2 Unix SMB/CIFS implementation.
4 endpoint server for the lsarpc pipe
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "rpc_server/lsa/lsa.h"
34 .rtype
= SID_NAME_WKN_GRP
,
37 .name
= "CREATOR OWNER",
38 .sid
= SID_CREATOR_OWNER
,
39 .rtype
= SID_NAME_WKN_GRP
,
42 .name
= "CREATOR GROUP",
43 .sid
= SID_CREATOR_GROUP
,
44 .rtype
= SID_NAME_WKN_GRP
,
47 .name
= "Owner Rights",
48 .sid
= SID_OWNER_RIGHTS
,
49 .rtype
= SID_NAME_WKN_GRP
,
52 .domain
= "NT AUTHORITY",
55 .rtype
= SID_NAME_WKN_GRP
,
58 .domain
= "NT AUTHORITY",
60 .sid
= SID_NT_NETWORK
,
61 .rtype
= SID_NAME_WKN_GRP
,
64 .domain
= "NT AUTHORITY",
67 .rtype
= SID_NAME_WKN_GRP
,
70 .domain
= "NT AUTHORITY",
71 .name
= "Interactive",
72 .sid
= SID_NT_INTERACTIVE
,
73 .rtype
= SID_NAME_WKN_GRP
,
76 .domain
= "NT AUTHORITY",
78 .sid
= SID_NT_SERVICE
,
79 .rtype
= SID_NAME_WKN_GRP
,
82 .domain
= "NT AUTHORITY",
83 .name
= "ANONYMOUS LOGON",
84 .sid
= SID_NT_ANONYMOUS
,
85 .rtype
= SID_NAME_WKN_GRP
,
88 .domain
= "NT AUTHORITY",
91 .rtype
= SID_NAME_WKN_GRP
,
94 .domain
= "NT AUTHORITY",
95 .name
= "ServerLogon",
96 .sid
= SID_NT_ENTERPRISE_DCS
,
97 .rtype
= SID_NAME_WKN_GRP
,
100 .domain
= "NT AUTHORITY",
103 .rtype
= SID_NAME_WKN_GRP
,
106 .domain
= "NT AUTHORITY",
107 .name
= "Authenticated Users",
108 .sid
= SID_NT_AUTHENTICATED_USERS
,
109 .rtype
= SID_NAME_WKN_GRP
,
112 .domain
= "NT AUTHORITY",
113 .name
= "Restricted",
114 .sid
= SID_NT_RESTRICTED
,
115 .rtype
= SID_NAME_WKN_GRP
,
118 .domain
= "NT AUTHORITY",
119 .name
= "Terminal Server User",
120 .sid
= SID_NT_TERMINAL_SERVER_USERS
,
121 .rtype
= SID_NAME_WKN_GRP
,
124 .domain
= "NT AUTHORITY",
125 .name
= "Remote Interactive Logon",
126 .sid
= SID_NT_REMOTE_INTERACTIVE
,
127 .rtype
= SID_NAME_WKN_GRP
,
130 .domain
= "NT AUTHORITY",
131 .name
= "This Organization",
132 .sid
= SID_NT_THIS_ORGANISATION
,
133 .rtype
= SID_NAME_WKN_GRP
,
136 .domain
= "NT AUTHORITY",
138 .sid
= SID_NT_SYSTEM
,
139 .rtype
= SID_NAME_WKN_GRP
,
142 .domain
= "NT AUTHORITY",
143 .name
= "Local Service",
144 .sid
= SID_NT_LOCAL_SERVICE
,
145 .rtype
= SID_NAME_WKN_GRP
,
148 .domain
= "NT AUTHORITY",
149 .name
= "Network Service",
150 .sid
= SID_NT_NETWORK_SERVICE
,
151 .rtype
= SID_NAME_WKN_GRP
,
154 .domain
= "NT AUTHORITY",
155 .name
= "Digest Authentication",
156 .sid
= SID_NT_DIGEST_AUTHENTICATION
,
157 .rtype
= SID_NAME_WKN_GRP
,
160 .domain
= "NT AUTHORITY",
161 .name
= "Enterprise Domain Controllers",
162 .sid
= SID_NT_ENTERPRISE_DCS
,
163 .rtype
= SID_NAME_WKN_GRP
,
166 .domain
= "NT AUTHORITY",
167 .name
= "NTLM Authentication",
168 .sid
= SID_NT_NTLM_AUTHENTICATION
,
169 .rtype
= SID_NAME_WKN_GRP
,
172 .domain
= "NT AUTHORITY",
173 .name
= "Other Organization",
174 .sid
= SID_NT_OTHER_ORGANISATION
,
175 .rtype
= SID_NAME_WKN_GRP
,
