?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
librpc: Shorten dcerpc_binding_handle_call a bit
[Samba/gebeck_regimport.git] / source3 / rpc_server / samr / srv_samr_nt.c
blobb366eda2dd8dd05f64c84d4c49f5431bc2697901
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2008,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
14 * Copyright (C) Guenther Deschner 2008.
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 3 of the License, or
19 * (at your option) any later version.
20 *
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 */
29
30 /*
31 * This is the implementation of the SAMR code.
32 */
33
34 #include "includes.h"
35 #include "system/passwd.h"
36 #include "../libcli/auth/libcli_auth.h"
37 #include "ntdomain.h"
38 #include "../librpc/gen_ndr/srv_samr.h"
39 #include "rpc_server/samr/srv_samr_util.h"
40 #include "../lib/crypto/arcfour.h"
41 #include "secrets.h"
42 #include "rpc_client/init_lsa.h"
43 #include "../libcli/security/security.h"
44 #include "passdb.h"
45 #include "auth.h"
46 #include "rpc_server/srv_access_check.h"
47 #include "../lib/tsocket/tsocket.h"
48
49 #undef DBGC_CLASS
50 #define DBGC_CLASS DBGC_RPC_SRV
51
52 #define SAMR_USR_RIGHTS_WRITE_PW \
53 ( READ_CONTROL_ACCESS | \
54 SAMR_USER_ACCESS_CHANGE_PASSWORD | \
55 SAMR_USER_ACCESS_SET_LOC_COM)
56 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
57 ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
58
59 #define DISP_INFO_CACHE_TIMEOUT 10
60
61 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
62 #define MAX_SAM_ENTRIES_W95 50
63
64 struct samr_connect_info {
65 uint8_t dummy;
66 };
67
68 struct samr_domain_info {
69 struct dom_sid sid;
70 struct disp_info *disp_info;
71 };
72
73 struct samr_user_info {
74 struct dom_sid sid;
75 };
76
77 struct samr_group_info {
78 struct dom_sid sid;
79 };
80
81 struct samr_alias_info {
82 struct dom_sid sid;
83 };
84
85 typedef struct disp_info {
86 struct dom_sid sid; /* identify which domain this is. */
87 struct pdb_search *users; /* querydispinfo 1 and 4 */
88 struct pdb_search *machines; /* querydispinfo 2 */
89 struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
90 struct pdb_search *aliases; /* enumaliases */
91
92 uint32_t enum_acb_mask;
93 struct pdb_search *enum_users; /* enumusers with a mask */
94
95 struct tevent_timer *cache_timeout_event; /* cache idle timeout
96 * handler. */
97 } DISP_INFO;
98
99 static const struct generic_mapping sam_generic_mapping = {
100 GENERIC_RIGHTS_SAM_READ,
101 GENERIC_RIGHTS_SAM_WRITE,
102 GENERIC_RIGHTS_SAM_EXECUTE,
103 GENERIC_RIGHTS_SAM_ALL_ACCESS};
104 static const struct generic_mapping dom_generic_mapping = {
105 GENERIC_RIGHTS_DOMAIN_READ,
106 GENERIC_RIGHTS_DOMAIN_WRITE,
107 GENERIC_RIGHTS_DOMAIN_EXECUTE,
108 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
109 static const struct generic_mapping usr_generic_mapping = {
110 GENERIC_RIGHTS_USER_READ,
111 GENERIC_RIGHTS_USER_WRITE,
112 GENERIC_RIGHTS_USER_EXECUTE,
113 GENERIC_RIGHTS_USER_ALL_ACCESS};
114 static const struct generic_mapping usr_nopwchange_generic_mapping = {
115 GENERIC_RIGHTS_USER_READ,
116 GENERIC_RIGHTS_USER_WRITE,
117 GENERIC_RIGHTS_USER_EXECUTE & ~SAMR_USER_ACCESS_CHANGE_PASSWORD,
118 GENERIC_RIGHTS_USER_ALL_ACCESS};
119 static const struct generic_mapping grp_generic_mapping = {
120 GENERIC_RIGHTS_GROUP_READ,
121 GENERIC_RIGHTS_GROUP_WRITE,
122 GENERIC_RIGHTS_GROUP_EXECUTE,
123 GENERIC_RIGHTS_GROUP_ALL_ACCESS};
124 static const struct generic_mapping ali_generic_mapping = {
125 GENERIC_RIGHTS_ALIAS_READ,
126 GENERIC_RIGHTS_ALIAS_WRITE,
127 GENERIC_RIGHTS_ALIAS_EXECUTE,
128 GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
129
130 /*******************************************************************
131 *******************************************************************/
132
133 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, struct security_descriptor **psd, size_t *sd_size,
134 const struct generic_mapping *map,
135 struct dom_sid *sid, uint32 sid_access )
136 {
137 struct dom_sid domadmin_sid;
138 struct security_ace ace[5]; /* at most 5 entries */
139 size_t i = 0;
140
141 struct security_acl *psa = NULL;
142
143 /* basic access for Everyone */
144
145 init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
146 map->generic_execute | map->generic_read, 0);
147
148 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
149
150 init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
151 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
152 init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
153 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
154
155 /* Add Full Access for Domain Admins if we are a DC */
156
157 if ( IS_DC ) {
158 sid_compose(&domadmin_sid, get_global_sam_sid(),
159 DOMAIN_RID_ADMINS);
160 init_sec_ace(&ace[i++], &domadmin_sid,
161 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
162 }
163
164 /* if we have a sid, give it some special access */
165
166 if ( sid ) {
167 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, sid_access, 0);
168 }
169
170 /* create the security descriptor */
171
172 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
173 return NT_STATUS_NO_MEMORY;
174
175 if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
176 SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
177 psa, sd_size)) == NULL)
178 return NT_STATUS_NO_MEMORY;
179
180 return NT_STATUS_OK;
181 }
182
183 /*******************************************************************
184 Fetch or create a dispinfo struct.
185 ********************************************************************/
186
187 static DISP_INFO *get_samr_dispinfo_by_sid(const struct dom_sid *psid)
188 {
189 /*
190 * We do a static cache for DISP_INFO's here. Explanation can be found
191 * in Jeremy's checkin message to r11793:
192 *
193 * Fix the SAMR cache so it works across completely insane
194 * client behaviour (ie.:
195 * open pipe/open SAMR handle/enumerate 0 - 1024
196 * close SAMR handle, close pipe.
197 * open pipe/open SAMR handle/enumerate 1024 - 2048...
198 * close SAMR handle, close pipe.
199 * And on ad-nausium. Amazing.... probably object-oriented
200 * client side programming in action yet again.
201 * This change should *massively* improve performance when
202 * enumerating users from an LDAP database.
203 * Jeremy.
204 *
205 * "Our" and the builtin domain are the only ones where we ever
206 * enumerate stuff, so just cache 2 entries.
207 */
208
209 static struct disp_info *builtin_dispinfo;
210 static struct disp_info *domain_dispinfo;
211
212 /* There are two cases to consider here:
213 1) The SID is a domain SID and we look for an equality match, or
214 2) This is an account SID and so we return the DISP_INFO* for our
215 domain */
216
217 if (psid == NULL) {
218 return NULL;
219 }
220
221 if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
222 /*
223 * Necessary only once, but it does not really hurt.
224 */
225 if (builtin_dispinfo == NULL) {
226 builtin_dispinfo = talloc_zero(NULL, struct disp_info);
227 if (builtin_dispinfo == NULL) {
228 return NULL;
229 }
230 }
231 sid_copy(&builtin_dispinfo->sid, &global_sid_Builtin);
232
233 return builtin_dispinfo;
234 }
235
236 if (sid_check_is_our_sam(psid) || sid_check_is_in_our_sam(psid)) {
237 /*
238 * Necessary only once, but it does not really hurt.
239 */
240 if (domain_dispinfo == NULL) {
241 domain_dispinfo = talloc_zero(NULL, struct disp_info);
242 if (domain_dispinfo == NULL) {
243 return NULL;
244 }
245 }
246 sid_copy(&domain_dispinfo->sid, get_global_sam_sid());
247
248 return domain_dispinfo;
249 }
250
251 return NULL;
252 }
253
254 /*******************************************************************
255 Function to free the per SID data.
256 ********************************************************************/
257
258 static void free_samr_cache(DISP_INFO *disp_info)
259 {
260 DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
261 sid_string_dbg(&disp_info->sid)));
262
263 /* We need to become root here because the paged search might have to
264 * tell the LDAP server we're not interested in the rest anymore. */
265
266 become_root();
267
268 TALLOC_FREE(disp_info->users);
269 TALLOC_FREE(disp_info->machines);
270 TALLOC_FREE(disp_info->groups);
271 TALLOC_FREE(disp_info->aliases);
272 TALLOC_FREE(disp_info->enum_users);
273
274 unbecome_root();
275 }
276
277 /*******************************************************************
278 Idle event handler. Throw away the disp info cache.
279 ********************************************************************/
280
281 static void disp_info_cache_idle_timeout_handler(struct tevent_context *ev_ctx,
282 struct tevent_timer *te,
283 struct timeval now,
284 void *private_data)
285 {
286 DISP_INFO *disp_info = (DISP_INFO *)private_data;
287
288 TALLOC_FREE(disp_info->cache_timeout_event);
289
290 DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
291 "out\n"));
292 free_samr_cache(disp_info);
293 }
294
295 /*******************************************************************
296 Setup cache removal idle event handler.
297 ********************************************************************/
298
299 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
300 {
301 /* Remove any pending timeout and update. */
302
303 TALLOC_FREE(disp_info->cache_timeout_event);
304
305 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
306 "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
307 (unsigned int)secs_fromnow ));
308
309 disp_info->cache_timeout_event = tevent_add_timer(
310 server_event_context(), NULL,
311 timeval_current_ofs(secs_fromnow, 0),
312 disp_info_cache_idle_timeout_handler, (void *)disp_info);
313 }
314
315 /*******************************************************************
316 Force flush any cache. We do this on any samr_set_xxx call.
317 We must also remove the timeout handler.
318 ********************************************************************/
319
320 static void force_flush_samr_cache(const struct dom_sid *sid)
321 {
322 struct disp_info *disp_info = get_samr_dispinfo_by_sid(sid);
323
324 if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
325 return;
326 }
327
328 DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
329 TALLOC_FREE(disp_info->cache_timeout_event);
330 free_samr_cache(disp_info);
331 }
332
333 /*******************************************************************
334 Ensure password info is never given out. Paranioa... JRA.
335 ********************************************************************/
336
337 static void samr_clear_sam_passwd(struct samu *sam_pass)
338 {
339
340 if (!sam_pass)
341 return;
342
343 /* These now zero out the old password */
344
345 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
346 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
347 }
348
349 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
350 {
351 struct samr_displayentry *entry;
352
353 if (sid_check_is_builtin(&info->sid)) {
354 /* No users in builtin. */
355 return 0;
356 }
357
358 if (info->users == NULL) {
359 info->users = pdb_search_users(info, acct_flags);
360 if (info->users == NULL) {
361 return 0;
362 }
363 }
364 /* Fetch the last possible entry, thus trigger an enumeration */
365 pdb_search_entries(info->users, 0xffffffff, 1, &entry);
366
367 /* Ensure we cache this enumeration. */
368 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
369
370 return info->users->num_entries;
371 }
372
373 static uint32 count_sam_groups(struct disp_info *info)
374 {
375 struct samr_displayentry *entry;
376
377 if (sid_check_is_builtin(&info->sid)) {
378 /* No groups in builtin. */
379 return 0;
380 }
381
382 if (info->groups == NULL) {
383 info->groups = pdb_search_groups(info);
384 if (info->groups == NULL) {
385 return 0;
386 }
387 }
388 /* Fetch the last possible entry, thus trigger an enumeration */
389 pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
390
391 /* Ensure we cache this enumeration. */
392 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
393
394 return info->groups->num_entries;
395 }
396
397 static uint32 count_sam_aliases(struct disp_info *info)
398 {
399 struct samr_displayentry *entry;
400
401 if (info->aliases == NULL) {
402 info->aliases = pdb_search_aliases(info, &info->sid);
403 if (info->aliases == NULL) {
404 return 0;
405 }
406 }
407 /* Fetch the last possible entry, thus trigger an enumeration */
408 pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
409
410 /* Ensure we cache this enumeration. */
411 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
412
413 return info->aliases->num_entries;
414 }
415
416 /*******************************************************************
417 _samr_Close
418 ********************************************************************/
419
420 NTSTATUS _samr_Close(struct pipes_struct *p, struct samr_Close *r)
421 {
422 if (!close_policy_hnd(p, r->in.handle)) {
423 return NT_STATUS_INVALID_HANDLE;
424 }
425
426 ZERO_STRUCTP(r->out.handle);
427
428 return NT_STATUS_OK;
429 }
430
431 /*******************************************************************
432 _samr_OpenDomain
433 ********************************************************************/
434
435 NTSTATUS _samr_OpenDomain(struct pipes_struct *p,
436 struct samr_OpenDomain *r)
437 {
438 struct samr_domain_info *dinfo;
439 struct security_descriptor *psd = NULL;
440 uint32 acc_granted;
441 uint32 des_access = r->in.access_mask;
442 NTSTATUS status;
443 size_t sd_size;
444 uint32_t extra_access = SAMR_DOMAIN_ACCESS_CREATE_USER;
445
446 /* find the connection policy handle. */
447
448 (void)policy_handle_find(p, r->in.connect_handle, 0, NULL,
449 struct samr_connect_info, &status);
450 if (!NT_STATUS_IS_OK(status)) {
451 return status;
452 }
453
454 /*check if access can be granted as requested by client. */
455 map_max_allowed_access(p->session_info->security_token,
456 p->session_info->unix_token,
457 &des_access);
458
459 make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
460 se_map_generic( &des_access, &dom_generic_mapping );
461
462 /*
463 * Users with SeAddUser get the ability to manipulate groups
464 * and aliases.
465 */
466 if (security_token_has_privilege(p->session_info->security_token, SEC_PRIV_ADD_USERS)) {
467 extra_access |= (SAMR_DOMAIN_ACCESS_CREATE_GROUP |
468 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
469 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
470 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS |
471 SAMR_DOMAIN_ACCESS_CREATE_ALIAS);
472 }
473
474 /*
475 * Users with SeMachineAccount or SeAddUser get additional
476 * SAMR_DOMAIN_ACCESS_CREATE_USER access.
477 */
478
479 status = access_check_object( psd, p->session_info->security_token,
480 SEC_PRIV_MACHINE_ACCOUNT, SEC_PRIV_ADD_USERS,
481 extra_access, des_access,
482 &acc_granted, "_samr_OpenDomain" );
483
484 if ( !NT_STATUS_IS_OK(status) )
485 return status;
486
487 if (!sid_check_is_our_sam(r->in.sid) &&
488 !sid_check_is_builtin(r->in.sid)) {
489 return NT_STATUS_NO_SUCH_DOMAIN;
490 }
491
492 dinfo = policy_handle_create(p, r->out.domain_handle, acc_granted,
493 struct samr_domain_info, &status);
494 if (!NT_STATUS_IS_OK(status)) {
495 return status;
496 }
497 dinfo->sid = *r->in.sid;
498 dinfo->disp_info = get_samr_dispinfo_by_sid(r->in.sid);
499
500 DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
501
502 return NT_STATUS_OK;
503 }
504
505 /*******************************************************************
506 _samr_GetUserPwInfo
507 ********************************************************************/
508
509 NTSTATUS _samr_GetUserPwInfo(struct pipes_struct *p,
510 struct samr_GetUserPwInfo *r)
511 {
512 struct samr_user_info *uinfo;
513 enum lsa_SidType sid_type;
514 uint32_t min_password_length = 0;
515 uint32_t password_properties = 0;
516 bool ret = false;
517 NTSTATUS status;
518
519 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
520
521 uinfo = policy_handle_find(p, r->in.user_handle,
522 SAMR_USER_ACCESS_GET_ATTRIBUTES, NULL,
523 struct samr_user_info, &status);
524 if (!NT_STATUS_IS_OK(status)) {
525 return status;
526 }
527
528 if (!sid_check_is_in_our_sam(&uinfo->sid)) {
529 return NT_STATUS_OBJECT_TYPE_MISMATCH;
530 }
531
532 become_root();
533 ret = lookup_sid(p->mem_ctx, &uinfo->sid, NULL, NULL, &sid_type);
534 unbecome_root();
535 if (ret == false) {
536 return NT_STATUS_NO_SUCH_USER;
537 }
538
539 switch (sid_type) {
540 case SID_NAME_USER:
541 become_root();
542 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
543 &min_password_length);
544 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
545 &password_properties);
546 unbecome_root();
547
548 if (lp_check_password_script(talloc_tos())
549 && *lp_check_password_script(talloc_tos())) {
550 password_properties |= DOMAIN_PASSWORD_COMPLEX;
551 }
552
553 break;
554 default:
555 break;
556 }
557
558 r->out.info->min_password_length = min_password_length;
559 r->out.info->password_properties = password_properties;
560
561 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
562
563 return NT_STATUS_OK;
564 }
565
566 /*******************************************************************
567 _samr_SetSecurity
568 ********************************************************************/
569
570 NTSTATUS _samr_SetSecurity(struct pipes_struct *p,
571 struct samr_SetSecurity *r)
572 {
573 struct samr_user_info *uinfo;
574 uint32 i;
575 struct security_acl *dacl;
576 bool ret;
577 struct samu *sampass=NULL;
578 NTSTATUS status;
579
580 uinfo = policy_handle_find(p, r->in.handle,
581 SAMR_USER_ACCESS_SET_ATTRIBUTES, NULL,
582 struct samr_user_info, &status);
583 if (!NT_STATUS_IS_OK(status)) {
584 return status;
585 }
586
587 if (!(sampass = samu_new( p->mem_ctx))) {
588 DEBUG(0,("No memory!\n"));
589 return NT_STATUS_NO_MEMORY;
590 }
591
592 /* get the user record */
593 become_root();
594 ret = pdb_getsampwsid(sampass, &uinfo->sid);
595 unbecome_root();
596
597 if (!ret) {
598 DEBUG(4, ("User %s not found\n",
599 sid_string_dbg(&uinfo->sid)));
600 TALLOC_FREE(sampass);
601 return NT_STATUS_INVALID_HANDLE;
602 }
603
604 dacl = r->in.sdbuf->sd->dacl;
605 for (i=0; i < dacl->num_aces; i++) {
606 if (dom_sid_equal(&uinfo->sid, &dacl->aces[i].trustee)) {
607 ret = pdb_set_pass_can_change(sampass,
608 (dacl->aces[i].access_mask &
609 SAMR_USER_ACCESS_CHANGE_PASSWORD) ?
610 True: False);
611 break;
612 }
613 }
614
615 if (!ret) {
616 TALLOC_FREE(sampass);
617 return NT_STATUS_ACCESS_DENIED;
618 }
619
620 become_root();
621 status = pdb_update_sam_account(sampass);
622 unbecome_root();
623
624 TALLOC_FREE(sampass);
625
626 return status;
627 }
628
629 /*******************************************************************
630 build correct perms based on policies and password times for _samr_query_sec_obj
631 *******************************************************************/
632 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, struct dom_sid *user_sid)
633 {
634 struct samu *sampass=NULL;
635 bool ret;
636
637 if ( !(sampass = samu_new( mem_ctx )) ) {
638 DEBUG(0,("No memory!\n"));
639 return False;
640 }
641
642 become_root();
643 ret = pdb_getsampwsid(sampass, user_sid);
644 unbecome_root();
645
646 if (ret == False) {
647 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
648 TALLOC_FREE(sampass);
649 return False;
650 }
651
652 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
653
654 if (pdb_get_pass_can_change(sampass)) {
655 TALLOC_FREE(sampass);
656 return True;
657 }
658 TALLOC_FREE(sampass);
659 return False;
660 }
661
662
663 /*******************************************************************
664 _samr_QuerySecurity
665 ********************************************************************/
666
667 NTSTATUS _samr_QuerySecurity(struct pipes_struct *p,
668 struct samr_QuerySecurity *r)
669 {
670 struct samr_domain_info *dinfo;
671 struct samr_user_info *uinfo;
672 struct samr_group_info *ginfo;
673 struct samr_alias_info *ainfo;
674 NTSTATUS status;
675 struct security_descriptor * psd = NULL;
676 size_t sd_size = 0;
677
678 (void)policy_handle_find(p, r->in.handle,
679 SEC_STD_READ_CONTROL, NULL,
680 struct samr_connect_info, &status);
681 if (NT_STATUS_IS_OK(status)) {
682 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
683 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size,
684 &sam_generic_mapping, NULL, 0);
685 goto done;
686 }
687
688 dinfo = policy_handle_find(p, r->in.handle,
689 SEC_STD_READ_CONTROL, NULL,
690 struct samr_domain_info, &status);
691 if (NT_STATUS_IS_OK(status)) {
692 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
693 "with SID: %s\n", sid_string_dbg(&dinfo->sid)));
694 /*
695 * TODO: Builtin probably needs a different SD with restricted
696 * write access
697 */
698 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size,
699 &dom_generic_mapping, NULL, 0);
700 goto done;
701 }
702
703 uinfo = policy_handle_find(p, r->in.handle,
704 SEC_STD_READ_CONTROL, NULL,
705 struct samr_user_info, &status);
706 if (NT_STATUS_IS_OK(status)) {
707 DEBUG(10,("_samr_QuerySecurity: querying security on user "
708 "Object with SID: %s\n",
709 sid_string_dbg(&uinfo->sid)));
710 if (check_change_pw_access(p->mem_ctx, &uinfo->sid)) {
711 status = make_samr_object_sd(
712 p->mem_ctx, &psd, &sd_size,
713 &usr_generic_mapping,
714 &uinfo->sid, SAMR_USR_RIGHTS_WRITE_PW);
715 } else {
716 status = make_samr_object_sd(
717 p->mem_ctx, &psd, &sd_size,
718 &usr_nopwchange_generic_mapping,
719 &uinfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
720 }
721 goto done;
722 }
723
724 ginfo = policy_handle_find(p, r->in.handle,
725 SEC_STD_READ_CONTROL, NULL,
726 struct samr_group_info, &status);
727 if (NT_STATUS_IS_OK(status)) {
728 /*
729 * TODO: different SDs have to be generated for aliases groups
730 * and users. Currently all three get a default user SD
731 */
732 DEBUG(10,("_samr_QuerySecurity: querying security on group "
733 "Object with SID: %s\n",
734 sid_string_dbg(&ginfo->sid)));
735 status = make_samr_object_sd(
736 p->mem_ctx, &psd, &sd_size,
737 &usr_nopwchange_generic_mapping,
738 &ginfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
739 goto done;
740 }
741
742 ainfo = policy_handle_find(p, r->in.handle,
743 SEC_STD_READ_CONTROL, NULL,
744 struct samr_alias_info, &status);
745 if (NT_STATUS_IS_OK(status)) {
746 /*
747 * TODO: different SDs have to be generated for aliases groups
748 * and users. Currently all three get a default user SD
749 */
750 DEBUG(10,("_samr_QuerySecurity: querying security on alias "
751 "Object with SID: %s\n",
752 sid_string_dbg(&ainfo->sid)));
753 status = make_samr_object_sd(
754 p->mem_ctx, &psd, &sd_size,
755 &usr_nopwchange_generic_mapping,
756 &ainfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
757 goto done;
758 }
759
760 return NT_STATUS_OBJECT_TYPE_MISMATCH;
761 done:
762 if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
763 return NT_STATUS_NO_MEMORY;
764
765 return status;
766 }
767
768 /*******************************************************************
769 makes a SAM_ENTRY / UNISTR2* structure from a user list.
770 ********************************************************************/
771
772 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
773 struct samr_SamEntry **sam_pp,
774 uint32_t num_entries,
775 uint32_t start_idx,
776 struct samr_displayentry *entries)
777 {
778 uint32_t i;
779 struct samr_SamEntry *sam;
780
781 *sam_pp = NULL;
782
783 if (num_entries == 0) {
784 return NT_STATUS_OK;
785 }
786
787 sam = talloc_zero_array(ctx, struct samr_SamEntry, num_entries);
788 if (sam == NULL) {
789 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
790 return NT_STATUS_NO_MEMORY;
791 }
792
793 for (i = 0; i < num_entries; i++) {
794 #if 0
795 /*
796 * usrmgr expects a non-NULL terminated string with
797 * trust relationships
798 */
799 if (entries[i].acct_flags & ACB_DOMTRUST) {
800 init_unistr2(&uni_temp_name, entries[i].account_name,
801 UNI_FLAGS_NONE);
802 } else {
803 init_unistr2(&uni_temp_name, entries[i].account_name,
804 UNI_STR_TERMINATE);
805 }
806 #endif
807 init_lsa_String(&sam[i].name, entries[i].account_name);
808 sam[i].idx = entries[i].rid;
809 }
810
811 *sam_pp = sam;
812
813 return NT_STATUS_OK;
814 }
815
816 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
817
818 /*******************************************************************
819 _samr_EnumDomainUsers
820 ********************************************************************/
821
822 NTSTATUS _samr_EnumDomainUsers(struct pipes_struct *p,
823 struct samr_EnumDomainUsers *r)
824 {
825 NTSTATUS status;
826 struct samr_domain_info *dinfo;
827 int num_account;
828 uint32 enum_context = *r->in.resume_handle;
829 enum remote_arch_types ra_type = get_remote_arch();
830 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
831 uint32 max_entries = max_sam_entries;
832 struct samr_displayentry *entries = NULL;
833 struct samr_SamArray *samr_array = NULL;
834 struct samr_SamEntry *samr_entries = NULL;
835
836 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
837
838 dinfo = policy_handle_find(p, r->in.domain_handle,
839 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
840 struct samr_domain_info, &status);
841 if (!NT_STATUS_IS_OK(status)) {
842 return status;
843 }
844
845 samr_array = talloc_zero(p->mem_ctx, struct samr_SamArray);
846 if (!samr_array) {
847 return NT_STATUS_NO_MEMORY;
848 }
849 *r->out.sam = samr_array;
850
851 if (sid_check_is_builtin(&dinfo->sid)) {
852 /* No users in builtin. */
853 *r->out.resume_handle = *r->in.resume_handle;
854 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
855 return status;
856 }
857
858 become_root();
859
860 /* AS ROOT !!!! */
861
862 if ((dinfo->disp_info->enum_users != NULL) &&
863 (dinfo->disp_info->enum_acb_mask != r->in.acct_flags)) {
864 TALLOC_FREE(dinfo->disp_info->enum_users);
865 }
866
867 if (dinfo->disp_info->enum_users == NULL) {
868 dinfo->disp_info->enum_users = pdb_search_users(
869 dinfo->disp_info, r->in.acct_flags);
870 dinfo->disp_info->enum_acb_mask = r->in.acct_flags;
871 }
872
873 if (dinfo->disp_info->enum_users == NULL) {
874 /* END AS ROOT !!!! */
875 unbecome_root();
876 return NT_STATUS_ACCESS_DENIED;
877 }
878
879 num_account = pdb_search_entries(dinfo->disp_info->enum_users,
880 enum_context, max_entries,
881 &entries);
882
883 /* END AS ROOT !!!! */
884
885 unbecome_root();
886
887 if (num_account == 0) {
888 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
889 "total entries\n"));
890 *r->out.resume_handle = *r->in.resume_handle;
891 return NT_STATUS_OK;
892 }
893
894 status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
895 num_account, enum_context,
896 entries);
897 if (!NT_STATUS_IS_OK(status)) {
898 return status;
899 }
900
901 if (max_entries <= num_account) {
902 status = STATUS_MORE_ENTRIES;
903 } else {
904 status = NT_STATUS_OK;
905 }
906
907 /* Ensure we cache this enumeration. */
908 set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
909
910 DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
911
912 samr_array->count = num_account;
913 samr_array->entries = samr_entries;
914
915 *r->out.resume_handle = *r->in.resume_handle + num_account;
916 *r->out.num_entries = num_account;
917
918 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
919
920 return status;
921 }
922
923 /*******************************************************************
924 makes a SAM_ENTRY / UNISTR2* structure from a group list.
