?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:lsa RPC - Change some counters to be "unsigned" where needed
[Samba/ekacnet.git] / source4 / rpc_server / lsa / dcesrv_lsa.c
blob937ae70a33bd7b4406df35631b1330595972410f
1 /* need access mask/acl implementation */
2
3 /*
4 Unix SMB/CIFS implementation.
5
6 endpoint server for the lsarpc pipe
7
8 Copyright (C) Andrew Tridgell 2004
9 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2008
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "rpc_server/lsa/lsa.h"
26 #include "system/kerberos.h"
27 #include "auth/kerberos/kerberos.h"
28 #include "librpc/gen_ndr/ndr_drsblobs.h"
29 #include "librpc/gen_ndr/ndr_lsa.h"
30 #include "../lib/crypto/crypto.h"
31 #include "lib/util/tsort.h"
32
33 /*
34 this type allows us to distinguish handle types
35 */
36
37 /*
38 state associated with a lsa_OpenAccount() operation
39 */
40 struct lsa_account_state {
41 struct lsa_policy_state *policy;
42 uint32_t access_mask;
43 struct dom_sid *account_sid;
44 };
45
46
47 /*
48 state associated with a lsa_OpenSecret() operation
49 */
50 struct lsa_secret_state {
51 struct lsa_policy_state *policy;
52 uint32_t access_mask;
53 struct ldb_dn *secret_dn;
54 struct ldb_context *sam_ldb;
55 bool global;
56 };
57
58 /*
59 state associated with a lsa_OpenTrustedDomain() operation
60 */
61 struct lsa_trusted_domain_state {
62 struct lsa_policy_state *policy;
63 uint32_t access_mask;
64 struct ldb_dn *trusted_domain_dn;
65 struct ldb_dn *trusted_domain_user_dn;
66 };
67
68 /*
69 this is based on the samba3 function make_lsa_object_sd()
70 It uses the same logic, but with samba4 helper functions
71 */
72 static NTSTATUS dcesrv_build_lsa_sd(TALLOC_CTX *mem_ctx,
73 struct security_descriptor **sd,
74 struct dom_sid *sid,
75 uint32_t sid_access)
76 {
77 NTSTATUS status;
78 uint32_t rid;
79 struct dom_sid *domain_sid, *domain_admins_sid;
80 const char *domain_admins_sid_str, *sidstr;
81 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
82
83 status = dom_sid_split_rid(tmp_ctx, sid, &domain_sid, &rid);
84 NT_STATUS_NOT_OK_RETURN_AND_FREE(status, tmp_ctx);
85
86 domain_admins_sid = dom_sid_add_rid(tmp_ctx, domain_sid, DOMAIN_RID_ADMINS);
87 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(domain_admins_sid, tmp_ctx);
88
89 domain_admins_sid_str = dom_sid_string(tmp_ctx, domain_admins_sid);
90 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(domain_admins_sid_str, tmp_ctx);
91
92 sidstr = dom_sid_string(tmp_ctx, sid);
93 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sidstr, tmp_ctx);
94
95 *sd = security_descriptor_dacl_create(mem_ctx,
96 0, sidstr, NULL,
97
98 SID_WORLD,
99 SEC_ACE_TYPE_ACCESS_ALLOWED,
100 SEC_GENERIC_EXECUTE | SEC_GENERIC_READ, 0,
101
102 SID_BUILTIN_ADMINISTRATORS,
103 SEC_ACE_TYPE_ACCESS_ALLOWED,
104 SEC_GENERIC_ALL, 0,
105
106 SID_BUILTIN_ACCOUNT_OPERATORS,
107 SEC_ACE_TYPE_ACCESS_ALLOWED,
108 SEC_GENERIC_ALL, 0,
109
110 domain_admins_sid_str,
111 SEC_ACE_TYPE_ACCESS_ALLOWED,
112 SEC_GENERIC_ALL, 0,
113
114 sidstr,
115 SEC_ACE_TYPE_ACCESS_ALLOWED,
116 sid_access, 0,
117
118 NULL);
119 talloc_free(tmp_ctx);
120
121 NT_STATUS_HAVE_NO_MEMORY(*sd);
122
123 return NT_STATUS_OK;
124 }
125
126
127 static NTSTATUS dcesrv_lsa_EnumAccountRights(struct dcesrv_call_state *dce_call,
128 TALLOC_CTX *mem_ctx,
129 struct lsa_EnumAccountRights *r);
130
131 static NTSTATUS dcesrv_lsa_AddRemoveAccountRights(struct dcesrv_call_state *dce_call,
132 TALLOC_CTX *mem_ctx,
133 struct lsa_policy_state *state,
134 int ldb_flag,
135 struct dom_sid *sid,
136 const struct lsa_RightSet *rights);
137
138 /*
139 lsa_Close
140 */
141 static NTSTATUS dcesrv_lsa_Close(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
142 struct lsa_Close *r)
143 {
144 struct dcesrv_handle *h;
145
146 *r->out.handle = *r->in.handle;
147
148 DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
149
150 talloc_free(h);
151
152 ZERO_STRUCTP(r->out.handle);
153
154 return NT_STATUS_OK;
155 }
156
157
158 /*
159 lsa_Delete
160 */
161 static NTSTATUS dcesrv_lsa_Delete(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
162 struct lsa_Delete *r)
163 {
164 return NT_STATUS_NOT_SUPPORTED;
165 }
166
167
168 /*
169 lsa_DeleteObject
170 */
171 static NTSTATUS dcesrv_lsa_DeleteObject(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
172 struct lsa_DeleteObject *r)
173 {
174 struct dcesrv_handle *h;
175 int ret;
176
177 DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
178
179 if (h->wire_handle.handle_type == LSA_HANDLE_SECRET) {
180 struct lsa_secret_state *secret_state = h->data;
181
182 /* Ensure user is permitted to delete this... */
183 switch (security_session_user_level(dce_call->conn->auth_state.session_info))
184 {
185 case SECURITY_SYSTEM:
186 case SECURITY_ADMINISTRATOR:
187 break;
188 default:
189 /* Users and annonymous are not allowed delete things */
190 return NT_STATUS_ACCESS_DENIED;
191 }
192
193 ret = ldb_delete(secret_state->sam_ldb,
194 secret_state->secret_dn);
195 talloc_free(h);
196 if (ret != LDB_SUCCESS) {
197 return NT_STATUS_INVALID_HANDLE;
198 }
199
200 ZERO_STRUCTP(r->out.handle);
201
202 return NT_STATUS_OK;
203 } else if (h->wire_handle.handle_type == LSA_HANDLE_TRUSTED_DOMAIN) {
204 struct lsa_trusted_domain_state *trusted_domain_state =
205 talloc_get_type(h->data, struct lsa_trusted_domain_state);
206 ret = ldb_transaction_start(trusted_domain_state->policy->sam_ldb);
207 if (ret != LDB_SUCCESS) {
208 return NT_STATUS_INTERNAL_DB_CORRUPTION;
209 }
210
211 ret = ldb_delete(trusted_domain_state->policy->sam_ldb,
212 trusted_domain_state->trusted_domain_dn);
213 if (ret != LDB_SUCCESS) {
214 ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
215 return NT_STATUS_INVALID_HANDLE;
216 }
217
218 if (trusted_domain_state->trusted_domain_user_dn) {
219 ret = ldb_delete(trusted_domain_state->policy->sam_ldb,
220 trusted_domain_state->trusted_domain_user_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_transaction_cancel(trusted_domain_state->policy->sam_ldb);
223 return NT_STATUS_INVALID_HANDLE;
224 }
225 }
226
227 ret = ldb_transaction_commit(trusted_domain_state->policy->sam_ldb);
228 if (ret != LDB_SUCCESS) {
229 return NT_STATUS_INTERNAL_DB_CORRUPTION;
230 }
231 talloc_free(h);
232 ZERO_STRUCTP(r->out.handle);
233
234 return NT_STATUS_OK;
235 } else if (h->wire_handle.handle_type == LSA_HANDLE_ACCOUNT) {
236 struct lsa_RightSet *rights;
237 struct lsa_account_state *astate;
238 struct lsa_EnumAccountRights r2;
239 NTSTATUS status;
240
241 rights = talloc(mem_ctx, struct lsa_RightSet);
242
243 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
244
245 astate = h->data;
246
247 r2.in.handle = &astate->policy->handle->wire_handle;
248 r2.in.sid = astate->account_sid;
249 r2.out.rights = rights;
250
251 /* dcesrv_lsa_EnumAccountRights takes a LSA_HANDLE_POLICY,
252 but we have a LSA_HANDLE_ACCOUNT here, so this call
253 will always fail */
254 status = dcesrv_lsa_EnumAccountRights(dce_call, mem_ctx, &r2);
255 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
256 return NT_STATUS_OK;
257 }
258
259 if (!NT_STATUS_IS_OK(status)) {
260 return status;
261 }
262
263 status = dcesrv_lsa_AddRemoveAccountRights(dce_call, mem_ctx, astate->policy,
264 LDB_FLAG_MOD_DELETE, astate->account_sid,
265 r2.out.rights);
266 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
267 return NT_STATUS_OK;
268 }
269
270 if (!NT_STATUS_IS_OK(status)) {
271 return status;
272 }
273
274 ZERO_STRUCTP(r->out.handle);
275 }
276
277 return NT_STATUS_INVALID_HANDLE;
278 }
279
280
281 /*
282 lsa_EnumPrivs
283 */
284 static NTSTATUS dcesrv_lsa_EnumPrivs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
285 struct lsa_EnumPrivs *r)
286 {
287 struct dcesrv_handle *h;
288 struct lsa_policy_state *state;
289 uint32_t i;
290 const char *privname;
291
292 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
293
294 state = h->data;
295
296 i = *r->in.resume_handle;
297 if (i == 0) i = 1;
298
299 while ((privname = sec_privilege_name(i)) &&
300 r->out.privs->count < r->in.max_count) {
301 struct lsa_PrivEntry *e;
302
303 r->out.privs->privs = talloc_realloc(r->out.privs,
304 r->out.privs->privs,
305 struct lsa_PrivEntry,
306 r->out.privs->count+1);
307 if (r->out.privs->privs == NULL) {
308 return NT_STATUS_NO_MEMORY;
309 }
310 e = &r->out.privs->privs[r->out.privs->count];
311 e->luid.low = i;
312 e->luid.high = 0;
313 e->name.string = privname;
314 r->out.privs->count++;
315 i++;
316 }
317
318 *r->out.resume_handle = i;
319
320 return NT_STATUS_OK;
321 }
322
323
324 /*
325 lsa_QuerySecObj
326 */
327 static NTSTATUS dcesrv_lsa_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
328 struct lsa_QuerySecurity *r)
329 {
330 struct dcesrv_handle *h;
331 struct security_descriptor *sd;
332 NTSTATUS status;
333 struct dom_sid *sid;
334
335 DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
336
337 sid = dce_call->conn->auth_state.session_info->security_token->user_sid;
338
339 if (h->wire_handle.handle_type == LSA_HANDLE_POLICY) {
340 status = dcesrv_build_lsa_sd(mem_ctx, &sd, sid, 0);
341 } else if (h->wire_handle.handle_type == LSA_HANDLE_ACCOUNT) {
342 status = dcesrv_build_lsa_sd(mem_ctx, &sd, sid,
343 LSA_ACCOUNT_ALL_ACCESS);
344 } else {
345 return NT_STATUS_INVALID_HANDLE;
346 }
347 NT_STATUS_NOT_OK_RETURN(status);
348
349 (*r->out.sdbuf) = talloc(mem_ctx, struct sec_desc_buf);
350 NT_STATUS_HAVE_NO_MEMORY(*r->out.sdbuf);
351
352 (*r->out.sdbuf)->sd = sd;
353
354 return NT_STATUS_OK;
355 }
356
357
358 /*
359 lsa_SetSecObj
360 */
361 static NTSTATUS dcesrv_lsa_SetSecObj(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
362 struct lsa_SetSecObj *r)
363 {
364 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
365 }
366
367
368 /*
369 lsa_ChangePassword
370 */
371 static NTSTATUS dcesrv_lsa_ChangePassword(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
372 struct lsa_ChangePassword *r)
373 {
374 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
375 }
376
377 /*
378 dssetup_DsRoleGetPrimaryDomainInformation
379
380 This is not an LSA call, but is the only call left on the DSSETUP
381 pipe (after the pipe was truncated), and needs lsa_get_policy_state
382 */
383 static WERROR dcesrv_dssetup_DsRoleGetPrimaryDomainInformation(struct dcesrv_call_state *dce_call,
384 TALLOC_CTX *mem_ctx,
385 struct dssetup_DsRoleGetPrimaryDomainInformation *r)
386 {
387 union dssetup_DsRoleInfo *info;
388
389 info = talloc(mem_ctx, union dssetup_DsRoleInfo);
390 W_ERROR_HAVE_NO_MEMORY(info);
391
392 switch (r->in.level) {
393 case DS_ROLE_BASIC_INFORMATION:
394 {
395 enum dssetup_DsRole role = DS_ROLE_STANDALONE_SERVER;
396 uint32_t flags = 0;
397 const char *domain = NULL;
398 const char *dns_domain = NULL;
399 const char *forest = NULL;
400 struct GUID domain_guid;
401 struct lsa_policy_state *state;
402
403 NTSTATUS status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
404 if (!NT_STATUS_IS_OK(status)) {
405 return ntstatus_to_werror(status);
406 }
407
408 ZERO_STRUCT(domain_guid);
409
410 switch (lp_server_role(dce_call->conn->dce_ctx->lp_ctx)) {
411 case ROLE_STANDALONE:
412 role = DS_ROLE_STANDALONE_SERVER;
413 break;
414 case ROLE_DOMAIN_MEMBER:
415 role = DS_ROLE_MEMBER_SERVER;
416 break;
417 case ROLE_DOMAIN_CONTROLLER:
418 if (samdb_is_pdc(state->sam_ldb)) {
419 role = DS_ROLE_PRIMARY_DC;
420 } else {
421 role = DS_ROLE_BACKUP_DC;
422 }
423 break;
424 }
425
426 switch (lp_server_role(dce_call->conn->dce_ctx->lp_ctx)) {
427 case ROLE_STANDALONE:
428 domain = talloc_strdup(mem_ctx, lp_workgroup(dce_call->conn->dce_ctx->lp_ctx));
429 W_ERROR_HAVE_NO_MEMORY(domain);
430 break;
431 case ROLE_DOMAIN_MEMBER:
432 domain = talloc_strdup(mem_ctx, lp_workgroup(dce_call->conn->dce_ctx->lp_ctx));
433 W_ERROR_HAVE_NO_MEMORY(domain);
434 /* TODO: what is with dns_domain and forest and guid? */
435 break;
436 case ROLE_DOMAIN_CONTROLLER:
437 flags = DS_ROLE_PRIMARY_DS_RUNNING;
438
439 if (state->mixed_domain == 1) {
440 flags |= DS_ROLE_PRIMARY_DS_MIXED_MODE;
441 }
442
443 domain = state->domain_name;
444 dns_domain = state->domain_dns;
445 forest = state->forest_dns;
446
447 domain_guid = state->domain_guid;
448 flags |= DS_ROLE_PRIMARY_DOMAIN_GUID_PRESENT;
449 break;
450 }
451
452 info->basic.role = role;
453 info->basic.flags = flags;
454 info->basic.domain = domain;
455 info->basic.dns_domain = dns_domain;
456 info->basic.forest = forest;
457 info->basic.domain_guid = domain_guid;
458
459 r->out.info = info;
460 return WERR_OK;
461 }
462 case DS_ROLE_UPGRADE_STATUS:
463 {
464 info->upgrade.upgrading = DS_ROLE_NOT_UPGRADING;
465 info->upgrade.previous_role = DS_ROLE_PREVIOUS_UNKNOWN;
466
467 r->out.info = info;
468 return WERR_OK;
469 }
470 case DS_ROLE_OP_STATUS:
471 {
472 info->opstatus.status = DS_ROLE_OP_IDLE;
