2 Unix SMB/CIFS implementation.
4 endpoint server for the lsarpc pipe
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "rpc_server/lsa/lsa.h"
34 .rtype
= SID_NAME_WKN_GRP
,
37 .name
= "CREATOR OWNER",
38 .sid
= SID_CREATOR_OWNER
,
39 .rtype
= SID_NAME_WKN_GRP
,
42 .name
= "CREATOR GROUP",
43 .sid
= SID_CREATOR_GROUP
,
44 .rtype
= SID_NAME_WKN_GRP
,
47 .name
= "Owner Rights",
48 .sid
= SID_OWNER_RIGHTS
,
49 .rtype
= SID_NAME_WKN_GRP
,
52 .domain
= "NT AUTHORITY",
55 .rtype
= SID_NAME_WKN_GRP
,
58 .domain
= "NT AUTHORITY",
60 .sid
= SID_NT_NETWORK
,
61 .rtype
= SID_NAME_WKN_GRP
,
64 .domain
= "NT AUTHORITY",
67 .rtype
= SID_NAME_WKN_GRP
,
70 .domain
= "NT AUTHORITY",
71 .name
= "Interactive",
72 .sid
= SID_NT_INTERACTIVE
,
73 .rtype
= SID_NAME_WKN_GRP
,
76 .domain
= "NT AUTHORITY",
78 .sid
= SID_NT_SERVICE
,
79 .rtype
= SID_NAME_WKN_GRP
,
82 .domain
= "NT AUTHORITY",
83 .name
= "ANONYMOUS LOGON",
84 .sid
= SID_NT_ANONYMOUS
,
85 .rtype
= SID_NAME_WKN_GRP
,
88 .domain
= "NT AUTHORITY",
91 .rtype
= SID_NAME_WKN_GRP
,
94 .domain
= "NT AUTHORITY",
95 .name
= "ServerLogon",
96 .sid
= SID_NT_ENTERPRISE_DCS
,
97 .rtype
= SID_NAME_WKN_GRP
,
100 .domain
= "NT AUTHORITY",
103 .rtype
= SID_NAME_WKN_GRP
,
106 .domain
= "NT AUTHORITY",
107 .name
= "Authenticated Users",
108 .sid
= SID_NT_AUTHENTICATED_USERS
,
109 .rtype
= SID_NAME_WKN_GRP
,
112 .domain
= "NT AUTHORITY",
113 .name
= "Restricted",
114 .sid
= SID_NT_RESTRICTED
,
115 .rtype
= SID_NAME_WKN_GRP
,
118 .domain
= "NT AUTHORITY",
119 .name
= "Terminal Server User",
120 .sid
= SID_NT_TERMINAL_SERVER_USERS
,
121 .rtype
= SID_NAME_WKN_GRP
,
124 .domain
= "NT AUTHORITY",
125 .name
= "Remote Interactive Logon",
126 .sid
= SID_NT_REMOTE_INTERACTIVE
,
127 .rtype
= SID_NAME_WKN_GRP
,
130 .domain
= "NT AUTHORITY",
131 .name
= "This Organization",
132 .sid
= SID_NT_THIS_ORGANISATION
,
133 .rtype
= SID_NAME_WKN_GRP
,
136 .domain
= "NT AUTHORITY",
138 .sid
= SID_NT_SYSTEM
,
139 .rtype
= SID_NAME_WKN_GRP
,
142 .domain
= "NT AUTHORITY",
143 .name
= "Local Service",
144 .sid
= SID_NT_LOCAL_SERVICE
,
145 .rtype
= SID_NAME_WKN_GRP
,
148 .domain
= "NT AUTHORITY",
149 .name
= "Network Service",
150 .sid
= SID_NT_NETWORK_SERVICE
,
151 .rtype
= SID_NAME_WKN_GRP
,
154 .domain
= "NT AUTHORITY",
155 .name
= "Digest Authentication",
156 .sid
= SID_NT_DIGEST_AUTHENTICATION
,
157 .rtype
= SID_NAME_WKN_GRP
,
160 .domain
= "NT AUTHORITY",
161 .name
= "Enterprise Domain Controllers",
162 .sid
= SID_NT_ENTERPRISE_DCS
,
163 .rtype
= SID_NAME_WKN_GRP
,
166 .domain
= "NT AUTHORITY",
167 .name
= "NTLM Authentication",
168 .sid
= SID_NT_NTLM_AUTHENTICATION
,
169 .rtype
= SID_NAME_WKN_GRP
,
172 .domain
= "NT AUTHORITY",
173 .name
= "Other Organization",
174 .sid
= SID_NT_OTHER_ORGANISATION
,
175 .rtype
= SID_NAME_WKN_GRP
,
178 .domain
= "NT AUTHORITY",
179 .name
= "SChannel Authentication",
180 .sid
= SID_NT_SCHANNEL_AUTHENTICATION
,
181 .rtype
= SID_NAME_WKN_GRP
,
184 .domain
= "NT AUTHORITY",
187 .rtype
= SID_NAME_WKN_GRP
,
194 static NTSTATUS
