain groups: %u\n"),info->general.num_groups);
 766                 d_printf(_("Num local groups: %u\n"),info->general.num_aliases);
 767         }
 768
 769  done:
 770         return status;
 771 }
 772
 773 /**
 774  * 'net rpc info' entrypoint.
 775  * @param argc  Standard main() style argc.
 776  * @param argv  Standard main() style argv. Initial components are already
 777  *              stripped.
 778  **/
 779
 780 int net_rpc_info(struct net_context *c, int argc, const char **argv)
 781 {
 782         if (c->display_usage) {
 783                 d_printf(  "%s\n"
 784                            "net rpc info\n"
 785                            "  %s\n",
 786                          _("Usage:"),
 787                          _("Display information about the domain"));
 788                 return 0;
 789         }
 790
 791         return run_rpc_command(c, NULL, &ndr_table_samr,
 792                                NET_FLAGS_PDC, rpc_info_internals,
 793                                argc, argv);
 794 }
 795
 796 /**
 797  * Fetch domain SID into the local secrets.tdb.
 798  *
 799  * All parameters are provided by the run_rpc_command function, except for
 800  * argc, argv which are passed through.
 801  *
 802  * @param domain_sid The domain sid acquired from the remote server.
 803  * @param cli A cli_state connected to the server.
 804  * @param mem_ctx Talloc context, destroyed on completion of the function.
 805  * @param argc  Standard main() style argc.
 806  * @param argv  Standard main() style argv. Initial components are already
 807  *              stripped.
 808  *
 809  * @return Normal NTSTATUS return.
 810  **/
 811
 812 static NTSTATUS rpc_getsid_internals(struct net_context *c,
 813                         const struct dom_sid *domain_sid,
 814                         const char *domain_name,
 815                         struct cli_state *cli,
 816                         struct rpc_pipe_client *pipe_hnd,
 817                         TALLOC_CTX *mem_ctx,
 818                         int argc,
 819                         const char **argv)
 820 {
 821         fstring sid_str;
 822
 823         sid_to_fstring(sid_str, domain_sid);
 824         d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
 825                  sid_str, domain_name);
 826
 827         if (!secrets_store_domain_sid(domain_name, domain_sid)) {
 828                 DEBUG(0,("Can't store domain SID\n"));
 829                 return NT_STATUS_UNSUCCESSFUL;
 830         }
 831
 832         return NT_STATUS_OK;
 833 }
 834
 835 /**
 836  * 'net rpc getsid' entrypoint.
 837  * @param argc  Standard main() style argc.
 838  * @param argv  Standard main() style argv. Initial components are already
 839  *              stripped.
 840  **/
 841
 842 int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
 843 {
 844         int conn_flags = NET_FLAGS_PDC;
 845
 846         if (!c->opt_user_specified) {
 847                 conn_flags |= NET_FLAGS_ANONYMOUS;
 848         }
 849
 850         if (c->display_usage) {
 851                 d_printf(  "%s\n"
 852                            "net rpc getsid\n"
 853                            "    %s\n",
 854                          _("Usage:"),
 855                          _("Fetch domain SID into local secrets.tdb"));
 856                 return 0;
 857         }
 858
 859         return run_rpc_command(c, NULL, &ndr_table_samr,
 860                                conn_flags,
 861                                rpc_getsid_internals,
 862                                argc, argv);
 863 }
 864
 865 /****************************************************************************/
 866
 867 /**
 868  * Basic usage function for 'net rpc user'.
 869  * @param argc  Standard main() style argc.
 870  * @param argv  Standard main() style argv. Initial components are already
 871  *              stripped.
 872  **/
 873
 874 static int rpc_user_usage(struct net_context *c, int argc, const char **argv)
 875 {
 876         return net_user_usage(c, argc, argv);
 877 }
 878
 879 /**
 880  * Add a new user to a remote RPC server.
 881  *
 882  * @param argc  Standard main() style argc.
 883  * @param argv  Standard main() style argv. Initial components are already
 884  *              stripped.
 885  *
 886  * @return A shell status integer (0 for success).
 887  **/
 888
 889 static int rpc_user_add(struct net_context *c, int argc, const char **argv)
 890 {
 891         NET_API_STATUS status;
 892         struct USER_INFO_1 info1;
 893         uint32_t parm_error = 0;
 894
 895         if (argc < 1 || c->display_usage) {
 896                 rpc_user_usage(c, argc, argv);
 897                 return 0;
 898         }
 899
 900         ZERO_STRUCT(info1);
 901
 902         info1.usri1_name = argv[0];
 903         if (argc == 2) {
 904                 info1.usri1_password = argv[1];
 905         }
 906
 907         status = NetUserAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
 908
 909         if (status != 0) {
 910                 d_fprintf(stderr,_("Failed to add user '%s' with error: %s.\n"),
 911                         argv[0], libnetapi_get_error_string(c->netapi_ctx,
 912                                                             status));
 913                 return -1;
 914         } else {
 915                 d_printf(_("Added user '%s'.\n"), argv[0]);
 916         }
 917
 918         return 0;
 919 }
 920
 921 /**
 922  * Rename a user on a remote RPC server.
 923  *
 924  * @param argc  Standard main() style argc.
 925  * @param argv  Standard main() style argv. Initial components are already
 926  *              stripped.
 927  *
 928  * @return A shell status integer (0 for success).
 929  **/
 930
 931 static int rpc_user_rename(struct net_context *c, int argc, const char **argv)
 932 {
 933         NET_API_STATUS status;
 934         struct USER_INFO_0 u0;
 935         uint32_t parm_err = 0;
 936
 937         if (argc != 2 || c->display_usage) {
 938                 rpc_user_usage(c, argc, argv);
 939                 return 0;
 940         }
 941
 942         u0.usri0_name = argv[1];
 943
 944         status = NetUserSetInfo(c->opt_host, argv[0],
 945                                 0, (uint8_t *)&u0, &parm_err);
 946         if (status) {
 947                 d_fprintf(stderr,
 948                           _("Failed to rename user from %s to %s - %s\n"),
 949                           argv[0], argv[1],
 950                           libnetapi_get_error_string(c->netapi_ctx, status));
 951         } else {
 952                 d_printf(_("Renamed user from %s to %s\n"), argv[0], argv[1]);
 953         }
 954
 955         return status;
 956 }
 957
 958 /**
 959  * Set a user's primary group
 960  *
 961  * @param argc  Standard main() style argc.
 962  * @param argv  Standard main() style argv. Initial components are already
 963  *              stripped.
 964  *
 965  * @return A shell status integer (0 for success).
 966  **/
 967
 968 static int rpc_user_setprimarygroup(struct net_context *c, int argc,
 969                                     const char **argv)
 970 {
 971         NET_API_STATUS status;
 972         uint8_t *buffer;
 973         struct GROUP_INFO_2 *g2;
 974         struct USER_INFO_1051 u1051;
 975         uint32_t parm_err = 0;
 976
 977         if (argc != 2 || c->display_usage) {
 978                 rpc_user_usage(c, argc, argv);
 979                 return 0;
 980         }
 981
 982         status = NetGroupGetInfo(c->opt_host, argv[1], 2, &buffer);
 983         if (status) {
 984                 d_fprintf(stderr, _("Failed to find group name %s -- %s\n"),
 985                           argv[1],
 986                           libnetapi_get_error_string(c->netapi_ctx, status));
 987                 return status;
 988         }
 989         g2 = (struct GROUP_INFO_2 *)buffer;
 990
 991         u1051.usri1051_primary_group_id = g2->grpi2_group_id;
 992
 993         NetApiBufferFree(buffer);
 994
 995         status = NetUserSetInfo(c->opt_host, argv[0], 1051,
 996                                 (uint8_t *)&u1051, &parm_err);
 997         if (status) {
 998                 d_fprintf(stderr,
 999                           _("Failed to set user's primary group %s to %s - "
1000                             "%s\n"), argv[0], argv[1],
1001                           libnetapi_get_error_string(c->netapi_ctx, status));
1002         } else {
1003                 d_printf(_("Set primary group of user %s to %s\n"), argv[0],
1004                          argv[1]);
1005         }
1006         return status;
1007 }
1008
1009 /**
1010  * Delete a user from a remote RPC server.
1011  *
1012  * @param argc  Standard main() style argc.
1013  * @param argv  Standard main() style argv. Initial components are already
1014  *              stripped.
1015  *
1016  * @return A shell status integer (0 for success).
1017  **/
1018
1019 static int rpc_user_delete(struct net_context *c, int argc, const char **argv)
1020 {
1021         NET_API_STATUS status;
1022
1023         if (argc < 1 || c->display_usage) {
1024                 rpc_user_usage(c, argc, argv);
1025                 return 0;
1026         }
1027
1028         status = NetUserDel(c->opt_host, argv[0]);
1029
1030         if (status != 0) {
1031                 d_fprintf(stderr, _("Failed to delete user '%s' with: %s.\n"),
1032                           argv[0],
1033                           libnetapi_get_error_string(c->netapi_ctx, status));
1034                 return -1;
1035         } else {
1036                 d_printf(_("Deleted user '%s'.\n"), argv[0]);
1037         }
1038
1039         return 0;
1040 }
1041
1042 /**
1043  * Set a user's password on a remote RPC server.
1044  *
1045  * @param argc  Standard main() style argc.
1046  * @param argv  Standard main() style argv. Initial components are already
1047  *              stripped.
1048  *
1049  * @return A shell status integer (0 for success).
1050  **/
1051
1052 static int rpc_user_password(struct net_context *c, int argc, const char **argv)
1053 {
1054         NET_API_STATUS status;
1055         char *prompt = NULL;
1056         struct USER_INFO_1003 u1003;
1057         uint32_t parm_err = 0;
1058         int ret;
1059
1060         if (argc < 1 || c->display_usage) {
1061                 rpc_user_usage(c, argc, argv);
1062                 return 0;
1063         }
1064
1065         if (argv[1]) {
1066                 u1003.usri1003_password = argv[1];
1067         } else {
1068                 char pwd[256] = {0};
1069                 ret = asprintf(&prompt, _("Enter new password for %s:"),
1070                                argv[0]);
1071                 if (ret == -1) {
1072                         return -1;
1073                 }
1074
1075                 ret = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
1076                 SAFE_FREE(prompt);
1077                 if (ret < 0) {
1078                         return -1;
1079                 }
1080
1081                 u1003.usri1003_password = talloc_strdup(c, pwd);
1082                 if (u1003.usri1003_password == NULL) {
1083                         return -1;
1084                 }
1085         }
1086
1087         status = NetUserSetInfo(c->opt_host, argv[0], 1003, (uint8_t *)&u1003, &parm_err);
1088
1089         /* Display results */
1090         if (status != 0) {
1091                 d_fprintf(stderr,
1092                         _("Failed to set password for '%s' with error: %s.\n"),
1093                         argv[0], libnetapi_get_error_string(c->netapi_ctx,
1094                                                             status));
1095                 return -1;
1096         }
1097
1098         return 0;
1099 }
1100
1101 /**
1102  * List a user's groups from a remote RPC server.
1103  *
1104  * @param argc  Standard main() style argc.
1105  * @param argv  Standard main() style argv. Initial components are already
1106  *              stripped.
1107  *
1108  * @return A shell status integer (0 for success)
1109  **/
1110
1111 static int rpc_user_info(struct net_context *c, int argc, const char **argv)
1112
1113 {
1114         NET_API_STATUS status;
1115         struct GROUP_USERS_INFO_0 *u0 = NULL;
1116         uint32_t entries_read = 0;
1117         uint32_t total_entries = 0;
1118         int i;
1119
1120
1121         if (argc < 1 || c->display_usage) {
1122                 rpc_user_usage(c, argc, argv);
1123                 return 0;
1124         }
1125
1126         status = NetUserGetGroups(c->opt_host,
1127                                   argv[0],
1128                                   0,
1129                                   (uint8_t **)(void *)&u0,
1130                                   (uint32_t)-1,
1131                                   &entries_read,
1132                                   &total_entries);
1133         if (status != 0) {
1134                 d_fprintf(stderr,
1135                         _("Failed to get groups for '%s' with error: %s.\n"),
1136                         argv[0], libnetapi_get_error_string(c->netapi_ctx,
1137                                                             status));
1138                 return -1;
1139         }
1140
1141         for (i=0; i < entries_read; i++) {
1142                 printf("%s\n", u0->grui0_name);
1143                 u0++;
1144         }
1145
1146         return 0;
1147 }
1148
1149 /**
1150  * List users on a remote RPC server.
1151  *
1152  * All parameters are provided by the run_rpc_command function, except for
1153  * argc, argv which are passed through.
1154  *
1155  * @param domain_sid The domain sid acquired from the remote server.
1156  * @param cli A cli_state connected to the server.
1157  * @param mem_ctx Talloc context, destroyed on completion of the function.
1158  * @param argc  Standard main() style argc.
1159  * @param argv  Standard main() style argv. Initial components are already
1160  *              stripped.
1161  *
1162  * @return Normal NTSTATUS return.
1163  **/
1164
1165 static int rpc_user_list(struct net_context *c, int argc, const char **argv)
1166 {
1167         NET_API_STATUS status;
1168         uint32_t start_idx=0, num_entries, i, loop_count = 0;
1169         struct NET_DISPLAY_USER *info = NULL;
1170         void *buffer = NULL;
1171
1172         /* Query domain users */
1173         if (c->opt_long_list_entries)
1174                 d_printf(_("\nUser name             Comment"
1175                            "\n-----------------------------\n"));
1176         do {
1177                 uint32_t max_entries, max_size;
1178
1179                 dcerpc_get_query_dispinfo_params(
1180                         loop_count, &max_entries, &max_size);
1181
1182                 status = NetQueryDisplayInformation(c->opt_host,
1183                                                     1,
1184                                                     start_idx,
1185                                                     max_entries,
1186                                                     max_size,
1187                                                     &num_entries,
1188                                                     &buffer);
1189                 if (status != 0 && status != ERROR_MORE_DATA) {
1190                         return status;
1191                 }
1192
1193                 info = (struct NET_DISPLAY_USER *)buffer;
1194
1195                 for (i = 0; i < num_entries; i++) {
1196
1197                         if (c->opt_long_list_entries)
1198                                 printf("%-21.21s %s\n", info->usri1_name,
1199                                         info->usri1_comment);
1200                         else
1201                                 printf("%s\n", info->usri1_name);
1202                         info++;
1203                 }
1204
1205                 NetApiBufferFree(buffer);
1206
1207                 loop_count++;
1208                 start_idx += num_entries;
1209
1210         } while (status == ERROR_MORE_DATA);
1211
1212         return status;
1213 }
1214
1215 /**
1216  * 'net rpc user' entrypoint.
1217  * @param argc  Standard main() style argc.
1218  * @param argv  Standard main() style argv. Initial components are already
1219  *              stripped.
1220  **/
1221
1222 int net_rpc_user(struct net_context *c, int argc, const char **argv)
1223 {
1224         NET_API_STATUS status;
1225
1226         struct functable func[] = {
1227                 {
1228                         "add",
1229                         rpc_user_add,
1230                         NET_TRANSPORT_RPC,
1231                         N_("Add specified user"),
1232                         N_("net rpc user add\n"
1233                            "    Add specified user")
1234                 },
1235                 {
1236                         "info",
1237                         rpc_user_info,
1238                         NET_TRANSPORT_RPC,
1239                         N_("List domain groups of user"),
1240                         N_("net rpc user info\n"
1241                            "    List domain groups of user")
1242                 },
1243                 {
1244                         "delete",
1245                         rpc_user_delete,
1246                         NET_TRANSPORT_RPC,
1247                         N_("Remove specified user"),
1248                         N_("net rpc user delete\n"
1249                            "    Remove specified user")
1250                 },
1251                 {
1252                         "password",
1253                         rpc_user_password,
1254                         NET_TRANSPORT_RPC,
1255                         N_("Change user password"),
1256                         N_("net rpc user password\n"
1257                            "    Change user password")
1258                 },
1259                 {
1260                         "rename",
1261                         rpc_user_rename,
1262                         NET_TRANSPORT_RPC,
1263                         N_("Rename specified user"),
1264                         N_("net rpc user rename\n"
1265                            "    Rename specified user")
1266                 },
1267                 {
1268                         "setprimarygroup",
1269                         rpc_user_setprimarygroup,
1270                         NET_TRANSPORT_RPC,
1271                         "Set a user's primary group",
1272                         "net rpc user setprimarygroup\n"
1273                         "    Set a user's primary group"
1274                 },
1275                 {NULL, NULL, 0, NULL, NULL}
1276         };
1277
1278         status = libnetapi_net_init(&c->netapi_ctx);
1279         if (status != 0) {
1280                 return -1;
1281         }
1282         libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
1283         libnetapi_set_password(c->netapi_ctx, c->opt_password);
1284         if (c->opt_kerberos) {
1285                 libnetapi_set_use_kerberos(c->netapi_ctx);
1286         }
1287
1288         if (argc == 0) {
1289                 if (c->display_usage) {
1290                         d_printf(  "%s\n"
1291                                    "net rpc user\n"
1292                                    "    %s\n",
1293                                  _("Usage:"),
1294                                  _("List all users"));
1295                         net_display_usage_from_functable(func);
1296                         return 0;
1297                 }
1298
1299                 return rpc_user_list(c, argc, argv);
1300         }
1301
1302         return net_run_function(c, argc, argv, "net rpc user", func);
1303 }
1304
1305 static NTSTATUS rpc_sh_user_list(struct net_context *c,
1306                                  TALLOC_CTX *mem_ctx,
1307                                  struct rpc_sh_ctx *ctx,
1308                                  struct rpc_pipe_client *pipe_hnd,
1309                                  int argc, const char **argv)
1310 {
1311         return werror_to_ntstatus(W_ERROR(rpc_user_list(c, argc, argv)));
1312 }
1313
1314 static NTSTATUS rpc_sh_user_info(struct net_context *c,
1315                                  TALLOC_CTX *mem_ctx,
1316                                  struct rpc_sh_ctx *ctx,
1317                                  struct rpc_pipe_client *pipe_hnd,
1318                                  int argc, const char **argv)
1319 {
1320         return werror_to_ntstatus(W_ERROR(rpc_user_info(c, argc, argv)));
1321 }
1322
1323 static NTSTATUS rpc_sh_handle_user(struct net_context *c,
1324                                    TALLOC_CTX *mem_ctx,
1325                                    struct rpc_sh_ctx *ctx,
1326                                    struct rpc_pipe_client *pipe_hnd,
1327                                    int argc, const char **argv,
1328                                    NTSTATUS (*fn)(
1329                                            struct net_context *c,
1330                                            TALLOC_CTX *mem_ctx,
1331                                            struct rpc_sh_ctx *ctx,
1332                                            struct rpc_pipe_client *pipe_hnd,
1333                                            struct policy_handle *user_hnd,
1334                                            int argc, const char **argv))
1335 {
1336         struct policy_handle connect_pol, domain_pol, user_pol;
1337         NTSTATUS status, result;
1338         struct dom_sid sid;
1339         uint32 rid;
1340         enum lsa_SidType type;
1341         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1342
1343         if (argc == 0) {
1344                 d_fprintf(stderr, "%s %s <username>\n", _("Usage:"),
1345                           ctx->whoami);
1346                 return NT_STATUS_INVALID_PARAMETER;
1347         }
1348
1349         ZERO_STRUCT(connect_pol);
1350         ZERO_STRUCT(domain_pol);
1351         ZERO_STRUCT(user_pol);
1352
1353         status = net_rpc_lookup_name(c, mem_ctx, ctx->cli,
1354                                      argv[0], NULL, NULL, &sid, &type);
1355         if (!NT_STATUS_IS_OK(status)) {
1356                 d_fprintf(stderr, _("Could not lookup %s: %s\n"), argv[0],
1357                           nt_errstr(status));
1358                 goto done;
1359         }
1360
1361         if (type != SID_NAME_USER) {
1362                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
1363                           sid_type_lookup(type));
1364                 status = NT_STATUS_NO_SUCH_USER;
1365                 goto done;
1366         }
1367
1368         if (!sid_peek_check_rid(ctx->domain_sid, &sid, &rid)) {
1369                 d_fprintf(stderr, _("%s is not in our domain\n"), argv[0]);
1370                 status = NT_STATUS_NO_SUCH_USER;
1371                 goto done;
1372         }
1373
1374         status = dcerpc_samr_Connect2(b, mem_ctx,
1375                                       pipe_hnd->desthost,
1376                                       MAXIMUM_ALLOWED_ACCESS,
1377                                       &connect_pol,
1378                                       &result);
1379         if (!NT_STATUS_IS_OK(status)) {
1380                 goto done;
1381         }
1382         if (!NT_STATUS_IS_OK(result)) {
1383                 status = result;
1384                 goto done;
1385         }
1386
1387         status = dcerpc_samr_OpenDomain(b, mem_ctx,
1388                                         &connect_pol,
1389                                         MAXIMUM_ALLOWED_ACCESS,
1390                                         ctx->domain_sid,
1391                                         &domain_pol,
1392                                         &result);
1393         if (!NT_STATUS_IS_OK(status)) {
1394                 goto done;
1395         }
1396         if (!NT_STATUS_IS_OK(result)) {
1397                 status = result;
1398                 goto done;
1399         }
1400
1401         status = dcerpc_samr_OpenUser(b, mem_ctx,
1402                                       &domain_pol,
1403                                       MAXIMUM_ALLOWED_ACCESS,
1404                                       rid,
1405                                       &user_pol,
1406                                       &result);
1407         if (!NT_STATUS_IS_OK(status)) {
1408                 goto done;
1409         }
1410         if (!NT_STATUS_IS_OK(result)) {
1411                 status = result;
1412                 goto done;
1413         }
1414
1415         status = fn(c, mem_ctx, ctx, pipe_hnd, &user_pol, argc-1, argv+1);
1416
1417  done:
1418         if (is_valid_policy_hnd(&user_pol)) {
1419                 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1420         }
1421         if (is_valid_policy_hnd(&domain_pol)) {
1422                 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1423         }
1424         if (is_valid_policy_hnd(&connect_pol)) {
1425                 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
1426         }
1427         return status;
1428 }
1429
1430 static NTSTATUS rpc_sh_user_show_internals(struct net_context *c,
1431                                            TALLOC_CTX *mem_ctx,
1432                                            struct rpc_sh_ctx *ctx,
1433                                            struct rpc_pipe_client *pipe_hnd,
1434                                            struct policy_handle *user_hnd,
1435                                            int argc, const char **argv)
1436 {
1437         NTSTATUS status, result;
1438         union samr_UserInfo *info = NULL;
1439         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1440
1441         if (argc != 0) {
1442                 d_fprintf(stderr, "%s %s show <username>\n", _("Usage:"),
1443                           ctx->whoami);
1444                 return NT_STATUS_INVALID_PARAMETER;
1445         }
1446
1447         status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1448                                            user_hnd,
1449                                            21,
1450                                            &info,
1451                                            &result);
1452         if (!NT_STATUS_IS_OK(status)) {
1453                 return status;
1454         }
1455         if (!NT_STATUS_IS_OK(result)) {
1456                 return result;
1457         }
1458
1459         d_printf(_("user rid: %d, group rid: %d\n"),
1460                 info->info21.rid,
1461                 info->info21.primary_gid);
1462
1463         return result;
1464 }
1465
1466 static NTSTATUS rpc_sh_user_show(struct net_context *c,
1467                                  TALLOC_CTX *mem_ctx,
1468                                  struct rpc_sh_ctx *ctx,
1469                                  struct rpc_pipe_client *pipe_hnd,
1470                                  int argc, const char **argv)
1471 {
1472         return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1473                                   rpc_sh_user_show_internals);
1474 }
1475
1476 #define FETCHSTR(name, rec) \
1477 do { if (strequal(ctx->thiscmd, name)) { \
1478         oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1479 } while (0);
1480
1481 #define SETSTR(name, rec, flag) \
1482 do { if (strequal(ctx->thiscmd, name)) { \
1483         init_lsa_String(&(info->info21.rec), argv[0]); \
1484         info->info21.fields_present |= SAMR_FIELD_##flag; } \
1485 } while (0);
1486
1487 static NTSTATUS rpc_sh_user_str_edit_internals(struct net_context *c,
1488                                                TALLOC_CTX *mem_ctx,
1489                                                struct rpc_sh_ctx *ctx,
1490                                                struct rpc_pipe_client *pipe_hnd,
1491                                                struct policy_handle *user_hnd,
1492                                                int argc, const char **argv)
1493 {
1494         NTSTATUS status, result;
1495         const char *username;
1496         const char *oldval = "";
1497         union samr_UserInfo *info = NULL;
1498         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1499
1500         if (argc > 1) {
1501                 d_fprintf(stderr, "%s %s <username> [new value|NULL]\n",
1502                           _("Usage:"), ctx->whoami);
1503                 return NT_STATUS_INVALID_PARAMETER;
1504         }
1505
1506         status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1507                                            user_hnd,
1508                                            21,
1509                                            &info,
1510                                            &result);
1511         if (!NT_STATUS_IS_OK(status)) {
1512                 return status;
1513         }
1514         if (!NT_STATUS_IS_OK(result)) {
1515                 return result;
1516         }
1517
1518         username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1519
1520         FETCHSTR("fullname", full_name);
1521         FETCHSTR("homedir", home_directory);
1522         FETCHSTR("homedrive", home_drive);
1523         FETCHSTR("logonscript", logon_script);
1524         FETCHSTR("profilepath", profile_path);
1525         FETCHSTR("description", description);
1526
1527         if (argc == 0) {
1528                 d_printf(_("%s's %s: [%s]\n"), username, ctx->thiscmd, oldval);
1529                 goto done;
1530         }
1531
1532         if (strcmp(argv[0], "NULL") == 0) {
1533                 argv[0] = "";
1534         }
1535
1536         ZERO_STRUCT(info->info21);
1537
1538         SETSTR("fullname", full_name, FULL_NAME);
1539         SETSTR("homedir", home_directory, HOME_DIRECTORY);
1540         SETSTR("homedrive", home_drive, HOME_DRIVE);
1541         SETSTR("logonscript", logon_script, LOGON_SCRIPT);
1542         SETSTR("profilepath", profile_path, PROFILE_PATH);
1543         SETSTR("description", description, DESCRIPTION);
1544
1545         status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1546                                          user_hnd,
1547                                          21,
1548                                          info,
1549                                          &result);
1550         if (!NT_STATUS_IS_OK(status)) {
1551                 return status;
1552         }
1553
1554         status = result;
1555
1556         d_printf(_("Set %s's %s from [%s] to [%s]\n"), username,
1557                  ctx->thiscmd, oldval, argv[0]);
1558
1559  done:
1560
1561         return status;
1562 }
1563
1564 #define HANDLEFLG(name, rec) \
1565 do { if (strequal(ctx->thiscmd, name)) { \
1566         oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1567         if (newval) { \
1568                 newflags = oldflags | ACB_##rec; \
1569         } else { \
1570                 newflags = oldflags & ~ACB_##rec; \
1571         } } } while (0);
1572
1573 static NTSTATUS rpc_sh_user_str_edit(struct net_context *c,
1574                                      TALLOC_CTX *mem_ctx,
1575                                      struct rpc_sh_ctx *ctx,
1576                                      struct rpc_pipe_client *pipe_hnd,
1577                                      int argc, const char **argv)
1578 {
1579         return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1580                                   rpc_sh_user_str_edit_internals);
1581 }
1582
1583 static NTSTATUS rpc_sh_user_flag_edit_internals(struct net_context *c,
1584                                                 TALLOC_CTX *mem_ctx,
1585                                                 struct rpc_sh_ctx *ctx,
1586                                                 struct rpc_pipe_client *pipe_hnd,
1587                                                 struct policy_handle *user_hnd,
1588                                                 int argc, const char **argv)
1589 {
1590         NTSTATUS status, result;
1591         const char *username;
1592         const char *oldval = "unknown";
1593         uint32 oldflags, newflags;
1594         bool newval;
1595         union samr_UserInfo *info = NULL;
1596         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1597
1598         if ((argc > 1) ||
1599             ((argc == 1) && !strequal(argv[0], "yes") &&
1600              !strequal(argv[0], "no"))) {
1601                 /* TRANSATORS: The yes|no here are program keywords. Please do
1602                    not translate. */
1603                 d_fprintf(stderr, _("Usage: %s <username> [yes|no]\n"),
1604                           ctx->whoami);
1605                 return NT_STATUS_INVALID_PARAMETER;
1606         }
1607
1608         newval = strequal(argv[0], "yes");
1609
1610         status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1611                                            user_hnd,
1612                                            21,
1613                                            &info,
1614                                            &result);
1615         if (!NT_STATUS_IS_OK(status)) {
1616                 return status;
1617         }
1618         if (!NT_STATUS_IS_OK(result)) {
1619                 return result;
1620         }
1621
1622         username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1623         oldflags = info->info21.acct_flags;
1624         newflags = info->info21.acct_flags;
1625
1626         HANDLEFLG("disabled", DISABLED);
1627         HANDLEFLG("pwnotreq", PWNOTREQ);
1628         HANDLEFLG("autolock", AUTOLOCK);
1629         HANDLEFLG("pwnoexp", PWNOEXP);
1630
1631         if (argc == 0) {
1632                 d_printf(_("%s's %s flag: %s\n"), username, ctx->thiscmd,
1633                          oldval);
1634                 goto done;
1635         }
1636
1637         ZERO_STRUCT(info->info21);
1638
1639         info->info21.acct_flags = newflags;
1640         info->info21.fields_present = SAMR_FIELD_ACCT_FLAGS;
1641
1642         status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1643                                          user_hnd,
1644                                          21,
1645                                          info,
1646                                          &result);
1647         if (!NT_STATUS_IS_OK(status)) {
1648                 goto done;
1649         }
1650         status = result;
1651         if (NT_STATUS_IS_OK(result)) {
1652                 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username,
1653                          ctx->thiscmd, oldval, argv[0]);
1654         }
1655
1656  done:
1657
1658         return status;
1659 }
1660
1661 static NTSTATUS rpc_sh_user_flag_edit(struct net_context *c,
1662                                       TALLOC_CTX *mem_ctx,
1663                                       struct rpc_sh_ctx *ctx,
1664                                       struct rpc_pipe_client *pipe_hnd,
1665                                       int argc, const char **argv)
1666 {
1667         return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1668                                   rpc_sh_user_flag_edit_internals);
1669 }
1670
1671 struct rpc_sh_cmd *net_rpc_user_edit_cmds(struct net_context *c,
1672                                           TALLOC_CTX *mem_ctx,
1673                                           struct rpc_sh_ctx *ctx)
1674 {
1675         static struct rpc_sh_cmd cmds[] = {
1676
1677                 { "fullname", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1678                   N_("Show/Set a user's full name") },
1679
1680                 { "homedir", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1681                   N_("Show/Set a user's home directory") },
1682
1683                 { "homedrive", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1684                   N_("Show/Set a user's home drive") },
1685
1686                 { "logonscript", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1687                   N_("Show/Set a user's logon script") },
1688
1689                 { "profilepath", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1690                   N_("Show/Set a user's profile path") },
1691
1692                 { "description", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1693                   N_("Show/Set a user's description") },
1694
1695                 { "disabled", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1696                   N_("Show/Set whether a user is disabled") },
1697
1698                 { "autolock", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1699                   N_("Show/Set whether a user locked out") },
1700
1701                 { "pwnotreq", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1702                   N_("Show/Set whether a user does not need a password") },
1703
1704                 { "pwnoexp", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1705                   N_("Show/Set whether a user's password does not expire") },
1706
1707                 { NULL, NULL, 0, NULL, NULL }
1708         };
1709
1710         return cmds;
1711 }
1712
1713 struct rpc_sh_cmd *net_rpc_user_cmds(struct net_context *c,
1714                                      TALLOC_CTX *mem_ctx,
1715                                      struct rpc_sh_ctx *ctx)
1716 {
1717         static struct rpc_sh_cmd cmds[] = {
1718
1719                 { "list", NULL, &ndr_table_samr, rpc_sh_user_list,
1720                   N_("List available users") },
1721
1722                 { "info", NULL, &ndr_table_samr, rpc_sh_user_info,
1723                   N_("List the domain groups a user is member of") },
1724
1725                 { "show", NULL, &ndr_table_samr, rpc_sh_user_show,
1726                   N_("Show info about a user") },
1727
1728                 { "edit", net_rpc_user_edit_cmds, 0, NULL,
1729                   N_("Show/Modify a user's fields") },
1730
1731                 { NULL, NULL, 0, NULL, NULL }
1732         };
1733
1734         return cmds;
1735 }
1736
1737 /****************************************************************************/
1738
1739 /**
1740  * Basic usage function for 'net rpc group'.
