/* This is the implementation of the lsa server code. */
#include "includes.h"
+#include "ntdomain.h"
#include "../librpc/gen_ndr/srv_lsa.h"
#include "secrets.h"
#include "../librpc/gen_ndr/netlogon.h"
#include "rpc_client/init_lsa.h"
#include "../libcli/security/security.h"
+#include "../libcli/security/dom_sid.h"
+#include "../librpc/gen_ndr/drsblobs.h"
+#include "../librpc/gen_ndr/ndr_drsblobs.h"
+#include "../lib/crypto/arcfour.h"
+#include "../libcli/security/dom_sid.h"
+#include "../librpc/gen_ndr/ndr_security.h"
+#include "passdb.h"
+#include "auth.h"
+#include "lib/privileges.h"
+#include "rpc_server/srv_access_check.h"
+#include "../librpc/gen_ndr/ndr_wkssvc.h"
+#include "../libcli/auth/libcli_auth.h"
+#include "../libcli/lsarpc/util_lsarpc.h"
+#include "lsa.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_SRV
enum lsa_handle_type {
LSA_HANDLE_POLICY_TYPE = 1,
LSA_HANDLE_ACCOUNT_TYPE = 2,
- LSA_HANDLE_TRUST_TYPE = 3};
+ LSA_HANDLE_TRUST_TYPE = 3,
+ LSA_HANDLE_SECRET_TYPE = 4};
struct lsa_info {
struct dom_sid sid;
const char *name;
- uint32 access;
+ uint32_t access;
enum lsa_handle_type type;
struct security_descriptor *sd;
};
LSA_TRUSTED_DOMAIN_ALL_ACCESS
};
-/***************************************************************************
- init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
-***************************************************************************/
-
-static int init_lsa_ref_domain_list(TALLOC_CTX *mem_ctx,
- struct lsa_RefDomainList *ref,
- const char *dom_name,
- struct dom_sid *dom_sid)
-{
- int num = 0;
-
- if (dom_name != NULL) {
- for (num = 0; num < ref->count; num++) {
- if (dom_sid_equal(dom_sid, ref->domains[num].sid)) {
- return num;
- }
- }
- } else {
- num = ref->count;
- }
-
- if (num >= LSA_REF_DOMAIN_LIST_MULTIPLIER) {
- /* index not found, already at maximum domain limit */
- return -1;
- }
-
- ref->count = num + 1;
- ref->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER;
-
- ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
- struct lsa_DomainInfo, ref->count);
- if (!ref->domains) {
- return -1;
- }
-
- ZERO_STRUCT(ref->domains[num]);
-
- init_lsa_StringLarge(&ref->domains[num].name, dom_name);
- ref->domains[num].sid = dom_sid_dup(mem_ctx, dom_sid);
- if (!ref->domains[num].sid) {
- return -1;
- }
-
- return num;
-}
-
-
/***************************************************************************
initialize a lsa_DomainInfo structure.
