?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:lsa RPC - Change some counters to be "unsigned" where needed
[Samba/ekacnet.git] / source4 / rpc_server / lsa / lsa_lookup.c
blob7e13f4e18a155797a17771095cc52160c32b4a60
1 /*
2 Unix SMB/CIFS implementation.
3
4 endpoint server for the lsarpc pipe
5
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "rpc_server/lsa/lsa.h"
24
25 static const struct {
26 const char *domain;
27 const char *name;
28 const char *sid;
29 int rtype;
30 } well_known[] = {
31 {
32 .name = "EVERYONE",
33 .sid = SID_WORLD,
34 .rtype = SID_NAME_WKN_GRP,
35 },
36 {
37 .name = "CREATOR OWNER",
38 .sid = SID_CREATOR_OWNER,
39 .rtype = SID_NAME_WKN_GRP,
40 },
41 {
42 .name = "CREATOR GROUP",
43 .sid = SID_CREATOR_GROUP,
44 .rtype = SID_NAME_WKN_GRP,
45 },
46 {
47 .name = "Owner Rights",
48 .sid = SID_OWNER_RIGHTS,
49 .rtype = SID_NAME_WKN_GRP,
50 },
51 {
52 .domain = "NT AUTHORITY",
53 .name = "Dialup",
54 .sid = SID_NT_DIALUP,
55 .rtype = SID_NAME_WKN_GRP,
56 },
57 {
58 .domain = "NT AUTHORITY",
59 .name = "Network",
60 .sid = SID_NT_NETWORK,
61 .rtype = SID_NAME_WKN_GRP,
62 },
63 {
64 .domain = "NT AUTHORITY",
65 .name = "Batch",
66 .sid = SID_NT_BATCH,
67 .rtype = SID_NAME_WKN_GRP,
68 },
69 {
70 .domain = "NT AUTHORITY",
71 .name = "Interactive",
72 .sid = SID_NT_INTERACTIVE,
73 .rtype = SID_NAME_WKN_GRP,
74 },
75 {
76 .domain = "NT AUTHORITY",
77 .name = "Service",
78 .sid = SID_NT_SERVICE,
79 .rtype = SID_NAME_WKN_GRP,
80 },
81 {
82 .domain = "NT AUTHORITY",
83 .name = "ANONYMOUS LOGON",
84 .sid = SID_NT_ANONYMOUS,
85 .rtype = SID_NAME_WKN_GRP,
86 },
87 {
88 .domain = "NT AUTHORITY",
89 .name = "Proxy",
90 .sid = SID_NT_PROXY,
91 .rtype = SID_NAME_WKN_GRP,
92 },
93 {
94 .domain = "NT AUTHORITY",
95 .name = "ServerLogon",
96 .sid = SID_NT_ENTERPRISE_DCS,
97 .rtype = SID_NAME_WKN_GRP,
98 },
99 {
100 .domain = "NT AUTHORITY",
101 .name = "Self",
102 .sid = SID_NT_SELF,
103 .rtype = SID_NAME_WKN_GRP,
104 },
105 {
106 .domain = "NT AUTHORITY",
107 .name = "Authenticated Users",
108 .sid = SID_NT_AUTHENTICATED_USERS,
109 .rtype = SID_NAME_WKN_GRP,
110 },
111 {
112 .domain = "NT AUTHORITY",
113 .name = "Restricted",
114 .sid = SID_NT_RESTRICTED,
115 .rtype = SID_NAME_WKN_GRP,
116 },
117 {
118 .domain = "NT AUTHORITY",
119 .name = "Terminal Server User",
120 .sid = SID_NT_TERMINAL_SERVER_USERS,
121 .rtype = SID_NAME_WKN_GRP,
122 },
123 {
124 .domain = "NT AUTHORITY",
125 .name = "Remote Interactive Logon",
126 .sid = SID_NT_REMOTE_INTERACTIVE,
127 .rtype = SID_NAME_WKN_GRP,
128 },
129 {
130 .domain = "NT AUTHORITY",
131 .name = "This Organization",
132 .sid = SID_NT_THIS_ORGANISATION,
133 .rtype = SID_NAME_WKN_GRP,
134 },
135 {
136 .domain = "NT AUTHORITY",
137 .name = "SYSTEM",
138 .sid = SID_NT_SYSTEM,
139 .rtype = SID_NAME_WKN_GRP,
140 },
141 {
142 .domain = "NT AUTHORITY",
143 .name = "Local Service",
144 .sid = SID_NT_LOCAL_SERVICE,
145 .rtype = SID_NAME_WKN_GRP,
146 },
147 {
148 .domain = "NT AUTHORITY",
149 .name = "Network Service",
150 .sid = SID_NT_NETWORK_SERVICE,
151 .rtype = SID_NAME_WKN_GRP,
152 },
153 {
154 .domain = "NT AUTHORITY",
155 .name = "Digest Authentication",
156 .sid = SID_NT_DIGEST_AUTHENTICATION,
157 .rtype = SID_NAME_WKN_GRP,
158 },
159 {
160 .domain = "NT AUTHORITY",
161 .name = "Enterprise Domain Controllers",
162 .sid = SID_NT_ENTERPRISE_DCS,
163 .rtype = SID_NAME_WKN_GRP,
164 },