178 .domain
= "NT AUTHORITY",
179 .name
= "SChannel Authentication",
180 .sid
= SID_NT_SCHANNEL_AUTHENTICATION
,
181 .rtype
= SID_NAME_WKN_GRP
,
184 .domain
= "NT AUTHORITY",
187 .rtype
= SID_NAME_WKN_GRP
,
194 static NTSTATUS
lookup_well_known_names(TALLOC_CTX
*mem_ctx
, const char *domain
,
195 const char *name
, const char **authority_name
,
196 struct dom_sid
**sid
, uint32_t *rtype
)
199 for (i
=0; well_known
[i
].sid
; i
++) {
201 if (strcasecmp_m(domain
, well_known
[i
].domain
) == 0
202 && strcasecmp_m(name
, well_known
[i
].name
) == 0) {
203 *authority_name
= well_known
[i
].domain
;
204 *sid
= dom_sid_parse_talloc(mem_ctx
, well_known
[i
].sid
);
205 *rtype
= well_known
[i
].rtype
;
209 if (strcasecmp_m(name
, well_known
[i
].name
) == 0) {
210 *authority_name
= well_known
[i
].domain
;
211 *sid
= dom_sid_parse_talloc(mem_ctx
, well_known
[i
].sid
);
212 *rtype
= well_known
[i
].rtype
;
217 return NT_STATUS_NOT_FOUND
;
220 static NTSTATUS
lookup_well_known_sids(TALLOC_CTX
*mem_ctx
,
221 const char *sid_str
, const char **authority_name
,
222 const char **name
, uint32_t *rtype
)
225 for (i
=0; well_known
[i
].sid
; i
++) {
226 if (strcasecmp_m(sid_str
, well_known
[i
].sid
) == 0) {
227 *authority_name
= well_known
[i
].domain
;
228 *name
= well_known
[i
].name
;
229 *rtype
= well_known
[i
].rtype
;
233 return NT_STATUS_NOT_FOUND
;
237 lookup a SID for 1 name
239 static NTSTATUS
dcesrv_lsa_lookup_name(struct event_context
*ev_ctx
,
240 struct loadparm_context
*lp_ctx
,
241 struct lsa_policy_state
*state
, TALLOC_CTX
*mem_ctx
,
242 const char *name
, const char **authority_name
,
243 struct dom_sid
**sid
, enum lsa_SidType
*rtype
)
246 struct ldb_message
**res
;
247 const char * const attrs
[] = { "objectSid", "sAMAccountType", NULL
};
250 const char *username
;
251 struct ldb_dn
*domain_dn
;
252 struct dom_sid
*domain_sid
;
255 p
= strchr_m(name
, '\\');
257 domain
= talloc_strndup(mem_ctx
, name
, p
-name
);
259 return NT_STATUS_NO_MEMORY
;
262 } else if (strchr_m(name
, '@')) {
263 status
= crack_name_to_nt4_name(mem_ctx
, ev_ctx
, lp_ctx
, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL
, name
, &domain
, &username
);
264 if (!NT_STATUS_IS_OK(status
)) {
265 DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name
, nt_errstr(status
)));
274 /* Look up table of well known names */
275 status
= lookup_well_known_names(mem_ctx
, NULL
, username
, authority_name
, sid
, rtype
);
276 if (NT_STATUS_IS_OK(status
)) {
280 if (strcasecmp_m(username
, NAME_NT_AUTHORITY
) == 0) {
281 *authority_name
= NAME_NT_AUTHORITY
;
282 *sid
= dom_sid_parse_talloc(mem_ctx
, SID_NT_AUTHORITY
);
283 *rtype
= SID_NAME_DOMAIN
;
286 if (strcasecmp_m(username
, NAME_BUILTIN
) == 0) {
287 *authority_name
= NAME_BUILTIN
;
288 *sid
= dom_sid_parse_talloc(mem_ctx
