source3/winbindd/winbindd_samr.c

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  *
   4  * Winbind rpc backend functions
   5  *
   6  * Copyright (c) 2000-2003 Tim Potter
   7  * Copyright (c) 2001      Andrew Tridgell
   8  * Copyright (c) 2005      Volker Lendecke
   9  * Copyright (c) 2008      Guenther Deschner (pidl conversion)
  10  * Copyright (c) 2010      Andreas Schneider <asn@samba.org>
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License as published by
  14  * the Free Software Foundation; either version 3 of the License, or
  15  * (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24  */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "winbindd_rpc.h"
  29 #include "rpc_client/rpc_client.h"
  30 #include "../librpc/gen_ndr/ndr_samr_c.h"
  31 #include "rpc_client/cli_samr.h"
  32 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  33 #include "rpc_client/cli_lsarpc.h"
  34 #include "rpc_server/rpc_ncacn_np.h"
  35 #include "../libcli/security/security.h"
  36 #include "passdb/machine_sid.h"
  37 #include "auth.h"
  38
  39 #undef DBGC_CLASS
  40 #define DBGC_CLASS DBGC_WINBIND
  41
  42 NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
  43                                  struct winbindd_domain *domain,
  44                                  struct rpc_pipe_client **samr_pipe,
  45                                  struct policy_handle *samr_domain_hnd)
  46 {
  47         NTSTATUS status, result;
  48         struct policy_handle samr_connect_hnd;
  49         struct dcerpc_binding_handle *b;
  50
  51         status = wb_open_internal_pipe(mem_ctx, &ndr_table_samr, samr_pipe);
  52         if (!NT_STATUS_IS_OK(status)) {
  53                 return status;
  54         }
  55
  56         b = (*samr_pipe)->binding_handle;
  57
  58         status = dcerpc_samr_Connect2(b, mem_ctx,
  59                                       (*samr_pipe)->desthost,
  60                                       SEC_FLAG_MAXIMUM_ALLOWED,
  61                                       &samr_connect_hnd,
  62                                       &result);
  63         if (!NT_STATUS_IS_OK(status)) {
  64                 return status;
  65         }
  66         if (!NT_STATUS_IS_OK(result)) {
  67                 return result;
  68         }
  69
  70         status = dcerpc_samr_OpenDomain(b, mem_ctx,
  71                                         &samr_connect_hnd,
  72                                         SEC_FLAG_MAXIMUM_ALLOWED,
  73                                         &domain->sid,
  74                                         samr_domain_hnd,
  75                                         &result);
  76         if (!NT_STATUS_IS_OK(status)) {
  77                 return status;
  78         }
  79
  80         return result;
  81 }
  82
  83 NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
  84                                 struct rpc_pipe_client **lsa_pipe,
  85                                 struct policy_handle *lsa_hnd)
  86 {
  87         NTSTATUS status;
  88
  89         status = wb_open_internal_pipe(mem_ctx, &ndr_table_lsarpc, lsa_pipe);
  90         if (!NT_STATUS_IS_OK(status)) {
  91                 return status;
  92         }
  93
  94         status = rpccli_lsa_open_policy((*lsa_pipe),
  95                                         mem_ctx,
  96                                         true,
  97                                         SEC_FLAG_MAXIMUM_ALLOWED,
  98                                         lsa_hnd);
  99
 100         return status;