925 ********************************************************************/
926
927 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
928 struct samr_SamEntry **sam_pp,
929 uint32_t num_sam_entries,
930 struct samr_displayentry *entries)
931 {
932 struct samr_SamEntry *sam;
933 uint32_t i;
934
935 *sam_pp = NULL;
936
937 if (num_sam_entries == 0) {
938 return;
939 }
940
941 sam = talloc_zero_array(ctx, struct samr_SamEntry, num_sam_entries);
942 if (sam == NULL) {
943 return;
944 }
945
946 for (i = 0; i < num_sam_entries; i++) {
947 /*
948 * JRA. I think this should include the null. TNG does not.
949 */
950 init_lsa_String(&sam[i].name, entries[i].account_name);
951 sam[i].idx = entries[i].rid;
952 }
953
954 *sam_pp = sam;
955 }
956
957 /*******************************************************************
958 _samr_EnumDomainGroups
959 ********************************************************************/
960
961 NTSTATUS _samr_EnumDomainGroups(struct pipes_struct *p,
962 struct samr_EnumDomainGroups *r)
963 {
964 NTSTATUS status;
965 struct samr_domain_info *dinfo;
966 struct samr_displayentry *groups;
967 uint32 num_groups;
968 struct samr_SamArray *samr_array = NULL;
969 struct samr_SamEntry *samr_entries = NULL;
970
971 dinfo = policy_handle_find(p, r->in.domain_handle,
972 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
973 struct samr_domain_info, &status);
974 if (!NT_STATUS_IS_OK(status)) {
975 return status;
976 }
977
978 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
979
980 samr_array = talloc_zero(p->mem_ctx, struct samr_SamArray);
981 if (!samr_array) {
982 return NT_STATUS_NO_MEMORY;
983 }
984 *r->out.sam = samr_array;
985
986 if (sid_check_is_builtin(&dinfo->sid)) {
987 /* No groups in builtin. */
988 *r->out.resume_handle = *r->in.resume_handle;
989 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
990 return status;
991 }
992
993 /* the domain group array is being allocated in the function below */
994
995 become_root();
996
997 if (dinfo->disp_info->groups == NULL) {
998 dinfo->disp_info->groups = pdb_search_groups(dinfo->disp_info);
999
1000 if (dinfo->disp_info->groups == NULL) {
1001 unbecome_root();
1002 return NT_STATUS_ACCESS_DENIED;
1003 }
1004 }
1005
1006 num_groups = pdb_search_entries(dinfo->disp_info->groups,
1007 *r->in.resume_handle,
1008 MAX_SAM_ENTRIES, &groups);
1009 unbecome_root();
1010
1011 /* Ensure we cache this enumeration. */
1012 set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1013
1014 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1015 num_groups, groups);
1016
1017 if (MAX_SAM_ENTRIES <= num_groups) {
1018 status = STATUS_MORE_ENTRIES;
1019 } else {
1020 status = NT_STATUS_OK;
1021 }
1022
1023 samr_array->count = num_groups;
1024 samr_array->entries = samr_entries;
1025
1026 *r->out.num_entries = num_groups;
1027 *r->out.resume_handle = num_groups + *r->in.resume_handle;
1028
1029 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1030
1031 return status;
1032 }
1033
1034 /*******************************************************************
1035 _samr_EnumDomainAliases
1036 ********************************************************************/
1037
1038 NTSTATUS _samr_EnumDomainAliases(struct pipes_struct *p,
1039 struct samr_EnumDomainAliases *r)
1040 {
1041 NTSTATUS status;
1042 struct samr_domain_info *dinfo;
1043 struct samr_displayentry *aliases;
1044 uint32 num_aliases = 0;
1045 struct samr_SamArray *samr_array = NULL;
1046 struct samr_SamEntry *samr_entries = NULL;
1047
1048 dinfo = policy_handle_find(p, r->in.domain_handle,
1049 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1050 struct samr_domain_info, &status);
1051 if (!NT_STATUS_IS_OK(status)) {
1052 return status;
1053 }
1054
1055 DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1056 sid_string_dbg(&dinfo->sid)));
1057
1058 samr_array = talloc_zero(p->mem_ctx, struct samr_SamArray);
1059 if (!samr_array) {
1060 return NT_STATUS_NO_MEMORY;
1061 }
1062
1063 become_root();
1064
1065 if (dinfo->disp_info->aliases == NULL) {
1066 dinfo->disp_info->aliases = pdb_search_aliases(
1067 dinfo->disp_info, &dinfo->sid);
1068 if (dinfo->disp_info->aliases == NULL) {
1069 unbecome_root();
1070 return NT_STATUS_ACCESS_DENIED;
1071 }
1072 }
1073
1074 num_aliases = pdb_search_entries(dinfo->disp_info->aliases,
1075 *r->in.resume_handle,
1076 MAX_SAM_ENTRIES, &aliases);
1077 unbecome_root();
1078
1079 /* Ensure we cache this enumeration. */
1080 set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1081
1082 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1083 num_aliases, aliases);
1084
1085 DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1086
1087 if (MAX_SAM_ENTRIES <= num_aliases) {
1088 status = STATUS_MORE_ENTRIES;
1089 } else {
1090 status = NT_STATUS_OK;
1091 }
1092
1093 samr_array->count = num_aliases;
1094 samr_array->entries = samr_entries;
1095
1096 *r->out.sam = samr_array;
1097 *r->out.num_entries = num_aliases;
1098 *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1099
1100 return status;
1101 }
1102
1103 /*******************************************************************
1104 inits a samr_DispInfoGeneral structure.
1105 ********************************************************************/
1106
1107 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1108 struct samr_DispInfoGeneral *r,
1109 uint32_t num_entries,
1110 uint32_t start_idx,
1111 struct samr_displayentry *entries)
1112 {
1113 uint32 i;
1114
1115 DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1116
1117 if (num_entries == 0) {
1118 return NT_STATUS_OK;
1119 }
1120
1121 r->count = num_entries;
1122
1123 r->entries = talloc_zero_array(ctx, struct samr_DispEntryGeneral, num_entries);
1124 if (!r->entries) {
1125 return NT_STATUS_NO_MEMORY;
1126 }
1127
1128 for (i = 0; i < num_entries ; i++) {
1129
1130 init_lsa_String(&r->entries[i].account_name,
1131 entries[i].account_name);
1132
1133 init_lsa_String(&r->entries[i].description,
1134 entries[i].description);
1135
1136 init_lsa_String(&r->entries[i].full_name,
1137 entries[i].fullname);
1138
1139 r->entries[i].rid = entries[i].rid;
1140 r->entries[i].acct_flags = entries[i].acct_flags;
1141 r->entries[i].idx = start_idx+i+1;
1142 }
1143
1144 return NT_STATUS_OK;
1145 }
1146
1147 /*******************************************************************
1148 inits a samr_DispInfoFull structure.
1149 ********************************************************************/
1150
1151 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1152 struct samr_DispInfoFull *r,
1153 uint32_t num_entries,
1154 uint32_t start_idx,
1155 struct samr_displayentry *entries)
1156 {
1157 uint32_t i;
1158
1159 DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1160
1161 if (num_entries == 0) {
1162 return NT_STATUS_OK;
1163 }
1164
1165 r->count = num_entries;
1166
1167 r->entries = talloc_zero_array(ctx, struct samr_DispEntryFull, num_entries);
1168 if (!r->entries) {
1169 return NT_STATUS_NO_MEMORY;
1170 }
1171
1172 for (i = 0; i < num_entries ; i++) {
1173
1174 init_lsa_String(&r->entries[i].account_name,
1175 entries[i].account_name);
1176
1177 init_lsa_String(&r->entries[i].description,
1178 entries[i].description);
1179
1180 r->entries[i].rid = entries[i].rid;
1181 r->entries[i].acct_flags = entries[i].acct_flags;
1182 r->entries[i].idx = start_idx+i+1;
1183 }
1184
1185 return NT_STATUS_OK;
1186 }
1187
1188 /*******************************************************************
1189 inits a samr_DispInfoFullGroups structure.
1190 ********************************************************************/
1191
1192 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1193 struct samr_DispInfoFullGroups *r,
1194 uint32_t num_entries,
1195 uint32_t start_idx,
1196 struct samr_displayentry *entries)
1197 {
1198 uint32_t i;
1199
1200 DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1201
1202 if (num_entries == 0) {
1203 return NT_STATUS_OK;
1204 }
1205
1206 r->count = num_entries;
1207
1208 r->entries = talloc_zero_array(ctx, struct samr_DispEntryFullGroup, num_entries);
1209 if (!r->entries) {
1210 return NT_STATUS_NO_MEMORY;
1211 }
1212
1213 for (i = 0; i < num_entries ; i++) {
1214
1215 init_lsa_String(&r->entries[i].account_name,
1216 entries[i].account_name);
1217
1218 init_lsa_String(&r->entries[i].description,
1219 entries[i].description);
1220
1221 r->entries[i].rid = entries[i].rid;
1222 r->entries[i].acct_flags = entries[i].acct_flags;
1223 r->entries[i].idx = start_idx+i+1;
1224 }
1225
1226 return NT_STATUS_OK;
1227 }
1228
1229 /*******************************************************************
1230 inits a samr_DispInfoAscii structure.
1231 ********************************************************************/
1232
1233 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1234 struct samr_DispInfoAscii *r,
1235 uint32_t num_entries,
1236 uint32_t start_idx,
1237 struct samr_displayentry *entries)
1238 {
1239 uint32_t i;
1240
1241 DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1242
1243 if (num_entries == 0) {
1244 return NT_STATUS_OK;
1245 }
1246
1247 r->count = num_entries;
1248
1249 r->entries = talloc_zero_array(ctx, struct samr_DispEntryAscii, num_entries);
1250 if (!r->entries) {
1251 return NT_STATUS_NO_MEMORY;
1252 }
1253
1254 for (i = 0; i < num_entries ; i++) {
1255
1256 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1257 entries[i].account_name);
1258
1259 r->entries[i].idx = start_idx+i+1;
1260 }
1261
1262 return NT_STATUS_OK;
1263 }
1264
1265 /*******************************************************************
1266 inits a samr_DispInfoAscii structure.
1267 ********************************************************************/
1268
1269 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1270 struct samr_DispInfoAscii *r,
1271 uint32_t num_entries,
1272 uint32_t start_idx,
1273 struct samr_displayentry *entries)
1274 {
1275 uint32_t i;
1276
1277 DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1278
1279 if (num_entries == 0) {
1280 return NT_STATUS_OK;
1281 }
1282
1283 r->count = num_entries;
1284
1285 r->entries = talloc_zero_array(ctx, struct samr_DispEntryAscii, num_entries);
1286 if (!r->entries) {
1287 return NT_STATUS_NO_MEMORY;
1288 }
1289
1290 for (i = 0; i < num_entries ; i++) {
1291
1292 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1293 entries[i].account_name);
1294
1295 r->entries[i].idx = start_idx+i+1;
1296 }
1297
1298 return NT_STATUS_OK;
1299 }
1300
1301 /*******************************************************************
1302 _samr_QueryDisplayInfo
1303 ********************************************************************/
1304
1305 NTSTATUS _samr_QueryDisplayInfo(struct pipes_struct *p,
1306 struct samr_QueryDisplayInfo *r)
1307 {
1308 NTSTATUS status;
1309 struct samr_domain_info *dinfo;
1310 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1311
1312 uint32 max_entries = r->in.max_entries;
1313
1314 union samr_DispInfo *disp_info = r->out.info;
1315
1316 uint32 temp_size=0;
1317 NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1318 uint32 num_account = 0;
1319 enum remote_arch_types ra_type = get_remote_arch();
1320 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1321 struct samr_displayentry *entries = NULL;
1322
1323 DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1324
1325 dinfo = policy_handle_find(p, r->in.domain_handle,
1326 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1327 struct samr_domain_info, &status);
1328 if (!NT_STATUS_IS_OK(status)) {
1329 return status;
1330 }
1331
1332 if (sid_check_is_builtin(&dinfo->sid)) {
1333 DEBUG(5,("_samr_QueryDisplayInfo: no users in BUILTIN\n"));
1334 return NT_STATUS_OK;
1335 }
1336
1337 /*
1338 * calculate how many entries we will return.
1339 * based on
1340 * - the number of entries the client asked
1341 * - our limit on that
1342 * - the starting point (enumeration context)
1343 * - the buffer size the client will accept
1344 */
1345
1346 /*
1347 * We are a lot more like W2K. Instead of reading the SAM
1348 * each time to find the records we need to send back,
1349 * we read it once and link that copy to the sam handle.
1350 * For large user list (over the MAX_SAM_ENTRIES)
1351 * it's a definitive win.
1352 * second point to notice: between enumerations
1353 * our sam is now the same as it's a snapshoot.
1354 * third point: got rid of the static SAM_USER_21 struct
1355 * no more intermediate.
1356 * con: it uses much more memory, as a full copy is stored
1357 * in memory.
1358 *
1359 * If you want to change it, think twice and think
1360 * of the second point , that's really important.
1361 *
1362 * JFM, 12/20/2001
1363 */
1364
1365 if ((r->in.level < 1) || (r->in.level > 5)) {
1366 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1367 (unsigned int)r->in.level ));
1368 return NT_STATUS_INVALID_INFO_CLASS;
1369 }
1370
1371 /* first limit the number of entries we will return */
1372 if (r->in.max_entries > max_sam_entries) {
1373 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1374 "entries, limiting to %d\n", r->in.max_entries,
1375 max_sam_entries));
1376 max_entries = max_sam_entries;
1377 }
1378
1379 /* calculate the size and limit on the number of entries we will
1380 * return */
1381
1382 temp_size=max_entries*struct_size;
1383
1384 if (temp_size > r->in.buf_size) {
1385 max_entries = MIN((r->in.buf_size / struct_size),max_entries);
1386 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1387 "only %d entries\n", max_entries));
1388 }
1389
1390 become_root();
1391
1392 /* THe following done as ROOT. Don't return without unbecome_root(). */
1393
1394 switch (r->in.level) {
1395 case 1:
1396 case 4:
1397 if (dinfo->disp_info->users == NULL) {
1398 dinfo->disp_info->users = pdb_search_users(
1399 dinfo->disp_info, ACB_NORMAL);
1400 if (dinfo->disp_info->users == NULL) {
1401 unbecome_root();
1402 return NT_STATUS_ACCESS_DENIED;
1403 }
1404 DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1405 (unsigned int)r->in.start_idx));
1406 } else {
1407 DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1408 (unsigned int)r->in.start_idx));
1409 }
1410
1411 num_account = pdb_search_entries(dinfo->disp_info->users,
1412 r->in.start_idx, max_entries,
1413 &entries);
1414 break;
1415 case 2:
1416 if (dinfo->disp_info->machines == NULL) {
1417 dinfo->disp_info->machines = pdb_search_users(
1418 dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
1419 if (dinfo->disp_info->machines == NULL) {
1420 unbecome_root();
1421 return NT_STATUS_ACCESS_DENIED;
1422 }
1423 DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1424 (unsigned int)r->in.start_idx));
1425 } else {
1426 DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1427 (unsigned int)r->in.start_idx));
1428 }
1429
1430 num_account = pdb_search_entries(dinfo->disp_info->machines,
1431 r->in.start_idx, max_entries,
1432 &entries);
1433 break;
1434 case 3:
1435 case 5:
1436 if (dinfo->disp_info->groups == NULL) {
1437 dinfo->disp_info->groups = pdb_search_groups(
1438 dinfo->disp_info);
1439 if (dinfo->disp_info->groups == NULL) {
1440 unbecome_root();
1441 return NT_STATUS_ACCESS_DENIED;
1442 }
1443 DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1444 (unsigned int)r->in.start_idx));
1445 } else {
1446 DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1447 (unsigned int)r->in.start_idx));
1448 }
1449
1450 num_account = pdb_search_entries(dinfo->disp_info->groups,
1451 r->in.start_idx, max_entries,
1452 &entries);
1453 break;
1454 default:
1455 unbecome_root();
1456 smb_panic("info class changed");
1457 break;
1458 }
1459 unbecome_root();
1460
1461
1462 /* Now create reply structure */
1463 switch (r->in.level) {
1464 case 1:
1465 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1466 num_account, r->in.start_idx,
1467 entries);
1468 break;
1469 case 2:
1470 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1471 num_account, r->in.start_idx,
1472 entries);
1473 break;
1474 case 3:
1475 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1476 num_account, r->in.start_idx,
1477 entries);
1478 break;
1479 case 4:
1480 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1481 num_account, r->in.start_idx,
1482 entries);
1483 break;
1484 case 5:
1485 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1486 num_account, r->in.start_idx,
1487 entries);
1488 break;
1489 default:
1490 smb_panic("info class changed");
1491 break;
1492 }
1493
1494 if (!NT_STATUS_IS_OK(disp_ret))
1495 return disp_ret;
1496
1497 if (max_entries <= num_account) {
1498 status = STATUS_MORE_ENTRIES;
1499 } else {
1500 status = NT_STATUS_OK;
1501 }
1502
1503 /* Ensure we cache this enumeration. */
1504 set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1505
1506 DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1507
1508 *r->out.total_size = num_account * struct_size;
1509 *r->out.returned_size = num_account ? temp_size : 0;
1510
1511 return status;
1512 }
1513
1514 /****************************************************************
1515 _samr_QueryDisplayInfo2
1516 ****************************************************************/
1517
1518 NTSTATUS _samr_QueryDisplayInfo2(struct pipes_struct *p,
1519 struct samr_QueryDisplayInfo2 *r)
1520 {
1521 struct samr_QueryDisplayInfo q;
1522
1523 q.in.domain_handle = r->in.domain_handle;
1524 q.in.level = r->in.level;
1525 q.in.start_idx = r->in.start_idx;
1526 q.in.max_entries = r->in.max_entries;
1527 q.in.buf_size = r->in.buf_size;
1528
1529 q.out.total_size = r->out.total_size;
1530 q.out.returned_size = r->out.returned_size;
1531 q.out.info = r->out.info;
1532
1533 return _samr_QueryDisplayInfo(p, &q);
1534 }
1535
1536 /****************************************************************
1537 _samr_QueryDisplayInfo3
1538 ****************************************************************/
1539
1540 NTSTATUS _samr_QueryDisplayInfo3(struct pipes_struct *p,
1541 struct samr_QueryDisplayInfo3 *r)
1542 {
1543 struct samr_QueryDisplayInfo q;
1544
1545 q.in.domain_handle = r->in.domain_handle;
1546 q.in.level = r->in.level;
1547 q.in.start_idx = r->in.start_idx;
1548 q.in.max_entries = r->in.max_entries;
1549 q.in.buf_size = r->in.buf_size;
1550
1551 q.out.total_size = r->out.total_size;
1552 q.out.returned_size = r->out.returned_size;
1553 q.out.info = r->out.info;
1554
1555 return _samr_QueryDisplayInfo(p, &q);
1556 }
1557
1558 /*******************************************************************
1559 _samr_QueryAliasInfo
1560 ********************************************************************/
1561
1562 NTSTATUS _samr_QueryAliasInfo(struct pipes_struct *p,
1563 struct samr_QueryAliasInfo *r)
1564 {
1565 struct samr_alias_info *ainfo;
1566 struct acct_info *info;
1567 NTSTATUS status;
1568 union samr_AliasInfo *alias_info = NULL;
1569 const char *alias_name = NULL;
1570 const char *alias_description = NULL;
1571
1572 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1573
1574 ainfo = policy_handle_find(p, r->in.alias_handle,
1575 SAMR_ALIAS_ACCESS_LOOKUP_INFO, NULL,
1576 struct samr_alias_info, &status);
1577 if (!NT_STATUS_IS_OK(status)) {
1578 return status;
1579 }
1580
1581 alias_info = talloc_zero(p->mem_ctx, union samr_AliasInfo);
1582 if (!alias_info) {
1583 return NT_STATUS_NO_MEMORY;
1584 }
1585
1586 info = talloc_zero(p->mem_ctx, struct acct_info);
1587 if (!info) {
1588 return NT_STATUS_NO_MEMORY;
1589 }
1590
1591 become_root();
1592 status = pdb_get_aliasinfo(&ainfo->sid, info);
1593 unbecome_root();
1594
1595 if (!NT_STATUS_IS_OK(status)) {
1596 TALLOC_FREE(info);
1597 return status;
1598 }
1599
1600 alias_name = talloc_steal(r, info->acct_name);
1601 alias_description = talloc_steal(r, info->acct_desc);
1602 TALLOC_FREE(info);
1603
1604 switch (r->in.level) {
1605 case ALIASINFOALL:
1606 alias_info->all.name.string = alias_name;
1607 alias_info->all.num_members = 1; /* ??? */
1608 alias_info->all.description.string = alias_description;
1609 break;
1610 case ALIASINFONAME:
1611 alias_info->name.string = alias_name;
1612 break;
1613 case ALIASINFODESCRIPTION:
1614 alias_info->description.string = alias_description;
1615 break;
1616 default:
1617 return NT_STATUS_INVALID_INFO_CLASS;
1618 }
1619
1620 *r->out.info = alias_info;
1621
1622 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1623
1624 return NT_STATUS_OK;
1625 }
1626
1627 /*******************************************************************
1628 _samr_LookupNames
1629 ********************************************************************/
1630
1631 NTSTATUS _samr_LookupNames(struct pipes_struct *p,
1632 struct samr_LookupNames *r)
1633 {
1634 struct samr_domain_info *dinfo;
1635 NTSTATUS status;
1636 uint32 *rid;
1637 enum lsa_SidType *type;
1638 int i;
1639 int num_rids = r->in.num_names;
1640 struct samr_Ids rids, types;
1641 uint32_t num_mapped = 0;
1642
1643 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1644
1645 dinfo = policy_handle_find(p, r->in.domain_handle,
1646 0 /* Don't know the acc_bits yet */, NULL,
1647 struct samr_domain_info, &status);
1648 if (!NT_STATUS_IS_OK(status)) {
1649 return status;
1650 }
1651
1652 if (num_rids > MAX_SAM_ENTRIES) {
1653 num_rids = MAX_SAM_ENTRIES;
1654 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1655 }
1656
1657 rid = talloc_array(p->mem_ctx, uint32, num_rids);
1658 NT_STATUS_HAVE_NO_MEMORY(rid);
1659
1660 type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1661 NT_STATUS_HAVE_NO_MEMORY(type);
1662
1663 DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1664 sid_string_dbg(&dinfo->sid)));
1665
1666 for (i = 0; i < num_rids; i++) {
1667
1668 status = NT_STATUS_NONE_MAPPED;
1669 type[i] = SID_NAME_UNKNOWN;
1670
1671 rid[i] = 0xffffffff;
1672
1673 if (sid_check_is_builtin(&dinfo->sid)) {
1674 if (lookup_builtin_name(r->in.names[i].string,
1675 &rid[i]))
1676 {
1677 type[i] = SID_NAME_ALIAS;
1678 }
1679 } else {
1680 lookup_global_sam_name(r->in.names[i].string, 0,
1681 &rid[i], &type[i]);
1682 }
1683
1684 if (type[i] != SID_NAME_UNKNOWN) {
1685 num_mapped++;
1686 }
1687 }
1688
1689 if (num_mapped == num_rids) {
1690 status = NT_STATUS_OK;
1691 } else if (num_mapped == 0) {
1692 status = NT_STATUS_NONE_MAPPED;
1693 } else {
1694 status = STATUS_SOME_UNMAPPED;
1695 }
1696
1697 rids.count = num_rids;
1698 rids.ids = rid;
1699
1700 types.count = num_rids;
1701 types.ids = talloc_array(p->mem_ctx, uint32_t, num_rids);
1702 NT_STATUS_HAVE_NO_MEMORY(type);
1703 for (i = 0; i < num_rids; i++) {
1704 types.ids[i] = (type[i] & 0xffffffff);
1705 }
1706
1707 *r->out.rids = rids;
1708 *r->out.types = types;
1709
1710 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1711
1712 return status;
1713 }
1714
1715 /****************************************************************
1716 _samr_ChangePasswordUser
1717 ****************************************************************/
1718
1719 NTSTATUS _samr_ChangePasswordUser(struct pipes_struct *p,
1720 struct samr_ChangePasswordUser *r)
1721 {
1722 NTSTATUS status;
1723 bool ret = false;
1724 struct samr_user_info *uinfo;
1725 struct samu *pwd;
1726 struct samr_Password new_lmPwdHash, new_ntPwdHash, checkHash;
1727 struct samr_Password lm_pwd, nt_pwd;
1728
1729 uinfo = policy_handle_find(p, r->in.user_handle,
1730 SAMR_USER_ACCESS_SET_PASSWORD, NULL,
1731 struct samr_user_info, &status);
1732 if (!NT_STATUS_IS_OK(status)) {
1733 return status;
1734 }
1735
1736 DEBUG(5,("_samr_ChangePasswordUser: sid:%s\n",
1737 sid_string_dbg(&uinfo->sid)));
1738
1739 if (!(pwd = samu_new(NULL))) {
1740 return NT_STATUS_NO_MEMORY;
1741 }
1742
1743 become_root();
1744 ret = pdb_getsampwsid(pwd, &uinfo->sid);
1745 unbecome_root();
1746
1747 if (!ret) {
1748 TALLOC_FREE(pwd);
1749 return NT_STATUS_WRONG_PASSWORD;
1750 }
1751
1752 {
1753 const uint8_t *lm_pass, *nt_pass;
1754
1755 lm_pass = pdb_get_lanman_passwd(pwd);
1756 nt_pass = pdb_get_nt_passwd(pwd);
1757
1758 if (!lm_pass || !nt_pass) {
1759 status = NT_STATUS_WRONG_PASSWORD;
1760 goto out;
1761 }
1762
1763 memcpy(&lm_pwd.hash, lm_pass, sizeof(lm_pwd.hash));
1764 memcpy(&nt_pwd.hash, nt_pass, sizeof(nt_pwd.hash));
1765 }
1766
1767 /* basic sanity checking on parameters. Do this before any database ops */
1768 if (!r->in.lm_present || !r->in.nt_present ||
1769 !r->in.old_lm_crypted || !r->in.new_lm_crypted ||
1770 !r->in.old_nt_crypted || !r->in.new_nt_crypted) {
1771 /* we should really handle a change with lm not
1772 present */
1773 status = NT_STATUS_INVALID_PARAMETER_MIX;
1774 goto out;
1775 }
1776
1777 /* decrypt and check the new lm hash */
1778 D_P16(lm_pwd.hash, r->in.new_lm_crypted->hash, new_lmPwdHash.hash);
1779 D_P16(new_lmPwdHash.hash, r->in.old_lm_crypted->hash, checkHash.hash);
1780 if (memcmp(checkHash.hash, lm_pwd.hash, 16) != 0) {
1781 status = NT_STATUS_WRONG_PASSWORD;
1782 goto out;
1783 }
1784
1785 /* decrypt and check the new nt hash */
1786 D_P16(nt_pwd.hash, r->in.new_nt_crypted->hash, new_ntPwdHash.hash);
1787 D_P16(new_ntPwdHash.hash, r->in.old_nt_crypted->hash, checkHash.hash);
1788 if (memcmp(checkHash.hash, nt_pwd.hash, 16) != 0) {
1789 status = NT_STATUS_WRONG_PASSWORD;
1790 goto out;
1791 }
1792
1793 /* The NT Cross is not required by Win2k3 R2, but if present
1794 check the nt cross hash */
1795 if (r->in.cross1_present && r->in.nt_cross) {
1796 D_P16(lm_pwd.hash, r->in.nt_cross->hash, checkHash.hash);
1797 if (memcmp(checkHash.hash, new_ntPwdHash.hash, 16) != 0) {
1798 status = NT_STATUS_WRONG_PASSWORD;
1799 goto out;
1800 }
1801 }
1802
1803 /* The LM Cross is not required by Win2k3 R2, but if present
1804 check the lm cross hash */
1805 if (r->in.cross2_present && r->in.lm_cross) {
1806 D_P16(nt_pwd.hash, r->in.lm_cross->hash, checkHash.hash);
1807 if (memcmp(checkHash.hash, new_lmPwdHash.hash, 16) != 0) {
1808 status = NT_STATUS_WRONG_PASSWORD;
1809 goto out;
1810 }
1811 }
1812
1813 if (!pdb_set_nt_passwd(pwd, new_ntPwdHash.hash, PDB_CHANGED) ||
1814 !pdb_set_lanman_passwd(pwd, new_lmPwdHash.hash, PDB_CHANGED)) {
1815 status = NT_STATUS_ACCESS_DENIED;
1816 goto out;
1817 }
1818
1819 status = pdb_update_sam_account(pwd);
1820 out:
1821 TALLOC_FREE(pwd);
1822
1823 return status;
1824 }
1825
1826 /*******************************************************************
1827 _samr_ChangePasswordUser2
1828 ********************************************************************/
1829
1830 NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p,
1831 struct samr_ChangePasswordUser2 *r)
1832 {
1833 NTSTATUS status;
1834 char *user_name = NULL;
1835 char *rhost;
1836 const char *wks = NULL;
1837
1838 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1839
1840 if (!r->in.account->string) {
1841 return NT_STATUS_INVALID_PARAMETER;
1842 }
1843 if (r->in.server && r->in.server->string) {
1844 wks = r->in.server->string;
1845 }
1846
1847 DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1848
1849 /*
1850 * Pass the user through the NT -> unix user mapping
1851 * function.