, SID_BUILTIN
);
289 *rtype
= SID_NAME_DOMAIN
;
292 if (strcasecmp_m(username
, state
->domain_dns
) == 0) {
293 *authority_name
= state
->domain_name
;
294 *sid
= state
->domain_sid
;
295 *rtype
= SID_NAME_DOMAIN
;
298 if (strcasecmp_m(username
, state
->domain_name
) == 0) {
299 *authority_name
= state
->domain_name
;
300 *sid
= state
->domain_sid
;
301 *rtype
= SID_NAME_DOMAIN
;
305 /* Perhaps this is a well known user? */
306 name
= talloc_asprintf(mem_ctx
, "%s\\%s", NAME_NT_AUTHORITY
, username
);
308 return NT_STATUS_NO_MEMORY
;
310 status
= dcesrv_lsa_lookup_name(ev_ctx
, lp_ctx
, state
, mem_ctx
, name
, authority_name
, sid
, rtype
);
311 if (NT_STATUS_IS_OK(status
)) {
315 /* Perhaps this is a BUILTIN user? */
316 name
= talloc_asprintf(mem_ctx
, "%s\\%s", NAME_BUILTIN
, username
);
318 return NT_STATUS_NO_MEMORY
;
320 status
= dcesrv_lsa_lookup_name(ev_ctx
, lp_ctx
, state
, mem_ctx
, name
, authority_name
, sid
, rtype
);
321 if (NT_STATUS_IS_OK(status
)) {
325 /* OK, I give up - perhaps we need to assume the user is in our domain? */
326 name
= talloc_asprintf(mem_ctx
, "%s\\%s", state
->domain_name
, username
);
328 return NT_STATUS_NO_MEMORY
;
330 status
= dcesrv_lsa_lookup_name(ev_ctx
, lp_ctx
, state
, mem_ctx
, name
, authority_name
, sid
, rtype
);
331 if (NT_STATUS_IS_OK(status
)) {
335 return STATUS_SOME_UNMAPPED
;
336 } else if (strcasecmp_m(domain
, NAME_NT_AUTHORITY
) == 0) {
338 *authority_name
= NAME_NT_AUTHORITY
;
339 *sid
= dom_sid_parse_talloc(mem_ctx
, SID_NT_AUTHORITY
);
340 *rtype
= SID_NAME_DOMAIN
;
344 /* Look up table of well known names */
345 return lookup_well_known_names(mem_ctx
, domain
, username
, authority_name
,
347 } else if (strcasecmp_m(domain
, NAME_BUILTIN
) == 0) {
348 *authority_name
= NAME_BUILTIN
;
349 domain_dn
= state
->builtin_dn
;
350 } else if (strcasecmp_m(domain
, state
->domain_dns
) == 0) {
351 *authority_name
= state
->domain_name
;
352 domain_dn
= state
->domain_dn
;
353 } else if (strcasecmp_m(domain
, state
->domain_name
) == 0) {
354 *authority_name
= state
->domain_name
;
355 domain_dn
= state
->domain_dn
;
357 /* Not local, need to ask winbind in future */
358 return STATUS_SOME_UNMAPPED
;
361 ret
= gendb_search_dn(state
->sam_ldb
, mem_ctx
, domain_dn
, &res
, attrs
);
363 domain_sid
= samdb_result_dom_sid(mem_ctx
, res
[0], "objectSid");
364 if (domain_sid
== NULL
) {
365 return NT_STATUS_INVALID_SID
;
368 return NT_STATUS_INVALID_SID
;
373 *rtype
= SID_NAME_DOMAIN
;
377 ret
= gendb_search(state
->sam_ldb
, mem_ctx
, domain_dn
, &res
, attrs
,
378 "(&(sAMAccountName=%s)(objectSid=*))",
379 ldb_binary_encode_string(mem_ctx
, username
));
381 return NT_STATUS_INVALID_SID
;
384 for (i
=0; i
< ret
; i
++) {
385 *sid
= samdb_result_dom_sid(mem_ctx
, res
[i
