?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
sync'ing up for 3.0alpha20 release
[Samba/gbeck.git] / source3 / rpc_server / srv_lsa_nt.c
blobe187e1556eff510d79226f56e147ad5ee0f366aa
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001,
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough 2002.
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 */
25
26 /* This is the implementation of the lsa server code. */
27
28 #include "includes.h"
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_RPC_SRV
32
33 extern fstring global_myworkgroup;
34 extern pstring global_myname;
35 extern PRIVS privs[];
36
37 struct lsa_info {
38 DOM_SID sid;
39 uint32 access;
40 };
41
42 struct generic_mapping lsa_generic_mapping = {
43 POLICY_READ,
44 POLICY_WRITE,
45 POLICY_EXECUTE,
46 POLICY_ALL_ACCESS
47 };
48
49 /*******************************************************************
50 Function to free the per handle data.
51 ********************************************************************/
52
53 static void free_lsa_info(void *ptr)
54 {
55 struct lsa_info *lsa = (struct lsa_info *)ptr;
56
57 SAFE_FREE(lsa);
58 }
59
60 /***************************************************************************
61 Init dom_query
62 ***************************************************************************/
63
64 static void init_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
65 {
66 int domlen = (dom_name != NULL) ? strlen(dom_name) : 0;
67
68 /*
69 * I'm not sure why this really odd combination of length
70 * values works, but it does appear to. I need to look at
71 * this *much* more closely - but at the moment leave alone
72 * until it's understood. This allows a W2k client to join
73 * a domain with both odd and even length names... JRA.
74 */
75
76 d_q->uni_dom_str_len = domlen ? ((domlen + 1) * 2) : 0;
77 d_q->uni_dom_max_len = domlen * 2;
78 d_q->buffer_dom_name = domlen != 0 ? 1 : 0; /* domain buffer pointer */
79 d_q->buffer_dom_sid = dom_sid != NULL ? 1 : 0; /* domain sid pointer */
80
81 /* this string is supposed to be character short */
82 init_unistr2(&d_q->uni_domain_name, dom_name, domlen);
83 d_q->uni_domain_name.uni_max_len++;
84
85 if (dom_sid != NULL)
86 init_dom_sid2(&d_q->dom_sid, dom_sid);
87 }
88
89 /***************************************************************************
90 init_dom_ref - adds a domain if it's not already in, returns the index.
91 ***************************************************************************/
92
93 static int init_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid)
94 {
95 int num = 0;
96 int len;
97
98 if (dom_name != NULL) {
99 for (num = 0; num < ref->num_ref_doms_1; num++) {
100 fstring domname;
101 rpcstr_pull(domname, &ref->ref_dom[num].uni_dom_name, sizeof(domname), -1, 0);
102 if (strequal(domname, dom_name))
103 return num;
104 }
105 } else {
106 num = ref->num_ref_doms_1;
107 }
108
109 if (num >= MAX_REF_DOMAINS) {
110 /* index not found, already at maximum domain limit */
111 return -1;
112 }
113
114 ref->num_ref_doms_1 = num+1;
115 ref->ptr_ref_dom = 1;
116 ref->max_entries = MAX_REF_DOMAINS;
117 ref->num_ref_doms_2 = num+1;
118
119 len = (dom_name != NULL) ? strlen(dom_name) : 0;
120 if(dom_name != NULL && len == 0)
121 len = 1;
122
123 init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, len);
124 ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0;
125
126 init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, len);
127 init_dom_sid2(&ref->ref_dom[num].ref_dom, dom_sid );
128
129 return num;
130 }
131
132 /***************************************************************************
133 init_lsa_rid2s
134 ***************************************************************************/
135
136 static void init_lsa_rid2s(DOM_R_REF *ref, DOM_RID2 *rid2,
137 int num_entries, UNISTR2 *name,
138 uint32 *mapped_count, BOOL endian)
139 {
140 int i;
141 int total = 0;
142 *mapped_count = 0;
143
144 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
145
146 become_root(); /* lookup_name can require root privs */
147
148 for (i = 0; i < num_entries; i++) {
149 BOOL status = False;
150 DOM_SID sid;
151 uint32 rid = 0xffffffff;
152 int dom_idx = -1;
153 pstring full_name;
154 fstring dom_name, user;
155 enum SID_NAME_USE name_type = SID_NAME_UNKNOWN;
156
157 /* Split name into domain and user component */
158
159 unistr2_to_ascii(full_name, &name[i], sizeof(full_name));
160 split_domain_name(full_name, dom_name, user);
161
162 /* Lookup name */
163
164 DEBUG(5, ("init_lsa_rid2s: looking up name %s\n", full_name));
165
166 status = lookup_name(dom_name, user, &sid, &name_type);
167
168 DEBUG(5, ("init_lsa_rid2s: %s\n", status ? "found" :
169 "not found"));
170
171 if (status && name_type != SID_NAME_UNKNOWN) {
172 sid_split_rid(&sid, &rid);
173 dom_idx = init_dom_ref(ref, dom_name, &sid);
174 (*mapped_count)++;
175 } else {
176 dom_idx = -1;
177 rid = 0xffffffff;
178 name_type = SID_NAME_UNKNOWN;
179 }
180
181 init_dom_rid2(&rid2[total], rid, name_type, dom_idx);
182 total++;
183 }
184
185 unbecome_root();
186 }
187
188 /***************************************************************************
189 init_reply_lookup_names
190 ***************************************************************************/
191
192 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
193 DOM_R_REF *ref, uint32 num_entries,
194 DOM_RID2 *rid2, uint32 mapped_count)
195 {
196 r_l->ptr_dom_ref = 1;
197 r_l->dom_ref = ref;
198
199 r_l->num_entries = num_entries;
200 r_l->ptr_entries = 1;
201 r_l->num_entries2 = num_entries;
202 r_l->dom_rid = rid2;
203
204 r_l->mapped_count = mapped_count;
205
206 if (mapped_count == 0)
207 r_l->status = NT_STATUS_NONE_MAPPED;
208 else
209 r_l->status = NT_STATUS_OK;