lookup_well_known_names(TALLOC_CTX
*mem_ctx
, const char *domain
,
195 const char *name
, const char **authority_name
,
196 struct dom_sid
**sid
, uint32_t *rtype
)
199 for (i
=0; well_known
[i
].sid
; i
++) {
201 if (strcasecmp_m(domain
, well_known
[i
].domain
) == 0
202 && strcasecmp_m(name
, well_known
[i
].name
) == 0) {
203 *authority_name
= well_known
[i
].domain
;
204 *sid
= dom_sid_parse_talloc(mem_ctx
, well_known
[i
].sid
);
205 *rtype
= well_known
[i
].rtype
;
209 if (strcasecmp_m(name
, well_known
[i
].name
) == 0) {
210 *authority_name
= well_known
[i
].domain
;
211 *sid
= dom_sid_parse_talloc(mem_ctx
, well_known
[i
].sid
);
212 *rtype
= well_known
[i
].rtype
;
217 return NT_STATUS_NOT_FOUND
;
220 static NTSTATUS
lookup_well_known_sids(TALLOC_CTX
*mem_ctx
,
221 const char *sid_str
, const char **authority_name
,
222 const char **name
, uint32_t *rtype
)
225 for (i
=0; well_known
[i
].sid
; i
++) {
226 if (strcasecmp_m(sid_str
, well_known
[i
].sid
) == 0) {
227 *authority_name
= well_known
[i
].domain
;
228 *name
= well_known
[i
].name
;
229 *rtype
= well_known
[i
].rtype
;
233 return NT_STATUS_NOT_FOUND
;
237 lookup a SID for 1 name
239 static NTSTATUS
dcesrv_lsa_lookup_name(struct tevent_context
*ev_ctx
,
240 struct loadparm_context
*lp_ctx
,
241 struct lsa_policy_state
*state
, TALLOC_CTX
*mem_ctx
,
242 const char *name
, const char **authority_name
,
243 struct dom_sid
**sid
, enum lsa_SidType
*rtype
,
248 struct ldb_message
**res
;
249 const char * const attrs
[] = { "objectSid", "sAMAccountType", NULL
};
252 const char *username
;
253 struct ldb_dn
*domain_dn
;
254 struct dom_sid
*domain_sid
;
257 p
= strchr_m(name
, '\\');
259 domain
= talloc_strndup(mem_ctx
, name
, p
-name
);
261 return NT_STATUS_NO_MEMORY
;
264 } else if (strchr_m(name
, '@')) {
265 status
= crack_name_to_nt4_name(mem_ctx
, ev_ctx
, lp_ctx
, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL
, name
, &domain
, &username
);
266 if (!NT_STATUS_IS_OK(status
)) {
267 DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name
, nt_errstr(status
)));
276 /* Look up table of well known names */
277 status
= lookup_well_known_names(mem_ctx
, NULL
, username
, authority_name
, sid
, rtype
);
278 if (NT_STATUS_IS_OK(status
)) {
279 dom_sid_split_rid(NULL
, *sid
, NULL
, rid
);
283 if (username
== NULL
) {
284 *authority_name
= NAME_BUILTIN
;
285 *sid
= dom_sid_parse_talloc(mem_ctx
, SID_BUILTIN
);
286 *rtype
= SID_NAME_DOMAIN
;
291 if (strcasecmp_m(username
, NAME_NT_AUTHORITY
) == 0) {
292 *authority_name
= NAME_NT_AUTHORITY
;
293 *sid
= dom_sid_parse_talloc(mem_ctx
, SID_NT_AUTHORITY
);
294 *rtype
= SID_NAME_DOMAIN
;
295 dom_sid_split_rid(NULL
, *sid
, NULL
, rid
);
298 if (strcasecmp_m(username
, NAME_BUILTIN
) == 0) {
299 *authority_name
= NAME_BUILTIN
;
300 *sid
= dom_sid_parse_talloc(mem_ctx
, SID_BUILTIN
);
301 *rtype
= SID_NAME_DOMAIN
;
305 if (strcasecmp_m(username
, state
->domain_dns
) == 0) {
306 *authority_name
= state
->domain_name
;
307 *sid
= state
->domain_sid
;