165 {
166 .domain = "NT AUTHORITY",
167 .name = "NTLM Authentication",
168 .sid = SID_NT_NTLM_AUTHENTICATION,
169 .rtype = SID_NAME_WKN_GRP,
170 },
171 {
172 .domain = "NT AUTHORITY",
173 .name = "Other Organization",
174 .sid = SID_NT_OTHER_ORGANISATION,
175 .rtype = SID_NAME_WKN_GRP,
176 },
177 {
178 .domain = "NT AUTHORITY",
179 .name = "SChannel Authentication",
180 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
181 .rtype = SID_NAME_WKN_GRP,
182 },
183 {
184 .domain = "NT AUTHORITY",
185 .name = "IUSR",
186 .sid = SID_NT_IUSR,
187 .rtype = SID_NAME_WKN_GRP,
188 },
189 {
190 .sid = NULL,
191 }
192 };
193
194 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195 const char *name, const char **authority_name,
196 struct dom_sid **sid, uint32_t *rtype)
197 {
198 unsigned int i;
199 for (i=0; well_known[i].sid; i++) {
200 if (domain) {
201 if (strcasecmp_m(domain, well_known[i].domain) == 0
202 && strcasecmp_m(name, well_known[i].name) == 0) {
203 *authority_name = well_known[i].domain;
204 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
205 *rtype = well_known[i].rtype;
206 return NT_STATUS_OK;
207 }
208 } else {
209 if (strcasecmp_m(name, well_known[i].name) == 0) {
210 *authority_name = well_known[i].domain;
211 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
212 *rtype = well_known[i].rtype;
213 return NT_STATUS_OK;
214 }
215 }
216 }
217 return NT_STATUS_NOT_FOUND;
218 }
219
220 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx,
221 const char *sid_str, const char **authority_name,
222 const char **name, uint32_t *rtype)
223 {
224 unsigned int i;
225 for (i=0; well_known[i].sid; i++) {
226 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227 *authority_name = well_known[i].domain;
228 *name = well_known[i].name;
229 *rtype = well_known[i].rtype;
230 return NT_STATUS_OK;
231 }
232 }
233 return NT_STATUS_NOT_FOUND;
234 }
235
236 /*
237 lookup a SID for 1 name
238 */
239 static NTSTATUS dcesrv_lsa_lookup_name(struct tevent_context *ev_ctx,
240 struct loadparm_context *lp_ctx,
241 struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242 const char *name, const char **authority_name,
243 struct dom_sid **sid, enum lsa_SidType *rtype,
244 uint32_t *rid)
245 {
246 int ret, i;
247 uint32_t atype;
248 struct ldb_message **res;
249 const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
250 const char *p;
251 const char *domain;
252 const char *username;
253 struct ldb_dn *domain_dn;
254 struct dom_sid *domain_sid;
255 NTSTATUS status;
256
257 p = strchr_m(name, '\\');
258 if (p != NULL) {
259 domain = talloc_strndup(mem_ctx, name, p-name);
260 if (!domain) {
261 return NT_STATUS_NO_MEMORY;
262 }
263 username = p + 1;
264 } else if (strchr_m(name, '@')) {
265 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
266 if (!NT_STATUS_IS_OK(status)) {
267 DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
268 return status;
269 }
270 } else {
271 domain = NULL;
272 username = name;
273 }
274
275 if (!domain) {
276 /* Look up table of well known names */
277 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
278 if (NT_STATUS_IS_OK(status)) {
279 dom_sid_split_rid(NULL, *sid, NULL, rid);
280 return NT_STATUS_OK;
281 }
282
283 if (username == NULL) {
284 *authority_name = NAME_BUILTIN;
285 *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
286 *rtype = SID_NAME_DOMAIN;
287 *rid = 0xFFFFFFFF;