 101 }
 102
 103 /*********************************************************************
 104  SAM specific functions.
 105 *********************************************************************/
 106
 107 /* List all domain groups */
 108 static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 109                                     TALLOC_CTX *mem_ctx,
 110                                     uint32_t *pnum_info,
 111                                     struct wb_acct_info **pinfo)
 112 {
 113         struct rpc_pipe_client *samr_pipe;
 114         struct policy_handle dom_pol;
 115         struct wb_acct_info *info = NULL;
 116         uint32_t num_info = 0;
 117         TALLOC_CTX *tmp_ctx;
 118         NTSTATUS status, result;
 119         struct dcerpc_binding_handle *b = NULL;
 120
 121         DEBUG(3,("sam_enum_dom_groups\n"));
 122
 123         ZERO_STRUCT(dom_pol);
 124
 125         if (pnum_info) {
 126                 *pnum_info = 0;
 127         }
 128
 129         tmp_ctx = talloc_stackframe();
 130         if (tmp_ctx == NULL) {
 131                 return NT_STATUS_NO_MEMORY;
 132         }
 133
 134         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 135         if (!NT_STATUS_IS_OK(status)) {
 136                 goto error;
 137         }
 138
 139         b = samr_pipe->binding_handle;
 140
 141         status = rpc_enum_dom_groups(tmp_ctx,
 142                                      samr_pipe,
 143                                      &dom_pol,
 144                                      &num_info,
 145                                      &info);
 146         if (!NT_STATUS_IS_OK(status)) {
 147                 goto error;
 148         }
 149
 150         if (pnum_info) {
 151                 *pnum_info = num_info;
 152         }
 153
 154         if (pinfo) {
 155                 *pinfo = talloc_move(mem_ctx, &info);
 156         }
 157
 158 error:
 159         if (b && is_valid_policy_hnd(&dom_pol)) {
 160                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 161         }
 162         TALLOC_FREE(tmp_ctx);
 163         return status;
 164 }
 165
 166 /* Query display info for a domain */
 167 static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 168                                     TALLOC_CTX *mem_ctx,
 169                                     uint32_t *pnum_info,
 170                                     struct wbint_userinfo **pinfo)
 171 {
 172         struct rpc_pipe_client *samr_pipe = NULL;
 173         struct policy_handle dom_pol;
 174         struct wbint_userinfo *info = NULL;
 175         uint32_t num_info = 0;
 176         TALLOC_CTX *tmp_ctx;
 177         NTSTATUS status, result;
 178         struct dcerpc_binding_handle *b = NULL;
 179
 180         DEBUG(3,("samr_query_user_list\n"));
 181
 182         ZERO_STRUCT(dom_pol);
 183
 184         if (pnum_info) {
 185                 *pnum_info = 0;
 186         }
 187
 188         tmp_ctx = talloc_stackframe();
 189         if (tmp_ctx == NULL) {
 190                 return NT_STATUS_NO_MEMORY;
 191         }
 192
 193         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 194         if (!NT_STATUS_IS_OK(status)) {
 195                 goto done;
 196         }
 197
 198         b = samr_pipe->binding_handle;
 199
 200         status = rpc_query_user_list(tmp_ctx,
 201                                      samr_pipe,
 202                                      &dom_pol,
 203                                      &domain->sid,
 204                                      &num_info,
 205                                      &info);
 206         if (!NT_STATUS_IS_OK(status)) {
 207                 goto done;
 208         }
 209
 210         if (pnum_info) {
 211                 *pnum_info = num_info;
 212         }
 213
 214         if (pinfo) {
 215                 *pinfo = talloc_move(mem_ctx, &info);
 216         }
 217
 218 done:
 219         if (b && is_valid_policy_hnd(&dom_pol)) {
 220                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 221         }
 222
 223         TALLOC_FREE(tmp_ctx);
 224         return status;
 225 }
 226
 227 /* Lookup user information from a rid or username. */
 228 static NTSTATUS sam_query_user(struct winbindd_domain *domain,
 229                                TALLOC_CTX *mem_ctx,
 230                                const struct dom_sid *user_sid,
 231                                struct wbint_userinfo *user_info)
 232 {
 233         struct rpc_pipe_client *samr_pipe;
 234         struct policy_handle dom_pol;
 235         TALLOC_CTX *tmp_ctx;
 236         NTSTATUS status, result;
 237         struct dcerpc_binding_handle *b = NULL;
 238
 239         DEBUG(3,("sam_query_user\n"));
 240
 241         ZERO_STRUCT(dom_pol);
 242
 243         /* Paranoia check */
 244         if (!sid_check_is_in_our_sam(user_sid)) {
 245                 return NT_STATUS_NO_SUCH_USER;
 246         }
 247
 248         user_info->homedir = NULL;
 249         user_info->shell = NULL;
 250         user_info->primary_gid = (gid_t) -1;
 251
 252         tmp_ctx = talloc_stackframe();
 253         if (tmp_ctx == NULL) {
 254                 return NT_STATUS_NO_MEMORY;
 255         }
 256
 257         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 goto done;
 260         }
 261
 262         b = samr_pipe->binding_handle;
 263
 264         status = rpc_query_user(tmp_ctx,