308 *rtype
= SID_NAME_DOMAIN
;
312 if (strcasecmp_m(username
, state
->domain_name
) == 0) {
313 *authority_name
= state
->domain_name
;
314 *sid
= state
->domain_sid
;
315 *rtype
= SID_NAME_DOMAIN
;
320 /* Perhaps this is a well known user? */
321 name
= talloc_asprintf(mem_ctx
, "%s\\%s", NAME_NT_AUTHORITY
, username
);
323 return NT_STATUS_NO_MEMORY
;
325 status
= dcesrv_lsa_lookup_name(ev_ctx
, lp_ctx
, state
, mem_ctx
, name
, authority_name
, sid
, rtype
, rid
);
326 if (NT_STATUS_IS_OK(status
)) {
330 /* Perhaps this is a BUILTIN user? */
331 name
= talloc_asprintf(mem_ctx
, "%s\\%s", NAME_BUILTIN
, username
);
333 return NT_STATUS_NO_MEMORY
;
335 status
= dcesrv_lsa_lookup_name(ev_ctx
, lp_ctx
, state
, mem_ctx
, name
, authority_name
, sid
, rtype
, rid
);
336 if (NT_STATUS_IS_OK(status
)) {
340 /* OK, I give up - perhaps we need to assume the user is in our domain? */
341 name
= talloc_asprintf(mem_ctx
, "%s\\%s", state
->domain_name
, username
);
343 return NT_STATUS_NO_MEMORY
;
345 status
= dcesrv_lsa_lookup_name(ev_ctx
, lp_ctx
, state
, mem_ctx
, name
, authority_name
, sid
, rtype
, rid
);
346 if (NT_STATUS_IS_OK(status
)) {
350 return STATUS_SOME_UNMAPPED
;
351 } else if (strcasecmp_m(domain
, NAME_NT_AUTHORITY
) == 0) {
353 *authority_name
= NAME_NT_AUTHORITY
;
354 *sid
= dom_sid_parse_talloc(mem_ctx
, SID_NT_AUTHORITY
);
355 *rtype
= SID_NAME_DOMAIN
;
356 dom_sid_split_rid(NULL
, *sid
, NULL
, rid
);
360 /* Look up table of well known names */
361 status
= lookup_well_known_names(mem_ctx
, domain
, username
, authority_name
,
363 if (NT_STATUS_IS_OK(status
)) {
364 dom_sid_split_rid(NULL
, *sid
, NULL
, rid
);
367 } else if (strcasecmp_m(domain
, NAME_BUILTIN
) == 0) {
368 *authority_name
= NAME_BUILTIN
;
369 domain_dn
= state
->builtin_dn
;
370 } else if (strcasecmp_m(domain
, state
->domain_dns
) == 0) {
371 *authority_name
= state
->domain_name
;
372 domain_dn
= state
->domain_dn
;
373 } else if (strcasecmp_m(domain
, state
->domain_name
) == 0) {
374 *authority_name
= state
->domain_name
;
375 domain_dn
= state
->domain_dn
;
377 /* Not local, need to ask winbind in future */
378 return STATUS_SOME_UNMAPPED
;
381 ret
= gendb_search_dn(state
->sam_ldb
, mem_ctx
, domain_dn
, &res
, attrs
);
383 domain_sid
= samdb_result_dom_sid(mem_ctx
, res
[0], "objectSid");
384 if (domain_sid
== NULL
) {
385 return NT_STATUS_INVALID_SID
;
388 return NT_STATUS_INVALID_SID
;
393 *rtype
= SID_NAME_DOMAIN
;
398 ret
= gendb_search(state
->sam_ldb
, mem_ctx
, domain_dn
, &res
, attrs
,
399 "(&(sAMAccountName=%s)(objectSid=*))",
400 ldb_binary_encode_string(mem_ctx
, username
));
402 return NT_STATUS_INVALID_SID
;
405 for (i
=0; i
< ret
; i
++) {
406 *sid
= samdb_result_dom_sid(mem_ctx
, res
[i
], "objectSid");
408 return NT_STATUS_INVALID_SID
;
411 /* Check that this is in the domain */
412 if (!dom_sid_in_domain(domain_sid
, *sid
)) {
416 atype
= samdb_result_uint(res
[i
], "sAMAccountType", 0);
418 *rtype
= ds_atype_map(atype
);
419 if (*rtype
== SID_NAME_UNKNOWN