1741  * @param argc  Standard main() style argc.
1742  * @param argv  Standard main() style argv. Initial components are already
1743  *              stripped.
1744  **/
1745
1746 static int rpc_group_usage(struct net_context *c, int argc, const char **argv)
1747 {
1748         return net_group_usage(c, argc, argv);
1749 }
1750
1751 /**
1752  * Delete group on a remote RPC server.
1753  *
1754  * All parameters are provided by the run_rpc_command function, except for
1755  * argc, argv which are passed through.
1756  *
1757  * @param domain_sid The domain sid acquired from the remote server.
1758  * @param cli A cli_state connected to the server.
1759  * @param mem_ctx Talloc context, destroyed on completion of the function.
1760  * @param argc  Standard main() style argc.
1761  * @param argv  Standard main() style argv. Initial components are already
1762  *              stripped.
1763  *
1764  * @return Normal NTSTATUS return.
1765  **/
1766
1767 static NTSTATUS rpc_group_delete_internals(struct net_context *c,
1768                                         const struct dom_sid *domain_sid,
1769                                         const char *domain_name,
1770                                         struct cli_state *cli,
1771                                         struct rpc_pipe_client *pipe_hnd,
1772                                         TALLOC_CTX *mem_ctx,
1773                                         int argc,
1774                                         const char **argv)
1775 {
1776         struct policy_handle connect_pol, domain_pol, group_pol, user_pol;
1777         bool group_is_primary = false;
1778         NTSTATUS status, result;
1779         uint32_t group_rid;
1780         struct samr_RidAttrArray *rids = NULL;
1781         /* char **names; */
1782         int i;
1783         /* struct samr_RidWithAttribute *user_gids; */
1784         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1785
1786         struct samr_Ids group_rids, name_types;
1787         struct lsa_String lsa_acct_name;
1788         union samr_UserInfo *info = NULL;
1789
1790         if (argc < 1 || c->display_usage) {
1791                 rpc_group_usage(c, argc,argv);
1792                 return NT_STATUS_OK; /* ok? */
1793         }
1794
1795         status = dcerpc_samr_Connect2(b, mem_ctx,
1796                                       pipe_hnd->desthost,
1797                                       MAXIMUM_ALLOWED_ACCESS,
1798                                       &connect_pol,
1799                                       &result);
1800         if (!NT_STATUS_IS_OK(status)) {
1801                 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1802                 goto done;
1803         }
1804
1805         if (!NT_STATUS_IS_OK(result)) {
1806                 status = result;
1807                 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1808                 goto done;
1809         }
1810
1811         status = dcerpc_samr_OpenDomain(b, mem_ctx,
1812                                         &connect_pol,
1813                                         MAXIMUM_ALLOWED_ACCESS,
1814                                         discard_const_p(struct dom_sid2, domain_sid),
1815                                         &domain_pol,
1816                                         &result);
1817         if (!NT_STATUS_IS_OK(status)) {
1818                 d_fprintf(stderr, _("Request open_domain failed\n"));
1819                 goto done;
1820         }
1821
1822         if (!NT_STATUS_IS_OK(result)) {
1823                 status = result;
1824                 d_fprintf(stderr, _("Request open_domain failed\n"));
1825                 goto done;
1826         }
1827
1828         init_lsa_String(&lsa_acct_name, argv[0]);
1829
1830         status = dcerpc_samr_LookupNames(b, mem_ctx,
1831                                          &domain_pol,
1832                                          1,
1833                                          &lsa_acct_name,
1834                                          &group_rids,
1835                                          &name_types,
1836                                          &result);
1837         if (!NT_STATUS_IS_OK(status)) {
1838                 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1839                 goto done;
1840         }
1841
1842         if (!NT_STATUS_IS_OK(result)) {
1843                 status = result;
1844                 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1845                 goto done;
1846         }
1847         if (group_rids.count != 1) {
1848                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1849                 goto done;
1850         }
1851         if (name_types.count != 1) {
1852                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1853                 goto done;
1854         }
1855
1856         switch (name_types.ids[0])
1857         {
1858         case SID_NAME_DOM_GRP:
1859                 status = dcerpc_samr_OpenGroup(b, mem_ctx,
1860                                                &domain_pol,
1861                                                MAXIMUM_ALLOWED_ACCESS,
1862                                                group_rids.ids[0],
1863                                                &group_pol,
1864                                                &result);
1865                 if (!NT_STATUS_IS_OK(status)) {
1866                         d_fprintf(stderr, _("Request open_group failed"));
1867                         goto done;
1868                 }
1869
1870                 if (!NT_STATUS_IS_OK(result)) {
1871                         status = result;
1872                         d_fprintf(stderr, _("Request open_group failed"));
1873                         goto done;
1874                 }
1875
1876                 group_rid = group_rids.ids[0];
1877
1878                 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
1879                                                       &group_pol,
1880                                                       &rids,
1881                                                       &result);
1882                 if (!NT_STATUS_IS_OK(status)) {
1883                         d_fprintf(stderr,
1884                                   _("Unable to query group members of %s"),
1885                                   argv[0]);
1886                         goto done;
1887                 }
1888
1889                 if (!NT_STATUS_IS_OK(result)) {
1890                         status = result;
1891                         d_fprintf(stderr,
1892                                   _("Unable to query group members of %s"),
1893                                   argv[0]);
1894                         goto done;
1895                 }
1896
1897                 if (c->opt_verbose) {
1898                         d_printf(
1899                                 _("Domain Group %s (rid: %d) has %d members\n"),
1900                                 argv[0],group_rid, rids->count);
1901                 }
1902
1903                 /* Check if group is anyone's primary group */
1904                 for (i = 0; i < rids->count; i++)
1905                 {
1906                         status = dcerpc_samr_OpenUser(b, mem_ctx,
1907                                                       &domain_pol,
1908                                                       MAXIMUM_ALLOWED_ACCESS,
1909                                                       rids->rids[i],
1910                                                       &user_pol,
1911                                                       &result);
1912                         if (!NT_STATUS_IS_OK(status)) {
1913                                 d_fprintf(stderr,
1914                                         _("Unable to open group member %d\n"),
1915                                         rids->rids[i]);
1916                                 goto done;
1917                         }
1918
1919                         if (!NT_STATUS_IS_OK(result)) {
1920                                 status = result;
1921                                 d_fprintf(stderr,
1922                                         _("Unable to open group member %d\n"),
1923                                         rids->rids[i]);
1924                                 goto done;
1925                         }
1926
1927                         status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1928                                                            &user_pol,
1929                                                            21,
1930                                                            &info,
1931                                                            &result);
1932                         if (!NT_STATUS_IS_OK(status)) {
1933                                 d_fprintf(stderr,
1934                                         _("Unable to lookup userinfo for group "
1935                                           "member %d\n"),
1936                                         rids->rids[i]);
1937                                 goto done;
1938                         }
1939
1940                         if (!NT_STATUS_IS_OK(result)) {
1941                                 status = result;
1942                                 d_fprintf(stderr,
1943                                         _("Unable to lookup userinfo for group "
1944                                           "member %d\n"),
1945                                         rids->rids[i]);
1946                                 goto done;
1947                         }
1948
1949                         if (info->info21.primary_gid == group_rid) {
1950                                 if (c->opt_verbose) {
1951                                         d_printf(_("Group is primary group "
1952                                                    "of %s\n"),
1953                                                 info->info21.account_name.string);
1954                                 }
1955                                 group_is_primary = true;
1956                         }
1957
1958                         dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1959                 }
1960
1961                 if (group_is_primary) {
1962                         d_fprintf(stderr, _("Unable to delete group because "
1963                                  "some of it's members have it as primary "
1964                                  "group\n"));
1965                         status = NT_STATUS_MEMBERS_PRIMARY_GROUP;
1966                         goto done;
1967                 }
1968
1969                 /* remove all group members */
1970                 for (i = 0; i < rids->count; i++)
1971                 {
1972                         if (c->opt_verbose)
1973                                 d_printf(_("Remove group member %d..."),
1974                                         rids->rids[i]);
1975                         status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
1976                                                                &group_pol,
1977                                                                rids->rids[i],
1978                                                                &result);
1979                         if (!NT_STATUS_IS_OK(status)) {
1980                                 goto done;
1981                         }
1982                         status = result;
1983                         if (NT_STATUS_IS_OK(result)) {
1984                                 if (c->opt_verbose)
1985                                         d_printf(_("ok\n"));
1986                         } else {
1987                                 if (c->opt_verbose)
1988                                         d_printf("%s\n", _("failed"));
1989                                 goto done;
1990                         }
1991                 }
1992
1993                 status = dcerpc_samr_DeleteDomainGroup(b, mem_ctx,
1994                                                        &group_pol,
1995                                                        &result);
1996                 if (!NT_STATUS_IS_OK(status)) {
1997                         break;
1998                 }
1999
2000                 status = result;
2001
2002                 break;
2003         /* removing a local group is easier... */
2004         case SID_NAME_ALIAS:
2005                 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2006                                                &domain_pol,
2007                                                MAXIMUM_ALLOWED_ACCESS,
2008                                                group_rids.ids[0],
2009                                                &group_pol,
2010                                                &result);
2011                 if (!NT_STATUS_IS_OK(status)) {
2012                         d_fprintf(stderr, _("Request open_alias failed\n"));
2013                         goto done;
2014                 }
2015                 if (!NT_STATUS_IS_OK(result)) {
2016                         status = result;
2017                         d_fprintf(stderr, _("Request open_alias failed\n"));
2018                         goto done;
2019                 }
2020
2021                 status = dcerpc_samr_DeleteDomAlias(b, mem_ctx,
2022                                                     &group_pol,
2023                                                     &result);
2024                 if (!NT_STATUS_IS_OK(status)) {
2025                         break;
2026                 }
2027
2028                 status = result;
2029
2030                 break;
2031         default:
2032                 d_fprintf(stderr, _("%s is of type %s. This command is only "
2033                                     "for deleting local or global groups\n"),
2034                         argv[0],sid_type_lookup(name_types.ids[0]));
2035                 status = NT_STATUS_UNSUCCESSFUL;
2036                 goto done;
2037         }
2038
2039         if (NT_STATUS_IS_OK(status)) {
2040                 if (c->opt_verbose)
2041                         d_printf(_("Deleted %s '%s'\n"),
2042                                  sid_type_lookup(name_types.ids[0]), argv[0]);
2043         } else {
2044                 d_fprintf(stderr, _("Deleting of %s failed: %s\n"), argv[0],
2045                         get_friendly_nt_error_msg(status));
2046         }
2047
2048  done:
2049         return status;
2050
2051 }
2052
2053 static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
2054 {
2055         return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2056                                rpc_group_delete_internals, argc,argv);
2057 }
2058
2059 static int rpc_group_add_internals(struct net_context *c, int argc, const char **argv)
2060 {
2061         NET_API_STATUS status;
2062         struct GROUP_INFO_1 info1;
2063         uint32_t parm_error = 0;
2064
2065         if (argc != 1 || c->display_usage) {
2066                 rpc_group_usage(c, argc, argv);
2067                 return 0;
2068         }
2069
2070         ZERO_STRUCT(info1);
2071
2072         info1.grpi1_name = argv[0];
2073         if (c->opt_comment && strlen(c->opt_comment) > 0) {
2074                 info1.grpi1_comment = c->opt_comment;
2075         }
2076
2077         status = NetGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
2078
2079         if (status != 0) {
2080                 d_fprintf(stderr,
2081                         _("Failed to add group '%s' with error: %s.\n"),
2082                         argv[0], libnetapi_get_error_string(c->netapi_ctx,
2083                                                             status));
2084                 return -1;
2085         } else {
2086                 d_printf(_("Added group '%s'.\n"), argv[0]);
2087         }
2088
2089         return 0;
2090 }
2091
2092 static int rpc_alias_add_internals(struct net_context *c, int argc, const char **argv)
2093 {
2094         NET_API_STATUS status;
2095         struct LOCALGROUP_INFO_1 info1;
2096         uint32_t parm_error = 0;
2097
2098         if (argc != 1 || c->display_usage) {
2099                 rpc_group_usage(c, argc, argv);
2100                 return 0;
2101         }
2102
2103         ZERO_STRUCT(info1);
2104
2105         info1.lgrpi1_name = argv[0];
2106         if (c->opt_comment && strlen(c->opt_comment) > 0) {
2107                 info1.lgrpi1_comment = c->opt_comment;
2108         }
2109
2110         status = NetLocalGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
2111
2112         if (status != 0) {
2113                 d_fprintf(stderr,
2114                         _("Failed to add alias '%s' with error: %s.\n"),
2115                         argv[0], libnetapi_get_error_string(c->netapi_ctx,
2116                                                             status));
2117                 return -1;
2118         } else {
2119                 d_printf(_("Added alias '%s'.\n"), argv[0]);
2120         }
2121
2122         return 0;
2123 }
2124
2125 static int rpc_group_add(struct net_context *c, int argc, const char **argv)
2126 {
2127         if (c->opt_localgroup)
2128                 return rpc_alias_add_internals(c, argc, argv);
2129
2130         return rpc_group_add_internals(c, argc, argv);
2131 }
2132
2133 static NTSTATUS get_sid_from_name(struct cli_state *cli,
2134                                 TALLOC_CTX *mem_ctx,
2135                                 const char *name,
2136                                 struct dom_sid *sid,
2137                                 enum lsa_SidType *type)
2138 {
2139         struct dom_sid *sids = NULL;
2140         enum lsa_SidType *types = NULL;
2141         struct rpc_pipe_client *pipe_hnd = NULL;
2142         struct policy_handle lsa_pol;
2143         NTSTATUS status, result;
2144         struct dcerpc_binding_handle *b;
2145
2146         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
2147                                           &pipe_hnd);
2148         if (!NT_STATUS_IS_OK(status)) {
2149                 goto done;
2150         }
2151
2152         b = pipe_hnd->binding_handle;
2153
2154         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, false,
2155                                      SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
2156
2157         if (!NT_STATUS_IS_OK(status)) {
2158                 goto done;
2159         }
2160
2161         status = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &lsa_pol, 1,
2162                                       &name, NULL, 1, &sids, &types);
2163
2164         if (NT_STATUS_IS_OK(status)) {
2165                 sid_copy(sid, &sids[0]);
2166                 *type = types[0];
2167         }
2168
2169         dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
2170
2171  done:
2172         if (pipe_hnd) {
2173                 TALLOC_FREE(pipe_hnd);
2174         }
2175
2176         if (!NT_STATUS_IS_OK(status) && (strncasecmp_m(name, "S-", 2) == 0)) {
2177
2178                 /* Try as S-1-5-whatever */
2179
2180                 struct dom_sid tmp_sid;
2181
2182                 if (string_to_sid(&tmp_sid, name)) {
2183                         sid_copy(sid, &tmp_sid);
2184                         *type = SID_NAME_UNKNOWN;
2185                         status = NT_STATUS_OK;
2186                 }
2187         }
2188
2189         return status;
2190 }
2191
2192 static NTSTATUS rpc_add_groupmem(struct rpc_pipe_client *pipe_hnd,
2193                                 TALLOC_CTX *mem_ctx,
2194                                 const struct dom_sid *group_sid,
2195                                 const char *member)
2196 {
2197         struct policy_handle connect_pol, domain_pol;
2198         NTSTATUS status, result;
2199         uint32 group_rid;
2200         struct policy_handle group_pol;
2201         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2202
2203         struct samr_Ids rids, rid_types;
2204         struct lsa_String lsa_acct_name;
2205
2206         struct dom_sid sid;
2207
2208         sid_copy(&sid, group_sid);
2209
2210         if (!sid_split_rid(&sid, &group_rid)) {
2211                 return NT_STATUS_UNSUCCESSFUL;
2212         }
2213
2214         /* Get sam policy handle */
2215         status = dcerpc_samr_Connect2(b, mem_ctx,
2216                                       pipe_hnd->desthost,
2217                                       MAXIMUM_ALLOWED_ACCESS,
2218                                       &connect_pol,
2219                                       &result);
2220         if (!NT_STATUS_IS_OK(status)) {
2221                 return status;
2222         }
2223         if (!NT_STATUS_IS_OK(result)) {
2224                 return result;
2225         }
2226
2227         /* Get domain policy handle */
2228         status = dcerpc_samr_OpenDomain(b, mem_ctx,
2229                                         &connect_pol,
2230                                         MAXIMUM_ALLOWED_ACCESS,
2231                                         &sid,
2232                                         &domain_pol,
2233                                         &result);
2234         if (!NT_STATUS_IS_OK(status)) {
2235                 return status;
2236         }
2237         if (!NT_STATUS_IS_OK(result)) {
2238                 return result;
2239         }
2240
2241         init_lsa_String(&lsa_acct_name, member);
2242
2243         status = dcerpc_samr_LookupNames(b, mem_ctx,
2244                                          &domain_pol,
2245                                          1,
2246                                          &lsa_acct_name,
2247                                          &rids,
2248                                          &rid_types,
2249                                          &result);
2250         if (!NT_STATUS_IS_OK(status)) {
2251                 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2252                           member);
2253                 goto done;
2254         }
2255
2256         if (!NT_STATUS_IS_OK(result)) {
2257                 status = result;
2258                 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2259                           member);
2260                 goto done;
2261         }
2262         if (rids.count != 1) {
2263                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2264                 goto done;
2265         }
2266         if (rid_types.count != 1) {
2267                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2268                 goto done;
2269         }
2270
2271         status = dcerpc_samr_OpenGroup(b, mem_ctx,
2272                                        &domain_pol,
2273                                        MAXIMUM_ALLOWED_ACCESS,
2274                                        group_rid,
2275                                        &group_pol,
2276                                        &result);
2277         if (!NT_STATUS_IS_OK(status)) {
2278                 goto done;
2279         }
2280
2281         if (!NT_STATUS_IS_OK(result)) {
2282                 status = result;
2283                 goto done;
2284         }
2285
2286         status = dcerpc_samr_AddGroupMember(b, mem_ctx,
2287                                             &group_pol,
2288                                             rids.ids[0],
2289                                             0x0005, /* unknown flags */
2290                                             &result);
2291         if (!NT_STATUS_IS_OK(status)) {
2292                 goto done;
2293         }
2294
2295         status = result;
2296
2297  done:
2298         dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2299         return status;
2300 }
2301
2302 static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
2303                                  struct cli_state *cli,
2304                                  TALLOC_CTX *mem_ctx,
2305                                  const struct dom_sid *alias_sid,
2306                                  const char *member)
2307 {
2308         struct policy_handle connect_pol, domain_pol;
2309         NTSTATUS status, result;
2310         uint32 alias_rid;
2311         struct policy_handle alias_pol;
2312         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2313
2314         struct dom_sid member_sid;
2315         enum lsa_SidType member_type;
2316
2317         struct dom_sid sid;
2318
2319         sid_copy(&sid, alias_sid);
2320
2321         if (!sid_split_rid(&sid, &alias_rid)) {
2322                 return NT_STATUS_UNSUCCESSFUL;
2323         }
2324
2325         result = get_sid_from_name(cli, mem_ctx,
2326                                    member, &member_sid, &member_type);
2327
2328         if (!NT_STATUS_IS_OK(result)) {
2329                 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2330                           member);
2331                 return result;
2332         }
2333
2334         /* Get sam policy handle */
2335         status = dcerpc_samr_Connect2(b, mem_ctx,
2336                                       pipe_hnd->desthost,
2337                                       MAXIMUM_ALLOWED_ACCESS,
2338                                       &connect_pol,
2339                                       &result);
2340         if (!NT_STATUS_IS_OK(status)) {
2341                 goto done;
2342         }
2343         if (!NT_STATUS_IS_OK(result)) {
2344                 status = result;
2345                 goto done;
2346         }
2347
2348         /* Get domain policy handle */
2349         status = dcerpc_samr_OpenDomain(b, mem_ctx,
2350                                         &connect_pol,
2351                                         MAXIMUM_ALLOWED_ACCESS,
2352                                         &sid,
2353                                         &domain_pol,
2354                                         &result);
2355         if (!NT_STATUS_IS_OK(status)) {
2356                 goto done;
2357         }
2358         if (!NT_STATUS_IS_OK(result)) {
2359                 status = result;
2360                 goto done;
2361         }
2362
2363         status = dcerpc_samr_OpenAlias(b, mem_ctx,
2364                                        &domain_pol,
2365                                        MAXIMUM_ALLOWED_ACCESS,
2366                                        alias_rid,
2367                                        &alias_pol,
2368                                        &result);
2369         if (!NT_STATUS_IS_OK(status)) {
2370                 return status;
2371         }
2372         if (!NT_STATUS_IS_OK(result)) {
2373                 return result;
2374         }
2375
2376         status = dcerpc_samr_AddAliasMember(b, mem_ctx,
2377                                             &alias_pol,
2378                                             &member_sid,
2379                                             &result);
2380         if (!NT_STATUS_IS_OK(status)) {
2381                 return status;
2382         }
2383
2384         status = result;
2385
2386  done:
2387         dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2388         return status;
2389 }
2390
2391 static NTSTATUS rpc_group_addmem_internals(struct net_context *c,
2392                                         const struct dom_sid *domain_sid,
2393                                         const char *domain_name,
2394                                         struct cli_state *cli,
2395                                         struct rpc_pipe_client *pipe_hnd,
2396                                         TALLOC_CTX *mem_ctx,
2397                                         int argc,
2398                                         const char **argv)
2399 {
2400         struct dom_sid group_sid;
2401         enum lsa_SidType group_type;
2402
2403         if (argc != 2 || c->display_usage) {
2404                 d_printf("%s\n%s",
2405                          _("Usage:"),
2406                          _("net rpc group addmem <group> <member>\n"
2407                            "  Add a member to a group\n"
2408                            "    group\tGroup to add member to\n"
2409                            "    member\tMember to add to group\n"));
2410                 return NT_STATUS_UNSUCCESSFUL;
2411         }
2412
2413         if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2414                                                &group_sid, &group_type))) {
2415                 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2416                           argv[0]);
2417                 return NT_STATUS_UNSUCCESSFUL;
2418         }
2419
2420         if (group_type == SID_NAME_DOM_GRP) {
2421                 NTSTATUS result = rpc_add_groupmem(pipe_hnd, mem_ctx,
2422                                                    &group_sid, argv[1]);
2423
2424                 if (!NT_STATUS_IS_OK(result)) {
2425                         d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2426                                  argv[1], argv[0], nt_errstr(result));
2427                 }
2428                 return result;
2429         }
2430
2431         if (group_type == SID_NAME_ALIAS) {
2432                 NTSTATUS result = rpc_add_aliasmem(pipe_hnd, cli, mem_ctx,
2433                                                    &group_sid, argv[1]);
2434
2435                 if (!NT_STATUS_IS_OK(result)) {
2436                         d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2437                                  argv[1], argv[0], nt_errstr(result));
2438                 }
2439                 return result;
2440         }
2441
2442         d_fprintf(stderr, _("Can only add members to global or local groups "
2443                  "which %s is not\n"), argv[0]);
2444
2445         return NT_STATUS_UNSUCCESSFUL;
2446 }
2447
2448 static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
2449 {
2450         return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2451                                rpc_group_addmem_internals,
2452                                argc, argv);
2453 }
2454
2455 static NTSTATUS rpc_del_groupmem(struct net_context *c,
2456                                 struct rpc_pipe_client *pipe_hnd,
2457                                 TALLOC_CTX *mem_ctx,
2458                                 const struct dom_sid *group_sid,
2459                                 const char *member)
2460 {
2461         struct policy_handle connect_pol, domain_pol;
2462         NTSTATUS status, result;
2463         uint32 group_rid;
2464         struct policy_handle group_pol;
2465         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2466
2467         struct samr_Ids rids, rid_types;
2468         struct lsa_String lsa_acct_name;
2469
2470         struct dom_sid sid;
2471
2472         sid_copy(&sid, group_sid);
2473
2474         if (!sid_split_rid(&sid, &group_rid))
2475                 return NT_STATUS_UNSUCCESSFUL;
2476
2477         /* Get sam policy handle */
2478         status = dcerpc_samr_Connect2(b, mem_ctx,
2479                                       pipe_hnd->desthost,
2480                                       MAXIMUM_ALLOWED_ACCESS,
2481                                       &connect_pol,
2482                                       &result);
2483         if (!NT_STATUS_IS_OK(status)) {
2484                 return status;
2485         }
2486         if (!NT_STATUS_IS_OK(result)) {
2487                 return result;
2488         }
2489
2490
2491         /* Get domain policy handle */
2492         status = dcerpc_samr_OpenDomain(b, mem_ctx,
2493                                         &connect_pol,
2494                                         MAXIMUM_ALLOWED_ACCESS,
2495                                         &sid,
2496                                         &domain_pol,
2497                                         &result);
2498         if (!NT_STATUS_IS_OK(status)) {
2499                 return status;
2500         }
2501         if (!NT_STATUS_IS_OK(result)) {
2502                 return result;
2503         }
2504
2505         init_lsa_String(&lsa_acct_name, member);
2506
2507         status = dcerpc_samr_LookupNames(b, mem_ctx,
2508                                          &domain_pol,
2509                                          1,
2510                                          &lsa_acct_name,
2511                                          &rids,
2512                                          &rid_types,
2513                                          &result);
2514         if (!NT_STATUS_IS_OK(status)) {
2515                 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2516                           member);
2517                 goto done;
2518         }
2519
2520         if (!NT_STATUS_IS_OK(result)) {
2521                 status = result;
2522                 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2523                           member);
2524                 goto done;
2525         }
2526         if (rids.count != 1) {
2527                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2528                 goto done;
2529         }
2530         if (rid_types.count != 1) {
2531                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2532                 goto done;
2533         }
2534
2535         status = dcerpc_samr_OpenGroup(b, mem_ctx,
2536                                        &domain_pol,
2537                                        MAXIMUM_ALLOWED_ACCESS,
2538                                        group_rid,
2539                                        &group_pol,
2540                                        &result);
2541         if (!NT_STATUS_IS_OK(status)) {
2542                 goto done;
2543         }
2544         if (!NT_STATUS_IS_OK(result)) {
2545                 status = result;
2546                 goto done;
2547         }
2548
2549         status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
2550                                                &group_pol,
2551                                                rids.ids[0],
2552                                                &result);
2553         if (!NT_STATUS_IS_OK(status)) {
2554                 goto done;
2555         }
2556
2557         status = result;
2558  done:
2559         dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2560         return status;
2561 }
2562
2563 static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
2564                                  struct cli_state *cli,
2565                                  TALLOC_CTX *mem_ctx,
2566                                  const struct dom_sid *alias_sid,
2567                                  const char *member)
2568 {
2569         struct policy_handle connect_pol, domain_pol;
2570         NTSTATUS status, result;
2571         uint32 alias_rid;
2572         struct policy_handle alias_pol;
2573         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2574
2575         struct dom_sid member_sid;
2576         enum lsa_SidType member_type;
2577
2578         struct dom_sid sid;
2579
2580         sid_copy(&sid, alias_sid);
2581
2582         if (!sid_split_rid(&sid, &alias_rid))
2583                 return NT_STATUS_UNSUCCESSFUL;
2584
2585         result = get_sid_from_name(cli, mem_ctx,
2586                                    member, &member_sid, &member_type);
2587
2588         if (!NT_STATUS_IS_OK(result)) {
2589                 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2590                           member);
2591                 return result;
2592         }
2593
2594         /* Get sam policy handle */
2595         status = dcerpc_samr_Connect2(b, mem_ctx,
2596                                       pipe_hnd->desthost,
2597                                       MAXIMUM_ALLOWED_ACCESS,
2598                                       &connect_pol,
2599                                       &result);
2600         if (!NT_STATUS_IS_OK(status)) {
2601                 goto done;
2602         }
2603         if (!NT_STATUS_IS_OK(result)) {
2604                 status = result;
2605                 goto done;
2606         }
2607
2608         /* Get domain policy handle */
2609         status = dcerpc_samr_OpenDomain(b, mem_ctx,
2610                                         &connect_pol,
2611                                         MAXIMUM_ALLOWED_ACCESS,
2612                                         &sid,
2613                                         &domain_pol,
2614                                         &result);
2615         if (!NT_STATUS_IS_OK(status)) {
2616                 goto done;
2617         }
2618         if (!NT_STATUS_IS_OK(result)) {
2619                 status = result;
2620                 goto done;
2621         }
2622
2623         status = dcerpc_samr_OpenAlias(b, mem_ctx,
2624                                        &domain_pol,
2625                                        MAXIMUM_ALLOWED_ACCESS,
2626                                        alias_rid,
2627                                        &alias_pol,
2628                                        &result);
2629         if (!NT_STATUS_IS_OK(status)) {
2630                 return status;
2631         }
2632
2633         if (!NT_STATUS_IS_OK(result)) {
2634                 return result;
2635         }
2636
2637         status = dcerpc_samr_DeleteAliasMember(b, mem_ctx,
2638                                                &alias_pol,
2639                                                &member_sid,
2640                                                &result);
2641
2642         if (!NT_STATUS_IS_OK(status)) {
2643                 return status;
2644         }
2645
2646         status = result;
2647
2648  done:
2649         dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2650         return status;
2651 }
2652
2653 static NTSTATUS rpc_group_delmem_internals(struct net_context *c,
2654                                         const struct dom_sid *domain_sid,
2655                                         const char *domain_name,
2656                                         struct cli_state *cli,
2657                                         struct rpc_pipe_client *pipe_hnd,
2658                                         TALLOC_CTX *mem_ctx,
2659                                         int argc,
2660                                         const char **argv)
2661 {
2662         struct dom_sid group_sid;
2663         enum lsa_SidType group_type;
2664
2665         if (argc != 2 || c->display_usage) {
2666                 d_printf("%s\n%s",
2667                          _("Usage:"),
2668                          _("net rpc group delmem <group> <member>\n"
2669                            "  Delete a member from a group\n"
2670                            "    group\tGroup to delete member from\n"
2671                            "    member\tMember to delete from group\n"));
2672                 return NT_STATUS_UNSUCCESSFUL;
2673         }
2674
2675         if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2676                                                &group_sid, &group_type))) {
2677                 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2678                           argv[0]);
2679                 return NT_STATUS_UNSUCCESSFUL;
2680         }
2681
2682         if (group_type == SID_NAME_DOM_GRP) {
2683                 NTSTATUS result = rpc_del_groupmem(c, pipe_hnd, mem_ctx,
2684                                                    &group_sid, argv[1]);
2685
2686                 if (!NT_STATUS_IS_OK(result)) {
2687                         d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2688                                  argv[1], argv[0], nt_errstr(result));
2689                 }
2690                 return result;
2691         }
2692
2693         if (group_type == SID_NAME_ALIAS) {
2694                 NTSTATUS result = rpc_del_aliasmem(pipe_hnd, cli, mem_ctx,
2695                                                    &group_sid, argv[1]);
2696
2697                 if (!NT_STATUS_IS_OK(result)) {
2698                         d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2699                                  argv[1], argv[0], nt_errstr(result));
2700                 }
2701                 return result;
2702         }
2703
2704         d_fprintf(stderr, _("Can only delete members from global or local "
2705                  "groups which %s is not\n"), argv[0]);
2706
2707         return NT_STATUS_UNSUCCESSFUL;
2708 }
2709
2710 static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
2711 {
2712         return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2713                                rpc_group_delmem_internals,
2714                                argc, argv);
2715 }
2716
2717 /**
2718  * List groups on a remote RPC server.