], "objectSid");
387 return NT_STATUS_INVALID_SID
;
390 /* Check that this is in the domain */
391 if (!dom_sid_in_domain(domain_sid
, *sid
)) {
395 atype
= samdb_result_uint(res
[i
], "sAMAccountType", 0);
397 *rtype
= samdb_atype_map(atype
);
398 if (*rtype
== SID_NAME_UNKNOWN
) {
399 return STATUS_SOME_UNMAPPED
;
405 /* need to check for an allocated sid */
407 return NT_STATUS_INVALID_SID
;
412 add to the lsa_RefDomainList for LookupSids and LookupNames
414 static NTSTATUS
dcesrv_lsa_authority_list(struct lsa_policy_state
*state
, TALLOC_CTX
*mem_ctx
,
415 enum lsa_SidType rtype
,
416 const char *authority_name
,
418 struct lsa_RefDomainList
*domains
,
421 struct dom_sid
*authority_sid
;
424 if (rtype
!= SID_NAME_DOMAIN
) {
425 authority_sid
= dom_sid_dup(mem_ctx
, sid
);
426 if (authority_sid
== NULL
) {
427 return NT_STATUS_NO_MEMORY
;
429 authority_sid
->num_auths
--;
434 /* see if we've already done this authority name */
435 for (i
=0;i
<domains
->count
;i
++) {
436 if (strcasecmp_m(authority_name
, domains
->domains
[i
].name
.string
) == 0) {
442 domains
->domains
= talloc_realloc(domains
,
444 struct lsa_DomainInfo
,
446 if (domains
->domains
== NULL
) {
447 return NT_STATUS_NO_MEMORY
;
449 domains
->domains
[i
].name
.string
= authority_name
;
450 domains
->domains
[i
].sid
= authority_sid
;
452 domains
->max_size
= LSA_REF_DOMAIN_LIST_MULTIPLIER
* domains
->count
;
459 lookup a name for 1 SID
461 static NTSTATUS
dcesrv_lsa_lookup_sid(struct lsa_policy_state
*state
, TALLOC_CTX
*mem_ctx
,
462 struct dom_sid
*sid
, const char *sid_str
,
463 const char **authority_name
,
464 const char **name
, enum lsa_SidType
*rtype
)
469 struct ldb_message
**res
;
470 struct ldb_dn
*domain_dn
;
471 const char * const attrs
[] = { "sAMAccountName", "sAMAccountType", "cn", NULL
};
473 status
= lookup_well_known_sids(mem_ctx
, sid_str
, authority_name
, name
, rtype
);
474 if (NT_STATUS_IS_OK(status
)) {
478 if (dom_sid_in_domain(state
->domain_sid
, sid
)) {
479 *authority_name
= state
->domain_name
;
480 domain_dn
= state
->domain_dn
;
481 } else if (dom_sid_in_domain(state
->builtin_sid
, sid
)) {
482 *authority_name
= NAME_BUILTIN
;
483 domain_dn
= state
->builtin_dn
;
485 /* Not well known, our domain or built in */
487 /* In future, we must look at SID histories, and at trusted domains via winbind */
489 return NT_STATUS_NOT_FOUND
;
492 ret
= gendb_search(state
->sam_ldb
, mem_ctx
, domain_dn
, &res
, attrs
,
493 "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx
, sid
));
495 *name
= ldb_msg_find_attr_as_string(res
[0], "sAMAccountName", NULL
);
497 *name
= ldb_msg_find_attr_as_string(res
[0], "cn", NULL
);
499 *name
= talloc_strdup(mem_ctx
, sid_str
);
500 NT_STATUS_HAVE_NO_MEMORY(*name
);
504 atype
= samdb_result_uint(res