***************************************************************************/
int flags,
uint32_t *pmapped_count)
{
- uint32 mapped_count, i;
+ uint32_t mapped_count, i;
SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
for (i = 0; i < num_entries; i++) {
struct dom_sid sid;
- uint32 rid;
+ uint32_t rid;
int dom_idx;
const char *full_name;
const char *domain;
- enum lsa_SidType type = SID_NAME_UNKNOWN;
+ enum lsa_SidType type;
/* Split name into domain and user component */
DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
- /* We can ignore the result of lookup_name, it will not touch
- "type" if it's not successful */
-
- lookup_name(mem_ctx, full_name, flags, &domain, NULL,
- &sid, &type);
+ if (!lookup_name(mem_ctx, full_name, flags, &domain, NULL,
+ &sid, &type)) {
+ type = SID_NAME_UNKNOWN;
+ }
switch (type) {
case SID_NAME_USER:
uint32_t num_entries,
struct lsa_String *name,
int flags,
- uint32 *pmapped_count)
+ uint32_t *pmapped_count)
{
- uint32 mapped_count, i;
+ uint32_t mapped_count, i;
SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
for (i = 0; i < num_entries; i++) {
struct dom_sid sid;
- uint32 rid;
+ uint32_t rid;
int dom_idx;
const char *full_name;
const char *domain;
- enum lsa_SidType type = SID_NAME_UNKNOWN;
+ enum lsa_SidType type;
ZERO_STRUCT(sid);
return NT_STATUS_NO_MEMORY;
}
- DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
+ DEBUG(5, ("lookup_lsa_sids: looking up name %s\n", full_name));
- /* We can ignore the result of lookup_name, it will not touch
- "type" if it's not successful */
-
- lookup_name(mem_ctx, full_name, flags, &domain, NULL,
- &sid, &type);
+ if (!lookup_name(mem_ctx, full_name, flags, &domain, NULL,
+ &sid, &type)) {
+ type = SID_NAME_UNKNOWN;
+ }
switch (type) {
case SID_NAME_USER:
case SID_NAME_DOMAIN:
case SID_NAME_ALIAS:
case SID_NAME_WKN_GRP:
- DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
+ DEBUG(5, ("lookup_lsa_sids: %s found\n", full_name));
/* Leave these unchanged */
break;
default:
/* Don't hand out anything but the list above */
- DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
+ DEBUG(5, ("lookup_lsa_sids: %s not found\n", full_name));
type = SID_NAME_UNKNOWN;
break;
}
info->name = talloc_strdup(info, name);
- if (sd) {
- info->sd = dup_sec_desc(info, sd);
- if (!info->sd) {
+ if (sd != NULL) {
+ info->sd = security_descriptor_copy(info, sd);
+ if (info->sd == NULL) {
talloc_free(info);
return NT_STATUS_NO_MEMORY;
}
{
struct security_descriptor *psd = NULL;
size_t sd_size;
- uint32 des_access = r->in.access_mask;
- uint32 acc_granted;
+ uint32_t des_access = r->in.access_mask;
+ uint32_t acc_granted;
NTSTATUS status;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ p->session_info->unix_token,
&des_access);
/* map the generic bits to the lsa policy ones */
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0, des_access,
&acc_granted, "_lsa_OpenPolicy2" );
if (!NT_STATUS_IS_OK(status)) {
{
struct lsa_OpenPolicy2 o;
+ /* _lsa_OpenPolicy2 will check if this is a NCACN_NP connection */
+
o.in.system_name = NULL; /* should be ignored */
o.in.attr = r->in.attr;
o.in.access_mask = r->in.access_mask;
return nt_status;
}
- entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_DomainInfo, count);
+ entries = talloc_zero_array(p->mem_ctx, struct lsa_DomainInfo, count);
if (!entries) {
return NT_STATUS_NO_MEMORY;
}
/* return NT_STATUS_ACCESS_DENIED; */
}
- info = TALLOC_ZERO_P(p->mem_ctx, union lsa_PolicyInformation);
+ info = talloc_zero(p->mem_ctx, union lsa_PolicyInformation);
if (!info) {
return NT_STATUS_NO_MEMORY;
}
case LSA_POLICY_INFO_AUDIT_EVENTS:
{
- uint32 policy_def = LSA_AUDIT_POLICY_ALL;
+ uint32_t policy_def = LSA_AUDIT_POLICY_ALL;
/* check if the user has enough rights */
if (!(handle->access & LSA_POLICY_VIEW_AUDIT_INFORMATION)) {
info->audit_events.auditing_mode = true;
info->audit_events.count = LSA_AUDIT_NUM_CATEGORIES;