 265                                 samr_pipe,
 266                                 &dom_pol,
 267                                 &domain->sid,
 268                                 user_sid,
 269                                 user_info);
 270
 271 done:
 272         if (b && is_valid_policy_hnd(&dom_pol)) {
 273                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 274         }
 275
 276         TALLOC_FREE(tmp_ctx);
 277         return status;
 278 }
 279
 280 /* get a list of trusted domains - builtin domain */
 281 static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 282                                     TALLOC_CTX *mem_ctx,
 283                                     struct netr_DomainTrustList *ptrust_list)
 284 {
 285         struct rpc_pipe_client *lsa_pipe;
 286         struct policy_handle lsa_policy;
 287         struct netr_DomainTrust *trusts = NULL;
 288         uint32_t num_trusts = 0;
 289         TALLOC_CTX *tmp_ctx;
 290         NTSTATUS status, result;
 291         struct dcerpc_binding_handle *b = NULL;
 292
 293         DEBUG(3,("samr: trusted domains\n"));
 294
 295         ZERO_STRUCT(lsa_policy);
 296
 297         if (ptrust_list) {
 298                 ZERO_STRUCTP(ptrust_list);
 299         }
 300
 301         tmp_ctx = talloc_stackframe();
 302         if (tmp_ctx == NULL) {
 303                 return NT_STATUS_NO_MEMORY;
 304         }
 305
 306         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 307         if (!NT_STATUS_IS_OK(status)) {
 308                 goto done;
 309         }
 310
 311         b = lsa_pipe->binding_handle;
 312
 313         status = rpc_trusted_domains(tmp_ctx,
 314                                      lsa_pipe,
 315                                      &lsa_policy,
 316                                      &num_trusts,
 317                                      &trusts);
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 goto done;
 320         }
 321
 322         if (ptrust_list) {
 323                 ptrust_list->count = num_trusts;
 324                 ptrust_list->array = talloc_move(mem_ctx, &trusts);
 325         }
 326
 327 done:
 328         if (b && is_valid_policy_hnd(&lsa_policy)) {
 329                 dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
 330         }
 331
 332         TALLOC_FREE(tmp_ctx);
 333         return status;
 334 }
 335
 336 /* Lookup group membership given a rid.   */
 337 static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 338                                     TALLOC_CTX *mem_ctx,
 339                                     const struct dom_sid *group_sid,
 340                                     enum lsa_SidType type,
 341                                     uint32_t *pnum_names,
 342                                     struct dom_sid **psid_mem,
 343                                     char ***pnames,
 344                                     uint32_t **pname_types)
 345 {
 346         struct rpc_pipe_client *samr_pipe;
 347         struct policy_handle dom_pol;
 348
 349         uint32_t num_names = 0;
 350         struct dom_sid *sid_mem = NULL;
 351         char **names = NULL;
 352         uint32_t *name_types = NULL;
 353
 354         TALLOC_CTX *tmp_ctx;
 355         NTSTATUS status, result;
 356         struct dcerpc_binding_handle *b = NULL;
 357
 358         DEBUG(3,("sam_lookup_groupmem\n"));
 359
 360         ZERO_STRUCT(dom_pol);
 361
 362         /* Paranoia check */
 363         if (sid_check_is_in_builtin(group_sid) && (type != SID_NAME_ALIAS)) {
 364                 /* There's no groups, only aliases in BUILTIN */
 365                 return NT_STATUS_NO_SUCH_GROUP;
 366         }
 367
 368         if (pnum_names) {
 369                 *pnum_names = 0;
 370         }
 371
 372         tmp_ctx = talloc_stackframe();
 373         if (tmp_ctx == NULL) {
 374                 return NT_STATUS_NO_MEMORY;
 375         }
 376
 377         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 378         if (!NT_STATUS_IS_OK(status)) {
 379                 goto done;
 380         }
 381
 382         b = samr_pipe->binding_handle;
 383
 384         status = rpc_lookup_groupmem(tmp_ctx,
 385                                      samr_pipe,
 386                                      &dom_pol,
 387                                      domain->name,
 388                                      &domain->sid,
 389                                      group_sid,
 390                                      type,
 391                                      &num_names,
 392                                      &sid_mem,
 393                                      &names,
 394                                      &name_types);
 395
 396         if (pnum_names) {
 397                 *pnum_names = num_names;
 398         }
 399
 400         if (pnames) {
 401                 *pnames = talloc_move(mem_ctx, &names);
 402         }
 403
 404         if (pname_types) {
 405                 *pname_types = talloc_move(mem_ctx, &name_types);
 406         }
 407
 408         if (psid_mem) {
 409                 *psid_mem = talloc_move(mem_ctx, &sid_mem);
 410         }
 411
 412 done:
 413         if (b && is_valid_policy_hnd(&dom_pol)) {
 414                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 415         }
 416
 417         TALLOC_FREE(tmp_ctx);
 418         return status;