473
474 r->out.info = info;
475 return WERR_OK;
476 }
477 default:
478 return WERR_INVALID_PARAM;
479 }
480
481 return WERR_INVALID_PARAM;
482 }
483
484 /*
485 fill in the AccountDomain info
486 */
487 static NTSTATUS dcesrv_lsa_info_AccountDomain(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
488 struct lsa_DomainInfo *info)
489 {
490 info->name.string = state->domain_name;
491 info->sid = state->domain_sid;
492
493 return NT_STATUS_OK;
494 }
495
496 /*
497 fill in the DNS domain info
498 */
499 static NTSTATUS dcesrv_lsa_info_DNS(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
500 struct lsa_DnsDomainInfo *info)
501 {
502 info->name.string = state->domain_name;
503 info->sid = state->domain_sid;
504 info->dns_domain.string = state->domain_dns;
505 info->dns_forest.string = state->forest_dns;
506 info->domain_guid = state->domain_guid;
507
508 return NT_STATUS_OK;
509 }
510
511 /*
512 lsa_QueryInfoPolicy2
513 */
514 static NTSTATUS dcesrv_lsa_QueryInfoPolicy2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
515 struct lsa_QueryInfoPolicy2 *r)
516 {
517 struct lsa_policy_state *state;
518 struct dcesrv_handle *h;
519 union lsa_PolicyInformation *info;
520
521 *r->out.info = NULL;
522
523 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
524
525 state = h->data;
526
527 info = talloc_zero(mem_ctx, union lsa_PolicyInformation);
528 if (!info) {
529 return NT_STATUS_NO_MEMORY;
530 }
531 *r->out.info = info;
532
533 switch (r->in.level) {
534 case LSA_POLICY_INFO_AUDIT_LOG:
535 /* we don't need to fill in any of this */
536 ZERO_STRUCT(info->audit_log);
537 return NT_STATUS_OK;
538 case LSA_POLICY_INFO_AUDIT_EVENTS:
539 /* we don't need to fill in any of this */
540 ZERO_STRUCT(info->audit_events);
541 return NT_STATUS_OK;
542 case LSA_POLICY_INFO_PD:
543 /* we don't need to fill in any of this */
544 ZERO_STRUCT(info->pd);
545 return NT_STATUS_OK;
546
547 case LSA_POLICY_INFO_DOMAIN:
548 return dcesrv_lsa_info_AccountDomain(state, mem_ctx, &info->domain);
549 case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
550 return dcesrv_lsa_info_AccountDomain(state, mem_ctx, &info->account_domain);
551 case LSA_POLICY_INFO_L_ACCOUNT_DOMAIN:
552 return dcesrv_lsa_info_AccountDomain(state, mem_ctx, &info->l_account_domain);
553
554 case LSA_POLICY_INFO_ROLE:
555 info->role.role = LSA_ROLE_PRIMARY;
556 return NT_STATUS_OK;
557
558 case LSA_POLICY_INFO_DNS:
559 case LSA_POLICY_INFO_DNS_INT:
560 return dcesrv_lsa_info_DNS(state, mem_ctx, &info->dns);
561
562 case LSA_POLICY_INFO_REPLICA:
563 ZERO_STRUCT(info->replica);
564 return NT_STATUS_OK;
565
566 case LSA_POLICY_INFO_QUOTA:
567 ZERO_STRUCT(info->quota);
568 return NT_STATUS_OK;
569
570 case LSA_POLICY_INFO_MOD:
571 case LSA_POLICY_INFO_AUDIT_FULL_SET:
572 case LSA_POLICY_INFO_AUDIT_FULL_QUERY:
573 /* windows gives INVALID_PARAMETER */
574 *r->out.info = NULL;
575 return NT_STATUS_INVALID_PARAMETER;
576 }
577
578 *r->out.info = NULL;
579 return NT_STATUS_INVALID_INFO_CLASS;
580 }
581
582 /*
583 lsa_QueryInfoPolicy
584 */
585 static NTSTATUS dcesrv_lsa_QueryInfoPolicy(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
586 struct lsa_QueryInfoPolicy *r)
587 {
588 struct lsa_QueryInfoPolicy2 r2;
589 NTSTATUS status;
590
591 ZERO_STRUCT(r2);
592
593 r2.in.handle = r->in.handle;
594 r2.in.level = r->in.level;
595 r2.out.info = r->out.info;
596
597 status = dcesrv_lsa_QueryInfoPolicy2(dce_call, mem_ctx, &r2);
598
599 return status;
600 }
601
602 /*
603 lsa_SetInfoPolicy
604 */
605 static NTSTATUS dcesrv_lsa_SetInfoPolicy(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
606 struct lsa_SetInfoPolicy *r)
607 {
608 /* need to support this */
609 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
610 }
611
612
613 /*
614 lsa_ClearAuditLog
615 */
616 static NTSTATUS dcesrv_lsa_ClearAuditLog(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
617 struct lsa_ClearAuditLog *r)
618 {
619 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
620 }
621
622
623 /*
624 lsa_CreateAccount
625
626 This call does not seem to have any long-term effects, hence no database operations
627
628 we need to talk to the MS product group to find out what this account database means!
629
630 answer is that the lsa database is totally separate from the SAM and
631 ldap databases. We are going to need a separate ldb to store these
632 accounts. The SIDs on this account bear no relation to the SIDs in
633 AD
634 */
635 static NTSTATUS dcesrv_lsa_CreateAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
636 struct lsa_CreateAccount *r)
637 {
638 struct lsa_account_state *astate;
639
640 struct lsa_policy_state *state;
641 struct dcesrv_handle *h, *ah;
642
643 ZERO_STRUCTP(r->out.acct_handle);
644
645 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
646
647 state = h->data;
648
649 astate = talloc(dce_call->conn, struct lsa_account_state);
650 if (astate == NULL) {
651 return NT_STATUS_NO_MEMORY;
652 }
653
654 astate->account_sid = dom_sid_dup(astate, r->in.sid);
655 if (astate->account_sid == NULL) {
656 talloc_free(astate);
657 return NT_STATUS_NO_MEMORY;
658 }
659
660 astate->policy = talloc_reference(astate, state);
661 astate->access_mask = r->in.access_mask;
662
663 ah = dcesrv_handle_new(dce_call->context, LSA_HANDLE_ACCOUNT);
664 if (!ah) {
665 talloc_free(astate);
666 return NT_STATUS_NO_MEMORY;
667 }
668
669 ah->data = talloc_steal(ah, astate);
670
671 *r->out.acct_handle = ah->wire_handle;
672
673 return NT_STATUS_OK;
674 }
675
676
677 /*
678 lsa_EnumAccounts
679 */
680 static NTSTATUS dcesrv_lsa_EnumAccounts(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
681 struct lsa_EnumAccounts *r)
682 {
683 struct dcesrv_handle *h;
684 struct lsa_policy_state *state;
685 int ret;
686 struct ldb_message **res;
687 const char * const attrs[] = { "objectSid", NULL};
688 uint32_t count, i;
689
690 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
691
692 state = h->data;
693
694 /* NOTE: This call must only return accounts that have at least
695 one privilege set
696 */
697 ret = gendb_search(state->pdb, mem_ctx, NULL, &res, attrs,
698 "(&(objectSid=*)(privilege=*))");
699 if (ret < 0) {
700 return NT_STATUS_NO_SUCH_USER;
701 }
702
703 if (*r->in.resume_handle >= ret) {
704 return NT_STATUS_NO_MORE_ENTRIES;
705 }
706
707 count = ret - *r->in.resume_handle;
708 if (count > r->in.num_entries) {
709 count = r->in.num_entries;
710 }
711
712 if (count == 0) {
713 return NT_STATUS_NO_MORE_ENTRIES;
714 }
715
716 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_SidPtr, count);
717 if (r->out.sids->sids == NULL) {
718 return NT_STATUS_NO_MEMORY;
719 }
720
721 for (i=0;i<count;i++) {
722 r->out.sids->sids[i].sid =
723 samdb_result_dom_sid(r->out.sids->sids,
724 res[i + *r->in.resume_handle],
725 "objectSid");
726 NT_STATUS_HAVE_NO_MEMORY(r->out.sids->sids[i].sid);
727 }
728
729 r->out.sids->num_sids = count;
730 *r->out.resume_handle = count + *r->in.resume_handle;
731
732 return NT_STATUS_OK;
733
734 }
735
736
737 /*
738 lsa_CreateTrustedDomainEx2
739 */
740 static NTSTATUS dcesrv_lsa_CreateTrustedDomain_base(struct dcesrv_call_state *dce_call,
741 TALLOC_CTX *mem_ctx,
742 struct lsa_CreateTrustedDomainEx2 *r,
743 int op)
744 {
745 struct dcesrv_handle *policy_handle;
746 struct lsa_policy_state *policy_state;
747 struct lsa_trusted_domain_state *trusted_domain_state;
748 struct dcesrv_handle *handle;
749 struct ldb_message **msgs, *msg, *msg_user;
750 const char *attrs[] = {
751 NULL
752 };
753 const char *netbios_name;
754 const char *dns_name;
755 const char *name;
756 DATA_BLOB session_key = data_blob(NULL, 0);
757 DATA_BLOB trustAuthIncoming, trustAuthOutgoing, auth_blob;
758 struct trustDomainPasswords auth_struct;
759 int ret;
760 NTSTATUS nt_status;
761 enum ndr_err_code ndr_err;
762 struct ldb_context *sam_ldb;
763
764 DCESRV_PULL_HANDLE(policy_handle, r->in.policy_handle, LSA_HANDLE_POLICY);
765 ZERO_STRUCTP(r->out.trustdom_handle);
766
767 policy_state = policy_handle->data;
768 sam_ldb = policy_state->sam_ldb;
769
770 nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
771 if (!NT_STATUS_IS_OK(nt_status)) {
772 return nt_status;
773 }
774
775 netbios_name = r->in.info->netbios_name.string;
776 if (!netbios_name) {
777 return NT_STATUS_INVALID_PARAMETER;
778 }
779
780 dns_name = r->in.info->domain_name.string;
781
782 trusted_domain_state = talloc_zero(mem_ctx, struct lsa_trusted_domain_state);
783 if (!trusted_domain_state) {
784 return NT_STATUS_NO_MEMORY;
785 }
786 trusted_domain_state->policy = policy_state;
787
788 if (strcasecmp(netbios_name, "BUILTIN") == 0
789 || (dns_name && strcasecmp(dns_name, "BUILTIN") == 0)
790 || (dom_sid_in_domain(policy_state->builtin_sid, r->in.info->sid))) {
791 return NT_STATUS_INVALID_PARAMETER;;
792 }
793
794 if (strcasecmp(netbios_name, policy_state->domain_name) == 0
795 || strcasecmp(netbios_name, policy_state->domain_dns) == 0
796 || (dns_name && strcasecmp(dns_name, policy_state->domain_dns) == 0)
797 || (dns_name && strcasecmp(dns_name, policy_state->domain_name) == 0)
798 || (dom_sid_equal(policy_state->domain_sid, r->in.info->sid))) {
799 return NT_STATUS_CURRENT_DOMAIN_NOT_ALLOWED;
800 }
801
802 /* While this is a REF pointer, some of the functions that wrap this don't provide this */
803 if (op == NDR_LSA_CREATETRUSTEDDOMAIN) {
804 /* No secrets are created at this time, for this function */
805 auth_struct.outgoing.count = 0;
806 auth_struct.incoming.count = 0;
807 } else {
808 auth_blob = data_blob_const(r->in.auth_info->auth_blob.data, r->in.auth_info->auth_blob.size);
809 arcfour_crypt_blob(auth_blob.data, auth_blob.length, &session_key);
810 ndr_err = ndr_pull_struct_blob(&auth_blob, mem_ctx,
811 lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
812 &auth_struct,
813 (ndr_pull_flags_fn_t)ndr_pull_trustDomainPasswords);
814 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
815 return NT_STATUS_INVALID_PARAMETER;
816 }
817
818 if (op == NDR_LSA_CREATETRUSTEDDOMAINEX) {
819 if (auth_struct.incoming.count > 1) {
820 return NT_STATUS_INVALID_PARAMETER;
821 }
822 }
823 }
824
825 if (auth_struct.incoming.count) {
826 uint32_t i;
827 struct trustAuthInOutBlob incoming;
828
829 incoming.count = auth_struct.incoming.count;
830 incoming.current = talloc(mem_ctx, struct AuthenticationInformationArray);
831 if (!incoming.current) {
832 return NT_STATUS_NO_MEMORY;
833 }
834
835 incoming.current->array = *auth_struct.incoming.current;
836 if (!incoming.current->array) {
837 return NT_STATUS_NO_MEMORY;
838 }
839
840 incoming.previous = talloc(mem_ctx, struct AuthenticationInformationArray);
841 if (!incoming.previous) {
842 return NT_STATUS_NO_MEMORY;
843 }
844 incoming.previous->array = talloc_array(mem_ctx, struct AuthenticationInformation, incoming.count);
845 if (!incoming.previous->array) {
846 return NT_STATUS_NO_MEMORY;
847 }
848
849 for (i = 0; i < incoming.count; i++) {
850 incoming.previous->array[i].LastUpdateTime = 0;
851 incoming.previous->array[i].AuthType = 0;
852 }
853 ndr_err = ndr_push_struct_blob(&trustAuthIncoming, mem_ctx,
854 lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
855 &incoming,
856 (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
857 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
858 return NT_STATUS_INVALID_PARAMETER;
859 }
860 } else {
861 trustAuthIncoming = data_blob(NULL, 0);
862 }
863
864 if (auth_struct.outgoing.count) {
865 uint32_t i;
866 struct trustAuthInOutBlob outgoing;
867
868 outgoing.count = auth_struct.outgoing.count;
869 outgoing.current = talloc(mem_ctx, struct AuthenticationInformationArray);
870 if (!outgoing.current) {
871 return NT_STATUS_NO_MEMORY;
872 }
873
874 outgoing.current->array = *auth_struct.outgoing.current;
875 if (!outgoing.current->array) {
876 return NT_STATUS_NO_MEMORY;
877 }
878
879 outgoing.previous = talloc(mem_ctx, struct AuthenticationInformationArray);
880 if (!outgoing.previous) {
881 return NT_STATUS_NO_MEMORY;
882 }
883 outgoing.previous->array = talloc_array(mem_ctx, struct AuthenticationInformation, outgoing.count);
884 if (!outgoing.previous->array) {
885 return NT_STATUS_NO_MEMORY;
886 }
887
888 for (i = 0; i < outgoing.count; i++) {
889 outgoing.previous->array[i].LastUpdateTime = 0;
890 outgoing.previous->array[i].AuthType = 0;
891 }
892 ndr_err = ndr_push_struct_blob(&trustAuthOutgoing, mem_ctx,
893 lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx),
894 &outgoing,
895 (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
896 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
897 return NT_STATUS_INVALID_PARAMETER;
898 }
899 } else {
900 trustAuthOutgoing = data_blob(NULL, 0);
901 }
902
903 ret = ldb_transaction_start(sam_ldb);
904 if (ret != LDB_SUCCESS) {
905 return NT_STATUS_INTERNAL_DB_CORRUPTION;