2719  *
2720  * All parameters are provided by the run_rpc_command function, except for
2721  * argc, argv which are passes through.
2722  *
2723  * @param domain_sid The domain sid acquired from the remote server.
2724  * @param cli A cli_state connected to the server.
2725  * @param mem_ctx Talloc context, destroyed on completion of the function.
2726  * @param argc  Standard main() style argc.
2727  * @param argv  Standard main() style argv. Initial components are already
2728  *              stripped.
2729  *
2730  * @return Normal NTSTATUS return.
2731  **/
2732
2733 static NTSTATUS rpc_group_list_internals(struct net_context *c,
2734                                         const struct dom_sid *domain_sid,
2735                                         const char *domain_name,
2736                                         struct cli_state *cli,
2737                                         struct rpc_pipe_client *pipe_hnd,
2738                                         TALLOC_CTX *mem_ctx,
2739                                         int argc,
2740                                         const char **argv)
2741 {
2742         struct policy_handle connect_pol, domain_pol;
2743         NTSTATUS status, result;
2744         uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
2745         struct samr_SamArray *groups = NULL;
2746         bool global = false;
2747         bool local = false;
2748         bool builtin = false;
2749         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2750
2751         if (c->display_usage) {
2752                 d_printf("%s\n%s",
2753                          _("Usage:"),
2754                          _("net rpc group list [global] [local] [builtin]\n"
2755                            "  List groups on RPC server\n"
2756                            "    global\tList global groups\n"
2757                            "    local\tList local groups\n"
2758                            "    builtin\tList builtin groups\n"
2759                            "    If none of global, local or builtin is "
2760                            "specified, all three options are considered "
2761                            "set\n"));
2762                 return NT_STATUS_OK;
2763         }
2764
2765         if (argc == 0) {
2766                 global = true;
2767                 local = true;
2768                 builtin = true;
2769         }
2770
2771         for (i=0; i<argc; i++) {
2772                 if (strequal(argv[i], "global"))
2773                         global = true;
2774
2775                 if (strequal(argv[i], "local"))
2776                         local = true;
2777
2778                 if (strequal(argv[i], "builtin"))
2779                         builtin = true;
2780         }
2781
2782         /* Get sam policy handle */
2783
2784         status = dcerpc_samr_Connect2(b, mem_ctx,
2785                                       pipe_hnd->desthost,
2786                                       MAXIMUM_ALLOWED_ACCESS,
2787                                       &connect_pol,
2788                                       &result);
2789         if (!NT_STATUS_IS_OK(status)) {
2790                 goto done;
2791         }
2792         if (!NT_STATUS_IS_OK(result)) {
2793                 status = result;
2794                 goto done;
2795         }
2796
2797         /* Get domain policy handle */
2798
2799         status = dcerpc_samr_OpenDomain(b, mem_ctx,
2800                                         &connect_pol,
2801                                         MAXIMUM_ALLOWED_ACCESS,
2802                                         discard_const_p(struct dom_sid2, domain_sid),
2803                                         &domain_pol,
2804                                         &result);
2805         if (!NT_STATUS_IS_OK(status)) {
2806                 goto done;
2807         }
2808         if (!NT_STATUS_IS_OK(result)) {
2809                 status = result;
2810                 goto done;
2811         }
2812
2813         /* Query domain groups */
2814         if (c->opt_long_list_entries)
2815                 d_printf(_("\nGroup name            Comment"
2816                            "\n-----------------------------\n"));
2817         do {
2818                 uint32_t max_size, total_size, returned_size;
2819                 union samr_DispInfo info;
2820
2821                 if (!global) break;
2822
2823                 dcerpc_get_query_dispinfo_params(
2824                         loop_count, &max_entries, &max_size);
2825
2826                 status = dcerpc_samr_QueryDisplayInfo(b, mem_ctx,
2827                                                       &domain_pol,
2828                                                       3,
2829                                                       start_idx,
2830                                                       max_entries,
2831                                                       max_size,
2832                                                       &total_size,
2833                                                       &returned_size,
2834                                                       &info,
2835                                                       &result);
2836                 if (!NT_STATUS_IS_OK(status)) {
2837                         goto done;
2838                 }
2839                 num_entries = info.info3.count;
2840                 start_idx += info.info3.count;
2841
2842                 if (!NT_STATUS_IS_OK(result) &&
2843                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2844                         break;
2845
2846                 for (i = 0; i < num_entries; i++) {
2847
2848                         const char *group = NULL;
2849                         const char *desc = NULL;
2850
2851                         group = info.info3.entries[i].account_name.string;
2852                         desc = info.info3.entries[i].description.string;
2853
2854                         if (c->opt_long_list_entries)
2855                                 printf("%-21.21s %-50.50s\n",
2856                                        group, desc);
2857                         else
2858                                 printf("%s\n", group);
2859                 }
2860         } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2861         /* query domain aliases */
2862         start_idx = 0;
2863         do {
2864                 if (!local) break;
2865
2866                 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2867                                                        &domain_pol,
2868                                                        &start_idx,
2869                                                        &groups,
2870                                                        0xffff,
2871                                                        &num_entries,
2872                                                        &result);
2873                 if (!NT_STATUS_IS_OK(status)) {
2874                         goto done;
2875                 }
2876                 if (!NT_STATUS_IS_OK(result) &&
2877                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2878                         break;
2879
2880                 for (i = 0; i < num_entries; i++) {
2881
2882                         const char *description = NULL;
2883
2884                         if (c->opt_long_list_entries) {
2885
2886                                 struct policy_handle alias_pol;
2887                                 union samr_AliasInfo *info = NULL;
2888                                 NTSTATUS _result;
2889
2890                                 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2891                                                                &domain_pol,
2892                                                                0x8,
2893                                                                groups->entries[i].idx,
2894                                                                &alias_pol,
2895                                                                &_result);
2896                                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2897                                         status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2898                                                                             &alias_pol,
2899                                                                             3,
2900                                                                             &info,
2901                                                                             &_result);
2902                                         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2903                                                 status = dcerpc_samr_Close(b, mem_ctx,
2904                                                                            &alias_pol,
2905                                                                            &_result);
2906                                                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2907                                                         description = info->description.string;
2908                                                 }
2909                                         }
2910                                 }
2911                         }
2912
2913                         if (description != NULL) {
2914                                 printf("%-21.21s %-50.50s\n",
2915                                        groups->entries[i].name.string,
2916                                        description);
2917                         } else {
2918                                 printf("%s\n", groups->entries[i].name.string);
2919                         }
2920                 }
2921         } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2922         dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
2923         /* Get builtin policy handle */
2924
2925         status = dcerpc_samr_OpenDomain(b, mem_ctx,
2926                                         &connect_pol,
2927                                         MAXIMUM_ALLOWED_ACCESS,
2928                                         discard_const_p(struct dom_sid2, &global_sid_Builtin),
2929                                         &domain_pol,
2930                                         &result);
2931         if (!NT_STATUS_IS_OK(status)) {
2932                 goto done;
2933         }
2934         if (!NT_STATUS_IS_OK(result)) {
2935                 status = result;
2936                 goto done;
2937         }
2938
2939         /* query builtin aliases */
2940         start_idx = 0;
2941         do {
2942                 if (!builtin) break;
2943
2944                 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2945                                                        &domain_pol,
2946                                                        &start_idx,
2947                                                        &groups,
2948                                                        max_entries,
2949                                                        &num_entries,
2950                                                        &result);
2951                 if (!NT_STATUS_IS_OK(status)) {
2952                         break;
2953                 }
2954                 if (!NT_STATUS_IS_OK(result) &&
2955                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
2956                         status = result;
2957                         break;
2958                 }
2959
2960                 for (i = 0; i < num_entries; i++) {
2961
2962                         const char *description = NULL;
2963
2964                         if (c->opt_long_list_entries) {
2965
2966                                 struct policy_handle alias_pol;
2967                                 union samr_AliasInfo *info = NULL;
2968                                 NTSTATUS _result;
2969
2970                                 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2971                                                                &domain_pol,
2972                                                                0x8,
2973                                                                groups->entries[i].idx,
2974                                                                &alias_pol,
2975                                                                &_result);
2976                                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2977                                         status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2978                                                                             &alias_pol,
2979                                                                             3,
2980                                                                             &info,
2981                                                                             &_result);
2982                                         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2983                                                 status = dcerpc_samr_Close(b, mem_ctx,
2984                                                                            &alias_pol,
2985                                                                            &_result);
2986                                                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2987                                                         description = info->description.string;
2988                                                 }
2989                                         }
2990                                 }
2991                         }
2992
2993                         if (description != NULL) {
2994                                 printf("%-21.21s %-50.50s\n",
2995                                        groups->entries[i].name.string,
2996                                        description);
2997                         } else {
2998                                 printf("%s\n", groups->entries[i].name.string);
2999                         }
3000                 }
3001         } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
3002
3003         status = result;
3004
3005  done:
3006         return status;
3007 }
3008
3009 static int rpc_group_list(struct net_context *c, int argc, const char **argv)
3010 {
3011         return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3012                                rpc_group_list_internals,
3013                                argc, argv);
3014 }
3015
3016 static NTSTATUS rpc_list_group_members(struct net_context *c,
3017                                         struct rpc_pipe_client *pipe_hnd,
3018                                         TALLOC_CTX *mem_ctx,
3019                                         const char *domain_name,
3020                                         const struct dom_sid *domain_sid,
3021                                         struct policy_handle *domain_pol,
3022                                         uint32 rid)
3023 {
3024         NTSTATUS result, status;
3025         struct policy_handle group_pol;
3026         uint32 num_members, *group_rids;
3027         int i;
3028         struct samr_RidAttrArray *rids = NULL;
3029         struct lsa_Strings names;
3030         struct samr_Ids types;
3031         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3032
3033         fstring sid_str;
3034         sid_to_fstring(sid_str, domain_sid);
3035
3036         status = dcerpc_samr_OpenGroup(b, mem_ctx,
3037                                        domain_pol,
3038                                        MAXIMUM_ALLOWED_ACCESS,
3039                                        rid,
3040                                        &group_pol,
3041                                        &result);
3042         if (!NT_STATUS_IS_OK(status)) {
3043                 return status;
3044         }
3045         if (!NT_STATUS_IS_OK(result)) {
3046                 return result;
3047         }
3048
3049         status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
3050                                               &group_pol,
3051                                               &rids,
3052                                               &result);
3053         if (!NT_STATUS_IS_OK(status)) {
3054                 return status;
3055         }
3056         if (!NT_STATUS_IS_OK(result)) {
3057                 return result;
3058         }
3059
3060         num_members = rids->count;
3061         group_rids = rids->rids;
3062
3063         while (num_members > 0) {
3064                 int this_time = 512;
3065
3066                 if (num_members < this_time)
3067                         this_time = num_members;
3068
3069                 status = dcerpc_samr_LookupRids(b, mem_ctx,
3070                                                 domain_pol,
3071                                                 this_time,
3072                                                 group_rids,
3073                                                 &names,
3074                                                 &types,
3075                                                 &result);
3076                 if (!NT_STATUS_IS_OK(status)) {
3077                         return status;
3078                 }
3079                 if (!NT_STATUS_IS_OK(result)) {
3080                         return result;
3081                 }
3082                 if (names.count != this_time) {
3083                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3084                 }
3085                 if (types.count != this_time) {
3086                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3087                 }
3088                 /* We only have users as members, but make the output
3089                    the same as the output of alias members */
3090
3091                 for (i = 0; i < this_time; i++) {
3092
3093                         if (c->opt_long_list_entries) {
3094                                 printf("%s-%d %s\\%s %d\n", sid_str,
3095                                        group_rids[i], domain_name,
3096                                        names.names[i].string,
3097                                        SID_NAME_USER);
3098                         } else {
3099                                 printf("%s\\%s\n", domain_name,
3100                                         names.names[i].string);
3101                         }
3102                 }
3103
3104                 num_members -= this_time;
3105                 group_rids += 512;
3106         }
3107
3108         return NT_STATUS_OK;
3109 }
3110
3111 static NTSTATUS rpc_list_alias_members(struct net_context *c,
3112                                        struct rpc_pipe_client *pipe_hnd,
3113                                        struct cli_state *cli,
3114                                        TALLOC_CTX *mem_ctx,
3115                                        struct policy_handle *domain_pol,
3116                                        uint32 rid)
3117 {
3118         NTSTATUS result, status;
3119         struct rpc_pipe_client *lsa_pipe;
3120         struct policy_handle alias_pol, lsa_pol;
3121         uint32 num_members;
3122         struct dom_sid *alias_sids;
3123         char **domains;
3124         char **names;
3125         enum lsa_SidType *types;
3126         int i;
3127         struct lsa_SidArray sid_array;
3128         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3129
3130         status = dcerpc_samr_OpenAlias(b, mem_ctx,
3131                                        domain_pol,
3132                                        MAXIMUM_ALLOWED_ACCESS,
3133                                        rid,
3134                                        &alias_pol,
3135                                        &result);
3136         if (!NT_STATUS_IS_OK(status)) {
3137                 return status;
3138         }
3139         if (!NT_STATUS_IS_OK(result)) {
3140                 return result;
3141         }
3142
3143         status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
3144                                                &alias_pol,
3145                                                &sid_array,
3146                                                &result);
3147         if (!NT_STATUS_IS_OK(status)) {
3148                 d_fprintf(stderr, _("Couldn't list alias members\n"));
3149                 return status;
3150         }
3151         if (!NT_STATUS_IS_OK(result)) {
3152                 d_fprintf(stderr, _("Couldn't list alias members\n"));
3153                 return result;
3154         }
3155
3156         num_members = sid_array.num_sids;
3157
3158         if (num_members == 0) {
3159                 return NT_STATUS_OK;
3160         }
3161
3162         result = cli_rpc_pipe_open_noauth(cli,
3163                                           &ndr_table_lsarpc,
3164                                           &lsa_pipe);
3165         if (!NT_STATUS_IS_OK(result)) {
3166                 d_fprintf(stderr, _("Couldn't open LSA pipe. Error was %s\n"),
3167                         nt_errstr(result) );
3168                 return result;
3169         }
3170
3171         result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, true,
3172                                      SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
3173
3174         if (!NT_STATUS_IS_OK(result)) {
3175                 d_fprintf(stderr, _("Couldn't open LSA policy handle\n"));
3176                 TALLOC_FREE(lsa_pipe);
3177                 return result;
3178         }
3179
3180         alias_sids = talloc_zero_array(mem_ctx, struct dom_sid, num_members);
3181         if (!alias_sids) {
3182                 d_fprintf(stderr, _("Out of memory\n"));
3183                 TALLOC_FREE(lsa_pipe);
3184                 return NT_STATUS_NO_MEMORY;
3185         }
3186
3187         for (i=0; i<num_members; i++) {
3188                 sid_copy(&alias_sids[i], sid_array.sids[i].sid);
3189         }
3190
3191         result = rpccli_lsa_lookup_sids(lsa_pipe, mem_ctx, &lsa_pol,
3192                                      num_members,  alias_sids,
3193                                      &domains, &names, &types);
3194
3195         if (!NT_STATUS_IS_OK(result) &&
3196             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
3197                 d_fprintf(stderr, _("Couldn't lookup SIDs\n"));
3198                 TALLOC_FREE(lsa_pipe);
3199                 return result;
3200         }
3201
3202         for (i = 0; i < num_members; i++) {
3203                 fstring sid_str;
3204                 sid_to_fstring(sid_str, &alias_sids[i]);
3205
3206                 if (c->opt_long_list_entries) {
3207                         printf("%s %s\\%s %d\n", sid_str,
3208                                domains[i] ? domains[i] : _("*unknown*"),
3209                                names[i] ? names[i] : _("*unknown*"), types[i]);
3210                 } else {
3211                         if (domains[i])
3212                                 printf("%s\\%s\n", domains[i], names[i]);
3213                         else
3214                                 printf("%s\n", sid_str);
3215                 }
3216         }
3217
3218         TALLOC_FREE(lsa_pipe);
3219         return NT_STATUS_OK;
3220 }
3221
3222 static NTSTATUS rpc_group_members_internals(struct net_context *c,
3223                                         const struct dom_sid *domain_sid,
3224                                         const char *domain_name,
3225                                         struct cli_state *cli,
3226                                         struct rpc_pipe_client *pipe_hnd,
3227                                         TALLOC_CTX *mem_ctx,
3228                                         int argc,
3229                                         const char **argv)
3230 {
3231         NTSTATUS result, status;
3232         struct policy_handle connect_pol, domain_pol;
3233         struct samr_Ids rids, rid_types;
3234         struct lsa_String lsa_acct_name;
3235         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3236
3237         /* Get sam policy handle */
3238
3239         status = dcerpc_samr_Connect2(b, mem_ctx,
3240                                       pipe_hnd->desthost,
3241                                       MAXIMUM_ALLOWED_ACCESS,
3242                                       &connect_pol,
3243                                       &result);
3244         if (!NT_STATUS_IS_OK(status)) {
3245                 return status;
3246         }
3247         if (!NT_STATUS_IS_OK(result)) {
3248                 return result;
3249         }
3250
3251         /* Get domain policy handle */
3252
3253         status = dcerpc_samr_OpenDomain(b, mem_ctx,
3254                                         &connect_pol,
3255                                         MAXIMUM_ALLOWED_ACCESS,
3256                                         discard_const_p(struct dom_sid2, domain_sid),
3257                                         &domain_pol,
3258                                         &result);
3259         if (!NT_STATUS_IS_OK(status)) {
3260                 return status;
3261         }
3262         if (!NT_STATUS_IS_OK(result)) {
3263                 return result;
3264         }
3265
3266         init_lsa_String(&lsa_acct_name, argv[0]); /* sure? */
3267
3268         status = dcerpc_samr_LookupNames(b, mem_ctx,
3269                                          &domain_pol,
3270                                          1,
3271                                          &lsa_acct_name,
3272                                          &rids,
3273                                          &rid_types,
3274                                          &result);
3275         if (!NT_STATUS_IS_OK(status)) {
3276                 return status;
3277         }
3278
3279         if (!NT_STATUS_IS_OK(result)) {
3280
3281                 /* Ok, did not find it in the global sam, try with builtin */
3282
3283                 struct dom_sid sid_Builtin;
3284
3285                 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
3286
3287                 sid_copy(&sid_Builtin, &global_sid_Builtin);
3288
3289                 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3290                                                 &connect_pol,
3291                                                 MAXIMUM_ALLOWED_ACCESS,
3292                                                 &sid_Builtin,
3293                                                 &domain_pol,
3294                                                 &result);
3295                 if (!NT_STATUS_IS_OK(status)) {
3296                         return status;
3297                 }
3298                 if (!NT_STATUS_IS_OK(result)) {
3299                         d_fprintf(stderr, _("Couldn't find group %s\n"),
3300                                   argv[0]);
3301                         return result;
3302                 }
3303
3304                 status = dcerpc_samr_LookupNames(b, mem_ctx,
3305                                                  &domain_pol,
3306                                                  1,
3307                                                  &lsa_acct_name,
3308                                                  &rids,
3309                                                  &rid_types,
3310                                                  &result);
3311                 if (!NT_STATUS_IS_OK(status)) {
3312                         return status;
3313                 }
3314                 if (!NT_STATUS_IS_OK(result)) {
3315                         d_fprintf(stderr, _("Couldn't find group %s\n"),
3316                                   argv[0]);
3317                         return result;
3318                 }
3319         }
3320
3321         if (rids.count != 1) {
3322                 d_fprintf(stderr, _("Couldn't find group %s\n"),
3323                           argv[0]);
3324                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3325         }
3326         if (rid_types.count != 1) {
3327                 d_fprintf(stderr, _("Couldn't find group %s\n"),
3328                           argv[0]);
3329                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3330         }
3331
3332
3333         if (rid_types.ids[0] == SID_NAME_DOM_GRP) {
3334                 return rpc_list_group_members(c, pipe_hnd, mem_ctx, domain_name,
3335                                               domain_sid, &domain_pol,
3336                                               rids.ids[0]);
3337         }
3338
3339         if (rid_types.ids[0] == SID_NAME_ALIAS) {
3340                 return rpc_list_alias_members(c, pipe_hnd, cli, mem_ctx, &domain_pol,
3341                                               rids.ids[0]);
3342         }
3343
3344         return NT_STATUS_NO_SUCH_GROUP;
3345 }
3346
3347 static int rpc_group_members(struct net_context *c, int argc, const char **argv)
3348 {
3349         if (argc != 1 || c->display_usage) {
3350                 return rpc_group_usage(c, argc, argv);
3351         }
3352
3353         return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3354                                rpc_group_members_internals,
3355                                argc, argv);
3356 }
3357
3358 static int rpc_group_rename_internals(struct net_context *c, int argc, const char **argv)
3359 {
3360         NET_API_STATUS status;
3361         struct GROUP_INFO_0 g0;
3362         uint32_t parm_err;
3363
3364         if (argc != 2) {
3365                 d_printf(_("Usage:\n"));
3366                 d_printf("net rpc group rename group newname\n");
3367                 return -1;
3368         }
3369
3370         g0.grpi0_name = argv[1];
3371
3372         status = NetGroupSetInfo(c->opt_host,
3373                                  argv[0],
3374                                  0,
3375                                  (uint8_t *)&g0,
3376                                  &parm_err);
3377
3378         if (status != 0) {
3379                 d_fprintf(stderr, _("Renaming group %s failed with: %s\n"),
3380                         argv[0], libnetapi_get_error_string(c->netapi_ctx,
3381                         status));
3382                 return -1;
3383         }
3384
3385         return 0;
3386 }
3387
3388 static int rpc_group_rename(struct net_context *c, int argc, const char **argv)
3389 {
3390         if (argc != 2 || c->display_usage) {
3391                 return rpc_group_usage(c, argc, argv);
3392         }
3393
3394         return rpc_group_rename_internals(c, argc, argv);
3395 }
3396
3397 /**
3398  * 'net rpc group' entrypoint.
3399  * @param argc  Standard main() style argc.
3400  * @param argv  Standard main() style argv. Initial components are already
3401  *              stripped.
3402  **/
3403
3404 int net_rpc_group(struct net_context *c, int argc, const char **argv)
3405 {
3406         NET_API_STATUS status;
3407
3408         struct functable func[] = {
3409                 {
3410                         "add",
3411                         rpc_group_add,
3412                         NET_TRANSPORT_RPC,
3413                         N_("Create specified group"),
3414                         N_("net rpc group add\n"
3415                            "    Create specified group")
3416                 },
3417                 {
3418                         "delete",
3419                         rpc_group_delete,
3420                         NET_TRANSPORT_RPC,
3421                         N_("Delete specified group"),
3422                         N_("net rpc group delete\n"
3423                            "    Delete specified group")
3424                 },
3425                 {
3426                         "addmem",
3427                         rpc_group_addmem,
3428                         NET_TRANSPORT_RPC,
3429                         N_("Add member to group"),
3430                         N_("net rpc group addmem\n"
3431                            "    Add member to group")
3432                 },
3433                 {
3434                         "delmem",
3435                         rpc_group_delmem,
3436                         NET_TRANSPORT_RPC,
3437                         N_("Remove member from group"),
3438                         N_("net rpc group delmem\n"
3439                            "    Remove member from group")
3440                 },
3441                 {
3442                         "list",
3443                         rpc_group_list,
3444                         NET_TRANSPORT_RPC,
3445                         N_("List groups"),
3446                         N_("net rpc group list\n"
3447                            "    List groups")
3448                 },
3449                 {
3450                         "members",
3451                         rpc_group_members,
3452                         NET_TRANSPORT_RPC,
3453                         N_("List group members"),
3454                         N_("net rpc group members\n"
3455                            "    List group members")
3456                 },
3457                 {
3458                         "rename",
3459                         rpc_group_rename,
3460                         NET_TRANSPORT_RPC,
3461                         N_("Rename group"),
3462                         N_("net rpc group rename\n"
3463                            "    Rename group")
3464                 },
3465                 {NULL, NULL, 0, NULL, NULL}
3466         };
3467
3468         status = libnetapi_net_init(&c->netapi_ctx);
3469         if (status != 0) {
3470                 return -1;
3471         }
3472         libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
3473         libnetapi_set_password(c->netapi_ctx, c->opt_password);
3474         if (c->opt_kerberos) {
3475                 libnetapi_set_use_kerberos(c->netapi_ctx);
3476         }
3477
3478         if (argc == 0) {
3479                 if (c->display_usage) {
3480                         d_printf(_("Usage:\n"));
3481                         d_printf(_("net rpc group\n"
3482                                    "    Alias for net rpc group list global "
3483                                    "local builtin\n"));
3484                         net_display_usage_from_functable(func);
3485                         return 0;
3486                 }
3487
3488                 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3489                                        rpc_group_list_internals,
3490                                        argc, argv);
3491         }
3492
3493         return net_run_function(c, argc, argv, "net rpc group", func);
3494 }
3495
3496 /****************************************************************************/
3497
3498 static int rpc_share_usage(struct net_context *c, int argc, const char **argv)
3499 {
3500         return net_share_usage(c, argc, argv);
3501 }
3502
3503 /**
3504  * Add a share on a remote RPC server.
3505  *
3506  * @param argc  Standard main() style argc.
3507  * @param argv  Standard main() style argv. Initial components are already
3508  *              stripped.
3509  *
3510  * @return A shell status integer (0 for success).
3511  **/
3512
3513 static int rpc_share_add(struct net_context *c, int argc, const char **argv)
3514 {
3515         NET_API_STATUS status;
3516         char *sharename;
3517         char *path;
3518         uint32 type = STYPE_DISKTREE; /* only allow disk shares to be added */
3519         uint32 num_users=0, perms=0;
3520         char *password=NULL; /* don't allow a share password */
3521         struct SHARE_INFO_2 i2;
3522         uint32_t parm_error = 0;
3523
3524         if ((argc < 1) || !strchr(argv[0], '=') || c->display_usage) {
3525                 return rpc_share_usage(c, argc, argv);
3526         }
3527
3528         if ((sharename = talloc_strdup(c, argv[0])) == NULL) {
3529                 return -1;
3530         }
3531
3532         path = strchr(sharename, '=');
3533         if (!path) {
3534                 return -1;
3535         }
3536
3537         *path++ = '\0';
3538
3539         i2.shi2_netname         = sharename;
3540         i2.shi2_type            = type;
3541         i2.shi2_remark          = c->opt_comment;
3542         i2.shi2_permissions     = perms;
3543         i2.shi2_max_uses        = c->opt_maxusers;
3544         i2.shi2_current_uses    = num_users;
3545         i2.shi2_path            = path;
3546         i2.shi2_passwd          = password;
3547
3548         status = NetShareAdd(c->opt_host,
3549                              2,
3550                              (uint8_t *)&i2,
3551                              &parm_error);
3552         if (status != 0) {
3553                 printf(_("NetShareAdd failed with: %s\n"),
3554                         libnetapi_get_error_string(c->netapi_ctx, status));
3555         }
3556
3557         return status;
3558 }
3559
3560 /**
3561  * Delete a share on a remote RPC server.
3562  *
3563  * @param domain_sid The domain sid acquired from the remote server.
3564  * @param argc  Standard main() style argc.
3565  * @param argv  Standard main() style argv. Initial components are already
3566  *              stripped.
3567  *
3568  * @return A shell status integer (0 for success).
