?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
build:dist: call build-manpages-nogit for make dist and package generated files
[Samba/gebeck_regimport.git] / source3 / lib / netapi / group.c
blob710ec3790f21a05e91966ce04aedc68098255a64
1 /*
2 * Unix SMB/CIFS implementation.
3 * NetApi Group Support
4 * Copyright (C) Guenther Deschner 2008
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21
22 #include "librpc/gen_ndr/libnetapi.h"
23 #include "lib/netapi/netapi.h"
24 #include "lib/netapi/netapi_private.h"
25 #include "lib/netapi/libnetapi.h"
26 #include "rpc_client/rpc_client.h"
27 #include "../librpc/gen_ndr/ndr_samr_c.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30
31 /****************************************************************
32 ****************************************************************/
33
34 WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
35 struct NetGroupAdd *r)
36 {
37 struct rpc_pipe_client *pipe_cli = NULL;
38 NTSTATUS status, result;
39 WERROR werr;
40 struct policy_handle connect_handle, domain_handle, group_handle;
41 struct lsa_String lsa_group_name;
42 struct dom_sid2 *domain_sid = NULL;
43 uint32_t rid = 0;
44 struct dcerpc_binding_handle *b = NULL;
45
46 struct GROUP_INFO_0 *info0 = NULL;
47 struct GROUP_INFO_1 *info1 = NULL;
48 struct GROUP_INFO_2 *info2 = NULL;
49 struct GROUP_INFO_3 *info3 = NULL;
50 union samr_GroupInfo info;
51
52 ZERO_STRUCT(connect_handle);
53 ZERO_STRUCT(domain_handle);
54 ZERO_STRUCT(group_handle);
55
56 if (!r->in.buffer) {
57 return WERR_INVALID_PARAM;
58 }
59
60 switch (r->in.level) {
61 case 0:
62 info0 = (struct GROUP_INFO_0 *)r->in.buffer;
63 break;
64 case 1:
65 info1 = (struct GROUP_INFO_1 *)r->in.buffer;
66 break;
67 case 2:
68 info2 = (struct GROUP_INFO_2 *)r->in.buffer;
69 break;
70 case 3:
71 info3 = (struct GROUP_INFO_3 *)r->in.buffer;
72 break;
73 default:
74 werr = WERR_UNKNOWN_LEVEL;
75 goto done;
76 }
77
78 werr = libnetapi_open_pipe(ctx, r->in.server_name,
79 &ndr_table_samr.syntax_id,
80 &pipe_cli);
81 if (!W_ERROR_IS_OK(werr)) {
82 goto done;
83 }
84
85 b = pipe_cli->binding_handle;
86
87 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
88 SAMR_ACCESS_ENUM_DOMAINS |
89 SAMR_ACCESS_LOOKUP_DOMAIN,
90 SAMR_DOMAIN_ACCESS_CREATE_GROUP |
91 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
92 &connect_handle,
93 &domain_handle,
94 &domain_sid);
95 if (!W_ERROR_IS_OK(werr)) {
96 goto done;
97 }
98
99 switch (r->in.level) {
100 case 0:
101 init_lsa_String(&lsa_group_name, info0->grpi0_name);
102 break;
103 case 1:
104 init_lsa_String(&lsa_group_name, info1->grpi1_name);
105 break;
106 case 2:
107 init_lsa_String(&lsa_group_name, info2->grpi2_name);
108 break;
109 case 3:
110 init_lsa_String(&lsa_group_name, info3->grpi3_name);
111 break;
112 }
113
114 status = dcerpc_samr_CreateDomainGroup(b, talloc_tos(),
115 &domain_handle,
116 &lsa_group_name,
117 SEC_STD_DELETE |
118 SAMR_GROUP_ACCESS_SET_INFO,
119 &group_handle,
120 &rid,
121 &result);
122
123 if (!NT_STATUS_IS_OK(status)) {
124 werr = ntstatus_to_werror(status);
125 goto done;
126 }
127 if (!NT_STATUS_IS_OK(result)) {
128 werr = ntstatus_to_werror(result);
129 goto done;
130 }
131
132 switch (r->in.level) {
133 case 1:
134 if (info1->grpi1_comment) {
135 init_lsa_String(&info.description,
136 info1->grpi1_comment);
137
138 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
139 &group_handle,
140 GROUPINFODESCRIPTION,
141 &info,
142 &result);
143 }
144 break;
145 case 2:
146 if (info2->grpi2_comment) {
147 init_lsa_String(&info.description,
148 info2->grpi2_comment);
149
150 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
151 &group_handle,
152 GROUPINFODESCRIPTION,
153 &info,
154 &result);
155 if (!NT_STATUS_IS_OK(status)) {
156 werr = ntstatus_to_werror(status);
157 goto failed;
158 }
159 if (!NT_STATUS_IS_OK(result)) {
160 werr = ntstatus_to_werror(result);
161 goto failed;
162 }
163 }
164
165 if (info2->grpi2_attributes != 0) {
166 info.attributes.attributes = info2->grpi2_attributes;
167 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
168 &group_handle,
169 GROUPINFOATTRIBUTES,
170 &info,
171 &result);
172
173 }
174 break;
175 case 3:
176 if (info3->grpi3_comment) {
177 init_lsa_String(&info.description,
178 info3->grpi3_comment);
179
180 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
181 &group_handle,
182 GROUPINFODESCRIPTION,
183 &info,
184 &result);
185 if (!NT_STATUS_IS_OK(status)) {
186 werr = ntstatus_to_werror(status);
187 goto failed;
188 }
189 if (!NT_STATUS_IS_OK(result)) {
190 werr = ntstatus_to_werror(result);
191 goto failed;
192 }
193 }
194
195 if (info3->grpi3_attributes != 0) {
196 info.attributes.attributes = info3->grpi3_attributes;
197 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
198 &group_handle,
199 GROUPINFOATTRIBUTES,
200 &info,
201 &result);
202 }
203 break;
204 default:
205 break;
206 }
207
208 if (!NT_STATUS_IS_OK(status)) {
209 werr = ntstatus_to_werror(status);
210 goto failed;
211 }
212 if (!NT_STATUS_IS_OK(result)) {
213 werr = ntstatus_to_werror(result);
214 goto failed;
215 }
216
217 werr = WERR_OK;
218 goto done;
219
220 failed:
221 dcerpc_samr_DeleteDomainGroup(b, talloc_tos(),
222 &group_handle, &result);
223
224 done:
225 if (is_valid_policy_hnd(&group_handle)) {
226 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
227 }
228
229 if (ctx->disable_policy_handle_cache) {
230 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
231 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
232 }
233
234 return werr;
235 }
236
237 /****************************************************************
238 ****************************************************************/
239
240 WERROR NetGroupAdd_l(struct libnetapi_ctx *ctx,
241 struct NetGroupAdd *r)
242 {
243 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupAdd);
244 }
245
246 /****************************************************************
247 ****************************************************************/
248