288 return NT_STATUS_OK;
289 }
290
291 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) {
292 *authority_name = NAME_NT_AUTHORITY;
293 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
294 *rtype = SID_NAME_DOMAIN;
295 dom_sid_split_rid(NULL, *sid, NULL, rid);
296 return NT_STATUS_OK;
297 }
298 if (strcasecmp_m(username, NAME_BUILTIN) == 0) {
299 *authority_name = NAME_BUILTIN;
300 *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
301 *rtype = SID_NAME_DOMAIN;
302 *rid = 0xFFFFFFFF;
303 return NT_STATUS_OK;
304 }
305 if (strcasecmp_m(username, state->domain_dns) == 0) {
306 *authority_name = state->domain_name;
307 *sid = state->domain_sid;
308 *rtype = SID_NAME_DOMAIN;
309 *rid = 0xFFFFFFFF;
310 return NT_STATUS_OK;
311 }
312 if (strcasecmp_m(username, state->domain_name) == 0) {
313 *authority_name = state->domain_name;
314 *sid = state->domain_sid;
315 *rtype = SID_NAME_DOMAIN;
316 *rid = 0xFFFFFFFF;
317 return NT_STATUS_OK;
318 }
319
320 /* Perhaps this is a well known user? */
321 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
322 if (!name) {
323 return NT_STATUS_NO_MEMORY;
324 }
325 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
326 if (NT_STATUS_IS_OK(status)) {
327 return status;
328 }
329
330 /* Perhaps this is a BUILTIN user? */
331 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
332 if (!name) {
333 return NT_STATUS_NO_MEMORY;
334 }
335 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
336 if (NT_STATUS_IS_OK(status)) {
337 return status;
338 }
339
340 /* OK, I give up - perhaps we need to assume the user is in our domain? */
341 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
342 if (!name) {
343 return NT_STATUS_NO_MEMORY;
344 }
345 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
346 if (NT_STATUS_IS_OK(status)) {
347 return status;
348 }
349
350 return STATUS_SOME_UNMAPPED;
351 } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
352 if (!*username) {
353 *authority_name = NAME_NT_AUTHORITY;
354 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
355 *rtype = SID_NAME_DOMAIN;
356 dom_sid_split_rid(NULL, *sid, NULL, rid);
357 return NT_STATUS_OK;
358 }
359
360 /* Look up table of well known names */
361 status = lookup_well_known_names(mem_ctx, domain, username, authority_name,
362 sid, rtype);
363 if (NT_STATUS_IS_OK(status)) {
364 dom_sid_split_rid(NULL, *sid, NULL, rid);
365 }
366 return status;
367 } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
368 *authority_name = NAME_BUILTIN;
369 domain_dn = state->builtin_dn;
370 } else if (strcasecmp_m(domain, state->domain_dns) == 0) {
371 *authority_name = state->domain_name;
372 domain_dn = state->domain_dn;
373 } else if (strcasecmp_m(domain, state->domain_name) == 0) {
374 *authority_name = state->domain_name;
375 domain_dn = state->domain_dn;
376 } else {
377 /* Not local, need to ask winbind in future */
378 return STATUS_SOME_UNMAPPED;
379 }
380
381 ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
382 if (ret == 1) {
383 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
384 if (domain_sid == NULL) {
385 return NT_STATUS_INVALID_SID;
386 }
387 } else {
388 return NT_STATUS_INVALID_SID;
389 }
390
391 if (!*username) {
392 *sid = domain_sid;
393 *rtype = SID_NAME_DOMAIN;
394 *rid = 0xFFFFFFFF;
395 return NT_STATUS_OK;
396 }
397
398 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