210 }
211
212 /***************************************************************************
213 Init lsa_trans_names.
214 ***************************************************************************/
215
216 static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *trn,
217 int num_entries, DOM_SID2 *sid,
218 uint32 *mapped_count)
219 {
220 int i;
221 int total = 0;
222 *mapped_count = 0;
223
224 /* Allocate memory for list of names */
225
226 if (num_entries > 0) {
227 if (!(trn->name = (LSA_TRANS_NAME *)talloc(ctx, sizeof(LSA_TRANS_NAME) *
228 num_entries))) {
229 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
230 return;
231 }
232
233 if (!(trn->uni_name = (UNISTR2 *)talloc(ctx, sizeof(UNISTR2) *
234 num_entries))) {
235 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
236 return;
237 }
238 }
239
240 become_root(); /* Need root to get to passdb to for local sids */
241
242 for (i = 0; i < num_entries; i++) {
243 BOOL status = False;
244 DOM_SID find_sid = sid[i].sid;
245 uint32 rid = 0xffffffff;
246 int dom_idx = -1;
247 fstring name, dom_name;
248 enum SID_NAME_USE sid_name_use = (enum SID_NAME_USE)0;
249
250 sid_to_string(name, &find_sid);
251 DEBUG(5, ("init_lsa_trans_names: looking up sid %s\n", name));
252
253 /* Lookup sid from winbindd */
254
255 memset(dom_name, '\0', sizeof(dom_name));
256 memset(name, '\0', sizeof(name));
257
258 status = lookup_sid(&find_sid, dom_name, name, &sid_name_use);
259
260 DEBUG(5, ("init_lsa_trans_names: %s\n", status ? "found" :
261 "not found"));
262
263 if (!status) {
264 sid_name_use = SID_NAME_UNKNOWN;
265 } else {
266 (*mapped_count)++;
267 }
268
269 /* Store domain sid in ref array */
270
271 if (find_sid.num_auths == 5) {
272 sid_split_rid(&find_sid, &rid);
273 }
274
275 dom_idx = init_dom_ref(ref, dom_name, &find_sid);
276
277 DEBUG(10,("init_lsa_trans_names: added user '%s\\%s' to "
278 "referenced list.\n", dom_name, name ));
279
280 init_lsa_trans_name(&trn->name[total], &trn->uni_name[total],
281 sid_name_use, name, dom_idx);
282 total++;
283 }
284
285 unbecome_root();
286
287 trn->num_entries = total;
288 trn->ptr_trans_names = 1;
289 trn->num_entries2 = total;
290 }
291
292 /***************************************************************************
293 Init_reply_lookup_sids.
294 ***************************************************************************/
295
296 static void init_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
297 DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *names,
298 uint32 mapped_count)
299 {
300 r_l->ptr_dom_ref = 1;
301 r_l->dom_ref = ref;
302 r_l->names = names;
303 r_l->mapped_count = mapped_count;
304
305 if (mapped_count == 0)
306 r_l->status = NT_STATUS_NONE_MAPPED;
307 else
308 r_l->status = NT_STATUS_OK;
309 }
310
311 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
312 {
313 extern DOM_SID global_sid_World;
314 extern DOM_SID global_sid_Builtin;
315 DOM_SID local_adm_sid;
316 DOM_SID adm_sid;
317
318 SEC_ACE ace[3];
319 SEC_ACCESS mask;
320
321 SEC_ACL *psa = NULL;
322
323 init_sec_access(&mask, POLICY_EXECUTE);
324 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
325
326 sid_copy(&adm_sid, get_global_sam_sid());
327 sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
328 init_sec_access(&mask, POLICY_ALL_ACCESS);
329 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
330
331 sid_copy(&local_adm_sid, &global_sid_Builtin);
332 sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
333 init_sec_access(&mask, POLICY_ALL_ACCESS);
334 init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
335
336 if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
337 return NT_STATUS_NO_MEMORY;
338
339 if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, &adm_sid, NULL, NULL, psa, sd_size)) == NULL)
340 return NT_STATUS_NO_MEMORY;
341
342 return NT_STATUS_OK;
343 }
344
345 /***************************************************************************
346 init_dns_dom_info.