249 WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
250 struct NetGroupDel *r)
251 {
252 struct rpc_pipe_client *pipe_cli = NULL;
253 NTSTATUS status, result;
254 WERROR werr;
255 struct policy_handle connect_handle, domain_handle, group_handle;
256 struct lsa_String lsa_group_name;
257 struct dom_sid2 *domain_sid = NULL;
258 int i = 0;
259 struct dcerpc_binding_handle *b = NULL;
260
261 struct samr_Ids rids;
262 struct samr_Ids types;
263 union samr_GroupInfo *info = NULL;
264 struct samr_RidAttrArray *rid_array = NULL;
265
266 ZERO_STRUCT(connect_handle);
267 ZERO_STRUCT(domain_handle);
268 ZERO_STRUCT(group_handle);
269
270 if (!r->in.group_name) {
271 return WERR_INVALID_PARAM;
272 }
273
274 werr = libnetapi_open_pipe(ctx, r->in.server_name,
275 &ndr_table_samr.syntax_id,
276 &pipe_cli);
277 if (!W_ERROR_IS_OK(werr)) {
278 goto done;
279 }
280
281 b = pipe_cli->binding_handle;
282
283 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
284 SAMR_ACCESS_ENUM_DOMAINS |
285 SAMR_ACCESS_LOOKUP_DOMAIN,
286 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
287 &connect_handle,
288 &domain_handle,
289 &domain_sid);
290 if (!W_ERROR_IS_OK(werr)) {
291 goto done;
292 }
293
294 init_lsa_String(&lsa_group_name, r->in.group_name);
295
296 status = dcerpc_samr_LookupNames(b, talloc_tos(),
297 &domain_handle,
298 1,
299 &lsa_group_name,
300 &rids,
301 &types,
302 &result);
303 if (!NT_STATUS_IS_OK(status)) {
304 werr = ntstatus_to_werror(status);
305 goto done;
306 }
307 if (!NT_STATUS_IS_OK(result)) {
308 werr = ntstatus_to_werror(result);
309 goto done;
310 }
311
312 if (types.ids[0] != SID_NAME_DOM_GRP) {
313 werr = WERR_INVALID_DATATYPE;
314 goto done;
315 }
316
317 status = dcerpc_samr_OpenGroup(b, talloc_tos(),
318 &domain_handle,
319 SEC_STD_DELETE |
320 SAMR_GROUP_ACCESS_GET_MEMBERS |
321 SAMR_GROUP_ACCESS_REMOVE_MEMBER |
322 SAMR_GROUP_ACCESS_ADD_MEMBER |
323 SAMR_GROUP_ACCESS_LOOKUP_INFO,
324 rids.ids[0],
325 &group_handle,
326 &result);
327 if (!NT_STATUS_IS_OK(status)) {
328 werr = ntstatus_to_werror(status);
329 goto done;
330 }
331 if (!NT_STATUS_IS_OK(result)) {
332 werr = ntstatus_to_werror(result);
333 goto done;
334 }
335
336 status = dcerpc_samr_QueryGroupInfo(b, talloc_tos(),
337 &group_handle,
338 GROUPINFOATTRIBUTES,
339 &info,
340 &result);
341 if (!NT_STATUS_IS_OK(status)) {
342 werr = ntstatus_to_werror(status);
343 goto done;
344 }
345 if (!NT_STATUS_IS_OK(result)) {
346 werr = ntstatus_to_werror(result);
347 goto done;
348 }
349
350 #if 0
351 /* breaks against NT4 */
352 if (!(info->attributes.attributes & SE_GROUP_ENABLED)) {
353 werr = WERR_ACCESS_DENIED;
354 goto done;
355 }
356 #endif
357 status = dcerpc_samr_QueryGroupMember(b, talloc_tos(),
358 &group_handle,
359 &rid_array,
360 &result);
361 if (!NT_STATUS_IS_OK(status)) {
362 werr = ntstatus_to_werror(status);
363 goto done;
364 }
365 if (!NT_STATUS_IS_OK(result)) {
366 werr = ntstatus_to_werror(result);
367 goto done;
368 }
369
370 {
371 struct lsa_Strings names;
372 struct samr_Ids member_types;
373
374 status = dcerpc_samr_LookupRids(b, talloc_tos(),
375 &domain_handle,
376 rid_array->count,
377 rid_array->rids,
378 &names,
379 &member_types,
380 &result);
381 if (!NT_STATUS_IS_OK(status)) {
382 werr = ntstatus_to_werror(status);
383 goto done;
384 }
385 if (!NT_STATUS_IS_OK(result)) {
386 werr = ntstatus_to_werror(result);
387 goto done;
388 }
389 }
390
391 for (i=0; i < rid_array->count; i++) {
392
393 status = dcerpc_samr_DeleteGroupMember(b, talloc_tos(),
394 &group_handle,
395 rid_array->rids[i],
396 &result);
397 if (!NT_STATUS_IS_OK(status)) {
398 werr = ntstatus_to_werror(status);
399 goto done;
400 }
401 if (!NT_STATUS_IS_OK(result)) {
402 werr = ntstatus_to_werror(result);
403 goto done;
404 }
405 }
406
407 status = dcerpc_samr_DeleteDomainGroup(b, talloc_tos(),
408 &group_handle,
409 &result);
410 if (!NT_STATUS_IS_OK(status)) {
411 werr = ntstatus_to_werror(status);
412 goto done;
413 }
414 if (!NT_STATUS_IS_OK(result)) {
415 werr = ntstatus_to_werror(result);
416 goto done;
417 }
418
419 ZERO_STRUCT(group_handle);
420
421 werr = WERR_OK;
422
423 done:
424 if (is_valid_policy_hnd(&group_handle)) {
425 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
426 }
427
428 if (ctx->disable_policy_handle_cache) {
429 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
430 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
431 }
432
433 return werr;
434 }
435
436 /****************************************************************
437 ****************************************************************/
438
439 WERROR NetGroupDel_l(struct libnetapi_ctx *ctx,
440 struct NetGroupDel *r)
441 {
442 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupDel);
443 }
444
445 /****************************************************************
446 ****************************************************************/
447
448 WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
449 struct NetGroupSetInfo *r)
450 {
451 struct rpc_pipe_client *pipe_cli = NULL;
452 NTSTATUS status, result;
453 WERROR werr;
454 struct policy_handle connect_handle, domain_handle, group_handle;
455 struct lsa_String lsa_group_name;
456 struct dom_sid2 *domain_sid = NULL;
457 struct dcerpc_binding_handle *b = NULL;
458
459 struct samr_Ids rids;
460 struct samr_Ids types;
461 union samr_GroupInfo info;
462 struct GROUP_INFO_0 *g0;
463 struct GROUP_INFO_1 *g1;
464 struct GROUP_INFO_2 *g2;
465 struct GROUP_INFO_3 *g3;
466 struct GROUP_INFO_1002 *g1002;
467 struct GROUP_INFO_1005 *g1005;
468
469 ZERO_STRUCT(connect_handle);
470 ZERO_STRUCT(domain_handle);
471 ZERO_STRUCT(group_handle);
472
473 if (!r->in.group_name) {
474 return WERR_INVALID_PARAM;
475 }
476
477 werr = libnetapi_open_pipe(ctx, r->in.server_name,
478 &ndr_table_samr.syntax_id,
479 &pipe_cli);
480 if (!W_ERROR_IS_OK(werr)) {
481 goto done;
482 }
483
484 b = pipe_cli->binding_handle;
485
486 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
487 SAMR_ACCESS_ENUM_DOMAINS |
488 SAMR_ACCESS_LOOKUP_DOMAIN,
