?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:ldb Remove DN+Binary code from the core ldb_dn
[Samba.git] / source4 / rpc_server / lsa / lsa_lookup.c
bloba164ad6d94ecb831b05a9c92eae1ca8f8f917775
1 /*
2 Unix SMB/CIFS implementation.
3
4 endpoint server for the lsarpc pipe
5
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "rpc_server/lsa/lsa.h"
24
25 static const struct {
26 const char *domain;
27 const char *name;
28 const char *sid;
29 int rtype;
30 } well_known[] = {
31 {
32 .name = "EVERYONE",
33 .sid = SID_WORLD,
34 .rtype = SID_NAME_WKN_GRP,
35 },
36 {
37 .name = "CREATOR OWNER",
38 .sid = SID_CREATOR_OWNER,
39 .rtype = SID_NAME_WKN_GRP,
40 },
41 {
42 .name = "CREATOR GROUP",
43 .sid = SID_CREATOR_GROUP,
44 .rtype = SID_NAME_WKN_GRP,
45 },
46 {
47 .name = "Owner Rights",
48 .sid = SID_OWNER_RIGHTS,
49 .rtype = SID_NAME_WKN_GRP,
50 },
51 {
52 .domain = "NT AUTHORITY",
53 .name = "Dialup",
54 .sid = SID_NT_DIALUP,
55 .rtype = SID_NAME_WKN_GRP,
56 },
57 {
58 .domain = "NT AUTHORITY",
59 .name = "Network",
60 .sid = SID_NT_NETWORK,
61 .rtype = SID_NAME_WKN_GRP,
62 },
63 {
64 .domain = "NT AUTHORITY",
65 .name = "Batch",
66 .sid = SID_NT_BATCH,
67 .rtype = SID_NAME_WKN_GRP,
68 },
69 {
70 .domain = "NT AUTHORITY",
71 .name = "Interactive",
72 .sid = SID_NT_INTERACTIVE,
73 .rtype = SID_NAME_WKN_GRP,
74 },
75 {
76 .domain = "NT AUTHORITY",
77 .name = "Service",
78 .sid = SID_NT_SERVICE,
79 .rtype = SID_NAME_WKN_GRP,
80 },
81 {
82 .domain = "NT AUTHORITY",
83 .name = "ANONYMOUS LOGON",
84 .sid = SID_NT_ANONYMOUS,
85 .rtype = SID_NAME_WKN_GRP,
86 },
87 {
88 .domain = "NT AUTHORITY",
89 .name = "Proxy",
90 .sid = SID_NT_PROXY,
91 .rtype = SID_NAME_WKN_GRP,
92 },
93 {
94 .domain = "NT AUTHORITY",
95 .name = "ServerLogon",
96 .sid = SID_NT_ENTERPRISE_DCS,
97 .rtype = SID_NAME_WKN_GRP,
98 },
99 {
100 .domain = "NT AUTHORITY",
101 .name = "Self",
102 .sid = SID_NT_SELF,
103 .rtype = SID_NAME_WKN_GRP,
104 },
105 {
106 .domain = "NT AUTHORITY",
107 .name = "Authenticated Users",
108 .sid = SID_NT_AUTHENTICATED_USERS,
109 .rtype = SID_NAME_WKN_GRP,
110 },
111 {
112 .domain = "NT AUTHORITY",
113 .name = "Restricted",
114 .sid = SID_NT_RESTRICTED,
115 .rtype = SID_NAME_WKN_GRP,
116 },
117 {
118 .domain = "NT AUTHORITY",
119 .name = "Terminal Server User",
120 .sid = SID_NT_TERMINAL_SERVER_USERS,
121 .rtype = SID_NAME_WKN_GRP,
122 },
123 {
124 .domain = "NT AUTHORITY",
125 .name = "Remote Interactive Logon",
126 .sid = SID_NT_REMOTE_INTERACTIVE,
127 .rtype = SID_NAME_WKN_GRP,
128 },
129 {
130 .domain = "NT AUTHORITY",
131 .name = "This Organization",
132 .sid = SID_NT_THIS_ORGANISATION,
133 .rtype = SID_NAME_WKN_GRP,
134 },
135 {
136 .domain = "NT AUTHORITY",
137 .name = "SYSTEM",
138 .sid = SID_NT_SYSTEM,
139 .rtype = SID_NAME_WKN_GRP,
140 },
141 {
142 .domain = "NT AUTHORITY",
143 .name = "Local Service",
144 .sid = SID_NT_LOCAL_SERVICE,
145 .rtype = SID_NAME_WKN_GRP,
146 },
147 {
148 .domain = "NT AUTHORITY",
149 .name = "Network Service",
150 .sid = SID_NT_NETWORK_SERVICE,
151 .rtype = SID_NAME_WKN_GRP,
152 },
153 {
154 .domain = "NT AUTHORITY",
155 .name = "Digest Authentication",
156 .sid = SID_NT_DIGEST_AUTHENTICATION,
157 .rtype = SID_NAME_WKN_GRP,
158 },
159 {
160 .domain = "NT AUTHORITY",
161 .name = "Enterprise Domain Controllers",
162 .sid = SID_NT_ENTERPRISE_DCS,
163 .rtype = SID_NAME_WKN_GRP,
164 },
165 {
166 .domain = "NT AUTHORITY",
167 .name = "NTLM Authentication",
168 .sid = SID_NT_NTLM_AUTHENTICATION,
169 .rtype = SID_NAME_WKN_GRP,
170 },
171 {
172 .domain = "NT AUTHORITY",
173 .name = "Other Organization",
174 .sid = SID_NT_OTHER_ORGANISATION,
175 .rtype = SID_NAME_WKN_GRP,
176 },
177 {
178 .domain = "NT AUTHORITY",
179 .name = "SChannel Authentication",
180 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
181 .rtype = SID_NAME_WKN_GRP,
182 },
183 {
184 .domain = "NT AUTHORITY",