399 "(&(sAMAccountName=%s)(objectSid=*))",
400 ldb_binary_encode_string(mem_ctx, username));
401 if (ret == -1) {
402 return NT_STATUS_INVALID_SID;
403 }
404
405 for (i=0; i < ret; i++) {
406 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
407 if (*sid == NULL) {
408 return NT_STATUS_INVALID_SID;
409 }
410
411 /* Check that this is in the domain */
412 if (!dom_sid_in_domain(domain_sid, *sid)) {
413 continue;
414 }
415
416 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
417
418 *rtype = ds_atype_map(atype);
419 if (*rtype == SID_NAME_UNKNOWN) {
420 return STATUS_SOME_UNMAPPED;
421 }
422
423 dom_sid_split_rid(NULL, *sid, NULL, rid);
424 return NT_STATUS_OK;
425 }
426
427 /* need to check for an allocated sid */
428
429 return NT_STATUS_INVALID_SID;
430 }
431
432
433 /*
434 add to the lsa_RefDomainList for LookupSids and LookupNames
435 */
436 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
437 enum lsa_SidType rtype,
438 const char *authority_name,
439 struct dom_sid *sid,
440 struct lsa_RefDomainList *domains,
441 uint32_t *sid_index)
442 {
443 struct dom_sid *authority_sid;
444 uint32_t i;
445
446 if (rtype != SID_NAME_DOMAIN) {
447 authority_sid = dom_sid_dup(mem_ctx, sid);
448 if (authority_sid == NULL) {
449 return NT_STATUS_NO_MEMORY;
450 }
451 authority_sid->num_auths--;
452 } else {
453 authority_sid = sid;
454 }
455
456 /* see if we've already done this authority name */
457 for (i=0;i<domains->count;i++) {
458 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
459 *sid_index = i;
460 return NT_STATUS_OK;
461 }
462 }
463
464 domains->domains = talloc_realloc(domains,
465 domains->domains,
466 struct lsa_DomainInfo,
467 domains->count+1);
468 if (domains->domains == NULL) {
469 return NT_STATUS_NO_MEMORY;
470 }
471 domains->domains[i].name.string = authority_name;
472 domains->domains[i].sid = authority_sid;
473 domains->count++;
474 domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
475 *sid_index = i;
476
477 return NT_STATUS_OK;
478 }
479
480 /*
481 lookup a name for 1 SID
482 */
483 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
484 struct dom_sid *sid, const char *sid_str,
485 const char **authority_name,
486 const char **name, enum lsa_SidType *rtype)
487 {
488 NTSTATUS status;
489 int ret;
490 uint32_t atype;
491 struct ldb_message **res;
492 struct ldb_dn *domain_dn;
493 const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
494
495 status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
496 if (NT_STATUS_IS_OK(status)) {
497 return status;
498 }
499
500 if (dom_sid_in_domain(state->domain_sid, sid)) {
501 *authority_name = state->domain_name;
502 domain_dn = state->domain_dn;
503 } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
504 *authority_name = NAME_BUILTIN;
505 domain_dn = state->builtin_dn;
506 } else {
507 /* Not well known, our domain or built in */
508
509 /* In future, we must look at SID histories, and at trusted domains via winbind */
510
511 return NT_STATUS_NOT_FOUND;
512 }
513
514 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
515 "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
516 if (ret == 1) {
517 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
518 if (!*name) {
519 *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
520 if (!*name) {
521 *name = talloc_strdup(mem_ctx, sid_str);
522 NT_STATUS_HAVE_NO_MEMORY(*name);
523 }
524 }
525
