?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix UNISTR2 length bug in LsaQueryInfo(3) that cause SID resolution to fail on local...
[Samba/gebeck_regimport.git] / source3 / rpc_server / srv_lsa_nt.c
blob01a31dcfe5bb5a53a9d62d2e4600d82d53e350d4
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001,
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002.
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 */
25
26 /* This is the implementation of the lsa server code. */
27
28 #include "includes.h"
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_RPC_SRV
32
33 extern PRIVS privs[];
34
35 struct lsa_info {
36 DOM_SID sid;
37 uint32 access;
38 };
39
40 struct generic_mapping lsa_generic_mapping = {
41 POLICY_READ,
42 POLICY_WRITE,
43 POLICY_EXECUTE,
44 POLICY_ALL_ACCESS
45 };
46
47 /*******************************************************************
48 Function to free the per handle data.
49 ********************************************************************/
50
51 static void free_lsa_info(void *ptr)
52 {
53 struct lsa_info *lsa = (struct lsa_info *)ptr;
54
55 SAFE_FREE(lsa);
56 }
57
58 /***************************************************************************
59 Init dom_query
60 ***************************************************************************/
61
62 static void init_dom_query(DOM_QUERY *d_q, const char *dom_name, DOM_SID *dom_sid)
63 {
64 d_q->buffer_dom_name = (dom_name != NULL) ? 1 : 0; /* domain buffer pointer */
65 d_q->buffer_dom_sid = (dom_sid != NULL) ? 1 : 0; /* domain sid pointer */
66
67 /* this string is supposed to be non-null terminated. */
68 /* But the maxlen in this UNISTR2 must include the terminating null. */
69 init_unistr2(&d_q->uni_domain_name, dom_name, UNI_BROKEN_NON_NULL);
70
71 /*
72 * I'm not sure why this really odd combination of length
73 * values works, but it does appear to. I need to look at
74 * this *much* more closely - but at the moment leave alone
75 * until it's understood. This allows a W2k client to join
76 * a domain with both odd and even length names... JRA.
77 */
78
79 /*
80 * IMPORTANT NOTE !!!!
81 * The two fields below probably are reversed in meaning, ie.
82 * the first field is probably the str_len, the second the max
83 * len. Both are measured in bytes anyway.
84 */
85
86 d_q->uni_dom_str_len = d_q->uni_domain_name.uni_max_len * 2;
87 d_q->uni_dom_max_len = d_q->uni_domain_name.uni_str_len * 2;
88
89 if (dom_sid != NULL)
90 init_dom_sid2(&d_q->dom_sid, dom_sid);
91 }
92
93 /***************************************************************************
94 init_dom_ref - adds a domain if it's not already in, returns the index.
95 ***************************************************************************/
96
97 static int init_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid)
98 {
99 int num = 0;
100
101 if (dom_name != NULL) {
102 for (num = 0; num < ref->num_ref_doms_1; num++) {
103 fstring domname;
104 rpcstr_pull(domname, &ref->ref_dom[num].uni_dom_name, sizeof(domname), -1, 0);
105 if (strequal(domname, dom_name))
106 return num;
107 }
108 } else {
109 num = ref->num_ref_doms_1;
110 }
111
112 if (num >= MAX_REF_DOMAINS) {
113 /* index not found, already at maximum domain limit */
114 return -1;
115 }
116
117 ref->num_ref_doms_1 = num+1;
118 ref->ptr_ref_dom = 1;
119 ref->max_entries = MAX_REF_DOMAINS;
120 ref->num_ref_doms_2 = num+1;
121
122 ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0;
123
124 init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, UNI_FLAGS_NONE);
125 init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, &ref->ref_dom[num].uni_dom_name);
126
127 init_dom_sid2(&ref->ref_dom[num].ref_dom, dom_sid );
128
129 return num;
130 }
131
132 /***************************************************************************
133 init_lsa_rid2s
134 ***************************************************************************/
135
136 static void init_lsa_rid2s(DOM_R_REF *ref, DOM_RID2 *rid2,
137 int num_entries, UNISTR2 *name,
138 uint32 *mapped_count, BOOL endian)
139 {
140 int i;
141 int total = 0;
142 *mapped_count = 0;
143
144 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
145
146 become_root(); /* lookup_name can require root privs */
147
148 for (i = 0; i < num_entries; i++) {
149 BOOL status = False;
150 DOM_SID sid;
151 uint32 rid = 0xffffffff;
152 int dom_idx = -1;
153 pstring full_name;
154 fstring dom_name, user;
155 enum SID_NAME_USE name_type = SID_NAME_UNKNOWN;
156
157 /* Split name into domain and user component */
158
159 unistr2_to_ascii(full_name, &name[i], sizeof(full_name));
160 split_domain_name(full_name, dom_name, user);
161
162 /* Lookup name */
163
164 DEBUG(5, ("init_lsa_rid2s: looking up name %s\n", full_name));
165
166 status = lookup_name(dom_name, user, &sid, &name_type);
167
168 DEBUG(5, ("init_lsa_rid2s: %s\n", status ? "found" :
169 "not found"));
170
171 if (status && name_type != SID_NAME_UNKNOWN) {
172 sid_split_rid(&sid, &rid);
173 dom_idx = init_dom_ref(ref, dom_name, &sid);
174 (*mapped_count)++;
175 } else {
176 dom_idx = -1;
177 rid = 0xffffffff;
178 name_type = SID_NAME_UNKNOWN;
179 }
180
181 init_dom_rid2(&rid2[total], rid, name_type, dom_idx);
182 total++;
183 }
184
185 unbecome_root();
186 }
187
188 /***************************************************************************
189 init_reply_lookup_names
190 ***************************************************************************/
191
192 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
193 DOM_R_REF *ref, uint32 num_entries,
194 DOM_RID2 *rid2, uint32 mapped_count)
195 {
196 r_l->ptr_dom_ref = 1;
197 r_l->dom_ref = ref;
198
199 r_l->num_entries = num_entries;
200 r_l->ptr_entries = 1;
201 r_l->num_entries2 = num_entries;
202 r_l->dom_rid = rid2;
203
204 r_l->mapped_count = mapped_count;
205
206 if (mapped_count == 0)
207 r_l->status = NT_STATUS_NONE_MAPPED;
208 else
209 r_l->status = NT_STATUS_OK;