 419 }
 420
 421 /*********************************************************************
 422  BUILTIN specific functions.
 423 *********************************************************************/
 424
 425 /* List all domain groups */
 426 static NTSTATUS builtin_enum_dom_groups(struct winbindd_domain *domain,
 427                                 TALLOC_CTX *mem_ctx,
 428                                 uint32_t *num_entries,
 429                                 struct wb_acct_info **info)
 430 {
 431         /* BUILTIN doesn't have domain groups */
 432         *num_entries = 0;
 433         *info = NULL;
 434         return NT_STATUS_OK;
 435 }
 436
 437 /* Query display info for a domain */
 438 static NTSTATUS builtin_query_user_list(struct winbindd_domain *domain,
 439                                 TALLOC_CTX *mem_ctx,
 440                                 uint32_t *num_entries,
 441                                 struct wbint_userinfo **info)
 442 {
 443         /* We don't have users */
 444         *num_entries = 0;
 445         *info = NULL;
 446         return NT_STATUS_OK;
 447 }
 448
 449 /* Lookup user information from a rid or username. */
 450 static NTSTATUS builtin_query_user(struct winbindd_domain *domain,
 451                                 TALLOC_CTX *mem_ctx,
 452                                 const struct dom_sid *user_sid,
 453                                 struct wbint_userinfo *user_info)
 454 {
 455         return NT_STATUS_NO_SUCH_USER;
 456 }
 457
 458 /* get a list of trusted domains - builtin domain */
 459 static NTSTATUS builtin_trusted_domains(struct winbindd_domain *domain,
 460                                         TALLOC_CTX *mem_ctx,
 461                                         struct netr_DomainTrustList *trusts)
 462 {
 463         ZERO_STRUCTP(trusts);
 464         return NT_STATUS_OK;
 465 }
 466
 467 /*********************************************************************
 468  COMMON functions.
 469 *********************************************************************/
 470
 471 /* List all local groups (aliases) */
 472 static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 473                                       TALLOC_CTX *mem_ctx,
 474                                       uint32_t *pnum_info,
 475                                       struct wb_acct_info **pinfo)
 476 {
 477         struct rpc_pipe_client *samr_pipe;
 478         struct policy_handle dom_pol;
 479         struct wb_acct_info *info = NULL;
 480         uint32_t num_info = 0;
 481         TALLOC_CTX *tmp_ctx;
 482         NTSTATUS status, result;
 483         struct dcerpc_binding_handle *b = NULL;
 484
 485         DEBUG(3,("samr: enum local groups\n"));
 486
 487         ZERO_STRUCT(dom_pol);
 488
 489         if (pnum_info) {
 490                 *pnum_info = 0;
 491         }
 492
 493         tmp_ctx = talloc_stackframe();
 494         if (tmp_ctx == NULL) {
 495                 return NT_STATUS_NO_MEMORY;
 496         }
 497
 498         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 499         if (!NT_STATUS_IS_OK(status)) {
 500                 goto done;
 501         }
 502
 503         b = samr_pipe->binding_handle;
 504
 505         status = rpc_enum_local_groups(mem_ctx,
 506                                        samr_pipe,
 507                                        &dom_pol,
 508                                        &num_info,
 509                                        &info);
 510         if (!NT_STATUS_IS_OK(status)) {
 511                 goto done;
 512         }
 513
 514         if (pnum_info) {
 515                 *pnum_info = num_info;
 516         }
 517
 518         if (pinfo) {
 519                 *pinfo = talloc_move(mem_ctx, &info);
 520         }
 521
 522 done:
 523         if (b && is_valid_policy_hnd(&dom_pol)) {
 524                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 525         }
 526
 527         TALLOC_FREE(tmp_ctx);
 528         return status;
 529 }
 530
 531 /* convert a single name to a sid in a domain */
 532 static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 533                                    TALLOC_CTX *mem_ctx,
 534                                    const char *domain_name,
 535                                    const char *name,
 536                                    uint32_t flags,
 537                                    struct dom_sid *psid,
 538                                    enum lsa_SidType *ptype)
 539 {
 540         struct rpc_pipe_client *lsa_pipe;
 541         struct policy_handle lsa_policy;
 542         struct dom_sid sid;
 543         enum lsa_SidType type;
 544         TALLOC_CTX *tmp_ctx;
 545         NTSTATUS status, result;