- info->audit_events.settings = TALLOC_ZERO_ARRAY(p->mem_ctx,
+ info->audit_events.settings = talloc_zero_array(p->mem_ctx,
enum lsa_PolicyAuditPolicy,
info->audit_events.count);
if (!info->audit_events.settings) {
struct lsa_QueryInfoPolicy r;
if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
int i;
const struct dom_sid **sids = NULL;
struct lsa_RefDomainList *ref = NULL;
- uint32 mapped_count = 0;
+ uint32_t mapped_count = 0;
struct lsa_dom_info *dom_infos = NULL;
struct lsa_name_info *name_infos = NULL;
struct lsa_TranslatedName2 *names = NULL;
return NT_STATUS_OK;
}
- sids = TALLOC_ARRAY(p->mem_ctx, const struct dom_sid *, num_sids);
- ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
+ sids = talloc_array(p->mem_ctx, const struct dom_sid *, num_sids);
+ ref = talloc_zero(p->mem_ctx, struct lsa_RefDomainList);
if (sids == NULL || ref == NULL) {
return NT_STATUS_NO_MEMORY;
return status;
}
- names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
+ names = talloc_array(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
if (names == NULL) {
return NT_STATUS_NO_MEMORY;
}
struct lsa_name_info *name = &name_infos[i];
if (name->type == SID_NAME_UNKNOWN) {
- fstring tmp;
name->dom_idx = -1;
/* Unknown sids should return the string
* representation of the SID. Windows 2003 behaves
* RID as 8 bytes hex, in others it returns the full
* SID. We (Jerry/VL) could not figure out which the
* hard cases are, so leave it with the SID. */
- name->name = talloc_asprintf(p->mem_ctx, "%s",
- sid_to_fstring(tmp,
- sids[i]));
+ name->name = dom_sid_string(p->mem_ctx, sids[i]);
if (name->name == NULL) {
return NT_STATUS_NO_MEMORY;
}
NTSTATUS status;
struct lsa_info *handle;
int num_sids = r->in.sids->num_sids;
- uint32 mapped_count = 0;
+ uint32_t mapped_count = 0;
struct lsa_RefDomainList *domains = NULL;
struct lsa_TranslatedName *names_out = NULL;
struct lsa_TranslatedName2 *names = NULL;
int i;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if ((r->in.level < 1) || (r->in.level > 6)) {
return NT_STATUS_INVALID_PARAMETER;
}
}
/* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
- names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
+ names_out = talloc_array(p->mem_ctx, struct lsa_TranslatedName,
num_sids);
if (!names_out) {
return NT_STATUS_NO_MEMORY;
return status;
}
-/***************************************************************************
- _lsa_LookupSids2
- ***************************************************************************/
-
-NTSTATUS _lsa_LookupSids2(struct pipes_struct *p,
- struct lsa_LookupSids2 *r)
+static NTSTATUS _lsa_LookupSids_common(struct pipes_struct *p,
+ struct lsa_LookupSids2 *r)
{
NTSTATUS status;
struct lsa_info *handle;
int num_sids = r->in.sids->num_sids;
- uint32 mapped_count = 0;
+ uint32_t mapped_count = 0;
struct lsa_RefDomainList *domains = NULL;
struct lsa_TranslatedName2 *names = NULL;
bool check_policy = true;
return status;
}
+/***************************************************************************
+ _lsa_LookupSids2
+ ***************************************************************************/
+
+NTSTATUS _lsa_LookupSids2(struct pipes_struct *p,
+ struct lsa_LookupSids2 *r)
+{
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ return _lsa_LookupSids_common(p, r);
+}
+
/***************************************************************************
_lsa_LookupSids3
***************************************************************************/
{
struct lsa_LookupSids2 q;
+ if (p->transport != NCACN_IP_TCP) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
/* No policy handle on this call. Restrict to crypto connections. */
- if (p->auth.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
- DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
- get_remote_machine_name() ));
- return NT_STATUS_INVALID_PARAMETER;
+ if (p->auth.auth_type != DCERPC_AUTH_TYPE_SCHANNEL ||