906 }
907
908 if (dns_name) {
909 char *dns_encoded = ldb_binary_encode_string(mem_ctx, netbios_name);
910 char *netbios_encoded = ldb_binary_encode_string(mem_ctx, netbios_name);
911 /* search for the trusted_domain record */
912 ret = gendb_search(sam_ldb,
913 mem_ctx, policy_state->system_dn, &msgs, attrs,
914 "(&(|(flatname=%s)(cn=%s)(trustPartner=%s)(flatname=%s)(cn=%s)(trustPartner=%s))(objectclass=trustedDomain))",
915 dns_encoded, dns_encoded, dns_encoded, netbios_encoded, netbios_encoded, netbios_encoded);
916 if (ret > 0) {
917 ldb_transaction_cancel(sam_ldb);
918 return NT_STATUS_OBJECT_NAME_COLLISION;
919 }
920 } else {
921 char *netbios_encoded = ldb_binary_encode_string(mem_ctx, netbios_name);
922 /* search for the trusted_domain record */
923 ret = gendb_search(sam_ldb,
924 mem_ctx, policy_state->system_dn, &msgs, attrs,
925 "(&(|(flatname=%s)(cn=%s)(trustPartner=%s))(objectclass=trustedDomain))",
926 netbios_encoded, netbios_encoded, netbios_encoded);
927 if (ret > 0) {
928 ldb_transaction_cancel(sam_ldb);
929 return NT_STATUS_OBJECT_NAME_COLLISION;
930 }
931 }
932
933 if (ret < 0 ) {
934 ldb_transaction_cancel(sam_ldb);
935 return NT_STATUS_INTERNAL_DB_CORRUPTION;
936 }
937
938 name = dns_name ? dns_name : netbios_name;
939
940 msg = ldb_msg_new(mem_ctx);
941 if (msg == NULL) {
942 return NT_STATUS_NO_MEMORY;
943 }
944
945 msg->dn = ldb_dn_copy(mem_ctx, policy_state->system_dn);
946 if ( ! ldb_dn_add_child_fmt(msg->dn, "cn=%s", name)) {
947 ldb_transaction_cancel(sam_ldb);
948 return NT_STATUS_NO_MEMORY;
949 }
950
951 samdb_msg_add_string(sam_ldb, mem_ctx, msg, "flatname", netbios_name);
952
953 if (r->in.info->sid) {
954 ret = samdb_msg_add_dom_sid(sam_ldb, mem_ctx, msg, "securityIdentifier", r->in.info->sid);
955 if (ret != LDB_SUCCESS) {
956 ldb_transaction_cancel(sam_ldb);
957 return NT_STATUS_INVALID_PARAMETER;
958 }
959 }
960
961 samdb_msg_add_string(sam_ldb, mem_ctx, msg, "objectClass", "trustedDomain");
962
963 samdb_msg_add_int(sam_ldb, mem_ctx, msg, "trustType", r->in.info->trust_type);
964
965 samdb_msg_add_int(sam_ldb, mem_ctx, msg, "trustAttributes", r->in.info->trust_attributes);
966
967 samdb_msg_add_int(sam_ldb, mem_ctx, msg, "trustDirection", r->in.info->trust_direction);
968
969 if (dns_name) {
970 samdb_msg_add_string(sam_ldb, mem_ctx, msg, "trustPartner", dns_name);
971 }
972
973 if (trustAuthIncoming.data) {
974 ret = ldb_msg_add_value(msg, "trustAuthIncoming", &trustAuthIncoming, NULL);
975 if (ret != LDB_SUCCESS) {
976 ldb_transaction_cancel(sam_ldb);
977 return NT_STATUS_NO_MEMORY;
978 }
979 }
980 if (trustAuthOutgoing.data) {
981 ret = ldb_msg_add_value(msg, "trustAuthOutgoing", &trustAuthOutgoing, NULL);
982 if (ret != LDB_SUCCESS) {
983 ldb_transaction_cancel(sam_ldb);
984 return NT_STATUS_NO_MEMORY;
985 }
986 }
987
988 trusted_domain_state->trusted_domain_dn = talloc_reference(trusted_domain_state, msg->dn);
989
990 /* create the trusted_domain */
991 ret = ldb_add(sam_ldb, msg);
992 switch (ret) {
993 case LDB_SUCCESS:
994 break;
995 case LDB_ERR_ENTRY_ALREADY_EXISTS:
996 ldb_transaction_cancel(sam_ldb);
997 DEBUG(0,("Failed to create trusted domain record %s: %s\n",
998 ldb_dn_get_linearized(msg->dn),
999 ldb_errstring(sam_ldb)));
1000 return NT_STATUS_DOMAIN_EXISTS;
1001 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
1002 ldb_transaction_cancel(sam_ldb);
1003 DEBUG(0,("Failed to create trusted domain record %s: %s\n",
1004 ldb_dn_get_linearized(msg->dn),
1005 ldb_errstring(sam_ldb)));
1006 return NT_STATUS_ACCESS_DENIED;
1007 default:
1008 ldb_transaction_cancel(sam_ldb);
1009 DEBUG(0,("Failed to create user record %s: %s\n",
1010 ldb_dn_get_linearized(msg->dn),
1011 ldb_errstring(sam_ldb)));
1012 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1013 }
1014
1015 if (r->in.info->trust_direction & LSA_TRUST_DIRECTION_INBOUND) {
1016 msg_user = ldb_msg_new(mem_ctx);
1017 if (msg_user == NULL) {
1018 ldb_transaction_cancel(sam_ldb);
1019 return NT_STATUS_NO_MEMORY;
1020 }
1021
1022 /* Inbound trusts must also create a cn=users object to match */
1023
1024 trusted_domain_state->trusted_domain_user_dn = msg_user->dn
1025 = ldb_dn_copy(trusted_domain_state, policy_state->domain_dn);
1026 if ( ! ldb_dn_add_child_fmt(msg_user->dn, "cn=users")) {
1027 ldb_transaction_cancel(sam_ldb);
1028 return NT_STATUS_NO_MEMORY;
1029 }
1030
1031 if ( ! ldb_dn_add_child_fmt(msg_user->dn, "cn=%s", netbios_name)) {
1032 ldb_transaction_cancel(sam_ldb);
1033 return NT_STATUS_NO_MEMORY;
1034 }
1035
1036 ldb_msg_add_string(msg_user, "objectClass", "user");
1037
1038 ldb_msg_add_steal_string(msg_user, "samAccountName",
1039 talloc_asprintf(mem_ctx, "%s$", netbios_name));
1040
1041 if (samdb_msg_add_uint(sam_ldb, mem_ctx, msg_user,
1042 "userAccountControl",
1043 UF_INTERDOMAIN_TRUST_ACCOUNT) != 0) {
1044 ldb_transaction_cancel(sam_ldb);
1045 return NT_STATUS_NO_MEMORY;
1046 }
1047
1048 if (auth_struct.incoming.count) {
1049 uint32_t i;
1050 for (i=0; i < auth_struct.incoming.count; i++ ) {
1051 if (auth_struct.incoming.current[i]->AuthType == TRUST_AUTH_TYPE_NT4OWF) {
1052 samdb_msg_add_hash(sam_ldb,
1053 mem_ctx, msg_user, "unicodePwd",
1054 &auth_struct.incoming.current[i]->AuthInfo.nt4owf.password);
1055 } else if (auth_struct.incoming.current[i]->AuthType == TRUST_AUTH_TYPE_CLEAR) {
1056 DATA_BLOB new_password = data_blob_const(auth_struct.incoming.current[i]->AuthInfo.clear.password,
1057 auth_struct.incoming.current[i]->AuthInfo.clear.size);
1058 ret = ldb_msg_add_value(msg_user, "clearTextPassword", &new_password, NULL);
1059 if (ret != LDB_SUCCESS) {
1060 ldb_transaction_cancel(sam_ldb);
1061 return NT_STATUS_NO_MEMORY;
1062 }
1063 }
1064 }
1065 }
1066
1067 /* create the cn=users trusted_domain account */
1068 ret = ldb_add(sam_ldb, msg_user);
1069 switch (ret) {
1070 case LDB_SUCCESS:
1071 break;
1072 case LDB_ERR_ENTRY_ALREADY_EXISTS:
1073 ldb_transaction_cancel(sam_ldb);
1074 DEBUG(0,("Failed to create trusted domain record %s: %s\n",
1075 ldb_dn_get_linearized(msg_user->dn),
1076 ldb_errstring(sam_ldb)));
1077 return NT_STATUS_DOMAIN_EXISTS;
1078 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
1079 ldb_transaction_cancel(sam_ldb);
1080 DEBUG(0,("Failed to create trusted domain record %s: %s\n",
1081 ldb_dn_get_linearized(msg_user->dn),
1082 ldb_errstring(sam_ldb)));
1083 return NT_STATUS_ACCESS_DENIED;
1084 default:
1085 ldb_transaction_cancel(sam_ldb);
1086 DEBUG(0,("Failed to create user record %s: %s\n",
1087 ldb_dn_get_linearized(msg_user->dn),
1088 ldb_errstring(sam_ldb)));
1089 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1090 }
1091 }
1092
1093 ret = ldb_transaction_commit(sam_ldb);
1094 if (ret != LDB_SUCCESS) {
1095 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1096 }
1097
1098 handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_TRUSTED_DOMAIN);
1099 if (!handle) {
1100 return NT_STATUS_NO_MEMORY;
1101 }
1102
1103 handle->data = talloc_steal(handle, trusted_domain_state);
1104
1105 trusted_domain_state->access_mask = r->in.access_mask;
1106 trusted_domain_state->policy = talloc_reference(trusted_domain_state, policy_state);
1107
1108 *r->out.trustdom_handle = handle->wire_handle;
1109
1110 return NT_STATUS_OK;
1111 }
1112
1113 /*
1114 lsa_CreateTrustedDomainEx2
1115 */
1116 static NTSTATUS dcesrv_lsa_CreateTrustedDomainEx2(struct dcesrv_call_state *dce_call,
1117 TALLOC_CTX *mem_ctx,
1118 struct lsa_CreateTrustedDomainEx2 *r)
1119 {
1120 return dcesrv_lsa_CreateTrustedDomain_base(dce_call, mem_ctx, r, NDR_LSA_CREATETRUSTEDDOMAINEX2);
1121 }
1122 /*
1123 lsa_CreateTrustedDomainEx
1124 */
1125 static NTSTATUS dcesrv_lsa_CreateTrustedDomainEx(struct dcesrv_call_state *dce_call,
1126 TALLOC_CTX *mem_ctx,
1127 struct lsa_CreateTrustedDomainEx *r)
1128 {
1129 struct lsa_CreateTrustedDomainEx2 r2;
1130
1131 r2.in.policy_handle = r->in.policy_handle;
1132 r2.in.info = r->in.info;
1133 r2.in.auth_info = r->in.auth_info;
1134 r2.out.trustdom_handle = r->out.trustdom_handle;
1135 return dcesrv_lsa_CreateTrustedDomain_base(dce_call, mem_ctx, &r2, NDR_LSA_CREATETRUSTEDDOMAINEX);
1136 }
1137
1138 /*
1139 lsa_CreateTrustedDomain
1140 */
1141 static NTSTATUS dcesrv_lsa_CreateTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1142 struct lsa_CreateTrustedDomain *r)
1143 {
1144 struct lsa_CreateTrustedDomainEx2 r2;
1145
1146 r2.in.policy_handle = r->in.policy_handle;
1147 r2.in.info = talloc(mem_ctx, struct lsa_TrustDomainInfoInfoEx);
1148 if (!r2.in.info) {
1149 return NT_STATUS_NO_MEMORY;
1150 }
1151
1152 r2.in.info->domain_name.string = NULL;
1153 r2.in.info->netbios_name = r->in.info->name;
1154 r2.in.info->sid = r->in.info->sid;
1155 r2.in.info->trust_direction = LSA_TRUST_DIRECTION_OUTBOUND;
1156 r2.in.info->trust_type = LSA_TRUST_TYPE_DOWNLEVEL;
1157 r2.in.info->trust_attributes = 0;
1158
1159 r2.in.access_mask = r->in.access_mask;
1160 r2.out.trustdom_handle = r->out.trustdom_handle;
1161
1162 return dcesrv_lsa_CreateTrustedDomain_base(dce_call, mem_ctx, &r2, NDR_LSA_CREATETRUSTEDDOMAIN);
1163
1164 }
1165
1166 /*
1167 lsa_OpenTrustedDomain
1168 */
1169 static NTSTATUS dcesrv_lsa_OpenTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1170 struct lsa_OpenTrustedDomain *r)
1171 {
1172 struct dcesrv_handle *policy_handle;
1173
1174 struct lsa_policy_state *policy_state;
1175 struct lsa_trusted_domain_state *trusted_domain_state;
1176 struct dcesrv_handle *handle;
1177 struct ldb_message **msgs;
1178 const char *attrs[] = {
1179 "trustDirection",
1180 "flatname",
1181 NULL
1182 };
1183
1184 const char *sid_string;
1185 int ret;
1186
1187 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
1188 ZERO_STRUCTP(r->out.trustdom_handle);
1189 policy_state = policy_handle->data;
1190
1191 trusted_domain_state = talloc_zero(mem_ctx, struct lsa_trusted_domain_state);
1192 if (!trusted_domain_state) {
1193 return NT_STATUS_NO_MEMORY;
1194 }
1195 trusted_domain_state->policy = policy_state;
1196
1197 sid_string = dom_sid_string(mem_ctx, r->in.sid);
1198 if (!sid_string) {
1199 return NT_STATUS_NO_MEMORY;
1200 }
1201
1202 /* search for the trusted_domain record */
1203 ret = gendb_search(trusted_domain_state->policy->sam_ldb,
1204 mem_ctx, policy_state->system_dn, &msgs, attrs,
1205 "(&(securityIdentifier=%s)(objectclass=trustedDomain))",
1206 sid_string);
1207 if (ret == 0) {
1208 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1209 }
1210
1211 if (ret != 1) {
1212 DEBUG(0,("Found %d records matching DN %s\n", ret,
1213 ldb_dn_get_linearized(policy_state->system_dn)));
1214 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1215 }
1216
1217 trusted_domain_state->trusted_domain_dn = talloc_reference(trusted_domain_state, msgs[0]->dn);
1218
1219 trusted_domain_state->trusted_domain_user_dn = NULL;
1220
1221 if (ldb_msg_find_attr_as_int(msgs[0], "trustDirection", 0) & LSA_TRUST_DIRECTION_INBOUND) {
1222 const char *flatname = ldb_binary_encode_string(mem_ctx, ldb_msg_find_attr_as_string(msgs[0], "flatname", NULL));
1223 /* search for the trusted_domain record */
1224 ret = gendb_search(trusted_domain_state->policy->sam_ldb,
1225 mem_ctx, policy_state->domain_dn, &msgs, attrs,
1226 "(&(samaccountname=%s$)(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=%d))",
1227 flatname, UF_INTERDOMAIN_TRUST_ACCOUNT);
1228 if (ret == 1) {
1229 trusted_domain_state->trusted_domain_user_dn = talloc_steal(trusted_domain_state, msgs[0]->dn);
1230 }
1231 }
1232 handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_TRUSTED_DOMAIN);
1233 if (!handle) {
1234 return NT_STATUS_NO_MEMORY;
1235 }
1236
1237 handle->data = talloc_steal(handle, trusted_domain_state);
1238
1239 trusted_domain_state->access_mask = r->in.access_mask;
1240 trusted_domain_state->policy = talloc_reference(trusted_domain_state, policy_state);
1241
1242 *r->out.trustdom_handle = handle->wire_handle;
1243
1244 return NT_STATUS_OK;
1245 }
1246
1247
1248 /*
1249 lsa_OpenTrustedDomainByName
1250 */
1251 static NTSTATUS dcesrv_lsa_OpenTrustedDomainByName(struct dcesrv_call_state *dce_call,
1252 TALLOC_CTX *mem_ctx,
1253 struct lsa_OpenTrustedDomainByName *r)
1254 {
1255 struct dcesrv_handle *policy_handle;
1256
1257 struct lsa_policy_state *policy_state;
1258 struct lsa_trusted_domain_state *trusted_domain_state;
1259 struct dcesrv_handle *handle;
1260 struct ldb_message **msgs;
1261 const char *attrs[] = {
1262 NULL
1263 };
1264 char *td_name;
1265 int ret;
1266
1267 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
1268 ZERO_STRUCTP(r->out.trustdom_handle);
1269 policy_state = policy_handle->data;
1270
1271 if (!r->in.name.string) {
1272 return NT_STATUS_INVALID_PARAMETER;
1273 }
1274
1275 trusted_domain_state = talloc_zero(mem_ctx, struct lsa_trusted_domain_state);
1276 if (!trusted_domain_state) {