3569  **/
3570 static int rpc_share_delete(struct net_context *c, int argc, const char **argv)
3571 {
3572         if (argc < 1 || c->display_usage) {
3573                 return rpc_share_usage(c, argc, argv);
3574         }
3575
3576         return NetShareDel(c->opt_host, argv[0], 0);
3577 }
3578
3579 /**
3580  * Formatted print of share info
3581  *
3582  * @param r  pointer to SHARE_INFO_1 to format
3583  **/
3584
3585 static void display_share_info_1(struct net_context *c,
3586                                  struct SHARE_INFO_1 *r)
3587 {
3588         if (c->opt_long_list_entries) {
3589                 d_printf("%-12s %-8.8s %-50s\n",
3590                          r->shi1_netname,
3591                          net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
3592                          r->shi1_remark);
3593         } else {
3594                 d_printf("%s\n", r->shi1_netname);
3595         }
3596 }
3597
3598 static WERROR get_share_info(struct net_context *c,
3599                              struct rpc_pipe_client *pipe_hnd,
3600                              TALLOC_CTX *mem_ctx,
3601                              uint32 level,
3602                              int argc,
3603                              const char **argv,
3604                              struct srvsvc_NetShareInfoCtr *info_ctr)
3605 {
3606         WERROR result;
3607         NTSTATUS status;
3608         union srvsvc_NetShareInfo info;
3609         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3610
3611         /* no specific share requested, enumerate all */
3612         if (argc == 0) {
3613
3614                 uint32_t preferred_len = 0xffffffff;
3615                 uint32_t total_entries = 0;
3616                 uint32_t resume_handle = 0;
3617
3618                 info_ctr->level = level;
3619
3620                 status = dcerpc_srvsvc_NetShareEnumAll(b, mem_ctx,
3621                                                        pipe_hnd->desthost,
3622                                                        info_ctr,
3623                                                        preferred_len,
3624                                                        &total_entries,
3625                                                        &resume_handle,
3626                                                        &result);
3627                 if (!NT_STATUS_IS_OK(status)) {
3628                         return ntstatus_to_werror(status);
3629                 }
3630                 return result;
3631         }
3632
3633         /* request just one share */
3634         status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
3635                                                pipe_hnd->desthost,
3636                                                argv[0],
3637                                                level,
3638                                                &info,
3639                                                &result);
3640
3641         if (!NT_STATUS_IS_OK(status)) {
3642                 result = ntstatus_to_werror(status);
3643                 goto done;
3644         }
3645
3646         if (!W_ERROR_IS_OK(result)) {
3647                 goto done;
3648         }
3649
3650         /* construct ctr */
3651         ZERO_STRUCTP(info_ctr);
3652
3653         info_ctr->level = level;
3654
3655         switch (level) {
3656         case 1:
3657         {
3658                 struct srvsvc_NetShareCtr1 *ctr1;
3659
3660                 ctr1 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr1);
3661                 W_ERROR_HAVE_NO_MEMORY(ctr1);
3662
3663                 ctr1->count = 1;
3664                 ctr1->array = info.info1;
3665
3666                 info_ctr->ctr.ctr1 = ctr1;
3667
3668                 break;
3669         }
3670         case 2:
3671         {
3672                 struct srvsvc_NetShareCtr2 *ctr2;
3673
3674                 ctr2 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr2);
3675                 W_ERROR_HAVE_NO_MEMORY(ctr2);
3676
3677                 ctr2->count = 1;
3678                 ctr2->array = info.info2;
3679
3680                 info_ctr->ctr.ctr2 = ctr2;
3681
3682                 break;
3683         }
3684         case 502:
3685         {
3686                 struct srvsvc_NetShareCtr502 *ctr502;
3687
3688                 ctr502 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr502);
3689                 W_ERROR_HAVE_NO_MEMORY(ctr502);
3690
3691                 ctr502->count = 1;
3692                 ctr502->array = info.info502;
3693
3694                 info_ctr->ctr.ctr502 = ctr502;
3695
3696                 break;
3697         }
3698         } /* switch */
3699 done:
3700         return result;
3701 }
3702
3703 /***
3704  * 'net rpc share list' entrypoint.
3705  * @param argc  Standard main() style argc.
3706  * @param argv  Standard main() style argv. Initial components are already
3707  *              stripped.
3708  **/
3709 static int rpc_share_list(struct net_context *c, int argc, const char **argv)
3710 {
3711         NET_API_STATUS status;
3712         struct SHARE_INFO_1 *i1 = NULL;
3713         uint32_t entries_read = 0;
3714         uint32_t total_entries = 0;
3715         uint32_t resume_handle = 0;
3716         uint32_t i, level = 1;
3717
3718         if (c->display_usage) {
3719                 d_printf(  "%s\n"
3720                            "net rpc share list\n"
3721                            "    %s\n",
3722                          _("Usage:"),
3723                          _("List shares on remote server"));
3724                 return 0;
3725         }
3726
3727         status = NetShareEnum(c->opt_host,
3728                               level,
3729                               (uint8_t **)(void *)&i1,
3730                               (uint32_t)-1,
3731                               &entries_read,
3732                               &total_entries,
3733                               &resume_handle);
3734         if (status != 0) {
3735                 goto done;
3736         }
3737
3738         /* Display results */
3739
3740         if (c->opt_long_list_entries) {
3741                 d_printf(_(
3742         "\nEnumerating shared resources (exports) on remote server:\n\n"
3743         "\nShare name   Type     Description\n"
3744         "----------   ----     -----------\n"));
3745         }
3746         for (i = 0; i < entries_read; i++)
3747                 display_share_info_1(c, &i1[i]);
3748  done:
3749         return status;
3750 }
3751
3752 static bool check_share_availability(struct cli_state *cli, const char *netname)
3753 {
3754         NTSTATUS status;
3755
3756         status = cli_tree_connect(cli, netname, "A:", "", 0);
3757         if (!NT_STATUS_IS_OK(status)) {
3758                 d_printf(_("skipping   [%s]: not a file share.\n"), netname);
3759                 return false;
3760         }
3761
3762         status = cli_tdis(cli);
3763         if (!NT_STATUS_IS_OK(status)) {
3764                 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status));
3765                 return false;
3766         }
3767
3768         return true;
3769 }
3770
3771 static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
3772                                const char *netname, uint32 type)
3773 {
3774         /* only support disk shares */
3775         if (! ( type == STYPE_DISKTREE || type == (STYPE_DISKTREE | STYPE_HIDDEN)) ) {
3776                 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname,
3777                        type);
3778                 return false;
3779         }
3780
3781         /* skip builtin shares */
3782         /* FIXME: should print$ be added too ? */
3783         if (strequal(netname,"IPC$") || strequal(netname,"ADMIN$") ||
3784             strequal(netname,"global"))
3785                 return false;
3786
3787         if (c->opt_exclude && in_list(netname, c->opt_exclude, false)) {
3788                 printf(_("excluding  [%s]\n"), netname);
3789                 return false;
3790         }
3791
3792         return check_share_availability(cli, netname);
3793 }
3794
3795 /**
3796  * Migrate shares from a remote RPC server to the local RPC server.
3797  *
3798  * All parameters are provided by the run_rpc_command function, except for
3799  * argc, argv which are passed through.
3800  *
3801  * @param domain_sid The domain sid acquired from the remote server.
3802  * @param cli A cli_state connected to the server.
3803  * @param mem_ctx Talloc context, destroyed on completion of the function.
3804  * @param argc  Standard main() style argc.
3805  * @param argv  Standard main() style argv. Initial components are already
3806  *              stripped.
3807  *
3808  * @return Normal NTSTATUS return.
3809  **/
3810
3811 static NTSTATUS rpc_share_migrate_shares_internals(struct net_context *c,
3812                                                 const struct dom_sid *domain_sid,
3813                                                 const char *domain_name,
3814                                                 struct cli_state *cli,
3815                                                 struct rpc_pipe_client *pipe_hnd,
3816                                                 TALLOC_CTX *mem_ctx,
3817                                                 int argc,
3818                                                 const char **argv)
3819 {
3820         WERROR result;
3821         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3822         struct srvsvc_NetShareInfoCtr ctr_src;
3823         uint32 i;
3824         struct rpc_pipe_client *srvsvc_pipe = NULL;
3825         struct cli_state *cli_dst = NULL;
3826         uint32 level = 502; /* includes secdesc */
3827         uint32_t parm_error = 0;
3828         struct dcerpc_binding_handle *b;
3829
3830         result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3831                                 &ctr_src);
3832         if (!W_ERROR_IS_OK(result))
3833                 goto done;
3834
3835         /* connect destination PI_SRVSVC */
3836         nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3837                                      &ndr_table_srvsvc);
3838         if (!NT_STATUS_IS_OK(nt_status))
3839                 return nt_status;
3840
3841         b = srvsvc_pipe->binding_handle;
3842
3843         for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3844
3845                 union srvsvc_NetShareInfo info;
3846                 struct srvsvc_NetShareInfo502 info502 =
3847                         ctr_src.ctr.ctr502->array[i];
3848
3849                 /* reset error-code */
3850                 nt_status = NT_STATUS_UNSUCCESSFUL;
3851
3852                 if (!check_share_sanity(c, cli, info502.name, info502.type))
3853                         continue;
3854
3855                 /* finally add the share on the dst server */
3856
3857                 printf(_("migrating: [%s], path: %s, comment: %s, without "
3858                          "share-ACLs\n"),
3859                         info502.name, info502.path, info502.comment);
3860
3861                 info.info502 = &info502;
3862
3863                 nt_status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
3864                                                       srvsvc_pipe->desthost,
3865                                                       502,
3866                                                       &info,
3867                                                       &parm_error,
3868                                                       &result);
3869                 if (!NT_STATUS_IS_OK(nt_status)) {
3870                         printf(_("cannot add share: %s\n"),
3871                                 nt_errstr(nt_status));
3872                         goto done;
3873                 }
3874                 if (W_ERROR_V(result) == W_ERROR_V(WERR_FILE_EXISTS)) {
3875                         printf(_("           [%s] does already exist\n"),
3876                                 info502.name);
3877                         continue;
3878                 }
3879
3880                 if (!W_ERROR_IS_OK(result)) {
3881                         nt_status = werror_to_ntstatus(result);
3882                         printf(_("cannot add share: %s\n"),
3883                                 win_errstr(result));
3884                         goto done;
3885                 }
3886
3887         }
3888
3889         nt_status = NT_STATUS_OK;
3890
3891 done:
3892         if (cli_dst) {
3893                 cli_shutdown(cli_dst);
3894         }
3895
3896         return nt_status;
3897
3898 }
3899
3900 /**
3901  * Migrate shares from a RPC server to another.
3902  *
3903  * @param argc  Standard main() style argc.
3904  * @param argv  Standard main() style argv. Initial components are already
3905  *              stripped.
3906  *
3907  * @return A shell status integer (0 for success).
3908  **/
3909 static int rpc_share_migrate_shares(struct net_context *c, int argc,
3910                                     const char **argv)
3911 {
3912         if (c->display_usage) {
3913                 d_printf(  "%s\n"
3914                            "net rpc share migrate shares\n"
3915                            "    %s\n",
3916                          _("Usage:"),
3917                          _("Migrate shares to local server"));
3918                 return 0;
3919         }
3920
3921         if (!c->opt_host) {
3922                 printf(_("no server to migrate\n"));
3923                 return -1;
3924         }
3925
3926         return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
3927                                rpc_share_migrate_shares_internals,
3928                                argc, argv);
3929 }
3930
3931 /**
3932  * Copy a file/dir
3933  *
3934  * @param f     file_info
3935  * @param mask  current search mask
3936  * @param state arg-pointer
3937  *
3938  **/
3939 static NTSTATUS copy_fn(const char *mnt, struct file_info *f,
3940                     const char *mask, void *state)
3941 {
3942         static NTSTATUS nt_status;
3943         static struct copy_clistate *local_state;
3944         static fstring filename, new_mask;
3945         fstring dir;
3946         char *old_dir;
3947         struct net_context *c;
3948
3949         local_state = (struct copy_clistate *)state;
3950         nt_status = NT_STATUS_UNSUCCESSFUL;
3951
3952         c = local_state->c;
3953
3954         if (strequal(f->name, ".") || strequal(f->name, ".."))
3955                 return NT_STATUS_OK;
3956
3957         DEBUG(3,("got mask: %s, name: %s\n", mask, f->name));
3958
3959         /* DIRECTORY */
3960         if (f->mode & FILE_ATTRIBUTE_DIRECTORY) {
3961
3962                 DEBUG(3,("got dir: %s\n", f->name));
3963
3964                 fstrcpy(dir, local_state->cwd);
3965                 fstrcat(dir, "\\");
3966                 fstrcat(dir, f->name);
3967
3968                 switch (net_mode_share)
3969                 {
3970                 case NET_MODE_SHARE_MIGRATE:
3971                         /* create that directory */
3972                         nt_status = net_copy_file(c, local_state->mem_ctx,
3973                                                   local_state->cli_share_src,
3974                                                   local_state->cli_share_dst,
3975                                                   dir, dir,
3976                                                   c->opt_acls? true : false,
3977                                                   c->opt_attrs? true : false,
3978                                                   c->opt_timestamps? true:false,
3979                                                   false);
3980                         break;
3981                 default:
3982                         d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3983                         return NT_STATUS_INTERNAL_ERROR;
3984                 }
3985
3986                 if (!NT_STATUS_IS_OK(nt_status)) {
3987                         printf(_("could not handle dir %s: %s\n"),
3988                                 dir, nt_errstr(nt_status));
3989                         return nt_status;
3990                 }
3991
3992                 /* search below that directory */
3993                 if (strlcpy(new_mask, dir, sizeof(new_mask)) >= sizeof(new_mask)) {
3994                         return NT_STATUS_NO_MEMORY;
3995                 }
3996                 if (strlcat(new_mask, "\\*", sizeof(new_mask)) >= sizeof(new_mask)) {
3997                         return NT_STATUS_NO_MEMORY;
3998                 }
3999
4000                 old_dir = local_state->cwd;
4001                 local_state->cwd = dir;
4002                 nt_status = sync_files(local_state, new_mask);
4003                 if (!NT_STATUS_IS_OK(nt_status)) {
4004                         printf(_("could not handle files\n"));
4005                 }
4006                 local_state->cwd = old_dir;
4007
4008                 return nt_status;
4009         }
4010
4011
4012         /* FILE */
4013         fstrcpy(filename, local_state->cwd);
4014         fstrcat(filename, "\\");
4015         fstrcat(filename, f->name);
4016
4017         DEBUG(3,("got file: %s\n", filename));
4018
4019         switch (net_mode_share)
4020         {
4021         case NET_MODE_SHARE_MIGRATE:
4022                 nt_status = net_copy_file(c, local_state->mem_ctx,
4023                                           local_state->cli_share_src,
4024                                           local_state->cli_share_dst,
4025                                           filename, filename,
4026                                           c->opt_acls? true : false,
4027                                           c->opt_attrs? true : false,
4028                                           c->opt_timestamps? true: false,
4029                                           true);
4030                 break;
4031         default:
4032                 d_fprintf(stderr, _("Unsupported file mode %d\n"),
4033                           net_mode_share);
4034                 return NT_STATUS_INTERNAL_ERROR;
4035         }
4036
4037         if (!NT_STATUS_IS_OK(nt_status))
4038                 printf(_("could not handle file %s: %s\n"),
4039                         filename, nt_errstr(nt_status));
4040         return nt_status;
4041 }
4042
4043 /**
4044  * sync files, can be called recursivly to list files
4045  * and then call copy_fn for each file
4046  *
4047  * @param cp_clistate   pointer to the copy_clistate we work with
4048  * @param mask          the current search mask
4049  *
4050  * @return              Boolean result
4051  **/
4052 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask)
4053 {
4054         struct cli_state *targetcli;
4055         char *targetpath = NULL;
4056         NTSTATUS status;
4057
4058         DEBUG(3,("calling cli_list with mask: %s\n", mask));
4059
4060         status = cli_resolve_path(talloc_tos(), "", NULL,
4061                                   cp_clistate->cli_share_src,
4062                                   mask, &targetcli, &targetpath);
4063         if (!NT_STATUS_IS_OK(status)) {
4064                 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
4065                                     "%s\n"),
4066                         mask, nt_errstr(status));
4067                 return status;
4068         }
4069
4070         status = cli_list(targetcli, targetpath, cp_clistate->attribute,
4071                           copy_fn, cp_clistate);
4072         if (!NT_STATUS_IS_OK(status)) {
4073                 d_fprintf(stderr, _("listing %s failed with error: %s\n"),
4074                           mask, nt_errstr(status));
4075         }
4076
4077         return status;
4078 }
4079
4080
4081 /**
4082  * Set the top level directory permissions before we do any further copies.
4083  * Should set up ACL inheritance.
4084  **/
4085
4086 bool copy_top_level_perms(struct net_context *c,
4087                                 struct copy_clistate *cp_clistate,
4088                                 const char *sharename)
4089 {
4090         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4091
4092         switch (net_mode_share) {
4093         case NET_MODE_SHARE_MIGRATE:
4094                 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename));
4095                 nt_status = net_copy_fileattr(c,
4096                                                 cp_clistate->mem_ctx,
4097                                                 cp_clistate->cli_share_src,
4098                                                 cp_clistate->cli_share_dst,
4099                                                 "\\", "\\",
4100                                                 c->opt_acls? true : false,
4101                                                 c->opt_attrs? true : false,
4102                                                 c->opt_timestamps? true: false,
4103                                                 false);
4104                 break;
4105         default:
4106                 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
4107                 break;
4108         }
4109
4110         if (!NT_STATUS_IS_OK(nt_status))  {
4111                 printf(_("Could handle directory attributes for top level "
4112                          "directory of share %s. Error %s\n"),
4113                         sharename, nt_errstr(nt_status));
4114                 return false;
4115         }
4116
4117         return true;
4118 }
4119
4120 /**
4121  * Sync all files inside a remote share to another share (over smb).
4122  *
4123  * All parameters are provided by the run_rpc_command function, except for
4124  * argc, argv which are passed through.
4125  *
4126  * @param domain_sid The domain sid acquired from the remote server.
4127  * @param cli A cli_state connected to the server.
4128  * @param mem_ctx Talloc context, destroyed on completion of the function.
4129  * @param argc  Standard main() style argc.
4130  * @param argv  Standard main() style argv. Initial components are already
4131  *              stripped.
4132  *
4133  * @return Normal NTSTATUS return.
4134  **/
4135
4136 static NTSTATUS rpc_share_migrate_files_internals(struct net_context *c,
4137                                                 const struct dom_sid *domain_sid,
4138                                                 const char *domain_name,
4139                                                 struct cli_state *cli,
4140                                                 struct rpc_pipe_client *pipe_hnd,
4141                                                 TALLOC_CTX *mem_ctx,
4142                                                 int argc,
4143                                                 const char **argv)
4144 {
4145         WERROR result;
4146         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4147         struct srvsvc_NetShareInfoCtr ctr_src;
4148         uint32 i;
4149         uint32 level = 502;
4150         struct copy_clistate cp_clistate;
4151         bool got_src_share = false;
4152         bool got_dst_share = false;
4153         const char *mask = "\\*";
4154         char *dst = NULL;
4155
4156         dst = SMB_STRDUP(c->opt_destination?c->opt_destination:"127.0.0.1");
4157         if (dst == NULL) {
4158                 nt_status = NT_STATUS_NO_MEMORY;
4159                 goto done;
4160         }
4161
4162         result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
4163                                 &ctr_src);
4164
4165         if (!W_ERROR_IS_OK(result))
4166                 goto done;
4167
4168         for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
4169
4170                 struct srvsvc_NetShareInfo502 info502 =
4171                         ctr_src.ctr.ctr502->array[i];
4172
4173                 if (!check_share_sanity(c, cli, info502.name, info502.type))
4174                         continue;
4175
4176                 /* one might not want to mirror whole discs :) */
4177                 if (strequal(info502.name, "print$") || info502.name[1] == '$') {
4178                         d_printf(_("skipping   [%s]: builtin/hidden share\n"),
4179                                  info502.name);
4180                         continue;
4181                 }
4182
4183                 switch (net_mode_share)
4184                 {
4185                 case NET_MODE_SHARE_MIGRATE:
4186                         printf("syncing");
4187                         break;
4188                 default:
4189                         d_fprintf(stderr, _("Unsupported mode %d\n"),
4190                                   net_mode_share);
4191                         break;
4192                 }
4193                 printf(_("    [%s] files and directories %s ACLs, %s DOS "
4194                          "Attributes %s\n"),
4195                         info502.name,
4196                         c->opt_acls ? _("including") : _("without"),
4197                         c->opt_attrs ? _("including") : _("without"),
4198                         c->opt_timestamps ? _("(preserving timestamps)") : "");
4199
4200                 cp_clistate.mem_ctx = mem_ctx;
4201                 cp_clistate.cli_share_src = NULL;
4202                 cp_clistate.cli_share_dst = NULL;
4203                 cp_clistate.cwd = NULL;
4204                 cp_clistate.attribute = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
4205                 cp_clistate.c = c;
4206
4207                 /* open share source */
4208                 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
4209                                                smbXcli_conn_remote_sockaddr(cli->conn),
4210                                                smbXcli_conn_remote_name(cli->conn),
4211                                                info502.name, "A:");
4212                 if (!NT_STATUS_IS_OK(nt_status))
4213                         goto done;
4214
4215                 got_src_share = true;
4216
4217                 if (net_mode_share == NET_MODE_SHARE_MIGRATE) {
4218                         /* open share destination */
4219                         nt_status = connect_to_service(c, &cp_clistate.cli_share_dst,
4220                                                        NULL, dst, info502.name, "A:");
4221                         if (!NT_STATUS_IS_OK(nt_status))
4222                                 goto done;
4223
4224                         got_dst_share = true;
4225                 }
4226
4227                 if (!copy_top_level_perms(c, &cp_clistate, info502.name)) {
4228                         d_fprintf(stderr, _("Could not handle the top level "
4229                                             "directory permissions for the "
4230                                             "share: %s\n"), info502.name);
4231                         nt_status = NT_STATUS_UNSUCCESSFUL;
4232                         goto done;
4233                 }
4234
4235                 nt_status = sync_files(&cp_clistate, mask);
4236                 if (!NT_STATUS_IS_OK(nt_status)) {
4237                         d_fprintf(stderr, _("could not handle files for share: "
4238                                             "%s\n"), info502.name);
4239                         goto done;
4240                 }
4241         }
4242
4243         nt_status = NT_STATUS_OK;
4244
4245 done:
4246
4247         if (got_src_share)
4248                 cli_shutdown(cp_clistate.cli_share_src);
4249
4250         if (got_dst_share)
4251                 cli_shutdown(cp_clistate.cli_share_dst);
4252
4253         SAFE_FREE(dst);
4254         return nt_status;
4255
4256 }
4257
4258 static int rpc_share_migrate_files(struct net_context *c, int argc, const char **argv)
4259 {
4260         if (c->display_usage) {
4261                 d_printf(  "%s\n"
4262                            "net share migrate files\n"
4263                            "    %s\n",
4264                          _("Usage:"),
4265                          _("Migrate files to local server"));
4266                 return 0;
4267         }
4268
4269         if (!c->opt_host) {
4270                 d_printf(_("no server to migrate\n"));
4271                 return -1;
4272         }
4273
4274         return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4275                                rpc_share_migrate_files_internals,
4276                                argc, argv);
4277 }
4278
4279 /**
4280  * Migrate share-ACLs from a remote RPC server to the local RPC server.
4281  *
4282  * All parameters are provided by the run_rpc_command function, except for
4283  * argc, argv which are passed through.
4284  *
4285  * @param domain_sid The domain sid acquired from the remote server.
4286  * @param cli A cli_state connected to the server.
4287  * @param mem_ctx Talloc context, destroyed on completion of the function.
4288  * @param argc  Standard main() style argc.
4289  * @param argv  Standard main() style argv. Initial components are already
4290  *              stripped.
4291  *
4292  * @return Normal NTSTATUS return.
4293  **/
4294
4295 static NTSTATUS rpc_share_migrate_security_internals(struct net_context *c,
4296                                                 const struct dom_sid *domain_sid,
4297                                                 const char *domain_name,
4298                                                 struct cli_state *cli,
4299                                                 struct rpc_pipe_client *pipe_hnd,
4300                                                 TALLOC_CTX *mem_ctx,
4301                                                 int argc,
4302                                                 const char **argv)
4303 {
4304         WERROR result;
4305         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4306         struct srvsvc_NetShareInfoCtr ctr_src;
4307         union srvsvc_NetShareInfo info;
4308         uint32 i;
4309         struct rpc_pipe_client *srvsvc_pipe = NULL;
4310         struct cli_state *cli_dst = NULL;
4311         uint32 level = 502; /* includes secdesc */
4312         uint32_t parm_error = 0;
4313         struct dcerpc_binding_handle *b;
4314
4315         result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
4316                                 &ctr_src);
4317
4318         if (!W_ERROR_IS_OK(result))
4319                 goto done;
4320
4321         /* connect destination PI_SRVSVC */
4322         nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
4323                                      &ndr_table_srvsvc);
4324         if (!NT_STATUS_IS_OK(nt_status))
4325                 return nt_status;
4326
4327         b = srvsvc_pipe->binding_handle;
4328
4329         for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
4330
4331                 struct srvsvc_NetShareInfo502 info502 =
4332                         ctr_src.ctr.ctr502->array[i];
4333
4334                 /* reset error-code */
4335                 nt_status = NT_STATUS_UNSUCCESSFUL;
4336
4337                 if (!check_share_sanity(c, cli, info502.name, info502.type))
4338                         continue;
4339
4340                 printf(_("migrating: [%s], path: %s, comment: %s, including "
4341                          "share-ACLs\n"),
4342                         info502.name, info502.path, info502.comment);
4343
4344                 if (c->opt_verbose)
4345                         display_sec_desc(info502.sd_buf.sd);
4346
4347                 /* FIXME: shouldn't we be able to just set the security descriptor ? */
4348                 info.info502 = &info502;
4349
4350                 /* finally modify the share on the dst server */
4351                 nt_status = dcerpc_srvsvc_NetShareSetInfo(b, mem_ctx,
4352                                                           srvsvc_pipe->desthost,
4353                                                           info502.name,
4354                                                           level,
4355                                                           &info,
4356                                                           &parm_error,
4357                                                           &result);
4358                 if (!NT_STATUS_IS_OK(nt_status)) {
4359                         printf(_("cannot set share-acl: %s\n"),
4360                                nt_errstr(nt_status));
4361                         goto done;
4362                 }
4363                 if (!W_ERROR_IS_OK(result)) {
4364                         nt_status = werror_to_ntstatus(result);
4365                         printf(_("cannot set share-acl: %s\n"),
4366                                win_errstr(result));
4367                         goto done;
4368                 }
4369
4370         }
4371
4372         nt_status = NT_STATUS_OK;
4373
4374 done:
4375         if (cli_dst) {
4376                 cli_shutdown(cli_dst);
4377         }
4378
4379         return nt_status;
4380
4381 }
4382
4383 /**
4384  * Migrate share-acls from a RPC server to another.
4385  *
4386  * @param argc  Standard main() style argc.
4387  * @param argv  Standard main() style argv. Initial components are already
4388  *              stripped.
4389  *
4390  * @return A shell status integer (0 for success).
4391  **/
4392 static int rpc_share_migrate_security(struct net_context *c, int argc,
4393                                       const char **argv)
4394 {
4395         if (c->display_usage) {
4396                 d_printf(  "%s\n"
4397                            "net rpc share migrate security\n"
4398                            "    %s\n",
4399                          _("Usage:"),
4400                          _("Migrate share-acls to local server"));
4401                 return 0;
4402         }
4403
4404         if (!c->opt_host) {
4405                 d_printf(_("no server to migrate\n"));
4406                 return -1;
4407         }
4408
4409         return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4410                                rpc_share_migrate_security_internals,
4411                                argc, argv);
4412 }
4413
4414 /**
4415  * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
4416  * from one server to another.
4417  *
4418  * @param argc  Standard main() style argc.
4419  * @param argv  Standard main() style argv. Initial components are already
4420  *              stripped.
4421  *
4422  * @return A shell status integer (0 for success).
4423  *
4424  **/
4425 static int rpc_share_migrate_all(struct net_context *c, int argc,
4426                                  const char **argv)
4427 {
4428         int ret;
4429
4430         if (c->display_usage) {
4431                 d_printf(  "%s\n"
4432                            "net rpc share migrate all\n"
4433                            "    %s\n",
4434                          _("Usage:"),
4435                          _("Migrates shares including all share settings"));
4436                 return 0;
4437         }
4438
4439         if (!c->opt_host) {
4440                 d_printf(_("no server to migrate\n"));
4441                 return -1;
4442         }
4443
4444         /* order is important. we don't want to be locked out by the share-acl
4445          * before copying files - gd */
4446
4447         ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4448                               rpc_share_migrate_shares_internals, argc, argv);
4449         if (ret)
4450                 return ret;
4451
4452         ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4453                               rpc_share_migrate_files_internals, argc, argv);
4454         if (ret)
4455                 return ret;
4456
4457         return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4458                                rpc_share_migrate_security_internals, argc,
4459                                argv);
4460 }
4461
4462
4463 /**
4464  * 'net rpc share migrate' entrypoint.
4465  * @param argc  Standard main() style argc.
4466  * @param argv  Standard main() style argv. Initial components are already
4467  *              stripped.
4468  **/
4469 static int rpc_share_migrate(struct net_context *c, int argc, const char **argv)
4470 {
4471
4472         struct functable func[] = {
4473                 {
4474                         "all",
4475                         rpc_share_migrate_all,
4476                         NET_TRANSPORT_RPC,
4477                         N_("Migrate shares from remote to local server"),
4478                         N_("net rpc share migrate all\n"
4479                            "    Migrate shares from remote to local server")
4480                 },
4481                 {
4482                         "files",
4483                         rpc_share_migrate_files,
4484                         NET_TRANSPORT_RPC,
4485                         N_("Migrate files from remote to local server"),
4486                         N_("net rpc share migrate files\n"
4487                            "    Migrate files from remote to local server")
4488                 },
4489                 {
4490                         "security",
4491                         rpc_share_migrate_security,
4492                         NET_TRANSPORT_RPC,
4493                         N_("Migrate share-ACLs from remote to local server"),
4494                         N_("net rpc share migrate security\n"
4495                            "    Migrate share-ACLs from remote to local server")
4496                 },
4497                 {
4498                         "shares",
4499                         rpc_share_migrate_shares,
4500                         NET_TRANSPORT_RPC,
4501                         N_("Migrate shares from remote to local server"),
4502                         N_("net rpc share migrate shares\n"
4503                            "    Migrate shares from remote to local server")
4504                 },
4505                 {NULL, NULL, 0, NULL, NULL}
4506         };
4507
4508         net_mode_share = NET_MODE_SHARE_MIGRATE;
4509
4510         return net_run_function(c, argc, argv, "net rpc share migrate", func);
4511 }
4512
4513 struct full_alias {
4514         struct dom_sid sid;
4515         uint32 num_members;
4516         struct dom_sid *members;
4517 };
4518
4519 static int num_server_aliases;
4520 static struct full_alias *server_aliases;
4521
4522 /*
4523  * Add an alias to the static list.