210 }
211
212 /***************************************************************************
213 Init lsa_trans_names.
214 ***************************************************************************/
215
216 static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *trn,
217 int num_entries, DOM_SID2 *sid,
218 uint32 *mapped_count)
219 {
220 int i;
221 int total = 0;
222 *mapped_count = 0;
223
224 /* Allocate memory for list of names */
225
226 if (num_entries > 0) {
227 if (!(trn->name = (LSA_TRANS_NAME *)talloc(ctx, sizeof(LSA_TRANS_NAME) *
228 num_entries))) {
229 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
230 return;
231 }
232
233 if (!(trn->uni_name = (UNISTR2 *)talloc(ctx, sizeof(UNISTR2) *
234 num_entries))) {
235 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
236 return;
237 }
238 }
239
240 become_root(); /* Need root to get to passdb to for local sids */
241
242 for (i = 0; i < num_entries; i++) {
243 BOOL status = False;
244 DOM_SID find_sid = sid[i].sid;
245 uint32 rid = 0xffffffff;
246 int dom_idx = -1;
247 fstring name, dom_name;
248 enum SID_NAME_USE sid_name_use = (enum SID_NAME_USE)0;
249
250 sid_to_string(name, &find_sid);
251 DEBUG(5, ("init_lsa_trans_names: looking up sid %s\n", name));
252
253 /* Lookup sid from winbindd */
254
255 memset(dom_name, '\0', sizeof(dom_name));
256 memset(name, '\0', sizeof(name));
257
258 status = lookup_sid(&find_sid, dom_name, name, &sid_name_use);
259
260 DEBUG(5, ("init_lsa_trans_names: %s\n", status ? "found" :
261 "not found"));
262
263 if (!status) {
264 sid_name_use = SID_NAME_UNKNOWN;
265 } else {
266 (*mapped_count)++;
267 }
268
269 /* Store domain sid in ref array */
270
271 if (find_sid.num_auths == 5) {
272 sid_split_rid(&find_sid, &rid);
273 }
274
275 dom_idx = init_dom_ref(ref, dom_name, &find_sid);
276
277 DEBUG(10,("init_lsa_trans_names: added user '%s\\%s' to "
278 "referenced list.\n", dom_name, name ));
279
280 init_lsa_trans_name(&trn->name[total], &trn->uni_name[total],
281 sid_name_use, name, dom_idx);
282 total++;
283 }
284
285 unbecome_root();
286
287 trn->num_entries = total;
288 trn->ptr_trans_names = 1;
289 trn->num_entries2 = total;
290 }
291
292 /***************************************************************************
293 Init_reply_lookup_sids.
294 ***************************************************************************/
295
296 static void init_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
297 DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *names,
298 uint32 mapped_count)
299 {
300 r_l->ptr_dom_ref = 1;
301 r_l->dom_ref = ref;
302 r_l->names = names;
303 r_l->mapped_count = mapped_count;
304
305 if (mapped_count == 0)
306 r_l->status = NT_STATUS_NONE_MAPPED;
307 else
308 r_l->status = NT_STATUS_OK;
309 }
310
311 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
312 {
313 extern DOM_SID global_sid_World;
314 extern DOM_SID global_sid_Builtin;
315 DOM_SID local_adm_sid;
316 DOM_SID adm_sid;
317
318 SEC_ACE ace[3];
319 SEC_ACCESS mask;
320
321 SEC_ACL *psa = NULL;
322
323 init_sec_access(&mask, POLICY_EXECUTE);
324 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
325
326 sid_copy(&adm_sid, get_global_sam_sid());
327 sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
328 init_sec_access(&mask, POLICY_ALL_ACCESS);
329 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
330
331 sid_copy(&local_adm_sid, &global_sid_Builtin);
332 sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
333 init_sec_access(&mask, POLICY_ALL_ACCESS);
334 init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
335
336 if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
337 return NT_STATUS_NO_MEMORY;
338
339 if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL, psa, sd_size)) == NULL)
340 return NT_STATUS_NO_MEMORY;
341
342 return NT_STATUS_OK;