185 .name = "IUSR",
186 .sid = SID_NT_IUSR,
187 .rtype = SID_NAME_WKN_GRP,
188 },
189 {
190 .sid = NULL,
191 }
192 };
193
194 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195 const char *name, const char **authority_name,
196 struct dom_sid **sid, uint32_t *rtype)
197 {
198 int i;
199 for (i=0; well_known[i].sid; i++) {
200 if (domain) {
201 if (strcasecmp_m(domain, well_known[i].domain) == 0
202 && strcasecmp_m(name, well_known[i].name) == 0) {
203 *authority_name = well_known[i].domain;
204 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
205 *rtype = well_known[i].rtype;
206 return NT_STATUS_OK;
207 }
208 } else {
209 if (strcasecmp_m(name, well_known[i].name) == 0) {
210 *authority_name = well_known[i].domain;
211 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
212 *rtype = well_known[i].rtype;
213 return NT_STATUS_OK;
214 }
215 }
216 }
217 return NT_STATUS_NOT_FOUND;
218 }
219
220 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx,
221 const char *sid_str, const char **authority_name,
222 const char **name, uint32_t *rtype)
223 {
224 int i;
225 for (i=0; well_known[i].sid; i++) {
226 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227 *authority_name = well_known[i].domain;
228 *name = well_known[i].name;
229 *rtype = well_known[i].rtype;
230 return NT_STATUS_OK;
231 }
232 }
233 return NT_STATUS_NOT_FOUND;
234 }
235
236 /*
237 lookup a SID for 1 name
238 */
239 static NTSTATUS dcesrv_lsa_lookup_name(struct tevent_context *ev_ctx,
240 struct loadparm_context *lp_ctx,
241 struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242 const char *name, const char **authority_name,
243 struct dom_sid **sid, enum lsa_SidType *rtype,
244 uint32_t *rid)
245 {
246 int ret, atype, i;
247 struct ldb_message **res;
248 const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
249 const char *p;
250 const char *domain;
251 const char *username;
252 struct ldb_dn *domain_dn;
253 struct dom_sid *domain_sid;
254 NTSTATUS status;
255
256 p = strchr_m(name, '\\');
257 if (p != NULL) {
258 domain = talloc_strndup(mem_ctx, name, p-name);
259 if (!domain) {
260 return NT_STATUS_NO_MEMORY;
261 }
262 username = p + 1;
263 } else if (strchr_m(name, '@')) {
264 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
265 if (!NT_STATUS_IS_OK(status)) {
266 DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
267 return status;
268 }
269 } else {
270 domain = NULL;
271 username = name;
272 }
273
274 if (!domain) {
275 /* Look up table of well known names */
276 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
277 if (NT_STATUS_IS_OK(status)) {
278 dom_sid_split_rid(NULL, *sid, NULL, rid);
279 return NT_STATUS_OK;
280 }
281
282 if (username == NULL) {
283 *authority_name = NAME_BUILTIN;
284 *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
285 *rtype = SID_NAME_DOMAIN;
286 *rid = 0xFFFFFFFF;
287 return NT_STATUS_OK;
288 }
289
290 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) {
291 *authority_name = NAME_NT_AUTHORITY;
292 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
293 *rtype = SID_NAME_DOMAIN;
294 dom_sid_split_rid(NULL, *sid, NULL, rid);
295 return NT_STATUS_OK;
296 }
297 if (strcasecmp_m(username, NAME_BUILTIN) == 0) {
298 *authority_name = NAME_BUILTIN;
299 *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
300 *rtype = SID_NAME_DOMAIN;
301 *rid = 0xFFFFFFFF;
302 return NT_STATUS_OK;
303 }
304 if (strcasecmp_m(username, state->domain_dns) == 0) {
305 *authority_name = state->domain_name;
306 *sid = state->domain_sid;
307 *rtype = SID_NAME_DOMAIN;
308 *rid = 0xFFFFFFFF;
309 return NT_STATUS_OK;
310 }
311 if (strcasecmp_m(username, state->domain_name) == 0) {
312 *authority_name = state->domain_name;
313 *sid = state->domain_sid;
314 *rtype = SID_NAME_DOMAIN;
315 *rid = 0xFFFFFFFF;
316 return NT_STATUS_OK;
317 }
318
319 /* Perhaps this is a well known user? */