4524  */
4525 static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
4526 {
4527         if (server_aliases == NULL)
4528                 server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);
4529
4530         server_aliases[num_server_aliases] = *alias;
4531         num_server_aliases += 1;
4532 }
4533
4534 /*
4535  * For a specific domain on the server, fetch all the aliases
4536  * and their members. Add all of them to the server_aliases.
4537  */
4538
4539 static NTSTATUS rpc_fetch_domain_aliases(struct rpc_pipe_client *pipe_hnd,
4540                                         TALLOC_CTX *mem_ctx,
4541                                         struct policy_handle *connect_pol,
4542                                         const struct dom_sid *domain_sid)
4543 {
4544         uint32 start_idx, max_entries, num_entries, i;
4545         struct samr_SamArray *groups = NULL;
4546         NTSTATUS result, status;
4547         struct policy_handle domain_pol;
4548         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4549
4550         /* Get domain policy handle */
4551
4552         status = dcerpc_samr_OpenDomain(b, mem_ctx,
4553                                         connect_pol,
4554                                         MAXIMUM_ALLOWED_ACCESS,
4555                                         discard_const_p(struct dom_sid2, domain_sid),
4556                                         &domain_pol,
4557                                         &result);
4558         if (!NT_STATUS_IS_OK(status)) {
4559                 return status;
4560         }
4561         if (!NT_STATUS_IS_OK(result)) {
4562                 return result;
4563         }
4564
4565         start_idx = 0;
4566         max_entries = 250;
4567
4568         do {
4569                 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
4570                                                        &domain_pol,
4571                                                        &start_idx,
4572                                                        &groups,
4573                                                        max_entries,
4574                                                        &num_entries,
4575                                                        &result);
4576                 if (!NT_STATUS_IS_OK(status)) {
4577                         goto done;
4578                 }
4579                 for (i = 0; i < num_entries; i++) {
4580
4581                         struct policy_handle alias_pol;
4582                         struct full_alias alias;
4583                         struct lsa_SidArray sid_array;
4584                         int j;
4585                         NTSTATUS _result;
4586
4587                         status = dcerpc_samr_OpenAlias(b, mem_ctx,
4588                                                        &domain_pol,
4589                                                        MAXIMUM_ALLOWED_ACCESS,
4590                                                        groups->entries[i].idx,
4591                                                        &alias_pol,
4592                                                        &_result);
4593                         if (!NT_STATUS_IS_OK(status)) {
4594                                 goto done;
4595                         }
4596                         if (!NT_STATUS_IS_OK(_result)) {
4597                                 status = _result;
4598                                 goto done;
4599                         }
4600
4601                         status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
4602                                                                &alias_pol,
4603                                                                &sid_array,
4604                                                                &_result);
4605                         if (!NT_STATUS_IS_OK(status)) {
4606                                 goto done;
4607                         }
4608                         if (!NT_STATUS_IS_OK(_result)) {
4609                                 status = _result;
4610                                 goto done;
4611                         }
4612
4613                         alias.num_members = sid_array.num_sids;
4614
4615                         status = dcerpc_samr_Close(b, mem_ctx, &alias_pol, &_result);
4616                         if (!NT_STATUS_IS_OK(status)) {
4617                                 goto done;
4618                         }
4619                         if (!NT_STATUS_IS_OK(_result)) {
4620                                 status = _result;
4621                                 goto done;
4622                         }
4623
4624                         alias.members = NULL;
4625
4626                         if (alias.num_members > 0) {
4627                                 alias.members = SMB_MALLOC_ARRAY(struct dom_sid, alias.num_members);
4628
4629                                 for (j = 0; j < alias.num_members; j++)
4630                                         sid_copy(&alias.members[j],
4631                                                  sid_array.sids[j].sid);
4632                         }
4633
4634                         sid_compose(&alias.sid, domain_sid,
4635                                     groups->entries[i].idx);
4636
4637                         push_alias(mem_ctx, &alias);
4638                 }
4639         } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
4640
4641         status = NT_STATUS_OK;
4642
4643  done:
4644         dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
4645
4646         return status;
4647 }
4648
4649 /*
4650  * Dump server_aliases as names for debugging purposes.
4651  */
4652
4653 static NTSTATUS rpc_aliaslist_dump(struct net_context *c,
4654                                 const struct dom_sid *domain_sid,
4655                                 const char *domain_name,
4656                                 struct cli_state *cli,
4657                                 struct rpc_pipe_client *pipe_hnd,
4658                                 TALLOC_CTX *mem_ctx,
4659                                 int argc,
4660                                 const char **argv)
4661 {
4662         int i;
4663         NTSTATUS result;
4664         struct policy_handle lsa_pol;
4665         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4666
4667         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
4668                                      SEC_FLAG_MAXIMUM_ALLOWED,
4669                                      &lsa_pol);
4670         if (!NT_STATUS_IS_OK(result))
4671                 return result;
4672
4673         for (i=0; i<num_server_aliases; i++) {
4674                 char **names;
4675                 char **domains;
4676                 enum lsa_SidType *types;
4677                 int j;
4678
4679                 struct full_alias *alias = &server_aliases[i];
4680
4681                 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol, 1,
4682                                              &alias->sid,
4683                                              &domains, &names, &types);
4684                 if (!NT_STATUS_IS_OK(result))
4685                         continue;
4686
4687                 DEBUG(1, ("%s\\%s %d: ", domains[0], names[0], types[0]));
4688
4689                 if (alias->num_members == 0) {
4690                         DEBUG(1, ("\n"));
4691                         continue;
4692                 }
4693
4694                 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol,
4695                                              alias->num_members,
4696                                              alias->members,
4697                                              &domains, &names, &types);
4698
4699                 if (!NT_STATUS_IS_OK(result) &&
4700                     !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
4701                         continue;
4702
4703                 for (j=0; j<alias->num_members; j++)
4704                         DEBUG(1, ("%s\\%s (%d); ",
4705                                   domains[j] ? domains[j] : "*unknown*",
4706                                   names[j] ? names[j] : "*unknown*",types[j]));
4707                 DEBUG(1, ("\n"));
4708         }
4709
4710         dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
4711
4712         return NT_STATUS_OK;
4713 }
4714
4715 /*
4716  * Fetch a list of all server aliases and their members into
4717  * server_aliases.
4718  */
4719
4720 static NTSTATUS rpc_aliaslist_internals(struct net_context *c,
4721                                         const struct dom_sid *domain_sid,
4722                                         const char *domain_name,
4723                                         struct cli_state *cli,
4724                                         struct rpc_pipe_client *pipe_hnd,
4725                                         TALLOC_CTX *mem_ctx,
4726                                         int argc,
4727                                         const char **argv)
4728 {
4729         NTSTATUS result, status;
4730         struct policy_handle connect_pol;
4731         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4732
4733         status = dcerpc_samr_Connect2(b, mem_ctx,
4734                                       pipe_hnd->desthost,
4735                                       MAXIMUM_ALLOWED_ACCESS,
4736                                       &connect_pol,
4737                                       &result);
4738         if (!NT_STATUS_IS_OK(status)) {
4739                 goto done;
4740         }
4741         if (!NT_STATUS_IS_OK(result)) {
4742                 status = result;
4743                 goto done;
4744         }
4745
4746         status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4747                                           &global_sid_Builtin);
4748         if (!NT_STATUS_IS_OK(status)) {
4749                 goto done;
4750         }
4751
4752         status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4753                                           domain_sid);
4754
4755         dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
4756  done:
4757         return status;
4758 }
4759
4760 static void init_user_token(struct security_token *token, struct dom_sid *user_sid)
4761 {
4762         token->num_sids = 4;
4763
4764         if (!(token->sids = SMB_MALLOC_ARRAY(struct dom_sid, 4))) {
4765                 d_fprintf(stderr, "malloc %s\n",_("failed"));
4766                 token->num_sids = 0;
4767                 return;
4768         }
4769
4770         token->sids[0] = *user_sid;
4771         sid_copy(&token->sids[1], &global_sid_World);
4772         sid_copy(&token->sids[2], &global_sid_Network);
4773         sid_copy(&token->sids[3], &global_sid_Authenticated_Users);
4774 }
4775
4776 static void free_user_token(struct security_token *token)
4777 {
4778         SAFE_FREE(token->sids);
4779 }
4780
4781 static void add_sid_to_token(struct security_token *token, struct dom_sid *sid)
4782 {
4783         if (security_token_has_sid(token, sid))
4784                 return;
4785
4786         token->sids = SMB_REALLOC_ARRAY(token->sids, struct dom_sid, token->num_sids+1);
4787         if (!token->sids) {
4788                 return;
4789         }
4790
4791         sid_copy(&token->sids[token->num_sids], sid);
4792
4793         token->num_sids += 1;
4794 }
4795
4796 struct user_token {
4797         fstring name;
4798         struct security_token token;
4799 };
4800
4801 static void dump_user_token(struct user_token *token)
4802 {
4803         int i;
4804
4805         d_printf("%s\n", token->name);
4806
4807         for (i=0; i<token->token.num_sids; i++) {
4808                 d_printf(" %s\n", sid_string_tos(&token->token.sids[i]));
4809         }
4810 }
4811
4812 static bool is_alias_member(struct dom_sid *sid, struct full_alias *alias)
4813 {
4814         int i;
4815
4816         for (i=0; i<alias->num_members; i++) {
4817                 if (dom_sid_compare(sid, &alias->members[i]) == 0)
4818                         return true;
4819         }
4820
4821         return false;
4822 }
4823
4824 static void collect_sid_memberships(struct security_token *token, struct dom_sid sid)
4825 {
4826         int i;
4827
4828         for (i=0; i<num_server_aliases; i++) {
4829                 if (is_alias_member(&sid, &server_aliases[i]))
4830                         add_sid_to_token(token, &server_aliases[i].sid);
4831         }
4832 }
4833
4834 /*
4835  * We got a user token with all the SIDs we can know about without asking the
4836  * server directly. These are the user and domain group sids. All of these can
4837  * be members of aliases. So scan the list of aliases for each of the SIDs and
4838  * add them to the token.
4839  */
4840
4841 static void collect_alias_memberships(struct security_token *token)
4842 {
4843         int num_global_sids = token->num_sids;
4844         int i;
4845
4846         for (i=0; i<num_global_sids; i++) {
4847                 collect_sid_memberships(token, token->sids[i]);
4848         }
4849 }
4850
4851 static bool get_user_sids(const char *domain, const char *user, struct security_token *token)
4852 {
4853         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4854         enum wbcSidType type;
4855         fstring full_name;
4856         struct wbcDomainSid wsid;
4857         char sid_str[WBC_SID_STRING_BUFLEN];
4858         struct dom_sid user_sid;
4859         uint32_t num_groups;
4860         gid_t *groups = NULL;
4861         uint32_t i;
4862
4863         fstr_sprintf(full_name, "%s%c%s",
4864                      domain, *lp_winbind_separator(), user);
4865
4866         /* First let's find out the user sid */
4867
4868         wbc_status = wbcLookupName(domain, user, &wsid, &type);
4869
4870         if (!WBC_ERROR_IS_OK(wbc_status)) {
4871                 DEBUG(1, ("winbind could not find %s: %s\n",
4872                           full_name, wbcErrorString(wbc_status)));
4873                 return false;
4874         }
4875
4876         wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4877
4878         if (type != WBC_SID_NAME_USER) {
4879                 DEBUG(1, ("%s is not a user\n", full_name));
4880                 return false;
4881         }
4882
4883         if (!string_to_sid(&user_sid, sid_str)) {
4884                 DEBUG(1,("Could not convert sid %s from string\n", sid_str));
4885                 return false;
4886         }
4887
4888         init_user_token(token, &user_sid);
4889
4890         /* And now the groups winbind knows about */
4891
4892         wbc_status = wbcGetGroups(full_name, &num_groups, &groups);
4893         if (!WBC_ERROR_IS_OK(wbc_status)) {
4894                 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4895                         full_name, wbcErrorString(wbc_status)));
4896                 return false;
4897         }
4898
4899         for (i = 0; i < num_groups; i++) {
4900                 gid_t gid = groups[i];
4901                 struct dom_sid sid;
4902                 bool ok;
4903
4904                 wbc_status = wbcGidToSid(gid, &wsid);
4905                 if (!WBC_ERROR_IS_OK(wbc_status)) {
4906                         DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4907                                   (unsigned int)gid, wbcErrorString(wbc_status)));
4908                         wbcFreeMemory(groups);
4909                         return false;
4910                 }
4911
4912                 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4913
4914                 DEBUG(3, (" %s\n", sid_str));
4915
4916                 ok = string_to_sid(&sid, sid_str);
4917                 if (!ok) {
4918                         DEBUG(1, ("Failed to convert string to SID\n"));
4919                         wbcFreeMemory(groups);
4920                         return false;
4921                 }
4922                 add_sid_to_token(token, &sid);
4923         }
4924         wbcFreeMemory(groups);
4925
4926         return true;
4927 }
4928
4929 /**
4930  * Get a list of all user tokens we want to look at
4931  **/
4932
4933 static bool get_user_tokens(struct net_context *c, int *num_tokens,
4934                             struct user_token **user_tokens)
4935 {
4936         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4937         uint32_t i, num_users;
4938         const char **users;
4939         struct user_token *result;
4940         TALLOC_CTX *frame = NULL;
4941
4942         if (lp_winbind_use_default_domain() &&
4943             (c->opt_target_workgroup == NULL)) {
4944                 d_fprintf(stderr, _("winbind use default domain = yes set, "
4945                          "please specify a workgroup\n"));
4946                 return false;
4947         }
4948
4949         /* Send request to winbind daemon */
4950
4951         wbc_status = wbcListUsers(NULL, &num_users, &users);
4952         if (!WBC_ERROR_IS_OK(wbc_status)) {
4953                 DEBUG(1, (_("winbind could not list users: %s\n"),
4954                           wbcErrorString(wbc_status)));
4955                 return false;
4956         }
4957
4958         result = SMB_MALLOC_ARRAY(struct user_token, num_users);
4959
4960         if (result == NULL) {
4961                 DEBUG(1, ("Could not malloc sid array\n"));
4962                 wbcFreeMemory(users);
4963                 return false;
4964         }
4965
4966         frame = talloc_stackframe();
4967         for (i=0; i < num_users; i++) {
4968                 fstring domain, user;
4969                 char *p;
4970
4971                 fstrcpy(result[i].name, users[i]);
4972
4973                 p = strchr(users[i], *lp_winbind_separator());
4974
4975                 DEBUG(3, ("%s\n", users[i]));
4976
4977                 if (p == NULL) {
4978                         fstrcpy(domain, c->opt_target_workgroup);
4979                         fstrcpy(user, users[i]);
4980                 } else {
4981                         *p++ = '\0';
4982                         fstrcpy(domain, users[i]);
4983                         if (!strupper_m(domain)) {
4984                                 DEBUG(1, ("strupper_m %s failed\n", domain));
4985                                 wbcFreeMemory(users);
4986                                 return false;
4987                         }
4988                         fstrcpy(user, p);
4989                 }
4990
4991                 get_user_sids(domain, user, &(result[i].token));
4992         }
4993         TALLOC_FREE(frame);
4994         wbcFreeMemory(users);
4995
4996         *num_tokens = num_users;
4997         *user_tokens = result;
4998
4999         return true;
5000 }
5001
5002 static bool get_user_tokens_from_file(FILE *f,
5003                                       int *num_tokens,
5004                                       struct user_token **tokens)
5005 {
5006         struct user_token *token = NULL;
5007
5008         while (!feof(f)) {
5009                 fstring line;
5010
5011                 if (fgets(line, sizeof(line)-1, f) == NULL) {
5012                         return true;
5013                 }
5014
5015                 if ((strlen(line) > 0) && (line[strlen(line)-1] == '\n')) {
5016                         line[strlen(line)-1] = '\0';
5017                 }
5018
5019                 if (line[0] == ' ') {
5020                         /* We have a SID */
5021
5022                         struct dom_sid sid;
5023                         if(!string_to_sid(&sid, &line[1])) {
5024                                 DEBUG(1,("get_user_tokens_from_file: Could "
5025                                         "not convert sid %s \n",&line[1]));
5026                                 return false;
5027                         }
5028
5029                         if (token == NULL) {
5030                                 DEBUG(0, ("File does not begin with username"));
5031                                 return false;
5032                         }
5033
5034                         add_sid_to_token(&token->token, &sid);
5035                         continue;
5036                 }
5037
5038                 /* And a new user... */
5039
5040                 *num_tokens += 1;
5041                 *tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
5042                 if (*tokens == NULL) {
5043                         DEBUG(0, ("Could not realloc tokens\n"));
5044                         return false;
5045                 }
5046
5047                 token = &((*tokens)[*num_tokens-1]);
5048
5049                 if (strlcpy(token->name, line, sizeof(token->name)) >= sizeof(token->name)) {
5050                         return false;
5051                 }
5052                 token->token.num_sids = 0;
5053                 token->token.sids = NULL;
5054                 continue;
5055         }
5056
5057         return false;
5058 }
5059
5060
5061 /*
5062  * Show the list of all users that have access to a share
5063  */
5064
5065 static void show_userlist(struct rpc_pipe_client *pipe_hnd,
5066                           struct cli_state *cli,
5067                           TALLOC_CTX *mem_ctx,
5068                           const char *netname,
5069                           int num_tokens,
5070                           struct user_token *tokens)
5071 {
5072         uint16_t fnum;
5073         struct security_descriptor *share_sd = NULL;
5074         struct security_descriptor *root_sd = NULL;
5075         int i;
5076         union srvsvc_NetShareInfo info;
5077         WERROR result;
5078         NTSTATUS status;
5079         uint16 cnum;
5080         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5081
5082         status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
5083                                                pipe_hnd->desthost,
5084                                                netname,
5085                                                502,
5086                                                &info,
5087                                                &result);
5088
5089         if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
5090                 DEBUG(1, ("Coult not query secdesc for share %s\n",
5091                           netname));
5092                 return;
5093         }
5094
5095         share_sd = info.info502->sd_buf.sd;
5096         if (share_sd == NULL) {
5097                 DEBUG(1, ("Got no secdesc for share %s\n",
5098                           netname));
5099         }
5100
5101         cnum = cli_state_get_tid(cli);
5102
5103         if (!NT_STATUS_IS_OK(cli_tree_connect(cli, netname, "A:", "", 0))) {
5104                 return;
5105         }
5106
5107         if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
5108                         FILE_SHARE_READ|FILE_SHARE_WRITE,
5109                         FILE_OPEN, 0x0, 0x0, &fnum, NULL))) {
5110                 cli_query_secdesc(cli, fnum, mem_ctx, &root_sd);
5111         }
5112
5113         for (i=0; i<num_tokens; i++) {
5114                 uint32 acc_granted;
5115
5116                 if (share_sd != NULL) {
5117                         status = se_access_check(share_sd, &tokens[i].token,
5118                                              1, &acc_granted);
5119
5120                         if (!NT_STATUS_IS_OK(status)) {
5121                                 DEBUG(1, ("Could not check share_sd for "
5122                                           "user %s\n",
5123                                           tokens[i].name));
5124                                 continue;
5125                         }
5126                 }
5127
5128                 if (root_sd == NULL) {
5129                         d_printf(" %s\n", tokens[i].name);
5130                         continue;
5131                 }
5132
5133                 status = se_access_check(root_sd, &tokens[i].token,
5134                                      1, &acc_granted);
5135                 if (!NT_STATUS_IS_OK(status)) {
5136                         DEBUG(1, ("Could not check root_sd for user %s\n",
5137                                   tokens[i].name));
5138                         continue;
5139                 }
5140                 d_printf(" %s\n", tokens[i].name);
5141         }
5142
5143         if (fnum != (uint16_t)-1)
5144                 cli_close(cli, fnum);
5145         cli_tdis(cli);
5146         cli_state_set_tid(cli, cnum);
5147
5148         return;
5149 }
5150
5151 /**
5152  * List shares on a remote RPC server, including the security descriptors.
5153  *
5154  * All parameters are provided by the run_rpc_command function, except for
5155  * argc, argv which are passed through.
5156  *
5157  * @param domain_sid The domain sid acquired from the remote server.
5158  * @param cli A cli_state connected to the server.
5159  * @param mem_ctx Talloc context, destroyed on completion of the function.
5160  * @param argc  Standard main() style argc.
5161  * @param argv  Standard main() style argv. Initial components are already
5162  *              stripped.
5163  *
5164  * @return Normal NTSTATUS return.
5165  **/
5166
5167 static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
5168                                                 const struct dom_sid *domain_sid,
5169                                                 const char *domain_name,
5170                                                 struct cli_state *cli,
5171                                                 struct rpc_pipe_client *pipe_hnd,
5172                                                 TALLOC_CTX *mem_ctx,
5173                                                 int argc,
5174                                                 const char **argv)
5175 {
5176         bool r;
5177         FILE *f;
5178         NTSTATUS nt_status = NT_STATUS_OK;
5179         uint32_t total_entries = 0;
5180         uint32_t resume_handle = 0;
5181         uint32_t preferred_len = 0xffffffff;
5182         uint32_t i;
5183         struct dcerpc_binding_handle *b = NULL;
5184         struct srvsvc_NetShareInfoCtr info_ctr;
5185         struct srvsvc_NetShareCtr1 ctr1;
5186         WERROR result;
5187
5188         struct user_token *tokens = NULL;
5189         int num_tokens = 0;
5190
5191         if (argc == 0) {
5192                 f = stdin;
5193         } else {
5194                 f = fopen(argv[0], "r");
5195         }
5196
5197         if (f == NULL) {
5198                 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno)));
5199                 return NT_STATUS_UNSUCCESSFUL;
5200         }
5201
5202         r = get_user_tokens_from_file(f, &num_tokens, &tokens);
5203
5204         if (f != stdin)
5205                 fclose(f);
5206
5207         if (!r) {
5208                 DEBUG(0, ("Could not read users from file\n"));
5209                 return NT_STATUS_UNSUCCESSFUL;
5210         }
5211
5212         for (i=0; i<num_tokens; i++)
5213                 collect_alias_memberships(&tokens[i].token);
5214
5215         ZERO_STRUCT(info_ctr);
5216         ZERO_STRUCT(ctr1);
5217
5218         info_ctr.level = 1;
5219         info_ctr.ctr.ctr1 = &ctr1;
5220
5221         b = pipe_hnd->binding_handle;
5222
5223         /* Issue the NetShareEnum RPC call and retrieve the response */
5224         nt_status = dcerpc_srvsvc_NetShareEnumAll(b,
5225                                         talloc_tos(),
5226                                         pipe_hnd->desthost,
5227                                         &info_ctr,
5228                                         preferred_len,
5229                                         &total_entries,
5230                                         &resume_handle,
5231                                         &result);
5232
5233         /* Was it successful? */
5234         if (!NT_STATUS_IS_OK(nt_status)) {
5235                 /*  Nope.  Go clean up. */
5236                 goto done;
5237         }
5238
5239         if (!W_ERROR_IS_OK(result)) {
5240                 /*  Nope.  Go clean up. */
5241                 nt_status = werror_to_ntstatus(result);
5242                 goto done;
5243         }
5244
5245         if (total_entries == 0) {
5246                 goto done;
5247         }
5248
5249         /* For each returned entry... */
5250         for (i = 0; i < info_ctr.ctr.ctr1->count; i++) {
5251                 const char *netname = info_ctr.ctr.ctr1->array[i].name;
5252
5253                 if (info_ctr.ctr.ctr1->array[i].type != STYPE_DISKTREE) {
5254                         continue;
5255                 }
5256
5257                 d_printf("%s\n", netname);
5258
5259                 show_userlist(pipe_hnd, cli, mem_ctx, netname,
5260                               num_tokens, tokens);
5261         }
5262  done:
5263         for (i=0; i<num_tokens; i++) {
5264                 free_user_token(&tokens[i].token);
5265         }
5266         SAFE_FREE(tokens);
5267
5268         return nt_status;
5269 }
5270
5271 static int rpc_share_allowedusers(struct net_context *c, int argc,
5272                                   const char **argv)
5273 {
5274         int result;
5275
5276         if (c->display_usage) {
5277                 d_printf(  "%s\n"
5278                            "net rpc share allowedusers\n"
5279                             "    %s\n",
5280                           _("Usage:"),
5281                           _("List allowed users"));
5282                 return 0;
5283         }
5284
5285         result = run_rpc_command(c, NULL, &ndr_table_samr, 0,
5286                                  rpc_aliaslist_internals,
5287                                  argc, argv);
5288         if (result != 0)
5289                 return result;
5290
5291         result = run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
5292                                  rpc_aliaslist_dump,
5293                                  argc, argv);
5294         if (result != 0)
5295                 return result;
5296
5297         return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
5298                                rpc_share_allowedusers_internals,
5299                                argc, argv);
5300 }
5301
5302 int net_usersidlist(struct net_context *c, int argc, const char **argv)
5303 {
5304         int num_tokens = 0;
5305         struct user_token *tokens = NULL;
5306         int i;
5307
5308         if (argc != 0) {
5309                 net_usersidlist_usage(c, argc, argv);
5310                 return 0;
5311         }
5312
5313         if (!get_user_tokens(c, &num_tokens, &tokens)) {
5314                 DEBUG(0, ("Could not get the user/sid list\n"));
5315                 return -1;
5316         }
5317
5318         for (i=0; i<num_tokens; i++) {
5319                 dump_user_token(&tokens[i]);
5320                 free_user_token(&tokens[i].token);
5321         }
5322
5323         SAFE_FREE(tokens);
5324         return 0;
5325 }
5326
5327 int net_usersidlist_usage(struct net_context *c, int argc, const char **argv)
5328 {
5329         d_printf(_("net usersidlist\n"
5330                    "\tprints out a list of all users the running winbind knows\n"
5331                    "\tabout, together with all their SIDs. This is used as\n"
5332                    "\tinput to the 'net rpc share allowedusers' command.\n\n"));
5333
5334         net_common_flags_usage(c, argc, argv);
5335         return -1;
5336 }
5337
5338 /**
5339  * 'net rpc share' entrypoint.
5340  * @param argc  Standard main() style argc.
5341  * @param argv  Standard main() style argv. Initial components are already
5342  *              stripped.
5343  **/
5344
5345 int net_rpc_share(struct net_context *c, int argc, const char **argv)
5346 {
5347         NET_API_STATUS status;
5348
5349         struct functable func[] = {
5350                 {
5351                         "add",
5352                         rpc_share_add,
5353                         NET_TRANSPORT_RPC,
5354                         N_("Add share"),
5355                         N_("net rpc share add\n"
5356                            "    Add share")
5357                 },
5358                 {
5359                         "delete",
5360                         rpc_share_delete,
5361                         NET_TRANSPORT_RPC,
5362                         N_("Remove share"),
5363                         N_("net rpc share delete\n"
5364                            "    Remove share")
5365                 },
5366                 {
5367                         "allowedusers",
5368                         rpc_share_allowedusers,
5369                         NET_TRANSPORT_RPC,
5370                         N_("Modify allowed users"),
5371                         N_("net rpc share allowedusers\n"
5372                            "    Modify allowed users")
5373                 },
5374                 {
5375                         "migrate",
5376                         rpc_share_migrate,
5377                         NET_TRANSPORT_RPC,
5378                         N_("Migrate share to local server"),
5379                         N_("net rpc share migrate\n"
5380                            "    Migrate share to local server")
5381                 },
5382                 {
5383                         "list",
5384                         rpc_share_list,
5385                         NET_TRANSPORT_RPC,
5386                         N_("List shares"),
5387                         N_("net rpc share list\n"
5388                            "    List shares")
5389                 },
5390                 {NULL, NULL, 0, NULL, NULL}
5391         };
5392
5393         status = libnetapi_net_init(&c->netapi_ctx);
5394         if (status != 0) {
5395                 return -1;
5396         }
5397         libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5398         libnetapi_set_password(c->netapi_ctx, c->opt_password);
5399         if (c->opt_kerberos) {
5400                 libnetapi_set_use_kerberos(c->netapi_ctx);
5401         }
5402
5403         if (argc == 0) {
5404                 if (c->display_usage) {
5405                         d_printf("%s\n%s",
5406                                  _("Usage:"),
5407                                  _("net rpc share\n"
5408                                    "    List shares\n"
5409                                    "    Alias for net rpc share list\n"));
5410                         net_display_usage_from_functable(func);
5411                         return 0;
5412                 }
5413
5414                 return rpc_share_list(c, argc, argv);
5415         }
5416
5417         return net_run_function(c, argc, argv, "net rpc share", func);
5418 }
5419
5420 static NTSTATUS rpc_sh_share_list(struct net_context *c,
5421                                   TALLOC_CTX *mem_ctx,
5422                                   struct rpc_sh_ctx *ctx,
5423                                   struct rpc_pipe_client *pipe_hnd,
5424                                   int argc, const char **argv)
5425 {
5426
5427         return werror_to_ntstatus(W_ERROR(rpc_share_list(c, argc, argv)));
5428 }
5429
5430 static NTSTATUS rpc_sh_share_add(struct net_context *c,
5431                                  TALLOC_CTX *mem_ctx,
5432                                  struct rpc_sh_ctx *ctx,
5433                                  struct rpc_pipe_client *pipe_hnd,
5434                                  int argc, const char **argv)
5435 {
5436         NET_API_STATUS status;
5437         uint32_t parm_err = 0;
5438         struct SHARE_INFO_2 i2;
5439
5440         if ((argc < 2) || (argc > 3)) {
5441                 d_fprintf(stderr, _("Usage: %s <share> <path> [comment]\n"),
5442                           ctx->whoami);
5443                 return NT_STATUS_INVALID_PARAMETER;
5444         }
5445
5446         i2.shi2_netname         = argv[0];
5447         i2.shi2_type            = STYPE_DISKTREE;
5448         i2.shi2_remark          = (argc == 3) ? argv[2] : "";
5449         i2.shi2_permissions     = 0;
5450         i2.shi2_max_uses        = 0;
5451         i2.shi2_current_uses    = 0;
5452         i2.shi2_path            = argv[1];
5453         i2.shi2_passwd          = NULL;
5454
5455         status = NetShareAdd(pipe_hnd->desthost,
5456                              2,
5457                              (uint8_t *)&i2,
5458                              &parm_err);
5459
5460         return werror_to_ntstatus(W_ERROR(status));
5461 }
5462
5463 static NTSTATUS rpc_sh_share_delete(struct net_context *c,
5464                                     TALLOC_CTX *mem_ctx,
5465                                     struct rpc_sh_ctx *ctx,
5466                                     struct rpc_pipe_client *pipe_hnd,
5467                                     int argc, const char **argv)
5468 {
5469         if (argc != 1) {
5470                 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5471                 return NT_STATUS_INVALID_PARAMETER;
5472         }
5473
5474         return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd->desthost, argv[0], 0)));
5475 }
5476
5477 static NTSTATUS rpc_sh_share_info(struct net_context *c,
5478                                   TALLOC_CTX *mem_ctx,
5479                                   struct rpc_sh_ctx *ctx,
5480                                   struct rpc_pipe_client *pipe_hnd,
5481                                   int argc, const char **argv)
5482 {
5483         union srvsvc_NetShareInfo info;
5484         WERROR result;
5485         NTSTATUS status;
5486         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5487
5488         if (argc != 1) {
5489                 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5490                 return NT_STATUS_INVALID_PARAMETER;
5491         }
5492
5493         status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
5494                                                pipe_hnd->desthost,
5495                                                argv[0],
5496                                                2,
5497                                                &info,
5498                                                &result);
5499         if (!NT_STATUS_IS_OK(status)) {
5500                 result = ntstatus_to_werror(status);
5501                 goto done;
5502         }
5503         if (!W_ERROR_IS_OK(result)) {
5504                 goto done;
5505         }
5506
5507         d_printf(_("Name:     %s\n"), info.info2->name);
5508         d_printf(_("Comment:  %s\n"), info.info2->comment);
5509         d_printf(_("Path:     %s\n"), info.info2->path);
5510         d_printf(_("Password: %s\n"), info.info2->password);
5511
5512  done:
5513         return werror_to_ntstatus(result);
5514 }
5515
5516 struct rpc_sh_cmd *net_rpc_share_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
5517                                       struct rpc_sh_ctx *ctx)
5518 {
5519         static struct rpc_sh_cmd cmds[] = {
5520
5521         { "list", NULL, &ndr_table_srvsvc, rpc_sh_share_list,
5522           N_("List available shares") },
5523
5524         { "add", NULL, &ndr_table_srvsvc, rpc_sh_share_add,
5525           N_("Add a share") },
5526
5527         { "delete", NULL, &ndr_table_srvsvc, rpc_sh_share_delete,
5528           N_("Delete a share") },
5529
5530         { "info", NULL, &ndr_table_srvsvc, rpc_sh_share_info,
5531           N_("Get information about a share") },
5532
5533         { NULL, NULL, 0, NULL, NULL }
5534         };
5535
5536         return cmds;
5537 }
5538
5539 /****************************************************************************/
5540
5541 static int rpc_file_usage(struct net_context *c, int argc, const char **argv)
5542 {
5543         return net_file_usage(c, argc, argv);
5544 }
5545
5546 /**
5547  * Close a file on a remote RPC server.