[0], "sAMAccountType", 0);
506 *rtype
= samdb_atype_map(atype
);
511 /* need to re-add a check for an allocated sid */
513 return NT_STATUS_NOT_FOUND
;
520 NTSTATUS
dcesrv_lsa_LookupSids2(struct dcesrv_call_state
*dce_call
,
522 struct lsa_LookupSids2
*r
)
524 struct lsa_policy_state
*state
;
526 NTSTATUS status
= NT_STATUS_OK
;
528 r
->out
.domains
= NULL
;
530 status
= dcesrv_lsa_get_policy_state(dce_call
, mem_ctx
, &state
);
531 if (!NT_STATUS_IS_OK(status
)) {
535 r
->out
.domains
= talloc_zero(mem_ctx
, struct lsa_RefDomainList
);
536 if (r
->out
.domains
== NULL
) {
537 return NT_STATUS_NO_MEMORY
;
540 r
->out
.names
= talloc_zero(mem_ctx
, struct lsa_TransNameArray2
);
541 if (r
->out
.names
== NULL
) {
542 return NT_STATUS_NO_MEMORY
;
547 r
->out
.names
->names
= talloc_array(r
->out
.names
, struct lsa_TranslatedName2
,
548 r
->in
.sids
->num_sids
);
549 if (r
->out
.names
->names
== NULL
) {
550 return NT_STATUS_NO_MEMORY
;
553 for (i
=0;i
<r
->in
.sids
->num_sids
;i
++) {
554 struct dom_sid
*sid
= r
->in
.sids
->sids
[i
].sid
;
555 char *sid_str
= dom_sid_string(mem_ctx
, sid
);
556 const char *name
, *authority_name
;
557 enum lsa_SidType rtype
;
561 r
->out
.names
->count
++;
563 r
->out
.names
->names
[i
].sid_type
= SID_NAME_UNKNOWN
;
564 r
->out
.names
->names
[i
].name
.string
= sid_str
;
565 r
->out
.names
->names
[i
].sid_index
= 0xFFFFFFFF;
566 r
->out
.names
->names
[i
].unknown
= 0;
568 if (sid_str
== NULL
) {
569 r
->out
.names
->names
[i
].name
.string
= "(SIDERROR)";
570 status
= STATUS_SOME_UNMAPPED
;
574 status2
= dcesrv_lsa_lookup_sid(state
, mem_ctx
, sid
, sid_str
,
575 &authority_name
, &name
, &rtype
);
576 if (!NT_STATUS_IS_OK(status2
)) {
577 status
= STATUS_SOME_UNMAPPED
;
581 /* set up the authority table */
582 status2
= dcesrv_lsa_authority_list(state
, mem_ctx
, rtype
,
584 r
->out
.domains
, &sid_index
);
585 if (!NT_STATUS_IS_OK(status2
)) {
589 r
->out
.names
->names
[i
].sid_type
= rtype
;
590 r
->out
.names
->names
[i
].name
.string
= name
;
591 r
->out
.names
->names
[i
].sid_index
= sid_index
;
592 r
->out
.names
->names
[i
].unknown
= 0;
597 if (*r
->out
.count
== 0) {
598 return NT_STATUS_NONE_MAPPED
;
600 if (*r
->out
.count
!= r
->in
.sids
->num_sids
) {
601 return STATUS_SOME_UNMAPPED
;
611 Identical to LookupSids2, but doesn't take a policy handle
614 NTSTATUS
dcesrv_lsa_LookupSids3(struct dcesrv_call_state
*dce_call
,
616 struct lsa_LookupSids3
*r
)
618 struct lsa_LookupSids2 r2
;
619 struct lsa_OpenPolicy2 pol
;
621 struct dcesrv_handle
*h
;
623 /* No policy handle on the wire, so make one up here */
624 r2
.in
.handle
= talloc(mem_ctx
, struct policy_handle
);
626 return NT_STATUS_NO_MEMORY
;
629 pol
.out
.handle
= r2
.in
.handle
;
630 pol
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