489 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
490 &connect_handle,
491 &domain_handle,
492 &domain_sid);
493 if (!W_ERROR_IS_OK(werr)) {
494 goto done;
495 }
496
497 init_lsa_String(&lsa_group_name, r->in.group_name);
498
499 status = dcerpc_samr_LookupNames(b, talloc_tos(),
500 &domain_handle,
501 1,
502 &lsa_group_name,
503 &rids,
504 &types,
505 &result);
506 if (!NT_STATUS_IS_OK(status)) {
507 werr = ntstatus_to_werror(status);
508 goto done;
509 }
510 if (!NT_STATUS_IS_OK(result)) {
511 werr = ntstatus_to_werror(result);
512 goto done;
513 }
514
515 if (types.ids[0] != SID_NAME_DOM_GRP) {
516 werr = WERR_INVALID_DATATYPE;
517 goto done;
518 }
519
520 status = dcerpc_samr_OpenGroup(b, talloc_tos(),
521 &domain_handle,
522 SAMR_GROUP_ACCESS_SET_INFO |
523 SAMR_GROUP_ACCESS_LOOKUP_INFO,
524 rids.ids[0],
525 &group_handle,
526 &result);
527 if (!NT_STATUS_IS_OK(status)) {
528 werr = ntstatus_to_werror(status);
529 goto done;
530 }
531 if (!NT_STATUS_IS_OK(result)) {
532 werr = ntstatus_to_werror(result);
533 goto done;
534 }
535
536 switch (r->in.level) {
537 case 0:
538 g0 = (struct GROUP_INFO_0 *)r->in.buffer;
539 init_lsa_String(&info.name, g0->grpi0_name);
540 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
541 &group_handle,
542 GROUPINFONAME,
543 &info,
544 &result);
545 break;
546 case 1:
547 g1 = (struct GROUP_INFO_1 *)r->in.buffer;
548 init_lsa_String(&info.description, g1->grpi1_comment);
549 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
550 &group_handle,
551 GROUPINFODESCRIPTION,
552 &info,
553 &result);
554 break;
555 case 2:
556 g2 = (struct GROUP_INFO_2 *)r->in.buffer;
557 init_lsa_String(&info.description, g2->grpi2_comment);
558 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
559 &group_handle,
560 GROUPINFODESCRIPTION,
561 &info,
562 &result);
563 if (!NT_STATUS_IS_OK(status)) {
564 werr = ntstatus_to_werror(status);
565 goto done;
566 }
567 if (!NT_STATUS_IS_OK(result)) {
568 werr = ntstatus_to_werror(result);
569 goto done;
570 }
571
572 info.attributes.attributes = g2->grpi2_attributes;
573 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
574 &group_handle,
575 GROUPINFOATTRIBUTES,
576 &info,
577 &result);
578 break;
579 case 3:
580 g3 = (struct GROUP_INFO_3 *)r->in.buffer;
581 init_lsa_String(&info.description, g3->grpi3_comment);
582 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
583 &group_handle,
584 GROUPINFODESCRIPTION,
585 &info,
586 &result);
587 if (!NT_STATUS_IS_OK(status)) {
588 werr = ntstatus_to_werror(status);
589 goto done;
590 }
591 if (!NT_STATUS_IS_OK(result)) {
592 werr = ntstatus_to_werror(result);
593 goto done;
594 }
595
596 info.attributes.attributes = g3->grpi3_attributes;
597 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
598 &group_handle,
599 GROUPINFOATTRIBUTES,
600 &info,
601 &result);
602 break;
603 case 1002:
604 g1002 = (struct GROUP_INFO_1002 *)r->in.buffer;
605 init_lsa_String(&info.description, g1002->grpi1002_comment);
606 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
607 &group_handle,
608 GROUPINFODESCRIPTION,
609 &info,
610 &result);
611 break;
612 case 1005:
613 g1005 = (struct GROUP_INFO_1005 *)r->in.buffer;
614 info.attributes.attributes = g1005->grpi1005_attributes;
615 status = dcerpc_samr_SetGroupInfo(b, talloc_tos(),
616 &group_handle,
617 GROUPINFOATTRIBUTES,
618 &info,
619 &result);
620 break;
621 default:
622 status = NT_STATUS_INVALID_LEVEL;
623 break;
624 }
625
626 if (!NT_STATUS_IS_OK(status)) {
627 werr = ntstatus_to_werror(status);
628 goto done;
629 }
630 if (!NT_STATUS_IS_OK(result)) {
631 werr = ntstatus_to_werror(result);
632 goto done;
633 }
634
635 werr = WERR_OK;
636
637 done:
638 if (is_valid_policy_hnd(&group_handle)) {
639 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
640 }
641
642 if (ctx->disable_policy_handle_cache) {
643 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
644 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
645 }
646
647 return werr;
648 }
649
650 /****************************************************************
651 ****************************************************************/
652
653 WERROR NetGroupSetInfo_l(struct libnetapi_ctx *ctx,
654 struct NetGroupSetInfo *r)
655 {
656 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupSetInfo);
657 }
658
659 /****************************************************************
660 ****************************************************************/
661
662 static WERROR map_group_info_to_buffer(TALLOC_CTX *mem_ctx,
663 uint32_t level,
664 struct samr_GroupInfoAll *info,
665 struct dom_sid2 *domain_sid,
666 uint32_t rid,
667 uint8_t **buffer)
668 {
669 struct GROUP_INFO_0 info0;
670 struct GROUP_INFO_1 info1;
671 struct GROUP_INFO_2 info2;
672 struct GROUP_INFO_3 info3;
673 struct dom_sid sid;
674
675 switch (level) {
676 case 0:
677 info0.grpi0_name = info->name.string;
678
679 *buffer = (uint8_t *)talloc_memdup(mem_ctx, &info0, sizeof(info0));
680
681 break;
682 case 1:
683 info1.grpi1_name = info->name.string;
684 info1.grpi1_comment = info->description.string;
685
686 *buffer = (uint8_t *)talloc_memdup(mem_ctx, &info1, sizeof(info1));
687
688 break;
689 case 2:
690 info2.grpi2_name = info->name.string;
691 info2.grpi2_comment = info->description.string;
692 info2.grpi2_group_id = rid;
693 info2.grpi2_attributes = info->attributes;
694
695 *buffer = (uint8_t *)talloc_memdup(mem_ctx, &info2, sizeof(info2));
696
697 break;
698 case 3:
699 if (!sid_compose(&sid, domain_sid, rid)) {
700 return WERR_NOMEM;
701 }
702
703 info3.grpi3_name = info->name.string;
704 info3.grpi3_comment = info->description.string;
705 info3.grpi3_attributes = info->attributes;
706 info3.grpi3_group_sid = (struct domsid *)dom_sid_dup(mem_ctx, &sid);
707
708 *buffer = (uint8_t *)talloc_memdup(mem_ctx, &info3, sizeof(info3));
709
710 break;
711 default:
712 return WERR_UNKNOWN_LEVEL;
713 }
714
715 W_ERROR_HAVE_NO_MEMORY(*buffer);
716
717 return WERR_OK;
718 }
719