+ p->auth.auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
+ DEBUG(1, ("_lsa_LookupSids3: The client %s is not using "
+ "a secure connection over netlogon\n",
+ get_remote_machine_name() ));
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
}
q.in.handle = NULL;
q.out.names = r->out.names;
q.out.count = r->out.count;
- return _lsa_LookupSids2(p, &q);
+ return _lsa_LookupSids_common(p, &q);
}
/***************************************************************************
NTSTATUS status = NT_STATUS_NONE_MAPPED;
struct lsa_info *handle;
struct lsa_String *names = r->in.names;
- uint32 num_entries = r->in.num_names;
+ uint32_t num_entries = r->in.num_names;
struct lsa_RefDomainList *domains = NULL;
struct lsa_TranslatedSid *rids = NULL;
- uint32 mapped_count = 0;
+ uint32_t mapped_count = 0;
int flags = 0;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if (num_entries > MAX_LOOKUP_SIDS) {
num_entries = MAX_LOOKUP_SIDS;
DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
flags = lsa_lookup_level_to_flags(r->in.level);
- domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
+ domains = talloc_zero(p->mem_ctx, struct lsa_RefDomainList);
if (!domains) {
return NT_STATUS_NO_MEMORY;
}
if (num_entries) {
- rids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid,
+ rids = talloc_zero_array(p->mem_ctx, struct lsa_TranslatedSid,
num_entries);
if (!rids) {
return NT_STATUS_NO_MEMORY;
struct lsa_TransSidArray *sid_array = NULL;
uint32_t i;
- sid_array = TALLOC_ZERO_P(p->mem_ctx, struct lsa_TransSidArray);
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ sid_array = talloc_zero(p->mem_ctx, struct lsa_TransSidArray);
if (!sid_array) {
return NT_STATUS_NO_MEMORY;
}
status = _lsa_LookupNames(p, &q);
sid_array2->count = sid_array->count;
- sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
+ sid_array2->sids = talloc_array(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
if (!sid_array2->sids) {
return NT_STATUS_NO_MEMORY;
}
return status;
}
-/***************************************************************************
- _lsa_LookupNames3
- ***************************************************************************/
-
-NTSTATUS _lsa_LookupNames3(struct pipes_struct *p,
- struct lsa_LookupNames3 *r)
+static NTSTATUS _lsa_LookupNames_common(struct pipes_struct *p,
+ struct lsa_LookupNames3 *r)
{
NTSTATUS status;
struct lsa_info *handle;
struct lsa_String *names = r->in.names;
- uint32 num_entries = r->in.num_names;
+ uint32_t num_entries = r->in.num_names;
struct lsa_RefDomainList *domains = NULL;
struct lsa_TranslatedSid3 *trans_sids = NULL;
- uint32 mapped_count = 0;
+ uint32_t mapped_count = 0;
int flags = 0;
bool check_policy = true;
DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries));
}
- /* Probably the lookup_level is some sort of bitmask. */
- if (r->in.level == 1) {
- flags = LOOKUP_NAME_ALL;
- }
+ flags = lsa_lookup_level_to_flags(r->in.level);
- domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
+ domains = talloc_zero(p->mem_ctx, struct lsa_RefDomainList);
if (!domains) {
return NT_STATUS_NO_MEMORY;
}
if (num_entries) {
- trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid3,
+ trans_sids = talloc_zero_array(p->mem_ctx, struct lsa_TranslatedSid3,
num_entries);
if (!trans_sids) {
return NT_STATUS_NO_MEMORY;
return status;
}
+/***************************************************************************
+ _lsa_LookupNames3
+ ***************************************************************************/
+
+NTSTATUS _lsa_LookupNames3(struct pipes_struct *p,
+ struct lsa_LookupNames3 *r)
+{
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ return _lsa_LookupNames_common(p, r);
+}
+
/***************************************************************************
_lsa_LookupNames4
***************************************************************************/
{
struct lsa_LookupNames3 q;