 546         struct dcerpc_binding_handle *b = NULL;
 547
 548         DEBUG(3,("sam_name_to_sid\n"));
 549
 550         ZERO_STRUCT(lsa_policy);
 551
 552         tmp_ctx = talloc_stackframe();
 553         if (tmp_ctx == NULL) {
 554                 return NT_STATUS_NO_MEMORY;
 555         }
 556
 557         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 558         if (!NT_STATUS_IS_OK(status)) {
 559                 goto done;
 560         }
 561
 562         b = lsa_pipe->binding_handle;
 563
 564         status = rpc_name_to_sid(tmp_ctx,
 565                                  lsa_pipe,
 566                                  &lsa_policy,
 567                                  domain_name,
 568                                  name,
 569                                  flags,
 570                                  &sid,
 571                                  &type);
 572         if (!NT_STATUS_IS_OK(status)) {
 573                 goto done;
 574         }
 575
 576         if (psid) {
 577                 sid_copy(psid, &sid);
 578         }
 579         if (ptype) {
 580                 *ptype = type;
 581         }
 582
 583 done:
 584         if (b && is_valid_policy_hnd(&lsa_policy)) {
 585                 dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
 586         }
 587
 588         TALLOC_FREE(tmp_ctx);
 589         return status;
 590 }
 591
 592 /* convert a domain SID to a user or group name */
 593 static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 594                                 TALLOC_CTX *mem_ctx,
 595                                 const struct dom_sid *sid,
 596                                 char **pdomain_name,
 597                                 char **pname,
 598                                 enum lsa_SidType *ptype)
 599 {
 600         struct rpc_pipe_client *lsa_pipe;
 601         struct policy_handle lsa_policy;
 602         char *domain_name = NULL;
 603         char *name = NULL;
 604         enum lsa_SidType type;
 605         TALLOC_CTX *tmp_ctx;
 606         NTSTATUS status, result;
 607         struct dcerpc_binding_handle *b = NULL;
 608
 609         DEBUG(3,("sam_sid_to_name\n"));
 610
 611         ZERO_STRUCT(lsa_policy);
 612
 613         /* Paranoia check */
 614         if (!sid_check_is_in_builtin(sid) &&
 615             !sid_check_is_builtin(sid) &&
 616             !sid_check_is_in_our_sam(sid) &&
 617             !sid_check_is_our_sam(sid) &&
 618             !sid_check_is_in_unix_users(sid) &&
 619             !sid_check_is_unix_users(sid) &&
 620             !sid_check_is_in_unix_groups(sid) &&
 621             !sid_check_is_unix_groups(sid) &&
 622             !sid_check_is_in_wellknown_domain(sid)) {
 623                 DEBUG(0, ("sam_sid_to_name: possible deadlock - trying to "
 624                           "lookup SID %s\n", sid_string_dbg(sid)));
 625                 return NT_STATUS_NONE_MAPPED;
 626         }
 627
 628         tmp_ctx = talloc_stackframe();
 629         if (tmp_ctx == NULL) {
 630                 return NT_STATUS_NO_MEMORY;
 631         }
 632
 633         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 634         if (!NT_STATUS_IS_OK(status)) {
 635                 goto done;
 636         }
 637
 638         b = lsa_pipe->binding_handle;
 639
 640         status = rpc_sid_to_name(tmp_ctx,
 641                                  lsa_pipe,
 642                                  &lsa_policy,
 643                                  domain,
 644                                  sid,
 645                                  &domain_name,
 646                                  &name,
 647                                  &type);
 648
 649         if (ptype) {
 650                 *ptype = type;
 651         }
 652
 653         if (pname) {
 654                 *pname = talloc_move(mem_ctx, &name);
 655         }
 656
 657         if (pdomain_name) {
 658                 *pdomain_name = talloc_move(mem_ctx, &domain_name);
 659         }
 660
 661 done:
 662         if (b && is_valid_policy_hnd(&lsa_policy)) {
 663                 dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
 664         }
 665
 666         TALLOC_FREE(tmp_ctx);
 667         return status;
 668 }
 669
 670 static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 671                                   TALLOC_CTX *mem_ctx,
 672                                   const struct dom_sid *domain_sid,
 673                                   uint32_t *rids,
 674                                   size_t num_rids,
 675                                   char **pdomain_name,
 676                                   char ***pnames,
 677                                   enum lsa_SidType **ptypes)
 678 {