526 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
527
528 *rtype = ds_atype_map(atype);
529
530 return NT_STATUS_OK;
531 }
532
533 /* need to re-add a check for an allocated sid */
534
535 return NT_STATUS_NOT_FOUND;
536 }
537
538
539 /*
540 lsa_LookupSids2
541 */
542 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
543 TALLOC_CTX *mem_ctx,
544 struct lsa_LookupSids2 *r)
545 {
546 struct lsa_policy_state *state;
547 struct lsa_RefDomainList *domains = NULL;
548 uint32_t i;
549 NTSTATUS status = NT_STATUS_OK;
550
551 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
552 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
553 return NT_STATUS_INVALID_PARAMETER;
554 }
555
556 *r->out.domains = NULL;
557
558 /* NOTE: the WSPP test suite tries SIDs with invalid revision numbers,
559 and expects NT_STATUS_INVALID_PARAMETER back - we just treat it as
560 an unknown SID. We could add a SID validator here. (tridge)
561 MS-DTYP 2.4.2
562 */
563
564 status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
565 if (!NT_STATUS_IS_OK(status)) {
566 return status;
567 }
568
569 domains = talloc_zero(r->out.domains, struct lsa_RefDomainList);
570 if (domains == NULL) {
571 return NT_STATUS_NO_MEMORY;
572 }
573 *r->out.domains = domains;
574
575 r->out.names = talloc_zero(mem_ctx, struct lsa_TransNameArray2);
576 if (r->out.names == NULL) {
577 return NT_STATUS_NO_MEMORY;
578 }
579
580 *r->out.count = 0;
581
582 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2,
583 r->in.sids->num_sids);
584 if (r->out.names->names == NULL) {
585 return NT_STATUS_NO_MEMORY;
586 }
587
588 for (i=0;i<r->in.sids->num_sids;i++) {
589 struct dom_sid *sid = r->in.sids->sids[i].sid;
590 char *sid_str = dom_sid_string(mem_ctx, sid);
591 const char *name, *authority_name;
592 enum lsa_SidType rtype;
593 uint32_t sid_index;
594 NTSTATUS status2;
595
596 r->out.names->count++;
597
598 r->out.names->names[i].sid_type = SID_NAME_UNKNOWN;
599 r->out.names->names[i].name.string = sid_str;
600 r->out.names->names[i].sid_index = 0xFFFFFFFF;
601 r->out.names->names[i].unknown = 0;
602
603 if (sid_str == NULL) {
604 r->out.names->names[i].name.string = "(SIDERROR)";
605 status = STATUS_SOME_UNMAPPED;
606 continue;
607 }
608
609 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str,
610 &authority_name, &name, &rtype);
611 if (!NT_STATUS_IS_OK(status2)) {
612 status = STATUS_SOME_UNMAPPED;
613 continue;
614 }
615
616 /* set up the authority table */
617 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype,
618 authority_name, sid,
619 domains, &sid_index);
620 if (!NT_STATUS_IS_OK(status2)) {
621 continue;
622 }
623
624 r->out.names->names[i].sid_type = rtype;
625 r->out.names->names[i].name.string = name;
626 r->out.names->names[i].sid_index = sid_index;
627 r->out.names->names[i].unknown = 0;
628
629 (*r->out.count)++;
630 }
631
632 if (*r->out.count == 0) {
633 return NT_STATUS_NONE_MAPPED;
634 }
635 if (*r->out.count != r->in.sids->num_sids) {
636 return STATUS_SOME_UNMAPPED;
637 }
638
639 return NT_STATUS_OK;
640 }
641
642
643 /*
644 lsa_LookupSids3
645
646 Identical to LookupSids2, but doesn't take a policy handle
647
648 */
649 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
650 TALLOC_CTX *mem_ctx,
651 struct lsa_LookupSids3 *r)
652 {
653 struct lsa_LookupSids2 r2;
654 struct lsa_OpenPolicy2 pol;
655 NTSTATUS status;
656 struct dcesrv_handle *h;