) {
420 return STATUS_SOME_UNMAPPED
;
423 dom_sid_split_rid(NULL
, *sid
, NULL
, rid
);
427 /* need to check for an allocated sid */
429 return NT_STATUS_INVALID_SID
;
434 add to the lsa_RefDomainList for LookupSids and LookupNames
436 static NTSTATUS
dcesrv_lsa_authority_list(struct lsa_policy_state
*state
, TALLOC_CTX
*mem_ctx
,
437 enum lsa_SidType rtype
,
438 const char *authority_name
,
440 struct lsa_RefDomainList
*domains
,
443 struct dom_sid
*authority_sid
;
446 if (rtype
!= SID_NAME_DOMAIN
) {
447 authority_sid
= dom_sid_dup(mem_ctx
, sid
);
448 if (authority_sid
== NULL
) {
449 return NT_STATUS_NO_MEMORY
;
451 authority_sid
->num_auths
--;
456 /* see if we've already done this authority name */
457 for (i
=0;i
<domains
->count
;i
++) {
458 if (strcasecmp_m(authority_name
, domains
->domains
[i
].name
.string
) == 0) {
464 domains
->domains
= talloc_realloc(domains
,
466 struct lsa_DomainInfo
,
468 if (domains
->domains
== NULL
) {
469 return NT_STATUS_NO_MEMORY
;
471 domains
->domains
[i
].name
.string
= authority_name
;
472 domains
->domains
[i
].sid
= authority_sid
;
474 domains
->max_size
= LSA_REF_DOMAIN_LIST_MULTIPLIER
* domains
->count
;
481 lookup a name for 1 SID
483 static NTSTATUS
dcesrv_lsa_lookup_sid(struct lsa_policy_state
*state
, TALLOC_CTX
*mem_ctx
,
484 struct dom_sid
*sid
, const char *sid_str
,
485 const char **authority_name
,
486 const char **name
, enum lsa_SidType
*rtype
)
491 struct ldb_message
**res
;
492 struct ldb_dn
*domain_dn
;
493 const char * const attrs
[] = { "sAMAccountName", "sAMAccountType", "cn", NULL
};
495 status
= lookup_well_known_sids(mem_ctx
, sid_str
, authority_name
, name
, rtype
);
496 if (NT_STATUS_IS_OK(status
)) {
500 if (dom_sid_in_domain(state
->domain_sid
, sid
)) {
501 *authority_name
= state
->domain_name
;
502 domain_dn
= state
->domain_dn
;
503 } else if (dom_sid_in_domain(state
->builtin_sid
, sid
)) {
504 *authority_name
= NAME_BUILTIN
;
505 domain_dn
= state
->builtin_dn
;
507 /* Not well known, our domain or built in */
509 /* In future, we must look at SID histories, and at trusted domains via winbind */
511 return NT_STATUS_NOT_FOUND
;
514 ret
= gendb_search(state
->sam_ldb
, mem_ctx
, domain_dn
, &res
, attrs
,
515 "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx
, sid
));
517 *name
= ldb_msg_find_attr_as_string(res
[0], "sAMAccountName", NULL
);
519 *name
= ldb_msg_find_attr_as_string(res
[0], "cn", NULL
);
521 *name
= talloc_strdup(mem_ctx
, sid_str
);
522 NT_STATUS_HAVE_NO_MEMORY(*name
);
526 atype
= samdb_result_uint(res
[0], "sAMAccountType", 0);
528 *rtype
= ds_atype_map(atype
);
533 /* need to re-add a check for an allocated sid */
535 return NT_STATUS_NOT_FOUND
;
542 NTSTATUS
dcesrv_lsa_LookupSids2(struct dcesrv_call_state
*dce_call
,
544 struct lsa_LookupSids2
*r
)
546 struct lsa_policy_state
*state
;
547 struct lsa_RefDomainList
*domains
= NULL
;
549 NTSTATUS status
= NT_STATUS_OK
;
551 if (r
->in
.level
< LSA_LOOKUP_NAMES_ALL
||
552 r
->in
.level
> LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC
) {
553 return NT_STATUS_INVALID_PARAMETER
;
556 *r
->out
.domains
= NULL
;
558 /* NOTE: the WSPP test suite tries SIDs with invalid revision numbers,
559 and expects NT_STATUS_INVALID_PARAMETER back - we just treat it as
560 an unknown SID. We could add a SID validator here. (tridge)
564 status
= dcesrv_lsa_get_policy_state(dce_call
, mem_ctx
, &state
);
565 if (!NT_STATUS_IS_OK(status
)) {
569 domains
= talloc_zero(r
->out
.domains
, struct lsa_RefDomainList
);
570 if (domains
== NULL
) {
571 return NT_STATUS_NO_MEMORY
;
573 *r
->out
.domains
= domains
;
575 r
->out
.names
= talloc_zero(mem_ctx
, struct lsa_TransNameArray2
);
576 if (r
->out
.names
== NULL
) {
577 return NT_STATUS_NO_MEMORY
;
582 r
->out
.names
->names
= talloc_array(r
->out
.names
, struct lsa_TranslatedName2
,
583 r
->in
.sids
->num_sids
);
584 if (r
->out
.names
->names
== NULL
) {
585 return NT_STATUS_NO_MEMORY
;
588 for (i
=0;i
<r
->in
.sids
->num_sids
;i
++) {
589 struct dom_sid
*sid
= r
->in
.sids
->sids
[i
].sid
;
590 char *sid_str
= dom_sid_string(mem_ctx
, sid
);
591 const char *name
, *authority_name
;
592 enum lsa_SidType rtype
;
596 r
->out
.names
->count
++;
598 r
->out
.names
->names
[i
].sid_type
= SID_NAME_UNKNOWN
;
599 r
->out
.names
->names
[i
].name
.string
= sid_str
;
600 r
->out
.names
->names
[i
].sid_index
= 0xFFFFFFFF;
601 r
->out
.names
->names
[i
].unknown
= 0;
603 if (sid_str
== NULL
) {
604 r
->out
.names
->names
[i
].name
.string
= "(SIDERROR)";
605 status
= STATUS_SOME_UNMAPPED
;
609 status2
= dcesrv_lsa_lookup_sid(state
, mem_ctx
, sid
, sid_str
,
610 &authority_name
, &name
, &rtype
);
611 if (!NT_STATUS_IS_OK(status2
)) {
612 status
= STATUS_SOME_UNMAPPED
;
616 /* set up the authority table */
617 status2
= dcesrv_lsa_authority_list(state
, mem_ctx
, rtype
,
619 domains
, &sid_index
);
620 if (!NT_STATUS_IS_OK(status2
)) {
624 r
->out
.names
->names
[i
].sid_type
= rtype
;
625 r
->out
.names
->names
[i
].name
.string
= name
;
626 r
->out
.names
->names
[i
].sid_index
= sid_index
;
627 r
->out
.names
->names
[i
].unknown
= 0;
632 if (*r
->out
.count
== 0) {
633 return NT_STATUS_NONE_MAPPED
;
635 if (*r
->out
.count
!= r
->in
.sids
->num_sids
) {
636 return STATUS_SOME_UNMAPPED
;
646 Identical to LookupSids2, but doesn't take a policy handle
649 NTSTATUS
dcesrv_lsa_LookupSids3(struct dcesrv_call_state
*dce_call
,
651 struct lsa_LookupSids3
*r
)
653 struct lsa_LookupSids2 r2
;
654 struct lsa_OpenPolicy2 pol
;
656 struct dcesrv_handle
*h
;
660 /* No policy handle on the wire, so make one up here */
661 r2
.in
.handle
= talloc(mem_ctx
, struct policy_handle
);
663 return NT_STATUS_NO_MEMORY
;
666 pol
.out
.handle
= r2
.in
.handle
;
667 pol
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
669 pol
.in
.system_name
= NULL
;
670 status
= dcesrv_lsa_OpenPolicy2(dce_call
, mem_ctx
, &pol
);
671 if (!NT_STATUS_IS_OK(status
)) {
675 /* ensure this handle goes away at the end of this call */
676 DCESRV_PULL_HANDLE(h
, r2
.in