 679         struct rpc_pipe_client *lsa_pipe;
 680         struct policy_handle lsa_policy;
 681         enum lsa_SidType *types = NULL;
 682         char *domain_name = NULL;
 683         char **names = NULL;
 684         TALLOC_CTX *tmp_ctx;
 685         NTSTATUS status, result;
 686         struct dcerpc_binding_handle *b = NULL;
 687
 688         DEBUG(3,("sam_rids_to_names for %s\n", domain->name));
 689
 690         ZERO_STRUCT(lsa_policy);
 691
 692         /* Paranoia check */
 693         if (!sid_check_is_builtin(domain_sid) &&
 694             !sid_check_is_our_sam(domain_sid) &&
 695             !sid_check_is_unix_users(domain_sid) &&
 696             !sid_check_is_unix_groups(domain_sid) &&
 697             !sid_check_is_in_wellknown_domain(domain_sid)) {
 698                 DEBUG(0, ("sam_rids_to_names: possible deadlock - trying to "
 699                           "lookup SID %s\n", sid_string_dbg(domain_sid)));
 700                 return NT_STATUS_NONE_MAPPED;
 701         }
 702
 703         tmp_ctx = talloc_stackframe();
 704         if (tmp_ctx == NULL) {
 705                 return NT_STATUS_NO_MEMORY;
 706         }
 707
 708         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 709         if (!NT_STATUS_IS_OK(status)) {
 710                 goto done;
 711         }
 712
 713         b = lsa_pipe->binding_handle;
 714
 715         status = rpc_rids_to_names(tmp_ctx,
 716                                    lsa_pipe,
 717                                    &lsa_policy,
 718                                    domain,
 719                                    domain_sid,
 720                                    rids,
 721                                    num_rids,
 722                                    &domain_name,
 723                                    &names,
 724                                    &types);
 725         if (!NT_STATUS_IS_OK(status)) {
 726                 goto done;
 727         }
 728
 729         if (pdomain_name) {
 730                 *pdomain_name = talloc_move(mem_ctx, &domain_name);
 731         }
 732
 733         if (ptypes) {
 734                 *ptypes = talloc_move(mem_ctx, &types);
 735         }
 736
 737         if (pnames) {
 738                 *pnames = talloc_move(mem_ctx, &names);
 739         }
 740
 741 done:
 742         if (b && is_valid_policy_hnd(&lsa_policy)) {
 743                 dcerpc_lsa_Close(b, mem_ctx, &lsa_policy, &result);
 744         }
 745
 746         TALLOC_FREE(tmp_ctx);
 747         return status;
 748 }
 749
 750 static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 751                                    TALLOC_CTX *mem_ctx,
 752                                    struct samr_DomInfo12 *lockout_policy)
 753 {
 754         struct rpc_pipe_client *samr_pipe;
 755         struct policy_handle dom_pol;
 756         union samr_DomainInfo *info = NULL;
 757         TALLOC_CTX *tmp_ctx;
 758         NTSTATUS status, result;
 759         struct dcerpc_binding_handle *b = NULL;
 760
 761         DEBUG(3,("sam_lockout_policy\n"));
 762
 763         ZERO_STRUCT(dom_pol);
 764
 765         tmp_ctx = talloc_stackframe();
 766         if (tmp_ctx == NULL) {
 767                 return NT_STATUS_NO_MEMORY;
 768         }
 769
 770         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 771         if (!NT_STATUS_IS_OK(status)) {
 772                 goto error;
 773         }
 774
 775         b = samr_pipe->binding_handle;
 776
 777         status = dcerpc_samr_QueryDomainInfo(b,
 778                                              mem_ctx,
 779                                              &dom_pol,
 780                                              DomainLockoutInformation,
 781                                              &info,
 782                                              &result);
 783         if (!NT_STATUS_IS_OK(status)) {
 784                 goto error;
 785         }
 786         if (!NT_STATUS_IS_OK(result)) {
 787                 status = result;
 788                 goto error;
 789         }
 790
 791         *lockout_policy = info->info12;
 792
 793 error:
 794         if (b && is_valid_policy_hnd(&dom_pol)) {
 795                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 796         }
 797
 798         TALLOC_FREE(tmp_ctx);
 799         return status;
 800 }
 801
 802 static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 803                                     TALLOC_CTX *mem_ctx,
 804                                     struct samr_DomInfo1 *passwd_policy)
 805 {
 806         struct rpc_pipe_client *samr_pipe;
 807         struct policy_handle dom_pol;
 808         union samr_DomainInfo *info = NULL;
 809         TALLOC_CTX *tmp_ctx;