657
658 ZERO_STRUCT(r2);
659
660 /* No policy handle on the wire, so make one up here */
661 r2.in.handle = talloc(mem_ctx, struct policy_handle);
662 if (!r2.in.handle) {
663 return NT_STATUS_NO_MEMORY;
664 }
665
666 pol.out.handle = r2.in.handle;
667 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
668 pol.in.attr = NULL;
669 pol.in.system_name = NULL;
670 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
671 if (!NT_STATUS_IS_OK(status)) {
672 return status;
673 }
674
675 /* ensure this handle goes away at the end of this call */
676 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
677 talloc_steal(mem_ctx, h);
678
679 r2.in.sids = r->in.sids;
680 r2.in.names = r->in.names;
681 r2.in.level = r->in.level;
682 r2.in.count = r->in.count;
683 r2.in.lookup_options = r->in.lookup_options;
684 r2.in.client_revision = r->in.client_revision;
685 r2.out.count = r->out.count;
686 r2.out.names = r->out.names;
687 r2.out.domains = r->out.domains;
688
689 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
690
691 r->out.domains = r2.out.domains;
692 r->out.names = r2.out.names;
693 r->out.count = r2.out.count;
694
695 return status;
696 }
697
698
699 /*
700 lsa_LookupSids
701 */
702 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
703 struct lsa_LookupSids *r)
704 {
705 struct lsa_LookupSids2 r2;
706 NTSTATUS status;
707 uint32_t i;
708
709 ZERO_STRUCT(r2);
710
711 r2.in.handle = r->in.handle;
712 r2.in.sids = r->in.sids;
713 r2.in.names = NULL;
714 r2.in.level = r->in.level;
715 r2.in.count = r->in.count;
716 r2.in.lookup_options = 0;
717 r2.in.client_revision = 0;
718 r2.out.count = r->out.count;
719 r2.out.names = NULL;
720 r2.out.domains = r->out.domains;
721
722 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
723 /* we deliberately don't check for error from the above,
724 as even on error we are supposed to return the names */
725
726 r->out.domains = r2.out.domains;
727 if (!r2.out.names) {
728 r->out.names = NULL;
729 return status;
730 }
731
732 r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
733 if (r->out.names == NULL) {
734 return NT_STATUS_NO_MEMORY;
735 }
736 r->out.names->count = r2.out.names->count;
737 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName,
738 r->out.names->count);
739 if (r->out.names->names == NULL) {
740 return NT_STATUS_NO_MEMORY;
741 }
742 for (i=0;i<r->out.names->count;i++) {
743 r->out.names->names[i].sid_type = r2.out.names->names[i].sid_type;
744 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
745 r->out.names->names[i].sid_index = r2.out.names->names[i].sid_index;
746 }
747
748 return status;
749 }
750
751
752 /*
753 lsa_LookupNames3
754 */
755 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
756 TALLOC_CTX *mem_ctx,
757 struct lsa_LookupNames3 *r)
758 {
759 struct lsa_policy_state *policy_state;
760 struct dcesrv_handle *policy_handle;
761 uint32_t i;
762 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
763 struct lsa_RefDomainList *domains;
764
765 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
766
767 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
768 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
769 return NT_STATUS_INVALID_PARAMETER;
770 }
771
772 policy_state = policy_handle->data;
773
774 *r->out.domains = NULL;
775
776 domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
777 if (domains == NULL) {