5548  *
5549  * @param argc  Standard main() style argc.
5550  * @param argv  Standard main() style argv. Initial components are already
5551  *              stripped.
5552  *
5553  * @return A shell status integer (0 for success).
5554  **/
5555 static int rpc_file_close(struct net_context *c, int argc, const char **argv)
5556 {
5557         if (argc < 1 || c->display_usage) {
5558                 return rpc_file_usage(c, argc, argv);
5559         }
5560
5561         return NetFileClose(c->opt_host, atoi(argv[0]));
5562 }
5563
5564 /**
5565  * Formatted print of open file info
5566  *
5567  * @param r  struct FILE_INFO_3 contents
5568  **/
5569
5570 static void display_file_info_3(struct FILE_INFO_3 *r)
5571 {
5572         d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
5573                  r->fi3_id, r->fi3_username, r->fi3_permissions,
5574                  r->fi3_num_locks, r->fi3_pathname);
5575 }
5576
5577 /**
5578  * List files for a user on a remote RPC server.
5579  *
5580  * @param argc  Standard main() style argc.
5581  * @param argv  Standard main() style argv. Initial components are already
5582  *              stripped.
5583  *
5584  * @return A shell status integer (0 for success)..
5585  **/
5586
5587 static int rpc_file_user(struct net_context *c, int argc, const char **argv)
5588 {
5589         NET_API_STATUS status;
5590         uint32 preferred_len = 0xffffffff, i;
5591         char *username=NULL;
5592         uint32_t total_entries = 0;
5593         uint32_t entries_read = 0;
5594         uint32_t resume_handle = 0;
5595         struct FILE_INFO_3 *i3 = NULL;
5596
5597         if (c->display_usage) {
5598                 return rpc_file_usage(c, argc, argv);
5599         }
5600
5601         /* if argc > 0, must be user command */
5602         if (argc > 0) {
5603                 username = smb_xstrdup(argv[0]);
5604         }
5605
5606         status = NetFileEnum(c->opt_host,
5607                              NULL,
5608                              username,
5609                              3,
5610                              (uint8_t **)(void *)&i3,
5611                              preferred_len,
5612                              &entries_read,
5613                              &total_entries,
5614                              &resume_handle);
5615
5616         if (status != 0) {
5617                 goto done;
5618         }
5619
5620         /* Display results */
5621
5622         d_printf(_(
5623                  "\nEnumerating open files on remote server:\n\n"
5624                  "\nFileId  Opened by            Perms  Locks  Path"
5625                  "\n------  ---------            -----  -----  ---- \n"));
5626         for (i = 0; i < entries_read; i++) {
5627                 display_file_info_3(&i3[i]);
5628         }
5629  done:
5630         SAFE_FREE(username);
5631         return status;
5632 }
5633
5634 /**
5635  * 'net rpc file' entrypoint.
5636  * @param argc  Standard main() style argc.
5637  * @param argv  Standard main() style argv. Initial components are already
5638  *              stripped.
5639  **/
5640
5641 int net_rpc_file(struct net_context *c, int argc, const char **argv)
5642 {
5643         NET_API_STATUS status;
5644
5645         struct functable func[] = {
5646                 {
5647                         "close",
5648                         rpc_file_close,
5649                         NET_TRANSPORT_RPC,
5650                         N_("Close opened file"),
5651                         N_("net rpc file close\n"
5652                            "    Close opened file")
5653                 },
5654                 {
5655                         "user",
5656                         rpc_file_user,
5657                         NET_TRANSPORT_RPC,
5658                         N_("List files opened by user"),
5659                         N_("net rpc file user\n"
5660                            "    List files opened by user")
5661                 },
5662 #if 0
5663                 {
5664                         "info",
5665                         rpc_file_info,
5666                         NET_TRANSPORT_RPC,
5667                         N_("Display information about opened file"),
5668                         N_("net rpc file info\n"
5669                            "    Display information about opened file")
5670                 },
5671 #endif
5672                 {NULL, NULL, 0, NULL, NULL}
5673         };
5674
5675         status = libnetapi_net_init(&c->netapi_ctx);
5676         if (status != 0) {
5677                 return -1;
5678         }
5679         libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5680         libnetapi_set_password(c->netapi_ctx, c->opt_password);
5681         if (c->opt_kerberos) {
5682                 libnetapi_set_use_kerberos(c->netapi_ctx);
5683         }
5684
5685         if (argc == 0) {
5686                 if (c->display_usage) {
5687                         d_printf(_("Usage:\n"));
5688                         d_printf(_("net rpc file\n"
5689                                    "    List opened files\n"));
5690                         net_display_usage_from_functable(func);
5691                         return 0;
5692                 }
5693
5694                 return rpc_file_user(c, argc, argv);
5695         }
5696
5697         return net_run_function(c, argc, argv, "net rpc file", func);
5698 }
5699
5700 /**
5701  * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5702  *
5703  * All parameters are provided by the run_rpc_command function, except for
5704  * argc, argv which are passed through.
5705  *
5706  * @param c     A net_context structure.
5707  * @param domain_sid The domain sid acquired from the remote server.
5708  * @param cli A cli_state connected to the server.
5709  * @param mem_ctx Talloc context, destroyed on completion of the function.
5710  * @param argc  Standard main() style argc.
5711  * @param argv  Standard main() style argv. Initial components are already
5712  *              stripped.
5713  *
5714  * @return Normal NTSTATUS return.
5715  **/
5716
5717 static NTSTATUS rpc_shutdown_abort_internals(struct net_context *c,
5718                                         const struct dom_sid *domain_sid,
5719                                         const char *domain_name,
5720                                         struct cli_state *cli,
5721                                         struct rpc_pipe_client *pipe_hnd,
5722                                         TALLOC_CTX *mem_ctx,
5723                                         int argc,
5724                                         const char **argv)
5725 {
5726         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5727         WERROR result;
5728         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5729
5730         status = dcerpc_initshutdown_Abort(b, mem_ctx, NULL, &result);
5731         if (!NT_STATUS_IS_OK(status)) {
5732                 return status;
5733         }
5734         if (W_ERROR_IS_OK(result)) {
5735                 d_printf(_("\nShutdown successfully aborted\n"));
5736                 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5737         } else
5738                 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5739
5740         return werror_to_ntstatus(result);
5741 }
5742
5743 /**
5744  * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5745  *
5746  * All parameters are provided by the run_rpc_command function, except for
5747  * argc, argv which are passed through.
5748  *
5749  * @param c     A net_context structure.
5750  * @param domain_sid The domain sid acquired from the remote server.
5751  * @param cli A cli_state connected to the server.
5752  * @param mem_ctx Talloc context, destroyed on completion of the function.
5753  * @param argc  Standard main() style argc.
5754  * @param argv  Standard main() style argv. Initial components are already
5755  *              stripped.
5756  *
5757  * @return Normal NTSTATUS return.
5758  **/
5759
5760 static NTSTATUS rpc_reg_shutdown_abort_internals(struct net_context *c,
5761                                                 const struct dom_sid *domain_sid,
5762                                                 const char *domain_name,
5763                                                 struct cli_state *cli,
5764                                                 struct rpc_pipe_client *pipe_hnd,
5765                                                 TALLOC_CTX *mem_ctx,
5766                                                 int argc,
5767                                                 const char **argv)
5768 {
5769         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5770         WERROR werr;
5771         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5772
5773         result = dcerpc_winreg_AbortSystemShutdown(b, mem_ctx, NULL, &werr);
5774
5775         if (!NT_STATUS_IS_OK(result)) {
5776                 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5777                 return result;
5778         }
5779         if (W_ERROR_IS_OK(werr)) {
5780                 d_printf(_("\nShutdown successfully aborted\n"));
5781                 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5782         } else
5783                 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5784
5785         return werror_to_ntstatus(werr);
5786 }
5787
5788 /**
5789  * ABORT the shutdown of a remote RPC server.
5790  *
5791  * @param argc  Standard main() style argc.
5792  * @param argv  Standard main() style argv. Initial components are already
5793  *              stripped.
5794  *
5795  * @return A shell status integer (0 for success).
5796  **/
5797
5798 static int rpc_shutdown_abort(struct net_context *c, int argc,
5799                               const char **argv)
5800 {
5801         int rc = -1;
5802
5803         if (c->display_usage) {
5804                 d_printf(  "%s\n"
5805                            "net rpc abortshutdown\n"
5806                            "    %s\n",
5807                          _("Usage:"),
5808                          _("Abort a scheduled shutdown"));
5809                 return 0;
5810         }
5811
5812         rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5813                              rpc_shutdown_abort_internals, argc, argv);
5814
5815         if (rc == 0)
5816                 return rc;
5817
5818         DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5819
5820         return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5821                                rpc_reg_shutdown_abort_internals,
5822                                argc, argv);
5823 }
5824
5825 /**
5826  * Shut down a remote RPC Server via initshutdown pipe.
5827  *
5828  * All parameters are provided by the run_rpc_command function, except for
5829  * argc, argv which are passed through.
5830  *
5831  * @param c     A net_context structure.
5832  * @param domain_sid The domain sid acquired from the remote server.
5833  * @param cli A cli_state connected to the server.
5834  * @param mem_ctx Talloc context, destroyed on completion of the function.
5835  * @param argc  Standard main() style argc.
5836  * @param argv  Standard main() style argv. Initial components are already
5837  *              stripped.
5838  *
5839  * @return Normal NTSTATUS return.
5840  **/
5841
5842 NTSTATUS rpc_init_shutdown_internals(struct net_context *c,
5843                                      const struct dom_sid *domain_sid,
5844                                      const char *domain_name,
5845                                      struct cli_state *cli,
5846                                      struct rpc_pipe_client *pipe_hnd,
5847                                      TALLOC_CTX *mem_ctx,
5848                                      int argc,
5849                                      const char **argv)
5850 {
5851         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5852         WERROR result;
5853         const char *msg = N_("This machine will be shutdown shortly");
5854         uint32 timeout = 20;
5855         struct lsa_StringLarge msg_string;
5856         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5857
5858         if (c->opt_comment) {
5859                 msg = c->opt_comment;
5860         }
5861         if (c->opt_timeout) {
5862                 timeout = c->opt_timeout;
5863         }
5864
5865         msg_string.string = msg;
5866
5867         /* create an entry */
5868         status = dcerpc_initshutdown_Init(b, mem_ctx, NULL,
5869                         &msg_string, timeout, c->opt_force, c->opt_reboot,
5870                         &result);
5871         if (!NT_STATUS_IS_OK(status)) {
5872                 return status;
5873         }
5874         if (W_ERROR_IS_OK(result)) {
5875                 d_printf(_("\nShutdown of remote machine succeeded\n"));
5876                 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5877         } else {
5878                 DEBUG(1,("Shutdown of remote machine failed!\n"));
5879         }
5880         return werror_to_ntstatus(result);
5881 }
5882
5883 /**
5884  * Shut down a remote RPC Server via winreg pipe.
5885  *
5886  * All parameters are provided by the run_rpc_command function, except for
5887  * argc, argv which are passed through.
5888  *
5889  * @param c     A net_context structure.
5890  * @param domain_sid The domain sid acquired from the remote server.
5891  * @param cli A cli_state connected to the server.
5892  * @param mem_ctx Talloc context, destroyed on completion of the function.
5893  * @param argc  Standard main() style argc.
5894  * @param argv  Standard main() style argv. Initial components are already
5895  *              stripped.
5896  *
5897  * @return Normal NTSTATUS return.
5898  **/
5899
5900 NTSTATUS rpc_reg_shutdown_internals(struct net_context *c,
5901                                     const struct dom_sid *domain_sid,
5902                                     const char *domain_name,
5903                                     struct cli_state *cli,
5904                                     struct rpc_pipe_client *pipe_hnd,
5905                                     TALLOC_CTX *mem_ctx,
5906                                     int argc,
5907                                     const char **argv)
5908 {
5909         const char *msg = N_("This machine will be shutdown shortly");
5910         uint32 timeout = 20;
5911         struct lsa_StringLarge msg_string;
5912         NTSTATUS result;
5913         WERROR werr;
5914         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5915
5916         if (c->opt_comment) {
5917                 msg = c->opt_comment;
5918         }
5919         msg_string.string = msg;
5920
5921         if (c->opt_timeout) {
5922                 timeout = c->opt_timeout;
5923         }
5924
5925         /* create an entry */
5926         result = dcerpc_winreg_InitiateSystemShutdown(b, mem_ctx, NULL,
5927                         &msg_string, timeout, c->opt_force, c->opt_reboot,
5928                         &werr);
5929         if (!NT_STATUS_IS_OK(result)) {
5930                 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5931                 return result;
5932         }
5933
5934         if (W_ERROR_IS_OK(werr)) {
5935                 d_printf(_("\nShutdown of remote machine succeeded\n"));
5936         } else {
5937                 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5938                 if ( W_ERROR_EQUAL(werr, WERR_MACHINE_LOCKED) )
5939                         d_fprintf(stderr, "\nMachine locked, use -f switch to force\n");
5940                 else
5941                         d_fprintf(stderr, "\nresult was: %s\n", win_errstr(werr));
5942         }
5943
5944         return werror_to_ntstatus(werr);
5945 }
5946
5947 /**
5948  * Shut down a remote RPC server.
5949  *
5950  * @param argc  Standard main() style argc.
5951  * @param argv  Standard main() style argv. Initial components are already
5952  *              stripped.
5953  *
5954  * @return A shell status integer (0 for success).
5955  **/
5956
5957 static int rpc_shutdown(struct net_context *c, int argc, const char **argv)
5958 {
5959         int rc =  -1;
5960
5961         if (c->display_usage) {
5962                 d_printf(  "%s\n"
5963                            "net rpc shutdown\n"
5964                            "    %s\n",
5965                          _("Usage:"),
5966                          _("Shut down a remote RPC server"));
5967                 return 0;
5968         }
5969
5970         rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5971                              rpc_init_shutdown_internals, argc, argv);
5972
5973         if (rc) {
5974                 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5975                 rc = run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5976                                      rpc_reg_shutdown_internals, argc, argv);
5977         }
5978
5979         return rc;
5980 }
5981
5982 /***************************************************************************
5983   NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5984  ***************************************************************************/
5985
5986 /**
5987  * Add interdomain trust account to the RPC server.
5988  * All parameters (except for argc and argv) are passed by run_rpc_command
5989  * function.
5990  *
5991  * @param c     A net_context structure.
5992  * @param domain_sid The domain sid acquired from the server.
5993  * @param cli A cli_state connected to the server.
5994  * @param mem_ctx Talloc context, destroyed on completion of the function.
5995  * @param argc  Standard main() style argc.
5996  * @param argv  Standard main() style argv. Initial components are already
5997  *              stripped.
5998  *
5999  * @return normal NTSTATUS return code.
6000  */
6001
6002 static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
6003                                                 const struct dom_sid *domain_sid,
6004                                                 const char *domain_name,
6005                                                 struct cli_state *cli,
6006                                                 struct rpc_pipe_client *pipe_hnd,
6007                                                 TALLOC_CTX *mem_ctx,
6008                                                 int argc,
6009                                                 const char **argv)
6010 {
6011         struct policy_handle connect_pol, domain_pol, user_pol;
6012         NTSTATUS status, result;
6013         char *acct_name;
6014         struct lsa_String lsa_acct_name;
6015         uint32 acb_info;
6016         uint32 acct_flags=0;
6017         uint32 user_rid;
6018         uint32_t access_granted = 0;
6019         union samr_UserInfo info;
6020         unsigned int orig_timeout;
6021         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6022         DATA_BLOB session_key = data_blob_null;
6023
6024         if (argc != 2) {
6025                 d_printf("%s\n%s",
6026                          _("Usage:"),
6027                          _(" net rpc trustdom add <domain_name> "
6028                            "<trust password>\n"));
6029                 return NT_STATUS_INVALID_PARAMETER;
6030         }
6031
6032         /*
6033          * Make valid trusting domain account (ie. uppercased and with '$' appended)
6034          */
6035
6036         if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
6037                 return NT_STATUS_NO_MEMORY;
6038         }
6039
6040         if (!strupper_m(acct_name)) {
6041                 SAFE_FREE(acct_name);
6042                 return NT_STATUS_INVALID_PARAMETER;
6043         }
6044
6045         init_lsa_String(&lsa_acct_name, acct_name);
6046
6047         status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
6048         if (!NT_STATUS_IS_OK(status)) {
6049                 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
6050                         nt_errstr(status)));
6051                 goto done;
6052         }
6053
6054         /* Get samr policy handle */
6055         status = dcerpc_samr_Connect2(b, mem_ctx,
6056                                       pipe_hnd->desthost,
6057                                       MAXIMUM_ALLOWED_ACCESS,
6058                                       &connect_pol,
6059                                       &result);
6060         if (!NT_STATUS_IS_OK(status)) {
6061                 goto done;
6062         }
6063         if (!NT_STATUS_IS_OK(result)) {
6064                 status = result;
6065                 goto done;
6066         }
6067
6068         /* Get domain policy handle */
6069         status = dcerpc_samr_OpenDomain(b, mem_ctx,
6070                                         &connect_pol,
6071                                         MAXIMUM_ALLOWED_ACCESS,
6072                                         discard_const_p(struct dom_sid2, domain_sid),
6073                                         &domain_pol,
6074                                         &result);
6075         if (!NT_STATUS_IS_OK(status)) {
6076                 goto done;
6077         }
6078         if (!NT_STATUS_IS_OK(result)) {
6079                 status = result;
6080                 goto done;
6081         }
6082
6083         /* This call can take a long time - allow the server to time out.
6084          * 35 seconds should do it. */
6085
6086         orig_timeout = rpccli_set_timeout(pipe_hnd, 35000);
6087
6088         /* Create trusting domain's account */
6089         acb_info = ACB_NORMAL;
6090         acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
6091                      SEC_STD_WRITE_DAC | SEC_STD_DELETE |
6092                      SAMR_USER_ACCESS_SET_PASSWORD |
6093                      SAMR_USER_ACCESS_GET_ATTRIBUTES |
6094                      SAMR_USER_ACCESS_SET_ATTRIBUTES;
6095
6096         status = dcerpc_samr_CreateUser2(b, mem_ctx,
6097                                          &domain_pol,
6098                                          &lsa_acct_name,
6099                                          acb_info,
6100                                          acct_flags,
6101                                          &user_pol,
6102                                          &access_granted,
6103                                          &user_rid,
6104                                          &result);
6105         if (!NT_STATUS_IS_OK(status)) {
6106                 goto done;
6107         }
6108         /* And restore our original timeout. */
6109         rpccli_set_timeout(pipe_hnd, orig_timeout);
6110
6111         if (!NT_STATUS_IS_OK(result)) {
6112                 status = result;
6113                 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
6114                         acct_name, nt_errstr(result));
6115                 goto done;
6116         }
6117
6118         {
6119                 struct samr_CryptPassword crypt_pwd;
6120
6121                 ZERO_STRUCT(info.info23);
6122
6123                 init_samr_CryptPassword(argv[1],
6124                                         &session_key,
6125                                         &crypt_pwd);
6126
6127                 info.info23.info.fields_present = SAMR_FIELD_ACCT_FLAGS |
6128                                                   SAMR_FIELD_NT_PASSWORD_PRESENT;
6129                 info.info23.info.acct_flags = ACB_DOMTRUST;
6130                 info.info23.password = crypt_pwd;
6131
6132                 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
6133                                                   &user_pol,
6134                                                   23,
6135                                                   &info,
6136                                                   &result);
6137                 if (!NT_STATUS_IS_OK(status)) {
6138                         goto done;
6139                 }
6140
6141                 if (!NT_STATUS_IS_OK(result)) {
6142                         status = result;
6143                         DEBUG(0,("Could not set trust account password: %s\n",
6144                                  nt_errstr(result)));
6145                         goto done;
6146                 }
6147         }
6148
6149  done:
6150         SAFE_FREE(acct_name);
6151         data_blob_clear_free(&session_key);
6152         return status;
6153 }
6154
6155 /**
6156  * Create interdomain trust account for a remote domain.
6157  *
6158  * @param argc Standard argc.
6159  * @param argv Standard argv without initial components.
6160  *
6161  * @return Integer status (0 means success).
6162  **/
6163
6164 static int rpc_trustdom_add(struct net_context *c, int argc, const char **argv)
6165 {
6166         if (argc > 0 && !c->display_usage) {
6167                 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
6168                                        rpc_trustdom_add_internals, argc, argv);
6169         } else {
6170                 d_printf("%s\n%s",
6171                          _("Usage:"),
6172                          _("net rpc trustdom add <domain_name> <trust "
6173                            "password>\n"));
6174                 return -1;
6175         }
6176 }
6177
6178
6179 /**
6180  * Remove interdomain trust account from the RPC server.
6181  * All parameters (except for argc and argv) are passed by run_rpc_command
6182  * function.
6183  *
6184  * @param c     A net_context structure.
6185  * @param domain_sid The domain sid acquired from the server.
6186  * @param cli A cli_state connected to the server.
6187  * @param mem_ctx Talloc context, destroyed on completion of the function.
6188  * @param argc  Standard main() style argc.
6189  * @param argv  Standard main() style argv. Initial components are already
6190  *              stripped.
6191  *
6192  * @return normal NTSTATUS return code.
6193  */
6194
6195 static NTSTATUS rpc_trustdom_del_internals(struct net_context *c,
6196                                         const struct dom_sid *domain_sid,
6197                                         const char *domain_name,
6198                                         struct cli_state *cli,
6199                                         struct rpc_pipe_client *pipe_hnd,
6200                                         TALLOC_CTX *mem_ctx,
6201                                         int argc,
6202                                         const char **argv)
6203 {
6204         struct policy_handle connect_pol, domain_pol, user_pol;
6205         NTSTATUS status, result;
6206         char *acct_name;
6207         struct dom_sid trust_acct_sid;
6208         struct samr_Ids user_rids, name_types;
6209         struct lsa_String lsa_acct_name;
6210         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6211
6212         if (argc != 1) {
6213                 d_printf("%s\n%s",
6214                          _("Usage:"),
6215                          _(" net rpc trustdom del <domain_name>\n"));
6216                 return NT_STATUS_INVALID_PARAMETER;
6217         }
6218
6219         /*
6220          * Make valid trusting domain account (ie. uppercased and with '$' appended)
6221          */
6222         acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
6223
6224         if (acct_name == NULL)
6225                 return NT_STATUS_NO_MEMORY;
6226
6227         if (!strupper_m(acct_name)) {
6228                 TALLOC_FREE(acct_name);
6229                 return NT_STATUS_INVALID_PARAMETER;
6230         }
6231
6232         /* Get samr policy handle */
6233         status = dcerpc_samr_Connect2(b, mem_ctx,
6234                                       pipe_hnd->desthost,
6235                                       MAXIMUM_ALLOWED_ACCESS,
6236                                       &connect_pol,
6237                                       &result);
6238         if (!NT_STATUS_IS_OK(status)) {
6239                 goto done;
6240         }
6241         if (!NT_STATUS_IS_OK(result)) {
6242                 status = result;
6243                 goto done;
6244         }
6245
6246         /* Get domain policy handle */
6247         status = dcerpc_samr_OpenDomain(b, mem_ctx,
6248                                         &connect_pol,
6249                                         MAXIMUM_ALLOWED_ACCESS,
6250                                         discard_const_p(struct dom_sid2, domain_sid),
6251                                         &domain_pol,
6252                                         &result);
6253         if (!NT_STATUS_IS_OK(status)) {
6254                 goto done;
6255         }
6256         if (!NT_STATUS_IS_OK(result)) {
6257                 status = result;
6258                 goto done;
6259         }
6260
6261         init_lsa_String(&lsa_acct_name, acct_name);
6262
6263         status = dcerpc_samr_LookupNames(b, mem_ctx,
6264                                          &domain_pol,
6265                                          1,
6266                                          &lsa_acct_name,
6267                                          &user_rids,
6268                                          &name_types,
6269                                          &result);
6270         if (!NT_STATUS_IS_OK(status)) {
6271                 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6272                            "failed %s\n"),
6273                         acct_name, nt_errstr(status));
6274                 goto done;
6275         }
6276         if (!NT_STATUS_IS_OK(result)) {
6277                 status = result;
6278                 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6279                            "failed %s\n"),
6280                         acct_name, nt_errstr(result) );
6281                 goto done;
6282         }
6283         if (user_rids.count != 1) {
6284                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
6285                 goto done;
6286         }
6287         if (name_types.count != 1) {
6288                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
6289                 goto done;
6290         }
6291
6292         status = dcerpc_samr_OpenUser(b, mem_ctx,
6293                                       &domain_pol,
6294                                       MAXIMUM_ALLOWED_ACCESS,
6295                                       user_rids.ids[0],
6296                                       &user_pol,
6297                                       &result);
6298         if (!NT_STATUS_IS_OK(status)) {
6299                 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6300                            "%s\n"),
6301                         acct_name, nt_errstr(status) );
6302                 goto done;
6303         }
6304
6305         if (!NT_STATUS_IS_OK(result)) {
6306                 status = result;
6307                 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6308                            "%s\n"),
6309                         acct_name, nt_errstr(result) );
6310                 goto done;
6311         }
6312
6313         /* append the rid to the domain sid */
6314         if (!sid_compose(&trust_acct_sid, domain_sid, user_rids.ids[0])) {
6315                 goto done;
6316         }
6317
6318         /* remove the sid */
6319
6320         status = dcerpc_samr_RemoveMemberFromForeignDomain(b, mem_ctx,
6321                                                            &user_pol,
6322                                                            &trust_acct_sid,
6323                                                            &result);
6324         if (!NT_STATUS_IS_OK(status)) {
6325                 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6326                            " on user %s failed %s\n"),
6327                         acct_name, nt_errstr(status));
6328                 goto done;
6329         }
6330         if (!NT_STATUS_IS_OK(result)) {
6331                 status = result;
6332                 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6333                            " on user %s failed %s\n"),
6334                         acct_name, nt_errstr(result) );
6335                 goto done;
6336         }
6337
6338
6339         /* Delete user */
6340
6341         status = dcerpc_samr_DeleteUser(b, mem_ctx,
6342                                         &user_pol,
6343                                         &result);
6344         if (!NT_STATUS_IS_OK(status)) {
6345                 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6346                            "%s\n"),
6347                         acct_name, nt_errstr(status));
6348                 goto done;
6349         }
6350
6351         if (!NT_STATUS_IS_OK(result)) {
6352                 result = status;
6353                 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6354                            "%s\n"),
6355                         acct_name, nt_errstr(result) );
6356                 goto done;
6357         }
6358
6359         if (!NT_STATUS_IS_OK(result)) {
6360                 d_printf(_("Could not set trust account password: %s\n"),
6361                    nt_errstr(result));
6362                 goto done;
6363         }
6364
6365  done:
6366         return status;
6367 }
6368
6369 /**
6370  * Delete interdomain trust account for a remote domain.
6371  *
6372  * @param argc Standard argc.
6373  * @param argv Standard argv without initial components.
6374  *
6375  * @return Integer status (0 means success).