1277 return NT_STATUS_NO_MEMORY;
1278 }
1279 trusted_domain_state->policy = policy_state;
1280
1281 /* search for the trusted_domain record */
1282 td_name = ldb_binary_encode_string(mem_ctx, r->in.name.string);
1283 ret = gendb_search(trusted_domain_state->policy->sam_ldb,
1284 mem_ctx, policy_state->system_dn, &msgs, attrs,
1285 "(&(|(flatname=%s)(cn=%s)(trustPartner=%s))"
1286 "(objectclass=trustedDomain))",
1287 td_name, td_name, td_name);
1288 if (ret == 0) {
1289 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1290 }
1291
1292 if (ret != 1) {
1293 DEBUG(0,("Found %d records matching DN %s\n", ret,
1294 ldb_dn_get_linearized(policy_state->system_dn)));
1295 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1296 }
1297
1298 /* TODO: perform access checks */
1299
1300 trusted_domain_state->trusted_domain_dn = talloc_reference(trusted_domain_state, msgs[0]->dn);
1301
1302 handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_TRUSTED_DOMAIN);
1303 if (!handle) {
1304 return NT_STATUS_NO_MEMORY;
1305 }
1306
1307 handle->data = talloc_steal(handle, trusted_domain_state);
1308
1309 trusted_domain_state->access_mask = r->in.access_mask;
1310 trusted_domain_state->policy = talloc_reference(trusted_domain_state, policy_state);
1311
1312 *r->out.trustdom_handle = handle->wire_handle;
1313
1314 return NT_STATUS_OK;
1315 }
1316
1317
1318
1319 /*
1320 lsa_SetTrustedDomainInfo
1321 */
1322 static NTSTATUS dcesrv_lsa_SetTrustedDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1323 struct lsa_SetTrustedDomainInfo *r)
1324 {
1325 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1326 }
1327
1328
1329
1330 /*
1331 lsa_SetInfomrationTrustedDomain
1332 */
1333 static NTSTATUS dcesrv_lsa_SetInformationTrustedDomain(struct dcesrv_call_state *dce_call,
1334 TALLOC_CTX *mem_ctx,
1335 struct lsa_SetInformationTrustedDomain *r)
1336 {
1337 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1338 }
1339
1340
1341 /*
1342 lsa_DeleteTrustedDomain
1343 */
1344 static NTSTATUS dcesrv_lsa_DeleteTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1345 struct lsa_DeleteTrustedDomain *r)
1346 {
1347 NTSTATUS status;
1348 struct lsa_OpenTrustedDomain opn;
1349 struct lsa_DeleteObject del;
1350 struct dcesrv_handle *h;
1351
1352 opn.in.handle = r->in.handle;
1353 opn.in.sid = r->in.dom_sid;
1354 opn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1355 opn.out.trustdom_handle = talloc(mem_ctx, struct policy_handle);
1356 if (!opn.out.trustdom_handle) {
1357 return NT_STATUS_NO_MEMORY;
1358 }
1359 status = dcesrv_lsa_OpenTrustedDomain(dce_call, mem_ctx, &opn);
1360 if (!NT_STATUS_IS_OK(status)) {
1361 return status;
1362 }
1363
1364 DCESRV_PULL_HANDLE(h, opn.out.trustdom_handle, DCESRV_HANDLE_ANY);
1365 talloc_steal(mem_ctx, h);
1366
1367 del.in.handle = opn.out.trustdom_handle;
1368 del.out.handle = opn.out.trustdom_handle;
1369 status = dcesrv_lsa_DeleteObject(dce_call, mem_ctx, &del);
1370 if (!NT_STATUS_IS_OK(status)) {
1371 return status;
1372 }
1373 return NT_STATUS_OK;
1374 }
1375
1376 static NTSTATUS fill_trust_domain_ex(TALLOC_CTX *mem_ctx,
1377 struct ldb_message *msg,
1378 struct lsa_TrustDomainInfoInfoEx *info_ex)
1379 {
1380 info_ex->domain_name.string
1381 = ldb_msg_find_attr_as_string(msg, "trustPartner", NULL);
1382 info_ex->netbios_name.string
1383 = ldb_msg_find_attr_as_string(msg, "flatname", NULL);
1384 info_ex->sid
1385 = samdb_result_dom_sid(mem_ctx, msg, "securityIdentifier");
1386 info_ex->trust_direction
1387 = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
1388 info_ex->trust_type
1389 = ldb_msg_find_attr_as_int(msg, "trustType", 0);
1390 info_ex->trust_attributes
1391 = ldb_msg_find_attr_as_int(msg, "trustAttributes", 0);
1392 return NT_STATUS_OK;
1393 }
1394
1395 /*
1396 lsa_QueryTrustedDomainInfo
1397 */
1398 static NTSTATUS dcesrv_lsa_QueryTrustedDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1399 struct lsa_QueryTrustedDomainInfo *r)
1400 {
1401 union lsa_TrustedDomainInfo *info = NULL;
1402 struct dcesrv_handle *h;
1403 struct lsa_trusted_domain_state *trusted_domain_state;
1404 struct ldb_message *msg;
1405 int ret;
1406 struct ldb_message **res;
1407 const char *attrs[] = {
1408 "flatname",
1409 "trustPartner",
1410 "securityIdentifier",
1411 "trustDirection",
1412 "trustType",
1413 "trustAttributes",
1414 "msDs-supportedEncryptionTypes",
1415 NULL
1416 };
1417
1418 DCESRV_PULL_HANDLE(h, r->in.trustdom_handle, LSA_HANDLE_TRUSTED_DOMAIN);
1419
1420 trusted_domain_state = talloc_get_type(h->data, struct lsa_trusted_domain_state);
1421
1422 /* pull all the user attributes */
1423 ret = gendb_search_dn(trusted_domain_state->policy->sam_ldb, mem_ctx,
1424 trusted_domain_state->trusted_domain_dn, &res, attrs);
1425 if (ret != 1) {
1426 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1427 }
1428 msg = res[0];
1429
1430 info = talloc_zero(mem_ctx, union lsa_TrustedDomainInfo);
1431 if (!info) {
1432 return NT_STATUS_NO_MEMORY;
1433 }
1434 *r->out.info = info;
1435
1436 switch (r->in.level) {
1437 case LSA_TRUSTED_DOMAIN_INFO_NAME:
1438 info->name.netbios_name.string
1439 = samdb_result_string(msg, "flatname", NULL);
1440 break;
1441 case LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET:
1442 info->posix_offset.posix_offset
1443 = samdb_result_uint(msg, "posixOffset", 0);
1444 break;
1445 #if 0 /* Win2k3 doesn't implement this */
1446 case LSA_TRUSTED_DOMAIN_INFO_BASIC:
1447 r->out.info->info_basic.netbios_name.string
1448 = ldb_msg_find_attr_as_string(msg, "flatname", NULL);
1449 r->out.info->info_basic.sid
1450 = samdb_result_dom_sid(mem_ctx, msg, "securityIdentifier");
1451 break;
1452 #endif
1453 case LSA_TRUSTED_DOMAIN_INFO_INFO_EX:
1454 return fill_trust_domain_ex(mem_ctx, msg, &info->info_ex);
1455
1456 case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO:
1457 ZERO_STRUCT(info->full_info);
1458 return fill_trust_domain_ex(mem_ctx, msg, &info->full_info.info_ex);
1459
1460 case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_2_INTERNAL:
1461 ZERO_STRUCT(info->full_info2_internal);
1462 info->full_info2_internal.posix_offset.posix_offset
1463 = samdb_result_uint(msg, "posixOffset", 0);
1464 return fill_trust_domain_ex(mem_ctx, msg, &info->full_info2_internal.info.info_ex);
1465
1466 case LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES:
1467 info->enc_types.enc_types
1468 = samdb_result_uint(msg, "msDs-supportedEncryptionTypes", KERB_ENCTYPE_RC4_HMAC_MD5);
1469 break;
1470
1471 case LSA_TRUSTED_DOMAIN_INFO_CONTROLLERS:
1472 case LSA_TRUSTED_DOMAIN_INFO_INFO_EX2_INTERNAL:
1473 /* oops, we don't want to return the info after all */
1474 talloc_free(info);
1475 *r->out.info = NULL;
1476 return NT_STATUS_INVALID_PARAMETER;
1477 default:
1478 /* oops, we don't want to return the info after all */
1479 talloc_free(info);
1480 *r->out.info = NULL;
1481 return NT_STATUS_INVALID_INFO_CLASS;
1482 }
1483
1484 return NT_STATUS_OK;
1485 }
1486
1487
1488 /*
1489 lsa_QueryTrustedDomainInfoBySid
1490 */
1491 static NTSTATUS dcesrv_lsa_QueryTrustedDomainInfoBySid(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1492 struct lsa_QueryTrustedDomainInfoBySid *r)
1493 {
1494 NTSTATUS status;
1495 struct lsa_OpenTrustedDomain opn;
1496 struct lsa_QueryTrustedDomainInfo query;
1497 struct dcesrv_handle *h;
1498
1499 opn.in.handle = r->in.handle;
1500 opn.in.sid = r->in.dom_sid;
1501 opn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1502 opn.out.trustdom_handle = talloc(mem_ctx, struct policy_handle);
1503 if (!opn.out.trustdom_handle) {
1504 return NT_STATUS_NO_MEMORY;
1505 }
1506 status = dcesrv_lsa_OpenTrustedDomain(dce_call, mem_ctx, &opn);
1507 if (!NT_STATUS_IS_OK(status)) {
1508 return status;
1509 }
1510
1511 /* Ensure this handle goes away at the end of this call */
1512 DCESRV_PULL_HANDLE(h, opn.out.trustdom_handle, DCESRV_HANDLE_ANY);
1513 talloc_steal(mem_ctx, h);
1514
1515 query.in.trustdom_handle = opn.out.trustdom_handle;
1516 query.in.level = r->in.level;
1517 query.out.info = r->out.info;
1518 status = dcesrv_lsa_QueryTrustedDomainInfo(dce_call, mem_ctx, &query);
1519 if (!NT_STATUS_IS_OK(status)) {
1520 return status;
1521 }
1522
1523 return NT_STATUS_OK;
1524 }
1525
1526 /*
1527 lsa_SetTrustedDomainInfoByName
1528 */
1529 static NTSTATUS dcesrv_lsa_SetTrustedDomainInfoByName(struct dcesrv_call_state *dce_call,
1530 TALLOC_CTX *mem_ctx,
1531 struct lsa_SetTrustedDomainInfoByName *r)
1532 {
1533 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1534 }
1535
1536 /*
1537 lsa_QueryTrustedDomainInfoByName
1538 */
1539 static NTSTATUS dcesrv_lsa_QueryTrustedDomainInfoByName(struct dcesrv_call_state *dce_call,
1540 TALLOC_CTX *mem_ctx,
1541 struct lsa_QueryTrustedDomainInfoByName *r)
1542 {
1543 NTSTATUS status;
1544 struct lsa_OpenTrustedDomainByName opn;
1545 struct lsa_QueryTrustedDomainInfo query;
1546 struct dcesrv_handle *h;
1547
1548 opn.in.handle = r->in.handle;
1549 opn.in.name = *r->in.trusted_domain;
1550 opn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1551 opn.out.trustdom_handle = talloc(mem_ctx, struct policy_handle);
1552 if (!opn.out.trustdom_handle) {
1553 return NT_STATUS_NO_MEMORY;
1554 }
1555 status = dcesrv_lsa_OpenTrustedDomainByName(dce_call, mem_ctx, &opn);
1556 if (!NT_STATUS_IS_OK(status)) {
1557 return status;
1558 }
1559
1560 /* Ensure this handle goes away at the end of this call */
1561 DCESRV_PULL_HANDLE(h, opn.out.trustdom_handle, DCESRV_HANDLE_ANY);
1562 talloc_steal(mem_ctx, h);
1563
1564 query.in.trustdom_handle = opn.out.trustdom_handle;
1565 query.in.level = r->in.level;
1566 query.out.info = r->out.info;
1567 status = dcesrv_lsa_QueryTrustedDomainInfo(dce_call, mem_ctx, &query);
1568 if (!NT_STATUS_IS_OK(status)) {
1569 return status;
1570 }
1571
1572 return NT_STATUS_OK;
1573 }
1574
1575 /*
1576 lsa_CloseTrustedDomainEx
1577 */
1578 static NTSTATUS dcesrv_lsa_CloseTrustedDomainEx(struct dcesrv_call_state *dce_call,
1579 TALLOC_CTX *mem_ctx,
1580 struct lsa_CloseTrustedDomainEx *r)
1581 {
1582 /* The result of a bad hair day from an IDL programmer? Not
1583 * implmented in Win2k3. You should always just lsa_Close
1584 * anyway. */
1585 return NT_STATUS_NOT_IMPLEMENTED;
1586 }
1587
1588
1589 /*
1590 comparison function for sorting lsa_DomainInformation array
1591 */
1592 static int compare_DomainInfo(struct lsa_DomainInfo *e1, struct lsa_DomainInfo *e2)
1593 {
1594 return strcasecmp_m(e1->name.string, e2->name.string);
1595 }
1596
1597 /*
1598 lsa_EnumTrustDom
1599 */
1600 static NTSTATUS dcesrv_lsa_EnumTrustDom(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1601 struct lsa_EnumTrustDom *r)
1602 {
1603 struct dcesrv_handle *policy_handle;
1604 struct lsa_DomainInfo *entries;
1605 struct lsa_policy_state *policy_state;
1606 struct ldb_message **domains;
1607 const char *attrs[] = {
1608 "flatname",
1609 "securityIdentifier",
1610 NULL
1611 };
1612
1613
1614 int count, i;
1615
1616 *r->out.resume_handle = 0;
1617
1618 r->out.domains->domains = NULL;
1619 r->out.domains->count = 0;
1620
1621 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
1622
1623 policy_state = policy_handle->data;
1624
1625 /* search for all users in this domain. This could possibly be cached and
1626 resumed based on resume_key */
1627 count = gendb_search(policy_state->sam_ldb, mem_ctx, policy_state->system_dn, &domains, attrs,
1628 "objectclass=trustedDomain");
1629 if (count == -1) {
1630 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1631 }
1632
1633 /* convert to lsa_TrustInformation format */
1634 entries = talloc_array(mem_ctx, struct lsa_DomainInfo, count);
1635 if (!entries) {
1636 return NT_STATUS_NO_MEMORY;
1637 }
1638 for (i=0;i<count;i++) {
1639 entries[i].sid = samdb_result_dom_sid(mem_ctx, domains[i], "securityIdentifier");
1640 entries[i].name.string = samdb_result_string(domains[i], "flatname", NULL);
1641 }
1642
1643 /* sort the results by name */
1644 TYPESAFE_QSORT(entries, count, compare_DomainInfo);
1645
1646 if (*r->in.resume_handle >= count) {
1647 *r->out.resume_handle = -1;
1648
1649 return NT_STATUS_NO_MORE_ENTRIES;
1650 }
1651
1652 /* return the rest, limit by max_size. Note that we
1653 use the w2k3 element size value of 60 */
1654 r->out.domains->count = count - *r->in.resume_handle;
1655 r->out.domains->count = MIN(r->out.domains->count,
1656 1+(r->in.max_size/LSA_ENUM_TRUST_DOMAIN_MULTIPLIER));
1657
1658 r->out.domains->domains = entries + *r->in.resume_handle;
1659 r->out.domains->count = r->out.domains->count;
1660
1661 if (r->out.domains->count < count - *r->in.resume_handle) {
1662 *r->out.resume_handle = *r->in.resume_handle + r->out.domains->count;
1663 return STATUS_MORE_ENTRIES;
1664 }
1665
1666 /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
1667 * always be larger than the previous input resume handle, in