778 return NT_STATUS_NO_MEMORY;
779 }
780 *r->out.domains = domains;
781
782 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray3);
783 if (r->out.sids == NULL) {
784 return NT_STATUS_NO_MEMORY;
785 }
786
787 *r->out.count = 0;
788
789 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3,
790 r->in.num_names);
791 if (r->out.sids->sids == NULL) {
792 return NT_STATUS_NO_MEMORY;
793 }
794
795 for (i=0;i<r->in.num_names;i++) {
796 const char *name = r->in.names[i].string;
797 const char *authority_name;
798 struct dom_sid *sid;
799 uint32_t sid_index, rid;
800 enum lsa_SidType rtype;
801 NTSTATUS status2;
802
803 r->out.sids->count++;
804
805 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
806 r->out.sids->sids[i].sid = NULL;
807 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
808 r->out.sids->sids[i].flags = 0;
809
810 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name,
811 &authority_name, &sid, &rtype, &rid);
812 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
813 continue;
814 }
815
816 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name,
817 sid, domains, &sid_index);
818 if (!NT_STATUS_IS_OK(status2)) {
819 continue;
820 }
821
822 r->out.sids->sids[i].sid_type = rtype;
823 r->out.sids->sids[i].sid = sid;
824 r->out.sids->sids[i].sid_index = sid_index;
825 r->out.sids->sids[i].flags = 0;
826
827 (*r->out.count)++;
828 }
829
830 if (*r->out.count == 0) {
831 return NT_STATUS_NONE_MAPPED;
832 }
833 if (*r->out.count != r->in.num_names) {
834 return STATUS_SOME_UNMAPPED;
835 }
836
837 return NT_STATUS_OK;
838 }
839
840 /*
841 lsa_LookupNames4
842
843 Identical to LookupNames3, but doesn't take a policy handle
844
845 */
846 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
847 struct lsa_LookupNames4 *r)
848 {
849 struct lsa_LookupNames3 r2;
850 struct lsa_OpenPolicy2 pol;
851 NTSTATUS status;
852 struct dcesrv_handle *h;
853
854 ZERO_STRUCT(r2);
855
856 /* No policy handle on the wire, so make one up here */
857 r2.in.handle = talloc(mem_ctx, struct policy_handle);
858 if (!r2.in.handle) {
859 return NT_STATUS_NO_MEMORY;
860 }
861
862 pol.out.handle = r2.in.handle;
863 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
864 pol.in.attr = NULL;
865 pol.in.system_name = NULL;
866 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
867 if (!NT_STATUS_IS_OK(status)) {
868 return status;
869 }
870
871 /* ensure this handle goes away at the end of this call */
872 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
873 talloc_steal(mem_ctx, h);
874
875 r2.in.num_names = r->in.num_names;
876 r2.in.names = r->in.names;
877 r2.in.level = r->in.level;
878 r2.in.sids = r->in.sids;
879 r2.in.count = r->in.count;
880 r2.in.lookup_options = r->in.lookup_options;
881 r2.in.client_revision = r->in.client_revision;
882 r2.out.domains = r->out.domains;
883 r2.out.sids = r->out.sids;
884 r2.out.count = r->out.count;
885
886 status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
887
888 r->out.domains = r2.out.domains;
889 r->out.sids = r2.out.sids;
890 r->out.count = r2.out.count;
891 return status;
892 }
893
894 /*
895 lsa_LookupNames2
896 */
897 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
898 TALLOC_CTX *mem_ctx,
899 struct lsa_LookupNames2 *r)
900 {
901 struct lsa_policy_state *state;
902 struct dcesrv_handle *h;
903 uint32_t i;
904 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