347 ***************************************************************************/
348 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, char *nb_name,
349 char *dns_name, char *forest_name,
350 GUID *dom_guid, DOM_SID *dom_sid)
351 {
352 if (nb_name && *nb_name) {
353 init_uni_hdr(&r_l->hdr_nb_dom_name, strlen(nb_name));
354 init_unistr2(&r_l->uni_nb_dom_name, nb_name,
355 strlen(nb_name));
356 r_l->hdr_nb_dom_name.uni_max_len += 2;
357 r_l->uni_nb_dom_name.uni_max_len += 1;
358 }
359
360 if (dns_name && *dns_name) {
361 init_uni_hdr(&r_l->hdr_dns_dom_name, strlen(dns_name));
362 init_unistr2(&r_l->uni_dns_dom_name, dns_name,
363 strlen(dns_name));
364 r_l->hdr_dns_dom_name.uni_max_len += 2;
365 r_l->uni_dns_dom_name.uni_max_len += 1;
366 }
367
368 if (forest_name && *forest_name) {
369 init_uni_hdr(&r_l->hdr_forest_name, strlen(forest_name));
370 init_unistr2(&r_l->uni_forest_name, forest_name,
371 strlen(forest_name));
372 r_l->hdr_forest_name.uni_max_len += 2;
373 r_l->uni_forest_name.uni_max_len += 1;
374 }
375
376 /* how do we init the guid ? probably should write an init fn */
377 if (dom_guid) {
378 memcpy(&r_l->dom_guid, dom_guid, sizeof(GUID));
379 }
380
381 if (dom_sid) {
382 r_l->ptr_dom_sid = 1;
383 init_dom_sid2(&r_l->dom_sid, dom_sid);
384 }
385 }
386
387 /***************************************************************************
388 _lsa_open_policy2.
389 ***************************************************************************/
390
391 NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL2 *r_u)
392 {
393 struct lsa_info *info;
394 SEC_DESC *psd = NULL;
395 size_t sd_size;
396 uint32 des_access=q_u->des_access;
397 uint32 acc_granted;
398 NTSTATUS status;
399
400
401 /* map the generic bits to the lsa policy ones */
402 se_map_generic(&des_access, &lsa_generic_mapping);
403
404 /* get the generic lsa policy SD until we store it */
405 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
406
407 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status))
408 return status;
409
410 /* associate the domain SID with the (unique) handle. */
411 if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
412 return NT_STATUS_NO_MEMORY;
413
414 ZERO_STRUCTP(info);
415 sid_copy(&info->sid,get_global_sam_sid());
416 info->access = acc_granted;
417
418 /* set up the LSA QUERY INFO response */
419 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
420 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
421
422 return NT_STATUS_OK;
423 }
424
425 /***************************************************************************
426 _lsa_open_policy
427 ***************************************************************************/
428
429 NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *r_u)
430 {
431 struct lsa_info *info;
432 SEC_DESC *psd = NULL;
433 size_t sd_size;
434 uint32 des_access=q_u->des_access;
435 uint32 acc_granted;
436 NTSTATUS status;
437
438
439 /* map the generic bits to the lsa policy ones */
440 se_map_generic(&des_access, &lsa_generic_mapping);
441
442 /* get the generic lsa policy SD until we store it */
443 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
444
445 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status))
446 return status;
447
448 /* associate the domain SID with the (unique) handle. */
449 if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
450 return NT_STATUS_NO_MEMORY;
451
452 ZERO_STRUCTP(info);
453 sid_copy(&info->sid,get_global_sam_sid());
454 info->access = acc_granted;
455
456 /* set up the LSA QUERY INFO response */
457 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
458 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
459
460 return NT_STATUS_OK;
461 }
462
463 /***************************************************************************
464 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
465 ufff, done :) mimir
466 ***************************************************************************/
467
468 NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_ENUM_TRUST_DOM *r_u)
469 {
470 struct lsa_info *info;
471 uint32 enum_context = q_u->enum_context;
472
473 /*
474 * preferred length is set to 5 as a "our" preferred length
475 * nt sets this parameter to 2
476 * update (20.08.2002): it's not preferred length, but preferred size!