1668 * particular when hitting the last query it is vital to set the
1669 * resume handle correctly to avoid infinite client loops, as
1670 * seen e.g. with Windows XP SP3 when resume handle is 0 and
1671 * status is NT_STATUS_OK - gd */
1672
1673 *r->out.resume_handle = (uint32_t)-1;
1674
1675 return NT_STATUS_OK;
1676 }
1677
1678 /*
1679 comparison function for sorting lsa_DomainInformation array
1680 */
1681 static int compare_TrustDomainInfoInfoEx(struct lsa_TrustDomainInfoInfoEx *e1, struct lsa_TrustDomainInfoInfoEx *e2)
1682 {
1683 return strcasecmp_m(e1->netbios_name.string, e2->netbios_name.string);
1684 }
1685
1686 /*
1687 lsa_EnumTrustedDomainsEx
1688 */
1689 static NTSTATUS dcesrv_lsa_EnumTrustedDomainsEx(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1690 struct lsa_EnumTrustedDomainsEx *r)
1691 {
1692 struct dcesrv_handle *policy_handle;
1693 struct lsa_TrustDomainInfoInfoEx *entries;
1694 struct lsa_policy_state *policy_state;
1695 struct ldb_message **domains;
1696 const char *attrs[] = {
1697 "flatname",
1698 "trustPartner",
1699 "securityIdentifier",
1700 "trustDirection",
1701 "trustType",
1702 "trustAttributes",
1703 NULL
1704 };
1705 NTSTATUS nt_status;
1706
1707 int count, i;
1708
1709 *r->out.resume_handle = 0;
1710
1711 r->out.domains->domains = NULL;
1712 r->out.domains->count = 0;
1713
1714 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
1715
1716 policy_state = policy_handle->data;
1717
1718 /* search for all users in this domain. This could possibly be cached and
1719 resumed based on resume_key */
1720 count = gendb_search(policy_state->sam_ldb, mem_ctx, policy_state->system_dn, &domains, attrs,
1721 "objectclass=trustedDomain");
1722 if (count == -1) {
1723 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1724 }
1725
1726 /* convert to lsa_DomainInformation format */
1727 entries = talloc_array(mem_ctx, struct lsa_TrustDomainInfoInfoEx, count);
1728 if (!entries) {
1729 return NT_STATUS_NO_MEMORY;
1730 }
1731 for (i=0;i<count;i++) {
1732 nt_status = fill_trust_domain_ex(mem_ctx, domains[i], &entries[i]);
1733 if (!NT_STATUS_IS_OK(nt_status)) {
1734 return nt_status;
1735 }
1736 }
1737
1738 /* sort the results by name */
1739 TYPESAFE_QSORT(entries, count, compare_TrustDomainInfoInfoEx);
1740
1741 if (*r->in.resume_handle >= count) {
1742 *r->out.resume_handle = -1;
1743
1744 return NT_STATUS_NO_MORE_ENTRIES;
1745 }
1746
1747 /* return the rest, limit by max_size. Note that we
1748 use the w2k3 element size value of 60 */
1749 r->out.domains->count = count - *r->in.resume_handle;
1750 r->out.domains->count = MIN(r->out.domains->count,
1751 1+(r->in.max_size/LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER));
1752
1753 r->out.domains->domains = entries + *r->in.resume_handle;
1754 r->out.domains->count = r->out.domains->count;
1755
1756 if (r->out.domains->count < count - *r->in.resume_handle) {
1757 *r->out.resume_handle = *r->in.resume_handle + r->out.domains->count;
1758 return STATUS_MORE_ENTRIES;
1759 }
1760
1761 return NT_STATUS_OK;
1762 }
1763
1764
1765 /*
1766 lsa_OpenAccount
1767 */
1768 static NTSTATUS dcesrv_lsa_OpenAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1769 struct lsa_OpenAccount *r)
1770 {
1771 struct dcesrv_handle *h, *ah;
1772 struct lsa_policy_state *state;
1773 struct lsa_account_state *astate;
1774
1775 ZERO_STRUCTP(r->out.acct_handle);
1776
1777 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1778
1779 state = h->data;
1780
1781 astate = talloc(dce_call->conn, struct lsa_account_state);
1782 if (astate == NULL) {
1783 return NT_STATUS_NO_MEMORY;
1784 }
1785
1786 astate->account_sid = dom_sid_dup(astate, r->in.sid);
1787 if (astate->account_sid == NULL) {
1788 talloc_free(astate);
1789 return NT_STATUS_NO_MEMORY;
1790 }
1791
1792 astate->policy = talloc_reference(astate, state);
1793 astate->access_mask = r->in.access_mask;
1794
1795 ah = dcesrv_handle_new(dce_call->context, LSA_HANDLE_ACCOUNT);
1796 if (!ah) {
1797 talloc_free(astate);
1798 return NT_STATUS_NO_MEMORY;
1799 }
1800
1801 ah->data = talloc_steal(ah, astate);
1802
1803 *r->out.acct_handle = ah->wire_handle;
1804
1805 return NT_STATUS_OK;
1806 }
1807
1808
1809 /*
1810 lsa_EnumPrivsAccount
1811 */
1812 static NTSTATUS dcesrv_lsa_EnumPrivsAccount(struct dcesrv_call_state *dce_call,
1813 TALLOC_CTX *mem_ctx,
1814 struct lsa_EnumPrivsAccount *r)
1815 {
1816 struct dcesrv_handle *h;
1817 struct lsa_account_state *astate;
1818 int ret;
1819 unsigned int i;
1820 struct ldb_message **res;
1821 const char * const attrs[] = { "privilege", NULL};
1822 struct ldb_message_element *el;
1823 const char *sidstr;
1824 struct lsa_PrivilegeSet *privs;
1825
1826 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
1827
1828 astate = h->data;
1829
1830 privs = talloc(mem_ctx, struct lsa_PrivilegeSet);
1831 if (privs == NULL) {
1832 return NT_STATUS_NO_MEMORY;
1833 }
1834 privs->count = 0;
1835 privs->unknown = 0;
1836 privs->set = NULL;
1837
1838 *r->out.privs = privs;
1839
1840 sidstr = ldap_encode_ndr_dom_sid(mem_ctx, astate->account_sid);
1841 if (sidstr == NULL) {
1842 return NT_STATUS_NO_MEMORY;
1843 }
1844
1845 ret = gendb_search(astate->policy->pdb, mem_ctx, NULL, &res, attrs,
1846 "objectSid=%s", sidstr);
1847 if (ret != 1) {
1848 return NT_STATUS_OK;
1849 }
1850
1851 el = ldb_msg_find_element(res[0], "privilege");
1852 if (el == NULL || el->num_values == 0) {
1853 return NT_STATUS_OK;
1854 }
1855
1856 privs->set = talloc_array(privs,
1857 struct lsa_LUIDAttribute, el->num_values);
1858 if (privs->set == NULL) {
1859 return NT_STATUS_NO_MEMORY;
1860 }
1861
1862 for (i=0;i<el->num_values;i++) {
1863 int id = sec_privilege_id((const char *)el->values[i].data);
1864 if (id == -1) {
1865 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1866 }
1867 privs->set[i].attribute = 0;
1868 privs->set[i].luid.low = id;
1869 privs->set[i].luid.high = 0;
1870 }
1871
1872 privs->count = el->num_values;
1873
1874 return NT_STATUS_OK;
1875 }
1876
1877 /*
1878 lsa_EnumAccountRights
1879 */
1880 static NTSTATUS dcesrv_lsa_EnumAccountRights(struct dcesrv_call_state *dce_call,
1881 TALLOC_CTX *mem_ctx,
1882 struct lsa_EnumAccountRights *r)
1883 {
1884 struct dcesrv_handle *h;
1885 struct lsa_policy_state *state;
1886 int ret;
1887 unsigned int i;
1888 struct ldb_message **res;
1889 const char * const attrs[] = { "privilege", NULL};
1890 const char *sidstr;
1891 struct ldb_message_element *el;
1892
1893 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1894
1895 state = h->data;
1896
1897 sidstr = ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid);
1898 if (sidstr == NULL) {
1899 return NT_STATUS_NO_MEMORY;
1900 }
1901
1902 ret = gendb_search(state->pdb, mem_ctx, NULL, &res, attrs,
1903 "(&(objectSid=%s)(privilege=*))", sidstr);
1904 if (ret == 0) {
1905 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1906 }
1907 if (ret > 1) {
1908 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1909 }
1910 if (ret == -1) {
1911 DEBUG(3, ("searching for account rights for SID: %s failed: %s",
1912 dom_sid_string(mem_ctx, r->in.sid),
1913 ldb_errstring(state->pdb)));
1914 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1915 }
1916
1917 el = ldb_msg_find_element(res[0], "privilege");
1918 if (el == NULL || el->num_values == 0) {
1919 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1920 }
1921
1922 r->out.rights->count = el->num_values;
1923 r->out.rights->names = talloc_array(r->out.rights,
1924 struct lsa_StringLarge, r->out.rights->count);
1925 if (r->out.rights->names == NULL) {
1926 return NT_STATUS_NO_MEMORY;
1927 }
1928
1929 for (i=0;i<el->num_values;i++) {
1930 r->out.rights->names[i].string = (const char *)el->values[i].data;
1931 }
1932
1933 return NT_STATUS_OK;
1934 }
1935
1936
1937
1938 /*
1939 helper for lsa_AddAccountRights and lsa_RemoveAccountRights
1940 */
1941 static NTSTATUS dcesrv_lsa_AddRemoveAccountRights(struct dcesrv_call_state *dce_call,
1942 TALLOC_CTX *mem_ctx,
1943 struct lsa_policy_state *state,
1944 int ldb_flag,
1945 struct dom_sid *sid,
1946 const struct lsa_RightSet *rights)
1947 {
1948 const char *sidstr, *sidndrstr;
1949 struct ldb_message *msg;
1950 struct ldb_message_element *el;
1951 int ret;
1952 uint32_t i;
1953 struct lsa_EnumAccountRights r2;
1954 char *dnstr;
1955
1956 if (security_session_user_level(dce_call->conn->auth_state.session_info) <
1957 SECURITY_ADMINISTRATOR) {
1958 DEBUG(0,("lsa_AddRemoveAccount refused for supplied security token\n"));
1959 return NT_STATUS_ACCESS_DENIED;
1960 }
1961
1962 msg = ldb_msg_new(mem_ctx);
1963 if (msg == NULL) {
1964 return NT_STATUS_NO_MEMORY;
1965 }
1966
1967 sidndrstr = ldap_encode_ndr_dom_sid(msg, sid);
1968 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sidndrstr, msg);
1969
1970 sidstr = dom_sid_string(msg, sid);
1971 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sidstr, msg);
1972
1973 dnstr = talloc_asprintf(msg, "sid=%s", sidstr);
1974 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dnstr, msg);
1975
1976 msg->dn = ldb_dn_new(msg, state->pdb, dnstr);
1977 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg->dn, msg);
1978
1979 if (ldb_flag == LDB_FLAG_MOD_ADD) {
1980 NTSTATUS status;
1981
1982 r2.in.handle = &state->handle->wire_handle;
1983 r2.in.sid = sid;
1984 r2.out.rights = talloc(mem_ctx, struct lsa_RightSet);
1985
1986 status = dcesrv_lsa_EnumAccountRights(dce_call, mem_ctx, &r2);
1987 if (!NT_STATUS_IS_OK(status)) {
1988 ZERO_STRUCTP(r2.out.rights);
1989 }
1990 }
1991
1992 for (i=0;i<rights->count;i++) {
1993 if (sec_privilege_id(rights->names[i].string) == -1) {
1994 talloc_free(msg);
1995 return NT_STATUS_NO_SUCH_PRIVILEGE;
1996 }
1997
1998 if (ldb_flag == LDB_FLAG_MOD_ADD) {
1999 uint32_t j;
2000 for (j=0;j<r2.out.rights->count;j++) {
2001 if (strcasecmp_m(r2.out.rights->names[j].string,
2002 rights->names[i].string) == 0) {
2003 break;
2004 }
2005 }
2006 if (j != r2.out.rights->count) continue;
2007 }
2008
2009 ret = ldb_msg_add_string(msg, "privilege", rights->names[i].string);
2010 if (ret != LDB_SUCCESS) {
2011 talloc_free(msg);
2012 return NT_STATUS_NO_MEMORY;
2013 }
2014 }
2015
2016 el = ldb_msg_find_element(msg, "privilege");
2017 if (!el) {
2018 talloc_free(msg);
2019 return NT_STATUS_OK;
2020 }
2021
2022 el->flags = ldb_flag;
2023
2024 ret = ldb_modify(state->pdb, msg);
2025 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2026 if (samdb_msg_add_dom_sid(state->pdb, msg, msg, "objectSid", sid) != LDB_SUCCESS) {
2027 talloc_free(msg);
2028 return NT_STATUS_NO_MEMORY;
2029 }
2030 samdb_msg_add_string(state->pdb, msg, msg, "comment", "added via LSA");
2031 ret = ldb_add(state->pdb, msg);
2032 }
2033 if (ret != LDB_SUCCESS) {
2034 if (ldb_flag == LDB_FLAG_MOD_DELETE && ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
2035 talloc_free(msg);
2036 return NT_STATUS_OK;
2037 }
2038 DEBUG(3, ("Could not %s attributes from %s: %s",
2039 ldb_flag == LDB_FLAG_MOD_DELETE ? "delete" : "add",
2040 ldb_dn_get_linearized(msg->dn), ldb_errstring(state->pdb)));
2041 talloc_free(msg);
2042 return NT_STATUS_UNEXPECTED_IO_ERROR;
2043 }
2044
2045 talloc_free(msg);
2046 return NT_STATUS_OK;
2047 }
2048
2049 /*
2050 lsa_AddPrivilegesToAccount
2051 */
2052 static NTSTATUS dcesrv_lsa_AddPrivilegesToAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2053 struct lsa_AddPrivilegesToAccount *r)
2054 {
2055 struct lsa_RightSet rights;
2056 struct dcesrv_handle *h;
2057 struct lsa_account_state *astate;
2058 uint32_t i;
2059
2060 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
2061
2062 astate = h->data;
2063
2064 rights.count = r->in.privs->count;
2065 rights.names = talloc_array(mem_ctx, struct lsa_StringLarge, rights.count);
2066 if (rights.names == NULL) {
2067 return NT_STATUS_NO_MEMORY;
2068 }
2069 for (i=0;i<rights.count;i++) {
2070 int id = r->in.privs->set[i].luid.low;
2071 if (r->in.privs->set[i].luid.high) {
2072 return NT_STATUS_NO_SUCH_PRIVILEGE;
2073 }
2074 rights.names[i].string = sec_privilege_name(id);
2075 if (rights.names[i].string == NULL) {
2076 return NT_STATUS_NO_SUCH_PRIVILEGE;
2077 }
2078 }
2079
2080 return dcesrv_lsa_AddRemoveAccountRights(dce_call, mem_ctx, astate->policy,
2081 LDB_FLAG_MOD_ADD, astate->account_sid,
2082 &rights);
2083 }
2084
2085
2086 /*
2087 lsa_RemovePrivilegesFromAccount
2088 */
2089 static NTSTATUS dcesrv_lsa_RemovePrivilegesFromAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2090 struct lsa_RemovePrivilegesFromAccount *r)
2091 {
2092 struct lsa_RightSet *rights;
2093 struct dcesrv_handle *h;
2094 struct lsa_account_state *astate;
2095 uint32_t i;
2096
2097 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
2098
2099 astate = h->data;
2100
2101 rights = talloc(mem_ctx, struct lsa_RightSet);
2102