320 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
321 if (!name) {
322 return NT_STATUS_NO_MEMORY;
323 }
324 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
325 if (NT_STATUS_IS_OK(status)) {
326 return status;
327 }
328
329 /* Perhaps this is a BUILTIN user? */
330 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
331 if (!name) {
332 return NT_STATUS_NO_MEMORY;
333 }
334 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
335 if (NT_STATUS_IS_OK(status)) {
336 return status;
337 }
338
339 /* OK, I give up - perhaps we need to assume the user is in our domain? */
340 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
341 if (!name) {
342 return NT_STATUS_NO_MEMORY;
343 }
344 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
345 if (NT_STATUS_IS_OK(status)) {
346 return status;
347 }
348
349 return STATUS_SOME_UNMAPPED;
350 } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
351 if (!*username) {
352 *authority_name = NAME_NT_AUTHORITY;
353 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
354 *rtype = SID_NAME_DOMAIN;
355 dom_sid_split_rid(NULL, *sid, NULL, rid);
356 return NT_STATUS_OK;
357 }
358
359 /* Look up table of well known names */
360 status = lookup_well_known_names(mem_ctx, domain, username, authority_name,
361 sid, rtype);
362 if (NT_STATUS_IS_OK(status)) {
363 dom_sid_split_rid(NULL, *sid, NULL, rid);
364 }
365 return status;
366 } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
367 *authority_name = NAME_BUILTIN;
368 domain_dn = state->builtin_dn;
369 } else if (strcasecmp_m(domain, state->domain_dns) == 0) {
370 *authority_name = state->domain_name;
371 domain_dn = state->domain_dn;
372 } else if (strcasecmp_m(domain, state->domain_name) == 0) {
373 *authority_name = state->domain_name;
374 domain_dn = state->domain_dn;
375 } else {
376 /* Not local, need to ask winbind in future */
377 return STATUS_SOME_UNMAPPED;
378 }
379
380 ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
381 if (ret == 1) {
382 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
383 if (domain_sid == NULL) {
384 return NT_STATUS_INVALID_SID;
385 }
386 } else {
387 return NT_STATUS_INVALID_SID;
388 }
389
390 if (!*username) {
391 *sid = domain_sid;
392 *rtype = SID_NAME_DOMAIN;
393 *rid = 0xFFFFFFFF;
394 return NT_STATUS_OK;
395 }
396
397 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
398 "(&(sAMAccountName=%s)(objectSid=*))",
399 ldb_binary_encode_string(mem_ctx, username));
400 if (ret == -1) {
401 return NT_STATUS_INVALID_SID;
402 }
403
404 for (i=0; i < ret; i++) {
405 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
406 if (*sid == NULL) {
407 return NT_STATUS_INVALID_SID;
408 }
409
410 /* Check that this is in the domain */
411 if (!dom_sid_in_domain(domain_sid, *sid)) {
412 continue;
413 }
414
415 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
416
417 *rtype = ds_atype_map(atype);
418 if (*rtype == SID_NAME_UNKNOWN) {
419 return STATUS_SOME_UNMAPPED;
420 }
421
422 dom_sid_split_rid(NULL, *sid, NULL, rid);
423 return NT_STATUS_OK;
424 }
425
426 /* need to check for an allocated sid */
427
428 return NT_STATUS_INVALID_SID;
429 }
430
431
432 /*
433 add to the lsa_RefDomainList for LookupSids and LookupNames
434 */
435 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
436 enum lsa_SidType rtype,
437 const char *authority_name,
438 struct dom_sid *sid,
439 struct lsa_RefDomainList *domains,
440 uint32_t *sid_index)
441 {
442 struct dom_sid *authority_sid;
443 int i;
444
445 if (rtype != SID_NAME_DOMAIN) {
446 authority_sid = dom_sid_dup(mem_ctx, sid);
447 if (authority_sid == NULL) {
448 return NT_STATUS_NO_MEMORY;
449 }
450 authority_sid->num_auths--;
451 } else {
452 authority_sid = sid;
453 }
454
455 /* see if we've already done this authority name */
456 for (i=0;i<domains->count;i++) {
457 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