720 /****************************************************************
721 ****************************************************************/
722
723 WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
724 struct NetGroupGetInfo *r)
725 {
726 struct rpc_pipe_client *pipe_cli = NULL;
727 NTSTATUS status, result;
728 WERROR werr;
729 struct policy_handle connect_handle, domain_handle, group_handle;
730 struct lsa_String lsa_group_name;
731 struct dom_sid2 *domain_sid = NULL;
732 struct dcerpc_binding_handle *b = NULL;
733
734 struct samr_Ids rids;
735 struct samr_Ids types;
736 union samr_GroupInfo *info = NULL;
737 bool group_info_all = false;
738
739 ZERO_STRUCT(connect_handle);
740 ZERO_STRUCT(domain_handle);
741 ZERO_STRUCT(group_handle);
742
743 if (!r->in.group_name) {
744 return WERR_INVALID_PARAM;
745 }
746
747 werr = libnetapi_open_pipe(ctx, r->in.server_name,
748 &ndr_table_samr.syntax_id,
749 &pipe_cli);
750 if (!W_ERROR_IS_OK(werr)) {
751 goto done;
752 }
753
754 b = pipe_cli->binding_handle;
755
756 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
757 SAMR_ACCESS_ENUM_DOMAINS |
758 SAMR_ACCESS_LOOKUP_DOMAIN,
759 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
760 &connect_handle,
761 &domain_handle,
762 &domain_sid);
763 if (!W_ERROR_IS_OK(werr)) {
764 goto done;
765 }
766
767 init_lsa_String(&lsa_group_name, r->in.group_name);
768
769 status = dcerpc_samr_LookupNames(b, talloc_tos(),
770 &domain_handle,
771 1,
772 &lsa_group_name,
773 &rids,
774 &types,
775 &result);
776 if (!NT_STATUS_IS_OK(status)) {
777 werr = ntstatus_to_werror(status);
778 goto done;
779 }
780 if (!NT_STATUS_IS_OK(result)) {
781 werr = ntstatus_to_werror(result);
782 goto done;
783 }
784
785 if (types.ids[0] != SID_NAME_DOM_GRP) {
786 werr = WERR_INVALID_DATATYPE;
787 goto done;
788 }
789
790 status = dcerpc_samr_OpenGroup(b, talloc_tos(),
791 &domain_handle,
792 SAMR_GROUP_ACCESS_LOOKUP_INFO,
793 rids.ids[0],
794 &group_handle,
795 &result);
796 if (!NT_STATUS_IS_OK(status)) {
797 werr = ntstatus_to_werror(status);
798 goto done;
799 }
800 if (!NT_STATUS_IS_OK(result)) {
801 werr = ntstatus_to_werror(result);
802 goto done;
803 }
804
805 status = dcerpc_samr_QueryGroupInfo(b, talloc_tos(),
806 &group_handle,
807 GROUPINFOALL2,
808 &info,
809 &result);
810 if (!NT_STATUS_IS_OK(status)) {
811 werr = ntstatus_to_werror(status);
812 goto done;
813 }
814
815 if (NT_STATUS_EQUAL(result, NT_STATUS_INVALID_INFO_CLASS)) {
816 status = dcerpc_samr_QueryGroupInfo(b, talloc_tos(),
817 &group_handle,
818 GROUPINFOALL,
819 &info,
820 &result);
821 group_info_all = true;
822 if (!NT_STATUS_IS_OK(status)) {
823 werr = ntstatus_to_werror(status);
824 goto done;
825 }
826 }
827
828 if (!NT_STATUS_IS_OK(result)) {
829 werr = ntstatus_to_werror(result);
830 goto done;
831 }
832
833 werr = map_group_info_to_buffer(ctx, r->in.level,
834 group_info_all ? &info->all : &info->all2,
835 domain_sid, rids.ids[0],
836 r->out.buffer);
837 if (!W_ERROR_IS_OK(werr)) {
838 goto done;
839 }
840 done:
841 if (is_valid_policy_hnd(&group_handle)) {
842 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
843 }
844
845 if (ctx->disable_policy_handle_cache) {
846 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
847 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
848 }
849
850 return werr;
851 }
852
853 /****************************************************************
854 ****************************************************************/
855
856 WERROR NetGroupGetInfo_l(struct libnetapi_ctx *ctx,
857 struct NetGroupGetInfo *r)
858 {
859 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupGetInfo);
860 }
861
862 /****************************************************************
863 ****************************************************************/
864
865 WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
866 struct NetGroupAddUser *r)
867 {
868 struct rpc_pipe_client *pipe_cli = NULL;
869 NTSTATUS status, result;
870 WERROR werr;
871 struct policy_handle connect_handle, domain_handle, group_handle;
872 struct lsa_String lsa_group_name, lsa_user_name;
873 struct dom_sid2 *domain_sid = NULL;
874 struct dcerpc_binding_handle *b = NULL;
875
876 struct samr_Ids rids;
877 struct samr_Ids types;
878
879 ZERO_STRUCT(connect_handle);
880 ZERO_STRUCT(domain_handle);
881 ZERO_STRUCT(group_handle);
882
883 if (!r->in.group_name) {
884 return WERR_INVALID_PARAM;
885 }
886
887 werr = libnetapi_open_pipe(ctx, r->in.server_name,
888 &ndr_table_samr.syntax_id,
889 &pipe_cli);
890 if (!W_ERROR_IS_OK(werr)) {
891 goto done;
892 }
893
894 b = pipe_cli->binding_handle;
895
896 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
897 SAMR_ACCESS_ENUM_DOMAINS |
898 SAMR_ACCESS_LOOKUP_DOMAIN,
899 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
900 &connect_handle,
901 &domain_handle,
902 &domain_sid);
903 if (!W_ERROR_IS_OK(werr)) {
904 goto done;
905 }
906
907 init_lsa_String(&lsa_group_name, r->in.group_name);
908
909 status = dcerpc_samr_LookupNames(b, talloc_tos(),
910 &domain_handle,
911 1,
912 &lsa_group_name,
913 &rids,
914 &types,
915 &result);
916 if (!NT_STATUS_IS_OK(status)) {
917 werr = ntstatus_to_werror(status);
918 goto done;
919 }
920 if (!NT_STATUS_IS_OK(result)) {
921 werr = WERR_GROUPNOTFOUND;
922 goto done;
923 }
924
925 if (types.ids[0] != SID_NAME_DOM_GRP) {
926 werr = WERR_GROUPNOTFOUND;
927 goto done;
928 }
929
930 status = dcerpc_samr_OpenGroup(b, talloc_tos(),
931 &domain_handle,
932 SAMR_GROUP_ACCESS_ADD_MEMBER,
933 rids.ids[0],
934 &group_handle,
935 &result);
936 if (!NT_STATUS_IS_OK(status)) {
937 werr = ntstatus_to_werror(status);
938 goto done;
939 }
940 if (!NT_STATUS_IS_OK(result)) {
941 werr = ntstatus_to_werror(result);
942 goto done;
943 }
944
945 init_lsa_String(&lsa_user_name, r->in.user_name);
946
947 status = dcerpc_samr_LookupNames(b, talloc_tos(),
948 &domain_handle,
949 1,
950 &lsa_user_name,
951 &rids,
952 &types,
953 &result);
954 if (!NT_STATUS_IS_OK(status)) {
955 werr = ntstatus_to_werror(status);
956 goto done;
957 }