2103 if (r->in.remove_all == 1 &&
2104 r->in.privs == NULL) {
2105 struct lsa_EnumAccountRights r2;
2106 NTSTATUS status;
2107
2108 r2.in.handle = &astate->policy->handle->wire_handle;
2109 r2.in.sid = astate->account_sid;
2110 r2.out.rights = rights;
2111
2112 status = dcesrv_lsa_EnumAccountRights(dce_call, mem_ctx, &r2);
2113 if (!NT_STATUS_IS_OK(status)) {
2114 return status;
2115 }
2116
2117 return dcesrv_lsa_AddRemoveAccountRights(dce_call, mem_ctx, astate->policy,
2118 LDB_FLAG_MOD_DELETE, astate->account_sid,
2119 r2.out.rights);
2120 }
2121
2122 if (r->in.remove_all != 0) {
2123 return NT_STATUS_INVALID_PARAMETER;
2124 }
2125
2126 rights->count = r->in.privs->count;
2127 rights->names = talloc_array(mem_ctx, struct lsa_StringLarge, rights->count);
2128 if (rights->names == NULL) {
2129 return NT_STATUS_NO_MEMORY;
2130 }
2131 for (i=0;i<rights->count;i++) {
2132 int id = r->in.privs->set[i].luid.low;
2133 if (r->in.privs->set[i].luid.high) {
2134 return NT_STATUS_NO_SUCH_PRIVILEGE;
2135 }
2136 rights->names[i].string = sec_privilege_name(id);
2137 if (rights->names[i].string == NULL) {
2138 return NT_STATUS_NO_SUCH_PRIVILEGE;
2139 }
2140 }
2141
2142 return dcesrv_lsa_AddRemoveAccountRights(dce_call, mem_ctx, astate->policy,
2143 LDB_FLAG_MOD_DELETE, astate->account_sid,
2144 rights);
2145 }
2146
2147
2148 /*
2149 lsa_GetQuotasForAccount
2150 */
2151 static NTSTATUS dcesrv_lsa_GetQuotasForAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2152 struct lsa_GetQuotasForAccount *r)
2153 {
2154 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2155 }
2156
2157
2158 /*
2159 lsa_SetQuotasForAccount
2160 */
2161 static NTSTATUS dcesrv_lsa_SetQuotasForAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2162 struct lsa_SetQuotasForAccount *r)
2163 {
2164 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2165 }
2166
2167
2168 /*
2169 lsa_GetSystemAccessAccount
2170 */
2171 static NTSTATUS dcesrv_lsa_GetSystemAccessAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2172 struct lsa_GetSystemAccessAccount *r)
2173 {
2174 uint32_t i;
2175 NTSTATUS status;
2176 struct lsa_EnumPrivsAccount enumPrivs;
2177 struct lsa_PrivilegeSet *privs;
2178
2179 privs = talloc(mem_ctx, struct lsa_PrivilegeSet);
2180 if (!privs) {
2181 return NT_STATUS_NO_MEMORY;
2182 }
2183 privs->count = 0;
2184 privs->unknown = 0;
2185 privs->set = NULL;
2186
2187 enumPrivs.in.handle = r->in.handle;
2188 enumPrivs.out.privs = &privs;
2189
2190 status = dcesrv_lsa_EnumPrivsAccount(dce_call, mem_ctx, &enumPrivs);
2191 if (!NT_STATUS_IS_OK(status)) {
2192 return status;
2193 }
2194
2195 *(r->out.access_mask) = 0x00000000;
2196
2197 for (i = 0; i < privs->count; i++) {
2198 int priv = privs->set[i].luid.low;
2199
2200 switch (priv) {
2201 case SEC_PRIV_INTERACTIVE_LOGON:
2202 *(r->out.access_mask) |= LSA_POLICY_MODE_INTERACTIVE;
2203 break;
2204 case SEC_PRIV_NETWORK_LOGON:
2205 *(r->out.access_mask) |= LSA_POLICY_MODE_NETWORK;
2206 break;
2207 case SEC_PRIV_REMOTE_INTERACTIVE_LOGON:
2208 *(r->out.access_mask) |= LSA_POLICY_MODE_REMOTE_INTERACTIVE;
2209 break;
2210 }
2211 }
2212
2213 return NT_STATUS_OK;
2214 }
2215
2216
2217 /*
2218 lsa_SetSystemAccessAccount
2219 */
2220 static NTSTATUS dcesrv_lsa_SetSystemAccessAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2221 struct lsa_SetSystemAccessAccount *r)
2222 {
2223 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2224 }
2225
2226
2227 /*
2228 lsa_CreateSecret
2229 */
2230 static NTSTATUS dcesrv_lsa_CreateSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2231 struct lsa_CreateSecret *r)
2232 {
2233 struct dcesrv_handle *policy_handle;
2234 struct lsa_policy_state *policy_state;
2235 struct lsa_secret_state *secret_state;
2236 struct dcesrv_handle *handle;
2237 struct ldb_message **msgs, *msg;
2238 const char *attrs[] = {
2239 NULL
2240 };
2241
2242 const char *name;
2243
2244 int ret;
2245
2246 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
2247 ZERO_STRUCTP(r->out.sec_handle);
2248
2249 switch (security_session_user_level(dce_call->conn->auth_state.session_info))
2250 {
2251 case SECURITY_SYSTEM:
2252 case SECURITY_ADMINISTRATOR:
2253 break;
2254 default:
2255 /* Users and annonymous are not allowed create secrets */
2256 return NT_STATUS_ACCESS_DENIED;
2257 }
2258
2259 policy_state = policy_handle->data;
2260
2261 if (!r->in.name.string) {
2262 return NT_STATUS_INVALID_PARAMETER;
2263 }
2264
2265 secret_state = talloc(mem_ctx, struct lsa_secret_state);
2266 if (!secret_state) {
2267 return NT_STATUS_NO_MEMORY;
2268 }
2269 secret_state->policy = policy_state;
2270
2271 msg = ldb_msg_new(mem_ctx);
2272 if (msg == NULL) {
2273 return NT_STATUS_NO_MEMORY;
2274 }
2275
2276 if (strncmp("G$", r->in.name.string, 2) == 0) {
2277 const char *name2;
2278 name = &r->in.name.string[2];
2279 /* We need to connect to the database as system, as this is one of the rare RPC calls that must read the secrets (and this is denied otherwise) */
2280 secret_state->sam_ldb = talloc_reference(secret_state,
2281 samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx)));
2282 secret_state->global = true;
2283
2284 if (strlen(name) < 1) {
2285 return NT_STATUS_INVALID_PARAMETER;
2286 }
2287
2288 name2 = talloc_asprintf(mem_ctx, "%s Secret", ldb_binary_encode_string(mem_ctx, name));
2289 /* search for the secret record */
2290 ret = gendb_search(secret_state->sam_ldb,
2291 mem_ctx, policy_state->system_dn, &msgs, attrs,
2292 "(&(cn=%s)(objectclass=secret))",
2293 name2);
2294 if (ret > 0) {
2295 return NT_STATUS_OBJECT_NAME_COLLISION;
2296 }
2297
2298 if (ret == -1) {
2299 DEBUG(0,("Failure searching for CN=%s: %s\n",
2300 name2, ldb_errstring(secret_state->sam_ldb)));
2301 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2302 }
2303
2304 msg->dn = ldb_dn_copy(mem_ctx, policy_state->system_dn);
2305 if (!name2 || ! ldb_dn_add_child_fmt(msg->dn, "cn=%s", name2)) {
2306 return NT_STATUS_NO_MEMORY;
2307 }
2308
2309 samdb_msg_add_string(secret_state->sam_ldb, mem_ctx, msg, "cn", name2);
2310
2311 } else {
2312 secret_state->global = false;
2313
2314 name = r->in.name.string;
2315 if (strlen(name) < 1) {
2316 return NT_STATUS_INVALID_PARAMETER;
2317 }
2318
2319 secret_state->sam_ldb = talloc_reference(secret_state,
2320 secrets_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx));
2321 /* search for the secret record */
2322 ret = gendb_search(secret_state->sam_ldb, mem_ctx,
2323 ldb_dn_new(mem_ctx, secret_state->sam_ldb, "cn=LSA Secrets"),
2324 &msgs, attrs,
2325 "(&(cn=%s)(objectclass=secret))",
2326 ldb_binary_encode_string(mem_ctx, name));
2327 if (ret > 0) {
2328 return NT_STATUS_OBJECT_NAME_COLLISION;
2329 }
2330
2331 if (ret == -1) {
2332 DEBUG(0,("Failure searching for CN=%s: %s\n",
2333 name, ldb_errstring(secret_state->sam_ldb)));
2334 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2335 }
2336
2337 msg->dn = ldb_dn_new_fmt(mem_ctx, secret_state->sam_ldb, "cn=%s,cn=LSA Secrets", name);
2338 samdb_msg_add_string(secret_state->sam_ldb, mem_ctx, msg, "cn", name);
2339 }
2340
2341 samdb_msg_add_string(secret_state->sam_ldb, mem_ctx, msg, "objectClass", "secret");
2342
2343 secret_state->secret_dn = talloc_reference(secret_state, msg->dn);
2344
2345 /* create the secret */
2346 ret = ldb_add(secret_state->sam_ldb, msg);
2347 if (ret != LDB_SUCCESS) {
2348 DEBUG(0,("Failed to create secret record %s: %s\n",
2349 ldb_dn_get_linearized(msg->dn),
2350 ldb_errstring(secret_state->sam_ldb)));
2351 return NT_STATUS_ACCESS_DENIED;
2352 }
2353
2354 handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_SECRET);
2355 if (!handle) {
2356 return NT_STATUS_NO_MEMORY;
2357 }
2358
2359 handle->data = talloc_steal(handle, secret_state);
2360
2361 secret_state->access_mask = r->in.access_mask;
2362 secret_state->policy = talloc_reference(secret_state, policy_state);
2363
2364 *r->out.sec_handle = handle->wire_handle;
2365
2366 return NT_STATUS_OK;
2367 }
2368
2369
2370 /*
2371 lsa_OpenSecret
2372 */
2373 static NTSTATUS dcesrv_lsa_OpenSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2374 struct lsa_OpenSecret *r)
2375 {
2376 struct dcesrv_handle *policy_handle;
2377
2378 struct lsa_policy_state *policy_state;
2379 struct lsa_secret_state *secret_state;
2380 struct dcesrv_handle *handle;
2381 struct ldb_message **msgs;
2382 const char *attrs[] = {
2383 NULL
2384 };
2385
2386 const char *name;
2387
2388 int ret;
2389
2390 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
2391 ZERO_STRUCTP(r->out.sec_handle);
2392 policy_state = policy_handle->data;
2393
2394 if (!r->in.name.string) {
2395 return NT_STATUS_INVALID_PARAMETER;
2396 }
2397
2398 switch (security_session_user_level(dce_call->conn->auth_state.session_info))
2399 {
2400 case SECURITY_SYSTEM:
2401 case SECURITY_ADMINISTRATOR:
2402 break;
2403 default:
2404 /* Users and annonymous are not allowed to access secrets */
2405 return NT_STATUS_ACCESS_DENIED;
2406 }
2407
2408 secret_state = talloc(mem_ctx, struct lsa_secret_state);
2409 if (!secret_state) {
2410 return NT_STATUS_NO_MEMORY;
2411 }
2412 secret_state->policy = policy_state;
2413
2414 if (strncmp("G$", r->in.name.string, 2) == 0) {
2415 name = &r->in.name.string[2];
2416 /* We need to connect to the database as system, as this is one of the rare RPC calls that must read the secrets (and this is denied otherwise) */
2417 secret_state->sam_ldb = talloc_reference(secret_state,
2418 samdb_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx, system_session(dce_call->conn->dce_ctx->lp_ctx)));
2419 secret_state->global = true;
2420
2421 if (strlen(name) < 1) {
2422 return NT_STATUS_INVALID_PARAMETER;
2423 }
2424
2425 /* search for the secret record */
2426 ret = gendb_search(secret_state->sam_ldb,
2427 mem_ctx, policy_state->system_dn, &msgs, attrs,
2428 "(&(cn=%s Secret)(objectclass=secret))",
2429 ldb_binary_encode_string(mem_ctx, name));
2430 if (ret == 0) {
2431 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2432 }
2433
2434 if (ret != 1) {
2435 DEBUG(0,("Found %d records matching DN %s\n", ret,
2436 ldb_dn_get_linearized(policy_state->system_dn)));
2437 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2438 }
2439
2440 } else {
2441 secret_state->global = false;
2442 secret_state->sam_ldb = talloc_reference(secret_state,
2443 secrets_db_connect(mem_ctx, dce_call->event_ctx, dce_call->conn->dce_ctx->lp_ctx));
2444
2445 name = r->in.name.string;
2446 if (strlen(name) < 1) {
2447 return NT_STATUS_INVALID_PARAMETER;
2448 }
2449
2450 /* search for the secret record */
2451 ret = gendb_search(secret_state->sam_ldb, mem_ctx,
2452 ldb_dn_new(mem_ctx, secret_state->sam_ldb, "cn=LSA Secrets"),
2453 &msgs, attrs,
2454 "(&(cn=%s)(objectclass=secret))",
2455 ldb_binary_encode_string(mem_ctx, name));
2456 if (ret == 0) {
2457 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2458 }
2459
2460 if (ret != 1) {
2461 DEBUG(0,("Found %d records matching CN=%s\n",
2462 ret, ldb_binary_encode_string(mem_ctx, name)));
2463 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2464 }
2465 }
2466
2467 secret_state->secret_dn = talloc_reference(secret_state, msgs[0]->dn);
2468
2469 handle = dcesrv_handle_new(dce_call->context, LSA_HANDLE_SECRET);
2470 if (!handle) {
2471 return NT_STATUS_NO_MEMORY;
2472 }
2473
2474 handle->data = talloc_steal(handle, secret_state);
2475
2476 secret_state->access_mask = r->in.access_mask;
2477 secret_state->policy = talloc_reference(secret_state, policy_state);
2478
2479 *r->out.sec_handle = handle->wire_handle;
2480
2481 return NT_STATUS_OK;
2482 }
2483
2484
2485 /*
2486 lsa_SetSecret
2487 */
2488 static NTSTATUS dcesrv_lsa_SetSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2489 struct lsa_SetSecret *r)
2490 {
2491
2492 struct dcesrv_handle *h;
2493 struct lsa_secret_state *secret_state;
2494 struct ldb_message *msg;
2495 DATA_BLOB session_key;
2496 DATA_BLOB crypt_secret, secret;
2497 struct ldb_val val;
2498 int ret;
2499 NTSTATUS status = NT_STATUS_OK;
2500
2501 struct timeval now = timeval_current();
2502 NTTIME nt_now = timeval_to_nttime(&now);
2503
2504 DCESRV_PULL_HANDLE(h, r->in.sec_handle, LSA_HANDLE_SECRET);
2505
2506 secret_state = h->data;
2507
2508 msg = ldb_msg_new(mem_ctx);
2509 if (msg == NULL) {
2510 return NT_STATUS_NO_MEMORY;
2511 }
2512
2513 msg->dn = talloc_reference(mem_ctx, secret_state->secret_dn);
2514 if (!msg->dn) {
2515 return NT_STATUS_NO_MEMORY;
2516 }
2517 status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
2518 if (!NT_STATUS_IS_OK(status)) {
2519 return status;
2520 }
2521
2522 if (r->in.old_val) {
2523 /* Decrypt */
2524 crypt_secret.data = r->in.old_val->data;
2525 crypt_secret.length = r->in.old_val->size;
2526
2527 status = sess_decrypt_blob(mem_ctx, &crypt_secret, &session_key, &secret);
2528 if (!NT_STATUS_IS_OK(status)) {