.handle
, LSA_HANDLE_POLICY
);
677 talloc_steal(mem_ctx
, h
);
679 r2
.in
.sids
= r
->in
.sids
;
680 r2
.in
.names
= r
->in
.names
;
681 r2
.in
.level
= r
->in
.level
;
682 r2
.in
.count
= r
->in
.count
;
683 r2
.in
.lookup_options
= r
->in
.lookup_options
;
684 r2
.in
.client_revision
= r
->in
.client_revision
;
685 r2
.out
.count
= r
->out
.count
;
686 r2
.out
.names
= r
->out
.names
;
687 r2
.out
.domains
= r
->out
.domains
;
689 status
= dcesrv_lsa_LookupSids2(dce_call
, mem_ctx
, &r2
);
691 r
->out
.domains
= r2
.out
.domains
;
692 r
->out
.names
= r2
.out
.names
;
693 r
->out
.count
= r2
.out
.count
;
702 NTSTATUS
dcesrv_lsa_LookupSids(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
703 struct lsa_LookupSids
*r
)
705 struct lsa_LookupSids2 r2
;
711 r2
.in
.handle
= r
->in
.handle
;
712 r2
.in
.sids
= r
->in
.sids
;
714 r2
.in
.level
= r
->in
.level
;
715 r2
.in
.count
= r
->in
.count
;
716 r2
.in
.lookup_options
= 0;
717 r2
.in
.client_revision
= 0;
718 r2
.out
.count
= r
->out
.count
;
720 r2
.out
.domains
= r
->out
.domains
;
722 status
= dcesrv_lsa_LookupSids2(dce_call
, mem_ctx
, &r2
);
723 /* we deliberately don't check for error from the above,
724 as even on error we are supposed to return the names */
726 r
->out
.domains
= r2
.out
.domains
;
732 r
->out
.names
= talloc(mem_ctx
, struct lsa_TransNameArray
);
733 if (r
->out
.names
== NULL
) {
734 return NT_STATUS_NO_MEMORY
;
736 r
->out
.names
->count
= r2
.out
.names
->count
;
737 r
->out
.names
->names
= talloc_array(r
->out
.names
, struct lsa_TranslatedName
,
738 r
->out
.names
->count
);
739 if (r
->out
.names
->names
== NULL
) {
740 return NT_STATUS_NO_MEMORY
;
742 for (i
=0;i
<r
->out
.names
->count
;i
++) {
743 r
->out
.names
->names
[i
].sid_type
= r2
.out
.names
->names
[i
].sid_type
;
744 r
->out
.names
->names
[i
].name
.string
= r2
.out
.names
->names
[i
].name
.string
;
745 r
->out
.names
->names
[i
].sid_index
= r2
.out
.names
->names
[i
].sid_index
;
755 NTSTATUS
dcesrv_lsa_LookupNames3(struct dcesrv_call_state
*dce_call
,
757 struct lsa_LookupNames3
*r
)
759 struct lsa_policy_state
*policy_state
;
760 struct dcesrv_handle
*policy_handle
;
762 struct loadparm_context
*lp_ctx
= dce_call
->conn
->dce_ctx
->lp_ctx
;
763 struct lsa_RefDomainList
*domains
;
765 DCESRV_PULL_HANDLE(policy_handle
, r
->in
.handle
, LSA_HANDLE_POLICY
);
767 if (r
->in
.level
< LSA_LOOKUP_NAMES_ALL
||
768 r
->in
.level
> LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC
) {
769 return NT_STATUS_INVALID_PARAMETER
;
772 policy_state
= policy_handle
->data
;
774 *r
->out
.domains
= NULL
;
776 domains
= talloc_zero(mem_ctx
, struct lsa_RefDomainList
);
777 if (domains
== NULL
) {
778 return NT_STATUS_NO_MEMORY
;
780 *r
->out
.domains
= domains
;
782 r
->out
.sids
= talloc_zero(mem_ctx
, struct lsa_TransSidArray3
);
783 if (r
->out
.sids
== NULL
) {
784 return NT_STATUS_NO_MEMORY
;
789 r
->out
.sids
->sids
= talloc_array(r
->out
.sids
, struct lsa_TranslatedSid3
,
791 if (r
->out
.sids
->sids
== NULL