1852 */
1853
1854 (void)map_username(talloc_tos(), r->in.account->string, &user_name);
1855 if (!user_name) {
1856 return NT_STATUS_NO_MEMORY;
1857 }
1858
1859 rhost = tsocket_address_inet_addr_string(p->remote_address,
1860 talloc_tos());
1861 if (rhost == NULL) {
1862 return NT_STATUS_NO_MEMORY;
1863 }
1864
1865 /*
1866 * UNIX username case mangling not required, pass_oem_change
1867 * is case insensitive.
1868 */
1869
1870 status = pass_oem_change(user_name,
1871 rhost,
1872 r->in.lm_password->data,
1873 r->in.lm_verifier->hash,
1874 r->in.nt_password->data,
1875 r->in.nt_verifier->hash,
1876 NULL);
1877
1878 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1879
1880 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1881 return NT_STATUS_WRONG_PASSWORD;
1882 }
1883
1884 return status;
1885 }
1886
1887 /****************************************************************
1888 _samr_OemChangePasswordUser2
1889 ****************************************************************/
1890
1891 NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p,
1892 struct samr_OemChangePasswordUser2 *r)
1893 {
1894 NTSTATUS status;
1895 char *user_name = NULL;
1896 const char *wks = NULL;
1897 char *rhost;
1898
1899 DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__));
1900
1901 if (!r->in.account->string) {
1902 return NT_STATUS_INVALID_PARAMETER;
1903 }
1904 if (r->in.server && r->in.server->string) {
1905 wks = r->in.server->string;
1906 }
1907
1908 DEBUG(5,("_samr_OemChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1909
1910 /*
1911 * Pass the user through the NT -> unix user mapping
1912 * function.
1913 */
1914
1915 (void)map_username(talloc_tos(), r->in.account->string, &user_name);
1916 if (!user_name) {
1917 return NT_STATUS_NO_MEMORY;
1918 }
1919
1920 /*
1921 * UNIX username case mangling not required, pass_oem_change
1922 * is case insensitive.
1923 */
1924
1925 if (!r->in.hash || !r->in.password) {
1926 return NT_STATUS_INVALID_PARAMETER;
1927 }
1928
1929 rhost = tsocket_address_inet_addr_string(p->remote_address,
1930 talloc_tos());
1931 if (rhost == NULL) {
1932 return NT_STATUS_NO_MEMORY;
1933 }
1934
1935 status = pass_oem_change(user_name,
1936 rhost,
1937 r->in.password->data,
1938 r->in.hash->hash,
1939 0,
1940 0,
1941 NULL);
1942
1943 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1944 return NT_STATUS_WRONG_PASSWORD;
1945 }
1946
1947 DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__));
1948
1949 return status;
1950 }
1951
1952 /*******************************************************************
1953 _samr_ChangePasswordUser3
1954 ********************************************************************/
1955
1956 NTSTATUS _samr_ChangePasswordUser3(struct pipes_struct *p,
1957 struct samr_ChangePasswordUser3 *r)
1958 {
1959 NTSTATUS status;
1960 char *user_name = NULL;
1961 const char *wks = NULL;
1962 enum samPwdChangeReason reject_reason;
1963 struct samr_DomInfo1 *dominfo = NULL;
1964 struct userPwdChangeFailureInformation *reject = NULL;
1965 uint32_t tmp;
1966 char *rhost;
1967
1968 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
1969
1970 if (!r->in.account->string) {
1971 return NT_STATUS_INVALID_PARAMETER;
1972 }
1973 if (r->in.server && r->in.server->string) {
1974 wks = r->in.server->string;
1975 }
1976
1977 DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
1978
1979 /*
1980 * Pass the user through the NT -> unix user mapping
1981 * function.
1982 */
1983
1984 (void)map_username(talloc_tos(), r->in.account->string, &user_name);
1985 if (!user_name) {
1986 return NT_STATUS_NO_MEMORY;
1987 }
1988
1989 rhost = tsocket_address_inet_addr_string(p->remote_address,
1990 talloc_tos());
1991 if (rhost == NULL) {
1992 return NT_STATUS_NO_MEMORY;
1993 }
1994
1995 /*
1996 * UNIX username case mangling not required, pass_oem_change
1997 * is case insensitive.
1998 */
1999
2000 status = pass_oem_change(user_name,
2001 rhost,
2002 r->in.lm_password->data,
2003 r->in.lm_verifier->hash,
2004 r->in.nt_password->data,
2005 r->in.nt_verifier->hash,
2006 &reject_reason);
2007 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2008 return NT_STATUS_WRONG_PASSWORD;
2009 }
2010
2011 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
2012 NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
2013
2014 time_t u_expire, u_min_age;
2015 uint32 account_policy_temp;
2016
2017 dominfo = talloc_zero(p->mem_ctx, struct samr_DomInfo1);
2018 if (!dominfo) {
2019 return NT_STATUS_NO_MEMORY;
2020 }
2021
2022 reject = talloc_zero(p->mem_ctx,
2023 struct userPwdChangeFailureInformation);
2024 if (!reject) {
2025 return NT_STATUS_NO_MEMORY;
2026 }
2027
2028 become_root();
2029
2030 /* AS ROOT !!! */
2031
2032 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN, &tmp);
2033 dominfo->min_password_length = tmp;
2034
2035 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &tmp);
2036 dominfo->password_history_length = tmp;
2037
2038 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
2039 &dominfo->password_properties);
2040
2041 pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &account_policy_temp);
2042 u_expire = account_policy_temp;
2043
2044 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &account_policy_temp);
2045 u_min_age = account_policy_temp;
2046
2047 /* !AS ROOT */
2048
2049 unbecome_root();
2050
2051 unix_to_nt_time_abs((NTTIME *)&dominfo->max_password_age, u_expire);
2052 unix_to_nt_time_abs((NTTIME *)&dominfo->min_password_age, u_min_age);
2053
2054 if (lp_check_password_script(talloc_tos())
2055 && *lp_check_password_script(talloc_tos())) {
2056 dominfo->password_properties |= DOMAIN_PASSWORD_COMPLEX;
2057 }
2058
2059 reject->extendedFailureReason = reject_reason;
2060
2061 *r->out.dominfo = dominfo;
2062 *r->out.reject = reject;
2063 }
2064
2065 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2066
2067 return status;
2068 }
2069
2070 /*******************************************************************
2071 makes a SAMR_R_LOOKUP_RIDS structure.
2072 ********************************************************************/
2073
2074 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2075 const char **names,
2076 struct lsa_String **lsa_name_array_p)
2077 {
2078 struct lsa_String *lsa_name_array = NULL;
2079 uint32_t i;
2080
2081 *lsa_name_array_p = NULL;
2082
2083 if (num_names != 0) {
2084 lsa_name_array = talloc_zero_array(ctx, struct lsa_String, num_names);
2085 if (!lsa_name_array) {
2086 return false;
2087 }
2088 }
2089
2090 for (i = 0; i < num_names; i++) {
2091 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2092 init_lsa_String(&lsa_name_array[i], names[i]);
2093 }
2094
2095 *lsa_name_array_p = lsa_name_array;
2096
2097 return true;
2098 }
2099
2100 /*******************************************************************
2101 _samr_LookupRids
2102 ********************************************************************/
2103
2104 NTSTATUS _samr_LookupRids(struct pipes_struct *p,
2105 struct samr_LookupRids *r)
2106 {
2107 struct samr_domain_info *dinfo;
2108 NTSTATUS status;
2109 const char **names;
2110 enum lsa_SidType *attrs = NULL;
2111 uint32 *wire_attrs = NULL;
2112 int num_rids = (int)r->in.num_rids;
2113 int i;
2114 struct lsa_Strings names_array;
2115 struct samr_Ids types_array;
2116 struct lsa_String *lsa_names = NULL;
2117
2118 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2119
2120 dinfo = policy_handle_find(p, r->in.domain_handle,
2121 0 /* Don't know the acc_bits yet */, NULL,
2122 struct samr_domain_info, &status);
2123 if (!NT_STATUS_IS_OK(status)) {
2124 return status;
2125 }
2126
2127 if (num_rids > 1000) {
2128 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2129 "to samba4 idl this is not possible\n", num_rids));
2130 return NT_STATUS_UNSUCCESSFUL;
2131 }
2132
2133 if (num_rids) {
2134 names = talloc_zero_array(p->mem_ctx, const char *, num_rids);
2135 attrs = talloc_zero_array(p->mem_ctx, enum lsa_SidType, num_rids);
2136 wire_attrs = talloc_zero_array(p->mem_ctx, uint32, num_rids);
2137
2138 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2139 return NT_STATUS_NO_MEMORY;
2140 } else {
2141 names = NULL;
2142 attrs = NULL;
2143 wire_attrs = NULL;
2144 }
2145
2146 become_root(); /* lookup_sid can require root privs */
2147 status = pdb_lookup_rids(&dinfo->sid, num_rids, r->in.rids,
2148 names, attrs);
2149 unbecome_root();
2150
2151 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2152 status = NT_STATUS_OK;
2153 }
2154
2155 if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2156 &lsa_names)) {
2157 return NT_STATUS_NO_MEMORY;
2158 }
2159
2160 /* Convert from enum lsa_SidType to uint32 for wire format. */
2161 for (i = 0; i < num_rids; i++) {
2162 wire_attrs[i] = (uint32)attrs[i];
2163 }
2164
2165 names_array.count = num_rids;
2166 names_array.names = lsa_names;
2167
2168 types_array.count = num_rids;
2169 types_array.ids = wire_attrs;
2170
2171 *r->out.names = names_array;
2172 *r->out.types = types_array;
2173
2174 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2175
2176 return status;
2177 }
2178
2179 /*******************************************************************
2180 _samr_OpenUser
2181 ********************************************************************/
2182
2183 NTSTATUS _samr_OpenUser(struct pipes_struct *p,
2184 struct samr_OpenUser *r)
2185 {
2186 struct samu *sampass=NULL;
2187 struct dom_sid sid;
2188 struct samr_domain_info *dinfo;
2189 struct samr_user_info *uinfo;
2190 struct security_descriptor *psd = NULL;
2191 uint32 acc_granted;
2192 uint32 des_access = r->in.access_mask;
2193 uint32_t extra_access = 0;
2194 size_t sd_size;
2195 bool ret;
2196 NTSTATUS nt_status;
2197
2198 /* These two privileges, if != SEC_PRIV_INVALID, indicate
2199 * privileges that the user must have to complete this
2200 * operation in defience of the fixed ACL */
2201 enum sec_privilege needed_priv_1, needed_priv_2;
2202 NTSTATUS status;
2203
2204 dinfo = policy_handle_find(p, r->in.domain_handle,
2205 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
2206 struct samr_domain_info, &status);
2207 if (!NT_STATUS_IS_OK(status)) {
2208 return status;
2209 }
2210
2211 if ( !(sampass = samu_new( p->mem_ctx )) ) {
2212 return NT_STATUS_NO_MEMORY;
2213 }
2214
2215 /* append the user's RID to it */
2216
2217 if (!sid_compose(&sid, &dinfo->sid, r->in.rid))
2218 return NT_STATUS_NO_SUCH_USER;
2219
2220 /* check if access can be granted as requested by client. */
2221 map_max_allowed_access(p->session_info->security_token,
2222 p->session_info->unix_token,
2223 &des_access);
2224
2225 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2226 se_map_generic(&des_access, &usr_generic_mapping);
2227
2228 /*
2229 * Get the sampass first as we need to check privileges
2230 * based on what kind of user object this is.
2231 * But don't reveal info too early if it didn't exist.
2232 */
2233
2234 become_root();
2235 ret=pdb_getsampwsid(sampass, &sid);
2236 unbecome_root();
2237
2238 needed_priv_1 = SEC_PRIV_INVALID;
2239 needed_priv_2 = SEC_PRIV_INVALID;
2240 /*
2241 * We do the override access checks on *open*, not at
2242 * SetUserInfo time.
2243 */
2244 if (ret) {
2245 uint32_t acb_info = pdb_get_acct_ctrl(sampass);
2246
2247 if (acb_info & ACB_WSTRUST) {
2248 /*
2249 * SeMachineAccount is needed to add
2250 * GENERIC_RIGHTS_USER_WRITE to a machine
2251 * account.
2252 */
2253 needed_priv_1 = SEC_PRIV_MACHINE_ACCOUNT;
2254 }
2255 if (acb_info & ACB_NORMAL) {
2256 /*
2257 * SeAddUsers is needed to add
2258 * GENERIC_RIGHTS_USER_WRITE to a normal
2259 * account.
2260 */
2261 needed_priv_1 = SEC_PRIV_ADD_USERS;
2262 }
2263 /*
2264 * Cheat - we have not set a specific privilege for
2265 * server (BDC) or domain trust account, so allow
2266 * GENERIC_RIGHTS_USER_WRITE if pipe user is in
2267 * DOMAIN_RID_ADMINS.
2268 */
2269 if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
2270 if (lp_enable_privileges() && nt_token_check_domain_rid(p->session_info->security_token,
2271 DOMAIN_RID_ADMINS)) {
2272 des_access &= ~GENERIC_RIGHTS_USER_WRITE;
2273 extra_access = GENERIC_RIGHTS_USER_WRITE;
2274 DEBUG(4,("_samr_OpenUser: Allowing "
2275 "GENERIC_RIGHTS_USER_WRITE for "
2276 "rid admins\n"));
2277 }
2278 }
2279 }
2280
2281 TALLOC_FREE(sampass);
2282
2283 nt_status = access_check_object(psd, p->session_info->security_token,
2284 needed_priv_1, needed_priv_2,
2285 GENERIC_RIGHTS_USER_WRITE, des_access,
2286 &acc_granted, "_samr_OpenUser");
2287
2288 if ( !NT_STATUS_IS_OK(nt_status) )
2289 return nt_status;
2290
2291 /* check that the SID exists in our domain. */
2292 if (ret == False) {
2293 return NT_STATUS_NO_SUCH_USER;
2294 }
2295
2296 /* If we did the rid admins hack above, allow access. */
2297 acc_granted |= extra_access;
2298
2299 uinfo = policy_handle_create(p, r->out.user_handle, acc_granted,
2300 struct samr_user_info, &nt_status);
2301 if (!NT_STATUS_IS_OK(nt_status)) {
2302 return nt_status;
2303 }
2304 uinfo->sid = sid;
2305
2306 return NT_STATUS_OK;
2307 }
2308
2309 /*************************************************************************
2310 *************************************************************************/
2311
2312 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2313 DATA_BLOB *blob,
2314 struct lsa_BinaryString **_r)
2315 {
2316 struct lsa_BinaryString *r;
2317
2318 if (!blob || !_r) {
2319 return NT_STATUS_INVALID_PARAMETER;
2320 }
2321
2322 r = talloc_zero(mem_ctx, struct lsa_BinaryString);
2323 if (!r) {
2324 return NT_STATUS_NO_MEMORY;
2325 }
2326
2327 r->array = talloc_zero_array(mem_ctx, uint16_t, blob->length/2);
2328 if (!r->array) {
2329 return NT_STATUS_NO_MEMORY;
2330 }
2331 memcpy(r->array, blob->data, blob->length);
2332 r->size = blob->length;
2333 r->length = blob->length;
2334
2335 if (!r->array) {
2336 return NT_STATUS_NO_MEMORY;
2337 }
2338
2339 *_r = r;
2340
2341 return NT_STATUS_OK;
2342 }
2343
2344 /*************************************************************************
2345 *************************************************************************/
2346
2347 static struct samr_LogonHours get_logon_hours_from_pdb(TALLOC_CTX *mem_ctx,
2348 struct samu *pw)
2349 {
2350 struct samr_LogonHours hours;
2351 const int units_per_week = 168;
2352
2353 ZERO_STRUCT(hours);
2354 hours.bits = talloc_array(mem_ctx, uint8_t, units_per_week);
2355 if (!hours.bits) {
2356 return hours;
2357 }
2358
2359 hours.units_per_week = units_per_week;
2360 memset(hours.bits, 0xFF, units_per_week);
2361
2362 if (pdb_get_hours(pw)) {
2363 memcpy(hours.bits, pdb_get_hours(pw),
2364 MIN(pdb_get_hours_len(pw), units_per_week));
2365 }
2366
2367 return hours;
2368 }
2369
2370 /*************************************************************************
2371 get_user_info_1.
2372 *************************************************************************/
2373
2374 static NTSTATUS get_user_info_1(TALLOC_CTX *mem_ctx,
2375 struct samr_UserInfo1 *r,
2376 struct samu *pw,
2377 struct dom_sid *domain_sid)
2378 {
2379 const struct dom_sid *sid_group;
2380 uint32_t primary_gid;
2381
2382 become_root();
2383 sid_group = pdb_get_group_sid(pw);
2384 unbecome_root();
2385
2386 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2387 DEBUG(0, ("get_user_info_1: User %s has Primary Group SID %s, \n"
2388 "which conflicts with the domain sid %s. Failing operation.\n",
2389 pdb_get_username(pw), sid_string_dbg(sid_group),
2390 sid_string_dbg(domain_sid)));
2391 return NT_STATUS_UNSUCCESSFUL;
2392 }
2393
2394 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(pw));
2395 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2396 r->primary_gid = primary_gid;
2397 r->description.string = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2398 r->comment.string = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2399
2400 return NT_STATUS_OK;
2401 }
2402
2403 /*************************************************************************
2404 get_user_info_2.
2405 *************************************************************************/
2406
2407 static NTSTATUS get_user_info_2(TALLOC_CTX *mem_ctx,
2408 struct samr_UserInfo2 *r,
2409 struct samu *pw)
2410 {
2411 r->comment.string = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2412 r->reserved.string = NULL;
2413 r->country_code = pdb_get_country_code(pw);
2414 r->code_page = pdb_get_code_page(pw);
2415
2416 return NT_STATUS_OK;
2417 }
2418
2419 /*************************************************************************
2420 get_user_info_3.
2421 *************************************************************************/
2422
2423 static NTSTATUS get_user_info_3(TALLOC_CTX *mem_ctx,
2424 struct samr_UserInfo3 *r,
2425 struct samu *pw,
2426 struct dom_sid *domain_sid)
2427 {
2428 const struct dom_sid *sid_user, *sid_group;
2429 uint32_t rid, primary_gid;
2430
2431 sid_user = pdb_get_user_sid(pw);
2432
2433 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2434 DEBUG(0, ("get_user_info_3: User %s has SID %s, \nwhich conflicts with "
2435 "the domain sid %s. Failing operation.\n",
2436 pdb_get_username(pw), sid_string_dbg(sid_user),
2437 sid_string_dbg(domain_sid)));
2438 return NT_STATUS_UNSUCCESSFUL;
2439 }
2440
2441 become_root();
2442 sid_group = pdb_get_group_sid(pw);
2443 unbecome_root();
2444
2445 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2446 DEBUG(0, ("get_user_info_3: User %s has Primary Group SID %s, \n"
2447 "which conflicts with the domain sid %s. Failing operation.\n",
2448 pdb_get_username(pw), sid_string_dbg(sid_group),
2449 sid_string_dbg(domain_sid)));
2450 return NT_STATUS_UNSUCCESSFUL;
2451 }
2452
2453 unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2454 unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2455 unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2456 unix_to_nt_time(&r->allow_password_change, pdb_get_pass_can_change_time(pw));
2457 unix_to_nt_time(&r->force_password_change, pdb_get_pass_must_change_time(pw));
2458
2459 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(pw));
2460 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2461 r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2462 r->home_drive.string = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2463 r->logon_script.string = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2464 r->profile_path.string = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2465 r->workstations.string = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2466
2467 r->logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2468 r->rid = rid;
2469 r->primary_gid = primary_gid;
2470 r->acct_flags = pdb_get_acct_ctrl(pw);
2471 r->bad_password_count = pdb_get_bad_password_count(pw);
2472 r->logon_count = pdb_get_logon_count(pw);
2473
2474 return NT_STATUS_OK;
2475 }
2476
2477 /*************************************************************************
2478 get_user_info_4.
2479 *************************************************************************/
2480
2481 static NTSTATUS get_user_info_4(TALLOC_CTX *mem_ctx,
2482 struct samr_UserInfo4 *r,
2483 struct samu *pw)
2484 {
2485 r->logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2486
2487 return NT_STATUS_OK;
2488 }
2489
2490 /*************************************************************************
2491 get_user_info_5.
2492 *************************************************************************/
2493
2494 static NTSTATUS get_user_info_5(TALLOC_CTX *mem_ctx,
2495 struct samr_UserInfo5 *r,
2496 struct samu *pw,
2497 struct dom_sid *domain_sid)
2498 {
2499 const struct dom_sid *sid_user, *sid_group;
2500 uint32_t rid, primary_gid;
2501
2502 sid_user = pdb_get_user_sid(pw);
2503
2504 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2505 DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
2506 "the domain sid %s. Failing operation.\n",
2507 pdb_get_username(pw), sid_string_dbg(sid_user),
2508 sid_string_dbg(domain_sid)));
2509 return NT_STATUS_UNSUCCESSFUL;
2510 }
2511
2512 become_root();
2513 sid_group = pdb_get_group_sid(pw);
2514 unbecome_root();
2515
2516 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2517 DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
2518 "which conflicts with the domain sid %s. Failing operation.\n",
2519 pdb_get_username(pw), sid_string_dbg(sid_group),
2520 sid_string_dbg(domain_sid)));
2521 return NT_STATUS_UNSUCCESSFUL;
2522 }
2523
2524 unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2525 unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2526 unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2527 unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2528
2529 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(pw));
2530 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2531 r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2532 r->home_drive.string = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2533 r->logon_script.string = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2534 r->profile_path.string = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2535 r->description.string = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2536 r->workstations.string = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2537
2538 r->logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2539 r->rid = rid;
2540 r->primary_gid = primary_gid;
2541 r->acct_flags = pdb_get_acct_ctrl(pw);
2542 r->bad_password_count = pdb_get_bad_password_count(pw);
2543 r->logon_count = pdb_get_logon_count(pw);
2544
2545 return NT_STATUS_OK;
2546 }
2547
2548 /*************************************************************************
2549 get_user_info_6.
2550 *************************************************************************/
2551
2552 static NTSTATUS get_user_info_6(TALLOC_CTX *mem_ctx,
2553 struct samr_UserInfo6 *r,
2554 struct samu *pw)
2555 {
2556 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(pw));
2557 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2558
2559 return NT_STATUS_OK;
2560 }
2561
2562 /*************************************************************************
2563 get_user_info_7. Safe. Only gives out account_name.
2564 *************************************************************************/
2565
2566 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2567 struct samr_UserInfo7 *r,
2568 struct samu *smbpass)
2569 {
2570 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2571 if (!r->account_name.string) {
2572 return NT_STATUS_NO_MEMORY;
2573 }
2574
2575 return NT_STATUS_OK;
2576 }
2577
2578 /*************************************************************************
2579 get_user_info_8.
2580 *************************************************************************/
2581
2582 static NTSTATUS get_user_info_8(TALLOC_CTX *mem_ctx,
2583 struct samr_UserInfo8 *r,
2584 struct samu *pw)
2585 {
2586 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2587
2588 return NT_STATUS_OK;
2589 }
2590
2591 /*************************************************************************
2592 get_user_info_9. Only gives out primary group SID.
2593 *************************************************************************/
2594
2595 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2596 struct samr_UserInfo9 *r,
2597 struct samu *smbpass)
2598 {
2599 r->primary_gid = pdb_get_group_rid(smbpass);
2600
2601 return NT_STATUS_OK;
2602 }
2603
2604 /*************************************************************************
2605 get_user_info_10.
2606 *************************************************************************/
2607
2608 static NTSTATUS get_user_info_10(TALLOC_CTX *mem_ctx,
2609 struct samr_UserInfo10 *r,
2610 struct samu *pw)
2611 {
2612 r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2613 r->home_drive.string = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2614
2615 return NT_STATUS_OK;
2616 }
2617
2618 /*************************************************************************
2619 get_user_info_11.
2620 *************************************************************************/
2621
2622 static NTSTATUS get_user_info_11(TALLOC_CTX *mem_ctx,
2623 struct samr_UserInfo11 *r,
2624 struct samu *pw)
2625 {
2626 r->logon_script.string = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2627
2628 return NT_STATUS_OK;
2629 }
2630
2631 /*************************************************************************
2632 get_user_info_12.
2633 *************************************************************************/
2634
2635 static NTSTATUS get_user_info_12(TALLOC_CTX *mem_ctx,
2636 struct samr_UserInfo12 *r,
2637 struct samu *pw)
2638 {
2639 r->profile_path.string = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2640
2641 return NT_STATUS_OK;
2642 }
2643
2644 /*************************************************************************
2645 get_user_info_13.
2646 *************************************************************************/
2647
2648 static NTSTATUS get_user_info_13(TALLOC_CTX *mem_ctx,
2649 struct samr_UserInfo13 *r,
2650 struct samu *pw)
2651 {
2652 r->description.string = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2653
2654 return NT_STATUS_OK;
2655 }
2656
2657 /*************************************************************************
2658 get_user_info_14.
2659 *************************************************************************/
2660
2661 static NTSTATUS get_user_info_14(TALLOC_CTX *mem_ctx,
2662 struct samr_UserInfo14 *r,
2663 struct samu *pw)
2664 {
2665 r->workstations.string = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2666
2667 return NT_STATUS_OK;
2668 }
2669
2670 /*************************************************************************
2671 get_user_info_16. Safe. Only gives out acb bits.
2672 *************************************************************************/
2673
2674 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2675 struct samr_UserInfo16 *r,
2676 struct samu *smbpass)
2677 {
2678 r->acct_flags = pdb_get_acct_ctrl(smbpass);
2679
2680 return NT_STATUS_OK;
2681 }
2682
2683 /*************************************************************************
2684 get_user_info_17.