477 * it needs further investigation how to optimally choose this value
478 */
479 uint32 max_num_domains = q_u->preferred_len < 5 ? q_u->preferred_len : 10;
480 TRUSTDOM **trust_doms;
481 uint32 num_domains;
482 NTSTATUS nt_status;
483
484 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
485 return NT_STATUS_INVALID_HANDLE;
486
487 /* check if the user have enough rights */
488 if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
489 return NT_STATUS_ACCESS_DENIED;
490
491 nt_status = secrets_get_trusted_domains(p->mem_ctx, &enum_context, max_num_domains, &num_domains, &trust_doms);
492
493 if (!NT_STATUS_IS_OK(nt_status) &&
494 !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES) &&
495 !NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES)) {
496 return nt_status;
497 } else {
498 r_u->status = nt_status;
499 }
500
501 /* set up the lsa_enum_trust_dom response */
502 init_r_enum_trust_dom(p->mem_ctx, r_u, enum_context, max_num_domains, num_domains, trust_doms);
503
504 return r_u->status;
505 }
506
507 /***************************************************************************
508 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
509 ***************************************************************************/
510
511 NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INFO *r_u)
512 {
513 struct lsa_info *handle;
514 LSA_INFO_UNION *info = &r_u->dom;
515 DOM_SID domain_sid;
516 char *name = NULL;
517 DOM_SID *sid = NULL;
518
519 r_u->status = NT_STATUS_OK;
520
521 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
522 return NT_STATUS_INVALID_HANDLE;
523
524 switch (q_u->info_class) {
525 case 0x02:
526 {
527 unsigned int i;
528 /* check if the user have enough rights */
529 if (!(handle->access & POLICY_VIEW_AUDIT_INFORMATION))
530 return NT_STATUS_ACCESS_DENIED;
531
532 /* fake info: We audit everything. ;) */
533 info->id2.auditing_enabled = 1;
534 info->id2.count1 = 7;
535 info->id2.count2 = 7;
536 if ((info->id2.auditsettings = (uint32 *)talloc(p->mem_ctx,7*sizeof(uint32))) == NULL)
537 return NT_STATUS_NO_MEMORY;
538 for (i = 0; i < 7; i++)
539 info->id2.auditsettings[i] = 3;
540 break;
541 }
542 case 0x03:
543 /* check if the user have enough rights */
544 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
545 return NT_STATUS_ACCESS_DENIED;
546
547 /* Request PolicyPrimaryDomainInformation. */
548 switch (lp_server_role()) {
549 case ROLE_DOMAIN_PDC:
550 case ROLE_DOMAIN_BDC:
551 name = global_myworkgroup;
552 sid = get_global_sam_sid();
553 break;
554 case ROLE_DOMAIN_MEMBER:
555 name = global_myworkgroup;
556 /* We need to return the Domain SID here. */
557 if (secrets_fetch_domain_sid(global_myworkgroup,
558 &domain_sid))
559 sid = &domain_sid;
560 else
561 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
562 break;
563 case ROLE_STANDALONE:
564 name = global_myworkgroup;
565 sid = NULL;
566 break;
567 default:
568 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
569 }
570 init_dom_query(&r_u->dom.id3, name, sid);
571 break;
572 case 0x05:
573 /* check if the user have enough rights */
574 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
575 return NT_STATUS_ACCESS_DENIED;
576
577 /* Request PolicyAccountDomainInformation. */
578 switch (lp_server_role()) {
579 case ROLE_DOMAIN_PDC:
580 case ROLE_DOMAIN_BDC:
581 name = global_myworkgroup;
582 sid = get_global_sam_sid();
583 break;
584 case ROLE_DOMAIN_MEMBER:
585 name = global_myname;
586 sid = get_global_sam_sid();
587 break;
588 case ROLE_STANDALONE:
589 name = global_myname;
590 sid = get_global_sam_sid();
591 break;
592 default:
593 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
594 }
595 init_dom_query(&r_u->dom.id5, name, sid);
596 break;
597 case 0x06:
598 /* check if the user have enough rights */
599 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
600 return NT_STATUS_ACCESS_DENIED;
601
602 switch (lp_server_role()) {
603 case ROLE_DOMAIN_BDC:
604 /*
605 * only a BDC is a backup controller
606 * of the domain, it controls.
607 */
608 info->id6.server_role = 2;
609 break;
610 default:
611 /*
612 * any other role is a primary
613 * of the domain, it controls.