632 pol
.in
.system_name
= NULL
;
633 status
= dcesrv_lsa_OpenPolicy2(dce_call
, mem_ctx
, &pol
);
634 if (!NT_STATUS_IS_OK(status
)) {
638 /* ensure this handle goes away at the end of this call */
639 DCESRV_PULL_HANDLE(h
, r2
.in
.handle
, LSA_HANDLE_POLICY
);
640 talloc_steal(mem_ctx
, h
);
642 r2
.in
.sids
= r
->in
.sids
;
643 r2
.in
.names
= r
->in
.names
;
644 r2
.in
.level
= r
->in
.level
;
645 r2
.in
.count
= r
->in
.count
;
646 r2
.in
.unknown1
= r
->in
.unknown1
;
647 r2
.in
.unknown2
= r
->in
.unknown2
;
648 r2
.out
.count
= r
->out
.count
;
649 r2
.out
.names
= r
->out
.names
;
651 status
= dcesrv_lsa_LookupSids2(dce_call
, mem_ctx
, &r2
);
652 if (dce_call
->fault_code
!= 0) {
656 r
->out
.domains
= r2
.out
.domains
;
657 r
->out
.names
= r2
.out
.names
;
658 r
->out
.count
= r2
.out
.count
;
667 NTSTATUS
dcesrv_lsa_LookupSids(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
668 struct lsa_LookupSids
*r
)
670 struct lsa_LookupSids2 r2
;
674 r2
.in
.handle
= r
->in
.handle
;
675 r2
.in
.sids
= r
->in
.sids
;
677 r2
.in
.level
= r
->in
.level
;
678 r2
.in
.count
= r
->in
.count
;
681 r2
.out
.count
= r
->out
.count
;
684 status
= dcesrv_lsa_LookupSids2(dce_call
, mem_ctx
, &r2
);
685 if (dce_call
->fault_code
!= 0) {
689 r
->out
.domains
= r2
.out
.domains
;
695 r
->out
.names
= talloc(mem_ctx
, struct lsa_TransNameArray
);
696 if (r
->out
.names
== NULL
) {
697 return NT_STATUS_NO_MEMORY
;
699 r
->out
.names
->count
= r2
.out
.names
->count
;
700 r
->out
.names
->names
= talloc_array(r
->out
.names
, struct lsa_TranslatedName
,
701 r
->out
.names
->count
);
702 if (r
->out
.names
->names
== NULL
) {
703 return NT_STATUS_NO_MEMORY
;
705 for (i
=0;i
<r
->out
.names
->count
;i
++) {
706 r
->out
.names
->names
[i
].sid_type
= r2
.out
.names
->names
[i
].sid_type
;
707 r
->out
.names
->names
[i
].name
.string
= r2
.out
.names
->names
[i
].name
.string
;
708 r
->out
.names
->names
[i
].sid_index
= r2
.out
.names
->names
[i
].sid_index
;
718 NTSTATUS
dcesrv_lsa_LookupNames3(struct dcesrv_call_state
*dce_call
,
720 struct lsa_LookupNames3
*r
)
722 struct lsa_policy_state
*policy_state
;
723 struct dcesrv_handle
*policy_handle
;
725 struct loadparm_context
*lp_ctx
= dce_call
->conn
->dce_ctx
->lp_ctx
;
727 DCESRV_PULL_HANDLE(policy_handle
, r
->in
.handle
, LSA_HANDLE_POLICY
);
729 policy_state
= policy_handle
->data
;
731 r
->out
.domains
= NULL
;
733 r
->out
.domains
= talloc_zero(mem_ctx
, struct lsa_RefDomainList
);
734 if (r
->out
.domains
== NULL
) {
735 return NT_STATUS_NO_MEMORY
;
738 r
->out
.sids
= talloc_zero(mem_ctx
, struct lsa_TransSidArray3
);
739 if (r
->out
.sids
== NULL
) {
740 return NT_STATUS_NO_MEMORY
;
745 r
->out
.sids
->sids
= talloc_array(r
->out
.sids
, struct lsa_TranslatedSid3
,
747 if (r
->out
.sids