343 }
344
345 /***************************************************************************
346 Init_dns_dom_info.
347 ***************************************************************************/
348
349 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
350 const char *dns_name, const char *forest_name,
351 struct uuid *dom_guid, DOM_SID *dom_sid)
352 {
353 if (nb_name && *nb_name) {
354 init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
355 init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name);
356 r_l->hdr_nb_dom_name.uni_max_len += 2;
357 r_l->uni_nb_dom_name.uni_max_len += 1;
358 }
359
360 if (dns_name && *dns_name) {
361 init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE);
362 init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name);
363 r_l->hdr_dns_dom_name.uni_max_len += 2;
364 r_l->uni_dns_dom_name.uni_max_len += 1;
365 }
366
367 if (forest_name && *forest_name) {
368 init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE);
369 init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name);
370 r_l->hdr_forest_name.uni_max_len += 2;
371 r_l->uni_forest_name.uni_max_len += 1;
372 }
373
374 /* how do we init the guid ? probably should write an init fn */
375 if (dom_guid) {
376 memcpy(&r_l->dom_guid, dom_guid, sizeof(struct uuid));
377 }
378
379 if (dom_sid) {
380 r_l->ptr_dom_sid = 1;
381 init_dom_sid2(&r_l->dom_sid, dom_sid);
382 }
383 }
384
385 /***************************************************************************
386 _lsa_open_policy2.
387 ***************************************************************************/
388
389 NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL2 *r_u)
390 {
391 struct lsa_info *info;
392 SEC_DESC *psd = NULL;
393 size_t sd_size;
394 uint32 des_access=q_u->des_access;
395 uint32 acc_granted;
396 NTSTATUS status;
397
398
399 /* map the generic bits to the lsa policy ones */
400 se_map_generic(&des_access, &lsa_generic_mapping);
401
402 /* get the generic lsa policy SD until we store it */
403 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
404
405 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
406 if (geteuid() != 0) {
407 return status;
408 }
409 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
410 acc_granted, des_access));
411 DEBUGADD(4,("but overwritten by euid == 0\n"));
412 acc_granted = des_access;
413 }
414
415
416 /* associate the domain SID with the (unique) handle. */
417 if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
418 return NT_STATUS_NO_MEMORY;
419
420 ZERO_STRUCTP(info);
421 sid_copy(&info->sid,get_global_sam_sid());
422 info->access = acc_granted;
423
424 /* set up the LSA QUERY INFO response */
425 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
426 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
427
428 return NT_STATUS_OK;
429 }
430
431 /***************************************************************************
432 _lsa_open_policy
433 ***************************************************************************/
434
435 NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *r_u)
436 {
437 struct lsa_info *info;
438 SEC_DESC *psd = NULL;
439 size_t sd_size;
440 uint32 des_access=q_u->des_access;
441 uint32 acc_granted;
442 NTSTATUS status;
443
444
445 /* map the generic bits to the lsa policy ones */
446 se_map_generic(&des_access, &lsa_generic_mapping);
447
448 /* get the generic lsa policy SD until we store it */
449 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
450
451 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
452 if (geteuid() != 0) {
453 return status;
454 }
455 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
456 acc_granted, des_access));
457 DEBUGADD(4,("but overwritten by euid == 0\n"));
458 acc_granted = des_access;
459 }
460
461 /* associate the domain SID with the (unique) handle. */
462 if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
463 return NT_STATUS_NO_MEMORY;
464
465 ZERO_STRUCTP(info);
466 sid_copy(&info->sid,get_global_sam_sid());
467 info->access = acc_granted;
468
469 /* set up the LSA QUERY INFO response */
470 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
471 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
472
473 return NT_STATUS_OK;
474 }
475
476 /***************************************************************************
477 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
478 ufff, done :) mimir
479 ***************************************************************************/
480
481 NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_ENUM_TRUST_DOM *r_u)
482 {
483 struct lsa_info *info;
484 uint32 enum_context = q_u->enum_context;
485
486 /*
487 * preferred length is set to 5 as a "our" preferred length
488 * nt sets this parameter to 2
489 * update (20.08.2002): it's not preferred length, but preferred size!