958 if (!NT_STATUS_IS_OK(result)) {
959 werr = WERR_USER_NOT_FOUND;
960 goto done;
961 }
962
963 if (types.ids[0] != SID_NAME_USER) {
964 werr = WERR_USER_NOT_FOUND;
965 goto done;
966 }
967
968 status = dcerpc_samr_AddGroupMember(b, talloc_tos(),
969 &group_handle,
970 rids.ids[0],
971 7, /* why ? */
972 &result);
973 if (!NT_STATUS_IS_OK(status)) {
974 werr = ntstatus_to_werror(status);
975 goto done;
976 }
977 if (!NT_STATUS_IS_OK(result)) {
978 werr = ntstatus_to_werror(result);
979 goto done;
980 }
981
982 werr = WERR_OK;
983
984 done:
985 if (is_valid_policy_hnd(&group_handle)) {
986 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
987 }
988
989 if (ctx->disable_policy_handle_cache) {
990 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
991 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
992 }
993
994 return werr;
995 }
996
997 /****************************************************************
998 ****************************************************************/
999
1000 WERROR NetGroupAddUser_l(struct libnetapi_ctx *ctx,
1001 struct NetGroupAddUser *r)
1002 {
1003 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupAddUser);
1004 }
1005
1006 /****************************************************************
1007 ****************************************************************/
1008
1009 WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
1010 struct NetGroupDelUser *r)
1011 {
1012 struct rpc_pipe_client *pipe_cli = NULL;
1013 NTSTATUS status, result;
1014 WERROR werr;
1015 struct policy_handle connect_handle, domain_handle, group_handle;
1016 struct lsa_String lsa_group_name, lsa_user_name;
1017 struct dom_sid2 *domain_sid = NULL;
1018 struct dcerpc_binding_handle *b = NULL;
1019
1020 struct samr_Ids rids;
1021 struct samr_Ids types;
1022
1023 ZERO_STRUCT(connect_handle);
1024 ZERO_STRUCT(domain_handle);
1025 ZERO_STRUCT(group_handle);
1026
1027 if (!r->in.group_name) {
1028 return WERR_INVALID_PARAM;
1029 }
1030
1031 werr = libnetapi_open_pipe(ctx, r->in.server_name,
1032 &ndr_table_samr.syntax_id,
1033 &pipe_cli);
1034 if (!W_ERROR_IS_OK(werr)) {
1035 goto done;
1036 }
1037
1038 b = pipe_cli->binding_handle;
1039
1040 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
1041 SAMR_ACCESS_ENUM_DOMAINS |
1042 SAMR_ACCESS_LOOKUP_DOMAIN,
1043 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
1044 &connect_handle,
1045 &domain_handle,
1046 &domain_sid);
1047 if (!W_ERROR_IS_OK(werr)) {
1048 goto done;
1049 }
1050
1051 init_lsa_String(&lsa_group_name, r->in.group_name);
1052
1053 status = dcerpc_samr_LookupNames(b, talloc_tos(),
1054 &domain_handle,
1055 1,
1056 &lsa_group_name,
1057 &rids,
1058 &types,
1059 &result);
1060 if (!NT_STATUS_IS_OK(status)) {
1061 werr = ntstatus_to_werror(status);
1062 goto done;
1063 }
1064 if (!NT_STATUS_IS_OK(result)) {
1065 werr = WERR_GROUPNOTFOUND;
1066 goto done;
1067 }
1068
1069 if (types.ids[0] != SID_NAME_DOM_GRP) {
1070 werr = WERR_GROUPNOTFOUND;
1071 goto done;
1072 }
1073
1074 status = dcerpc_samr_OpenGroup(b, talloc_tos(),
1075 &domain_handle,
1076 SAMR_GROUP_ACCESS_REMOVE_MEMBER,
1077 rids.ids[0],
1078 &group_handle,
1079 &result);
1080 if (!NT_STATUS_IS_OK(status)) {
1081 werr = ntstatus_to_werror(status);
1082 goto done;
1083 }
1084 if (!NT_STATUS_IS_OK(result)) {
1085 werr = ntstatus_to_werror(result);
1086 goto done;
1087 }
1088
1089 init_lsa_String(&lsa_user_name, r->in.user_name);
1090
1091 status = dcerpc_samr_LookupNames(b, talloc_tos(),
1092 &domain_handle,
1093 1,
1094 &lsa_user_name,
1095 &rids,
1096 &types,
1097 &result);
1098 if (!NT_STATUS_IS_OK(status)) {
1099 werr = ntstatus_to_werror(status);
1100 goto done;
1101 }
1102
1103 if (!NT_STATUS_IS_OK(result)) {
1104 werr = WERR_USER_NOT_FOUND;
1105 goto done;
1106 }
1107
1108 if (types.ids[0] != SID_NAME_USER) {
1109 werr = WERR_USER_NOT_FOUND;
1110 goto done;
1111 }
1112
1113 status = dcerpc_samr_DeleteGroupMember(b, talloc_tos(),
1114 &group_handle,
1115 rids.ids[0],
1116 &result);
1117 if (!NT_STATUS_IS_OK(status)) {
1118 werr = ntstatus_to_werror(status);
1119 goto done;
1120 }
1121 if (!NT_STATUS_IS_OK(result)) {
1122 werr = ntstatus_to_werror(result);
1123 goto done;
1124 }
1125
1126 werr = WERR_OK;
1127
1128 done:
1129 if (is_valid_policy_hnd(&group_handle)) {
1130 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
1131 }
1132
1133 if (ctx->disable_policy_handle_cache) {
1134 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
1135 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
1136 }
1137
1138 return werr;
1139 }
1140
1141 /****************************************************************
1142 ****************************************************************/
1143
1144 WERROR NetGroupDelUser_l(struct libnetapi_ctx *ctx,
1145 struct NetGroupDelUser *r)
1146 {
1147 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupDelUser);
1148 }
1149
1150 /****************************************************************
1151 ****************************************************************/
1152
1153 static WERROR convert_samr_disp_groups_to_GROUP_INFO_0_buffer(TALLOC_CTX *mem_ctx,
1154 struct samr_DispInfoFullGroups *groups,
1155 uint8_t **buffer)
1156 {
1157 struct GROUP_INFO_0 *g0;
1158 int i;
1159
1160 g0 = talloc_zero_array(mem_ctx, struct GROUP_INFO_0, groups->count);
1161 W_ERROR_HAVE_NO_MEMORY(g0);
1162
1163 for (i=0; i<groups->count; i++) {
1164 g0[i].grpi0_name = talloc_strdup(mem_ctx,
1165 groups->entries[i].account_name.string);
1166 W_ERROR_HAVE_NO_MEMORY(g0[i].grpi0_name);
1167 }
1168
1169 *buffer = (uint8_t *)talloc_memdup(mem_ctx, g0,
1170 sizeof(struct GROUP_INFO_0) * groups->count);
1171 W_ERROR_HAVE_NO_MEMORY(*buffer);
1172
1173 return WERR_OK;
1174 }
1175
1176 /****************************************************************
1177 ****************************************************************/
1178
1179 static WERROR convert_samr_disp_groups_to_GROUP_INFO_1_buffer(TALLOC_CTX *mem_ctx,
1180 struct samr_DispInfoFullGroups *groups,
1181 uint8_t **buffer)