614 */
615 info->id6.server_role = 3;
616 break;
617 }
618 break;
619 default:
620 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u->info_class));
621 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
622 break;
623 }
624
625 if (NT_STATUS_IS_OK(r_u->status)) {
626 r_u->undoc_buffer = 0x22000000; /* bizarre */
627 r_u->info_class = q_u->info_class;
628 }
629
630 return r_u->status;
631 }
632
633 /***************************************************************************
634 _lsa_lookup_sids
635 ***************************************************************************/
636
637 NTSTATUS _lsa_lookup_sids(pipes_struct *p, LSA_Q_LOOKUP_SIDS *q_u, LSA_R_LOOKUP_SIDS *r_u)
638 {
639 struct lsa_info *handle;
640 DOM_SID2 *sid = q_u->sids.sid;
641 int num_entries = q_u->sids.num_entries;
642 DOM_R_REF *ref = NULL;
643 LSA_TRANS_NAME_ENUM *names = NULL;
644 uint32 mapped_count = 0;
645
646 ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
647 names = (LSA_TRANS_NAME_ENUM *)talloc_zero(p->mem_ctx, sizeof(LSA_TRANS_NAME_ENUM));
648
649 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
650 r_u->status = NT_STATUS_INVALID_HANDLE;
651 goto done;
652 }
653
654 /* check if the user have enough rights */
655 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
656 r_u->status = NT_STATUS_ACCESS_DENIED;
657 goto done;
658 }
659 if (!ref || !names)
660 return NT_STATUS_NO_MEMORY;
661
662 done:
663
664 /* set up the LSA Lookup SIDs response */
665 init_lsa_trans_names(p->mem_ctx, ref, names, num_entries, sid, &mapped_count);
666 init_reply_lookup_sids(r_u, ref, names, mapped_count);
667
668 return r_u->status;
669 }
670
671 /***************************************************************************
672 lsa_reply_lookup_names
673 ***************************************************************************/
674
675 NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP_NAMES *r_u)
676 {
677 struct lsa_info *handle;
678 UNISTR2 *names = q_u->uni_name;
679 int num_entries = q_u->num_entries;
680 DOM_R_REF *ref;
681 DOM_RID2 *rids;
682 uint32 mapped_count = 0;
683
684 if (num_entries > MAX_LOOKUP_SIDS) {
685 num_entries = MAX_LOOKUP_SIDS;
686 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
687 }
688
689 ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
690 rids = (DOM_RID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_RID2)*num_entries);
691
692 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
693 r_u->status = NT_STATUS_INVALID_HANDLE;
694 goto done;
695 }
696
697 /* check if the user have enough rights */
698 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
699 r_u->status = NT_STATUS_ACCESS_DENIED;
700 goto done;
701 }
702
703 if (!ref || !rids)
704 return NT_STATUS_NO_MEMORY;
705
706 done:
707
708 /* set up the LSA Lookup RIDs response */
709 init_lsa_rid2s(ref, rids, num_entries, names, &mapped_count, p->endian);
710 init_reply_lookup_names(r_u, ref, num_entries, rids, mapped_count);
711
712 return r_u->status;
713 }
714
715 /***************************************************************************
716 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
717 ***************************************************************************/
718
719 NTSTATUS _lsa_close(pipes_struct *p, LSA_Q_CLOSE *q_u, LSA_R_CLOSE *r_u)
720 {
721 if (!find_policy_by_hnd(p, &q_u->pol, NULL))
722 return NT_STATUS_INVALID_HANDLE;
723
724 close_policy_hnd(p, &q_u->pol);
725 return NT_STATUS_OK;
726 }
727
728 /***************************************************************************
729 "No more secrets Marty...." :-).
730 ***************************************************************************/
731
732 NTSTATUS _lsa_open_secret(pipes_struct *p, LSA_Q_OPEN_SECRET *q_u, LSA_R_OPEN_SECRET *r_u)
733 {
734 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
735 }
736
737 /***************************************************************************
738 _lsa_enum_privs.
739 ***************************************************************************/
740
741 NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIVS *r_u)
742 {
743 struct lsa_info *handle;
744 uint32 i;
745
746 uint32 enum_context=q_u->enum_context;
747 LSA_PRIV_ENTRY *entry;
748 LSA_PRIV_ENTRY *entries=NULL;
749
750 if (enum_context >= PRIV_ALL_INDEX)
751 return NT_STATUS_NO_MORE_ENTRIES;
752
753 entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX));
754 if (entries==NULL)
755 return NT_STATUS_NO_MEMORY;
756
757 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
758 return NT_STATUS_INVALID_HANDLE;
759
760 /* check if the user have enough rights */
761
762 /*
763 * I don't know if it's the right one. not documented.
764 */
765 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
766 return NT_STATUS_ACCESS_DENIED;
767
768 entry = entries;
769
770 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n", enum_context, PRIV_ALL_INDEX));
771
772 for (i = 0; i < PRIV_ALL_INDEX; i++, entry++) {
773 if( i<enum_context) {
774 init_uni_hdr(&entry->hdr_name, 0);
775 init_unistr2(&entry->name, NULL, 0 );
776 entry->luid_low = 0;
777 entry->luid_high = 0;
778 } else {
779 init_uni_hdr(&entry->hdr_name, strlen(privs[i+1].priv));
780 init_unistr2(&entry->name, privs[i+1].priv, strlen(privs[i+1].priv) );
781 entry->luid_low = privs[i+1].se_priv;
782 entry->luid_high = 0;
783 }
784 }
785
786 enum_context = PRIV_ALL_INDEX;
787 init_lsa_r_enum_privs(r_u, enum_context, PRIV_ALL_INDEX, entries);
788
789 return NT_STATUS_OK;
790 }
791
792 /***************************************************************************
793 _lsa_priv_get_dispname.