490 * it needs further investigation how to optimally choose this value
491 */
492 uint32 max_num_domains = q_u->preferred_len < 5 ? q_u->preferred_len : 10;
493 TRUSTDOM **trust_doms;
494 uint32 num_domains;
495 NTSTATUS nt_status;
496
497 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
498 return NT_STATUS_INVALID_HANDLE;
499
500 /* check if the user have enough rights */
501 if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
502 return NT_STATUS_ACCESS_DENIED;
503
504 nt_status = secrets_get_trusted_domains(p->mem_ctx, (int *)&enum_context, max_num_domains, (int *)&num_domains, &trust_doms);
505
506 if (!NT_STATUS_IS_OK(nt_status) &&
507 !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES) &&
508 !NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES)) {
509 return nt_status;
510 } else {
511 r_u->status = nt_status;
512 }
513
514 /* set up the lsa_enum_trust_dom response */
515 init_r_enum_trust_dom(p->mem_ctx, r_u, enum_context, max_num_domains, num_domains, trust_doms);
516
517 return r_u->status;
518 }
519
520 /***************************************************************************
521 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
522 ***************************************************************************/
523
524 NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INFO *r_u)
525 {
526 struct lsa_info *handle;
527 LSA_INFO_UNION *info = &r_u->dom;
528 DOM_SID domain_sid;
529 const char *name;
530 DOM_SID *sid = NULL;
531
532 r_u->status = NT_STATUS_OK;
533
534 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
535 return NT_STATUS_INVALID_HANDLE;
536
537 switch (q_u->info_class) {
538 case 0x02:
539 {
540 unsigned int i;
541 /* check if the user have enough rights */
542 if (!(handle->access & POLICY_VIEW_AUDIT_INFORMATION))
543 return NT_STATUS_ACCESS_DENIED;
544
545 /* fake info: We audit everything. ;) */
546 info->id2.auditing_enabled = 1;
547 info->id2.count1 = 7;
548 info->id2.count2 = 7;
549 if ((info->id2.auditsettings = (uint32 *)talloc(p->mem_ctx,7*sizeof(uint32))) == NULL)
550 return NT_STATUS_NO_MEMORY;
551 for (i = 0; i < 7; i++)
552 info->id2.auditsettings[i] = 3;
553 break;
554 }
555 case 0x03:
556 /* check if the user have enough rights */
557 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
558 return NT_STATUS_ACCESS_DENIED;
559
560 /* Request PolicyPrimaryDomainInformation. */
561 switch (lp_server_role()) {
562 case ROLE_DOMAIN_PDC:
563 case ROLE_DOMAIN_BDC:
564 name = get_global_sam_name();
565 sid = get_global_sam_sid();
566 break;
567 case ROLE_DOMAIN_MEMBER:
568 name = lp_workgroup();
569 /* We need to return the Domain SID here. */
570 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid))
571 sid = &domain_sid;
572 else
573 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
574 break;
575 case ROLE_STANDALONE:
576 name = lp_workgroup();
577 sid = NULL;
578 break;
579 default:
580 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
581 }
582 init_dom_query(&r_u->dom.id3, name, sid);
583 break;
584 case 0x05:
585 /* check if the user have enough rights */
586 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
587 return NT_STATUS_ACCESS_DENIED;
588
589 /* Request PolicyAccountDomainInformation. */
590 name = get_global_sam_name();
591 sid = get_global_sam_sid();
592 init_dom_query(&r_u->dom.id5, name, sid);
593 break;
594 case 0x06:
595 /* check if the user have enough rights */
596 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
597 return NT_STATUS_ACCESS_DENIED;
598
599 switch (lp_server_role()) {
600 case ROLE_DOMAIN_BDC:
601 /*
602 * only a BDC is a backup controller
603 * of the domain, it controls.
604 */
605 info->id6.server_role = 2;
606 break;
607 default:
608 /*
609 * any other role is a primary
610 * of the domain, it controls.
611 */
612 info->id6.server_role = 3;
613 break;
614 }
615 break;
616 default:
617 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u->info_class));
618 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
619 break;
620 }
621
622 if (NT_STATUS_IS_OK(r_u->status)) {
623 r_u->undoc_buffer = 0x22000000; /* bizarre */
624 r_u->info_class = q_u->info_class;
625 }
626
627 return r_u->status;
628 }
629
630 /***************************************************************************
631 _lsa_lookup_sids
632 ***************************************************************************/
633
634 NTSTATUS _lsa_lookup_sids(pipes_struct *p, LSA_Q_LOOKUP_SIDS *q_u, LSA_R_LOOKUP_SIDS *r_u)
635 {
636 struct lsa_info *handle;
637 DOM_SID2 *sid = q_u->sids.sid;
638 int num_entries = q_u->sids.num_entries;
639 DOM_R_REF *ref = NULL;
640 LSA_TRANS_NAME_ENUM *names = NULL;
641 uint32 mapped_count = 0;
642
643 if (num_entries > MAX_LOOKUP_SIDS) {
644 num_entries = MAX_LOOKUP_SIDS;
645 DEBUG(5,("_lsa_lookup_sids: truncating SID lookup list to %d\n", num_entries));
646 }
647
648 ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
649 names = (LSA_TRANS_NAME_ENUM *)talloc_zero(p->mem_ctx, sizeof(LSA_TRANS_NAME_ENUM));
650