2685 *************************************************************************/
2686
2687 static NTSTATUS get_user_info_17(TALLOC_CTX *mem_ctx,
2688 struct samr_UserInfo17 *r,
2689 struct samu *pw)
2690 {
2691 unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2692
2693 return NT_STATUS_OK;
2694 }
2695
2696 /*************************************************************************
2697 get_user_info_18. OK - this is the killer as it gives out password info.
2698 Ensure that this is only allowed on an encrypted connection with a root
2699 user. JRA.
2700 *************************************************************************/
2701
2702 static NTSTATUS get_user_info_18(struct pipes_struct *p,
2703 TALLOC_CTX *mem_ctx,
2704 struct samr_UserInfo18 *r,
2705 struct dom_sid *user_sid)
2706 {
2707 struct samu *smbpass=NULL;
2708 bool ret;
2709 const uint8_t *nt_pass = NULL;
2710 const uint8_t *lm_pass = NULL;
2711
2712 ZERO_STRUCTP(r);
2713
2714 if (security_token_is_system(p->session_info->security_token)) {
2715 goto query;
2716 }
2717
2718 if ((p->auth.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) ||
2719 (p->auth.auth_type != DCERPC_AUTH_TYPE_KRB5) ||
2720 (p->auth.auth_type != DCERPC_AUTH_TYPE_SPNEGO)) {
2721 return NT_STATUS_ACCESS_DENIED;
2722 }
2723
2724 if (p->auth.auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
2725 return NT_STATUS_ACCESS_DENIED;
2726 }
2727
2728 query:
2729 /*
2730 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2731 */
2732
2733 if ( !(smbpass = samu_new( mem_ctx )) ) {
2734 return NT_STATUS_NO_MEMORY;
2735 }
2736
2737 ret = pdb_getsampwsid(smbpass, user_sid);
2738
2739 if (ret == False) {
2740 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2741 TALLOC_FREE(smbpass);
2742 return (geteuid() == sec_initial_uid()) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2743 }
2744
2745 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2746
2747 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2748 TALLOC_FREE(smbpass);
2749 return NT_STATUS_ACCOUNT_DISABLED;
2750 }
2751
2752 lm_pass = pdb_get_lanman_passwd(smbpass);
2753 if (lm_pass != NULL) {
2754 memcpy(r->lm_pwd.hash, lm_pass, 16);
2755 r->lm_pwd_active = true;
2756 }
2757
2758 nt_pass = pdb_get_nt_passwd(smbpass);
2759 if (nt_pass != NULL) {
2760 memcpy(r->nt_pwd.hash, nt_pass, 16);
2761 r->nt_pwd_active = true;
2762 }
2763 r->password_expired = 0; /* FIXME */
2764
2765 TALLOC_FREE(smbpass);
2766
2767 return NT_STATUS_OK;
2768 }
2769
2770 /*************************************************************************
2771 get_user_info_20
2772 *************************************************************************/
2773
2774 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2775 struct samr_UserInfo20 *r,
2776 struct samu *sampass)
2777 {
2778 const char *munged_dial = NULL;
2779 DATA_BLOB blob;
2780 NTSTATUS status;
2781 struct lsa_BinaryString *parameters = NULL;
2782
2783 ZERO_STRUCTP(r);
2784
2785 munged_dial = pdb_get_munged_dial(sampass);
2786
2787 DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2788 munged_dial, (int)strlen(munged_dial)));
2789
2790 if (munged_dial) {
2791 blob = base64_decode_data_blob(munged_dial);
2792 } else {
2793 blob = data_blob_string_const_null("");
2794 }
2795
2796 status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2797 data_blob_free(&blob);
2798 if (!NT_STATUS_IS_OK(status)) {
2799 return status;
2800 }
2801
2802 r->parameters = *parameters;
2803
2804 return NT_STATUS_OK;
2805 }
2806
2807
2808 /*************************************************************************
2809 get_user_info_21
2810 *************************************************************************/
2811
2812 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2813 struct samr_UserInfo21 *r,
2814 struct samu *pw,
2815 struct dom_sid *domain_sid,
2816 uint32_t acc_granted)
2817 {
2818 NTSTATUS status;
2819 const struct dom_sid *sid_user, *sid_group;
2820 uint32_t rid, primary_gid;
2821 NTTIME force_password_change;
2822 time_t must_change_time;
2823 struct lsa_BinaryString *parameters = NULL;
2824 const char *munged_dial = NULL;
2825 DATA_BLOB blob;
2826
2827 ZERO_STRUCTP(r);
2828
2829 sid_user = pdb_get_user_sid(pw);
2830
2831 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2832 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2833 "the domain sid %s. Failing operation.\n",
2834 pdb_get_username(pw), sid_string_dbg(sid_user),
2835 sid_string_dbg(domain_sid)));
2836 return NT_STATUS_UNSUCCESSFUL;
2837 }
2838
2839 become_root();
2840 sid_group = pdb_get_group_sid(pw);
2841 unbecome_root();
2842
2843 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2844 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2845 "which conflicts with the domain sid %s. Failing operation.\n",
2846 pdb_get_username(pw), sid_string_dbg(sid_group),
2847 sid_string_dbg(domain_sid)));
2848 return NT_STATUS_UNSUCCESSFUL;
2849 }
2850
2851 unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2852 unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2853 unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2854 unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2855 unix_to_nt_time(&r->allow_password_change, pdb_get_pass_can_change_time(pw));
2856
2857 must_change_time = pdb_get_pass_must_change_time(pw);
2858 if (pdb_is_password_change_time_max(must_change_time)) {
2859 unix_to_nt_time_abs(&force_password_change, must_change_time);
2860 } else {
2861 unix_to_nt_time(&force_password_change, must_change_time);
2862 }
2863
2864 munged_dial = pdb_get_munged_dial(pw);
2865 if (munged_dial) {
2866 blob = base64_decode_data_blob(munged_dial);
2867 } else {
2868 blob = data_blob_string_const_null("");
2869 }
2870
2871 status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2872 data_blob_free(&blob);
2873 if (!NT_STATUS_IS_OK(status)) {
2874 return status;
2875 }
2876
2877 r->force_password_change = force_password_change;
2878
2879 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(pw));
2880 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2881 r->home_directory.string = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2882 r->home_drive.string = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2883 r->logon_script.string = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2884 r->profile_path.string = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2885 r->description.string = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2886 r->workstations.string = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2887 r->comment.string = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2888
2889 r->logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2890 r->parameters = *parameters;
2891 r->rid = rid;
2892 r->primary_gid = primary_gid;
2893 r->acct_flags = pdb_get_acct_ctrl(pw);
2894 r->bad_password_count = pdb_get_bad_password_count(pw);
2895 r->logon_count = pdb_get_logon_count(pw);
2896 r->fields_present = pdb_build_fields_present(pw);
2897 r->password_expired = (pdb_get_pass_must_change_time(pw) == 0) ?
2898 PASS_MUST_CHANGE_AT_NEXT_LOGON : 0;
2899 r->country_code = pdb_get_country_code(pw);
2900 r->code_page = pdb_get_code_page(pw);
2901 r->lm_password_set = 0;
2902 r->nt_password_set = 0;
2903
2904 #if 0
2905
2906 /*
2907 Look at a user on a real NT4 PDC with usrmgr, press
2908 'ok'. Then you will see that fields_present is set to
2909 0x08f827fa. Look at the user immediately after that again,
2910 and you will see that 0x00fffff is returned. This solves
2911 the problem that you get access denied after having looked
2912 at the user.
2913 -- Volker
2914 */
2915
2916 #endif
2917
2918
2919 return NT_STATUS_OK;
2920 }
2921
2922 /*******************************************************************
2923 _samr_QueryUserInfo
2924 ********************************************************************/
2925
2926 NTSTATUS _samr_QueryUserInfo(struct pipes_struct *p,
2927 struct samr_QueryUserInfo *r)
2928 {
2929 NTSTATUS status;
2930 union samr_UserInfo *user_info = NULL;
2931 struct samr_user_info *uinfo;
2932 struct dom_sid domain_sid;
2933 uint32 rid;
2934 bool ret = false;
2935 struct samu *pwd = NULL;
2936 uint32_t acc_required, acc_granted;
2937
2938 switch (r->in.level) {
2939 case 1: /* UserGeneralInformation */
2940 /* USER_READ_GENERAL */
2941 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC;
2942 break;
2943 case 2: /* UserPreferencesInformation */
2944 /* USER_READ_PREFERENCES | USER_READ_GENERAL */
2945 acc_required = SAMR_USER_ACCESS_GET_LOCALE |
2946 SAMR_USER_ACCESS_GET_NAME_ETC;
2947 break;
2948 case 3: /* UserLogonInformation */
2949 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
2950 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC |
2951 SAMR_USER_ACCESS_GET_LOCALE |
2952 SAMR_USER_ACCESS_GET_LOGONINFO |
2953 SAMR_USER_ACCESS_GET_ATTRIBUTES;
2954 break;
2955 case 4: /* UserLogonHoursInformation */
2956 /* USER_READ_LOGON */
2957 acc_required = SAMR_USER_ACCESS_GET_LOGONINFO;
2958 break;
2959 case 5: /* UserAccountInformation */
2960 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
2961 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC |
2962 SAMR_USER_ACCESS_GET_LOCALE |
2963 SAMR_USER_ACCESS_GET_LOGONINFO |
2964 SAMR_USER_ACCESS_GET_ATTRIBUTES;
2965 break;
2966 case 6: /* UserNameInformation */
2967 case 7: /* UserAccountNameInformation */
2968 case 8: /* UserFullNameInformation */
2969 case 9: /* UserPrimaryGroupInformation */
2970 case 13: /* UserAdminCommentInformation */
2971 /* USER_READ_GENERAL */
2972 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC;
2973 break;
2974 case 10: /* UserHomeInformation */
2975 case 11: /* UserScriptInformation */
2976 case 12: /* UserProfileInformation */
2977 case 14: /* UserWorkStationsInformation */
2978 /* USER_READ_LOGON */
2979 acc_required = SAMR_USER_ACCESS_GET_LOGONINFO;
2980 break;
2981 case 16: /* UserControlInformation */
2982 case 17: /* UserExpiresInformation */
2983 case 20: /* UserParametersInformation */
2984 /* USER_READ_ACCOUNT */
2985 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
2986 break;
2987 case 21: /* UserAllInformation */
2988 /* FIXME! - gd */
2989 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
2990 break;
2991 case 18: /* UserInternal1Information */
2992 /* FIXME! - gd */
2993 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
2994 break;
2995 case 23: /* UserInternal4Information */
2996 case 24: /* UserInternal4InformationNew */
2997 case 25: /* UserInternal4InformationNew */
2998 case 26: /* UserInternal5InformationNew */
2999 default:
3000 return NT_STATUS_INVALID_INFO_CLASS;
3001 break;
3002 }
3003
3004 uinfo = policy_handle_find(p, r->in.user_handle,
3005 acc_required, &acc_granted,
3006 struct samr_user_info, &status);
3007 if (!NT_STATUS_IS_OK(status)) {
3008 return status;
3009 }
3010
3011 domain_sid = uinfo->sid;
3012
3013 sid_split_rid(&domain_sid, &rid);
3014
3015 if (!sid_check_is_in_our_sam(&uinfo->sid))
3016 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3017
3018 DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
3019 sid_string_dbg(&uinfo->sid)));
3020
3021 user_info = talloc_zero(p->mem_ctx, union samr_UserInfo);
3022 if (!user_info) {
3023 return NT_STATUS_NO_MEMORY;
3024 }
3025
3026 DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
3027
3028 if (!(pwd = samu_new(p->mem_ctx))) {
3029 return NT_STATUS_NO_MEMORY;
3030 }
3031
3032 become_root();
3033 ret = pdb_getsampwsid(pwd, &uinfo->sid);
3034 unbecome_root();
3035
3036 if (ret == false) {
3037 DEBUG(4,("User %s not found\n", sid_string_dbg(&uinfo->sid)));
3038 TALLOC_FREE(pwd);
3039 return NT_STATUS_NO_SUCH_USER;
3040 }
3041
3042 DEBUG(3,("User:[%s]\n", pdb_get_username(pwd)));
3043
3044 samr_clear_sam_passwd(pwd);
3045
3046 switch (r->in.level) {
3047 case 1:
3048 status = get_user_info_1(p->mem_ctx, &user_info->info1, pwd, &domain_sid);
3049 break;
3050 case 2:
3051 status = get_user_info_2(p->mem_ctx, &user_info->info2, pwd);
3052 break;
3053 case 3:
3054 status = get_user_info_3(p->mem_ctx, &user_info->info3, pwd, &domain_sid);
3055 break;
3056 case 4:
3057 status = get_user_info_4(p->mem_ctx, &user_info->info4, pwd);
3058 break;
3059 case 5:
3060 status = get_user_info_5(p->mem_ctx, &user_info->info5, pwd, &domain_sid);
3061 break;
3062 case 6:
3063 status = get_user_info_6(p->mem_ctx, &user_info->info6, pwd);
3064 break;
3065 case 7:
3066 status = get_user_info_7(p->mem_ctx, &user_info->info7, pwd);
3067 break;
3068 case 8:
3069 status = get_user_info_8(p->mem_ctx, &user_info->info8, pwd);
3070 break;
3071 case 9:
3072 status = get_user_info_9(p->mem_ctx, &user_info->info9, pwd);
3073 break;
3074 case 10:
3075 status = get_user_info_10(p->mem_ctx, &user_info->info10, pwd);
3076 break;
3077 case 11:
3078 status = get_user_info_11(p->mem_ctx, &user_info->info11, pwd);
3079 break;
3080 case 12:
3081 status = get_user_info_12(p->mem_ctx, &user_info->info12, pwd);
3082 break;
3083 case 13:
3084 status = get_user_info_13(p->mem_ctx, &user_info->info13, pwd);
3085 break;
3086 case 14:
3087 status = get_user_info_14(p->mem_ctx, &user_info->info14, pwd);
3088 break;
3089 case 16:
3090 status = get_user_info_16(p->mem_ctx, &user_info->info16, pwd);
3091 break;
3092 case 17:
3093 status = get_user_info_17(p->mem_ctx, &user_info->info17, pwd);
3094 break;
3095 case 18:
3096 /* level 18 is special */
3097 status = get_user_info_18(p, p->mem_ctx, &user_info->info18,
3098 &uinfo->sid);
3099 break;
3100 case 20:
3101 status = get_user_info_20(p->mem_ctx, &user_info->info20, pwd);
3102 break;
3103 case 21:
3104 status = get_user_info_21(p->mem_ctx, &user_info->info21, pwd, &domain_sid, acc_granted);
3105 break;
3106 default:
3107 status = NT_STATUS_INVALID_INFO_CLASS;
3108 break;
3109 }
3110
3111 if (!NT_STATUS_IS_OK(status)) {
3112 goto done;
3113 }
3114
3115 *r->out.info = user_info;
3116
3117 done:
3118 TALLOC_FREE(pwd);
3119
3120 DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
3121
3122 return status;
3123 }
3124
3125 /****************************************************************
3126 ****************************************************************/
3127
3128 NTSTATUS _samr_QueryUserInfo2(struct pipes_struct *p,
3129 struct samr_QueryUserInfo2 *r)
3130 {
3131 struct samr_QueryUserInfo u;
3132
3133 u.in.user_handle = r->in.user_handle;
3134 u.in.level = r->in.level;
3135 u.out.info = r->out.info;
3136
3137 return _samr_QueryUserInfo(p, &u);
3138 }
3139
3140 /*******************************************************************
3141 _samr_GetGroupsForUser
3142 ********************************************************************/
3143
3144 NTSTATUS _samr_GetGroupsForUser(struct pipes_struct *p,
3145 struct samr_GetGroupsForUser *r)
3146 {
3147 struct samr_user_info *uinfo;
3148 struct samu *sam_pass=NULL;
3149 struct dom_sid *sids;
3150 struct samr_RidWithAttribute dom_gid;
3151 struct samr_RidWithAttribute *gids = NULL;
3152 uint32 primary_group_rid;
3153 uint32_t num_groups = 0;
3154 gid_t *unix_gids;
3155 uint32_t i, num_gids;
3156 bool ret;
3157 NTSTATUS result;
3158 bool success = False;
3159
3160 struct samr_RidWithAttributeArray *rids = NULL;
3161
3162 /*
3163 * from the SID in the request:
3164 * we should send back the list of DOMAIN GROUPS
3165 * the user is a member of
3166 *
3167 * and only the DOMAIN GROUPS
3168 * no ALIASES !!! neither aliases of the domain
3169 * nor aliases of the builtin SID
3170 *
3171 * JFM, 12/2/2001
3172 */
3173
3174 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
3175
3176 uinfo = policy_handle_find(p, r->in.user_handle,
3177 SAMR_USER_ACCESS_GET_GROUPS, NULL,
3178 struct samr_user_info, &result);
3179 if (!NT_STATUS_IS_OK(result)) {
3180 return result;
3181 }
3182
3183 rids = talloc_zero(p->mem_ctx, struct samr_RidWithAttributeArray);
3184 if (!rids) {
3185 return NT_STATUS_NO_MEMORY;
3186 }
3187
3188 if (!sid_check_is_in_our_sam(&uinfo->sid))
3189 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3190
3191 if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
3192 return NT_STATUS_NO_MEMORY;
3193 }
3194
3195 become_root();
3196 ret = pdb_getsampwsid(sam_pass, &uinfo->sid);
3197 unbecome_root();
3198
3199 if (!ret) {
3200 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
3201 sid_string_dbg(&uinfo->sid)));
3202 return NT_STATUS_NO_SUCH_USER;
3203 }
3204
3205 sids = NULL;
3206
3207 /* make both calls inside the root block */
3208 become_root();
3209 result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
3210 &sids, &unix_gids, &num_groups);
3211 if ( NT_STATUS_IS_OK(result) ) {
3212 success = sid_peek_check_rid(get_global_sam_sid(),
3213 pdb_get_group_sid(sam_pass),
3214 &primary_group_rid);
3215 }
3216 unbecome_root();
3217
3218 if (!NT_STATUS_IS_OK(result)) {
3219 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
3220 sid_string_dbg(&uinfo->sid)));
3221 return result;
3222 }
3223
3224 if ( !success ) {
3225 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
3226 sid_string_dbg(pdb_get_group_sid(sam_pass)),
3227 pdb_get_username(sam_pass)));
3228 TALLOC_FREE(sam_pass);
3229 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3230 }
3231
3232 gids = NULL;
3233 num_gids = 0;
3234
3235 dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
3236 SE_GROUP_ENABLED);
3237 dom_gid.rid = primary_group_rid;
3238 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
3239
3240 for (i=0; i<num_groups; i++) {
3241
3242 if (!sid_peek_check_rid(get_global_sam_sid(),
3243 &(sids[i]), &dom_gid.rid)) {
3244 DEBUG(10, ("Found sid %s not in our domain\n",
3245 sid_string_dbg(&sids[i])));
3246 continue;
3247 }
3248
3249 if (dom_gid.rid == primary_group_rid) {
3250 /* We added the primary group directly from the
3251 * sam_account. The other SIDs are unique from
3252 * enum_group_memberships */
3253 continue;
3254 }
3255
3256 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
3257 }
3258
3259 rids->count = num_gids;
3260 rids->rids = gids;
3261
3262 *r->out.rids = rids;
3263
3264 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
3265
3266 return result;
3267 }
3268
3269 /*******************************************************************
3270 ********************************************************************/
3271
3272 static uint32_t samr_get_server_role(void)
3273 {
3274 uint32_t role = ROLE_DOMAIN_PDC;
3275
3276 if (lp_server_role() == ROLE_DOMAIN_BDC) {
3277 role = ROLE_DOMAIN_BDC;
3278 }
3279
3280 return role;
3281 }
3282
3283 /*******************************************************************
3284 ********************************************************************/
3285
3286 static NTSTATUS query_dom_info_1(TALLOC_CTX *mem_ctx,
3287 struct samr_DomInfo1 *r)
3288 {
3289 uint32_t account_policy_temp;
3290 time_t u_expire, u_min_age;
3291
3292 become_root();
3293
3294 /* AS ROOT !!! */
3295
3296 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN, &account_policy_temp);
3297 r->min_password_length = account_policy_temp;
3298
3299 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &account_policy_temp);
3300 r->password_history_length = account_policy_temp;
3301
3302 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
3303 &r->password_properties);
3304
3305 pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &account_policy_temp);
3306 u_expire = account_policy_temp;
3307
3308 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &account_policy_temp);
3309 u_min_age = account_policy_temp;
3310
3311 /* !AS ROOT */
3312
3313 unbecome_root();
3314
3315 unix_to_nt_time_abs((NTTIME *)&r->max_password_age, u_expire);
3316 unix_to_nt_time_abs((NTTIME *)&r->min_password_age, u_min_age);
3317
3318 if (lp_check_password_script(talloc_tos()) && *lp_check_password_script(talloc_tos())) {
3319 r->password_properties |= DOMAIN_PASSWORD_COMPLEX;
3320 }
3321
3322 return NT_STATUS_OK;
3323 }
3324
3325 /*******************************************************************
3326 ********************************************************************/
3327
3328 static NTSTATUS query_dom_info_2(TALLOC_CTX *mem_ctx,
3329 struct samr_DomGeneralInformation *r,
3330 struct samr_domain_info *dinfo)
3331 {
3332 uint32_t u_logout;
3333 time_t seq_num;
3334
3335 become_root();
3336
3337 /* AS ROOT !!! */
3338
3339 r->num_users = count_sam_users(dinfo->disp_info, ACB_NORMAL);
3340 r->num_groups = count_sam_groups(dinfo->disp_info);
3341 r->num_aliases = count_sam_aliases(dinfo->disp_info);
3342
3343 pdb_get_account_policy(PDB_POLICY_TIME_TO_LOGOUT, &u_logout);
3344
3345 unix_to_nt_time_abs(&r->force_logoff_time, u_logout);
3346
3347 if (!pdb_get_seq_num(&seq_num)) {
3348 seq_num = time(NULL);
3349 }
3350
3351 /* !AS ROOT */
3352
3353 unbecome_root();
3354
3355 r->oem_information.string = lp_serverstring(r);
3356 r->domain_name.string = lp_workgroup();
3357 r->primary.string = lp_netbios_name();
3358 r->sequence_num = seq_num;
3359 r->domain_server_state = DOMAIN_SERVER_ENABLED;
3360 r->role = (enum samr_Role) samr_get_server_role();
3361 r->unknown3 = 1;
3362
3363 return NT_STATUS_OK;
3364 }
3365
3366 /*******************************************************************
3367 ********************************************************************/
3368
3369 static NTSTATUS query_dom_info_3(TALLOC_CTX *mem_ctx,
3370 struct samr_DomInfo3 *r)
3371 {
3372 uint32_t u_logout;
3373
3374 become_root();
3375
3376 /* AS ROOT !!! */
3377
3378 {
3379 uint32_t ul;
3380 pdb_get_account_policy(PDB_POLICY_TIME_TO_LOGOUT, &ul);
3381 u_logout = (time_t)ul;
3382 }
3383
3384 /* !AS ROOT */
3385
3386 unbecome_root();
3387
3388 unix_to_nt_time_abs(&r->force_logoff_time, u_logout);
3389
3390 return NT_STATUS_OK;
3391 }
3392
3393 /*******************************************************************
3394 ********************************************************************/
3395
3396 static NTSTATUS query_dom_info_4(TALLOC_CTX *mem_ctx,
3397 struct samr_DomOEMInformation *r)
3398 {
3399 r->oem_information.string = lp_serverstring(r);
3400
3401 return NT_STATUS_OK;
3402 }
3403
3404 /*******************************************************************
3405 ********************************************************************/
3406
3407 static NTSTATUS query_dom_info_5(TALLOC_CTX *mem_ctx,
3408 struct samr_DomInfo5 *r)
3409 {
3410 r->domain_name.string = get_global_sam_name();
3411
3412 return NT_STATUS_OK;
3413 }
3414
3415 /*******************************************************************
3416 ********************************************************************/
3417
3418 static NTSTATUS query_dom_info_6(TALLOC_CTX *mem_ctx,
3419 struct samr_DomInfo6 *r)
3420 {
3421 /* NT returns its own name when a PDC. win2k and later
3422 * only the name of the PDC if itself is a BDC (samba4
3423 * idl) */
3424 r->primary.string = lp_netbios_name();
3425
3426 return NT_STATUS_OK;
3427 }
3428
3429 /*******************************************************************
3430 ********************************************************************/
3431
3432 static NTSTATUS query_dom_info_7(TALLOC_CTX *mem_ctx,
3433 struct samr_DomInfo7 *r)
3434 {
3435 r->role = (enum samr_Role) samr_get_server_role();
3436
3437 return NT_STATUS_OK;
3438 }
3439
3440 /*******************************************************************
3441 ********************************************************************/
3442
3443 static NTSTATUS query_dom_info_8(TALLOC_CTX *mem_ctx,
3444 struct samr_DomInfo8 *r)
3445 {
3446 time_t seq_num;
3447
3448 become_root();
3449
3450 /* AS ROOT !!! */
3451
3452 if (!pdb_get_seq_num(&seq_num)) {
3453 seq_num = time(NULL);
3454 }
3455
3456 /* !AS ROOT */
3457
3458 unbecome_root();
3459
3460 r->sequence_num = seq_num;
3461 r->domain_create_time = 0;
3462
3463 return NT_STATUS_OK;
3464 }
3465
3466 /*******************************************************************
3467 ********************************************************************/
3468
3469 static NTSTATUS query_dom_info_9(TALLOC_CTX *mem_ctx,
3470 struct samr_DomInfo9 *r)
3471 {
3472 r->domain_server_state = DOMAIN_SERVER_ENABLED;
3473
3474 return NT_STATUS_OK;
3475 }
3476
3477 /*******************************************************************
3478 ********************************************************************/
3479
3480 static NTSTATUS query_dom_info_11(TALLOC_CTX *mem_ctx,
3481 struct samr_DomGeneralInformation2 *r,
3482 struct samr_domain_info *dinfo)
3483 {
3484 NTSTATUS status;
3485 uint32_t account_policy_temp;
3486 time_t u_lock_duration, u_reset_time;
3487
3488 status = query_dom_info_2(mem_ctx, &r->general, dinfo);
3489 if (!NT_STATUS_IS_OK(status)) {
3490 return status;
3491 }
3492
3493 /* AS ROOT !!! */
3494
3495 become_root();
3496
3497 pdb_get_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3498 u_lock_duration = account_policy_temp;
3499 if (u_lock_duration != -1) {
3500 u_lock_duration *= 60;
3501 }
3502
3503 pdb_get_account_policy(PDB_POLICY_RESET_COUNT_TIME, &account_policy_temp);
3504 u_reset_time = account_policy_temp * 60;
3505
3506 pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3507 r->lockout_threshold = account_policy_temp;
3508
3509 /* !AS ROOT */
3510
3511 unbecome_root();
3512
3513 unix_to_nt_time_abs(&r->lockout_duration, u_lock_duration);