794 ***************************************************************************/
795
796 NTSTATUS _lsa_priv_get_dispname(pipes_struct *p, LSA_Q_PRIV_GET_DISPNAME *q_u, LSA_R_PRIV_GET_DISPNAME *r_u)
797 {
798 struct lsa_info *handle;
799 fstring name_asc;
800 int i=1;
801
802 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
803 return NT_STATUS_INVALID_HANDLE;
804
805 /* check if the user have enough rights */
806
807 /*
808 * I don't know if it's the right one. not documented.
809 */
810 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
811 return NT_STATUS_ACCESS_DENIED;
812
813 unistr2_to_ascii(name_asc, &q_u->name, sizeof(name_asc));
814
815 DEBUG(10,("_lsa_priv_get_dispname: %s", name_asc));
816
817 while (privs[i].se_priv!=SE_PRIV_ALL && strcmp(name_asc, privs[i].priv))
818 i++;
819
820 if (privs[i].se_priv!=SE_PRIV_ALL) {
821 DEBUG(10,(": %s\n", privs[i].description));
822 init_uni_hdr(&r_u->hdr_desc, strlen(privs[i].description));
823 init_unistr2(&r_u->desc, privs[i].description, strlen(privs[i].description) );
824
825 r_u->ptr_info=0xdeadbeef;
826 r_u->lang_id=q_u->lang_id;
827 return NT_STATUS_OK;
828 } else {
829 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
830 r_u->ptr_info=0;
831 return NT_STATUS_NO_SUCH_PRIVILEGE;
832 }
833 }
834
835 /***************************************************************************
836 _lsa_enum_accounts.
837 ***************************************************************************/
838
839 NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENUM_ACCOUNTS *r_u)
840 {
841 struct lsa_info *handle;
842 GROUP_MAP *map=NULL;
843 int num_entries=0;
844 LSA_SID_ENUM *sids=&r_u->sids;
845 int i=0,j=0;
846
847 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
848 return NT_STATUS_INVALID_HANDLE;
849
850 /* check if the user have enough rights */
851
852 /*
853 * I don't know if it's the right one. not documented.
854 */
855 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
856 return NT_STATUS_ACCESS_DENIED;
857
858 /* get the list of mapped groups (domain, local, builtin) */
859 if(!enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV))
860 return NT_STATUS_OK;
861
862 if (q_u->enum_context >= num_entries)
863 return NT_STATUS_NO_MORE_ENTRIES;
864
865 sids->ptr_sid = (uint32 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(uint32));
866 sids->sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(DOM_SID2));
867
868 if (sids->ptr_sid==NULL || sids->sid==NULL) {
869 SAFE_FREE(map);
870 return NT_STATUS_NO_MEMORY;
871 }
872
873 for (i=q_u->enum_context, j=0; i<num_entries; i++) {
874 init_dom_sid2( &(*sids).sid[j], &map[i].sid);
875 (*sids).ptr_sid[j]=1;
876 j++;
877 }
878
879 SAFE_FREE(map);
880
881 init_lsa_r_enum_accounts(r_u, j);
882
883 return NT_STATUS_OK;
884 }
885
886
887 NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u)
888 {
889 fstring username, domname;
890 int ulen, dlen;
891 user_struct *vuser = get_valid_user_struct(p->vuid);
892
893 if (vuser == NULL)
894 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
895
896 fstrcpy(username, vuser->user.smb_name);
897 fstrcpy(domname, vuser->user.domain);
898
899 ulen = strlen(username) + 1;
900 dlen = strlen(domname) + 1;
901
902 init_uni_hdr(&r_u->hdr_user_name, ulen);
903 r_u->ptr_user_name = 1;
904 init_unistr2(&r_u->uni2_user_name, username, ulen);
905
906 r_u->unk1 = 1;
907
908 init_uni_hdr(&r_u->hdr_dom_name, dlen);
909 r_u->ptr_dom_name = 1;
910 init_unistr2(&r_u->uni2_dom_name, domname, dlen);
911
912 r_u->status = NT_STATUS_OK;
913
914 return r_u->status;
915 }
916
917 /***************************************************************************
918
919 ***************************************************************************/
920
921 NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENACCOUNT *r_u)
922 {
923 struct lsa_info *handle;
924 struct lsa_info *info;
925
926 r_u->status = NT_STATUS_OK;
927
928 /* find the connection policy handle. */
929 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
930 return NT_STATUS_INVALID_HANDLE;
931
932 /* check if the user have enough rights */
933
934 /*
935 * I don't know if it's the right one. not documented.
936 * but guessed with rpcclient.