651 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
652 r_u->status = NT_STATUS_INVALID_HANDLE;
653 goto done;
654 }
655
656 /* check if the user have enough rights */
657 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
658 r_u->status = NT_STATUS_ACCESS_DENIED;
659 goto done;
660 }
661 if (!ref || !names)
662 return NT_STATUS_NO_MEMORY;
663
664 done:
665
666 /* set up the LSA Lookup SIDs response */
667 init_lsa_trans_names(p->mem_ctx, ref, names, num_entries, sid, &mapped_count);
668 init_reply_lookup_sids(r_u, ref, names, mapped_count);
669
670 return r_u->status;
671 }
672
673 /***************************************************************************
674 lsa_reply_lookup_names
675 ***************************************************************************/
676
677 NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP_NAMES *r_u)
678 {
679 struct lsa_info *handle;
680 UNISTR2 *names = q_u->uni_name;
681 int num_entries = q_u->num_entries;
682 DOM_R_REF *ref;
683 DOM_RID2 *rids;
684 uint32 mapped_count = 0;
685
686 if (num_entries > MAX_LOOKUP_SIDS) {
687 num_entries = MAX_LOOKUP_SIDS;
688 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
689 }
690
691 ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
692 rids = (DOM_RID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_RID2)*num_entries);
693
694 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
695 r_u->status = NT_STATUS_INVALID_HANDLE;
696 goto done;
697 }
698
699 /* check if the user have enough rights */
700 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
701 r_u->status = NT_STATUS_ACCESS_DENIED;
702 goto done;
703 }
704
705 if (!ref || !rids)
706 return NT_STATUS_NO_MEMORY;
707
708 done:
709
710 /* set up the LSA Lookup RIDs response */
711 init_lsa_rid2s(ref, rids, num_entries, names, &mapped_count, p->endian);
712 init_reply_lookup_names(r_u, ref, num_entries, rids, mapped_count);
713
714 return r_u->status;
715 }
716
717 /***************************************************************************
718 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
719 ***************************************************************************/
720
721 NTSTATUS _lsa_close(pipes_struct *p, LSA_Q_CLOSE *q_u, LSA_R_CLOSE *r_u)
722 {
723 if (!find_policy_by_hnd(p, &q_u->pol, NULL))
724 return NT_STATUS_INVALID_HANDLE;
725
726 close_policy_hnd(p, &q_u->pol);
727 return NT_STATUS_OK;
728 }
729
730 /***************************************************************************
731 "No more secrets Marty...." :-).
732 ***************************************************************************/
733
734 NTSTATUS _lsa_open_secret(pipes_struct *p, LSA_Q_OPEN_SECRET *q_u, LSA_R_OPEN_SECRET *r_u)
735 {
736 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
737 }
738
739 /***************************************************************************
740 _lsa_enum_privs.
741 ***************************************************************************/
742
743 NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIVS *r_u)
744 {
745 struct lsa_info *handle;
746 uint32 i;
747
748 uint32 enum_context=q_u->enum_context;
749 LSA_PRIV_ENTRY *entry;
750 LSA_PRIV_ENTRY *entries=NULL;
751
752 if (enum_context >= PRIV_ALL_INDEX)
753 return NT_STATUS_NO_MORE_ENTRIES;
754
755 entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX));
756 if (entries==NULL)
757 return NT_STATUS_NO_MEMORY;
758
759 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
760 return NT_STATUS_INVALID_HANDLE;
761
762 /* check if the user have enough rights */
763
764 /*
765 * I don't know if it's the right one. not documented.
766 */
767 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
768 return NT_STATUS_ACCESS_DENIED;
769
770 entry = entries;
771
772 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n", enum_context, PRIV_ALL_INDEX));
773
774 for (i = 0; i < PRIV_ALL_INDEX; i++, entry++) {
775 if( i<enum_context) {
776 init_unistr2(&entry->name, NULL, UNI_FLAGS_NONE);
777 init_uni_hdr(&entry->hdr_name, &entry->name);
778 entry->luid_low = 0;
779 entry->luid_high = 0;
780 } else {
781 init_unistr2(&entry->name, privs[i+1].priv, UNI_FLAGS_NONE);
782 init_uni_hdr(&entry->hdr_name, &entry->name);
783 entry->luid_low = privs[i+1].se_priv;
784 entry->luid_high = 0;
785 }
786 }
787
788 enum_context = PRIV_ALL_INDEX;
789 init_lsa_r_enum_privs(r_u, enum_context, PRIV_ALL_INDEX, entries);
790
791 return NT_STATUS_OK;
792 }
793
794 /***************************************************************************
795 _lsa_priv_get_dispname.
796 ***************************************************************************/
797
798 NTSTATUS _lsa_priv_get_dispname(pipes_struct *p, LSA_Q_PRIV_GET_DISPNAME *q_u, LSA_R_PRIV_GET_DISPNAME *r_u)
799 {
800 struct lsa_info *handle;
801 fstring name_asc;
802 int i=1;
803
804 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
805 return NT_STATUS_INVALID_HANDLE;
806
807 /* check if the user have enough rights */
808
809 /*
810 * I don't know if it's the right one. not documented.