3514 unix_to_nt_time_abs(&r->lockout_window, u_reset_time);
3515
3516 return NT_STATUS_OK;
3517 }
3518
3519 /*******************************************************************
3520 ********************************************************************/
3521
3522 static NTSTATUS query_dom_info_12(TALLOC_CTX *mem_ctx,
3523 struct samr_DomInfo12 *r)
3524 {
3525 uint32_t account_policy_temp;
3526 time_t u_lock_duration, u_reset_time;
3527
3528 become_root();
3529
3530 /* AS ROOT !!! */
3531
3532 pdb_get_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3533 u_lock_duration = account_policy_temp;
3534 if (u_lock_duration != -1) {
3535 u_lock_duration *= 60;
3536 }
3537
3538 pdb_get_account_policy(PDB_POLICY_RESET_COUNT_TIME, &account_policy_temp);
3539 u_reset_time = account_policy_temp * 60;
3540
3541 pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3542 r->lockout_threshold = account_policy_temp;
3543
3544 /* !AS ROOT */
3545
3546 unbecome_root();
3547
3548 unix_to_nt_time_abs(&r->lockout_duration, u_lock_duration);
3549 unix_to_nt_time_abs(&r->lockout_window, u_reset_time);
3550
3551 return NT_STATUS_OK;
3552 }
3553
3554 /*******************************************************************
3555 ********************************************************************/
3556
3557 static NTSTATUS query_dom_info_13(TALLOC_CTX *mem_ctx,
3558 struct samr_DomInfo13 *r)
3559 {
3560 time_t seq_num;
3561
3562 become_root();
3563
3564 /* AS ROOT !!! */
3565
3566 if (!pdb_get_seq_num(&seq_num)) {
3567 seq_num = time(NULL);
3568 }
3569
3570 /* !AS ROOT */
3571
3572 unbecome_root();
3573
3574 r->sequence_num = seq_num;
3575 r->domain_create_time = 0;
3576 r->modified_count_at_last_promotion = 0;
3577
3578 return NT_STATUS_OK;
3579 }
3580
3581 /*******************************************************************
3582 _samr_QueryDomainInfo
3583 ********************************************************************/
3584
3585 NTSTATUS _samr_QueryDomainInfo(struct pipes_struct *p,
3586 struct samr_QueryDomainInfo *r)
3587 {
3588 NTSTATUS status = NT_STATUS_OK;
3589 struct samr_domain_info *dinfo;
3590 union samr_DomainInfo *dom_info;
3591
3592 uint32_t acc_required;
3593
3594 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3595
3596 switch (r->in.level) {
3597 case 1: /* DomainPasswordInformation */
3598 case 12: /* DomainLockoutInformation */
3599 /* DOMAIN_READ_PASSWORD_PARAMETERS */
3600 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1;
3601 break;
3602 case 11: /* DomainGeneralInformation2 */
3603 /* DOMAIN_READ_PASSWORD_PARAMETERS |
3604 * DOMAIN_READ_OTHER_PARAMETERS */
3605 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 |
3606 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2;
3607 break;
3608 case 2: /* DomainGeneralInformation */
3609 case 3: /* DomainLogoffInformation */
3610 case 4: /* DomainOemInformation */
3611 case 5: /* DomainReplicationInformation */
3612 case 6: /* DomainReplicationInformation */
3613 case 7: /* DomainServerRoleInformation */
3614 case 8: /* DomainModifiedInformation */
3615 case 9: /* DomainStateInformation */
3616 case 10: /* DomainUasInformation */
3617 case 13: /* DomainModifiedInformation2 */
3618 /* DOMAIN_READ_OTHER_PARAMETERS */
3619 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2;
3620 break;
3621 default:
3622 return NT_STATUS_INVALID_INFO_CLASS;
3623 }
3624
3625 dinfo = policy_handle_find(p, r->in.domain_handle,
3626 acc_required, NULL,
3627 struct samr_domain_info, &status);
3628 if (!NT_STATUS_IS_OK(status)) {
3629 return status;
3630 }
3631
3632 dom_info = talloc_zero(p->mem_ctx, union samr_DomainInfo);
3633 if (!dom_info) {
3634 return NT_STATUS_NO_MEMORY;
3635 }
3636
3637 switch (r->in.level) {
3638 case 1:
3639 status = query_dom_info_1(p->mem_ctx, &dom_info->info1);
3640 break;
3641 case 2:
3642 status = query_dom_info_2(p->mem_ctx, &dom_info->general, dinfo);
3643 break;
3644 case 3:
3645 status = query_dom_info_3(p->mem_ctx, &dom_info->info3);
3646 break;
3647 case 4:
3648 status = query_dom_info_4(p->mem_ctx, &dom_info->oem);
3649 break;
3650 case 5:
3651 status = query_dom_info_5(p->mem_ctx, &dom_info->info5);
3652 break;
3653 case 6:
3654 status = query_dom_info_6(p->mem_ctx, &dom_info->info6);
3655 break;
3656 case 7:
3657 status = query_dom_info_7(p->mem_ctx, &dom_info->info7);
3658 break;
3659 case 8:
3660 status = query_dom_info_8(p->mem_ctx, &dom_info->info8);
3661 break;
3662 case 9:
3663 status = query_dom_info_9(p->mem_ctx, &dom_info->info9);
3664 break;
3665 case 11:
3666 status = query_dom_info_11(p->mem_ctx, &dom_info->general2, dinfo);
3667 break;
3668 case 12:
3669 status = query_dom_info_12(p->mem_ctx, &dom_info->info12);
3670 break;
3671 case 13:
3672 status = query_dom_info_13(p->mem_ctx, &dom_info->info13);
3673 break;
3674 default:
3675 return NT_STATUS_INVALID_INFO_CLASS;
3676 }
3677
3678 if (!NT_STATUS_IS_OK(status)) {
3679 return status;
3680 }
3681
3682 *r->out.info = dom_info;
3683
3684 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3685
3686 return status;
3687 }
3688
3689 /* W2k3 seems to use the same check for all 3 objects that can be created via
3690 * SAMR, if you try to create for example "Dialup" as an alias it says
3691 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3692 * database. */
3693
3694 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
3695 {
3696 enum lsa_SidType type;
3697 bool result;
3698
3699 DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
3700
3701 become_root();
3702 /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3703 * whether the name already exists */
3704 result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
3705 NULL, NULL, NULL, &type);
3706 unbecome_root();
3707
3708 if (!result) {
3709 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3710 return NT_STATUS_OK;
3711 }
3712
3713 DEBUG(5, ("trying to create %s, exists as %s\n",
3714 new_name, sid_type_lookup(type)));
3715
3716 if (type == SID_NAME_DOM_GRP) {
3717 return NT_STATUS_GROUP_EXISTS;
3718 }
3719 if (type == SID_NAME_ALIAS) {
3720 return NT_STATUS_ALIAS_EXISTS;
3721 }
3722
3723 /* Yes, the default is NT_STATUS_USER_EXISTS */
3724 return NT_STATUS_USER_EXISTS;
3725 }
3726
3727 /*******************************************************************
3728 _samr_CreateUser2
3729 ********************************************************************/
3730
3731 NTSTATUS _samr_CreateUser2(struct pipes_struct *p,
3732 struct samr_CreateUser2 *r)
3733 {
3734 const char *account = NULL;
3735 struct dom_sid sid;
3736 uint32_t acb_info = r->in.acct_flags;
3737 struct samr_domain_info *dinfo;
3738 struct samr_user_info *uinfo;
3739 NTSTATUS nt_status;
3740 uint32 acc_granted;
3741 struct security_descriptor *psd;
3742 size_t sd_size;
3743 /* check this, when giving away 'add computer to domain' privs */
3744 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3745 bool can_add_account = False;
3746
3747 /* Which privilege is needed to override the ACL? */
3748 enum sec_privilege needed_priv = SEC_PRIV_INVALID;
3749
3750 dinfo = policy_handle_find(p, r->in.domain_handle,
3751 SAMR_DOMAIN_ACCESS_CREATE_USER, NULL,
3752 struct samr_domain_info, &nt_status);
3753 if (!NT_STATUS_IS_OK(nt_status)) {
3754 return nt_status;
3755 }
3756
3757 if (sid_check_is_builtin(&dinfo->sid)) {
3758 DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
3759 return NT_STATUS_ACCESS_DENIED;
3760 }
3761
3762 if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3763 acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3764 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3765 this parameter is not an account type */
3766 return NT_STATUS_INVALID_PARAMETER;
3767 }
3768
3769 account = r->in.account_name->string;
3770 if (account == NULL) {
3771 return NT_STATUS_NO_MEMORY;
3772 }
3773
3774 nt_status = can_create(p->mem_ctx, account);
3775 if (!NT_STATUS_IS_OK(nt_status)) {
3776 return nt_status;
3777 }
3778
3779 /* determine which user right we need to check based on the acb_info */
3780
3781 if (geteuid() == sec_initial_uid()) {
3782 can_add_account = true;
3783 } else if (acb_info & ACB_WSTRUST) {
3784 needed_priv = SEC_PRIV_MACHINE_ACCOUNT;
3785 can_add_account = security_token_has_privilege(p->session_info->security_token, SEC_PRIV_MACHINE_ACCOUNT);
3786 } else if (acb_info & ACB_NORMAL &&
3787 (account[strlen(account)-1] != '$')) {
3788 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3789 account for domain trusts and changes the ACB flags later */
3790 needed_priv = SEC_PRIV_ADD_USERS;
3791 can_add_account = security_token_has_privilege(p->session_info->security_token, SEC_PRIV_ADD_USERS);
3792 } else if (lp_enable_privileges()) {
3793 /* implicit assumption of a BDC or domain trust account here
3794 * (we already check the flags earlier) */
3795 /* only Domain Admins can add a BDC or domain trust */
3796 can_add_account = nt_token_check_domain_rid(
3797 p->session_info->security_token,
3798 DOMAIN_RID_ADMINS );
3799 }
3800
3801 DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3802 uidtoname(p->session_info->unix_token->uid),
3803 can_add_account ? "True":"False" ));
3804
3805 if (!can_add_account) {
3806 return NT_STATUS_ACCESS_DENIED;
3807 }
3808
3809 /********** BEGIN Admin BLOCK **********/
3810
3811 become_root();
3812 nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3813 r->out.rid);
3814 unbecome_root();
3815
3816 /********** END Admin BLOCK **********/
3817
3818 /* now check for failure */
3819
3820 if ( !NT_STATUS_IS_OK(nt_status) )
3821 return nt_status;
3822
3823 /* Get the user's SID */
3824
3825 sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3826
3827 map_max_allowed_access(p->session_info->security_token,
3828 p->session_info->unix_token,
3829 &des_access);
3830
3831 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3832 &sid, SAMR_USR_RIGHTS_WRITE_PW);
3833 se_map_generic(&des_access, &usr_generic_mapping);
3834
3835 /*
3836 * JRA - TESTME. We just created this user so we
3837 * had rights to create them. Do we need to check
3838 * any further access on this object ? Can't we
3839 * just assume we have all the rights we need ?
3840 */
3841
3842 nt_status = access_check_object(psd, p->session_info->security_token,
3843 needed_priv, SEC_PRIV_INVALID,
3844 GENERIC_RIGHTS_USER_WRITE, des_access,
3845 &acc_granted, "_samr_CreateUser2");
3846
3847 if ( !NT_STATUS_IS_OK(nt_status) ) {
3848 return nt_status;
3849 }
3850
3851 uinfo = policy_handle_create(p, r->out.user_handle, acc_granted,
3852 struct samr_user_info, &nt_status);
3853 if (!NT_STATUS_IS_OK(nt_status)) {
3854 return nt_status;
3855 }
3856 uinfo->sid = sid;
3857
3858 /* After a "set" ensure we have no cached display info. */
3859 force_flush_samr_cache(&sid);
3860
3861 *r->out.access_granted = acc_granted;
3862
3863 return NT_STATUS_OK;
3864 }
3865
3866 /****************************************************************
3867 ****************************************************************/
3868
3869 NTSTATUS _samr_CreateUser(struct pipes_struct *p,
3870 struct samr_CreateUser *r)
3871 {
3872 struct samr_CreateUser2 c;
3873 uint32_t access_granted;
3874
3875 c.in.domain_handle = r->in.domain_handle;
3876 c.in.account_name = r->in.account_name;
3877 c.in.acct_flags = ACB_NORMAL;
3878 c.in.access_mask = r->in.access_mask;
3879 c.out.user_handle = r->out.user_handle;
3880 c.out.access_granted = &access_granted;
3881 c.out.rid = r->out.rid;
3882
3883 return _samr_CreateUser2(p, &c);
3884 }
3885
3886 /*******************************************************************
3887 _samr_Connect
3888 ********************************************************************/
3889
3890 NTSTATUS _samr_Connect(struct pipes_struct *p,
3891 struct samr_Connect *r)
3892 {
3893 uint32_t acc_granted;
3894 struct policy_handle hnd;
3895 uint32 des_access = r->in.access_mask;
3896 NTSTATUS status;
3897
3898 /* Access check */
3899
3900 if (!pipe_access_check(p)) {
3901 DEBUG(3, ("access denied to _samr_Connect\n"));
3902 return NT_STATUS_ACCESS_DENIED;
3903 }
3904
3905 /* don't give away the farm but this is probably ok. The SAMR_ACCESS_ENUM_DOMAINS
3906 was observed from a win98 client trying to enumerate users (when configured
3907 user level access control on shares) --jerry */
3908
3909 map_max_allowed_access(p->session_info->security_token,
3910 p->session_info->unix_token,
3911 &des_access);
3912
3913 se_map_generic( &des_access, &sam_generic_mapping );
3914
3915 acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS
3916 |SAMR_ACCESS_LOOKUP_DOMAIN);
3917
3918 /* set up the SAMR connect_anon response */
3919
3920 (void)policy_handle_create(p, &hnd, acc_granted,
3921 struct samr_connect_info,
3922 &status);
3923 if (!NT_STATUS_IS_OK(status)) {
3924 return status;
3925 }
3926
3927 *r->out.connect_handle = hnd;
3928 return NT_STATUS_OK;
3929 }
3930
3931 /*******************************************************************
3932 _samr_Connect2
3933 ********************************************************************/
3934
3935 NTSTATUS _samr_Connect2(struct pipes_struct *p,
3936 struct samr_Connect2 *r)
3937 {
3938 struct policy_handle hnd;
3939 struct security_descriptor *psd = NULL;
3940 uint32 acc_granted;
3941 uint32 des_access = r->in.access_mask;
3942 NTSTATUS nt_status;
3943 size_t sd_size;
3944 const char *fn = "_samr_Connect2";
3945
3946 switch (p->opnum) {
3947 case NDR_SAMR_CONNECT2:
3948 fn = "_samr_Connect2";
3949 break;
3950 case NDR_SAMR_CONNECT3:
3951 fn = "_samr_Connect3";
3952 break;
3953 case NDR_SAMR_CONNECT4:
3954 fn = "_samr_Connect4";
3955 break;
3956 case NDR_SAMR_CONNECT5:
3957 fn = "_samr_Connect5";
3958 break;
3959 }
3960
3961 DEBUG(5,("%s: %d\n", fn, __LINE__));
3962
3963 /* Access check */
3964
3965 if (!pipe_access_check(p)) {
3966 DEBUG(3, ("access denied to %s\n", fn));
3967 return NT_STATUS_ACCESS_DENIED;
3968 }
3969
3970 map_max_allowed_access(p->session_info->security_token,
3971 p->session_info->unix_token,
3972 &des_access);
3973
3974 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3975 se_map_generic(&des_access, &sam_generic_mapping);
3976
3977 nt_status = access_check_object(psd, p->session_info->security_token,
3978 SEC_PRIV_INVALID, SEC_PRIV_INVALID,
3979 0, des_access, &acc_granted, fn);
3980
3981 if ( !NT_STATUS_IS_OK(nt_status) )
3982 return nt_status;
3983
3984 (void)policy_handle_create(p, &hnd, acc_granted,
3985 struct samr_connect_info, &nt_status);
3986 if (!NT_STATUS_IS_OK(nt_status)) {
3987 return nt_status;
3988 }
3989
3990 DEBUG(5,("%s: %d\n", fn, __LINE__));
3991
3992 *r->out.connect_handle = hnd;
3993 return NT_STATUS_OK;
3994 }
3995
3996 /****************************************************************
3997 _samr_Connect3
3998 ****************************************************************/
3999
4000 NTSTATUS _samr_Connect3(struct pipes_struct *p,
4001 struct samr_Connect3 *r)
4002 {
4003 struct samr_Connect2 c;
4004
4005 c.in.system_name = r->in.system_name;
4006 c.in.access_mask = r->in.access_mask;
4007 c.out.connect_handle = r->out.connect_handle;
4008
4009 return _samr_Connect2(p, &c);
4010 }
4011
4012 /*******************************************************************
4013 _samr_Connect4
4014 ********************************************************************/
4015
4016 NTSTATUS _samr_Connect4(struct pipes_struct *p,
4017 struct samr_Connect4 *r)
4018 {
4019 struct samr_Connect2 c;
4020
4021 c.in.system_name = r->in.system_name;
4022 c.in.access_mask = r->in.access_mask;
4023 c.out.connect_handle = r->out.connect_handle;
4024
4025 return _samr_Connect2(p, &c);
4026 }
4027
4028 /*******************************************************************
4029 _samr_Connect5
4030 ********************************************************************/
4031
4032 NTSTATUS _samr_Connect5(struct pipes_struct *p,
4033 struct samr_Connect5 *r)
4034 {
4035 NTSTATUS status;
4036 struct samr_Connect2 c;
4037 struct samr_ConnectInfo1 info1;
4038
4039 info1.client_version = SAMR_CONNECT_AFTER_W2K;
4040 info1.unknown2 = 0;
4041
4042 c.in.system_name = r->in.system_name;
4043 c.in.access_mask = r->in.access_mask;
4044 c.out.connect_handle = r->out.connect_handle;
4045
4046 *r->out.level_out = 1;
4047
4048 status = _samr_Connect2(p, &c);
4049 if (!NT_STATUS_IS_OK(status)) {
4050 return status;
4051 }
4052
4053 r->out.info_out->info1 = info1;
4054
4055 return NT_STATUS_OK;
4056 }
4057
4058 /**********************************************************************
4059 _samr_LookupDomain
4060 **********************************************************************/
4061
4062 NTSTATUS _samr_LookupDomain(struct pipes_struct *p,
4063 struct samr_LookupDomain *r)
4064 {
4065 NTSTATUS status;
4066 const char *domain_name;
4067 struct dom_sid *sid = NULL;
4068
4069 /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
4070 Reverted that change so we will work with RAS servers again */
4071
4072 (void)policy_handle_find(p, r->in.connect_handle,
4073 SAMR_ACCESS_LOOKUP_DOMAIN, NULL,
4074 struct samr_connect_info,
4075 &status);
4076 if (!NT_STATUS_IS_OK(status)) {
4077 return status;
4078 }
4079
4080 domain_name = r->in.domain_name->string;
4081 if (!domain_name) {
4082 return NT_STATUS_INVALID_PARAMETER;
4083 }
4084
4085 sid = talloc_zero(p->mem_ctx, struct dom_sid2);
4086 if (!sid) {
4087 return NT_STATUS_NO_MEMORY;
4088 }
4089
4090 if (strequal(domain_name, builtin_domain_name())) {
4091 sid_copy(sid, &global_sid_Builtin);
4092 } else {
4093 if (!secrets_fetch_domain_sid(domain_name, sid)) {
4094 status = NT_STATUS_NO_SUCH_DOMAIN;
4095 }
4096 }
4097
4098 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
4099 sid_string_dbg(sid)));
4100
4101 *r->out.sid = sid;
4102
4103 return status;
4104 }
4105
4106 /**********************************************************************
4107 _samr_EnumDomains
4108 **********************************************************************/
4109
4110 NTSTATUS _samr_EnumDomains(struct pipes_struct *p,
4111 struct samr_EnumDomains *r)
4112 {
4113 NTSTATUS status;
4114 uint32_t num_entries = 2;
4115 struct samr_SamEntry *entry_array = NULL;
4116 struct samr_SamArray *sam;
4117
4118 (void)policy_handle_find(p, r->in.connect_handle,
4119 SAMR_ACCESS_ENUM_DOMAINS, NULL,
4120 struct samr_connect_info, &status);
4121 if (!NT_STATUS_IS_OK(status)) {
4122 return status;
4123 }
4124
4125 sam = talloc_zero(p->mem_ctx, struct samr_SamArray);
4126 if (!sam) {
4127 return NT_STATUS_NO_MEMORY;
4128 }
4129
4130 entry_array = talloc_zero_array(p->mem_ctx,
4131 struct samr_SamEntry,
4132 num_entries);
4133 if (!entry_array) {
4134 return NT_STATUS_NO_MEMORY;
4135 }
4136
4137 entry_array[0].idx = 0;
4138 init_lsa_String(&entry_array[0].name, get_global_sam_name());
4139
4140 entry_array[1].idx = 1;
4141 init_lsa_String(&entry_array[1].name, "Builtin");
4142
4143 sam->count = num_entries;
4144 sam->entries = entry_array;
4145
4146 *r->out.sam = sam;
4147 *r->out.num_entries = num_entries;
4148
4149 return status;
4150 }
4151
4152 /*******************************************************************
4153 _samr_OpenAlias
4154 ********************************************************************/
4155
4156 NTSTATUS _samr_OpenAlias(struct pipes_struct *p,
4157 struct samr_OpenAlias *r)
4158 {
4159 struct dom_sid sid;
4160 uint32 alias_rid = r->in.rid;
4161 struct samr_alias_info *ainfo;
4162 struct samr_domain_info *dinfo;
4163 struct security_descriptor *psd = NULL;
4164 uint32 acc_granted;
4165 uint32 des_access = r->in.access_mask;
4166 size_t sd_size;
4167 NTSTATUS status;
4168
4169 dinfo = policy_handle_find(p, r->in.domain_handle,
4170 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
4171 struct samr_domain_info, &status);
4172 if (!NT_STATUS_IS_OK(status)) {
4173 return status;
4174 }
4175
4176 /* append the alias' RID to it */
4177
4178 if (!sid_compose(&sid, &dinfo->sid, alias_rid))
4179 return NT_STATUS_NO_SUCH_ALIAS;
4180
4181 /*check if access can be granted as requested by client. */
4182
4183 map_max_allowed_access(p->session_info->security_token,
4184 p->session_info->unix_token,
4185 &des_access);
4186
4187 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
4188 se_map_generic(&des_access,&ali_generic_mapping);
4189
4190 status = access_check_object(psd, p->session_info->security_token,
4191 SEC_PRIV_ADD_USERS, SEC_PRIV_INVALID,
4192 GENERIC_RIGHTS_ALIAS_ALL_ACCESS,
4193 des_access, &acc_granted, "_samr_OpenAlias");
4194
4195 if ( !NT_STATUS_IS_OK(status) )
4196 return status;
4197
4198 {
4199 /* Check we actually have the requested alias */
4200 enum lsa_SidType type;
4201 bool result;
4202 gid_t gid;
4203
4204 become_root();
4205 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
4206 unbecome_root();
4207
4208 if (!result || (type != SID_NAME_ALIAS)) {
4209 return NT_STATUS_NO_SUCH_ALIAS;
4210 }
4211
4212 /* make sure there is a mapping */
4213
4214 if ( !sid_to_gid( &sid, &gid ) ) {
4215 return NT_STATUS_NO_SUCH_ALIAS;
4216 }
4217
4218 }
4219
4220 ainfo = policy_handle_create(p, r->out.alias_handle, acc_granted,
4221 struct samr_alias_info, &status);
4222 if (!NT_STATUS_IS_OK(status)) {
4223 return status;
4224 }
4225 ainfo->sid = sid;
4226
4227 return NT_STATUS_OK;
4228 }
4229
4230 /*******************************************************************
4231 set_user_info_2
4232 ********************************************************************/
4233
4234 static NTSTATUS set_user_info_2(TALLOC_CTX *mem_ctx,
4235 struct samr_UserInfo2 *id2,
4236 struct samu *pwd)
4237 {
4238 if (id2 == NULL) {
4239 DEBUG(5,("set_user_info_2: NULL id2\n"));
4240 return NT_STATUS_ACCESS_DENIED;
4241 }
4242
4243 copy_id2_to_sam_passwd(pwd, id2);
4244
4245 return pdb_update_sam_account(pwd);
4246 }
4247
4248 /*******************************************************************
4249 set_user_info_4
4250 ********************************************************************/
4251
4252 static NTSTATUS set_user_info_4(TALLOC_CTX *mem_ctx,
4253 struct samr_UserInfo4 *id4,
4254 struct samu *pwd)
4255 {
4256 if (id4 == NULL) {
4257 DEBUG(5,("set_user_info_2: NULL id4\n"));
4258 return NT_STATUS_ACCESS_DENIED;
4259 }
4260
4261 copy_id4_to_sam_passwd(pwd, id4);
4262
4263 return pdb_update_sam_account(pwd);
4264 }
4265
4266 /*******************************************************************
4267 set_user_info_6
4268 ********************************************************************/
4269
4270 static NTSTATUS set_user_info_6(TALLOC_CTX *mem_ctx,
4271 struct samr_UserInfo6 *id6,
4272 struct samu *pwd)
4273 {
4274 if (id6 == NULL) {
4275 DEBUG(5,("set_user_info_6: NULL id6\n"));
4276 return NT_STATUS_ACCESS_DENIED;
4277 }
4278
4279 copy_id6_to_sam_passwd(pwd, id6);
4280
4281 return pdb_update_sam_account(pwd);
4282 }
4283
4284 /*******************************************************************
4285 set_user_info_7
4286 ********************************************************************/
4287
4288 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
4289 struct samr_UserInfo7 *id7,
4290 struct samu *pwd)
4291 {
4292 NTSTATUS rc;
4293
4294 if (id7 == NULL) {
4295 DEBUG(5, ("set_user_info_7: NULL id7\n"));
4296 return NT_STATUS_ACCESS_DENIED;
4297 }
4298
4299 if (!id7->account_name.string) {
4300 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
4301 return NT_STATUS_ACCESS_DENIED;
4302 }
4303
4304 /* check to see if the new username already exists. Note: we can't
4305 reliably lock all backends, so there is potentially the
4306 possibility that a user can be created in between this check and
4307 the rename. The rename should fail, but may not get the
4308 exact same failure status code. I think this is small enough
4309 of a window for this type of operation and the results are
4310 simply that the rename fails with a slightly different status
4311 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4312
4313 rc = can_create(mem_ctx, id7->account_name.string);
4314
4315 /* when there is nothing to change, we're done here */
4316 if (NT_STATUS_EQUAL(rc, NT_STATUS_USER_EXISTS) &&
4317 strequal(id7->account_name.string, pdb_get_username(pwd))) {
4318 return NT_STATUS_OK;
4319 }
4320 if (!NT_STATUS_IS_OK(rc)) {
4321 return rc;
4322 }
4323
4324 rc = pdb_rename_sam_account(pwd, id7->account_name.string);
4325
4326 return rc;
4327 }
4328
4329 /*******************************************************************
4330 set_user_info_8
4331 ********************************************************************/
4332
4333 static NTSTATUS set_user_info_8(TALLOC_CTX *mem_ctx,
4334 struct samr_UserInfo8 *id8,
4335 struct samu *pwd)
4336 {
4337 if (id8 == NULL) {
4338 DEBUG(5,("set_user_info_8: NULL id8\n"));
4339 return NT_STATUS_ACCESS_DENIED;
4340 }
4341
4342 copy_id8_to_sam_passwd(pwd, id8);
4343
4344 return pdb_update_sam_account(pwd);
4345 }
4346
4347 /*******************************************************************
4348 set_user_info_10
4349 ********************************************************************/
4350
4351 static NTSTATUS set_user_info_10(TALLOC_CTX *mem_ctx,
4352 struct samr_UserInfo10 *id10,
4353 struct samu *pwd)
4354 {
4355 if (id10 == NULL) {
4356 DEBUG(5,("set_user_info_8: NULL id10\n"));
4357 return NT_STATUS_ACCESS_DENIED;
4358 }
4359
4360 copy_id10_to_sam_passwd(pwd, id10);