937 */
938 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
939 return NT_STATUS_ACCESS_DENIED;
940
941 /* associate the user/group SID with the (unique) handle. */
942 if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
943 return NT_STATUS_NO_MEMORY;
944
945 ZERO_STRUCTP(info);
946 info->sid = q_u->sid.sid;
947 info->access = q_u->access;
948
949 /* get a (unique) handle. open a policy on it. */
950 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
951 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
952
953 return r_u->status;
954 }
955
956 /***************************************************************************
957 For a given SID, enumerate all the privilege this account has.
958 ***************************************************************************/
959
960 NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u)
961 {
962 struct lsa_info *info=NULL;
963 GROUP_MAP map;
964 int i=0;
965
966 LUID_ATTR *set=NULL;
967
968 r_u->status = NT_STATUS_OK;
969
970 /* find the connection policy handle. */
971 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
972 return NT_STATUS_INVALID_HANDLE;
973
974 if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
975 return NT_STATUS_NO_SUCH_GROUP;
976
977 DEBUG(10,("_lsa_enum_privsaccount: %d privileges\n", map.priv_set.count));
978 if (map.priv_set.count!=0) {
979
980 set=(LUID_ATTR *)talloc(p->mem_ctx, map.priv_set.count*sizeof(LUID_ATTR));
981 if (set == NULL) {
982 free_privilege(&map.priv_set);
983 return NT_STATUS_NO_MEMORY;
984 }
985
986 for (i=0; i<map.priv_set.count; i++) {
987 set[i].luid.low=map.priv_set.set[i].luid.low;
988 set[i].luid.high=map.priv_set.set[i].luid.high;
989 set[i].attr=map.priv_set.set[i].attr;
990 DEBUG(10,("_lsa_enum_privsaccount: priv %d: %d:%d:%d\n", i,
991 set[i].luid.high, set[i].luid.low, set[i].attr));
992 }
993 }
994
995 init_lsa_r_enum_privsaccount(r_u, set, map.priv_set.count, 0);
996 free_privilege(&map.priv_set);
997
998 return r_u->status;
999 }
1000
1001 /***************************************************************************
1002
1003 ***************************************************************************/
1004
1005 NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA_R_GETSYSTEMACCOUNT *r_u)
1006 {
1007 struct lsa_info *info=NULL;
1008 GROUP_MAP map;
1009 r_u->status = NT_STATUS_OK;
1010
1011 /* find the connection policy handle. */
1012 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1013 return NT_STATUS_INVALID_HANDLE;
1014
1015 if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITHOUT_PRIV))
1016 return NT_STATUS_NO_SUCH_GROUP;
1017
1018 /*
1019 0x01 -> Log on locally
1020 0x02 -> Access this computer from network
1021 0x04 -> Log on as a batch job
1022 0x10 -> Log on as a service
1023
1024 they can be ORed together
1025 */
1026
1027 r_u->access=map.systemaccount;
1028
1029 return r_u->status;
1030 }
1031
1032 /***************************************************************************
1033 update the systemaccount information
1034 ***************************************************************************/
1035
1036 NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA_R_SETSYSTEMACCOUNT *r_u)
1037 {
1038 struct lsa_info *info=NULL;
1039 GROUP_MAP map;
1040 r_u->status = NT_STATUS_OK;
1041
1042 /* find the connection policy handle. */
1043 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1044 return NT_STATUS_INVALID_HANDLE;
1045
1046 if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
1047 return NT_STATUS_NO_SUCH_GROUP;
1048
1049 map.systemaccount=q_u->access;
1050
1051 if(!add_mapping_entry(&map, TDB_REPLACE))
1052 return NT_STATUS_NO_SUCH_GROUP;
1053
1054 free_privilege(&map.priv_set);
1055
1056 return r_u->status;
1057 }
1058
1059 /***************************************************************************
1060 For a given SID, add some privileges.
1061 ***************************************************************************/
1062
1063 NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u)
1064 {
1065 struct lsa_info *info=NULL;
1066 GROUP_MAP map;
1067 int i=0;
1068
1069 LUID_ATTR *luid_attr=NULL;
1070 PRIVILEGE_SET *set=NULL;
1071
1072 r_u->status = NT_STATUS_OK;
1073
1074 /* find the connection policy handle. */
1075 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1076 return NT_STATUS_INVALID_HANDLE;
1077
1078 if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
1079 return NT_STATUS_NO_SUCH_GROUP;
1080
1081 set=&q_u->set;
1082
1083 for (i=0; i<set->count; i++) {
1084 luid_attr=&set->set[i];
1085
1086 /* check if the privilege is already there */
1087 if (check_priv_in_privilege(&map.priv_set, *luid_attr)){
1088 free_privilege(&map.priv_set);
1089 return NT_STATUS_NO_SUCH_PRIVILEGE;
1090 }
1091
1092 add_privilege(&map.priv_set, *luid_attr);
1093 }
1094
1095 if(!add_mapping_entry(&map, TDB_REPLACE))
1096 return NT_STATUS_NO_SUCH_GROUP;
1097
1098 free_privilege(&map.priv_set);
1099
1100 return r_u->status;
1101 }
1102
1103 /***************************************************************************