6376  **/
6377
6378 static int rpc_trustdom_del(struct net_context *c, int argc, const char **argv)
6379 {
6380         if (argc > 0 && !c->display_usage) {
6381                 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
6382                                        rpc_trustdom_del_internals, argc, argv);
6383         } else {
6384                 d_printf("%s\n%s",
6385                          _("Usage:"),
6386                          _("net rpc trustdom del <domain>\n"));
6387                 return -1;
6388         }
6389 }
6390
6391 static NTSTATUS rpc_trustdom_get_pdc(struct net_context *c,
6392                                      struct cli_state *cli,
6393                                      TALLOC_CTX *mem_ctx,
6394                                      const char *domain_name)
6395 {
6396         char *dc_name = NULL;
6397         const char *buffer = NULL;
6398         struct rpc_pipe_client *netr;
6399         NTSTATUS status;
6400         WERROR result;
6401         struct dcerpc_binding_handle *b;
6402
6403         /* Use NetServerEnum2 */
6404
6405         if (cli_get_pdc_name(cli, domain_name, &dc_name)) {
6406                 SAFE_FREE(dc_name);
6407                 return NT_STATUS_OK;
6408         }
6409
6410         DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
6411                  for domain %s\n", domain_name));
6412
6413         /* Try netr_GetDcName */
6414
6415         status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon,
6416                                           &netr);
6417         if (!NT_STATUS_IS_OK(status)) {
6418                 return status;
6419         }
6420
6421         b = netr->binding_handle;
6422
6423         status = dcerpc_netr_GetDcName(b, mem_ctx,
6424                                        netr->desthost,
6425                                        domain_name,
6426                                        &buffer,
6427                                        &result);
6428         TALLOC_FREE(netr);
6429
6430         if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(result)) {
6431                 return status;
6432         }
6433
6434         DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
6435                  for domain %s\n", domain_name));
6436
6437         if (!NT_STATUS_IS_OK(status)) {
6438                 return status;
6439         }
6440
6441         return werror_to_ntstatus(result);
6442 }
6443
6444 /**
6445  * Establish trust relationship to a trusting domain.
6446  * Interdomain account must already be created on remote PDC.
6447  *
6448  * @param c    A net_context structure.
6449  * @param argc Standard argc.
6450  * @param argv Standard argv without initial components.
6451  *
6452  * @return Integer status (0 means success).
6453  **/
6454
6455 static int rpc_trustdom_establish(struct net_context *c, int argc,
6456                                   const char **argv)
6457 {
6458         struct cli_state *cli = NULL;
6459         struct sockaddr_storage server_ss;
6460         struct rpc_pipe_client *pipe_hnd = NULL;
6461         struct policy_handle connect_hnd;
6462         TALLOC_CTX *mem_ctx;
6463         NTSTATUS nt_status, result;
6464         struct dom_sid *domain_sid;
6465
6466         char* domain_name;
6467         char* acct_name;
6468         fstring pdc_name;
6469         union lsa_PolicyInformation *info = NULL;
6470         struct dcerpc_binding_handle *b;
6471
6472         /*
6473          * Connect to \\server\ipc$ as 'our domain' account with password
6474          */
6475
6476         if (argc != 1 || c->display_usage) {
6477                 d_printf("%s\n%s",
6478                          _("Usage:"),
6479                          _("net rpc trustdom establish <domain_name>\n"));
6480                 return -1;
6481         }
6482
6483         domain_name = smb_xstrdup(argv[0]);
6484         if (!strupper_m(domain_name)) {
6485                 SAFE_FREE(domain_name);
6486                 return -1;
6487         }
6488
6489         /* account name used at first is our domain's name with '$' */
6490         if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
6491                 return -1;
6492         }
6493         if (!strupper_m(acct_name)) {
6494                 SAFE_FREE(domain_name);
6495                 SAFE_FREE(acct_name);
6496                 return -1;
6497         }
6498
6499         /*
6500          * opt_workgroup will be used by connection functions further,
6501          * hence it should be set to remote domain name instead of ours
6502          */
6503         if (c->opt_workgroup) {
6504                 c->opt_workgroup = smb_xstrdup(domain_name);
6505         };
6506
6507         c->opt_user_name = acct_name;
6508
6509         /* find the domain controller */
6510         if (!net_find_pdc(&server_ss, pdc_name, domain_name)) {
6511                 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
6512                 return -1;
6513         }
6514
6515         /* connect to ipc$ as username/password */
6516         nt_status = connect_to_ipc(c, &cli, &server_ss, pdc_name);
6517         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
6518
6519                 /* Is it trusting domain account for sure ? */
6520                 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
6521                         nt_errstr(nt_status)));
6522                 return -1;
6523         }
6524
6525         /* store who we connected to */
6526
6527         saf_store( domain_name, pdc_name );
6528
6529         /*
6530          * Connect to \\server\ipc$ again (this time anonymously)
6531          */
6532
6533         nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
6534                                              (char*)pdc_name);
6535
6536         if (NT_STATUS_IS_ERR(nt_status)) {
6537                 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
6538                         domain_name, nt_errstr(nt_status)));
6539                 return -1;
6540         }
6541
6542         if (!(mem_ctx = talloc_init("establishing trust relationship to "
6543                                     "domain %s", domain_name))) {
6544                 DEBUG(0, ("talloc_init() failed\n"));
6545                 cli_shutdown(cli);
6546                 return -1;
6547         }
6548
6549         /* Make sure we're talking to a proper server */
6550
6551         nt_status = rpc_trustdom_get_pdc(c, cli, mem_ctx, domain_name);
6552         if (!NT_STATUS_IS_OK(nt_status)) {
6553                 cli_shutdown(cli);
6554                 talloc_destroy(mem_ctx);
6555                 return -1;
6556         }
6557
6558         /*
6559          * Call LsaOpenPolicy and LsaQueryInfo
6560          */
6561
6562         nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
6563                                              &pipe_hnd);
6564         if (!NT_STATUS_IS_OK(nt_status)) {
6565                 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status) ));
6566                 cli_shutdown(cli);
6567                 talloc_destroy(mem_ctx);
6568                 return -1;
6569         }
6570
6571         b = pipe_hnd->binding_handle;
6572
6573         nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true, KEY_QUERY_VALUE,
6574                                          &connect_hnd);
6575         if (NT_STATUS_IS_ERR(nt_status)) {
6576                 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6577                         nt_errstr(nt_status)));
6578                 cli_shutdown(cli);
6579                 talloc_destroy(mem_ctx);
6580                 return -1;
6581         }
6582
6583         /* Querying info level 5 */
6584
6585         nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6586                                                &connect_hnd,
6587                                                LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6588                                                &info,
6589                                                &result);
6590         if (NT_STATUS_IS_ERR(nt_status)) {
6591                 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6592                         nt_errstr(nt_status)));
6593                 cli_shutdown(cli);
6594                 talloc_destroy(mem_ctx);
6595                 return -1;
6596         }
6597         if (NT_STATUS_IS_ERR(result)) {
6598                 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6599                         nt_errstr(result)));
6600                 cli_shutdown(cli);
6601                 talloc_destroy(mem_ctx);
6602                 return -1;
6603         }
6604
6605         domain_sid = info->account_domain.sid;
6606
6607         /* There should be actually query info level 3 (following nt serv behaviour),
6608            but I still don't know if it's _really_ necessary */
6609
6610         /*
6611          * Store the password in secrets db
6612          */
6613
6614         if (!pdb_set_trusteddom_pw(domain_name, c->opt_password, domain_sid)) {
6615                 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6616                 cli_shutdown(cli);
6617                 talloc_destroy(mem_ctx);
6618                 return -1;
6619         }
6620
6621         /*
6622          * Close the pipes and clean up
6623          */
6624
6625         nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6626         if (NT_STATUS_IS_ERR(nt_status)) {
6627                 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
6628                         nt_errstr(nt_status)));
6629                 cli_shutdown(cli);
6630                 talloc_destroy(mem_ctx);
6631                 return -1;
6632         }
6633
6634         cli_shutdown(cli);
6635
6636         talloc_destroy(mem_ctx);
6637
6638         d_printf(_("Trust to domain %s established\n"), domain_name);
6639         return 0;
6640 }
6641
6642 /**
6643  * Revoke trust relationship to the remote domain.
6644  *
6645  * @param c    A net_context structure.
6646  * @param argc Standard argc.
6647  * @param argv Standard argv without initial components.
6648  *
6649  * @return Integer status (0 means success).
6650  **/
6651
6652 static int rpc_trustdom_revoke(struct net_context *c, int argc,
6653                                const char **argv)
6654 {
6655         char* domain_name;
6656         int rc = -1;
6657
6658         if (argc < 1 || c->display_usage) {
6659                 d_printf("%s\n%s",
6660                          _("Usage:"),
6661                          _("net rpc trustdom revoke <domain_name>\n"
6662                            "  Revoke trust relationship\n"
6663                            "    domain_name\tName of domain to revoke trust\n"));
6664                 return -1;
6665         }
6666
6667         /* generate upper cased domain name */
6668         domain_name = smb_xstrdup(argv[0]);
6669         if (!strupper_m(domain_name)) {
6670                 SAFE_FREE(domain_name);
6671                 return -1;
6672         }
6673
6674         /* delete password of the trust */
6675         if (!pdb_del_trusteddom_pw(domain_name)) {
6676                 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
6677                           domain_name));
6678                 goto done;
6679         };
6680
6681         rc = 0;
6682 done:
6683         SAFE_FREE(domain_name);
6684         return rc;
6685 }
6686
6687 static NTSTATUS rpc_query_domain_sid(struct net_context *c,
6688                                         const struct dom_sid *domain_sid,
6689                                         const char *domain_name,
6690                                         struct cli_state *cli,
6691                                         struct rpc_pipe_client *pipe_hnd,
6692                                         TALLOC_CTX *mem_ctx,
6693                                         int argc,
6694                                         const char **argv)
6695 {
6696         fstring str_sid;
6697         if (!sid_to_fstring(str_sid, domain_sid)) {
6698                 return NT_STATUS_UNSUCCESSFUL;
6699         }
6700         d_printf("%s\n", str_sid);
6701         return NT_STATUS_OK;
6702 }
6703
6704 static void print_trusted_domain(struct dom_sid *dom_sid, const char *trusted_dom_name)
6705 {
6706         fstring ascii_sid;
6707
6708         /* convert sid into ascii string */
6709         sid_to_fstring(ascii_sid, dom_sid);
6710
6711         d_printf("%-20s%s\n", trusted_dom_name, ascii_sid);
6712 }
6713
6714 static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
6715                                       TALLOC_CTX *mem_ctx,
6716                                       struct policy_handle *pol,
6717                                       struct dom_sid dom_sid,
6718                                       const char *trusted_dom_name)
6719 {
6720         NTSTATUS nt_status, result;
6721         union lsa_TrustedDomainInfo *info = NULL;
6722         char *cleartextpwd = NULL;
6723         DATA_BLOB session_key;
6724         DATA_BLOB data = data_blob_null;
6725         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6726
6727         nt_status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
6728                                                            pol,
6729                                                            &dom_sid,
6730                                                            LSA_TRUSTED_DOMAIN_INFO_PASSWORD,
6731                                                            &info,
6732                                                            &result);
6733         if (NT_STATUS_IS_ERR(nt_status)) {
6734                 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6735                 nt_errstr(nt_status)));
6736                 goto done;
6737         }
6738         if (NT_STATUS_IS_ERR(result)) {
6739                 nt_status = result;
6740                 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6741                 nt_errstr(result)));
6742                 goto done;
6743         }
6744
6745         data = data_blob(info->password.password->data,
6746                          info->password.password->length);
6747
6748         nt_status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
6749         if (!NT_STATUS_IS_OK(nt_status)) {
6750                 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status)));
6751                 goto done;
6752         }
6753
6754         cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key);
6755         data_blob_free(&session_key);
6756
6757         if (cleartextpwd == NULL) {
6758                 DEBUG(0,("retrieved NULL password\n"));
6759                 nt_status = NT_STATUS_UNSUCCESSFUL;
6760                 goto done;
6761         }
6762
6763         if (!pdb_set_trusteddom_pw(trusted_dom_name, cleartextpwd, &dom_sid)) {
6764                 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6765                 nt_status = NT_STATUS_UNSUCCESSFUL;
6766                 goto done;
6767         }
6768
6769 #ifdef DEBUG_PASSWORD
6770         DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
6771                    "password: [%s]\n", trusted_dom_name,
6772                    sid_string_dbg(&dom_sid), cleartextpwd));
6773 #endif
6774
6775 done:
6776         SAFE_FREE(cleartextpwd);
6777         data_blob_free(&data);
6778
6779         return nt_status;
6780 }
6781
6782 static int rpc_trustdom_vampire(struct net_context *c, int argc,
6783                                 const char **argv)
6784 {
6785         /* common variables */
6786         TALLOC_CTX* mem_ctx;
6787         struct cli_state *cli = NULL;
6788         struct rpc_pipe_client *pipe_hnd = NULL;
6789         NTSTATUS nt_status, result;
6790         const char *domain_name = NULL;
6791         struct policy_handle connect_hnd;
6792         union lsa_PolicyInformation *info = NULL;
6793
6794         /* trusted domains listing variables */
6795         unsigned int enum_ctx = 0;
6796         int i;
6797         struct lsa_DomainList dom_list;
6798         fstring pdc_name;
6799         struct dcerpc_binding_handle *b;
6800
6801         if (c->display_usage) {
6802                 d_printf(  "%s\n"
6803                            "net rpc trustdom vampire\n"
6804                            "  %s\n",
6805                          _("Usage:"),
6806                          _("Vampire trust relationship from remote server"));
6807                 return 0;
6808         }
6809
6810         /*
6811          * Listing trusted domains (stored in secrets.tdb, if local)
6812          */
6813
6814         mem_ctx = talloc_init("trust relationships vampire");
6815
6816         /*
6817          * set domain and pdc name to local samba server (default)
6818          * or to remote one given in command line
6819          */
6820
6821         if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6822                 domain_name = c->opt_workgroup;
6823                 c->opt_target_workgroup = c->opt_workgroup;
6824         } else {
6825                 fstrcpy(pdc_name, lp_netbios_name());
6826                 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6827                 c->opt_target_workgroup = domain_name;
6828         };
6829
6830         /* open \PIPE\lsarpc and open policy handle */
6831         nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6832         if (!NT_STATUS_IS_OK(nt_status)) {
6833                 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6834                           nt_errstr(nt_status)));
6835                 talloc_destroy(mem_ctx);
6836                 return -1;
6837         };
6838
6839         nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
6840                                              &pipe_hnd);
6841         if (!NT_STATUS_IS_OK(nt_status)) {
6842                 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6843                         nt_errstr(nt_status) ));
6844                 cli_shutdown(cli);
6845                 talloc_destroy(mem_ctx);
6846                 return -1;
6847         };
6848
6849         b = pipe_hnd->binding_handle;
6850
6851         nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6852                                         &connect_hnd);
6853         if (NT_STATUS_IS_ERR(nt_status)) {
6854                 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6855                         nt_errstr(nt_status)));
6856                 cli_shutdown(cli);
6857                 talloc_destroy(mem_ctx);
6858                 return -1;
6859         };
6860
6861         /* query info level 5 to obtain sid of a domain being queried */
6862         nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6863                                                &connect_hnd,
6864                                                LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6865                                                &info,
6866                                                &result);
6867
6868         if (NT_STATUS_IS_ERR(nt_status)) {
6869                 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6870                         nt_errstr(nt_status)));
6871                 cli_shutdown(cli);
6872                 talloc_destroy(mem_ctx);
6873                 return -1;
6874         }
6875         if (NT_STATUS_IS_ERR(result)) {
6876                 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6877                         nt_errstr(result)));
6878                 cli_shutdown(cli);
6879                 talloc_destroy(mem_ctx);
6880                 return -1;
6881         }
6882
6883         /*
6884          * Keep calling LsaEnumTrustdom over opened pipe until
6885          * the end of enumeration is reached
6886          */
6887
6888         d_printf(_("Vampire trusted domains:\n\n"));
6889
6890         do {
6891                 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6892                                                     &connect_hnd,
6893                                                     &enum_ctx,
6894                                                     &dom_list,
6895                                                     (uint32_t)-1,
6896                                                     &result);
6897                 if (NT_STATUS_IS_ERR(nt_status)) {
6898                         DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6899                                 nt_errstr(nt_status)));
6900                         cli_shutdown(cli);
6901                         talloc_destroy(mem_ctx);
6902                         return -1;
6903                 };
6904                 if (NT_STATUS_IS_ERR(result)) {
6905                         nt_status = result;
6906                         DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6907                                 nt_errstr(result)));
6908                         cli_shutdown(cli);
6909                         talloc_destroy(mem_ctx);
6910                         return -1;
6911                 };
6912
6913
6914                 for (i = 0; i < dom_list.count; i++) {
6915
6916                         print_trusted_domain(dom_list.domains[i].sid,
6917                                              dom_list.domains[i].name.string);
6918
6919                         nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
6920                                                            *dom_list.domains[i].sid,
6921                                                            dom_list.domains[i].name.string);
6922                         if (!NT_STATUS_IS_OK(nt_status)) {
6923                                 cli_shutdown(cli);
6924                                 talloc_destroy(mem_ctx);
6925                                 return -1;
6926                         }
6927                 };
6928
6929                 /*
6930                  * in case of no trusted domains say something rather
6931                  * than just display blank line
6932                  */
6933                 if (!dom_list.count) d_printf(_("none\n"));
6934
6935         } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6936
6937         /* close this connection before doing next one */
6938         nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6939         if (NT_STATUS_IS_ERR(nt_status)) {
6940                 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6941                         nt_errstr(nt_status)));
6942                 cli_shutdown(cli);
6943                 talloc_destroy(mem_ctx);
6944                 return -1;
6945         };
6946
6947         /* close lsarpc pipe and connection to IPC$ */
6948         cli_shutdown(cli);
6949
6950         talloc_destroy(mem_ctx);
6951         return 0;
6952 }
6953
6954 static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
6955 {
6956         /* common variables */
6957         TALLOC_CTX* mem_ctx;
6958         struct cli_state *cli = NULL, *remote_cli = NULL;
6959         struct rpc_pipe_client *pipe_hnd = NULL;
6960         NTSTATUS nt_status, result;
6961         const char *domain_name = NULL;
6962         struct dom_sid *queried_dom_sid;
6963         int ascii_dom_name_len;
6964         struct policy_handle connect_hnd;
6965         union lsa_PolicyInformation *info = NULL;
6966         struct dcerpc_binding_handle *b = NULL;
6967
6968         /* trusted domains listing variables */
6969         unsigned int num_domains, enum_ctx = 0;
6970         int i;
6971         struct lsa_DomainList dom_list;
6972         fstring pdc_name;
6973         bool found_domain;
6974
6975         /* trusting domains listing variables */
6976         struct policy_handle domain_hnd;
6977         struct samr_SamArray *trusts = NULL;
6978
6979         if (c->display_usage) {
6980                 d_printf(  "%s\n"
6981                            "net rpc trustdom list\n"
6982                            "    %s\n",
6983                          _("Usage:"),
6984                          _("List incoming and outgoing trust relationships"));
6985                 return 0;
6986         }
6987
6988         /*
6989          * Listing trusted domains (stored in secrets.tdb, if local)
6990          */
6991
6992         mem_ctx = talloc_init("trust relationships listing");
6993
6994         /*
6995          * set domain and pdc name to local samba server (default)
6996          * or to remote one given in command line
6997          */
6998
6999         if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
7000                 domain_name = c->opt_workgroup;
7001                 c->opt_target_workgroup = c->opt_workgroup;
7002         } else {
7003                 fstrcpy(pdc_name, lp_netbios_name());
7004                 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
7005                 c->opt_target_workgroup = domain_name;
7006         };
7007
7008         /* open \PIPE\lsarpc and open policy handle */
7009         nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
7010         if (!NT_STATUS_IS_OK(nt_status)) {
7011                 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
7012                           nt_errstr(nt_status)));
7013                 talloc_destroy(mem_ctx);
7014                 return -1;
7015         };
7016
7017         nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
7018                                              &pipe_hnd);
7019         if (!NT_STATUS_IS_OK(nt_status)) {
7020                 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
7021                         nt_errstr(nt_status) ));
7022                 cli_shutdown(cli);
7023                 talloc_destroy(mem_ctx);
7024                 return -1;
7025         };
7026
7027         b = pipe_hnd->binding_handle;
7028
7029         nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
7030                                         &connect_hnd);
7031         if (NT_STATUS_IS_ERR(nt_status)) {
7032                 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
7033                         nt_errstr(nt_status)));
7034                 cli_shutdown(cli);
7035                 talloc_destroy(mem_ctx);
7036                 return -1;
7037         };
7038
7039         /* query info level 5 to obtain sid of a domain being queried */
7040         nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
7041                                                &connect_hnd,
7042                                                LSA_POLICY_INFO_ACCOUNT_DOMAIN,
7043                                                &info,
7044                                                &result);
7045
7046         if (NT_STATUS_IS_ERR(nt_status)) {
7047                 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
7048                         nt_errstr(nt_status)));
7049                 cli_shutdown(cli);
7050                 talloc_destroy(mem_ctx);
7051                 return -1;
7052         }
7053         if (NT_STATUS_IS_ERR(result)) {
7054                 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
7055                         nt_errstr(result)));
7056                 cli_shutdown(cli);
7057                 talloc_destroy(mem_ctx);
7058                 return -1;
7059         }
7060
7061         queried_dom_sid = info->account_domain.sid;
7062
7063         /*
7064          * Keep calling LsaEnumTrustdom over opened pipe until
7065          * the end of enumeration is reached
7066          */
7067
7068         d_printf(_("Trusted domains list:\n\n"));
7069
7070         found_domain = false;
7071
7072         do {
7073                 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
7074                                                     &connect_hnd,
7075                                                     &enum_ctx,
7076                                                     &dom_list,
7077                                                     (uint32_t)-1,
7078                                                     &result);
7079                 if (NT_STATUS_IS_ERR(nt_status)) {
7080                         DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
7081                                 nt_errstr(nt_status)));
7082                         cli_shutdown(cli);
7083                         talloc_destroy(mem_ctx);
7084                         return -1;
7085                 };
7086                 if (NT_STATUS_IS_ERR(result)) {
7087                         DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
7088                                 nt_errstr(result)));
7089                         cli_shutdown(cli);
7090                         talloc_destroy(mem_ctx);
7091                         return -1;
7092                 };
7093
7094
7095                 for (i = 0; i < dom_list.count; i++) {
7096                         print_trusted_domain(dom_list.domains[i].sid,
7097                                              dom_list.domains[i].name.string);
7098                         found_domain = true;
7099                 };
7100
7101
7102         } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
7103
7104         /*
7105          * in case of no trusted domains say something rather
7106          * than just display blank line
7107          */
7108         if (!found_domain) {
7109                 d_printf(_("none\n"));
7110         }
7111
7112         /* close this connection before doing next one */
7113         nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
7114         if (NT_STATUS_IS_ERR(nt_status)) {
7115                 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
7116                         nt_errstr(nt_status)));
7117                 cli_shutdown(cli);
7118                 talloc_destroy(mem_ctx);
7119                 return -1;
7120         };
7121
7122         TALLOC_FREE(pipe_hnd);
7123
7124         /*
7125          * Listing trusting domains (stored in passdb backend, if local)
7126          */
7127
7128         d_printf(_("\nTrusting domains list:\n\n"));
7129
7130         /*
7131          * Open \PIPE\samr and get needed policy handles
7132          */
7133         nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
7134                                              &pipe_hnd);
7135         if (!NT_STATUS_IS_OK(nt_status)) {
7136                 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status)));
7137                 cli_shutdown(cli);
7138                 talloc_destroy(mem_ctx);
7139                 return -1;
7140         };
7141
7142         b = pipe_hnd->binding_handle;
7143
7144         /* SamrConnect2 */
7145         nt_status = dcerpc_samr_Connect2(b, mem_ctx,
7146                                          pipe_hnd->desthost,
7147                                          SAMR_ACCESS_LOOKUP_DOMAIN,
7148                                          &connect_hnd,
7149                                          &result);
7150         if (!NT_STATUS_IS_OK(nt_status)) {
7151                 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
7152                         nt_errstr(nt_status)));
7153                 cli_shutdown(cli);
7154                 talloc_destroy(mem_ctx);
7155                 return -1;
7156         };
7157         if (!NT_STATUS_IS_OK(result)) {
7158                 nt_status = result;
7159                 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
7160                         nt_errstr(result)));
7161                 cli_shutdown(cli);
7162                 talloc_destroy(mem_ctx);
7163                 return -1;
7164         };
7165
7166         /* SamrOpenDomain - we have to open domain policy handle in order to be
7167            able to enumerate accounts*/
7168         nt_status = dcerpc_samr_OpenDomain(b, mem_ctx,
7169                                            &connect_hnd,
7170                                            SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
7171                                            queried_dom_sid,
7172                                            &domain_hnd,
7173                                            &result);
7174         if (!NT_STATUS_IS_OK(nt_status)) {
7175                 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
7176                         nt_errstr(nt_status)));
7177                 cli_shutdown(cli);
7178                 talloc_destroy(mem_ctx);
7179                 return -1;
7180         };
7181         if (!NT_STATUS_IS_OK(result)) {
7182                 nt_status = result;
7183                 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
7184                         nt_errstr(result)));
7185                 cli_shutdown(cli);
7186                 talloc_destroy(mem_ctx);
7187                 return -1;
7188         };
7189
7190         /*
7191          * perform actual enumeration
7192          */
7193
7194         found_domain = false;
7195
7196         enum_ctx = 0;   /* reset enumeration context from last enumeration */
7197         do {
7198
7199                 nt_status = dcerpc_samr_EnumDomainUsers(b, mem_ctx,
7200                                                         &domain_hnd,
7201                                                         &enum_ctx,
7202                                                         ACB_DOMTRUST,
7203                                                         &trusts,
7204                                                         0xffff,
7205                                                         &num_domains,
7206                                                         &result);
7207                 if (NT_STATUS_IS_ERR(nt_status)) {
7208                         DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
7209                                 nt_errstr(nt_status)));
7210                         cli_shutdown(cli);
7211                         talloc_destroy(mem_ctx);
7212                         return -1;
7213                 };
7214                 if (NT_STATUS_IS_ERR(result)) {
7215                         nt_status = result;
7216                         DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
7217                                 nt_errstr(result)));
7218                         cli_shutdown(cli);
7219                         talloc_destroy(mem_ctx);
7220                         return -1;
7221                 };
7222
7223                 for (i = 0; i < num_domains; i++) {
7224
7225                         char *str = discard_const_p(char, trusts->entries[i].name.string);
7226
7227                         found_domain = true;
7228
7229                         /*
7230                          * get each single domain's sid (do we _really_ need this ?):
7231                          *  1) connect to domain's pdc
7232                          *  2) query the pdc for domain's sid
7233                          */
7234
7235                         /* get rid of '$' tail */
7236                         ascii_dom_name_len = strlen(str);
7237                         if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
7238                                 str[ascii_dom_name_len - 1] = '\0';
7239
7240                         /* set opt_* variables to remote domain */
7241                         if (!strupper_m(str)) {
7242                                 cli_shutdown(cli);
7243                                 talloc_destroy(mem_ctx);
7244                                 return -1;
7245                         }
7246                         c->opt_workgroup = talloc_strdup(mem_ctx, str);
7247                         c->opt_target_workgroup = c->opt_workgroup;
7248
7249                         d_printf("%-20s", str);
7250
7251                         /* connect to remote domain controller */
7252                         nt_status = net_make_ipc_connection(c,
7253                                         NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS,
7254                                         &remote_cli);
7255                         if (NT_STATUS_IS_OK(nt_status)) {
7256                                 /* query for domain's sid */
7257                                 if (run_rpc_command(
7258                                             c, remote_cli,
7259                                             &ndr_table_lsarpc, 0,
7260                                             rpc_query_domain_sid, argc,
7261                                             argv))
7262                                         d_printf(_("strange - couldn't get domain's sid\n"));
7263
7264                                 cli_shutdown(remote_cli);
7265
7266                         } else {
7267                                 d_fprintf(stderr, _("domain controller is not "
7268                                           "responding: %s\n"),
7269                                           nt_errstr(nt_status));
7270                                 d_printf(_("couldn't get domain's sid\n"));
7271                         }
7272                 }
7273
7274         } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
7275
7276         if (!found_domain) {
7277                 d_printf("none\n");
7278         }
7279
7280         /* close opened samr and domain policy handles */
7281         nt_status = dcerpc_samr_Close(b, mem_ctx, &domain_hnd, &result);
7282         if (!NT_STATUS_IS_OK(nt_status)) {
7283                 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
7284         };
7285
7286         nt_status = dcerpc_samr_Close(b, mem_ctx, &connect_hnd, &result);
7287         if (!NT_STATUS_IS_OK(nt_status)) {
7288                 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
7289         };
7290
7291         /* close samr pipe and connection to IPC$ */
7292         cli_shutdown(cli);
7293
7294         talloc_destroy(mem_ctx);
7295         return 0;
7296 }
7297
7298 /**
7299  * Entrypoint for 'net rpc trustdom' code.
7300  *
7301  * @param argc Standard argc.
7302  * @param argv Standard argv without initial components.
7303  *
7304  * @return Integer status (0 means success).