458 *sid_index = i;
459 return NT_STATUS_OK;
460 }
461 }
462
463 domains->domains = talloc_realloc(domains,
464 domains->domains,
465 struct lsa_DomainInfo,
466 domains->count+1);
467 if (domains->domains == NULL) {
468 return NT_STATUS_NO_MEMORY;
469 }
470 domains->domains[i].name.string = authority_name;
471 domains->domains[i].sid = authority_sid;
472 domains->count++;
473 domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
474 *sid_index = i;
475
476 return NT_STATUS_OK;
477 }
478
479 /*
480 lookup a name for 1 SID
481 */
482 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
483 struct dom_sid *sid, const char *sid_str,
484 const char **authority_name,
485 const char **name, enum lsa_SidType *rtype)
486 {
487 NTSTATUS status;
488 int ret;
489 uint32_t atype;
490 struct ldb_message **res;
491 struct ldb_dn *domain_dn;
492 const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
493
494 status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
495 if (NT_STATUS_IS_OK(status)) {
496 return status;
497 }
498
499 if (dom_sid_in_domain(state->domain_sid, sid)) {
500 *authority_name = state->domain_name;
501 domain_dn = state->domain_dn;
502 } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
503 *authority_name = NAME_BUILTIN;
504 domain_dn = state->builtin_dn;
505 } else {
506 /* Not well known, our domain or built in */
507
508 /* In future, we must look at SID histories, and at trusted domains via winbind */
509
510 return NT_STATUS_NOT_FOUND;
511 }
512
513 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
514 "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
515 if (ret == 1) {
516 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
517 if (!*name) {
518 *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
519 if (!*name) {
520 *name = talloc_strdup(mem_ctx, sid_str);
521 NT_STATUS_HAVE_NO_MEMORY(*name);
522 }
523 }
524
525 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
526
527 *rtype = ds_atype_map(atype);
528
529 return NT_STATUS_OK;
530 }
531
532 /* need to re-add a check for an allocated sid */
533
534 return NT_STATUS_NOT_FOUND;
535 }
536
537
538 /*
539 lsa_LookupSids2
540 */
541 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
542 TALLOC_CTX *mem_ctx,
543 struct lsa_LookupSids2 *r)
544 {
545 struct lsa_policy_state *state;
546 struct lsa_RefDomainList *domains = NULL;
547 int i;
548 NTSTATUS status = NT_STATUS_OK;
549
550 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
551 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
552 return NT_STATUS_INVALID_PARAMETER;
553 }
554
555 *r->out.domains = NULL;
556
557 /* NOTE: the WSPP test suite tries SIDs with invalid revision numbers,
558 and expects NT_STATUS_INVALID_PARAMETER back - we just treat it as
559 an unknown SID. We could add a SID validator here. (tridge)
560 MS-DTYP 2.4.2
561 */
562
563 status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
564 if (!NT_STATUS_IS_OK(status)) {
565 return status;
566 }
567
568 domains = talloc_zero(r->out.domains, struct lsa_RefDomainList);
569 if (domains == NULL) {
570 return NT_STATUS_NO_MEMORY;
571 }
572 *r->out.domains = domains;
573
574 r->out.names = talloc_zero(mem_ctx, struct lsa_TransNameArray2);
575 if (r->out.names == NULL) {
576 return NT_STATUS_NO_MEMORY;
577 }
578
579 *r->out.count = 0;
580
581 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2,
582 r->in.sids->num_sids);
583 if (r->out.names->names == NULL) {
584 return NT_STATUS_NO_MEMORY;
585 }
586
587 for (i=0;i<r->in.sids->num_sids;i++) {
588 struct dom_sid *sid = r->in.sids->sids[i].sid;
589 char *sid_str = dom_sid_string(mem_ctx, sid);
590 const char *name, *authority_name;
591 enum lsa_SidType rtype;
592 uint32_t sid_index;
593 NTSTATUS status2;
594
595 r->out.names->count++;
596
597 r->out.names->names[i].sid_type = SID_NAME_UNKNOWN;