1182 {
1183 struct GROUP_INFO_1 *g1;
1184 int i;
1185
1186 g1 = talloc_zero_array(mem_ctx, struct GROUP_INFO_1, groups->count);
1187 W_ERROR_HAVE_NO_MEMORY(g1);
1188
1189 for (i=0; i<groups->count; i++) {
1190 g1[i].grpi1_name = talloc_strdup(mem_ctx,
1191 groups->entries[i].account_name.string);
1192 g1[i].grpi1_comment = talloc_strdup(mem_ctx,
1193 groups->entries[i].description.string);
1194 W_ERROR_HAVE_NO_MEMORY(g1[i].grpi1_name);
1195 }
1196
1197 *buffer = (uint8_t *)talloc_memdup(mem_ctx, g1,
1198 sizeof(struct GROUP_INFO_1) * groups->count);
1199 W_ERROR_HAVE_NO_MEMORY(*buffer);
1200
1201 return WERR_OK;
1202 }
1203
1204 /****************************************************************
1205 ****************************************************************/
1206
1207 static WERROR convert_samr_disp_groups_to_GROUP_INFO_2_buffer(TALLOC_CTX *mem_ctx,
1208 struct samr_DispInfoFullGroups *groups,
1209 uint8_t **buffer)
1210 {
1211 struct GROUP_INFO_2 *g2;
1212 int i;
1213
1214 g2 = talloc_zero_array(mem_ctx, struct GROUP_INFO_2, groups->count);
1215 W_ERROR_HAVE_NO_MEMORY(g2);
1216
1217 for (i=0; i<groups->count; i++) {
1218 g2[i].grpi2_name = talloc_strdup(mem_ctx,
1219 groups->entries[i].account_name.string);
1220 g2[i].grpi2_comment = talloc_strdup(mem_ctx,
1221 groups->entries[i].description.string);
1222 g2[i].grpi2_group_id = groups->entries[i].rid;
1223 g2[i].grpi2_attributes = groups->entries[i].acct_flags;
1224 W_ERROR_HAVE_NO_MEMORY(g2[i].grpi2_name);
1225 }
1226
1227 *buffer = (uint8_t *)talloc_memdup(mem_ctx, g2,
1228 sizeof(struct GROUP_INFO_2) * groups->count);
1229 W_ERROR_HAVE_NO_MEMORY(*buffer);
1230
1231 return WERR_OK;
1232 }
1233
1234 /****************************************************************
1235 ****************************************************************/
1236
1237 static WERROR convert_samr_disp_groups_to_GROUP_INFO_3_buffer(TALLOC_CTX *mem_ctx,
1238 struct samr_DispInfoFullGroups *groups,
1239 const struct dom_sid *domain_sid,
1240 uint8_t **buffer)
1241 {
1242 struct GROUP_INFO_3 *g3;
1243 int i;
1244
1245 g3 = talloc_zero_array(mem_ctx, struct GROUP_INFO_3, groups->count);
1246 W_ERROR_HAVE_NO_MEMORY(g3);
1247
1248 for (i=0; i<groups->count; i++) {
1249
1250 struct dom_sid sid;
1251
1252 if (!sid_compose(&sid, domain_sid, groups->entries[i].rid)) {
1253 return WERR_NOMEM;
1254 }
1255
1256 g3[i].grpi3_name = talloc_strdup(mem_ctx,
1257 groups->entries[i].account_name.string);
1258 g3[i].grpi3_comment = talloc_strdup(mem_ctx,
1259 groups->entries[i].description.string);
1260 g3[i].grpi3_group_sid = (struct domsid *)dom_sid_dup(mem_ctx, &sid);
1261 g3[i].grpi3_attributes = groups->entries[i].acct_flags;
1262 W_ERROR_HAVE_NO_MEMORY(g3[i].grpi3_name);
1263 }
1264
1265 *buffer = (uint8_t *)talloc_memdup(mem_ctx, g3,
1266 sizeof(struct GROUP_INFO_3) * groups->count);
1267 W_ERROR_HAVE_NO_MEMORY(*buffer);
1268
1269 return WERR_OK;
1270 }
1271
1272 /****************************************************************
1273 ****************************************************************/
1274
1275 static WERROR convert_samr_disp_groups_to_GROUP_INFO_buffer(TALLOC_CTX *mem_ctx,
1276 uint32_t level,
1277 struct samr_DispInfoFullGroups *groups,
1278 const struct dom_sid *domain_sid,
1279 uint32_t *entries_read,
1280 uint8_t **buffer)
1281 {
1282 if (entries_read) {
1283 *entries_read = groups->count;
1284 }
1285
1286 switch (level) {
1287 case 0:
1288 return convert_samr_disp_groups_to_GROUP_INFO_0_buffer(mem_ctx, groups, buffer);
1289 case 1:
1290 return convert_samr_disp_groups_to_GROUP_INFO_1_buffer(mem_ctx, groups, buffer);
1291 case 2:
1292 return convert_samr_disp_groups_to_GROUP_INFO_2_buffer(mem_ctx, groups, buffer);
1293 case 3:
1294 return convert_samr_disp_groups_to_GROUP_INFO_3_buffer(mem_ctx, groups, domain_sid, buffer);
1295 default:
1296 return WERR_UNKNOWN_LEVEL;
1297 }
1298 }
1299
1300 /****************************************************************
1301 ****************************************************************/
1302
1303 WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
1304 struct NetGroupEnum *r)
1305 {
1306 struct rpc_pipe_client *pipe_cli = NULL;
1307 struct policy_handle connect_handle;
1308 struct dom_sid2 *domain_sid = NULL;
1309 struct policy_handle domain_handle;
1310 union samr_DispInfo info;
1311 union samr_DomainInfo *domain_info = NULL;
1312 struct dcerpc_binding_handle *b = NULL;
1313
1314 uint32_t total_size = 0;
1315 uint32_t returned_size = 0;
1316
1317 NTSTATUS result = NT_STATUS_OK;
1318 NTSTATUS status = NT_STATUS_OK;
1319 WERROR werr, tmp_werr;
1320
1321 ZERO_STRUCT(connect_handle);
1322 ZERO_STRUCT(domain_handle);
1323
1324 switch (r->in.level) {
1325 case 0:
1326 case 1:
1327 case 2:
1328 case 3:
1329 break;
1330 default:
1331 return WERR_UNKNOWN_LEVEL;
1332 }
1333
1334 werr = libnetapi_open_pipe(ctx, r->in.server_name,
1335 &ndr_table_samr.syntax_id,
1336 &pipe_cli);
1337 if (!W_ERROR_IS_OK(werr)) {
1338 goto done;
1339 }
1340
1341 b = pipe_cli->binding_handle;
1342
1343 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
1344 SAMR_ACCESS_ENUM_DOMAINS |
1345 SAMR_ACCESS_LOOKUP_DOMAIN,
1346 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
1347 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
1348 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
1349 &connect_handle,
1350 &domain_handle,
1351 &domain_sid);
1352 if (!W_ERROR_IS_OK(werr)) {
1353 goto done;
1354 }
1355
1356 status = dcerpc_samr_QueryDomainInfo(b, talloc_tos(),
1357 &domain_handle,
1358 2,
1359 &domain_info,
1360 &result);
1361 if (!NT_STATUS_IS_OK(status)) {
1362 werr = ntstatus_to_werror(status);
1363 goto done;
1364 }
1365 if (!NT_STATUS_IS_OK(result)) {
1366 werr = ntstatus_to_werror(result);
1367 goto done;
1368 }
1369
1370 if (r->out.total_entries) {
1371 *r->out.total_entries = domain_info->general.num_groups;
1372 }
1373
1374 status = dcerpc_samr_QueryDisplayInfo2(b,
1375 ctx,
1376 &domain_handle,
1377 3,
1378 r->in.resume_handle ?