+ if (p->transport != NCACN_IP_TCP) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
/* No policy handle on this call. Restrict to crypto connections. */
- if (p->auth.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
- DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
- get_remote_machine_name() ));
- return NT_STATUS_INVALID_PARAMETER;
+ if (p->auth.auth_type != DCERPC_AUTH_TYPE_SCHANNEL ||
+ p->auth.auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
+ DEBUG(1, ("_lsa_LookupNames4: The client %s is not using "
+ "a secure connection over netlogon\n",
+ get_remote_machine_name()));
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
}
q.in.handle = NULL;
q.out.sids = r->out.sids;
q.out.count = r->out.count;
- return _lsa_LookupNames3(p, &q);
+ return _lsa_LookupNames_common(p, &q);
}
/***************************************************************************
NTSTATUS _lsa_Close(struct pipes_struct *p, struct lsa_Close *r)
{
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
return NT_STATUS_INVALID_HANDLE;
}
/***************************************************************************
***************************************************************************/
-NTSTATUS _lsa_OpenSecret(struct pipes_struct *p, struct lsa_OpenSecret *r)
+static NTSTATUS lsa_lookup_trusted_domain_by_sid(TALLOC_CTX *mem_ctx,
+ const struct dom_sid *sid,
+ struct trustdom_info **info)
{
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ NTSTATUS status;
+ uint32_t num_domains = 0;
+ struct trustdom_info **domains = NULL;
+ int i;
+
+ status = pdb_enum_trusteddoms(mem_ctx, &num_domains, &domains);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ for (i=0; i < num_domains; i++) {
+ if (dom_sid_equal(&domains[i]->sid, sid)) {
+ break;
+ }
+ }
+
+ if (i == num_domains) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ *info = domains[i];
+
+ return NT_STATUS_OK;
}
/***************************************************************************
***************************************************************************/
-NTSTATUS _lsa_OpenTrustedDomain(struct pipes_struct *p,
- struct lsa_OpenTrustedDomain *r)
+static NTSTATUS lsa_lookup_trusted_domain_by_name(TALLOC_CTX *mem_ctx,
+ const char *netbios_domain_name,
+ struct trustdom_info **info_p)
{
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ NTSTATUS status;
+ struct trustdom_info *info;
+ struct pdb_trusted_domain *td;
+
+ status = pdb_get_trusted_domain(mem_ctx, netbios_domain_name, &td);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ info = talloc(mem_ctx, struct trustdom_info);
+ if (!info) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ info->name = talloc_strdup(info, netbios_domain_name);
+ NT_STATUS_HAVE_NO_MEMORY(info->name);
+
+ sid_copy(&info->sid, &td->security_identifier);
+
+ *info_p = info;
+
+ return NT_STATUS_OK;
}
/***************************************************************************
- _lsa_CreateTrustedDomainEx2
+ _lsa_OpenSecret
***************************************************************************/
-NTSTATUS _lsa_CreateTrustedDomainEx2(struct pipes_struct *p,
- struct lsa_CreateTrustedDomainEx2 *r)
+NTSTATUS _lsa_OpenSecret(struct pipes_struct *p,
+ struct lsa_OpenSecret *r)
{
- struct lsa_info *policy;
+ struct lsa_info *handle;
+ struct security_descriptor *psd;
NTSTATUS status;
uint32_t acc_granted;
- struct security_descriptor *psd;
- size_t sd_size;
- struct pdb_trusted_domain td;
-
- if (!IS_DC) {
- return NT_STATUS_NOT_SUPPORTED;
- }
- if (!find_policy_by_hnd(p, r->in.policy_handle, (void **)(void *)&policy)) {
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
return NT_STATUS_INVALID_HANDLE;
}
- if (!(policy->access & LSA_POLICY_TRUST_ADMIN)) {
- return NT_STATUS_ACCESS_DENIED;
+ if (handle->type != LSA_HANDLE_POLICY_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
}
- if (p->server_info->utok.uid != sec_initial_uid() &&