598 r->out.names->names[i].name.string = sid_str;
599 r->out.names->names[i].sid_index = 0xFFFFFFFF;
600 r->out.names->names[i].unknown = 0;
601
602 if (sid_str == NULL) {
603 r->out.names->names[i].name.string = "(SIDERROR)";
604 status = STATUS_SOME_UNMAPPED;
605 continue;
606 }
607
608 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str,
609 &authority_name, &name, &rtype);
610 if (!NT_STATUS_IS_OK(status2)) {
611 status = STATUS_SOME_UNMAPPED;
612 continue;
613 }
614
615 /* set up the authority table */
616 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype,
617 authority_name, sid,
618 domains, &sid_index);
619 if (!NT_STATUS_IS_OK(status2)) {
620 continue;
621 }
622
623 r->out.names->names[i].sid_type = rtype;
624 r->out.names->names[i].name.string = name;
625 r->out.names->names[i].sid_index = sid_index;
626 r->out.names->names[i].unknown = 0;
627
628 (*r->out.count)++;
629 }
630
631 if (*r->out.count == 0) {
632 return NT_STATUS_NONE_MAPPED;
633 }
634 if (*r->out.count != r->in.sids->num_sids) {
635 return STATUS_SOME_UNMAPPED;
636 }
637
638 return NT_STATUS_OK;
639 }
640
641
642 /*
643 lsa_LookupSids3
644
645 Identical to LookupSids2, but doesn't take a policy handle
646
647 */
648 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
649 TALLOC_CTX *mem_ctx,
650 struct lsa_LookupSids3 *r)
651 {
652 struct lsa_LookupSids2 r2;
653 struct lsa_OpenPolicy2 pol;
654 NTSTATUS status;
655 struct dcesrv_handle *h;
656
657 ZERO_STRUCT(r2);
658
659 /* No policy handle on the wire, so make one up here */
660 r2.in.handle = talloc(mem_ctx, struct policy_handle);
661 if (!r2.in.handle) {
662 return NT_STATUS_NO_MEMORY;
663 }
664
665 pol.out.handle = r2.in.handle;
666 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
667 pol.in.attr = NULL;
668 pol.in.system_name = NULL;
669 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
670 if (!NT_STATUS_IS_OK(status)) {
671 return status;
672 }
673
674 /* ensure this handle goes away at the end of this call */
675 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
676 talloc_steal(mem_ctx, h);
677
678 r2.in.sids = r->in.sids;
679 r2.in.names = r->in.names;
680 r2.in.level = r->in.level;
681 r2.in.count = r->in.count;
682 r2.in.lookup_options = r->in.lookup_options;
683 r2.in.client_revision = r->in.client_revision;
684 r2.out.count = r->out.count;
685 r2.out.names = r->out.names;
686 r2.out.domains = r->out.domains;
687
688 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
689
690 r->out.domains = r2.out.domains;
691 r->out.names = r2.out.names;
692 r->out.count = r2.out.count;
693
694 return status;
695 }
696
697
698 /*
699 lsa_LookupSids
700 */
701 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
702 struct lsa_LookupSids *r)
703 {
704 struct lsa_LookupSids2 r2;
705 NTSTATUS status;
706 int i;
707
708 ZERO_STRUCT(r2);
709
710 r2.in.handle = r->in.handle;
711 r2.in.sids = r->in.sids;
712 r2.in.names = NULL;
713 r2.in.level = r->in.level;
714 r2.in.count = r->in.count;
715 r2.in.lookup_options = 0;
716 r2.in.client_revision = 0;
717 r2.out.count = r->out.count;
718 r2.out.names = NULL;
719 r2.out.domains = r->out.domains;
720
721 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
722 /* we deliberately don't check for error from the above,
723 as even on error we are supposed to return the names */
724
725 r->out.domains = r2.out.domains;
726 if (!r2.out.names) {
727 r->out.names = NULL;
728 return status;
729 }
730
731 r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
732 if (r->out.names == NULL) {
733 return NT_STATUS_NO_MEMORY;
734 }
735 r->out.names->count = r2.out.names->count;
736 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName,
737 r->out.names->count);
738 if (r->out.names->names == NULL) {
739 return NT_STATUS_NO_MEMORY;
740 }
741 for (i=0;i<r->out.names->count;i++) {
742 r->out.names->names[i].sid_type = r2.out.names->names[i].sid_type;