 810         NTSTATUS status, result;
 811         struct dcerpc_binding_handle *b = NULL;
 812
 813         DEBUG(3,("sam_password_policy\n"));
 814
 815         ZERO_STRUCT(dom_pol);
 816
 817         tmp_ctx = talloc_stackframe();
 818         if (tmp_ctx == NULL) {
 819                 return NT_STATUS_NO_MEMORY;
 820         }
 821
 822         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 823         if (!NT_STATUS_IS_OK(status)) {
 824                 goto error;
 825         }
 826
 827         b = samr_pipe->binding_handle;
 828
 829         status = dcerpc_samr_QueryDomainInfo(b,
 830                                              mem_ctx,
 831                                              &dom_pol,
 832                                              DomainPasswordInformation,
 833                                              &info,
 834                                              &result);
 835         if (!NT_STATUS_IS_OK(status)) {
 836                 goto error;
 837         }
 838         if (!NT_STATUS_IS_OK(result)) {
 839                 status = result;
 840                 goto error;
 841         }
 842
 843         *passwd_policy = info->info1;
 844
 845 error:
 846         if (b && is_valid_policy_hnd(&dom_pol)) {
 847                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 848         }
 849
 850         TALLOC_FREE(tmp_ctx);
 851         return status;
 852 }
 853
 854 /* Lookup groups a user is a member of. */
 855 static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 856                                       TALLOC_CTX *mem_ctx,
 857                                       const struct dom_sid *user_sid,
 858                                       uint32_t *pnum_groups,
 859                                       struct dom_sid **puser_grpsids)
 860 {
 861         struct rpc_pipe_client *samr_pipe;
 862         struct policy_handle dom_pol;
 863         struct dom_sid *user_grpsids = NULL;
 864         uint32_t num_groups = 0;
 865         TALLOC_CTX *tmp_ctx;
 866         NTSTATUS status, result;
 867         struct dcerpc_binding_handle *b = NULL;
 868
 869         DEBUG(3,("sam_lookup_usergroups\n"));
 870
 871         ZERO_STRUCT(dom_pol);
 872
 873         if (pnum_groups) {
 874                 *pnum_groups = 0;
 875         }
 876
 877         tmp_ctx = talloc_stackframe();
 878         if (tmp_ctx == NULL) {
 879                 return NT_STATUS_NO_MEMORY;
 880         }
 881
 882         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 883         if (!NT_STATUS_IS_OK(status)) {
 884                 goto done;
 885         }
 886
 887         b = samr_pipe->binding_handle;
 888
 889         status = rpc_lookup_usergroups(tmp_ctx,
 890                                        samr_pipe,
 891                                        &dom_pol,
 892                                        &domain->sid,
 893                                        user_sid,
 894                                        &num_groups,
 895                                        &user_grpsids);
 896         if (!NT_STATUS_IS_OK(status)) {
 897                 goto done;
 898         }
 899
 900         if (pnum_groups) {
 901                 *pnum_groups = num_groups;
 902         }
 903
 904         if (puser_grpsids) {
 905                 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
 906         }
 907
 908 done:
 909         if (b && is_valid_policy_hnd(&dom_pol)) {
 910                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 911         }
 912
 913         TALLOC_FREE(tmp_ctx);
 914         return status;
 915 }
 916
 917 static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 918                                        TALLOC_CTX *mem_ctx,
 919                                        uint32_t num_sids,
 920                                        const struct dom_sid *sids,
 921                                        uint32_t *pnum_aliases,
 922                                        uint32_t **palias_rids)
 923 {
 924         struct rpc_pipe_client *samr_pipe;
 925         struct policy_handle dom_pol;
 926         uint32_t num_aliases = 0;
 927         uint32_t *alias_rids = NULL;
 928         TALLOC_CTX *tmp_ctx;
 929         NTSTATUS status, result;
 930         struct dcerpc_binding_handle *b = NULL;
 931
 932         DEBUG(3,("sam_lookup_useraliases\n"));
 933
 934         ZERO_STRUCT(dom_pol);
 935
 936         if (pnum_aliases) {
 937                 *pnum_aliases = 0;
 938         }
 939
 940         tmp_ctx = talloc_stackframe();
 941         if (tmp_ctx == NULL) {
 942                 return NT_STATUS_NO_MEMORY;
 943         }
 944
 945         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 946         if (!NT_STATUS_IS_OK(status)) {