811 */
812 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
813 return NT_STATUS_ACCESS_DENIED;
814
815 unistr2_to_ascii(name_asc, &q_u->name, sizeof(name_asc));
816
817 DEBUG(10,("_lsa_priv_get_dispname: %s", name_asc));
818
819 while (privs[i].se_priv!=SE_PRIV_ALL && strcmp(name_asc, privs[i].priv))
820 i++;
821
822 if (privs[i].se_priv!=SE_PRIV_ALL) {
823 DEBUG(10,(": %s\n", privs[i].description));
824 init_unistr2(&r_u->desc, privs[i].description, UNI_FLAGS_NONE);
825 init_uni_hdr(&r_u->hdr_desc, &r_u->desc);
826
827 r_u->ptr_info=0xdeadbeef;
828 r_u->lang_id=q_u->lang_id;
829 return NT_STATUS_OK;
830 } else {
831 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
832 r_u->ptr_info=0;
833 return NT_STATUS_NO_SUCH_PRIVILEGE;
834 }
835 }
836
837 /***************************************************************************
838 _lsa_enum_accounts.
839 ***************************************************************************/
840
841 NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENUM_ACCOUNTS *r_u)
842 {
843 struct lsa_info *handle;
844 GROUP_MAP *map=NULL;
845 int num_entries=0;
846 LSA_SID_ENUM *sids=&r_u->sids;
847 int i=0,j=0;
848 BOOL ret;
849
850 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
851 return NT_STATUS_INVALID_HANDLE;
852
853 /* check if the user have enough rights */
854
855 /*
856 * I don't know if it's the right one. not documented.
857 */
858 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
859 return NT_STATUS_ACCESS_DENIED;
860
861 /* get the list of mapped groups (domain, local, builtin) */
862 become_root();
863 ret = pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED);
864 unbecome_root();
865 if( !ret ) {
866 DEBUG(3,("_lsa_enum_accounts: enumeration of groups failed!\n"));
867 return NT_STATUS_OK;
868 }
869
870
871 if (q_u->enum_context >= num_entries)
872 return NT_STATUS_NO_MORE_ENTRIES;
873
874 sids->ptr_sid = (uint32 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(uint32));
875 sids->sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(DOM_SID2));
876
877 if (sids->ptr_sid==NULL || sids->sid==NULL) {
878 SAFE_FREE(map);
879 return NT_STATUS_NO_MEMORY;
880 }
881
882 for (i=q_u->enum_context, j=0; i<num_entries; i++) {
883 init_dom_sid2( &(*sids).sid[j], &map[i].sid);
884 (*sids).ptr_sid[j]=1;
885 j++;
886 }
887
888 SAFE_FREE(map);
889
890 init_lsa_r_enum_accounts(r_u, j);
891
892 return NT_STATUS_OK;
893 }
894
895
896 NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u)
897 {
898 fstring username, domname;
899 user_struct *vuser = get_valid_user_struct(p->vuid);
900
901 if (vuser == NULL)
902 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
903
904 fstrcpy(username, vuser->user.smb_name);
905 fstrcpy(domname, vuser->user.domain);
906
907 r_u->ptr_user_name = 1;
908 init_unistr2(&r_u->uni2_user_name, username, UNI_STR_TERMINATE);
909 init_uni_hdr(&r_u->hdr_user_name, &r_u->uni2_user_name);
910
911 r_u->unk1 = 1;
912
913 r_u->ptr_dom_name = 1;
914 init_unistr2(&r_u->uni2_dom_name, domname, UNI_STR_TERMINATE);
915 init_uni_hdr(&r_u->hdr_dom_name, &r_u->uni2_dom_name);
916
917 r_u->status = NT_STATUS_OK;
918
919 return r_u->status;
920 }
921
922 /***************************************************************************
923
924 ***************************************************************************/
925
926 NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENACCOUNT *r_u)
927 {
928 struct lsa_info *handle;
929 struct lsa_info *info;
930
931 r_u->status = NT_STATUS_OK;
932
933 /* find the connection policy handle. */
934 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
935 return NT_STATUS_INVALID_HANDLE;
936
937 /* check if the user have enough rights */
938
939 /*
940 * I don't know if it's the right one. not documented.
941 * but guessed with rpcclient.
942 */
943 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
944 return NT_STATUS_ACCESS_DENIED;
945
946 /* associate the user/group SID with the (unique) handle. */
947 if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
948 return NT_STATUS_NO_MEMORY;
949
950 ZERO_STRUCTP(info);
951 info->sid = q_u->sid.sid;
952 info->access = q_u->access;
953
954 /* get a (unique) handle. open a policy on it. */
955 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
956 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
957
958 return r_u->status;