1379 *r->in.resume_handle : 0,
1380 (uint32_t)-1,
1381 r->in.prefmaxlen,
1382 &total_size,
1383 &returned_size,
1384 &info,
1385 &result);
1386 if (!NT_STATUS_IS_OK(status)) {
1387 werr = ntstatus_to_werror(status);
1388 goto done;
1389 }
1390
1391 werr = ntstatus_to_werror(result);
1392 if (NT_STATUS_IS_ERR(result)) {
1393 goto done;
1394 }
1395
1396 if (r->out.resume_handle && info.info3.count > 0) {
1397 *r->out.resume_handle =
1398 info.info3.entries[info.info3.count-1].idx;
1399 }
1400
1401 tmp_werr = convert_samr_disp_groups_to_GROUP_INFO_buffer(ctx,
1402 r->in.level,
1403 &info.info3,
1404 domain_sid,
1405 r->out.entries_read,
1406 r->out.buffer);
1407 if (!W_ERROR_IS_OK(tmp_werr)) {
1408 werr = tmp_werr;
1409 goto done;
1410 }
1411
1412 done:
1413 /* if last query */
1414 if (NT_STATUS_IS_OK(result) ||
1415 NT_STATUS_IS_ERR(result)) {
1416
1417 if (ctx->disable_policy_handle_cache) {
1418 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
1419 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
1420 }
1421 }
1422
1423 return werr;
1424 }
1425
1426 /****************************************************************
1427 ****************************************************************/
1428
1429 WERROR NetGroupEnum_l(struct libnetapi_ctx *ctx,
1430 struct NetGroupEnum *r)
1431 {
1432 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupEnum);
1433 }
1434
1435 /****************************************************************
1436 ****************************************************************/
1437
1438 WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
1439 struct NetGroupGetUsers *r)
1440 {
1441 /* FIXME: this call needs to cope with large replies */
1442
1443 struct rpc_pipe_client *pipe_cli = NULL;
1444 struct policy_handle connect_handle, domain_handle, group_handle;
1445 struct lsa_String lsa_account_name;
1446 struct dom_sid2 *domain_sid = NULL;
1447 struct samr_Ids group_rids, name_types;
1448 struct samr_RidAttrArray *rid_array = NULL;
1449 struct lsa_Strings names;
1450 struct samr_Ids member_types;
1451 struct dcerpc_binding_handle *b = NULL;
1452
1453 int i;
1454 uint32_t entries_read = 0;
1455
1456 NTSTATUS status = NT_STATUS_OK;
1457 NTSTATUS result = NT_STATUS_OK;
1458 WERROR werr;
1459
1460 ZERO_STRUCT(connect_handle);
1461 ZERO_STRUCT(domain_handle);
1462
1463 if (!r->out.buffer) {
1464 return WERR_INVALID_PARAM;
1465 }
1466
1467 *r->out.buffer = NULL;
1468 *r->out.entries_read = 0;
1469 *r->out.total_entries = 0;
1470
1471 switch (r->in.level) {
1472 case 0:
1473 case 1:
1474 break;
1475 default:
1476 return WERR_UNKNOWN_LEVEL;
1477 }
1478
1479
1480 werr = libnetapi_open_pipe(ctx, r->in.server_name,
1481 &ndr_table_samr.syntax_id,
1482 &pipe_cli);
1483 if (!W_ERROR_IS_OK(werr)) {
1484 goto done;
1485 }
1486
1487 b = pipe_cli->binding_handle;
1488
1489 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
1490 SAMR_ACCESS_ENUM_DOMAINS |
1491 SAMR_ACCESS_LOOKUP_DOMAIN,
1492 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
1493 &connect_handle,
1494 &domain_handle,
1495 &domain_sid);
1496 if (!W_ERROR_IS_OK(werr)) {
1497 goto done;
1498 }
1499
1500 init_lsa_String(&lsa_account_name, r->in.group_name);
1501
1502 status = dcerpc_samr_LookupNames(b, talloc_tos(),
1503 &domain_handle,
1504 1,
1505 &lsa_account_name,
1506 &group_rids,
1507 &name_types,
1508 &result);
1509 if (!NT_STATUS_IS_OK(status)) {
1510 werr = ntstatus_to_werror(status);
1511 goto done;
1512 }
1513 if (!NT_STATUS_IS_OK(result)) {
1514 werr = ntstatus_to_werror(result);
1515 goto done;
1516 }
1517
1518 status = dcerpc_samr_OpenGroup(b, talloc_tos(),
1519 &domain_handle,
1520 SAMR_GROUP_ACCESS_GET_MEMBERS,
1521 group_rids.ids[0],
1522 &group_handle,
1523 &result);
1524 if (!NT_STATUS_IS_OK(status)) {
1525 werr = ntstatus_to_werror(status);
1526 goto done;
1527 }
1528 if (!NT_STATUS_IS_OK(result)) {
1529 werr = ntstatus_to_werror(result);
1530 goto done;
1531 }
1532
1533 status = dcerpc_samr_QueryGroupMember(b, talloc_tos(),
1534 &group_handle,
1535 &rid_array,
1536 &result);
1537 if (!NT_STATUS_IS_OK(status)) {
1538 werr = ntstatus_to_werror(status);
1539 goto done;
1540 }
1541 if (!NT_STATUS_IS_OK(result)) {
1542 werr = ntstatus_to_werror(result);
1543 goto done;
1544 }
1545
1546 status = dcerpc_samr_LookupRids(b, talloc_tos(),
1547 &domain_handle,
1548 rid_array->count,
1549 rid_array->rids,
1550 &names,
1551 &member_types,
1552 &result);
1553 if (!NT_STATUS_IS_OK(status)) {
1554 werr = ntstatus_to_werror(status);
1555 goto done;
1556 }
1557 if (!NT_STATUS_IS_OK(result)) {
1558 werr = ntstatus_to_werror(result);
1559 goto done;
1560 }
1561
1562 for (i=0; i < names.count; i++) {
1563
1564 if (member_types.ids[i] != SID_NAME_USER) {
1565 continue;
1566 }
1567
1568 status = add_GROUP_USERS_INFO_X_buffer(ctx,
1569 r->in.level,
1570 names.names[i].string,
1571 7,
1572 r->out.buffer,
1573 &entries_read);
1574 if (!NT_STATUS_IS_OK(status)) {
1575 werr = ntstatus_to_werror(status);
1576 goto done;
1577 }
1578 }
1579
1580 *r->out.entries_read = entries_read;
1581 *r->out.total_entries = entries_read;
1582
1583 werr = WERR_OK;
1584
1585 done:
1586 if (is_valid_policy_hnd(&group_handle)) {
1587 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
1588 }
1589
1590 if (ctx->disable_policy_handle_cache) {
1591 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
1592 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
1593 }
1594
1595 return werr;
1596 }
1597
1598 /****************************************************************
1599 ****************************************************************/
1600
1601 WERROR NetGroupGetUsers_l(struct libnetapi_ctx *ctx,
1602 struct NetGroupGetUsers *r)
1603 {
1604 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupGetUsers);
1605 }
1606
1607 /****************************************************************
1608 ****************************************************************/
1609
1610 WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
1611 struct NetGroupSetUsers *r)
1612 {
1613 struct rpc_pipe_client *pipe_cli = NULL;
1614 struct policy_handle connect_handle, domain_handle, group_handle;
1615 struct lsa_String lsa_account_name;
1616 struct dom_sid2 *domain_sid = NULL;
1617 union samr_GroupInfo *group_info = NULL;
1618 struct samr_Ids user_rids, name_types;