4361
4362 return pdb_update_sam_account(pwd);
4363 }
4364
4365 /*******************************************************************
4366 set_user_info_11
4367 ********************************************************************/
4368
4369 static NTSTATUS set_user_info_11(TALLOC_CTX *mem_ctx,
4370 struct samr_UserInfo11 *id11,
4371 struct samu *pwd)
4372 {
4373 if (id11 == NULL) {
4374 DEBUG(5,("set_user_info_11: NULL id11\n"));
4375 return NT_STATUS_ACCESS_DENIED;
4376 }
4377
4378 copy_id11_to_sam_passwd(pwd, id11);
4379
4380 return pdb_update_sam_account(pwd);
4381 }
4382
4383 /*******************************************************************
4384 set_user_info_12
4385 ********************************************************************/
4386
4387 static NTSTATUS set_user_info_12(TALLOC_CTX *mem_ctx,
4388 struct samr_UserInfo12 *id12,
4389 struct samu *pwd)
4390 {
4391 if (id12 == NULL) {
4392 DEBUG(5,("set_user_info_12: NULL id12\n"));
4393 return NT_STATUS_ACCESS_DENIED;
4394 }
4395
4396 copy_id12_to_sam_passwd(pwd, id12);
4397
4398 return pdb_update_sam_account(pwd);
4399 }
4400
4401 /*******************************************************************
4402 set_user_info_13
4403 ********************************************************************/
4404
4405 static NTSTATUS set_user_info_13(TALLOC_CTX *mem_ctx,
4406 struct samr_UserInfo13 *id13,
4407 struct samu *pwd)
4408 {
4409 if (id13 == NULL) {
4410 DEBUG(5,("set_user_info_13: NULL id13\n"));
4411 return NT_STATUS_ACCESS_DENIED;
4412 }
4413
4414 copy_id13_to_sam_passwd(pwd, id13);
4415
4416 return pdb_update_sam_account(pwd);
4417 }
4418
4419 /*******************************************************************
4420 set_user_info_14
4421 ********************************************************************/
4422
4423 static NTSTATUS set_user_info_14(TALLOC_CTX *mem_ctx,
4424 struct samr_UserInfo14 *id14,
4425 struct samu *pwd)
4426 {
4427 if (id14 == NULL) {
4428 DEBUG(5,("set_user_info_14: NULL id14\n"));
4429 return NT_STATUS_ACCESS_DENIED;
4430 }
4431
4432 copy_id14_to_sam_passwd(pwd, id14);
4433
4434 return pdb_update_sam_account(pwd);
4435 }
4436
4437 /*******************************************************************
4438 set_user_info_16
4439 ********************************************************************/
4440
4441 static NTSTATUS set_user_info_16(TALLOC_CTX *mem_ctx,
4442 struct samr_UserInfo16 *id16,
4443 struct samu *pwd)
4444 {
4445 if (id16 == NULL) {
4446 DEBUG(5,("set_user_info_16: NULL id16\n"));
4447 return NT_STATUS_ACCESS_DENIED;
4448 }
4449
4450 copy_id16_to_sam_passwd(pwd, id16);
4451
4452 return pdb_update_sam_account(pwd);
4453 }
4454
4455 /*******************************************************************
4456 set_user_info_17
4457 ********************************************************************/
4458
4459 static NTSTATUS set_user_info_17(TALLOC_CTX *mem_ctx,
4460 struct samr_UserInfo17 *id17,
4461 struct samu *pwd)
4462 {
4463 if (id17 == NULL) {
4464 DEBUG(5,("set_user_info_17: NULL id17\n"));
4465 return NT_STATUS_ACCESS_DENIED;
4466 }
4467
4468 copy_id17_to_sam_passwd(pwd, id17);
4469
4470 return pdb_update_sam_account(pwd);
4471 }
4472
4473 /*******************************************************************
4474 set_user_info_18
4475 ********************************************************************/
4476
4477 static NTSTATUS set_user_info_18(struct samr_UserInfo18 *id18,
4478 TALLOC_CTX *mem_ctx,
4479 DATA_BLOB *session_key,
4480 struct samu *pwd)
4481 {
4482 if (id18 == NULL) {
4483 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
4484 return NT_STATUS_INVALID_PARAMETER;
4485 }
4486
4487 if (id18->nt_pwd_active || id18->lm_pwd_active) {
4488 if (!session_key->length) {
4489 return NT_STATUS_NO_USER_SESSION_KEY;
4490 }
4491 }
4492
4493 if (id18->nt_pwd_active) {
4494
4495 DATA_BLOB in, out;
4496
4497 in = data_blob_const(id18->nt_pwd.hash, 16);
4498 out = data_blob_talloc_zero(mem_ctx, 16);
4499
4500 sess_crypt_blob(&out, &in, session_key, false);
4501
4502 if (!pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED)) {
4503 return NT_STATUS_ACCESS_DENIED;
4504 }
4505
4506 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4507 }
4508
4509 if (id18->lm_pwd_active) {
4510
4511 DATA_BLOB in, out;
4512
4513 in = data_blob_const(id18->lm_pwd.hash, 16);
4514 out = data_blob_talloc_zero(mem_ctx, 16);
4515
4516 sess_crypt_blob(&out, &in, session_key, false);
4517
4518 if (!pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED)) {
4519 return NT_STATUS_ACCESS_DENIED;
4520 }
4521
4522 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4523 }
4524
4525 copy_id18_to_sam_passwd(pwd, id18);
4526
4527 return pdb_update_sam_account(pwd);
4528 }
4529
4530 /*******************************************************************
4531 set_user_info_20
4532 ********************************************************************/
4533
4534 static NTSTATUS set_user_info_20(TALLOC_CTX *mem_ctx,
4535 struct samr_UserInfo20 *id20,
4536 struct samu *pwd)
4537 {
4538 if (id20 == NULL) {
4539 DEBUG(5,("set_user_info_20: NULL id20\n"));
4540 return NT_STATUS_ACCESS_DENIED;
4541 }
4542
4543 copy_id20_to_sam_passwd(pwd, id20);
4544
4545 return pdb_update_sam_account(pwd);
4546 }
4547
4548 /*******************************************************************
4549 set_user_info_21
4550 ********************************************************************/
4551
4552 static NTSTATUS set_user_info_21(struct samr_UserInfo21 *id21,
4553 TALLOC_CTX *mem_ctx,
4554 DATA_BLOB *session_key,
4555 struct samu *pwd)
4556 {
4557 NTSTATUS status;
4558
4559 if (id21 == NULL) {
4560 DEBUG(5, ("set_user_info_21: NULL id21\n"));
4561 return NT_STATUS_INVALID_PARAMETER;
4562 }
4563
4564 if (id21->fields_present == 0) {
4565 return NT_STATUS_INVALID_PARAMETER;
4566 }
4567
4568 if (id21->fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4569 return NT_STATUS_ACCESS_DENIED;
4570 }
4571
4572 if (id21->fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
4573 if (id21->nt_password_set) {
4574 DATA_BLOB in, out;
4575
4576 if ((id21->nt_owf_password.length != 16) ||
4577 (id21->nt_owf_password.size != 16)) {
4578 return NT_STATUS_INVALID_PARAMETER;
4579 }
4580
4581 if (!session_key->length) {
4582 return NT_STATUS_NO_USER_SESSION_KEY;
4583 }
4584
4585 in = data_blob_const(id21->nt_owf_password.array, 16);
4586 out = data_blob_talloc_zero(mem_ctx, 16);
4587
4588 sess_crypt_blob(&out, &in, session_key, false);
4589
4590 pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED);
4591 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4592 }
4593 }
4594
4595 if (id21->fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
4596 if (id21->lm_password_set) {
4597 DATA_BLOB in, out;
4598
4599 if ((id21->lm_owf_password.length != 16) ||
4600 (id21->lm_owf_password.size != 16)) {
4601 return NT_STATUS_INVALID_PARAMETER;
4602 }
4603
4604 if (!session_key->length) {
4605 return NT_STATUS_NO_USER_SESSION_KEY;
4606 }
4607
4608 in = data_blob_const(id21->lm_owf_password.array, 16);
4609 out = data_blob_talloc_zero(mem_ctx, 16);
4610
4611 sess_crypt_blob(&out, &in, session_key, false);
4612
4613 pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED);
4614 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4615 }
4616 }
4617
4618 /* we need to separately check for an account rename first */
4619
4620 if (id21->account_name.string &&
4621 (!strequal(id21->account_name.string, pdb_get_username(pwd))))
4622 {
4623
4624 /* check to see if the new username already exists. Note: we can't
4625 reliably lock all backends, so there is potentially the
4626 possibility that a user can be created in between this check and
4627 the rename. The rename should fail, but may not get the
4628 exact same failure status code. I think this is small enough
4629 of a window for this type of operation and the results are
4630 simply that the rename fails with a slightly different status
4631 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4632
4633 status = can_create(mem_ctx, id21->account_name.string);
4634 if (!NT_STATUS_IS_OK(status)) {
4635 return status;
4636 }
4637
4638 status = pdb_rename_sam_account(pwd, id21->account_name.string);
4639
4640 if (!NT_STATUS_IS_OK(status)) {
4641 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
4642 nt_errstr(status)));
4643 return status;
4644 }
4645
4646 /* set the new username so that later
4647 functions can work on the new account */
4648 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
4649 }
4650
4651 copy_id21_to_sam_passwd("INFO_21", pwd, id21);
4652
4653 /*
4654 * The funny part about the previous two calls is
4655 * that pwd still has the password hashes from the
4656 * passdb entry. These have not been updated from
4657 * id21. I don't know if they need to be set. --jerry
4658 */
4659
4660 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4661 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4662 if ( !NT_STATUS_IS_OK(status) ) {
4663 return status;
4664 }
4665 }
4666
4667 /* Don't worry about writing out the user account since the
4668 primary group SID is generated solely from the user's Unix
4669 primary group. */
4670
4671 /* write the change out */
4672 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4673 return status;
4674 }
4675
4676 return NT_STATUS_OK;
4677 }
4678
4679 /*******************************************************************
4680 set_user_info_23
4681 ********************************************************************/
4682
4683 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
4684 struct samr_UserInfo23 *id23,
4685 const char *rhost,
4686 struct samu *pwd)
4687 {
4688 char *plaintext_buf = NULL;
4689 size_t len = 0;
4690 uint32_t acct_ctrl;
4691 NTSTATUS status;
4692
4693 if (id23 == NULL) {
4694 DEBUG(5, ("set_user_info_23: NULL id23\n"));
4695 return NT_STATUS_INVALID_PARAMETER;
4696 }
4697
4698 if (id23->info.fields_present == 0) {
4699 return NT_STATUS_INVALID_PARAMETER;
4700 }
4701
4702 if (id23->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4703 return NT_STATUS_ACCESS_DENIED;
4704 }
4705
4706 if ((id23->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4707 (id23->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4708
4709 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
4710 pdb_get_username(pwd)));
4711
4712 if (!decode_pw_buffer(mem_ctx,
4713 id23->password.data,
4714 &plaintext_buf,
4715 &len,
4716 CH_UTF16)) {
4717 return NT_STATUS_WRONG_PASSWORD;
4718 }
4719
4720 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
4721 return NT_STATUS_ACCESS_DENIED;
4722 }
4723 }
4724
4725 copy_id23_to_sam_passwd(pwd, id23);
4726
4727 acct_ctrl = pdb_get_acct_ctrl(pwd);
4728
4729 /* if it's a trust account, don't update /etc/passwd */
4730 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
4731 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
4732 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
4733 DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
4734 } else if (plaintext_buf) {
4735 /* update the UNIX password */
4736 if (lp_unix_password_sync() ) {
4737 struct passwd *passwd;
4738 if (pdb_get_username(pwd) == NULL) {
4739 DEBUG(1, ("chgpasswd: User without name???\n"));
4740 return NT_STATUS_ACCESS_DENIED;
4741 }
4742
4743 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
4744 if (passwd == NULL) {
4745 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4746 }
4747
4748 if(!chgpasswd(pdb_get_username(pwd), rhost,
4749 passwd, "", plaintext_buf, True)) {
4750 return NT_STATUS_ACCESS_DENIED;
4751 }
4752 TALLOC_FREE(passwd);
4753 }
4754 }
4755
4756 if (plaintext_buf) {
4757 memset(plaintext_buf, '\0', strlen(plaintext_buf));
4758 }
4759
4760 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
4761 (!NT_STATUS_IS_OK(status = pdb_set_unix_primary_group(mem_ctx,
4762 pwd)))) {
4763 return status;
4764 }
4765
4766 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4767 return status;
4768 }
4769
4770 return NT_STATUS_OK;
4771 }
4772
4773 /*******************************************************************
4774 set_user_info_pw
4775 ********************************************************************/
4776
4777 static bool set_user_info_pw(uint8 *pass, const char *rhost, struct samu *pwd)
4778 {
4779 size_t len = 0;
4780 char *plaintext_buf = NULL;
4781 uint32 acct_ctrl;
4782
4783 DEBUG(5, ("Attempting administrator password change for user %s\n",
4784 pdb_get_username(pwd)));
4785
4786 acct_ctrl = pdb_get_acct_ctrl(pwd);
4787
4788 if (!decode_pw_buffer(talloc_tos(),
4789 pass,
4790 &plaintext_buf,
4791 &len,
4792 CH_UTF16)) {
4793 return False;
4794 }
4795
4796 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
4797 return False;
4798 }
4799
4800 /* if it's a trust account, don't update /etc/passwd */
4801 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
4802 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
4803 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
4804 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
4805 } else {
4806 /* update the UNIX password */
4807 if (lp_unix_password_sync()) {
4808 struct passwd *passwd;
4809
4810 if (pdb_get_username(pwd) == NULL) {
4811 DEBUG(1, ("chgpasswd: User without name???\n"));
4812 return False;
4813 }
4814
4815 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
4816 if (passwd == NULL) {
4817 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4818 }
4819
4820 if(!chgpasswd(pdb_get_username(pwd), rhost, passwd,
4821 "", plaintext_buf, True)) {
4822 return False;
4823 }
4824 TALLOC_FREE(passwd);
4825 }
4826 }
4827
4828 memset(plaintext_buf, '\0', strlen(plaintext_buf));
4829
4830 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4831
4832 return True;
4833 }
4834
4835 /*******************************************************************
4836 set_user_info_24
4837 ********************************************************************/
4838
4839 static NTSTATUS set_user_info_24(TALLOC_CTX *mem_ctx,
4840 const char *rhost,
4841 struct samr_UserInfo24 *id24,
4842 struct samu *pwd)
4843 {
4844 NTSTATUS status;
4845
4846 if (id24 == NULL) {
4847 DEBUG(5, ("set_user_info_24: NULL id24\n"));
4848 return NT_STATUS_INVALID_PARAMETER;
4849 }
4850
4851 if (!set_user_info_pw(id24->password.data, rhost, pwd)) {
4852 return NT_STATUS_WRONG_PASSWORD;
4853 }
4854
4855 copy_id24_to_sam_passwd(pwd, id24);
4856
4857 status = pdb_update_sam_account(pwd);
4858 if (!NT_STATUS_IS_OK(status)) {
4859 return status;
4860 }
4861
4862 return NT_STATUS_OK;
4863 }
4864
4865 /*******************************************************************
4866 set_user_info_25
4867 ********************************************************************/
4868
4869 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
4870 const char *rhost,
4871 struct samr_UserInfo25 *id25,
4872 struct samu *pwd)
4873 {
4874 NTSTATUS status;
4875
4876 if (id25 == NULL) {
4877 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4878 return NT_STATUS_INVALID_PARAMETER;
4879 }
4880
4881 if (id25->info.fields_present == 0) {
4882 return NT_STATUS_INVALID_PARAMETER;
4883 }
4884
4885 if (id25->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4886 return NT_STATUS_ACCESS_DENIED;
4887 }
4888
4889 if ((id25->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4890 (id25->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4891
4892 if (!set_user_info_pw(id25->password.data, rhost, pwd)) {
4893 return NT_STATUS_WRONG_PASSWORD;
4894 }
4895 }
4896
4897 copy_id25_to_sam_passwd(pwd, id25);
4898
4899 /* write the change out */
4900 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4901 return status;
4902 }
4903
4904 /*
4905 * We need to "pdb_update_sam_account" before the unix primary group
4906 * is set, because the idealx scripts would also change the
4907 * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4908 * the delete explicit / add explicit, which would then fail to find
4909 * the previous primaryGroupSid value.
4910 */
4911
4912 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4913 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4914 if ( !NT_STATUS_IS_OK(status) ) {
4915 return status;
4916 }
4917 }
4918
4919 return NT_STATUS_OK;
4920 }
4921
4922 /*******************************************************************
4923 set_user_info_26
4924 ********************************************************************/
4925
4926 static NTSTATUS set_user_info_26(TALLOC_CTX *mem_ctx,
4927 const char *rhost,
4928 struct samr_UserInfo26 *id26,
4929 struct samu *pwd)
4930 {
4931 NTSTATUS status;
4932
4933 if (id26 == NULL) {
4934 DEBUG(5, ("set_user_info_26: NULL id26\n"));
4935 return NT_STATUS_INVALID_PARAMETER;
4936 }
4937
4938 if (!set_user_info_pw(id26->password.data, rhost, pwd)) {
4939 return NT_STATUS_WRONG_PASSWORD;
4940 }
4941
4942 copy_id26_to_sam_passwd(pwd, id26);
4943
4944 status = pdb_update_sam_account(pwd);
4945 if (!NT_STATUS_IS_OK(status)) {
4946 return status;
4947 }
4948
4949 return NT_STATUS_OK;
4950 }
4951
4952 /*************************************************************
4953 **************************************************************/
4954
4955 static uint32_t samr_set_user_info_map_fields_to_access_mask(uint32_t fields)
4956 {
4957 uint32_t acc_required = 0;
4958
4959 /* USER_ALL_USERNAME */
4960 if (fields & SAMR_FIELD_ACCOUNT_NAME)
4961 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4962 /* USER_ALL_FULLNAME */
4963 if (fields & SAMR_FIELD_FULL_NAME)
4964 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4965 /* USER_ALL_PRIMARYGROUPID */
4966 if (fields & SAMR_FIELD_PRIMARY_GID)
4967 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4968 /* USER_ALL_HOMEDIRECTORY */
4969 if (fields & SAMR_FIELD_HOME_DIRECTORY)
4970 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4971 /* USER_ALL_HOMEDIRECTORYDRIVE */
4972 if (fields & SAMR_FIELD_HOME_DRIVE)
4973 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4974 /* USER_ALL_SCRIPTPATH */
4975 if (fields & SAMR_FIELD_LOGON_SCRIPT)
4976 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4977 /* USER_ALL_PROFILEPATH */
4978 if (fields & SAMR_FIELD_PROFILE_PATH)
4979 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4980 /* USER_ALL_ADMINCOMMENT */
4981 if (fields & SAMR_FIELD_COMMENT)
4982 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4983 /* USER_ALL_WORKSTATIONS */
4984 if (fields & SAMR_FIELD_WORKSTATIONS)
4985 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4986 /* USER_ALL_LOGONHOURS */
4987 if (fields & SAMR_FIELD_LOGON_HOURS)
4988 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4989 /* USER_ALL_ACCOUNTEXPIRES */
4990 if (fields & SAMR_FIELD_ACCT_EXPIRY)
4991 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4992 /* USER_ALL_USERACCOUNTCONTROL */
4993 if (fields & SAMR_FIELD_ACCT_FLAGS)
4994 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4995 /* USER_ALL_PARAMETERS */
4996 if (fields & SAMR_FIELD_PARAMETERS)
4997 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4998 /* USER_ALL_USERCOMMENT */
4999 if (fields & SAMR_FIELD_COMMENT)
5000 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
5001 /* USER_ALL_COUNTRYCODE */
5002 if (fields & SAMR_FIELD_COUNTRY_CODE)
5003 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
5004 /* USER_ALL_CODEPAGE */
5005 if (fields & SAMR_FIELD_CODE_PAGE)
5006 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
5007 /* USER_ALL_NTPASSWORDPRESENT */
5008 if (fields & SAMR_FIELD_NT_PASSWORD_PRESENT)
5009 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
5010 /* USER_ALL_LMPASSWORDPRESENT */
5011 if (fields & SAMR_FIELD_LM_PASSWORD_PRESENT)
5012 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
5013 /* USER_ALL_PASSWORDEXPIRED */
5014 if (fields & SAMR_FIELD_EXPIRED_FLAG)
5015 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
5016
5017 return acc_required;
5018 }
5019
5020 /*******************************************************************
5021 samr_SetUserInfo
5022 ********************************************************************/
5023
5024 NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
5025 struct samr_SetUserInfo *r)
5026 {
5027 struct samr_user_info *uinfo;
5028 NTSTATUS status;
5029 struct samu *pwd = NULL;
5030 union samr_UserInfo *info = r->in.info;
5031 uint32_t acc_required = 0;
5032 uint32_t fields = 0;
5033 bool ret;
5034 char *rhost;
5035 DATA_BLOB session_key;
5036
5037 DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
5038
5039 /* This is tricky. A WinXP domain join sets
5040 (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
5041 The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
5042 standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
5043 This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
5044 we'll use the set from the WinXP join as the basis. */
5045
5046 switch (r->in.level) {
5047 case 2: /* UserPreferencesInformation */
5048 /* USER_WRITE_ACCOUNT | USER_WRITE_PREFERENCES */
5049 acc_required = SAMR_USER_ACCESS_SET_ATTRIBUTES | SAMR_USER_ACCESS_SET_LOC_COM;
5050 break;
5051 case 4: /* UserLogonHoursInformation */
5052 case 6: /* UserNameInformation */
5053 case 7: /* UserAccountNameInformation */
5054 case 8: /* UserFullNameInformation */
5055 case 9: /* UserPrimaryGroupInformation */
5056 case 10: /* UserHomeInformation */
5057 case 11: /* UserScriptInformation */
5058 case 12: /* UserProfileInformation */
5059 case 13: /* UserAdminCommentInformation */
5060 case 14: /* UserWorkStationsInformation */
5061 case 16: /* UserControlInformation */
5062 case 17: /* UserExpiresInformation */
5063 case 20: /* UserParametersInformation */
5064 /* USER_WRITE_ACCOUNT */
5065 acc_required = SAMR_USER_ACCESS_SET_ATTRIBUTES;
5066 break;
5067 case 18: /* UserInternal1Information */
5068 /* FIXME: gd, this is a guess */
5069 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
5070 break;
5071 case 21: /* UserAllInformation */
5072 fields = info->info21.fields_present;
5073 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
5074 break;
5075 case 23: /* UserInternal4Information */
5076 fields = info->info23.info.fields_present;
5077 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
5078 break;
5079 case 25: /* UserInternal4InformationNew */
5080 fields = info->info25.info.fields_present;
5081 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
5082 break;
5083 case 24: /* UserInternal5Information */
5084 case 26: /* UserInternal5InformationNew */
5085 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
5086 break;
5087 default:
5088 return NT_STATUS_INVALID_INFO_CLASS;
5089 }
5090
5091 uinfo = policy_handle_find(p, r->in.user_handle, acc_required, NULL,
5092 struct samr_user_info, &status);
5093 if (!NT_STATUS_IS_OK(status)) {
5094 return status;
5095 }
5096
5097 DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
5098 sid_string_dbg(&uinfo->sid), r->in.level));
5099
5100 if (info == NULL) {
5101 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
5102 return NT_STATUS_INVALID_INFO_CLASS;
5103 }
5104
5105 if (!(pwd = samu_new(NULL))) {
5106 return NT_STATUS_NO_MEMORY;
5107 }
5108
5109 become_root();
5110 ret = pdb_getsampwsid(pwd, &uinfo->sid);
5111 unbecome_root();
5112
5113 if (!ret) {
5114 TALLOC_FREE(pwd);
5115 return NT_STATUS_NO_SUCH_USER;
5116 }
5117
5118 rhost = tsocket_address_inet_addr_string(p->remote_address,
5119 talloc_tos());
5120 if (rhost == NULL) {
5121 return NT_STATUS_NO_MEMORY;
5122 }
5123
5124 /* ================ BEGIN Privilege BLOCK ================ */
5125
5126 become_root();
5127
5128 /* ok! user info levels (lots: see MSDEV help), off we go... */
5129
5130 switch (r->in.level) {
5131
5132 case 2:
5133 status = set_user_info_2(p->mem_ctx,
5134 &info->info2, pwd);
5135 break;
5136
5137 case 4:
5138 status = set_user_info_4(p->mem_ctx,
5139 &info->info4, pwd);
5140 break;
5141
5142 case 6:
5143 status = set_user_info_6(p->mem_ctx,
5144 &info->info6, pwd);
5145 break;
5146
5147 case 7:
5148 status = set_user_info_7(p->mem_ctx,
5149 &info->info7, pwd);
5150 break;
5151
5152 case 8:
5153 status = set_user_info_8(p->mem_ctx,
5154 &info->info8, pwd);
5155 break;
5156
5157 case 10:
5158 status = set_user_info_10(p->mem_ctx,
5159 &info->info10, pwd);
5160 break;
5161
5162 case 11:
5163 status = set_user_info_11(p->mem_ctx,
5164 &info->info11, pwd);
5165 break;
5166
5167 case 12:
5168 status = set_user_info_12(p->mem_ctx,
5169 &info->info12, pwd);
5170 break;
5171
5172 case 13:
5173 status = set_user_info_13(p->mem_ctx,
5174 &info->info13, pwd);
5175 break;
5176
5177 case 14:
5178 status = set_user_info_14(p->mem_ctx,
5179 &info->info14, pwd);
5180 break;
5181
5182 case 16:
5183 status = set_user_info_16(p->mem_ctx,
5184 &info->info16, pwd);
5185 break;
5186
5187 case 17:
5188 status = set_user_info_17(p->mem_ctx,
5189 &info->info17, pwd);
5190 break;
5191
5192 case 18:
5193 status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
5194 if(!NT_STATUS_IS_OK(status)) {
5195 return status;
5196 }
5197 /* Used by AS/U JRA. */
5198 status = set_user_info_18(&info->info18,
5199 p->mem_ctx,
5200 &session_key,
5201 pwd);
5202 break;
5203
5204 case 20:
5205 status = set_user_info_20(p->mem_ctx,
5206 &info->info20, pwd);
5207 break;
5208