2529 return status;
2530 }
2531
2532 val.data = secret.data;
2533 val.length = secret.length;
2534
2535 /* set value */
2536 if (samdb_msg_add_value(secret_state->sam_ldb,
2537 mem_ctx, msg, "priorValue", &val) != LDB_SUCCESS) {
2538 return NT_STATUS_NO_MEMORY;
2539 }
2540
2541 /* set old value mtime */
2542 if (samdb_msg_add_uint64(secret_state->sam_ldb,
2543 mem_ctx, msg, "priorSetTime", nt_now) != LDB_SUCCESS) {
2544 return NT_STATUS_NO_MEMORY;
2545 }
2546
2547 } else {
2548 /* If the old value is not set, then migrate the
2549 * current value to the old value */
2550 const struct ldb_val *old_val;
2551 NTTIME last_set_time;
2552 struct ldb_message **res;
2553 const char *attrs[] = {
2554 "currentValue",
2555 "lastSetTime",
2556 NULL
2557 };
2558
2559 /* search for the secret record */
2560 ret = gendb_search_dn(secret_state->sam_ldb,mem_ctx,
2561 secret_state->secret_dn, &res, attrs);
2562 if (ret == 0) {
2563 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2564 }
2565
2566 if (ret != 1) {
2567 DEBUG(0,("Found %d records matching dn=%s\n", ret,
2568 ldb_dn_get_linearized(secret_state->secret_dn)));
2569 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2570 }
2571
2572 old_val = ldb_msg_find_ldb_val(res[0], "currentValue");
2573 last_set_time = ldb_msg_find_attr_as_uint64(res[0], "lastSetTime", 0);
2574
2575 if (old_val) {
2576 /* set old value */
2577 if (samdb_msg_add_value(secret_state->sam_ldb,
2578 mem_ctx, msg, "priorValue",
2579 old_val) != 0) {
2580 return NT_STATUS_NO_MEMORY;
2581 }
2582 } else {
2583 if (samdb_msg_add_delete(secret_state->sam_ldb,
2584 mem_ctx, msg, "priorValue")) {
2585 return NT_STATUS_NO_MEMORY;
2586 }
2587
2588 }
2589
2590 /* set old value mtime */
2591 if (ldb_msg_find_ldb_val(res[0], "lastSetTime")) {
2592 if (samdb_msg_add_uint64(secret_state->sam_ldb,
2593 mem_ctx, msg, "priorSetTime", last_set_time) != LDB_SUCCESS) {
2594 return NT_STATUS_NO_MEMORY;
2595 }
2596 } else {
2597 if (samdb_msg_add_uint64(secret_state->sam_ldb,
2598 mem_ctx, msg, "priorSetTime", nt_now) != LDB_SUCCESS) {
2599 return NT_STATUS_NO_MEMORY;
2600 }
2601 }
2602 }
2603
2604 if (r->in.new_val) {
2605 /* Decrypt */
2606 crypt_secret.data = r->in.new_val->data;
2607 crypt_secret.length = r->in.new_val->size;
2608
2609 status = sess_decrypt_blob(mem_ctx, &crypt_secret, &session_key, &secret);
2610 if (!NT_STATUS_IS_OK(status)) {
2611 return status;
2612 }
2613
2614 val.data = secret.data;
2615 val.length = secret.length;
2616
2617 /* set value */
2618 if (samdb_msg_add_value(secret_state->sam_ldb,
2619 mem_ctx, msg, "currentValue", &val) != LDB_SUCCESS) {
2620 return NT_STATUS_NO_MEMORY;
2621 }
2622
2623 /* set new value mtime */
2624 if (samdb_msg_add_uint64(secret_state->sam_ldb,
2625 mem_ctx, msg, "lastSetTime", nt_now) != LDB_SUCCESS) {
2626 return NT_STATUS_NO_MEMORY;
2627 }
2628
2629 } else {
2630 /* NULL out the NEW value */
2631 if (samdb_msg_add_uint64(secret_state->sam_ldb,
2632 mem_ctx, msg, "lastSetTime", nt_now) != LDB_SUCCESS) {
2633 return NT_STATUS_NO_MEMORY;
2634 }
2635 if (samdb_msg_add_delete(secret_state->sam_ldb,
2636 mem_ctx, msg, "currentValue") != LDB_SUCCESS) {
2637 return NT_STATUS_NO_MEMORY;
2638 }
2639 }
2640
2641 /* modify the samdb record */
2642 ret = dsdb_replace(secret_state->sam_ldb, msg, 0);
2643 if (ret != LDB_SUCCESS) {
2644 /* we really need samdb.c to return NTSTATUS */
2645 return NT_STATUS_UNSUCCESSFUL;
2646 }
2647
2648 return NT_STATUS_OK;
2649 }
2650
2651
2652 /*
2653 lsa_QuerySecret
2654 */
2655 static NTSTATUS dcesrv_lsa_QuerySecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2656 struct lsa_QuerySecret *r)
2657 {
2658 struct dcesrv_handle *h;
2659 struct lsa_secret_state *secret_state;
2660 struct ldb_message *msg;
2661 DATA_BLOB session_key;
2662 DATA_BLOB crypt_secret, secret;
2663 int ret;
2664 struct ldb_message **res;
2665 const char *attrs[] = {
2666 "currentValue",
2667 "priorValue",
2668 "lastSetTime",
2669 "priorSetTime",
2670 NULL
2671 };
2672
2673 NTSTATUS nt_status;
2674
2675 DCESRV_PULL_HANDLE(h, r->in.sec_handle, LSA_HANDLE_SECRET);
2676
2677 /* Ensure user is permitted to read this... */
2678 switch (security_session_user_level(dce_call->conn->auth_state.session_info))
2679 {
2680 case SECURITY_SYSTEM:
2681 case SECURITY_ADMINISTRATOR:
2682 break;
2683 default:
2684 /* Users and annonymous are not allowed to read secrets */
2685 return NT_STATUS_ACCESS_DENIED;
2686 }
2687
2688 secret_state = h->data;
2689
2690 /* pull all the user attributes */
2691 ret = gendb_search_dn(secret_state->sam_ldb, mem_ctx,
2692 secret_state->secret_dn, &res, attrs);
2693 if (ret != 1) {
2694 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2695 }
2696 msg = res[0];
2697
2698 nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
2699 if (!NT_STATUS_IS_OK(nt_status)) {
2700 return nt_status;
2701 }
2702
2703 if (r->in.old_val) {
2704 const struct ldb_val *prior_val;
2705 r->out.old_val = talloc_zero(mem_ctx, struct lsa_DATA_BUF_PTR);
2706 if (!r->out.old_val) {
2707 return NT_STATUS_NO_MEMORY;
2708 }
2709 prior_val = ldb_msg_find_ldb_val(res[0], "priorValue");
2710
2711 if (prior_val && prior_val->length) {
2712 secret.data = prior_val->data;
2713 secret.length = prior_val->length;
2714
2715 /* Encrypt */
2716 crypt_secret = sess_encrypt_blob(mem_ctx, &secret, &session_key);
2717 if (!crypt_secret.length) {
2718 return NT_STATUS_NO_MEMORY;
2719 }
2720 r->out.old_val->buf = talloc(mem_ctx, struct lsa_DATA_BUF);
2721 if (!r->out.old_val->buf) {
2722 return NT_STATUS_NO_MEMORY;
2723 }
2724 r->out.old_val->buf->size = crypt_secret.length;
2725 r->out.old_val->buf->length = crypt_secret.length;
2726 r->out.old_val->buf->data = crypt_secret.data;
2727 }
2728 }
2729
2730 if (r->in.old_mtime) {
2731 r->out.old_mtime = talloc(mem_ctx, NTTIME);
2732 if (!r->out.old_mtime) {
2733 return NT_STATUS_NO_MEMORY;
2734 }
2735 *r->out.old_mtime = ldb_msg_find_attr_as_uint64(res[0], "priorSetTime", 0);
2736 }
2737
2738 if (r->in.new_val) {
2739 const struct ldb_val *new_val;
2740 r->out.new_val = talloc_zero(mem_ctx, struct lsa_DATA_BUF_PTR);
2741 if (!r->out.new_val) {
2742 return NT_STATUS_NO_MEMORY;
2743 }
2744
2745 new_val = ldb_msg_find_ldb_val(res[0], "currentValue");
2746
2747 if (new_val && new_val->length) {
2748 secret.data = new_val->data;
2749 secret.length = new_val->length;
2750
2751 /* Encrypt */
2752 crypt_secret = sess_encrypt_blob(mem_ctx, &secret, &session_key);
2753 if (!crypt_secret.length) {
2754 return NT_STATUS_NO_MEMORY;
2755 }
2756 r->out.new_val->buf = talloc(mem_ctx, struct lsa_DATA_BUF);
2757 if (!r->out.new_val->buf) {
2758 return NT_STATUS_NO_MEMORY;
2759 }
2760 r->out.new_val->buf->length = crypt_secret.length;
2761 r->out.new_val->buf->size = crypt_secret.length;
2762 r->out.new_val->buf->data = crypt_secret.data;
2763 }
2764 }
2765
2766 if (r->in.new_mtime) {
2767 r->out.new_mtime = talloc(mem_ctx, NTTIME);
2768 if (!r->out.new_mtime) {
2769 return NT_STATUS_NO_MEMORY;
2770 }
2771 *r->out.new_mtime = ldb_msg_find_attr_as_uint64(res[0], "lastSetTime", 0);
2772 }
2773
2774 return NT_STATUS_OK;
2775 }
2776
2777
2778 /*
2779 lsa_LookupPrivValue
2780 */
2781 static NTSTATUS dcesrv_lsa_LookupPrivValue(struct dcesrv_call_state *dce_call,
2782 TALLOC_CTX *mem_ctx,
2783 struct lsa_LookupPrivValue *r)
2784 {
2785 struct dcesrv_handle *h;
2786 struct lsa_policy_state *state;
2787 int id;
2788
2789 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
2790
2791 state = h->data;
2792
2793 id = sec_privilege_id(r->in.name->string);
2794 if (id == -1) {
2795 return NT_STATUS_NO_SUCH_PRIVILEGE;
2796 }
2797
2798 r->out.luid->low = id;
2799 r->out.luid->high = 0;
2800
2801 return NT_STATUS_OK;
2802 }
2803
2804
2805 /*
2806 lsa_LookupPrivName
2807 */
2808 static NTSTATUS dcesrv_lsa_LookupPrivName(struct dcesrv_call_state *dce_call,
2809 TALLOC_CTX *mem_ctx,
2810 struct lsa_LookupPrivName *r)
2811 {
2812 struct dcesrv_handle *h;
2813 struct lsa_policy_state *state;
2814 struct lsa_StringLarge *name;
2815 const char *privname;
2816
2817 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
2818
2819 state = h->data;
2820
2821 if (r->in.luid->high != 0) {
2822 return NT_STATUS_NO_SUCH_PRIVILEGE;
2823 }
2824
2825 privname = sec_privilege_name(r->in.luid->low);
2826 if (privname == NULL) {
2827 return NT_STATUS_NO_SUCH_PRIVILEGE;
2828 }
2829
2830 name = talloc(mem_ctx, struct lsa_StringLarge);
2831 if (name == NULL) {
2832 return NT_STATUS_NO_MEMORY;
2833 }
2834
2835 name->string = privname;
2836
2837 *r->out.name = name;
2838
2839 return NT_STATUS_OK;
2840 }
2841
2842
2843 /*
2844 lsa_LookupPrivDisplayName
2845 */
2846 static NTSTATUS dcesrv_lsa_LookupPrivDisplayName(struct dcesrv_call_state *dce_call,
2847 TALLOC_CTX *mem_ctx,
2848 struct lsa_LookupPrivDisplayName *r)
2849 {
2850 struct dcesrv_handle *h;
2851 struct lsa_policy_state *state;
2852 struct lsa_StringLarge *disp_name = NULL;
2853 int id;
2854
2855 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
2856
2857 state = h->data;
2858
2859 id = sec_privilege_id(r->in.name->string);
2860 if (id == -1) {
2861 return NT_STATUS_NO_SUCH_PRIVILEGE;
2862 }
2863
2864 disp_name = talloc(mem_ctx, struct lsa_StringLarge);
2865 if (disp_name == NULL) {
2866 return NT_STATUS_NO_MEMORY;
2867 }
2868
2869 disp_name->string = sec_privilege_display_name(id, &r->in.language_id);
2870 if (disp_name->string == NULL) {
2871 return NT_STATUS_INTERNAL_ERROR;
2872 }
2873
2874 *r->out.disp_name = disp_name;
2875 *r->out.returned_language_id = 0;
2876
2877 return NT_STATUS_OK;
2878 }
2879
2880
2881 /*
2882 lsa_EnumAccountsWithUserRight
2883 */
2884 static NTSTATUS dcesrv_lsa_EnumAccountsWithUserRight(struct dcesrv_call_state *dce_call,
2885 TALLOC_CTX *mem_ctx,
2886 struct lsa_EnumAccountsWithUserRight *r)
2887 {
2888 struct dcesrv_handle *h;
2889 struct lsa_policy_state *state;
2890 int ret, i;
2891 struct ldb_message **res;
2892 const char * const attrs[] = { "objectSid", NULL};
2893 const char *privname;
2894
2895 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
2896
2897 state = h->data;
2898
2899 if (r->in.name == NULL) {
2900 return NT_STATUS_NO_SUCH_PRIVILEGE;
2901 }
2902
2903 privname = r->in.name->string;
2904 if (sec_privilege_id(privname) == -1) {
2905 return NT_STATUS_NO_SUCH_PRIVILEGE;
2906 }
2907
2908 ret = gendb_search(state->pdb, mem_ctx, NULL, &res, attrs,
2909 "privilege=%s", privname);
2910 if (ret == -1) {
2911 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2912 }
2913 if (ret == 0) {
2914 return NT_STATUS_NO_MORE_ENTRIES;
2915 }
2916
2917 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_SidPtr, ret);
2918 if (r->out.sids->sids == NULL) {
2919 return NT_STATUS_NO_MEMORY;
2920 }
2921 for (i=0;i<ret;i++) {
2922 r->out.sids->sids[i].sid = samdb_result_dom_sid(r->out.sids->sids,
2923 res[i], "objectSid");
2924 NT_STATUS_HAVE_NO_MEMORY(r->out.sids->sids[i].sid);
2925 }
2926 r->out.sids->num_sids = ret;
2927
2928 return NT_STATUS_OK;
2929 }
2930
2931
2932 /*
2933 lsa_AddAccountRights
2934 */
2935 static NTSTATUS dcesrv_lsa_AddAccountRights(struct dcesrv_call_state *dce_call,
2936 TALLOC_CTX *mem_ctx,
2937 struct lsa_AddAccountRights *r)
2938 {
2939 struct dcesrv_handle *h;
2940 struct lsa_policy_state *state;
2941
2942 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
2943
2944 state = h->data;
2945
2946 return dcesrv_lsa_AddRemoveAccountRights(dce_call, mem_ctx, state,
2947 LDB_FLAG_MOD_ADD,
2948 r->in.sid, r->in.rights);
2949 }
2950
2951
2952 /*
2953 lsa_RemoveAccountRights
2954 */
2955 static NTSTATUS dcesrv_lsa_RemoveAccountRights(struct dcesrv_call_state *dce_call,
2956 TALLOC_CTX *mem_ctx,
2957 struct lsa_RemoveAccountRights *r)
2958 {
2959 struct dcesrv_handle *h;
2960 struct lsa_policy_state *state;
2961
2962 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
2963
2964 state = h->data;
2965
2966 return dcesrv_lsa_AddRemoveAccountRights(dce_call, mem_ctx, state,
2967 LDB_FLAG_MOD_DELETE,
2968 r->in.sid, r->in.rights);
2969 }
2970
2971
2972 /*
2973 lsa_StorePrivateData
2974 */
2975 static NTSTATUS dcesrv_lsa_StorePrivateData(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2976 struct lsa_StorePrivateData *r)
2977 {
2978 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2979 }
2980
2981
2982 /*
2983 lsa_RetrievePrivateData
2984 */
2985 static NTSTATUS dcesrv_lsa_RetrievePrivateData(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2986 struct lsa_RetrievePrivateData *r)
2987 {
2988 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2989 }
2990
2991
2992 /*
2993 lsa_GetUserName
2994 */
2995 static NTSTATUS dcesrv_lsa_GetUserName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2996 struct lsa_GetUserName *r)
2997 {
2998 NTSTATUS status = NT_STATUS_OK;
2999 const char *account_name;