 947                 goto done;
 948         }
 949
 950         b = samr_pipe->binding_handle;
 951
 952         status = rpc_lookup_useraliases(tmp_ctx,
 953                                         samr_pipe,
 954                                         &dom_pol,
 955                                         num_sids,
 956                                         sids,
 957                                         &num_aliases,
 958                                         &alias_rids);
 959         if (!NT_STATUS_IS_OK(status)) {
 960                 goto done;
 961         }
 962
 963         if (pnum_aliases) {
 964                 *pnum_aliases = num_aliases;
 965         }
 966
 967         if (palias_rids) {
 968                 *palias_rids = talloc_move(mem_ctx, &alias_rids);
 969         }
 970
 971 done:
 972         if (b && is_valid_policy_hnd(&dom_pol)) {
 973                 dcerpc_samr_Close(b, mem_ctx, &dom_pol, &result);
 974         }
 975
 976         TALLOC_FREE(tmp_ctx);
 977         return status;
 978 }
 979
 980 /* find the sequence number for a domain */
 981 static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
 982                                     uint32_t *pseq)
 983 {
 984         struct rpc_pipe_client *samr_pipe;
 985         struct policy_handle dom_pol;
 986         uint32_t seq;
 987         TALLOC_CTX *tmp_ctx;
 988         NTSTATUS status, result;
 989         struct dcerpc_binding_handle *b = NULL;
 990
 991         DEBUG(3,("samr: sequence number\n"));
 992
 993         ZERO_STRUCT(dom_pol);
 994
 995         if (pseq) {
 996                 *pseq = DOM_SEQUENCE_NONE;
 997         }
 998
 999         tmp_ctx = talloc_stackframe();
1000         if (tmp_ctx == NULL) {
1001                 return NT_STATUS_NO_MEMORY;
1002         }
1003
1004         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
1005         if (!NT_STATUS_IS_OK(status)) {
1006                 goto done;
1007         }
1008
1009         b = samr_pipe->binding_handle;
1010
1011         status = rpc_sequence_number(tmp_ctx,
1012                                      samr_pipe,
1013                                      &dom_pol,
1014                                      domain->name,
1015                                      &seq);
1016         if (!NT_STATUS_IS_OK(status)) {
1017                 goto done;
1018         }
1019
1020         if (pseq) {
1021                 *pseq = seq;
1022         }
1023 done:
1024         if (b && is_valid_policy_hnd(&dom_pol)) {
1025                 dcerpc_samr_Close(b, tmp_ctx, &dom_pol, &result);
1026         }
1027
1028         TALLOC_FREE(tmp_ctx);
1029         return status;
1030 }
1031
1032 /* the rpc backend methods are exposed via this structure */
1033 struct winbindd_methods builtin_passdb_methods = {
1034         .consistent            = false,
1035
1036         .query_user_list       = builtin_query_user_list,
1037         .enum_dom_groups       = builtin_enum_dom_groups,
1038         .enum_local_groups     = sam_enum_local_groups,
1039         .name_to_sid           = sam_name_to_sid,
1040         .sid_to_name           = sam_sid_to_name,
1041         .rids_to_names         = sam_rids_to_names,
1042         .query_user            = builtin_query_user,
1043         .lookup_usergroups     = sam_lookup_usergroups,
1044         .lookup_useraliases    = sam_lookup_useraliases,
1045         .lookup_groupmem       = sam_lookup_groupmem,
1046         .sequence_number       = sam_sequence_number,
1047         .lockout_policy        = sam_lockout_policy,
1048         .password_policy       = sam_password_policy,
1049         .trusted_domains       = builtin_trusted_domains
1050 };
1051
1052 /* the rpc backend methods are exposed via this structure */
1053 struct winbindd_methods sam_passdb_methods = {
1054         .consistent            = false,
1055
1056         .query_user_list       = sam_query_user_list,
1057         .enum_dom_groups       = sam_enum_dom_groups,
1058         .enum_local_groups     = sam_enum_local_groups,
1059         .name_to_sid           = sam_name_to_sid,
1060         .sid_to_name           = sam_sid_to_name,
1061         .rids_to_names         = sam_rids_to_names,
1062         .query_user            = sam_query_user,
1063         .lookup_usergroups     = sam_lookup_usergroups,
1064         .lookup_useraliases    = sam_lookup_useraliases,
1065         .lookup_groupmem       = sam_lookup_groupmem,
1066         .sequence_number       = sam_sequence_number,
1067         .lockout_policy        = sam_lockout_policy,
1068         .password_policy       = sam_password_policy,
1069         .trusted_domains       = sam_trusted_domains
1070 };