5209 case 21:
5210 status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
5211 if(!NT_STATUS_IS_OK(status)) {
5212 return status;
5213 }
5214 status = set_user_info_21(&info->info21,
5215 p->mem_ctx,
5216 &session_key,
5217 pwd);
5218 break;
5219
5220 case 23:
5221 status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
5222 arcfour_crypt_blob(info->info23.password.data, 516,
5223 &session_key);
5224
5225 dump_data(100, info->info23.password.data, 516);
5226
5227 status = set_user_info_23(p->mem_ctx,
5228 &info->info23,
5229 rhost,
5230 pwd);
5231 break;
5232
5233 case 24:
5234 status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
5235 arcfour_crypt_blob(info->info24.password.data,
5236 516,
5237 &session_key);
5238
5239 dump_data(100, info->info24.password.data, 516);
5240
5241 status = set_user_info_24(p->mem_ctx,
5242 rhost,
5243 &info->info24, pwd);
5244 break;
5245
5246 case 25:
5247 status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
5248 encode_or_decode_arc4_passwd_buffer(
5249 info->info25.password.data,
5250 &session_key);
5251
5252 dump_data(100, info->info25.password.data, 532);
5253
5254 status = set_user_info_25(p->mem_ctx,
5255 rhost,
5256 &info->info25, pwd);
5257 break;
5258
5259 case 26:
5260 status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
5261 encode_or_decode_arc4_passwd_buffer(
5262 info->info26.password.data,
5263 &session_key);
5264
5265 dump_data(100, info->info26.password.data, 516);
5266
5267 status = set_user_info_26(p->mem_ctx,
5268 rhost,
5269 &info->info26, pwd);
5270 break;
5271
5272 default:
5273 status = NT_STATUS_INVALID_INFO_CLASS;
5274 }
5275
5276 TALLOC_FREE(pwd);
5277
5278 unbecome_root();
5279
5280 /* ================ END Privilege BLOCK ================ */
5281
5282 if (NT_STATUS_IS_OK(status)) {
5283 force_flush_samr_cache(&uinfo->sid);
5284 }
5285
5286 return status;
5287 }
5288
5289 /*******************************************************************
5290 _samr_SetUserInfo2
5291 ********************************************************************/
5292
5293 NTSTATUS _samr_SetUserInfo2(struct pipes_struct *p,
5294 struct samr_SetUserInfo2 *r)
5295 {
5296 struct samr_SetUserInfo q;
5297
5298 q.in.user_handle = r->in.user_handle;
5299 q.in.level = r->in.level;
5300 q.in.info = r->in.info;
5301
5302 return _samr_SetUserInfo(p, &q);
5303 }
5304
5305 /*********************************************************************
5306 _samr_GetAliasMembership
5307 *********************************************************************/
5308
5309 NTSTATUS _samr_GetAliasMembership(struct pipes_struct *p,
5310 struct samr_GetAliasMembership *r)
5311 {
5312 size_t num_alias_rids;
5313 uint32 *alias_rids;
5314 struct samr_domain_info *dinfo;
5315 size_t i;
5316
5317 NTSTATUS status;
5318
5319 struct dom_sid *members;
5320
5321 DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
5322
5323 dinfo = policy_handle_find(p, r->in.domain_handle,
5324 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
5325 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
5326 struct samr_domain_info, &status);
5327 if (!NT_STATUS_IS_OK(status)) {
5328 return status;
5329 }
5330
5331 if (!sid_check_is_our_sam(&dinfo->sid) &&
5332 !sid_check_is_builtin(&dinfo->sid))
5333 return NT_STATUS_OBJECT_TYPE_MISMATCH;
5334
5335 if (r->in.sids->num_sids) {
5336 members = talloc_array(p->mem_ctx, struct dom_sid, r->in.sids->num_sids);
5337
5338 if (members == NULL)
5339 return NT_STATUS_NO_MEMORY;
5340 } else {
5341 members = NULL;
5342 }
5343
5344 for (i=0; i<r->in.sids->num_sids; i++)
5345 sid_copy(&members[i], r->in.sids->sids[i].sid);
5346
5347 alias_rids = NULL;
5348 num_alias_rids = 0;
5349
5350 become_root();
5351 status = pdb_enum_alias_memberships(p->mem_ctx, &dinfo->sid, members,
5352 r->in.sids->num_sids,
5353 &alias_rids, &num_alias_rids);
5354 unbecome_root();
5355
5356 if (!NT_STATUS_IS_OK(status)) {
5357 return status;
5358 }
5359
5360 r->out.rids->count = num_alias_rids;
5361 r->out.rids->ids = alias_rids;
5362
5363 if (r->out.rids->ids == NULL) {
5364 /* Windows domain clients don't accept a NULL ptr here */
5365 r->out.rids->ids = talloc_zero(p->mem_ctx, uint32_t);
5366 }
5367 if (r->out.rids->ids == NULL) {
5368 return NT_STATUS_NO_MEMORY;
5369 }
5370
5371 return NT_STATUS_OK;
5372 }
5373
5374 /*********************************************************************
5375 _samr_GetMembersInAlias
5376 *********************************************************************/
5377
5378 NTSTATUS _samr_GetMembersInAlias(struct pipes_struct *p,
5379 struct samr_GetMembersInAlias *r)
5380 {
5381 struct samr_alias_info *ainfo;
5382 NTSTATUS status;
5383 size_t i;
5384 size_t num_sids = 0;
5385 struct lsa_SidPtr *sids = NULL;
5386 struct dom_sid *pdb_sids = NULL;
5387
5388 ainfo = policy_handle_find(p, r->in.alias_handle,
5389 SAMR_ALIAS_ACCESS_GET_MEMBERS, NULL,
5390 struct samr_alias_info, &status);
5391 if (!NT_STATUS_IS_OK(status)) {
5392 return status;
5393 }
5394
5395 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5396
5397 become_root();
5398 status = pdb_enum_aliasmem(&ainfo->sid, talloc_tos(), &pdb_sids,
5399 &num_sids);
5400 unbecome_root();
5401
5402 if (!NT_STATUS_IS_OK(status)) {
5403 return status;
5404 }
5405
5406 if (num_sids) {
5407 sids = talloc_zero_array(p->mem_ctx, struct lsa_SidPtr, num_sids);
5408 if (sids == NULL) {
5409 TALLOC_FREE(pdb_sids);
5410 return NT_STATUS_NO_MEMORY;
5411 }
5412 }
5413
5414 for (i = 0; i < num_sids; i++) {
5415 sids[i].sid = dom_sid_dup(p->mem_ctx, &pdb_sids[i]);
5416 if (!sids[i].sid) {
5417 TALLOC_FREE(pdb_sids);
5418 return NT_STATUS_NO_MEMORY;
5419 }
5420 }
5421
5422 r->out.sids->num_sids = num_sids;
5423 r->out.sids->sids = sids;
5424
5425 TALLOC_FREE(pdb_sids);
5426
5427 return NT_STATUS_OK;
5428 }
5429
5430 /*********************************************************************
5431 _samr_QueryGroupMember
5432 *********************************************************************/
5433
5434 NTSTATUS _samr_QueryGroupMember(struct pipes_struct *p,
5435 struct samr_QueryGroupMember *r)
5436 {
5437 struct samr_group_info *ginfo;
5438 size_t i, num_members;
5439
5440 uint32 *rid=NULL;
5441 uint32 *attr=NULL;
5442
5443 NTSTATUS status;
5444 struct samr_RidAttrArray *rids = NULL;
5445
5446 ginfo = policy_handle_find(p, r->in.group_handle,
5447 SAMR_GROUP_ACCESS_GET_MEMBERS, NULL,
5448 struct samr_group_info, &status);
5449 if (!NT_STATUS_IS_OK(status)) {
5450 return status;
5451 }
5452
5453 rids = talloc_zero(p->mem_ctx, struct samr_RidAttrArray);
5454 if (!rids) {
5455 return NT_STATUS_NO_MEMORY;
5456 }
5457
5458 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5459
5460 if (!sid_check_is_in_our_sam(&ginfo->sid)) {
5461 DEBUG(3, ("sid %s is not in our domain\n",
5462 sid_string_dbg(&ginfo->sid)));
5463 return NT_STATUS_NO_SUCH_GROUP;
5464 }
5465
5466 DEBUG(10, ("lookup on Domain SID\n"));
5467
5468 become_root();
5469 status = pdb_enum_group_members(p->mem_ctx, &ginfo->sid,
5470 &rid, &num_members);
5471 unbecome_root();
5472
5473 if (!NT_STATUS_IS_OK(status))
5474 return status;
5475
5476 if (num_members) {
5477 attr=talloc_zero_array(p->mem_ctx, uint32, num_members);
5478 if (attr == NULL) {
5479 return NT_STATUS_NO_MEMORY;
5480 }
5481 } else {
5482 attr = NULL;
5483 }
5484
5485 for (i=0; i<num_members; i++) {
5486 attr[i] = SE_GROUP_MANDATORY |
5487 SE_GROUP_ENABLED_BY_DEFAULT |
5488 SE_GROUP_ENABLED;
5489 }
5490
5491 rids->count = num_members;
5492 rids->attributes = attr;
5493 rids->rids = rid;
5494
5495 *r->out.rids = rids;
5496
5497 return NT_STATUS_OK;
5498 }
5499
5500 /*********************************************************************
5501 _samr_AddAliasMember
5502 *********************************************************************/
5503
5504 NTSTATUS _samr_AddAliasMember(struct pipes_struct *p,
5505 struct samr_AddAliasMember *r)
5506 {
5507 struct samr_alias_info *ainfo;
5508 NTSTATUS status;
5509
5510 ainfo = policy_handle_find(p, r->in.alias_handle,
5511 SAMR_ALIAS_ACCESS_ADD_MEMBER, NULL,
5512 struct samr_alias_info, &status);
5513 if (!NT_STATUS_IS_OK(status)) {
5514 return status;
5515 }
5516
5517 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5518
5519 /******** BEGIN SeAddUsers BLOCK *********/
5520
5521 become_root();
5522 status = pdb_add_aliasmem(&ainfo->sid, r->in.sid);
5523 unbecome_root();
5524
5525 /******** END SeAddUsers BLOCK *********/
5526
5527 if (NT_STATUS_IS_OK(status)) {
5528 force_flush_samr_cache(&ainfo->sid);
5529 }
5530
5531 return status;
5532 }
5533
5534 /*********************************************************************
5535 _samr_DeleteAliasMember
5536 *********************************************************************/
5537
5538 NTSTATUS _samr_DeleteAliasMember(struct pipes_struct *p,
5539 struct samr_DeleteAliasMember *r)
5540 {
5541 struct samr_alias_info *ainfo;
5542 NTSTATUS status;
5543
5544 ainfo = policy_handle_find(p, r->in.alias_handle,
5545 SAMR_ALIAS_ACCESS_REMOVE_MEMBER, NULL,
5546 struct samr_alias_info, &status);
5547 if (!NT_STATUS_IS_OK(status)) {
5548 return status;
5549 }
5550
5551 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
5552 sid_string_dbg(&ainfo->sid)));
5553
5554 /******** BEGIN SeAddUsers BLOCK *********/
5555
5556 become_root();
5557 status = pdb_del_aliasmem(&ainfo->sid, r->in.sid);
5558 unbecome_root();
5559
5560 /******** END SeAddUsers BLOCK *********/
5561
5562 if (NT_STATUS_IS_OK(status)) {
5563 force_flush_samr_cache(&ainfo->sid);
5564 }
5565
5566 return status;
5567 }
5568
5569 /*********************************************************************
5570 _samr_AddGroupMember
5571 *********************************************************************/
5572
5573 NTSTATUS _samr_AddGroupMember(struct pipes_struct *p,
5574 struct samr_AddGroupMember *r)
5575 {
5576 struct samr_group_info *ginfo;
5577 NTSTATUS status;
5578 uint32 group_rid;
5579
5580 ginfo = policy_handle_find(p, r->in.group_handle,
5581 SAMR_GROUP_ACCESS_ADD_MEMBER, NULL,
5582 struct samr_group_info, &status);
5583 if (!NT_STATUS_IS_OK(status)) {
5584 return status;
5585 }
5586
5587 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5588
5589 if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5590 &group_rid)) {
5591 return NT_STATUS_INVALID_HANDLE;
5592 }
5593
5594 /******** BEGIN SeAddUsers BLOCK *********/
5595
5596 become_root();
5597 status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
5598 unbecome_root();
5599
5600 /******** END SeAddUsers BLOCK *********/
5601
5602 force_flush_samr_cache(&ginfo->sid);
5603
5604 return status;
5605 }
5606
5607 /*********************************************************************
5608 _samr_DeleteGroupMember
5609 *********************************************************************/
5610
5611 NTSTATUS _samr_DeleteGroupMember(struct pipes_struct *p,
5612 struct samr_DeleteGroupMember *r)
5613
5614 {
5615 struct samr_group_info *ginfo;
5616 NTSTATUS status;
5617 uint32 group_rid;
5618
5619 /*
5620 * delete the group member named r->in.rid
5621 * who is a member of the sid associated with the handle
5622 * the rid is a user's rid as the group is a domain group.
5623 */
5624
5625 ginfo = policy_handle_find(p, r->in.group_handle,
5626 SAMR_GROUP_ACCESS_REMOVE_MEMBER, NULL,
5627 struct samr_group_info, &status);
5628 if (!NT_STATUS_IS_OK(status)) {
5629 return status;
5630 }
5631
5632 if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5633 &group_rid)) {
5634 return NT_STATUS_INVALID_HANDLE;
5635 }
5636
5637 /******** BEGIN SeAddUsers BLOCK *********/
5638
5639 become_root();
5640 status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
5641 unbecome_root();
5642
5643 /******** END SeAddUsers BLOCK *********/
5644
5645 force_flush_samr_cache(&ginfo->sid);
5646
5647 return status;
5648 }
5649
5650 /*********************************************************************
5651 _samr_DeleteUser
5652 *********************************************************************/
5653
5654 NTSTATUS _samr_DeleteUser(struct pipes_struct *p,
5655 struct samr_DeleteUser *r)
5656 {
5657 struct samr_user_info *uinfo;
5658 NTSTATUS status;
5659 struct samu *sam_pass=NULL;
5660 bool ret;
5661
5662 DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
5663
5664 uinfo = policy_handle_find(p, r->in.user_handle,
5665 SEC_STD_DELETE, NULL,
5666 struct samr_user_info, &status);
5667 if (!NT_STATUS_IS_OK(status)) {
5668 return status;
5669 }
5670
5671 if (!sid_check_is_in_our_sam(&uinfo->sid))
5672 return NT_STATUS_CANNOT_DELETE;
5673
5674 /* check if the user exists before trying to delete */
5675 if ( !(sam_pass = samu_new( NULL )) ) {
5676 return NT_STATUS_NO_MEMORY;
5677 }
5678
5679 become_root();
5680 ret = pdb_getsampwsid(sam_pass, &uinfo->sid);
5681 unbecome_root();
5682
5683 if(!ret) {
5684 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
5685 sid_string_dbg(&uinfo->sid)));
5686 TALLOC_FREE(sam_pass);
5687 return NT_STATUS_NO_SUCH_USER;
5688 }
5689
5690 /******** BEGIN SeAddUsers BLOCK *********/
5691
5692 become_root();
5693 status = pdb_delete_user(p->mem_ctx, sam_pass);
5694 unbecome_root();
5695
5696 /******** END SeAddUsers BLOCK *********/
5697
5698 if ( !NT_STATUS_IS_OK(status) ) {
5699 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
5700 "user %s: %s.\n", pdb_get_username(sam_pass),
5701 nt_errstr(status)));
5702 TALLOC_FREE(sam_pass);
5703 return status;
5704 }
5705
5706
5707 TALLOC_FREE(sam_pass);
5708
5709 force_flush_samr_cache(&uinfo->sid);
5710
5711 if (!close_policy_hnd(p, r->in.user_handle))
5712 return NT_STATUS_OBJECT_NAME_INVALID;
5713
5714 ZERO_STRUCTP(r->out.user_handle);
5715
5716 return NT_STATUS_OK;
5717 }
5718
5719 /*********************************************************************
5720 _samr_DeleteDomainGroup
5721 *********************************************************************/
5722
5723 NTSTATUS _samr_DeleteDomainGroup(struct pipes_struct *p,
5724 struct samr_DeleteDomainGroup *r)
5725 {
5726 struct samr_group_info *ginfo;
5727 NTSTATUS status;
5728 uint32 group_rid;
5729
5730 DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
5731
5732 ginfo = policy_handle_find(p, r->in.group_handle,
5733 SEC_STD_DELETE, NULL,
5734 struct samr_group_info, &status);
5735 if (!NT_STATUS_IS_OK(status)) {
5736 return status;
5737 }
5738
5739 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5740
5741 if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5742 &group_rid)) {
5743 return NT_STATUS_NO_SUCH_GROUP;
5744 }
5745
5746 /******** BEGIN SeAddUsers BLOCK *********/
5747
5748 become_root();
5749 status = pdb_delete_dom_group(p->mem_ctx, group_rid);
5750 unbecome_root();
5751
5752 /******** END SeAddUsers BLOCK *********/
5753
5754 if ( !NT_STATUS_IS_OK(status) ) {
5755 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
5756 "entry for group %s: %s\n",
5757 sid_string_dbg(&ginfo->sid),
5758 nt_errstr(status)));
5759 return status;
5760 }
5761
5762 force_flush_samr_cache(&ginfo->sid);
5763
5764 if (!close_policy_hnd(p, r->in.group_handle))
5765 return NT_STATUS_OBJECT_NAME_INVALID;
5766
5767 return NT_STATUS_OK;
5768 }
5769
5770 /*********************************************************************
5771 _samr_DeleteDomAlias
5772 *********************************************************************/
5773
5774 NTSTATUS _samr_DeleteDomAlias(struct pipes_struct *p,
5775 struct samr_DeleteDomAlias *r)
5776 {
5777 struct samr_alias_info *ainfo;
5778 NTSTATUS status;
5779
5780 DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
5781
5782 ainfo = policy_handle_find(p, r->in.alias_handle,
5783 SEC_STD_DELETE, NULL,
5784 struct samr_alias_info, &status);
5785 if (!NT_STATUS_IS_OK(status)) {
5786 return status;
5787 }
5788
5789 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5790
5791 /* Don't let Windows delete builtin groups */
5792
5793 if ( sid_check_is_in_builtin( &ainfo->sid ) ) {
5794 return NT_STATUS_SPECIAL_ACCOUNT;
5795 }
5796
5797 if (!sid_check_is_in_our_sam(&ainfo->sid))
5798 return NT_STATUS_NO_SUCH_ALIAS;
5799
5800 DEBUG(10, ("lookup on Local SID\n"));
5801
5802 /******** BEGIN SeAddUsers BLOCK *********/
5803
5804 become_root();
5805 /* Have passdb delete the alias */
5806 status = pdb_delete_alias(&ainfo->sid);
5807 unbecome_root();
5808
5809 /******** END SeAddUsers BLOCK *********/
5810
5811 if ( !NT_STATUS_IS_OK(status))
5812 return status;
5813
5814 force_flush_samr_cache(&ainfo->sid);
5815
5816 if (!close_policy_hnd(p, r->in.alias_handle))
5817 return NT_STATUS_OBJECT_NAME_INVALID;
5818
5819 return NT_STATUS_OK;
5820 }
5821
5822 /*********************************************************************
5823 _samr_CreateDomainGroup
5824 *********************************************************************/
5825
5826 NTSTATUS _samr_CreateDomainGroup(struct pipes_struct *p,
5827 struct samr_CreateDomainGroup *r)
5828
5829 {
5830 NTSTATUS status;
5831 const char *name;
5832 struct samr_domain_info *dinfo;
5833 struct samr_group_info *ginfo;
5834
5835 dinfo = policy_handle_find(p, r->in.domain_handle,
5836 SAMR_DOMAIN_ACCESS_CREATE_GROUP, NULL,
5837 struct samr_domain_info, &status);
5838 if (!NT_STATUS_IS_OK(status)) {
5839 return status;
5840 }
5841
5842 if (!sid_check_is_our_sam(&dinfo->sid)) {
5843 return NT_STATUS_ACCESS_DENIED;
5844 }
5845
5846 name = r->in.name->string;
5847 if (name == NULL) {
5848 return NT_STATUS_NO_MEMORY;
5849 }
5850
5851 status = can_create(p->mem_ctx, name);
5852 if (!NT_STATUS_IS_OK(status)) {
5853 return status;
5854 }
5855
5856 /******** BEGIN SeAddUsers BLOCK *********/
5857
5858 become_root();
5859 /* check that we successfully create the UNIX group */
5860 status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
5861 unbecome_root();
5862
5863 /******** END SeAddUsers BLOCK *********/
5864
5865 /* check if we should bail out here */
5866
5867 if ( !NT_STATUS_IS_OK(status) )
5868 return status;
5869
5870 ginfo = policy_handle_create(p, r->out.group_handle,
5871 GENERIC_RIGHTS_GROUP_ALL_ACCESS,
5872 struct samr_group_info, &status);
5873 if (!NT_STATUS_IS_OK(status)) {
5874 return status;
5875 }
5876 sid_compose(&ginfo->sid, &dinfo->sid, *r->out.rid);
5877
5878 force_flush_samr_cache(&dinfo->sid);
5879
5880 return NT_STATUS_OK;
5881 }
5882
5883 /*********************************************************************
5884 _samr_CreateDomAlias
5885 *********************************************************************/
5886
5887 NTSTATUS _samr_CreateDomAlias(struct pipes_struct *p,
5888 struct samr_CreateDomAlias *r)
5889 {
5890 struct dom_sid info_sid;
5891 const char *name = NULL;
5892 struct samr_domain_info *dinfo;
5893 struct samr_alias_info *ainfo;
5894 gid_t gid;
5895 NTSTATUS result;
5896
5897 dinfo = policy_handle_find(p, r->in.domain_handle,
5898 SAMR_DOMAIN_ACCESS_CREATE_ALIAS, NULL,
5899 struct samr_domain_info, &result);
5900 if (!NT_STATUS_IS_OK(result)) {
5901 return result;
5902 }
5903
5904 if (!sid_check_is_our_sam(&dinfo->sid)) {
5905 return NT_STATUS_ACCESS_DENIED;
5906 }
5907
5908 name = r->in.alias_name->string;
5909
5910 result = can_create(p->mem_ctx, name);
5911 if (!NT_STATUS_IS_OK(result)) {
5912 return result;
5913 }
5914
5915 /******** BEGIN SeAddUsers BLOCK *********/
5916
5917 become_root();
5918 /* Have passdb create the alias */
5919 result = pdb_create_alias(name, r->out.rid);
5920 unbecome_root();
5921
5922 /******** END SeAddUsers BLOCK *********/
5923
5924 if (!NT_STATUS_IS_OK(result)) {
5925 DEBUG(10, ("pdb_create_alias failed: %s\n",
5926 nt_errstr(result)));
5927 return result;
5928 }
5929
5930 sid_compose(&info_sid, &dinfo->sid, *r->out.rid);
5931
5932 if (!sid_to_gid(&info_sid, &gid)) {
5933 DEBUG(10, ("Could not find alias just created\n"));
5934 return NT_STATUS_ACCESS_DENIED;
5935 }
5936
5937 /* check if the group has been successfully created */
5938 if ( getgrgid(gid) == NULL ) {
5939 DEBUG(1, ("getgrgid(%u) of just created alias failed\n",
5940 (unsigned int)gid));
5941 return NT_STATUS_ACCESS_DENIED;
5942 }
5943
5944 ainfo = policy_handle_create(p, r->out.alias_handle,
5945 GENERIC_RIGHTS_ALIAS_ALL_ACCESS,
5946 struct samr_alias_info, &result);
5947 if (!NT_STATUS_IS_OK(result)) {
5948 return result;
5949 }
5950 ainfo->sid = info_sid;
5951
5952 force_flush_samr_cache(&info_sid);
5953
5954 return NT_STATUS_OK;
5955 }
5956
5957 /*********************************************************************
5958 _samr_QueryGroupInfo
5959 *********************************************************************/
5960
5961 NTSTATUS _samr_QueryGroupInfo(struct pipes_struct *p,
5962 struct samr_QueryGroupInfo *r)
5963 {
5964 struct samr_group_info *ginfo;
5965 NTSTATUS status;
5966 GROUP_MAP *map;
5967 union samr_GroupInfo *info = NULL;
5968 bool ret;
5969 uint32_t attributes = SE_GROUP_MANDATORY |
5970 SE_GROUP_ENABLED_BY_DEFAULT |
5971 SE_GROUP_ENABLED;
5972 const char *group_name = NULL;
5973 const char *group_description = NULL;
5974
5975 ginfo = policy_handle_find(p, r->in.group_handle,
5976 SAMR_GROUP_ACCESS_LOOKUP_INFO, NULL,
5977 struct samr_group_info, &status);
5978 if (!NT_STATUS_IS_OK(status)) {
5979 return status;
5980 }
5981
5982 map = talloc_zero(p->mem_ctx, GROUP_MAP);
5983 if (!map) {
5984 return NT_STATUS_NO_MEMORY;
5985 }
5986
5987 become_root();
5988 ret = get_domain_group_from_sid(ginfo->sid, map);
5989 unbecome_root();
5990 if (!ret)
5991 return NT_STATUS_INVALID_HANDLE;
5992
5993 group_name = talloc_move(r, &map->nt_name);
5994 group_description = talloc_move(r, &map->comment);
5995
5996 TALLOC_FREE(map);
5997
5998 info = talloc_zero(p->mem_ctx, union samr_GroupInfo);
5999 if (!info) {
6000 return NT_STATUS_NO_MEMORY;
6001 }
6002
6003 switch (r->in.level) {
6004 case 1: {
6005 uint32 *members;
6006 size_t num_members;
6007
6008 become_root();
6009 status = pdb_enum_group_members(
6010 p->mem_ctx, &ginfo->sid, &members,
6011 &num_members);
6012 unbecome_root();
6013
6014 if (!NT_STATUS_IS_OK(status)) {
6015 return status;
6016 }
6017
6018 info->all.name.string = group_name;
6019 info->all.attributes = attributes;
6020 info->all.num_members = num_members;
6021 info->all.description.string = group_description;
6022 break;
6023 }
6024 case 2:
6025 info->name.string = group_name;
6026 break;
6027 case 3:
6028 info->attributes.attributes = attributes;
6029 break;
6030 case 4:
6031 info->description.string = group_description;
6032 break;
6033 case 5: {
6034 /*
6035 uint32 *members;
6036 size_t num_members;
6037 */
6038
6039 /*
6040 become_root();
6041 status = pdb_enum_group_members(
6042 p->mem_ctx, &ginfo->sid, &members,
6043 &num_members);
6044 unbecome_root();
6045
6046 if (!NT_STATUS_IS_OK(status)) {
6047 return status;
6048 }
6049 */
6050 info->all2.name.string = group_name;
6051 info->all2.attributes = attributes;
6052 info->all2.num_members = 0; /* num_members - in w2k3 this is always 0 */
6053 info->all2.description.string = group_description;
6054
6055 break;
6056 }
6057 default:
6058 return NT_STATUS_INVALID_INFO_CLASS;
6059 }
6060
6061 *r->out.info = info;
6062
6063 return NT_STATUS_OK;
6064 }
6065
6066 /*********************************************************************
6067 _samr_SetGroupInfo
6068 *********************************************************************/
6069
6070 NTSTATUS _samr_SetGroupInfo(struct pipes_struct *p,
6071 struct samr_SetGroupInfo *r)
6072 {
6073 struct samr_group_info *ginfo;
6074 GROUP_MAP *map;
6075 NTSTATUS status;
6076 bool ret;
6077
6078 ginfo = policy_handle_find(p, r->in.group_handle,
6079 SAMR_GROUP_ACCESS_SET_INFO, NULL,
6080 struct samr_group_info, &status);
6081 if (!NT_STATUS_IS_OK(status)) {
6082 return status;
6083 }
6084
6085 map = talloc_zero(p->mem_ctx, GROUP_MAP);
6086 if (!map) {
6087 return NT_STATUS_NO_MEMORY;
6088 }
6089
6090 become_root();
6091 ret = get_domain_group_from_sid(ginfo->sid, map);
6092 unbecome_root();
6093 if (!ret)
6094 return NT_STATUS_NO_SUCH_GROUP;
6095
6096 switch (r->in.level) {
6097 case 2:
6098 map->nt_name = talloc_strdup(map,
6099 r->in.info->name.string);
6100 if (!map->nt_name) {
6101 return NT_STATUS_NO_MEMORY;
6102 }
6103 break;
6104 case 3:
6105 break;
6106 case 4:
6107 map->comment = talloc_strdup(map,
6108 r->in.info->description.string);
6109 if (!map->comment) {
6110 return NT_STATUS_NO_MEMORY;
6111 }
6112 break;
6113 default:
6114 return NT_STATUS_INVALID_INFO_CLASS;
6115 }
6116
6117 /******** BEGIN SeAddUsers BLOCK *********/
6118
6119 become_root();
6120 status = pdb_update_group_mapping_entry(map);
6121 unbecome_root();
6122
6123 /******** End SeAddUsers BLOCK *********/
6124
6125 TALLOC_FREE(map);
6126
6127 if (NT_STATUS_IS_OK(status)) {
6128 force_flush_samr_cache(&ginfo->sid);
6129 }
6130
6131 return status;
6132 }
6133
6134 /*********************************************************************
6135 _samr_SetAliasInfo
6136 *********************************************************************/
6137
6138 NTSTATUS _samr_SetAliasInfo(struct pipes_struct *p,
6139 struct samr_SetAliasInfo *r)
6140 {
6141 struct samr_alias_info *ainfo;
6142 struct acct_info *info;
6143 NTSTATUS status;
6144
6145 ainfo = policy_handle_find(p, r->in.alias_handle,
6146 SAMR_ALIAS_ACCESS_SET_INFO, NULL,
6147 struct samr_alias_info, &status);
6148 if (!NT_STATUS_IS_OK(status)) {
6149 return status;