743 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
744 r->out.names->names[i].sid_index = r2.out.names->names[i].sid_index;
745 }
746
747 return status;
748 }
749
750
751 /*
752 lsa_LookupNames3
753 */
754 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
755 TALLOC_CTX *mem_ctx,
756 struct lsa_LookupNames3 *r)
757 {
758 struct lsa_policy_state *policy_state;
759 struct dcesrv_handle *policy_handle;
760 int i;
761 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
762 struct lsa_RefDomainList *domains;
763
764 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
765
766 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
767 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
768 return NT_STATUS_INVALID_PARAMETER;
769 }
770
771 policy_state = policy_handle->data;
772
773 *r->out.domains = NULL;
774
775 domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
776 if (domains == NULL) {
777 return NT_STATUS_NO_MEMORY;
778 }
779 *r->out.domains = domains;
780
781 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray3);
782 if (r->out.sids == NULL) {
783 return NT_STATUS_NO_MEMORY;
784 }
785
786 *r->out.count = 0;
787
788 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3,
789 r->in.num_names);
790 if (r->out.sids->sids == NULL) {
791 return NT_STATUS_NO_MEMORY;
792 }
793
794 for (i=0;i<r->in.num_names;i++) {
795 const char *name = r->in.names[i].string;
796 const char *authority_name;
797 struct dom_sid *sid;
798 uint32_t sid_index, rid;
799 enum lsa_SidType rtype;
800 NTSTATUS status2;
801
802 r->out.sids->count++;
803
804 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
805 r->out.sids->sids[i].sid = NULL;
806 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
807 r->out.sids->sids[i].flags = 0;
808
809 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name,
810 &authority_name, &sid, &rtype, &rid);
811 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
812 continue;
813 }
814
815 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name,
816 sid, domains, &sid_index);
817 if (!NT_STATUS_IS_OK(status2)) {
818 continue;
819 }
820
821 r->out.sids->sids[i].sid_type = rtype;
822 r->out.sids->sids[i].sid = sid;
823 r->out.sids->sids[i].sid_index = sid_index;
824 r->out.sids->sids[i].flags = 0;
825
826 (*r->out.count)++;
827 }
828
829 if (*r->out.count == 0) {
830 return NT_STATUS_NONE_MAPPED;
831 }
832 if (*r->out.count != r->in.num_names) {
833 return STATUS_SOME_UNMAPPED;
834 }
835
836 return NT_STATUS_OK;
837 }
838
839 /*
840 lsa_LookupNames4
841
842 Identical to LookupNames3, but doesn't take a policy handle
843
844 */
845 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
846 struct lsa_LookupNames4 *r)
847 {
848 struct lsa_LookupNames3 r2;
849 struct lsa_OpenPolicy2 pol;
850 NTSTATUS status;
851 struct dcesrv_handle *h;
852
853 ZERO_STRUCT(r2);
854
855 /* No policy handle on the wire, so make one up here */
856 r2.in.handle = talloc(mem_ctx, struct policy_handle);
857 if (!r2.in.handle) {
858 return NT_STATUS_NO_MEMORY;
859 }
860
861 pol.out.handle = r2.in.handle;
862 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
863 pol.in.attr = NULL;
864 pol.in.system_name = NULL;
865 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
866 if (!NT_STATUS_IS_OK(status)) {
867 return status;
868 }
869
870 /* ensure this handle goes away at the end of this call */
871 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
872 talloc_steal(mem_ctx, h);
873
874 r2.in.num_names = r->in.num_names;
875 r2.in.names = r->in.names;
876 r2.in.level = r->in.level;
877 r2.in.sids = r->in.sids;
878 r2.in.count = r->in.count;
879 r2.in.lookup_options = r->in.lookup_options;
880 r2.in.client_revision = r->in.client_revision;
881 r2.out.domains = r->out.domains;
882 r2.out.sids = r->out.sids;
883 r2.out.count = r->out.count;
884