- !nt_token_check_domain_rid(p->server_info->security_token, DOMAIN_RID_ADMINS)) {
- return NT_STATUS_ACCESS_DENIED;
+ if (!r->in.name.string) {
+ return NT_STATUS_INVALID_PARAMETER;
}
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ p->session_info->unix_token,
&r->in.access_mask);
/* map the generic bits to the lsa policy ones */
- se_map_generic(&r->in.access_mask, &lsa_account_mapping);
-
- status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
- &lsa_trusted_domain_mapping,
- NULL, 0);
+ se_map_generic(&r->in.access_mask, &lsa_secret_mapping);
+
+ status = pdb_get_secret(p->mem_ctx, r->in.name.string,
+ NULL,
+ NULL,
+ NULL,
+ NULL,
+ &psd);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
- r->in.access_mask, &acc_granted,
- "_lsa_CreateTrustedDomainEx2");
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
-
- ZERO_STRUCT(td);
-
- td.domain_name = r->in.info->domain_name.string;
- td.netbios_name = r->in.info->netbios_name.string;
- sid_copy(&td.security_identifier, r->in.info->sid);
- td.trust_auth_incoming.data = NULL;
- td.trust_auth_incoming.length = 0;
- td.trust_auth_outgoing.data = NULL;
- td.trust_auth_outgoing.length = 0;
- td.trust_direction = r->in.info->trust_direction;
- td.trust_type = r->in.info->trust_type;
- td.trust_attributes = r->in.info->trust_attributes;
-
- status = pdb_set_trusted_domain(r->in.info->domain_name.string, &td);
+ r->in.access_mask,
+ &acc_granted, "_lsa_OpenSecret");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
status = create_lsa_policy_handle(p->mem_ctx, p,
- LSA_HANDLE_TRUST_TYPE,
+ LSA_HANDLE_SECRET_TYPE,
acc_granted,
- r->in.info->sid,
- r->in.info->netbios_name.string,
+ NULL,
+ r->in.name.string,
psd,
- r->out.trustdom_handle);
+ r->out.sec_handle);
if (!NT_STATUS_IS_OK(status)) {
- pdb_del_trusteddom_pw(r->in.info->netbios_name.string);
return NT_STATUS_OBJECT_NAME_NOT_FOUND;
}
}
/***************************************************************************
- _lsa_CreateTrustedDomainEx
+ _lsa_OpenTrustedDomain_base
***************************************************************************/
-NTSTATUS _lsa_CreateTrustedDomainEx(struct pipes_struct *p,
- struct lsa_CreateTrustedDomainEx *r)
+static NTSTATUS _lsa_OpenTrustedDomain_base(struct pipes_struct *p,
+ uint32_t access_mask,
+ struct trustdom_info *info,
+ struct policy_handle *handle)
{
- struct lsa_CreateTrustedDomainEx2 q;
-
- q.in.policy_handle = r->in.policy_handle;
- q.in.info = r->in.info;
- q.in.auth_info = r->in.auth_info;
- q.in.access_mask = r->in.access_mask;
- q.out.trustdom_handle = r->out.trustdom_handle;
+ struct security_descriptor *psd = NULL;
+ size_t sd_size;
+ uint32_t acc_granted;
+ NTSTATUS status;
- return _lsa_CreateTrustedDomainEx2(p, &q);
-}
+ /* des_access is for the account here, not the policy
+ * handle - so don't check against policy handle. */
-/***************************************************************************
- _lsa_CreateTrustedDomain
- ***************************************************************************/
+ /* Work out max allowed. */
+ map_max_allowed_access(p->session_info->security_token,
+ p->session_info->unix_token,
+ &access_mask);
-NTSTATUS _lsa_CreateTrustedDomain(struct pipes_struct *p,
- struct lsa_CreateTrustedDomain *r)
-{
- struct lsa_CreateTrustedDomainEx2 c;
- struct lsa_TrustDomainInfoInfoEx info;
- struct lsa_TrustDomainInfoAuthInfoInternal auth_info;
+ /* map the generic bits to the lsa account ones */
+ se_map_generic(&access_mask, &lsa_trusted_domain_mapping);
- ZERO_STRUCT(auth_info);
+ /* get the generic lsa account SD until we store it */
+ status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
+ &lsa_trusted_domain_mapping,
+ NULL, 0);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
- info.domain_name = r->in.info->name;
- info.netbios_name = r->in.info->name;
- info.sid = r->in.info->sid;