6150 }
6151
6152 info = talloc_zero(p->mem_ctx, struct acct_info);
6153 if (!info) {
6154 return NT_STATUS_NO_MEMORY;
6155 }
6156
6157 /* get the current group information */
6158
6159 become_root();
6160 status = pdb_get_aliasinfo(&ainfo->sid, info);
6161 unbecome_root();
6162
6163 if ( !NT_STATUS_IS_OK(status))
6164 return status;
6165
6166 switch (r->in.level) {
6167 case ALIASINFONAME:
6168 {
6169 char *group_name;
6170
6171 /* We currently do not support renaming groups in the
6172 the BUILTIN domain. Refer to util_builtin.c to understand
6173 why. The eventually needs to be fixed to be like Windows
6174 where you can rename builtin groups, just not delete them */
6175
6176 if ( sid_check_is_in_builtin( &ainfo->sid ) ) {
6177 return NT_STATUS_SPECIAL_ACCOUNT;
6178 }
6179
6180 /* There has to be a valid name (and it has to be different) */
6181
6182 if ( !r->in.info->name.string )
6183 return NT_STATUS_INVALID_PARAMETER;
6184
6185 /* If the name is the same just reply "ok". Yes this
6186 doesn't allow you to change the case of a group name. */
6187
6188 if (strequal(r->in.info->name.string, info->acct_name)) {
6189 return NT_STATUS_OK;
6190 }
6191
6192 talloc_free(info->acct_name);
6193 info->acct_name = talloc_strdup(info, r->in.info->name.string);
6194 if (!info->acct_name) {
6195 return NT_STATUS_NO_MEMORY;
6196 }
6197
6198 /* make sure the name doesn't already exist as a user
6199 or local group */
6200
6201 group_name = talloc_asprintf(p->mem_ctx,
6202 "%s\\%s",
6203 lp_netbios_name(),
6204 info->acct_name);
6205 if (group_name == NULL) {
6206 return NT_STATUS_NO_MEMORY;
6207 }
6208
6209 status = can_create( p->mem_ctx, group_name );
6210 talloc_free(group_name);
6211 if ( !NT_STATUS_IS_OK( status ) )
6212 return status;
6213 break;
6214 }
6215 case ALIASINFODESCRIPTION:
6216 TALLOC_FREE(info->acct_desc);
6217 if (r->in.info->description.string) {
6218 info->acct_desc = talloc_strdup(info,
6219 r->in.info->description.string);
6220 } else {
6221 info->acct_desc = talloc_strdup(info, "");
6222 }
6223 if (!info->acct_desc) {
6224 return NT_STATUS_NO_MEMORY;
6225 }
6226 break;
6227 default:
6228 return NT_STATUS_INVALID_INFO_CLASS;
6229 }
6230
6231 /******** BEGIN SeAddUsers BLOCK *********/
6232
6233 become_root();
6234 status = pdb_set_aliasinfo(&ainfo->sid, info);
6235 unbecome_root();
6236
6237 /******** End SeAddUsers BLOCK *********/
6238
6239 if (NT_STATUS_IS_OK(status))
6240 force_flush_samr_cache(&ainfo->sid);
6241
6242 return status;
6243 }
6244
6245 /****************************************************************
6246 _samr_GetDomPwInfo
6247 ****************************************************************/
6248
6249 NTSTATUS _samr_GetDomPwInfo(struct pipes_struct *p,
6250 struct samr_GetDomPwInfo *r)
6251 {
6252 uint32_t min_password_length = 0;
6253 uint32_t password_properties = 0;
6254
6255 /* Perform access check. Since this rpc does not require a
6256 policy handle it will not be caught by the access checks on
6257 SAMR_CONNECT or SAMR_CONNECT_ANON. */
6258
6259 if (!pipe_access_check(p)) {
6260 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
6261 return NT_STATUS_ACCESS_DENIED;
6262 }
6263
6264 become_root();
6265 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
6266 &min_password_length);
6267 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
6268 &password_properties);
6269 unbecome_root();
6270
6271 if (lp_check_password_script(talloc_tos()) && *lp_check_password_script(talloc_tos())) {
6272 password_properties |= DOMAIN_PASSWORD_COMPLEX;
6273 }
6274
6275 r->out.info->min_password_length = min_password_length;
6276 r->out.info->password_properties = password_properties;
6277
6278 return NT_STATUS_OK;
6279 }
6280
6281 /*********************************************************************
6282 _samr_OpenGroup
6283 *********************************************************************/
6284
6285 NTSTATUS _samr_OpenGroup(struct pipes_struct *p,
6286 struct samr_OpenGroup *r)
6287
6288 {
6289 struct dom_sid info_sid;
6290 GROUP_MAP *map;
6291 struct samr_domain_info *dinfo;
6292 struct samr_group_info *ginfo;
6293 struct security_descriptor *psd = NULL;
6294 uint32 acc_granted;
6295 uint32 des_access = r->in.access_mask;
6296 size_t sd_size;
6297 NTSTATUS status;
6298 bool ret;
6299
6300 dinfo = policy_handle_find(p, r->in.domain_handle,
6301 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
6302 struct samr_domain_info, &status);
6303 if (!NT_STATUS_IS_OK(status)) {
6304 return status;
6305 }
6306
6307 /*check if access can be granted as requested by client. */
6308 map_max_allowed_access(p->session_info->security_token,
6309 p->session_info->unix_token,
6310 &des_access);
6311
6312 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
6313 se_map_generic(&des_access,&grp_generic_mapping);
6314
6315 status = access_check_object(psd, p->session_info->security_token,
6316 SEC_PRIV_ADD_USERS, SEC_PRIV_INVALID, GENERIC_RIGHTS_GROUP_ALL_ACCESS,
6317 des_access, &acc_granted, "_samr_OpenGroup");
6318
6319 if ( !NT_STATUS_IS_OK(status) )
6320 return status;
6321
6322 /* this should not be hard-coded like this */
6323
6324 if (!sid_check_is_our_sam(&dinfo->sid)) {
6325 return NT_STATUS_ACCESS_DENIED;
6326 }
6327
6328 sid_compose(&info_sid, &dinfo->sid, r->in.rid);
6329
6330 DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n",
6331 sid_string_dbg(&info_sid)));
6332
6333 map = talloc_zero(p->mem_ctx, GROUP_MAP);
6334 if (!map) {
6335 return NT_STATUS_NO_MEMORY;
6336 }
6337
6338 /* check if that group really exists */
6339 become_root();
6340 ret = get_domain_group_from_sid(info_sid, map);
6341 unbecome_root();
6342 if (!ret)
6343 return NT_STATUS_NO_SUCH_GROUP;
6344
6345 TALLOC_FREE(map);
6346
6347 ginfo = policy_handle_create(p, r->out.group_handle,
6348 acc_granted,
6349 struct samr_group_info, &status);
6350 if (!NT_STATUS_IS_OK(status)) {
6351 return status;
6352 }
6353 ginfo->sid = info_sid;
6354
6355 return NT_STATUS_OK;
6356 }
6357
6358 /*********************************************************************
6359 _samr_RemoveMemberFromForeignDomain
6360 *********************************************************************/
6361
6362 NTSTATUS _samr_RemoveMemberFromForeignDomain(struct pipes_struct *p,
6363 struct samr_RemoveMemberFromForeignDomain *r)
6364 {
6365 struct samr_domain_info *dinfo;
6366 NTSTATUS result;
6367
6368 DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
6369 sid_string_dbg(r->in.sid)));
6370
6371 /* Find the policy handle. Open a policy on it. */
6372
6373 dinfo = policy_handle_find(p, r->in.domain_handle,
6374 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
6375 struct samr_domain_info, &result);
6376 if (!NT_STATUS_IS_OK(result)) {
6377 return result;
6378 }
6379
6380 DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
6381 sid_string_dbg(&dinfo->sid)));
6382
6383 /* we can only delete a user from a group since we don't have
6384 nested groups anyways. So in the latter case, just say OK */
6385
6386 /* TODO: The above comment nowadays is bogus. Since we have nested
6387 * groups now, and aliases members are never reported out of the unix
6388 * group membership, the "just say OK" makes this call a no-op. For
6389 * us. This needs fixing however. */
6390
6391 /* I've only ever seen this in the wild when deleting a user from
6392 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
6393 * is the user about to be deleted. I very much suspect this is the
6394 * only application of this call. To verify this, let people report
6395 * other cases. */
6396
6397 if (!sid_check_is_builtin(&dinfo->sid)) {
6398 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
6399 "global_sam_sid() = %s\n",
6400 sid_string_dbg(&dinfo->sid),
6401 sid_string_dbg(get_global_sam_sid())));
6402 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
6403 return NT_STATUS_OK;
6404 }
6405
6406 force_flush_samr_cache(&dinfo->sid);
6407
6408 result = NT_STATUS_OK;
6409
6410 return result;
6411 }
6412
6413 /*******************************************************************
6414 _samr_QueryDomainInfo2
6415 ********************************************************************/
6416
6417 NTSTATUS _samr_QueryDomainInfo2(struct pipes_struct *p,
6418 struct samr_QueryDomainInfo2 *r)
6419 {
6420 struct samr_QueryDomainInfo q;
6421
6422 q.in.domain_handle = r->in.domain_handle;
6423 q.in.level = r->in.level;
6424
6425 q.out.info = r->out.info;
6426
6427 return _samr_QueryDomainInfo(p, &q);
6428 }
6429
6430 /*******************************************************************
6431 ********************************************************************/
6432
6433 static NTSTATUS set_dom_info_1(TALLOC_CTX *mem_ctx,
6434 struct samr_DomInfo1 *r)
6435 {
6436 time_t u_expire, u_min_age;
6437
6438 u_expire = nt_time_to_unix_abs((NTTIME *)&r->max_password_age);
6439 u_min_age = nt_time_to_unix_abs((NTTIME *)&r->min_password_age);
6440
6441 pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
6442 (uint32_t)r->min_password_length);
6443 pdb_set_account_policy(PDB_POLICY_PASSWORD_HISTORY,
6444 (uint32_t)r->password_history_length);
6445 pdb_set_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
6446 (uint32_t)r->password_properties);
6447 pdb_set_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, (int)u_expire);
6448 pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, (int)u_min_age);
6449
6450 return NT_STATUS_OK;
6451 }
6452
6453 /*******************************************************************
6454 ********************************************************************/
6455
6456 static NTSTATUS set_dom_info_3(TALLOC_CTX *mem_ctx,
6457 struct samr_DomInfo3 *r)
6458 {
6459 time_t u_logout;
6460
6461 u_logout = nt_time_to_unix_abs((NTTIME *)&r->force_logoff_time);
6462
6463 pdb_set_account_policy(PDB_POLICY_TIME_TO_LOGOUT, (int)u_logout);
6464
6465 return NT_STATUS_OK;
6466 }
6467
6468 /*******************************************************************
6469 ********************************************************************/
6470
6471 static NTSTATUS set_dom_info_12(TALLOC_CTX *mem_ctx,
6472 struct samr_DomInfo12 *r)
6473 {
6474 time_t u_lock_duration, u_reset_time;
6475
6476 u_lock_duration = nt_time_to_unix_abs((NTTIME *)&r->lockout_duration);
6477 if (u_lock_duration != -1) {
6478 u_lock_duration /= 60;
6479 }
6480
6481 u_reset_time = nt_time_to_unix_abs((NTTIME *)&r->lockout_window)/60;
6482
6483 pdb_set_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
6484 pdb_set_account_policy(PDB_POLICY_RESET_COUNT_TIME, (int)u_reset_time);
6485 pdb_set_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT,
6486 (uint32_t)r->lockout_threshold);
6487
6488 return NT_STATUS_OK;
6489 }
6490
6491 /*******************************************************************
6492 _samr_SetDomainInfo
6493 ********************************************************************/
6494
6495 NTSTATUS _samr_SetDomainInfo(struct pipes_struct *p,
6496 struct samr_SetDomainInfo *r)
6497 {
6498 NTSTATUS status;
6499 uint32_t acc_required = 0;
6500
6501 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
6502
6503 switch (r->in.level) {
6504 case 1: /* DomainPasswordInformation */
6505 case 12: /* DomainLockoutInformation */
6506 /* DOMAIN_WRITE_PASSWORD_PARAMETERS */
6507 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_1;
6508 break;
6509 case 3: /* DomainLogoffInformation */
6510 case 4: /* DomainOemInformation */
6511 /* DOMAIN_WRITE_OTHER_PARAMETERS */
6512 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_2;
6513 break;
6514 case 6: /* DomainReplicationInformation */
6515 case 9: /* DomainStateInformation */
6516 case 7: /* DomainServerRoleInformation */
6517 /* DOMAIN_ADMINISTER_SERVER */
6518 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_3;
6519 break;
6520 default:
6521 return NT_STATUS_INVALID_INFO_CLASS;
6522 }
6523
6524 (void)policy_handle_find(p, r->in.domain_handle,
6525 acc_required, NULL,
6526 struct samr_domain_info, &status);
6527 if (!NT_STATUS_IS_OK(status)) {
6528 return status;
6529 }
6530
6531 DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
6532
6533 switch (r->in.level) {
6534 case 1:
6535 status = set_dom_info_1(p->mem_ctx, &r->in.info->info1);
6536 break;
6537 case 3:
6538 status = set_dom_info_3(p->mem_ctx, &r->in.info->info3);
6539 break;
6540 case 4:
6541 break;
6542 case 6:
6543 break;
6544 case 7:
6545 break;
6546 case 9:
6547 break;
6548 case 12:
6549 status = set_dom_info_12(p->mem_ctx, &r->in.info->info12);
6550 break;
6551 default:
6552 return NT_STATUS_INVALID_INFO_CLASS;
6553 }
6554
6555 if (!NT_STATUS_IS_OK(status)) {
6556 return status;
6557 }
6558
6559 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
6560
6561 return NT_STATUS_OK;
6562 }
6563
6564 /****************************************************************
6565 _samr_GetDisplayEnumerationIndex
6566 ****************************************************************/
6567
6568 NTSTATUS _samr_GetDisplayEnumerationIndex(struct pipes_struct *p,
6569 struct samr_GetDisplayEnumerationIndex *r)
6570 {
6571 struct samr_domain_info *dinfo;
6572 uint32_t max_entries = (uint32_t) -1;
6573 uint32_t enum_context = 0;
6574 int i;
6575 uint32_t num_account = 0;
6576 struct samr_displayentry *entries = NULL;
6577 NTSTATUS status;
6578
6579 DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
6580
6581 dinfo = policy_handle_find(p, r->in.domain_handle,
6582 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
6583 struct samr_domain_info, &status);
6584 if (!NT_STATUS_IS_OK(status)) {
6585 return status;
6586 }
6587
6588 if ((r->in.level < 1) || (r->in.level > 3)) {
6589 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
6590 "Unknown info level (%u)\n",
6591 r->in.level));
6592 return NT_STATUS_INVALID_INFO_CLASS;
6593 }
6594
6595 become_root();
6596
6597 /* The following done as ROOT. Don't return without unbecome_root(). */
6598
6599 switch (r->in.level) {
6600 case 1:
6601 if (dinfo->disp_info->users == NULL) {
6602 dinfo->disp_info->users = pdb_search_users(
6603 dinfo->disp_info, ACB_NORMAL);
6604 if (dinfo->disp_info->users == NULL) {
6605 unbecome_root();
6606 return NT_STATUS_ACCESS_DENIED;
6607 }
6608 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6609 "starting user enumeration at index %u\n",
6610 (unsigned int)enum_context));
6611 } else {
6612 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6613 "using cached user enumeration at index %u\n",
6614 (unsigned int)enum_context));
6615 }
6616 num_account = pdb_search_entries(dinfo->disp_info->users,
6617 enum_context, max_entries,
6618 &entries);
6619 break;
6620 case 2:
6621 if (dinfo->disp_info->machines == NULL) {
6622 dinfo->disp_info->machines = pdb_search_users(
6623 dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
6624 if (dinfo->disp_info->machines == NULL) {
6625 unbecome_root();
6626 return NT_STATUS_ACCESS_DENIED;
6627 }
6628 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6629 "starting machine enumeration at index %u\n",
6630 (unsigned int)enum_context));
6631 } else {
6632 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6633 "using cached machine enumeration at index %u\n",
6634 (unsigned int)enum_context));
6635 }
6636 num_account = pdb_search_entries(dinfo->disp_info->machines,
6637 enum_context, max_entries,
6638 &entries);
6639 break;
6640 case 3:
6641 if (dinfo->disp_info->groups == NULL) {
6642 dinfo->disp_info->groups = pdb_search_groups(
6643 dinfo->disp_info);
6644 if (dinfo->disp_info->groups == NULL) {
6645 unbecome_root();
6646 return NT_STATUS_ACCESS_DENIED;
6647 }
6648 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6649 "starting group enumeration at index %u\n",
6650 (unsigned int)enum_context));
6651 } else {
6652 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6653 "using cached group enumeration at index %u\n",
6654 (unsigned int)enum_context));
6655 }
6656 num_account = pdb_search_entries(dinfo->disp_info->groups,
6657 enum_context, max_entries,
6658 &entries);
6659 break;
6660 default:
6661 unbecome_root();
6662 smb_panic("info class changed");
6663 break;
6664 }
6665
6666 unbecome_root();
6667
6668 /* Ensure we cache this enumeration. */
6669 set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
6670
6671 DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
6672 r->in.name->string));
6673
6674 for (i=0; i<num_account; i++) {
6675 if (strequal(entries[i].account_name, r->in.name->string)) {
6676 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6677 "found %s at idx %d\n",
6678 r->in.name->string, i));
6679 *r->out.idx = i;
6680 return NT_STATUS_OK;
6681 }
6682 }
6683
6684 /* assuming account_name lives at the very end */
6685 *r->out.idx = num_account;
6686
6687 return NT_STATUS_NO_MORE_ENTRIES;
6688 }
6689
6690 /****************************************************************
6691 _samr_GetDisplayEnumerationIndex2
6692 ****************************************************************/
6693
6694 NTSTATUS _samr_GetDisplayEnumerationIndex2(struct pipes_struct *p,
6695 struct samr_GetDisplayEnumerationIndex2 *r)
6696 {
6697 struct samr_GetDisplayEnumerationIndex q;
6698
6699 q.in.domain_handle = r->in.domain_handle;
6700 q.in.level = r->in.level;
6701 q.in.name = r->in.name;
6702
6703 q.out.idx = r->out.idx;
6704
6705 return _samr_GetDisplayEnumerationIndex(p, &q);
6706 }
6707
6708 /****************************************************************
6709 _samr_RidToSid
6710 ****************************************************************/
6711
6712 NTSTATUS _samr_RidToSid(struct pipes_struct *p,
6713 struct samr_RidToSid *r)
6714 {
6715 struct samr_domain_info *dinfo;
6716 NTSTATUS status;
6717 struct dom_sid sid;
6718
6719 dinfo = policy_handle_find(p, r->in.domain_handle,
6720 0, NULL,
6721 struct samr_domain_info, &status);
6722 if (!NT_STATUS_IS_OK(status)) {
6723 return status;
6724 }
6725
6726 if (!sid_compose(&sid, &dinfo->sid, r->in.rid)) {
6727 return NT_STATUS_NO_MEMORY;
6728 }
6729
6730 *r->out.sid = dom_sid_dup(p->mem_ctx, &sid);
6731 if (!*r->out.sid) {
6732 return NT_STATUS_NO_MEMORY;
6733 }
6734
6735 return NT_STATUS_OK;
6736 }
6737
6738 /****************************************************************
6739 ****************************************************************/
6740
6741 static enum samr_ValidationStatus samr_ValidatePassword_Change(TALLOC_CTX *mem_ctx,
6742 const struct samr_PwInfo *dom_pw_info,
6743 const struct samr_ValidatePasswordReq2 *req,
6744 struct samr_ValidatePasswordRepCtr *rep)
6745 {
6746 NTSTATUS status;
6747
6748 if (req->password.string == NULL) {
6749 return SAMR_VALIDATION_STATUS_SUCCESS;
6750 }
6751 if (strlen(req->password.string) < dom_pw_info->min_password_length) {
6752 ZERO_STRUCT(rep->info);
6753 return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT;
6754 }
6755 if (dom_pw_info->password_properties & DOMAIN_PASSWORD_COMPLEX) {
6756 status = check_password_complexity(req->account.string,
6757 req->password.string,
6758 NULL);
6759 if (!NT_STATUS_IS_OK(status)) {
6760 ZERO_STRUCT(rep->info);
6761 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
6762 }
6763 }
6764
6765 return SAMR_VALIDATION_STATUS_SUCCESS;
6766 }
6767
6768 /****************************************************************
6769 ****************************************************************/
6770
6771 static enum samr_ValidationStatus samr_ValidatePassword_Reset(TALLOC_CTX *mem_ctx,
6772 const struct samr_PwInfo *dom_pw_info,
6773 const struct samr_ValidatePasswordReq3 *req,
6774 struct samr_ValidatePasswordRepCtr *rep)
6775 {
6776 NTSTATUS status;
6777
6778 if (req->password.string == NULL) {
6779 return SAMR_VALIDATION_STATUS_SUCCESS;
6780 }
6781 if (strlen(req->password.string) < dom_pw_info->min_password_length) {
6782 ZERO_STRUCT(rep->info);
6783 return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT;
6784 }
6785 if (dom_pw_info->password_properties & DOMAIN_PASSWORD_COMPLEX) {
6786 status = check_password_complexity(req->account.string,
6787 req->password.string,
6788 NULL);
6789 if (!NT_STATUS_IS_OK(status)) {
6790 ZERO_STRUCT(rep->info);
6791 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
6792 }
6793 }
6794
6795 return SAMR_VALIDATION_STATUS_SUCCESS;
6796 }
6797
6798 /****************************************************************
6799 _samr_ValidatePassword
6800 ****************************************************************/
6801
6802 NTSTATUS _samr_ValidatePassword(struct pipes_struct *p,
6803 struct samr_ValidatePassword *r)
6804 {
6805 union samr_ValidatePasswordRep *rep;
6806 NTSTATUS status;
6807 struct samr_GetDomPwInfo pw;
6808 struct samr_PwInfo dom_pw_info;
6809
6810 if (p->transport != NCACN_IP_TCP && p->transport != NCALRPC) {
6811 p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
6812 return NT_STATUS_ACCESS_DENIED;
6813 }
6814
6815 if (r->in.level < 1 || r->in.level > 3) {
6816 return NT_STATUS_INVALID_INFO_CLASS;
6817 }
6818
6819 pw.in.domain_name = NULL;
6820 pw.out.info = &dom_pw_info;
6821
6822 status = _samr_GetDomPwInfo(p, &pw);
6823 if (!NT_STATUS_IS_OK(status)) {
6824 return status;
6825 }
6826
6827 rep = talloc_zero(p->mem_ctx, union samr_ValidatePasswordRep);
6828 if (!rep) {
6829 return NT_STATUS_NO_MEMORY;
6830 }
6831
6832 switch (r->in.level) {
6833 case 1:
6834 status = NT_STATUS_NOT_SUPPORTED;
6835 break;
6836 case 2:
6837 rep->ctr2.status = samr_ValidatePassword_Change(p->mem_ctx,
6838 &dom_pw_info,
6839 &r->in.req->req2,
6840 &rep->ctr2);
6841 break;
6842 case 3:
6843 rep->ctr3.status = samr_ValidatePassword_Reset(p->mem_ctx,
6844 &dom_pw_info,
6845 &r->in.req->req3,
6846 &rep->ctr3);
6847 break;
6848 default:
6849 status = NT_STATUS_INVALID_INFO_CLASS;
6850 break;
6851 }
6852
6853 if (!NT_STATUS_IS_OK(status)) {
6854 talloc_free(rep);
6855 return status;
6856 }
6857
6858 *r->out.rep = rep;
6859
6860 return NT_STATUS_OK;
6861 }
6862
6863 /****************************************************************
6864 ****************************************************************/
6865
6866 NTSTATUS _samr_Shutdown(struct pipes_struct *p,
6867 struct samr_Shutdown *r)
6868 {
6869 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6870 return NT_STATUS_NOT_IMPLEMENTED;
6871 }
6872
6873 /****************************************************************
6874 ****************************************************************/
6875
6876 NTSTATUS _samr_SetMemberAttributesOfGroup(struct pipes_struct *p,
6877 struct samr_SetMemberAttributesOfGroup *r)
6878 {
6879 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6880 return NT_STATUS_NOT_IMPLEMENTED;
6881 }
6882
6883 /****************************************************************
6884 ****************************************************************/
6885
6886 NTSTATUS _samr_TestPrivateFunctionsDomain(struct pipes_struct *p,
6887 struct samr_TestPrivateFunctionsDomain *r)
6888 {
6889 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6890 return NT_STATUS_NOT_IMPLEMENTED;
6891 }
6892
6893 /****************************************************************
6894 ****************************************************************/
6895
6896 NTSTATUS _samr_TestPrivateFunctionsUser(struct pipes_struct *p,
6897 struct samr_TestPrivateFunctionsUser *r)
6898 {
6899 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6900 return NT_STATUS_NOT_IMPLEMENTED;
6901 }
6902
6903 /****************************************************************
6904 ****************************************************************/
6905
6906 NTSTATUS _samr_AddMultipleMembersToAlias(struct pipes_struct *p,
6907 struct samr_AddMultipleMembersToAlias *r)
6908 {
6909 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6910 return NT_STATUS_NOT_IMPLEMENTED;
6911 }
6912
6913 /****************************************************************
6914 ****************************************************************/
6915
6916 NTSTATUS _samr_RemoveMultipleMembersFromAlias(struct pipes_struct *p,
6917 struct samr_RemoveMultipleMembersFromAlias *r)
6918 {
6919 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6920 return NT_STATUS_NOT_IMPLEMENTED;
6921 }
6922
6923 /****************************************************************
6924 ****************************************************************/
6925
6926 NTSTATUS _samr_SetBootKeyInformation(struct pipes_struct *p,
6927 struct samr_SetBootKeyInformation *r)
6928 {
6929 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6930 return NT_STATUS_NOT_IMPLEMENTED;
6931 }
6932
6933 /****************************************************************
6934 ****************************************************************/
6935
6936 NTSTATUS _samr_GetBootKeyInformation(struct pipes_struct *p,
6937 struct samr_GetBootKeyInformation *r)
6938 {
6939 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6940 return NT_STATUS_NOT_IMPLEMENTED;
6941 }
6942
6943 /****************************************************************
6944 ****************************************************************/
6945
6946 NTSTATUS _samr_SetDsrmPassword(struct pipes_struct *p,
6947 struct samr_SetDsrmPassword *r)
6948 {
6949 p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6950 return NT_STATUS_NOT_IMPLEMENTED;
6951 }
reg import