7305  */
7306
7307 static int rpc_trustdom(struct net_context *c, int argc, const char **argv)
7308 {
7309         struct functable func[] = {
7310                 {
7311                         "add",
7312                         rpc_trustdom_add,
7313                         NET_TRANSPORT_RPC,
7314                         N_("Add trusting domain's account"),
7315                         N_("net rpc trustdom add\n"
7316                            "    Add trusting domain's account")
7317                 },
7318                 {
7319                         "del",
7320                         rpc_trustdom_del,
7321                         NET_TRANSPORT_RPC,
7322                         N_("Remove trusting domain's account"),
7323                         N_("net rpc trustdom del\n"
7324                            "    Remove trusting domain's account")
7325                 },
7326                 {
7327                         "establish",
7328                         rpc_trustdom_establish,
7329                         NET_TRANSPORT_RPC,
7330                         N_("Establish outgoing trust relationship"),
7331                         N_("net rpc trustdom establish\n"
7332                            "    Establish outgoing trust relationship")
7333                 },
7334                 {
7335                         "revoke",
7336                         rpc_trustdom_revoke,
7337                         NET_TRANSPORT_RPC,
7338                         N_("Revoke outgoing trust relationship"),
7339                         N_("net rpc trustdom revoke\n"
7340                            "    Revoke outgoing trust relationship")
7341                 },
7342                 {
7343                         "list",
7344                         rpc_trustdom_list,
7345                         NET_TRANSPORT_RPC,
7346                         N_("List in- and outgoing domain trusts"),
7347                         N_("net rpc trustdom list\n"
7348                            "    List in- and outgoing domain trusts")
7349                 },
7350                 {
7351                         "vampire",
7352                         rpc_trustdom_vampire,
7353                         NET_TRANSPORT_RPC,
7354                         N_("Vampire trusts from remote server"),
7355                         N_("net rpc trustdom vampire\n"
7356                            "    Vampire trusts from remote server")
7357                 },
7358                 {NULL, NULL, 0, NULL, NULL}
7359         };
7360
7361         return net_run_function(c, argc, argv, "net rpc trustdom", func);
7362 }
7363
7364 /**
7365  * Check if a server will take rpc commands
7366  * @param flags Type of server to connect to (PDC, DMB, localhost)
7367  *              if the host is not explicitly specified
7368  * @return  bool (true means rpc supported)
7369  */
7370 bool net_rpc_check(struct net_context *c, unsigned flags)
7371 {
7372         struct cli_state *cli;
7373         bool ret = false;
7374         struct sockaddr_storage server_ss;
7375         char *server_name = NULL;
7376         NTSTATUS status;
7377
7378         /* flags (i.e. server type) may depend on command */
7379         if (!net_find_server(c, NULL, flags, &server_ss, &server_name))
7380                 return false;
7381
7382         status = cli_connect_nb(server_name, &server_ss, 0, 0x20,
7383                                 lp_netbios_name(), SMB_SIGNING_DEFAULT,
7384                                 0, &cli);
7385         if (!NT_STATUS_IS_OK(status)) {
7386                 return false;
7387         }
7388         status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
7389                                  PROTOCOL_NT1);
7390         if (!NT_STATUS_IS_OK(status))
7391                 goto done;
7392         if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1)
7393                 goto done;
7394
7395         ret = true;
7396  done:
7397         cli_shutdown(cli);
7398         return ret;
7399 }
7400
7401 /* dump sam database via samsync rpc calls */
7402 static int rpc_samdump(struct net_context *c, int argc, const char **argv) {
7403         if (c->display_usage) {
7404                 d_printf(  "%s\n"
7405                            "net rpc samdump\n"
7406                            "    %s\n",
7407                          _("Usage:"),
7408                          _("Dump remote SAM database"));
7409                 return 0;
7410         }
7411
7412         return run_rpc_command(c, NULL, &ndr_table_netlogon,
7413                                NET_FLAGS_ANONYMOUS,
7414                                rpc_samdump_internals, argc, argv);
7415 }
7416
7417 /* syncronise sam database via samsync rpc calls */
7418 static int rpc_vampire(struct net_context *c, int argc, const char **argv)
7419 {
7420         struct functable func[] = {
7421                 {
7422                         "ldif",
7423                         rpc_vampire_ldif,
7424                         NET_TRANSPORT_RPC,
7425                         N_("Dump remote SAM database to ldif"),
7426                         N_("net rpc vampire ldif\n"
7427                            "    Dump remote SAM database to LDIF file or "
7428                            "stdout")
7429                 },
7430                 {
7431                         "keytab",
7432                         rpc_vampire_keytab,
7433                         NET_TRANSPORT_RPC,
7434                         N_("Dump remote SAM database to Kerberos Keytab"),
7435                         N_("net rpc vampire keytab\n"
7436                            "    Dump remote SAM database to Kerberos keytab "
7437                            "file")
7438                 },
7439                 {
7440                         "passdb",
7441                         rpc_vampire_passdb,
7442                         NET_TRANSPORT_RPC,
7443                         N_("Dump remote SAM database to passdb"),
7444                         N_("net rpc vampire passdb\n"
7445                            "    Dump remote SAM database to passdb")
7446                 },
7447
7448                 {NULL, NULL, 0, NULL, NULL}
7449         };
7450
7451         if (argc == 0) {
7452                 if (c->display_usage) {
7453                         d_printf(  "%s\n"
7454                                    "net rpc vampire\n"
7455                                    "    %s\n",
7456                                  _("Usage:"),
7457                                  _("Vampire remote SAM database"));
7458                         return 0;
7459                 }
7460
7461                 return rpc_vampire_passdb(c, argc, argv);
7462         }
7463
7464         return net_run_function(c, argc, argv, "net rpc vampire", func);
7465 }
7466
7467 /**
7468  * Migrate everything from a print server.
7469  *
7470  * @param c     A net_context structure.
7471  * @param argc  Standard main() style argc.
7472  * @param argv  Standard main() style argv. Initial components are already
7473  *              stripped.
7474  *
7475  * @return A shell status integer (0 for success).
7476  *
7477  * The order is important !
7478  * To successfully add drivers the print queues have to exist !
7479  * Applying ACLs should be the last step, because you're easily locked out.
7480  *
7481  **/
7482 static int rpc_printer_migrate_all(struct net_context *c, int argc,
7483                                    const char **argv)
7484 {
7485         int ret;
7486
7487         if (c->display_usage) {
7488                 d_printf(  "%s\n"
7489                            "net rpc printer migrate all\n"
7490                            "    %s\n",
7491                          _("Usage:"),
7492                          _("Migrate everything from a print server"));
7493                 return 0;
7494         }
7495
7496         if (!c->opt_host) {
7497                 d_printf(_("no server to migrate\n"));
7498                 return -1;
7499         }
7500
7501         ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7502                               rpc_printer_migrate_printers_internals, argc,
7503                               argv);
7504         if (ret)
7505                 return ret;
7506
7507         ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7508                               rpc_printer_migrate_drivers_internals, argc,
7509                               argv);
7510         if (ret)
7511                 return ret;
7512
7513         ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7514                               rpc_printer_migrate_forms_internals, argc, argv);
7515         if (ret)
7516                 return ret;
7517
7518         ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7519                               rpc_printer_migrate_settings_internals, argc,
7520                               argv);
7521         if (ret)
7522                 return ret;
7523
7524         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7525                                rpc_printer_migrate_security_internals, argc,
7526                                argv);
7527
7528 }
7529
7530 /**
7531  * Migrate print drivers from a print server.
7532  *
7533  * @param c     A net_context structure.
7534  * @param argc  Standard main() style argc.
7535  * @param argv  Standard main() style argv. Initial components are already
7536  *              stripped.
7537  *
7538  * @return A shell status integer (0 for success).
7539  **/
7540 static int rpc_printer_migrate_drivers(struct net_context *c, int argc,
7541                                        const char **argv)
7542 {
7543         if (c->display_usage) {
7544                 d_printf(  "%s\n"
7545                            "net rpc printer migrate drivers\n"
7546                            "     %s\n",
7547                          _("Usage:"),
7548                          _("Migrate print-drivers from a print-server"));
7549                 return 0;
7550         }
7551
7552         if (!c->opt_host) {
7553                 d_printf(_("no server to migrate\n"));
7554                 return -1;
7555         }
7556
7557         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7558                                rpc_printer_migrate_drivers_internals,
7559                                argc, argv);
7560 }
7561
7562 /**
7563  * Migrate print-forms from a print-server.
7564  *
7565  * @param c     A net_context structure.
7566  * @param argc  Standard main() style argc.
7567  * @param argv  Standard main() style argv. Initial components are already
7568  *              stripped.
7569  *
7570  * @return A shell status integer (0 for success).
7571  **/
7572 static int rpc_printer_migrate_forms(struct net_context *c, int argc,
7573                                      const char **argv)
7574 {
7575         if (c->display_usage) {
7576                 d_printf(  "%s\n"
7577                            "net rpc printer migrate forms\n"
7578                            "    %s\n",
7579                          _("Usage:"),
7580                          _("Migrate print-forms from a print-server"));
7581                 return 0;
7582         }
7583
7584         if (!c->opt_host) {
7585                 d_printf(_("no server to migrate\n"));
7586                 return -1;
7587         }
7588
7589         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7590                                rpc_printer_migrate_forms_internals,
7591                                argc, argv);
7592 }
7593
7594 /**
7595  * Migrate printers from a print-server.
7596  *
7597  * @param c     A net_context structure.
7598  * @param argc  Standard main() style argc.
7599  * @param argv  Standard main() style argv. Initial components are already
7600  *              stripped.
7601  *
7602  * @return A shell status integer (0 for success).
7603  **/
7604 static int rpc_printer_migrate_printers(struct net_context *c, int argc,
7605                                         const char **argv)
7606 {
7607         if (c->display_usage) {
7608                 d_printf(  "%s\n"
7609                            "net rpc printer migrate printers\n"
7610                            "    %s\n",
7611                          _("Usage:"),
7612                          _("Migrate printers from a print-server"));
7613                 return 0;
7614         }
7615
7616         if (!c->opt_host) {
7617                 d_printf(_("no server to migrate\n"));
7618                 return -1;
7619         }
7620
7621         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7622                                rpc_printer_migrate_printers_internals,
7623                                argc, argv);
7624 }
7625
7626 /**
7627  * Migrate printer-ACLs from a print-server
7628  *
7629  * @param c     A net_context structure.
7630  * @param argc  Standard main() style argc.
7631  * @param argv  Standard main() style argv. Initial components are already
7632  *              stripped.
7633  *
7634  * @return A shell status integer (0 for success).
7635  **/
7636 static int rpc_printer_migrate_security(struct net_context *c, int argc,
7637                                         const char **argv)
7638 {
7639         if (c->display_usage) {
7640                 d_printf(  "%s\n"
7641                            "net rpc printer migrate security\n"
7642                            "    %s\n",
7643                          _("Usage:"),
7644                          _("Migrate printer-ACLs from a print-server"));
7645                 return 0;
7646         }
7647
7648         if (!c->opt_host) {
7649                 d_printf(_("no server to migrate\n"));
7650                 return -1;
7651         }
7652
7653         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7654                                rpc_printer_migrate_security_internals,
7655                                argc, argv);
7656 }
7657
7658 /**
7659  * Migrate printer-settings from a print-server.
7660  *
7661  * @param c     A net_context structure.
7662  * @param argc  Standard main() style argc.
7663  * @param argv  Standard main() style argv. Initial components are already
7664  *              stripped.
7665  *
7666  * @return A shell status integer (0 for success).
7667  **/
7668 static int rpc_printer_migrate_settings(struct net_context *c, int argc,
7669                                         const char **argv)
7670 {
7671         if (c->display_usage) {
7672                 d_printf(  "%s\n"
7673                            "net rpc printer migrate settings\n"
7674                             "    %s\n",
7675                           _("Usage:"),
7676                           _("Migrate printer-settings from a "
7677                             "print-server"));
7678                 return 0;
7679         }
7680
7681         if (!c->opt_host) {
7682                 d_printf(_("no server to migrate\n"));
7683                 return -1;
7684         }
7685
7686         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7687                                rpc_printer_migrate_settings_internals,
7688                                argc, argv);
7689 }
7690
7691 /**
7692  * 'net rpc printer' entrypoint.
7693  *
7694  * @param c     A net_context structure.
7695  * @param argc  Standard main() style argc.
7696  * @param argv  Standard main() style argv. Initial components are already
7697  *              stripped.
7698  **/
7699
7700 int rpc_printer_migrate(struct net_context *c, int argc, const char **argv)
7701 {
7702
7703         /* ouch: when addriver and setdriver are called from within
7704            rpc_printer_migrate_drivers_internals, the printer-queue already
7705            *has* to exist */
7706
7707         struct functable func[] = {
7708                 {
7709                         "all",
7710                         rpc_printer_migrate_all,
7711                         NET_TRANSPORT_RPC,
7712                         N_("Migrate all from remote to local print server"),
7713                         N_("net rpc printer migrate all\n"
7714                            "    Migrate all from remote to local print server")
7715                 },
7716                 {
7717                         "drivers",
7718                         rpc_printer_migrate_drivers,
7719                         NET_TRANSPORT_RPC,
7720                         N_("Migrate drivers to local server"),
7721                         N_("net rpc printer migrate drivers\n"
7722                            "    Migrate drivers to local server")
7723                 },
7724                 {
7725                         "forms",
7726                         rpc_printer_migrate_forms,
7727                         NET_TRANSPORT_RPC,
7728                         N_("Migrate froms to local server"),
7729                         N_("net rpc printer migrate forms\n"
7730                            "    Migrate froms to local server")
7731                 },
7732                 {
7733                         "printers",
7734                         rpc_printer_migrate_printers,
7735                         NET_TRANSPORT_RPC,
7736                         N_("Migrate printers to local server"),
7737                         N_("net rpc printer migrate printers\n"
7738                            "    Migrate printers to local server")
7739                 },
7740                 {
7741                         "security",
7742                         rpc_printer_migrate_security,
7743                         NET_TRANSPORT_RPC,
7744                         N_("Mirgate printer ACLs to local server"),
7745                         N_("net rpc printer migrate security\n"
7746                            "    Mirgate printer ACLs to local server")
7747                 },
7748                 {
7749                         "settings",
7750                         rpc_printer_migrate_settings,
7751                         NET_TRANSPORT_RPC,
7752                         N_("Migrate printer settings to local server"),
7753                         N_("net rpc printer migrate settings\n"
7754                            "    Migrate printer settings to local server")
7755                 },
7756                 {NULL, NULL, 0, NULL, NULL}
7757         };
7758
7759         return net_run_function(c, argc, argv, "net rpc printer migrate",func);
7760 }
7761
7762
7763 /**
7764  * List printers on a remote RPC server.
7765  *
7766  * @param c     A net_context structure.
7767  * @param argc  Standard main() style argc.
7768  * @param argv  Standard main() style argv. Initial components are already
7769  *              stripped.
7770  *
7771  * @return A shell status integer (0 for success).
7772  **/
7773 static int rpc_printer_list(struct net_context *c, int argc, const char **argv)
7774 {
7775         if (c->display_usage) {
7776                 d_printf(  "%s\n"
7777                            "net rpc printer list\n"
7778                            "    %s\n",
7779                          _("Usage:"),
7780                          _("List printers on a remote RPC server"));
7781                 return 0;
7782         }
7783
7784         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7785                                rpc_printer_list_internals,
7786                                argc, argv);
7787 }
7788
7789 /**
7790  * List printer-drivers on a remote RPC server.
7791  *
7792  * @param c     A net_context structure.
7793  * @param argc  Standard main() style argc.
7794  * @param argv  Standard main() style argv. Initial components are already
7795  *              stripped.
7796  *
7797  * @return A shell status integer (0 for success).
7798  **/
7799 static int rpc_printer_driver_list(struct net_context *c, int argc,
7800                                    const char **argv)
7801 {
7802         if (c->display_usage) {
7803                 d_printf(  "%s\n"
7804                            "net rpc printer driver\n"
7805                            "    %s\n",
7806                          _("Usage:"),
7807                          _("List printer-drivers on a remote RPC server"));
7808                 return 0;
7809         }
7810
7811         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7812                                rpc_printer_driver_list_internals,
7813                                argc, argv);
7814 }
7815
7816 /**
7817  * Publish printer in ADS via MSRPC.
7818  *
7819  * @param c     A net_context structure.
7820  * @param argc  Standard main() style argc.
7821  * @param argv  Standard main() style argv. Initial components are already
7822  *              stripped.
7823  *
7824  * @return A shell status integer (0 for success).
7825  **/
7826 static int rpc_printer_publish_publish(struct net_context *c, int argc,
7827                                        const char **argv)
7828 {
7829         if (c->display_usage) {
7830                 d_printf(  "%s\n"
7831                            "net rpc printer publish publish\n"
7832                            "     %s\n",
7833                          _("Usage:"),
7834                          _("Publish printer in ADS via MSRPC"));
7835                 return 0;
7836         }
7837
7838         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7839                                rpc_printer_publish_publish_internals,
7840                                argc, argv);
7841 }
7842
7843 /**
7844  * Update printer in ADS via MSRPC.
7845  *
7846  * @param c     A net_context structure.
7847  * @param argc  Standard main() style argc.
7848  * @param argv  Standard main() style argv. Initial components are already
7849  *              stripped.
7850  *
7851  * @return A shell status integer (0 for success).
7852  **/
7853 static int rpc_printer_publish_update(struct net_context *c, int argc, const char **argv)
7854 {
7855         if (c->display_usage) {
7856                 d_printf(  "%s\n"
7857                            "net rpc printer publish update\n"
7858                            "    %s\n",
7859                          _("Usage:"),
7860                          _("Update printer in ADS via MSRPC"));
7861                 return 0;
7862         }
7863
7864         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7865                                rpc_printer_publish_update_internals,
7866                                argc, argv);
7867 }
7868
7869 /**
7870  * UnPublish printer in ADS via MSRPC.
7871  *
7872  * @param c     A net_context structure.
7873  * @param argc  Standard main() style argc.
7874  * @param argv  Standard main() style argv. Initial components are already
7875  *              stripped.
7876  *
7877  * @return A shell status integer (0 for success).
7878  **/
7879 static int rpc_printer_publish_unpublish(struct net_context *c, int argc,
7880                                          const char **argv)
7881 {
7882         if (c->display_usage) {
7883                 d_printf(  "%s\n"
7884                            "net rpc printer publish unpublish\n"
7885                            "    %s\n",
7886                          _("Usage:\n"),
7887                          _("UnPublish printer in ADS via MSRPC"));
7888                 return 0;
7889         }
7890
7891         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7892                                rpc_printer_publish_unpublish_internals,
7893                                argc, argv);
7894 }
7895
7896 /**
7897  * List published printers via MSRPC.
7898  *
7899  * @param c     A net_context structure.
7900  * @param argc  Standard main() style argc.
7901  * @param argv  Standard main() style argv. Initial components are already
7902  *              stripped.
7903  *
7904  * @return A shell status integer (0 for success).
7905  **/
7906 static int rpc_printer_publish_list(struct net_context *c, int argc,
7907                                     const char **argv)
7908 {
7909         if (c->display_usage) {
7910                 d_printf(  "%s\n"
7911                            "net rpc printer publish list\n"
7912                            "    %s\n",
7913                          _("Usage:"),
7914                          _("List published printers via MSRPC"));
7915                 return 0;
7916         }
7917
7918         return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7919                                rpc_printer_publish_list_internals,
7920                                argc, argv);
7921 }
7922
7923
7924 /**
7925  * Publish printer in ADS.
7926  *
7927  * @param c     A net_context structure.
7928  * @param argc  Standard main() style argc.
7929  * @param argv  Standard main() style argv. Initial components are already
7930  *              stripped.
7931  *
7932  * @return A shell status integer (0 for success).
7933  **/
7934 static int rpc_printer_publish(struct net_context *c, int argc,
7935                                const char **argv)
7936 {
7937
7938         struct functable func[] = {
7939                 {
7940                         "publish",
7941                         rpc_printer_publish_publish,
7942                         NET_TRANSPORT_RPC,
7943                         N_("Publish printer in AD"),
7944                         N_("net rpc printer publish publish\n"
7945                            "    Publish printer in AD")
7946                 },
7947                 {
7948                         "update",
7949                         rpc_printer_publish_update,
7950                         NET_TRANSPORT_RPC,
7951                         N_("Update printer in AD"),
7952                         N_("net rpc printer publish update\n"
7953                            "    Update printer in AD")
7954                 },
7955                 {
7956                         "unpublish",
7957                         rpc_printer_publish_unpublish,
7958                         NET_TRANSPORT_RPC,
7959                         N_("Unpublish printer"),
7960                         N_("net rpc printer publish unpublish\n"
7961                            "    Unpublish printer")
7962                 },
7963                 {
7964                         "list",
7965                         rpc_printer_publish_list,
7966                         NET_TRANSPORT_RPC,
7967                         N_("List published printers"),
7968                         N_("net rpc printer publish list\n"
7969                            "    List published printers")
7970                 },
7971                 {NULL, NULL, 0, NULL, NULL}
7972         };
7973
7974         if (argc == 0) {
7975                 if (c->display_usage) {
7976                         d_printf(_("Usage:\n"));
7977                         d_printf(_("net rpc printer publish\n"
7978                                    "    List published printers\n"
7979                                    "    Alias of net rpc printer publish "
7980                                    "list\n"));
7981                         net_display_usage_from_functable(func);
7982                         return 0;
7983                 }
7984                 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7985                                rpc_printer_publish_list_internals,
7986                                argc, argv);
7987         }
7988
7989         return net_run_function(c, argc, argv, "net rpc printer publish",func);
7990
7991 }
7992
7993
7994 /**
7995  * Display rpc printer help page.
7996  *
7997  * @param c     A net_context structure.
7998  * @param argc  Standard main() style argc.
7999  * @param argv  Standard main() style argv. Initial components are already
8000  *              stripped.
8001  **/
8002 int rpc_printer_usage(struct net_context *c, int argc, const char **argv)
8003 {
8004         d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
8005                    "\tlists all printers on print-server\n\n"));
8006         d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
8007                    "\tlists all printer-drivers on print-server\n\n"));
8008         d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
8009                    "\tpublishes printer settings in Active Directory\n"
8010                    "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
8011         d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
8012                    "\n\tmigrates printers from remote to local server\n\n"));
8013         d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
8014                    "\n\tmigrates printer-settings from remote to local server\n\n"));
8015         d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
8016                    "\n\tmigrates printer-drivers from remote to local server\n\n"));
8017         d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
8018                    "\n\tmigrates printer-forms from remote to local server\n\n"));
8019         d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
8020                    "\n\tmigrates printer-ACLs from remote to local server\n\n"));
8021         d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
8022                    "\n\tmigrates drivers, forms, queues, settings and acls from\n"
8023                    "\tremote to local print-server\n\n"));
8024         net_common_methods_usage(c, argc, argv);
8025         net_common_flags_usage(c, argc, argv);
8026         d_printf(_(
8027          "\t-v or --verbose\t\t\tgive verbose output\n"
8028          "\t      --destination\t\tmigration target server (default: localhost)\n"));
8029
8030         return -1;
8031 }
8032
8033 /**
8034  * 'net rpc printer' entrypoint.
8035  *
8036  * @param c     A net_context structure.
8037  * @param argc  Standard main() style argc.
8038  * @param argv  Standard main() style argv. Initial components are already
8039  *              stripped.
8040  **/
8041 int net_rpc_printer(struct net_context *c, int argc, const char **argv)
8042 {
8043         struct functable func[] = {
8044                 {
8045                         "list",
8046                         rpc_printer_list,
8047                         NET_TRANSPORT_RPC,
8048                         N_("List all printers on print server"),
8049                         N_("net rpc printer list\n"
8050                            "    List all printers on print server")
8051                 },
8052                 {
8053                         "migrate",
8054                         rpc_printer_migrate,
8055                         NET_TRANSPORT_RPC,
8056                         N_("Migrate printer to local server"),
8057                         N_("net rpc printer migrate\n"
8058                            "    Migrate printer to local server")
8059                 },
8060                 {
8061                         "driver",
8062                         rpc_printer_driver_list,
8063                         NET_TRANSPORT_RPC,
8064                         N_("List printer drivers"),
8065                         N_("net rpc printer driver\n"
8066                            "    List printer drivers")
8067                 },
8068                 {
8069                         "publish",
8070                         rpc_printer_publish,
8071                         NET_TRANSPORT_RPC,
8072                         N_("Publish printer in AD"),
8073                         N_("net rpc printer publish\n"
8074                            "    Publish printer in AD")
8075                 },
8076                 {NULL, NULL, 0, NULL, NULL}
8077         };
8078
8079         if (argc == 0) {
8080                 if (c->display_usage) {
8081                         d_printf(_("Usage:\n"));
8082                         d_printf(_("net rpc printer\n"
8083                                    "    List printers\n"));
8084                         net_display_usage_from_functable(func);
8085                         return 0;
8086                 }
8087                 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
8088                                rpc_printer_list_internals,
8089                                argc, argv);
8090         }
8091
8092         return net_run_function(c, argc, argv, "net rpc printer", func);
8093 }
8094
8095 /**
8096  * 'net rpc' entrypoint.
8097  *
8098  * @param c     A net_context structure.
8099  * @param argc  Standard main() style argc.
8100  * @param argv  Standard main() style argv. Initial components are already
8101  *              stripped.
8102  **/
8103
8104 int net_rpc(struct net_context *c, int argc, const char **argv)
8105 {
8106         NET_API_STATUS status;
8107
8108         struct functable func[] = {
8109                 {
8110                         "audit",
8111                         net_rpc_audit,
8112                         NET_TRANSPORT_RPC,
8113                         N_("Modify global audit settings"),
8114                         N_("net rpc audit\n"
8115                            "    Modify global audit settings")
8116                 },
8117                 {
8118                         "info",
8119                         net_rpc_info,
8120                         NET_TRANSPORT_RPC,
8121                         N_("Show basic info about a domain"),
8122                         N_("net rpc info\n"
8123                            "    Show basic info about a domain")
8124                 },
8125                 {
8126                         "join",
8127                         net_rpc_join,
8128                         NET_TRANSPORT_RPC,
8129                         N_("Join a domain"),
8130                         N_("net rpc join\n"
8131                            "    Join a domain")
8132                 },
8133                 {
8134                         "oldjoin",
8135                         net_rpc_oldjoin,
8136                         NET_TRANSPORT_RPC,
8137                         N_("Join a domain created in server manager"),
8138                         N_("net rpc oldjoin\n"
8139                            "    Join a domain created in server manager")
8140                 },
8141                 {
8142                         "testjoin",
8143                         net_rpc_testjoin,
8144                         NET_TRANSPORT_RPC,
8145                         N_("Test that a join is valid"),
8146                         N_("net rpc testjoin\n"
8147                            "    Test that a join is valid")
8148                 },
8149                 {
8150                         "user",
8151                         net_rpc_user,
8152                         NET_TRANSPORT_RPC,
8153                         N_("List/modify users"),
8154                         N_("net rpc user\n"
8155                            "    List/modify users")
8156                 },
8157                 {
8158                         "password",
8159                         rpc_user_password,
8160                         NET_TRANSPORT_RPC,
8161                         N_("Change a user password"),
8162                         N_("net rpc password\n"
8163                            "    Change a user password\n"
8164                            "    Alias for net rpc user password")
8165                 },
8166                 {
8167                         "group",
8168                         net_rpc_group,
8169                         NET_TRANSPORT_RPC,
8170                         N_("List/modify groups"),
8171                         N_("net rpc group\n"
8172                            "    List/modify groups")
8173                 },
8174                 {
8175                         "share",
8176                         net_rpc_share,
8177                         NET_TRANSPORT_RPC,
8178                         N_("List/modify shares"),
8179                         N_("net rpc share\n"
8180                            "    List/modify shares")
8181                 },
8182                 {
8183                         "file",
8184                         net_rpc_file,
8185                         NET_TRANSPORT_RPC,
8186                         N_("List open files"),
8187                         N_("net rpc file\n"
8188                            "    List open files")
8189                 },
8190                 {
8191                         "printer",
8192                         net_rpc_printer,
8193                         NET_TRANSPORT_RPC,
8194                         N_("List/modify printers"),
8195                         N_("net rpc printer\n"
8196                            "    List/modify printers")
8197                 },
8198                 {
8199                         "changetrustpw",
8200                         net_rpc_changetrustpw,
8201                         NET_TRANSPORT_RPC,
8202                         N_("Change trust account password"),
8203                         N_("net rpc changetrustpw\n"
8204                            "    Change trust account password")
8205                 },
8206                 {
8207                         "trustdom",
8208                         rpc_trustdom,
8209                         NET_TRANSPORT_RPC,
8210                         N_("Modify domain trusts"),
8211                         N_("net rpc trustdom\n"
8212                            "    Modify domain trusts")
8213                 },
8214                 {
8215                         "abortshutdown",
8216                         rpc_shutdown_abort,
8217                         NET_TRANSPORT_RPC,
8218                         N_("Abort a remote shutdown"),
8219                         N_("net rpc abortshutdown\n"
8220                            "    Abort a remote shutdown")
8221                 },
8222                 {
8223                         "shutdown",
8224                         rpc_shutdown,
8225                         NET_TRANSPORT_RPC,
8226                         N_("Shutdown a remote server"),
8227                         N_("net rpc shutdown\n"
8228                            "    Shutdown a remote server")
8229                 },
8230                 {
8231                         "samdump",
8232                         rpc_samdump,
8233                         NET_TRANSPORT_RPC,
8234                         N_("Dump SAM data of remote NT PDC"),
8235                         N_("net rpc samdump\n"
8236                            "    Dump SAM data of remote NT PDC")
8237                 },
8238                 {
8239                         "vampire",
8240                         rpc_vampire,
8241                         NET_TRANSPORT_RPC,
8242                         N_("Sync a remote NT PDC's data into local passdb"),
8243                         N_("net rpc vampire\n"
8244                            "    Sync a remote NT PDC's data into local passdb")
8245                 },
8246                 {
8247                         "getsid",
8248                         net_rpc_getsid,
8249                         NET_TRANSPORT_RPC,
8250                         N_("Fetch the domain sid into local secrets.tdb"),
8251                         N_("net rpc getsid\n"
8252                            "    Fetch the domain sid into local secrets.tdb")
8253                 },
8254                 {
8255                         "rights",
8256                         net_rpc_rights,
8257                         NET_TRANSPORT_RPC,
8258                         N_("Manage privileges assigned to SID"),
8259                         N_("net rpc rights\n"
8260                            "    Manage privileges assigned to SID")
8261                 },
8262                 {
8263                         "service",
8264                         net_rpc_service,
8265                         NET_TRANSPORT_RPC,
8266                         N_("Start/stop/query remote services"),
8267                         N_("net rpc service\n"
8268                            "    Start/stop/query remote services")
8269                 },
8270                 {
8271                         "registry",
8272                         net_rpc_registry,
8273                         NET_TRANSPORT_RPC,
8274                         N_("Manage registry hives"),
8275                         N_("net rpc registry\n"
8276                            "    Manage registry hives")
8277                 },
8278                 {
8279                         "shell",
8280                         net_rpc_shell,
8281                         NET_TRANSPORT_RPC,
8282                         N_("Open interactive shell on remote server"),
8283                         N_("net rpc shell\n"
8284                            "    Open interactive shell on remote server")
8285                 },
8286                 {
8287                         "trust",
8288                         net_rpc_trust,
8289                         NET_TRANSPORT_RPC,
8290                         N_("Manage trusts"),
8291                         N_("net rpc trust\n"
8292                            "    Manage trusts")
8293                 },
8294                 {
8295                         "conf",
8296                         net_rpc_conf,
8297                         NET_TRANSPORT_RPC,
8298                         N_("Configure a remote samba server"),
8299                         N_("net rpc conf\n"
8300                            "    Configure a remote samba server")
8301                 },
8302                 {NULL, NULL, 0, NULL, NULL}
8303         };
8304
8305         status = libnetapi_net_init(&c->netapi_ctx);
8306         if (status != 0) {
8307                 return -1;
8308         }
8309         libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
8310         libnetapi_set_password(c->netapi_ctx, c->opt_password);
8311         if (c->opt_kerberos) {
8312                 libnetapi_set_use_kerberos(c->netapi_ctx);
8313         }
8314         if (c->opt_ccache) {
8315                 libnetapi_set_use_ccache(c->netapi_ctx);
8316         }
8317
8318         return net_run_function(c, argc, argv, "net rpc", func);
8319 }