959 }
960
961 /***************************************************************************
962 For a given SID, enumerate all the privilege this account has.
963 ***************************************************************************/
964
965 NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, prs_struct *ps, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u)
966 {
967 struct lsa_info *info=NULL;
968 GROUP_MAP map;
969 LUID_ATTR *set=NULL;
970
971 r_u->status = NT_STATUS_OK;
972
973 /* find the connection policy handle. */
974 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
975 return NT_STATUS_INVALID_HANDLE;
976
977 if (!pdb_getgrsid(&map, info->sid))
978 return NT_STATUS_NO_SUCH_GROUP;
979
980 #if 0 /* privileges currently not implemented! */
981 DEBUG(10,("_lsa_enum_privsaccount: %d privileges\n", map.priv_set->count));
982 if (map.priv_set->count!=0) {
983
984 set=(LUID_ATTR *)talloc(map.priv_set->mem_ctx, map.priv_set.count*sizeof(LUID_ATTR));
985 if (set == NULL) {
986 destroy_privilege(&map.priv_set);
987 return NT_STATUS_NO_MEMORY;
988 }
989
990 for (i = 0; i < map.priv_set.count; i++) {
991 set[i].luid.low = map.priv_set->set[i].luid.low;
992 set[i].luid.high = map.priv_set->set[i].luid.high;
993 set[i].attr = map.priv_set->set[i].attr;
994 DEBUG(10,("_lsa_enum_privsaccount: priv %d: %d:%d:%d\n", i,
995 set[i].luid.high, set[i].luid.low, set[i].attr));
996 }
997 }
998
999 init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, set, map.priv_set->count, 0);
1000 destroy_privilege(&map.priv_set);
1001 #endif
1002
1003 init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, set, 0, 0);
1004
1005 return r_u->status;
1006 }
1007
1008 /***************************************************************************
1009
1010 ***************************************************************************/
1011
1012 NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA_R_GETSYSTEMACCOUNT *r_u)
1013 {
1014 struct lsa_info *info=NULL;
1015 GROUP_MAP map;
1016 r_u->status = NT_STATUS_OK;
1017
1018 /* find the connection policy handle. */
1019 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1020 return NT_STATUS_INVALID_HANDLE;
1021
1022 if (!pdb_getgrsid(&map, info->sid))
1023 return NT_STATUS_NO_SUCH_GROUP;
1024
1025 /*
1026 0x01 -> Log on locally
1027 0x02 -> Access this computer from network
1028 0x04 -> Log on as a batch job
1029 0x10 -> Log on as a service
1030
1031 they can be ORed together
1032 */
1033
1034 r_u->access = PR_LOG_ON_LOCALLY | PR_ACCESS_FROM_NETWORK;
1035
1036 return r_u->status;
1037 }
1038
1039 /***************************************************************************
1040 update the systemaccount information
1041 ***************************************************************************/
1042
1043 NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA_R_SETSYSTEMACCOUNT *r_u)
1044 {
1045 struct lsa_info *info=NULL;
1046 GROUP_MAP map;
1047 r_u->status = NT_STATUS_OK;
1048
1049 /* find the connection policy handle. */
1050 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1051 return NT_STATUS_INVALID_HANDLE;
1052
1053 if (!pdb_getgrsid(&map, info->sid))
1054 return NT_STATUS_NO_SUCH_GROUP;
1055
1056 if(!pdb_update_group_mapping_entry(&map))
1057 return NT_STATUS_NO_SUCH_GROUP;
1058
1059 return r_u->status;
1060 }
1061
1062 /***************************************************************************
1063 For a given SID, add some privileges.
1064 ***************************************************************************/
1065
1066 NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u)
1067 {
1068 #if 0
1069 struct lsa_info *info = NULL;
1070 GROUP_MAP map;
1071 int i = 0;
1072 LUID_ATTR *luid_attr = NULL;
1073 PRIVILEGE_SET *set = NULL;
1074 #endif
1075
1076 r_u->status = NT_STATUS_OK;
1077
1078 #if 0 /* privileges are not implemented */
1079 /* find the connection policy handle. */
1080 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1081 return NT_STATUS_INVALID_HANDLE;
1082
1083 if (!pdb_getgrsid(&map, info->sid))
1084 return NT_STATUS_NO_SUCH_GROUP;
1085
1086 set = &q_u->set;
1087
1088 for (i = 0; i < set->count; i++) {
1089 luid_attr = &set->set[i];
1090
1091 /* check if the privilege is already there */
1092 if (check_priv_in_privilege(map.priv_set, *luid_attr)){
1093 destroy_privilege(&map.priv_set);
1094 return NT_STATUS_NO_SUCH_PRIVILEGE;
1095 }
1096
1097 add_privilege(map.priv_set, *luid_attr);
1098 }
1099
1100 if(!pdb_update_group_mapping_entry(&map))
1101 return NT_STATUS_NO_SUCH_GROUP;
1102
1103 destroy_privilege(&map.priv_set);
1104
1105 #endif
1106 return r_u->status;
1107 }
1108
1109 /***************************************************************************