885 status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
886
887 r->out.domains = r2.out.domains;
888 r->out.sids = r2.out.sids;
889 r->out.count = r2.out.count;
890 return status;
891 }
892
893 /*
894 lsa_LookupNames2
895 */
896 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
897 TALLOC_CTX *mem_ctx,
898 struct lsa_LookupNames2 *r)
899 {
900 struct lsa_policy_state *state;
901 struct dcesrv_handle *h;
902 int i;
903 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
904 struct lsa_RefDomainList *domains;
905
906 *r->out.domains = NULL;
907
908 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
909
910 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
911 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
912 return NT_STATUS_INVALID_PARAMETER;
913 }
914
915 state = h->data;
916
917 domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
918 if (domains == NULL) {
919 return NT_STATUS_NO_MEMORY;
920 }
921 *r->out.domains = domains;
922
923 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray2);
924 if (r->out.sids == NULL) {
925 return NT_STATUS_NO_MEMORY;
926 }
927
928 *r->out.count = 0;
929
930 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2,
931 r->in.num_names);
932 if (r->out.sids->sids == NULL) {
933 return NT_STATUS_NO_MEMORY;
934 }
935
936 for (i=0;i<r->in.num_names;i++) {
937 const char *name = r->in.names[i].string;
938 const char *authority_name;
939 struct dom_sid *sid;
940 uint32_t rtype, sid_index, rid=0;
941 NTSTATUS status2;
942
943 r->out.sids->count++;
944
945 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
946 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
947 to sid NULL - so we should return 0 rid for
948 unmapped entries */
949 r->out.sids->sids[i].rid = 0;
950 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
951 r->out.sids->sids[i].unknown = 0;
952
953 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name,
954 &authority_name, &sid, &rtype, &rid);
955 if (!NT_STATUS_IS_OK(status2)) {
956 continue;
957 }
958
959 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name,
960 sid, domains, &sid_index);
961 if (!NT_STATUS_IS_OK(status2)) {
962 continue;
963 }
964
965 r->out.sids->sids[i].sid_type = rtype;
966 r->out.sids->sids[i].rid = rid;
967 r->out.sids->sids[i].sid_index = sid_index;
968 r->out.sids->sids[i].unknown = 0;
969
970 (*r->out.count)++;
971 }
972
973 if (*r->out.count == 0) {
974 return NT_STATUS_NONE_MAPPED;
975 }
976 if (*r->out.count != r->in.num_names) {
977 return STATUS_SOME_UNMAPPED;
978 }
979
980 return NT_STATUS_OK;
981 }
982
983 /*
984 lsa_LookupNames
985 */
986 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
987 struct lsa_LookupNames *r)
988 {
989 struct lsa_LookupNames2 r2;
990 NTSTATUS status;
991 int i;
992
993 ZERO_STRUCT(r2);
994
995 r2.in.handle = r->in.handle;
996 r2.in.num_names = r->in.num_names;
997 r2.in.names = r->in.names;
998 r2.in.sids = NULL;
999 r2.in.level = r->in.level;
1000 r2.in.count = r->in.count;
1001 r2.in.lookup_options = 0;
1002 r2.in.client_revision = 0;
1003 r2.out.count = r->out.count;
1004 r2.out.domains = r->out.domains;
1005
1006 status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
1007 if (r2.out.sids == NULL) {
1008 return status;
1009 }
1010
1011 r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
1012 if (r->out.sids == NULL) {
1013 return NT_STATUS_NO_MEMORY;
1014 }
1015 r->out.sids->count = r2.out.sids->count;
1016 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid,
1017 r->out.sids->count);
1018 if (r->out.sids->sids == NULL) {
1019 return NT_STATUS_NO_MEMORY;
1020 }
1021 for (i=0;i<r->out.sids->count;i++) {
1022 r->out.sids->sids[i].sid_type = r2.out.sids->sids[i].sid_type;
1023 r->out.sids->sids[i].rid = r2.out.sids->sids[i].rid;
1024 r->out.sids->sids[i].sid_index = r2.out.sids->sids[i].sid_index;
1025 }
1026
1027 return status;
1028 }
1029
Samba GIT mirror