) {
792 return NT_STATUS_NO_MEMORY
;
795 for (i
=0;i
<r
->in
.num_names
;i
++) {
796 const char *name
= r
->in
.names
[i
].string
;
797 const char *authority_name
;
799 uint32_t sid_index
, rid
;
800 enum lsa_SidType rtype
;
803 r
->out
.sids
->count
++;
805 r
->out
.sids
->sids
[i
].sid_type
= SID_NAME_UNKNOWN
;
806 r
->out
.sids
->sids
[i
].sid
= NULL
;
807 r
->out
.sids
->sids
[i
].sid_index
= 0xFFFFFFFF;
808 r
->out
.sids
->sids
[i
].flags
= 0;
810 status2
= dcesrv_lsa_lookup_name(dce_call
->event_ctx
, lp_ctx
, policy_state
, mem_ctx
, name
,
811 &authority_name
, &sid
, &rtype
, &rid
);
812 if (!NT_STATUS_IS_OK(status2
) || sid
->num_auths
== 0) {
816 status2
= dcesrv_lsa_authority_list(policy_state
, mem_ctx
, rtype
, authority_name
,
817 sid
, domains
, &sid_index
);
818 if (!NT_STATUS_IS_OK(status2
)) {
822 r
->out
.sids
->sids
[i
].sid_type
= rtype
;
823 r
->out
.sids
->sids
[i
].sid
= sid
;
824 r
->out
.sids
->sids
[i
].sid_index
= sid_index
;
825 r
->out
.sids
->sids
[i
].flags
= 0;
830 if (*r
->out
.count
== 0) {
831 return NT_STATUS_NONE_MAPPED
;
833 if (*r
->out
.count
!= r
->in
.num_names
) {
834 return STATUS_SOME_UNMAPPED
;
843 Identical to LookupNames3, but doesn't take a policy handle
846 NTSTATUS
dcesrv_lsa_LookupNames4(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
847 struct lsa_LookupNames4
*r
)
849 struct lsa_LookupNames3 r2
;
850 struct lsa_OpenPolicy2 pol
;
852 struct dcesrv_handle
*h
;
856 /* No policy handle on the wire, so make one up here */
857 r2
.in
.handle
= talloc(mem_ctx
, struct policy_handle
);
859 return NT_STATUS_NO_MEMORY
;
862 pol
.out
.handle
= r2
.in
.handle
;
863 pol
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
865 pol
.in
.system_name
= NULL
;
866 status
= dcesrv_lsa_OpenPolicy2(dce_call
, mem_ctx
, &pol
);
867 if (!NT_STATUS_IS_OK(status
)) {
871 /* ensure this handle goes away at the end of this call */
872 DCESRV_PULL_HANDLE(h
, r2
.in
.handle
, LSA_HANDLE_POLICY
);
873 talloc_steal(mem_ctx
, h
);
875 r2
.in
.num_names
= r
->in
.num_names
;
876 r2
.in
.names
= r
->in
.names
;
877 r2
.in
.level
= r
->in
.level
;
878 r2
.in
.sids
= r
->in
.sids
;
879 r2
.in
.count
= r
->in
.count
;
880 r2
.in
.lookup_options
= r
->in
.lookup_options
;
881 r2
.in
.client_revision
= r
->in
.client_revision
;
882 r2
.out
.domains
= r
->out
.domains
;
883 r2
.out
.sids
= r
->out
.sids
;
884 r2
.out
.count
= r
->out
.count
;
886 status
= dcesrv_lsa_LookupNames3(dce_call
, mem_ctx
, &r2
);
888 r
->out
.domains
= r2
.out
.domains
;
889 r
->out
.sids
= r2
.out
.sids
;
890 r
->out
.count
= r2
.out
.count
;
897 NTSTATUS
dcesrv_lsa_LookupNames2(struct dcesrv_call_state
*dce_call
,
899 struct lsa_LookupNames2
*r
)
901 struct lsa_policy_state
*state
;
902 struct dcesrv_handle
*h
;
904 struct loadparm_context
*lp_ctx
= dce_call
->conn
->dce_ctx
->lp_ctx
;
905 struct lsa_RefDomainList
*domains
;
907 *r
->out
.domains
= NULL
;
909 DCESRV_PULL_HANDLE(h
, r
->in
.handle
, LSA_HANDLE_POLICY
);
911 if (r
->in
.level
< LSA_LOOKUP_NAMES_ALL