1110 For a given SID, remove some privileges.
1111 ***************************************************************************/
1112
1113 NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u)
1114 {
1115 #if 0
1116 struct lsa_info *info = NULL;
1117 GROUP_MAP map;
1118 int i=0;
1119 LUID_ATTR *luid_attr = NULL;
1120 PRIVILEGE_SET *set = NULL;
1121 #endif
1122
1123 r_u->status = NT_STATUS_OK;
1124
1125 #if 0 /* privileges are not implemented */
1126 /* find the connection policy handle. */
1127 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1128 return NT_STATUS_INVALID_HANDLE;
1129
1130 if (!pdb_getgrsid(&map, info->sid))
1131 return NT_STATUS_NO_SUCH_GROUP;
1132
1133 if (q_u->allrights != 0) {
1134 /* log it and return, until I see one myself don't do anything */
1135 DEBUG(5,("_lsa_removeprivs: trying to remove all privileges ?\n"));
1136 return NT_STATUS_OK;
1137 }
1138
1139 if (q_u->ptr == 0) {
1140 /* log it and return, until I see one myself don't do anything */
1141 DEBUG(5,("_lsa_removeprivs: no privileges to remove ?\n"));
1142 return NT_STATUS_OK;
1143 }
1144
1145 set = &q_u->set;
1146
1147 for (i = 0; i < set->count; i++) {
1148 luid_attr = &set->set[i];
1149
1150 /* if we don't have the privilege, we're trying to remove, give up */
1151 /* what else can we do ??? JFM. */
1152 if (!check_priv_in_privilege(map.priv_set, *luid_attr)){
1153 destroy_privilege(&map.priv_set);
1154 return NT_STATUS_NO_SUCH_PRIVILEGE;
1155 }
1156
1157 remove_privilege(map.priv_set, *luid_attr);
1158 }
1159
1160 if(!pdb_update_group_mapping_entry(&map))
1161 return NT_STATUS_NO_SUCH_GROUP;
1162
1163 destroy_privilege(&map.priv_set);
1164 #endif
1165 return r_u->status;
1166 }
1167
1168 /***************************************************************************
1169 For a given SID, remove some privileges.
1170 ***************************************************************************/
1171
1172 NTSTATUS _lsa_query_secobj(pipes_struct *p, LSA_Q_QUERY_SEC_OBJ *q_u, LSA_R_QUERY_SEC_OBJ *r_u)
1173 {
1174 struct lsa_info *handle=NULL;
1175 SEC_DESC *psd = NULL;
1176 size_t sd_size;
1177 NTSTATUS status;
1178
1179 r_u->status = NT_STATUS_OK;
1180
1181 /* find the connection policy handle. */
1182 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1183 return NT_STATUS_INVALID_HANDLE;
1184
1185 /* check if the user have enough rights */
1186 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1187 return NT_STATUS_ACCESS_DENIED;
1188
1189
1190 switch (q_u->sec_info) {
1191 case 1:
1192 /* SD contains only the owner */
1193
1194 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1195 if(!NT_STATUS_IS_OK(status))
1196 return NT_STATUS_NO_MEMORY;
1197
1198
1199 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1200 return NT_STATUS_NO_MEMORY;
1201 break;
1202 case 4:
1203 /* SD contains only the ACL */
1204
1205 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1206 if(!NT_STATUS_IS_OK(status))
1207 return NT_STATUS_NO_MEMORY;
1208
1209 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1210 return NT_STATUS_NO_MEMORY;
1211 break;
1212 default:
1213 return NT_STATUS_INVALID_LEVEL;
1214 }
1215
1216 r_u->ptr=1;
1217
1218 return r_u->status;
1219 }
1220
1221
1222 NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1223 {
1224 struct lsa_info *handle;
1225 const char *nb_name;
1226 char *dns_name = NULL;
1227 char *forest_name = NULL;
1228 DOM_SID *sid = NULL;
1229 struct uuid guid;
1230 fstring dnsdomname;
1231
1232 ZERO_STRUCT(guid);
1233 r_u->status = NT_STATUS_OK;
1234
1235 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1236 return NT_STATUS_INVALID_HANDLE;
1237
1238 switch (q_u->info_class) {
1239 case 0x0c:
1240 /* check if the user have enough rights */
1241 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1242 return NT_STATUS_ACCESS_DENIED;
1243
1244 /* Request PolicyPrimaryDomainInformation. */
1245 switch (lp_server_role()) {
1246 case ROLE_DOMAIN_PDC:
1247 case ROLE_DOMAIN_BDC:
1248 nb_name = get_global_sam_name();
1249 /* ugly temp hack for these next two */
1250
1251 /* This should be a 'netbios domain -> DNS domain' mapping */
1252 dnsdomname[0] = '\0';
1253 get_mydomname(dnsdomname);
1254 strlower_m(dnsdomname);
1255
1256 dns_name = dnsdomname;
1257 forest_name = dnsdomname;
1258
1259 sid = get_global_sam_sid();
1260 secrets_fetch_domain_guid(lp_workgroup(), &guid);
1261 break;
1262 default:
1263 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1264 }
1265 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1266 forest_name,&guid,sid);
1267 break;
1268 default:
1269 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1270 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1271 break;
1272 }
1273
1274 if (NT_STATUS_IS_OK(r_u->status)) {
1275 r_u->ptr = 0x1;
1276 r_u->info_class = q_u->info_class;
1277 }
1278
1279 return r_u->status;
1280 }
reg import