905 struct lsa_RefDomainList *domains;
906
907 *r->out.domains = NULL;
908
909 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
910
911 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
912 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
913 return NT_STATUS_INVALID_PARAMETER;
914 }
915
916 state = h->data;
917
918 domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
919 if (domains == NULL) {
920 return NT_STATUS_NO_MEMORY;
921 }
922 *r->out.domains = domains;
923
924 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray2);
925 if (r->out.sids == NULL) {
926 return NT_STATUS_NO_MEMORY;
927 }
928
929 *r->out.count = 0;
930
931 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2,
932 r->in.num_names);
933 if (r->out.sids->sids == NULL) {
934 return NT_STATUS_NO_MEMORY;
935 }
936
937 for (i=0;i<r->in.num_names;i++) {
938 const char *name = r->in.names[i].string;
939 const char *authority_name;
940 struct dom_sid *sid;
941 uint32_t rtype, sid_index, rid=0;
942 NTSTATUS status2;
943
944 r->out.sids->count++;
945
946 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
947 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
948 to sid NULL - so we should return 0 rid for
949 unmapped entries */
950 r->out.sids->sids[i].rid = 0;
951 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
952 r->out.sids->sids[i].unknown = 0;
953
954 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name,
955 &authority_name, &sid, &rtype, &rid);
956 if (!NT_STATUS_IS_OK(status2)) {
957 continue;
958 }
959
960 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name,
961 sid, domains, &sid_index);
962 if (!NT_STATUS_IS_OK(status2)) {
963 continue;
964 }
965
966 r->out.sids->sids[i].sid_type = rtype;
967 r->out.sids->sids[i].rid = rid;
968 r->out.sids->sids[i].sid_index = sid_index;
969 r->out.sids->sids[i].unknown = 0;
970
971 (*r->out.count)++;
972 }
973
974 if (*r->out.count == 0) {
975 return NT_STATUS_NONE_MAPPED;
976 }
977 if (*r->out.count != r->in.num_names) {
978 return STATUS_SOME_UNMAPPED;
979 }
980
981 return NT_STATUS_OK;
982 }
983
984 /*
985 lsa_LookupNames
986 */
987 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
988 struct lsa_LookupNames *r)
989 {
990 struct lsa_LookupNames2 r2;
991 NTSTATUS status;
992 uint32_t i;
993
994 ZERO_STRUCT(r2);
995
996 r2.in.handle = r->in.handle;
997 r2.in.num_names = r->in.num_names;
998 r2.in.names = r->in.names;
999 r2.in.sids = NULL;
1000 r2.in.level = r->in.level;
1001 r2.in.count = r->in.count;
1002 r2.in.lookup_options = 0;
1003 r2.in.client_revision = 0;
1004 r2.out.count = r->out.count;
1005 r2.out.domains = r->out.domains;
1006
1007 status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
1008 if (r2.out.sids == NULL) {
1009 return status;
1010 }
1011
1012 r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
1013 if (r->out.sids == NULL) {
1014 return NT_STATUS_NO_MEMORY;
1015 }
1016 r->out.sids->count = r2.out.sids->count;
1017 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid,
1018 r->out.sids->count);
1019 if (r->out.sids->sids == NULL) {
1020 return NT_STATUS_NO_MEMORY;
1021 }
1022 for (i=0;i<r->out.sids->count;i++) {
1023 r->out.sids->sids[i].sid_type = r2.out.sids->sids[i].sid_type;
1024 r->out.sids->sids[i].rid = r2.out.sids->sids[i].rid;
1025 r->out.sids->sids[i].sid_index = r2.out.sids->sids[i].sid_index;
1026 }
1027
1028 return status;
1029 }
1030