||
912 r
->in
.level
> LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC
) {
913 return NT_STATUS_INVALID_PARAMETER
;
918 domains
= talloc_zero(mem_ctx
, struct lsa_RefDomainList
);
919 if (domains
== NULL
) {
920 return NT_STATUS_NO_MEMORY
;
922 *r
->out
.domains
= domains
;
924 r
->out
.sids
= talloc_zero(mem_ctx
, struct lsa_TransSidArray2
);
925 if (r
->out
.sids
== NULL
) {
926 return NT_STATUS_NO_MEMORY
;
931 r
->out
.sids
->sids
= talloc_array(r
->out
.sids
, struct lsa_TranslatedSid2
,
933 if (r
->out
.sids
->sids
== NULL
) {
934 return NT_STATUS_NO_MEMORY
;
937 for (i
=0;i
<r
->in
.num_names
;i
++) {
938 const char *name
= r
->in
.names
[i
].string
;
939 const char *authority_name
;
941 uint32_t rtype
, sid_index
, rid
=0;
944 r
->out
.sids
->count
++;
946 r
->out
.sids
->sids
[i
].sid_type
= SID_NAME_UNKNOWN
;
947 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
948 to sid NULL - so we should return 0 rid for
950 r
->out
.sids
->sids
[i
].rid
= 0;
951 r
->out
.sids
->sids
[i
].sid_index
= 0xFFFFFFFF;
952 r
->out
.sids
->sids
[i
].unknown
= 0;
954 status2
= dcesrv_lsa_lookup_name(dce_call
->event_ctx
, lp_ctx
, state
, mem_ctx
, name
,
955 &authority_name
, &sid
, &rtype
, &rid
);
956 if (!NT_STATUS_IS_OK(status2
)) {
960 status2
= dcesrv_lsa_authority_list(state
, mem_ctx
, rtype
, authority_name
,
961 sid
, domains
, &sid_index
);
962 if (!NT_STATUS_IS_OK(status2
)) {
966 r
->out
.sids
->sids
[i
].sid_type
= rtype
;
967 r
->out
.sids
->sids
[i
].rid
= rid
;
968 r
->out
.sids
->sids
[i
].sid_index
= sid_index
;
969 r
->out
.sids
->sids
[i
].unknown
= 0;
974 if (*r
->out
.count
== 0) {
975 return NT_STATUS_NONE_MAPPED
;
977 if (*r
->out
.count
!= r
->in
.num_names
) {
978 return STATUS_SOME_UNMAPPED
;
987 NTSTATUS
dcesrv_lsa_LookupNames(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
988 struct lsa_LookupNames
*r
)
990 struct lsa_LookupNames2 r2
;
996 r2
.in
.handle
= r
->in
.handle
;
997 r2
.in
.num_names
= r
->in
.num_names
;
998 r2
.in
.names
= r
->in
.names
;
1000 r2
.in
.level
= r
->in
.level
;
1001 r2
.in
.count
= r
->in
.count
;
1002 r2
.in
.lookup_options
= 0;
1003 r2
.in
.client_revision
= 0;
1004 r2
.out
.count
= r
->out
.count
;
1005 r2
.out
.domains
= r
->out
.domains
;
1007 status
= dcesrv_lsa_LookupNames2(dce_call
, mem_ctx
, &r2
);
1008 if (r2
.out
.sids
== NULL
) {
1012 r
->out
.sids
= talloc(mem_ctx
, struct lsa_TransSidArray
);
1013 if (r
->out
.sids
== NULL
) {
1014 return NT_STATUS_NO_MEMORY
;
1016 r
->out
.sids
->count
= r2
.out
.sids
->count
;
1017 r
->out
.sids
->sids
= talloc_array(r
->out
.sids
, struct lsa_TranslatedSid
,
1018 r
->out
.sids
->count
);
1019 if (r
->out
.sids
->sids
== NULL
) {
1020 return NT_STATUS_NO_MEMORY
;
1022 for (i
=0;i
<r
->out
.sids
->count
;i
++) {
1023 r
->out
.sids
->sids
[i
].sid_type
= r2
.out
.sids
->sids
[i
].sid_type
;
1024 r
->out
.sids
->sids
[i
].rid
= r2
.out
.sids
->sids
[i
].rid
;
1025 r
->out
.sids
->sids
[i
].sid_index
= r2
.out
.sids
->sids
[i
].sid_index
;