1619 struct samr_Ids group_rids, group_types;
1620 struct samr_RidAttrArray *rid_array = NULL;
1621 struct lsa_String *lsa_names = NULL;
1622 struct dcerpc_binding_handle *b = NULL;
1623
1624 uint32_t *add_rids = NULL;
1625 uint32_t *del_rids = NULL;
1626 size_t num_add_rids = 0;
1627 size_t num_del_rids = 0;
1628
1629 uint32_t *member_rids = NULL;
1630
1631 struct GROUP_USERS_INFO_0 *i0 = NULL;
1632 struct GROUP_USERS_INFO_1 *i1 = NULL;
1633
1634 int i, k;
1635
1636 NTSTATUS status = NT_STATUS_OK;
1637 NTSTATUS result = NT_STATUS_OK;
1638 WERROR werr;
1639
1640 ZERO_STRUCT(connect_handle);
1641 ZERO_STRUCT(domain_handle);
1642
1643 if (!r->in.buffer) {
1644 return WERR_INVALID_PARAM;
1645 }
1646
1647 switch (r->in.level) {
1648 case 0:
1649 case 1:
1650 break;
1651 default:
1652 return WERR_UNKNOWN_LEVEL;
1653 }
1654
1655 werr = libnetapi_open_pipe(ctx, r->in.server_name,
1656 &ndr_table_samr.syntax_id,
1657 &pipe_cli);
1658 if (!W_ERROR_IS_OK(werr)) {
1659 goto done;
1660 }
1661
1662 b = pipe_cli->binding_handle;
1663
1664 werr = libnetapi_samr_open_domain(ctx, pipe_cli,
1665 SAMR_ACCESS_ENUM_DOMAINS |
1666 SAMR_ACCESS_LOOKUP_DOMAIN,
1667 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
1668 &connect_handle,
1669 &domain_handle,
1670 &domain_sid);
1671 if (!W_ERROR_IS_OK(werr)) {
1672 goto done;
1673 }
1674
1675 init_lsa_String(&lsa_account_name, r->in.group_name);
1676
1677 status = dcerpc_samr_LookupNames(b, talloc_tos(),
1678 &domain_handle,
1679 1,
1680 &lsa_account_name,
1681 &group_rids,
1682 &group_types,
1683 &result);
1684 if (!NT_STATUS_IS_OK(status)) {
1685 werr = ntstatus_to_werror(status);
1686 goto done;
1687 }
1688 if (!NT_STATUS_IS_OK(result)) {
1689 werr = ntstatus_to_werror(result);
1690 goto done;
1691 }
1692
1693 status = dcerpc_samr_OpenGroup(b, talloc_tos(),
1694 &domain_handle,
1695 SAMR_GROUP_ACCESS_GET_MEMBERS |
1696 SAMR_GROUP_ACCESS_ADD_MEMBER |
1697 SAMR_GROUP_ACCESS_REMOVE_MEMBER |
1698 SAMR_GROUP_ACCESS_LOOKUP_INFO,
1699 group_rids.ids[0],
1700 &group_handle,
1701 &result);
1702 if (!NT_STATUS_IS_OK(status)) {
1703 werr = ntstatus_to_werror(status);
1704 goto done;
1705 }
1706 if (!NT_STATUS_IS_OK(result)) {
1707 werr = ntstatus_to_werror(result);
1708 goto done;
1709 }
1710
1711 status = dcerpc_samr_QueryGroupInfo(b, talloc_tos(),
1712 &group_handle,
1713 GROUPINFOATTRIBUTES,
1714 &group_info,
1715 &result);
1716 if (!NT_STATUS_IS_OK(status)) {
1717 werr = ntstatus_to_werror(status);
1718 goto done;
1719 }
1720 if (!NT_STATUS_IS_OK(result)) {
1721 werr = ntstatus_to_werror(result);
1722 goto done;
1723 }
1724
1725 switch (r->in.level) {
1726 case 0:
1727 i0 = (struct GROUP_USERS_INFO_0 *)r->in.buffer;
1728 break;
1729 case 1:
1730 i1 = (struct GROUP_USERS_INFO_1 *)r->in.buffer;
1731 break;
1732 }
1733
1734 lsa_names = talloc_array(ctx, struct lsa_String, r->in.num_entries);
1735 if (!lsa_names) {
1736 werr = WERR_NOMEM;
1737 goto done;
1738 }
1739
1740 for (i=0; i < r->in.num_entries; i++) {
1741
1742 switch (r->in.level) {
1743 case 0:
1744 init_lsa_String(&lsa_names[i], i0->grui0_name);
1745 i0++;
1746 break;
1747 case 1:
1748 init_lsa_String(&lsa_names[i], i1->grui1_name);
1749 i1++;
1750 break;
1751 }
1752 }
1753
1754 status = dcerpc_samr_LookupNames(b, talloc_tos(),
1755 &domain_handle,
1756 r->in.num_entries,
1757 lsa_names,
1758 &user_rids,
1759 &name_types,
1760 &result);
1761 if (!NT_STATUS_IS_OK(status)) {
1762 werr = ntstatus_to_werror(status);
1763 goto done;
1764 }
1765 if (!NT_STATUS_IS_OK(result)) {
1766 werr = ntstatus_to_werror(result);
1767 goto done;
1768 }
1769
1770 member_rids = user_rids.ids;
1771
1772 status = dcerpc_samr_QueryGroupMember(b, talloc_tos(),
1773 &group_handle,
1774 &rid_array,
1775 &result);
1776 if (!NT_STATUS_IS_OK(status)) {
1777 werr = ntstatus_to_werror(status);
1778 goto done;
1779 }
1780 if (!NT_STATUS_IS_OK(result)) {
1781 werr = ntstatus_to_werror(result);
1782 goto done;
1783 }
1784
1785 /* add list */
1786
1787 for (i=0; i < r->in.num_entries; i++) {
1788 bool already_member = false;
1789 for (k=0; k < rid_array->count; k++) {
1790 if (member_rids[i] == rid_array->rids[k]) {
1791 already_member = true;
1792 break;
1793 }
1794 }
1795 if (!already_member) {
1796 if (!add_rid_to_array_unique(ctx,
1797 member_rids[i],
1798 &add_rids, &num_add_rids)) {
1799 werr = WERR_GENERAL_FAILURE;
1800 goto done;
1801 }
1802 }
1803 }
1804
1805 /* del list */
1806
1807 for (k=0; k < rid_array->count; k++) {
1808 bool keep_member = false;
1809 for (i=0; i < r->in.num_entries; i++) {
1810 if (member_rids[i] == rid_array->rids[k]) {
1811 keep_member = true;
1812 break;
1813 }
1814 }
1815 if (!keep_member) {
1816 if (!add_rid_to_array_unique(ctx,
1817 rid_array->rids[k],
1818 &del_rids, &num_del_rids)) {
1819 werr = WERR_GENERAL_FAILURE;
1820 goto done;
1821 }
1822 }
1823 }
1824
1825 /* add list */
1826
1827 for (i=0; i < num_add_rids; i++) {
1828 status = dcerpc_samr_AddGroupMember(b, talloc_tos(),
1829 &group_handle,
1830 add_rids[i],
1831 7 /* ? */,
1832 &result);
1833 if (!NT_STATUS_IS_OK(status)) {
1834 werr = ntstatus_to_werror(status);
1835 goto done;
1836 }
1837 if (!NT_STATUS_IS_OK(result)) {
1838 werr = ntstatus_to_werror(result);
1839 goto done;
1840 }
1841 }
1842
1843 /* del list */
1844
1845 for (i=0; i < num_del_rids; i++) {
1846 status = dcerpc_samr_DeleteGroupMember(b, talloc_tos(),
1847 &group_handle,
1848 del_rids[i],
1849 &result);
1850 if (!NT_STATUS_IS_OK(status)) {
1851 werr = ntstatus_to_werror(status);
1852 goto done;
1853 }
1854 if (!NT_STATUS_IS_OK(result)) {
1855 werr = ntstatus_to_werror(result);
1856 goto done;
1857 }
1858 }
1859
1860 werr = WERR_OK;
1861
1862 done:
1863 if (is_valid_policy_hnd(&group_handle)) {
1864 dcerpc_samr_Close(b, talloc_tos(), &group_handle, &result);
1865 }
1866
1867 if (ctx->disable_policy_handle_cache) {
1868 libnetapi_samr_close_domain_handle(ctx, &domain_handle);
1869 libnetapi_samr_close_connect_handle(ctx, &connect_handle);
1870 }
1871
1872 return werr;
1873 }
1874
1875 /****************************************************************
1876 ****************************************************************/
1877
1878 WERROR NetGroupSetUsers_l(struct libnetapi_ctx *ctx,
1879 struct NetGroupSetUsers *r)
1880 {
1881 LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetGroupSetUsers);
1882 }
reg import