->sids
== NULL
) {
748 return NT_STATUS_NO_MEMORY
;
751 for (i
=0;i
<r
->in
.num_names
;i
++) {
752 const char *name
= r
->in
.names
[i
].string
;
753 const char *authority_name
;
756 enum lsa_SidType rtype
;
759 r
->out
.sids
->count
++;
761 r
->out
.sids
->sids
[i
].sid_type
= SID_NAME_UNKNOWN
;
762 r
->out
.sids
->sids
[i
].sid
= NULL
;
763 r
->out
.sids
->sids
[i
].sid_index
= 0xFFFFFFFF;
764 r
->out
.sids
->sids
[i
].unknown
= 0;
766 status2
= dcesrv_lsa_lookup_name(dce_call
->event_ctx
, lp_ctx
, policy_state
, mem_ctx
, name
, &authority_name
, &sid
, &rtype
);
767 if (!NT_STATUS_IS_OK(status2
) || sid
->num_auths
== 0) {
771 status2
= dcesrv_lsa_authority_list(policy_state
, mem_ctx
, rtype
, authority_name
,
772 sid
, r
->out
.domains
, &sid_index
);
773 if (!NT_STATUS_IS_OK(status2
)) {
777 r
->out
.sids
->sids
[i
].sid_type
= rtype
;
778 r
->out
.sids
->sids
[i
].sid
= sid
;
779 r
->out
.sids
->sids
[i
].sid_index
= sid_index
;
780 r
->out
.sids
->sids
[i
].unknown
= 0;
785 if (*r
->out
.count
== 0) {
786 return NT_STATUS_NONE_MAPPED
;
788 if (*r
->out
.count
!= r
->in
.num_names
) {
789 return STATUS_SOME_UNMAPPED
;
798 Identical to LookupNames3, but doesn't take a policy handle
801 NTSTATUS
dcesrv_lsa_LookupNames4(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
802 struct lsa_LookupNames4
*r
)
804 struct lsa_LookupNames3 r2
;
805 struct lsa_OpenPolicy2 pol
;
807 struct dcesrv_handle
*h
;
809 /* No policy handle on the wire, so make one up here */
810 r2
.in
.handle
= talloc(mem_ctx
, struct policy_handle
);
812 return NT_STATUS_NO_MEMORY
;
815 pol
.out
.handle
= r2
.in
.handle
;
816 pol
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
818 pol
.in
.system_name
= NULL
;
819 status
= dcesrv_lsa_OpenPolicy2(dce_call
, mem_ctx
, &pol
);
820 if (!NT_STATUS_IS_OK(status
)) {
824 /* ensure this handle goes away at the end of this call */
825 DCESRV_PULL_HANDLE(h
, r2
.in
.handle
, LSA_HANDLE_POLICY
);
826 talloc_steal(mem_ctx
, h
);
828 r2
.in
.num_names
= r
->in
.num_names
;
829 r2
.in
.names
= r
->in
.names
;
830 r2
.in
.sids
= r
->in
.sids
;
831 r2
.in
.count
= r
->in
.count
;
832 r2
.in
.unknown1
= r
->in
.unknown1
;
833 r2
.in
.unknown2
= r
->in
.unknown2
;
834 r2
.out
.domains
= r
->out
.domains
;
835 r2
.out
.sids
= r
->out
.sids
;
836 r2
.out
.count
= r
->out
.count
;
838 status
= dcesrv_lsa_LookupNames3(dce_call
, mem_ctx
, &r2
);
839 if (dce_call
->fault_code
!= 0) {
843 r
->out
.domains
= r2
.out
.domains
;
844 r
->out
.sids
= r2
.out
.sids
;
845 r
->out
.count
= r2
.out
.count
;
852 NTSTATUS
dcesrv_lsa_LookupNames2(struct dcesrv_call_state
*dce_call
,
854 struct lsa_LookupNames2
*r
)
856 struct lsa_policy_state
*state
;
857 struct dcesrv_handle
*h
;
859 struct loadparm_context
*lp_ctx
= dce_call
->conn
->dce_ctx