3000 const char *authority_name;
3001 struct lsa_String *_account_name;
3002 struct lsa_String *_authority_name = NULL;
3003
3004 /* this is what w2k3 does */
3005 r->out.account_name = r->in.account_name;
3006 r->out.authority_name = r->in.authority_name;
3007
3008 if (r->in.account_name
3009 && *r->in.account_name
3010 /* && *(*r->in.account_name)->string */
3011 ) {
3012 return NT_STATUS_INVALID_PARAMETER;
3013 }
3014
3015 if (r->in.authority_name
3016 && *r->in.authority_name
3017 /* && *(*r->in.authority_name)->string */
3018 ) {
3019 return NT_STATUS_INVALID_PARAMETER;
3020 }
3021
3022 account_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->server_info->account_name);
3023 authority_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->server_info->domain_name);
3024
3025 _account_name = talloc(mem_ctx, struct lsa_String);
3026 NT_STATUS_HAVE_NO_MEMORY(_account_name);
3027 _account_name->string = account_name;
3028
3029 if (r->in.authority_name) {
3030 _authority_name = talloc(mem_ctx, struct lsa_String);
3031 NT_STATUS_HAVE_NO_MEMORY(_authority_name);
3032 _authority_name->string = authority_name;
3033 }
3034
3035 *r->out.account_name = _account_name;
3036 if (r->out.authority_name) {
3037 *r->out.authority_name = _authority_name;
3038 }
3039
3040 return status;
3041 }
3042
3043 /*
3044 lsa_SetInfoPolicy2
3045 */
3046 static NTSTATUS dcesrv_lsa_SetInfoPolicy2(struct dcesrv_call_state *dce_call,
3047 TALLOC_CTX *mem_ctx,
3048 struct lsa_SetInfoPolicy2 *r)
3049 {
3050 /* need to support these */
3051 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3052 }
3053
3054 /*
3055 lsa_QueryDomainInformationPolicy
3056 */
3057 static NTSTATUS dcesrv_lsa_QueryDomainInformationPolicy(struct dcesrv_call_state *dce_call,
3058 TALLOC_CTX *mem_ctx,
3059 struct lsa_QueryDomainInformationPolicy *r)
3060 {
3061 union lsa_DomainInformationPolicy *info;
3062
3063 info = talloc(r->out.info, union lsa_DomainInformationPolicy);
3064 if (!info) {
3065 return NT_STATUS_NO_MEMORY;
3066 }
3067
3068 switch (r->in.level) {
3069 case LSA_DOMAIN_INFO_POLICY_EFS:
3070 talloc_free(info);
3071 *r->out.info = NULL;
3072 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3073 case LSA_DOMAIN_INFO_POLICY_KERBEROS:
3074 {
3075 struct lsa_DomainInfoKerberos *k = &info->kerberos_info;
3076 struct smb_krb5_context *smb_krb5_context;
3077 int ret = smb_krb5_init_context(mem_ctx,
3078 dce_call->event_ctx,
3079 dce_call->conn->dce_ctx->lp_ctx,
3080 &smb_krb5_context);
3081 if (ret != 0) {
3082 talloc_free(info);
3083 *r->out.info = NULL;
3084 return NT_STATUS_INTERNAL_ERROR;
3085 }
3086 k->enforce_restrictions = 0; /* FIXME, details missing from MS-LSAD 2.2.53 */
3087 k->service_tkt_lifetime = 0; /* Need to find somewhere to store this, and query in KDC too */
3088 k->user_tkt_lifetime = 0; /* Need to find somewhere to store this, and query in KDC too */
3089 k->user_tkt_renewaltime = 0; /* Need to find somewhere to store this, and query in KDC too */
3090 k->clock_skew = krb5_get_max_time_skew(smb_krb5_context->krb5_context);
3091 talloc_free(smb_krb5_context);
3092 *r->out.info = info;
3093 return NT_STATUS_OK;
3094 }
3095 default:
3096 talloc_free(info);
3097 *r->out.info = NULL;
3098 return NT_STATUS_INVALID_INFO_CLASS;
3099 }
3100 }
3101
3102 /*
3103 lsa_SetDomInfoPolicy
3104 */
3105 static NTSTATUS dcesrv_lsa_SetDomainInformationPolicy(struct dcesrv_call_state *dce_call,
3106 TALLOC_CTX *mem_ctx,
3107 struct lsa_SetDomainInformationPolicy *r)
3108 {
3109 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3110 }
3111
3112 /*
3113 lsa_TestCall
3114 */
3115 static NTSTATUS dcesrv_lsa_TestCall(struct dcesrv_call_state *dce_call,
3116 TALLOC_CTX *mem_ctx,
3117 struct lsa_TestCall *r)
3118 {
3119 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3120 }
3121
3122 /*
3123 lsa_CREDRWRITE
3124 */
3125 static NTSTATUS dcesrv_lsa_CREDRWRITE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3126 struct lsa_CREDRWRITE *r)
3127 {
3128 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3129 }
3130
3131
3132 /*
3133 lsa_CREDRREAD
3134 */
3135 static NTSTATUS dcesrv_lsa_CREDRREAD(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3136 struct lsa_CREDRREAD *r)
3137 {
3138 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3139 }
3140
3141
3142 /*
3143 lsa_CREDRENUMERATE
3144 */
3145 static NTSTATUS dcesrv_lsa_CREDRENUMERATE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3146 struct lsa_CREDRENUMERATE *r)
3147 {
3148 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3149 }
3150
3151
3152 /*
3153 lsa_CREDRWRITEDOMAINCREDENTIALS
3154 */
3155 static NTSTATUS dcesrv_lsa_CREDRWRITEDOMAINCREDENTIALS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3156 struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
3157 {
3158 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3159 }
3160
3161
3162 /*
3163 lsa_CREDRREADDOMAINCREDENTIALS
3164 */
3165 static NTSTATUS dcesrv_lsa_CREDRREADDOMAINCREDENTIALS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3166 struct lsa_CREDRREADDOMAINCREDENTIALS *r)
3167 {
3168 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3169 }
3170
3171
3172 /*
3173 lsa_CREDRDELETE
3174 */
3175 static NTSTATUS dcesrv_lsa_CREDRDELETE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3176 struct lsa_CREDRDELETE *r)
3177 {
3178 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3179 }
3180
3181
3182 /*
3183 lsa_CREDRGETTARGETINFO
3184 */
3185 static NTSTATUS dcesrv_lsa_CREDRGETTARGETINFO(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3186 struct lsa_CREDRGETTARGETINFO *r)
3187 {
3188 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3189 }
3190
3191
3192 /*
3193 lsa_CREDRPROFILELOADED
3194 */
3195 static NTSTATUS dcesrv_lsa_CREDRPROFILELOADED(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3196 struct lsa_CREDRPROFILELOADED *r)
3197 {
3198 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3199 }
3200
3201
3202 /*
3203 lsa_CREDRGETSESSIONTYPES
3204 */
3205 static NTSTATUS dcesrv_lsa_CREDRGETSESSIONTYPES(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3206 struct lsa_CREDRGETSESSIONTYPES *r)
3207 {
3208 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3209 }
3210
3211
3212 /*
3213 lsa_LSARREGISTERAUDITEVENT
3214 */
3215 static NTSTATUS dcesrv_lsa_LSARREGISTERAUDITEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3216 struct lsa_LSARREGISTERAUDITEVENT *r)
3217 {
3218 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3219 }
3220
3221
3222 /*
3223 lsa_LSARGENAUDITEVENT
3224 */
3225 static NTSTATUS dcesrv_lsa_LSARGENAUDITEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3226 struct lsa_LSARGENAUDITEVENT *r)
3227 {
3228 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3229 }
3230
3231
3232 /*
3233 lsa_LSARUNREGISTERAUDITEVENT
3234 */
3235 static NTSTATUS dcesrv_lsa_LSARUNREGISTERAUDITEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3236 struct lsa_LSARUNREGISTERAUDITEVENT *r)
3237 {
3238 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3239 }
3240
3241
3242 /*
3243 lsa_lsaRQueryForestTrustInformation
3244 */
3245 static NTSTATUS dcesrv_lsa_lsaRQueryForestTrustInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3246 struct lsa_lsaRQueryForestTrustInformation *r)
3247 {
3248 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3249 }
3250
3251
3252 /*
3253 lsa_LSARSETFORESTTRUSTINFORMATION
3254 */
3255 static NTSTATUS dcesrv_lsa_LSARSETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3256 struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
3257 {
3258 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3259 }
3260
3261
3262 /*
3263 lsa_CREDRRENAME
3264 */
3265 static NTSTATUS dcesrv_lsa_CREDRRENAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3266 struct lsa_CREDRRENAME *r)
3267 {
3268 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3269 }
3270
3271
3272
3273 /*
3274 lsa_LSAROPENPOLICYSCE
3275 */
3276 static NTSTATUS dcesrv_lsa_LSAROPENPOLICYSCE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3277 struct lsa_LSAROPENPOLICYSCE *r)
3278 {
3279 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3280 }
3281
3282
3283 /*
3284 lsa_LSARADTREGISTERSECURITYEVENTSOURCE
3285 */
3286 static NTSTATUS dcesrv_lsa_LSARADTREGISTERSECURITYEVENTSOURCE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3287 struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
3288 {
3289 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3290 }
3291
3292
3293 /*
3294 lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE
3295 */
3296 static NTSTATUS dcesrv_lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3297 struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
3298 {
3299 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3300 }
3301
3302
3303 /*
3304 lsa_LSARADTREPORTSECURITYEVENT
3305 */
3306 static NTSTATUS dcesrv_lsa_LSARADTREPORTSECURITYEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3307 struct lsa_LSARADTREPORTSECURITYEVENT *r)
3308 {
3309 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3310 }
3311
3312
3313 /* include the generated boilerplate */
3314 #include "librpc/gen_ndr/ndr_lsa_s.c"
3315
3316
3317
3318 /*****************************************
3319 NOTE! The remaining calls below were
3320 removed in w2k3, so the DCESRV_FAULT()
3321 replies are the correct implementation. Do
3322 not try and fill these in with anything else
3323 ******************************************/
3324
3325 /*
3326 dssetup_DsRoleDnsNameToFlatName
3327 */
3328 static WERROR dcesrv_dssetup_DsRoleDnsNameToFlatName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3329 struct dssetup_DsRoleDnsNameToFlatName *r)
3330 {
3331 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3332 }
3333
3334
3335 /*
3336 dssetup_DsRoleDcAsDc
3337 */
3338 static WERROR dcesrv_dssetup_DsRoleDcAsDc(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3339 struct dssetup_DsRoleDcAsDc *r)
3340 {
3341 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3342 }
3343
3344
3345 /*
3346 dssetup_DsRoleDcAsReplica
3347 */
3348 static WERROR dcesrv_dssetup_DsRoleDcAsReplica(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3349 struct dssetup_DsRoleDcAsReplica *r)
3350 {
3351 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3352 }
3353
3354
3355 /*
3356 dssetup_DsRoleDemoteDc
3357 */
3358 static WERROR dcesrv_dssetup_DsRoleDemoteDc(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3359 struct dssetup_DsRoleDemoteDc *r)
3360 {
3361 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3362 }
3363
3364
3365 /*
3366 dssetup_DsRoleGetDcOperationProgress
3367 */
3368 static WERROR dcesrv_dssetup_DsRoleGetDcOperationProgress(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3369 struct dssetup_DsRoleGetDcOperationProgress *r)
3370 {
3371 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3372 }
3373
3374
3375 /*
3376 dssetup_DsRoleGetDcOperationResults
3377 */
3378 static WERROR dcesrv_dssetup_DsRoleGetDcOperationResults(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3379 struct dssetup_DsRoleGetDcOperationResults *r)
3380 {
3381 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3382 }
3383
3384
3385 /*
3386 dssetup_DsRoleCancel
3387 */
3388 static WERROR dcesrv_dssetup_DsRoleCancel(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3389 struct dssetup_DsRoleCancel *r)
3390 {
3391 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3392 }
3393
3394
3395 /*
3396 dssetup_DsRoleServerSaveStateForUpgrade
3397 */
3398 static WERROR dcesrv_dssetup_DsRoleServerSaveStateForUpgrade(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3399 struct dssetup_DsRoleServerSaveStateForUpgrade *r)
3400 {
3401 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3402 }
3403
3404
3405 /*
3406 dssetup_DsRoleUpgradeDownlevelServer
3407 */
3408 static WERROR dcesrv_dssetup_DsRoleUpgradeDownlevelServer(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3409 struct dssetup_DsRoleUpgradeDownlevelServer *r)
3410 {
3411 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3412 }
3413
3414
3415 /*
3416 dssetup_DsRoleAbortDownlevelServerUpgrade
3417 */
3418 static WERROR dcesrv_dssetup_DsRoleAbortDownlevelServerUpgrade(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3419 struct dssetup_DsRoleAbortDownlevelServerUpgrade *r)
3420 {
3421 DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
3422 }
3423
3424
3425 /* include the generated boilerplate */
3426 #include "librpc/gen_ndr/ndr_dssetup_s.c"
3427
3428 NTSTATUS dcerpc_server_lsa_init(void)
3429 {
3430 NTSTATUS ret;
3431
3432 ret = dcerpc_server_dssetup_init();
3433 if (!NT_STATUS_IS_OK(ret)) {
3434 return ret;
3435 }
3436 ret = dcerpc_server_lsarpc_init();
3437 if (!NT_STATUS_IS_OK(ret)) {
3438 return ret;
3439 }
3440 return ret;
3441 }