1104 For a given SID, remove some privileges.
1105 ***************************************************************************/
1106
1107 NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u)
1108 {
1109 struct lsa_info *info=NULL;
1110 GROUP_MAP map;
1111 int i=0;
1112
1113 LUID_ATTR *luid_attr=NULL;
1114 PRIVILEGE_SET *set=NULL;
1115
1116 r_u->status = NT_STATUS_OK;
1117
1118 /* find the connection policy handle. */
1119 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1120 return NT_STATUS_INVALID_HANDLE;
1121
1122 if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
1123 return NT_STATUS_NO_SUCH_GROUP;
1124
1125 if (q_u->allrights!=0) {
1126 /* log it and return, until I see one myself don't do anything */
1127 DEBUG(5,("_lsa_removeprivs: trying to remove all privileges ?\n"));
1128 return NT_STATUS_OK;
1129 }
1130
1131 if (q_u->ptr==0) {
1132 /* log it and return, until I see one myself don't do anything */
1133 DEBUG(5,("_lsa_removeprivs: no privileges to remove ?\n"));
1134 return NT_STATUS_OK;
1135 }
1136
1137 set=&q_u->set;
1138
1139 for (i=0; i<set->count; i++) {
1140 luid_attr=&set->set[i];
1141
1142 /* if we don't have the privilege, we're trying to remove, give up */
1143 /* what else can we do ??? JFM. */
1144 if (!check_priv_in_privilege(&map.priv_set, *luid_attr)){
1145 free_privilege(&map.priv_set);
1146 return NT_STATUS_NO_SUCH_PRIVILEGE;
1147 }
1148
1149 remove_privilege(&map.priv_set, *luid_attr);
1150 }
1151
1152 if(!add_mapping_entry(&map, TDB_REPLACE))
1153 return NT_STATUS_NO_SUCH_GROUP;
1154
1155 free_privilege(&map.priv_set);
1156
1157 return r_u->status;
1158 }
1159
1160 /***************************************************************************
1161 For a given SID, remove some privileges.
1162 ***************************************************************************/
1163
1164 NTSTATUS _lsa_query_secobj(pipes_struct *p, LSA_Q_QUERY_SEC_OBJ *q_u, LSA_R_QUERY_SEC_OBJ *r_u)
1165 {
1166 struct lsa_info *handle=NULL;
1167 SEC_DESC *psd = NULL;
1168 size_t sd_size;
1169 NTSTATUS status;
1170
1171 r_u->status = NT_STATUS_OK;
1172
1173 /* find the connection policy handle. */
1174 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1175 return NT_STATUS_INVALID_HANDLE;
1176
1177 /* check if the user have enough rights */
1178 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1179 return NT_STATUS_ACCESS_DENIED;
1180
1181
1182 switch (q_u->sec_info) {
1183 case 1:
1184 /* SD contains only the owner */
1185
1186 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1187 if(!NT_STATUS_IS_OK(status))
1188 return NT_STATUS_NO_MEMORY;
1189
1190
1191 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1192 return NT_STATUS_NO_MEMORY;
1193 break;
1194 case 4:
1195 /* SD contains only the ACL */
1196
1197 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1198 if(!NT_STATUS_IS_OK(status))
1199 return NT_STATUS_NO_MEMORY;
1200
1201 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1202 return NT_STATUS_NO_MEMORY;
1203 break;
1204 default:
1205 return NT_STATUS_INVALID_LEVEL;
1206 }
1207
1208 r_u->ptr=1;
1209
1210 return r_u->status;
1211 }
1212
1213
1214 NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1215 {
1216 struct lsa_info *handle;
1217 char *nb_name = NULL;
1218 char *dns_name = NULL;
1219 char *forest_name = NULL;
1220 DOM_SID *sid = NULL;
1221 GUID guid;
1222
1223 ZERO_STRUCT(guid);
1224 r_u->status = NT_STATUS_OK;
1225
1226 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1227 return NT_STATUS_INVALID_HANDLE;
1228
1229 switch (q_u->info_class) {
1230 case 0x0c:
1231 /* check if the user have enough rights */
1232 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1233 return NT_STATUS_ACCESS_DENIED;
1234
1235 /* Request PolicyPrimaryDomainInformation. */
1236 switch (lp_server_role()) {
1237 case ROLE_DOMAIN_PDC:
1238 case ROLE_DOMAIN_BDC:
1239 nb_name = global_myworkgroup;
1240 /* ugly temp hack for these next two */
1241 dns_name = lp_realm();
1242 forest_name = lp_realm();
1243 sid = get_global_sam_sid();
1244 secrets_fetch_domain_guid(global_myworkgroup,
1245 &guid);
1246 break;
1247 default:
1248 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1249 }
1250 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1251 forest_name,&guid,sid);
1252 break;
1253 default:
1254 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1255 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1256 break;
1257 }
1258
1259 if (NT_STATUS_IS_OK(r_u->status)) {
1260 r_u->ptr = 0x1;
1261 r_u->info_class = q_u->info_class;
1262 }
1263
1264 return r_u->status;
1265 }
WIP