->lp_ctx
;
861 r
->out
.domains
= NULL
;
863 DCESRV_PULL_HANDLE(h
, r
->in
.handle
, LSA_HANDLE_POLICY
);
867 r
->out
.domains
= talloc_zero(mem_ctx
, struct lsa_RefDomainList
);
868 if (r
->out
.domains
== NULL
) {
869 return NT_STATUS_NO_MEMORY
;
872 r
->out
.sids
= talloc_zero(mem_ctx
, struct lsa_TransSidArray2
);
873 if (r
->out
.sids
== NULL
) {
874 return NT_STATUS_NO_MEMORY
;
879 r
->out
.sids
->sids
= talloc_array(r
->out
.sids
, struct lsa_TranslatedSid2
,
881 if (r
->out
.sids
->sids
== NULL
) {
882 return NT_STATUS_NO_MEMORY
;
885 for (i
=0;i
<r
->in
.num_names
;i
++) {
886 const char *name
= r
->in
.names
[i
].string
;
887 const char *authority_name
;
889 uint32_t rtype
, sid_index
;
892 r
->out
.sids
->count
++;
894 r
->out
.sids
->sids
[i
].sid_type
= SID_NAME_UNKNOWN
;
895 r
->out
.sids
->sids
[i
].rid
= 0xFFFFFFFF;
896 r
->out
.sids
->sids
[i
].sid_index
= 0xFFFFFFFF;
897 r
->out
.sids
->sids
[i
].unknown
= 0;
899 status2
= dcesrv_lsa_lookup_name(dce_call
->event_ctx
, lp_ctx
, state
, mem_ctx
, name
,
900 &authority_name
, &sid
, &rtype
);
901 if (!NT_STATUS_IS_OK(status2
)) {
905 status2
= dcesrv_lsa_authority_list(state
, mem_ctx
, rtype
, authority_name
,
906 sid
, r
->out
.domains
, &sid_index
);
907 if (!NT_STATUS_IS_OK(status2
)) {
911 r
->out
.sids
->sids
[i
].sid_type
= rtype
;
912 r
->out
.sids
->sids
[i
].rid
= sid
->sub_auths
[sid
->num_auths
-1];
913 r
->out
.sids
->sids
[i
].sid_index
= sid_index
;
914 r
->out
.sids
->sids
[i
].unknown
= 0;
919 if (*r
->out
.count
== 0) {
920 return NT_STATUS_NONE_MAPPED
;
922 if (*r
->out
.count
!= r
->in
.num_names
) {
923 return STATUS_SOME_UNMAPPED
;
932 NTSTATUS
dcesrv_lsa_LookupNames(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
933 struct lsa_LookupNames
*r
)
935 struct lsa_LookupNames2 r2
;
939 r2
.in
.handle
= r
->in
.handle
;
940 r2
.in
.num_names
= r
->in
.num_names
;
941 r2
.in
.names
= r
->in
.names
;
943 r2
.in
.level
= r
->in
.level
;
944 r2
.in
.count
= r
->in
.count
;
947 r2
.out
.count
= r
->out
.count
;
949 status
= dcesrv_lsa_LookupNames2(dce_call
, mem_ctx
, &r2
);
950 if (dce_call
->fault_code
!= 0) {
954 r
->out
.domains
= r2
.out
.domains
;
955 r
->out
.sids
= talloc(mem_ctx
, struct lsa_TransSidArray
);
956 if (r
->out
.sids
== NULL
) {
957 return NT_STATUS_NO_MEMORY
;
959 r
->out
.sids
->count
= r2
.out
.sids
->count
;
960 r
->out
.sids
->sids
= talloc_array(r
->out
.sids
, struct lsa_TranslatedSid
,
962 if (r
->out
.sids
->sids
== NULL
) {
963 return NT_STATUS_NO_MEMORY
;
965 for (i
=0;i
<r
->out
.sids
->count
;i
++) {
966 r
->out
.sids
->sids
[i
].sid_type
= r2
.out
.sids
->sids
[i
].sid_type
;
967 r
->out
.sids
->sids
[i
].rid
= r2
.out
.sids
->sids
[i
].rid
;
968 r
->out
.sids
->sids
[i
].sid_index
= r2
.out
.sids
->sids
[i
].sid_index
;