- info.trust_direction = LSA_TRUST_DIRECTION_OUTBOUND;
- info.trust_type = LSA_TRUST_TYPE_DOWNLEVEL;
- info.trust_attributes = 0;
+ status = access_check_object(psd, p->session_info->security_token,
+ SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
+ access_mask, &acc_granted,
+ "_lsa_OpenTrustedDomain");
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
- c.in.policy_handle = r->in.policy_handle;
- c.in.info = &info;
- c.in.auth_info = &auth_info;
- c.in.access_mask = r->in.access_mask;
- c.out.trustdom_handle = r->out.trustdom_handle;
+ status = create_lsa_policy_handle(p->mem_ctx, p,
+ LSA_HANDLE_TRUST_TYPE,
+ acc_granted,
+ &info->sid,
+ info->name,
+ psd,
+ handle);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ }
- return _lsa_CreateTrustedDomainEx2(p, &c);
+ return NT_STATUS_OK;
}
/***************************************************************************
+ _lsa_OpenTrustedDomain
***************************************************************************/
-NTSTATUS _lsa_CreateSecret(struct pipes_struct *p, struct lsa_CreateSecret *r)
+NTSTATUS _lsa_OpenTrustedDomain(struct pipes_struct *p,
+ struct lsa_OpenTrustedDomain *r)
{
- return NT_STATUS_ACCESS_DENIED;
-}
+ struct lsa_info *handle = NULL;
+ struct trustdom_info *info = NULL;
+ NTSTATUS status;
-/***************************************************************************
- ***************************************************************************/
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
-NTSTATUS _lsa_SetSecret(struct pipes_struct *p, struct lsa_SetSecret *r)
-{
- return NT_STATUS_ACCESS_DENIED;
+ if (handle->type != LSA_HANDLE_POLICY_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ status = lsa_lookup_trusted_domain_by_sid(p->mem_ctx,
+ r->in.sid,
+ &info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ return _lsa_OpenTrustedDomain_base(p, r->in.access_mask, info,
+ r->out.trustdom_handle);
}
/***************************************************************************
- _lsa_DeleteObject
+ _lsa_OpenTrustedDomainByName
***************************************************************************/
-NTSTATUS _lsa_DeleteObject(struct pipes_struct *p,
- struct lsa_DeleteObject *r)
+NTSTATUS _lsa_OpenTrustedDomainByName(struct pipes_struct *p,
+ struct lsa_OpenTrustedDomainByName *r)
{
+ struct lsa_info *handle = NULL;
+ struct trustdom_info *info = NULL;
NTSTATUS status;
- struct lsa_info *info = NULL;
- if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
return NT_STATUS_INVALID_HANDLE;
}
- if (!(info->access & SEC_STD_DELETE)) {
+ if (handle->type != LSA_HANDLE_POLICY_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ status = lsa_lookup_trusted_domain_by_name(p->mem_ctx,
+ r->in.name.string,
+ &info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ return _lsa_OpenTrustedDomain_base(p, r->in.access_mask, info,
+ r->out.trustdom_handle);
+}
+
+static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p,
+ TALLOC_CTX *mem_ctx, DATA_BLOB *auth_blob,
+ struct trustDomainPasswords *auth_struct)
+{
+ enum ndr_err_code ndr_err;
+ DATA_BLOB lsession_key;
+ NTSTATUS status;
+
+ status = session_extract_session_key(p->session_info, &lsession_key, KEY_USE_16BYTES);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ arcfour_crypt_blob(auth_blob->data, auth_blob->length, &lsession_key);
+ ndr_err = ndr_pull_struct_blob(auth_blob, mem_ctx,
+ auth_struct,
+ (ndr_pull_flags_fn_t)ndr_pull_trustDomainPasswords);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS get_trustauth_inout_blob(TALLOC_CTX *mem_ctx,
+ struct trustAuthInOutBlob *iopw,
+ DATA_BLOB *trustauth_blob)
+{
+ enum ndr_err_code ndr_err;
+
+ if (iopw->current.count != iopw->count) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (iopw->previous.count > iopw->current.count) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (iopw->previous.count == 0) {
+ /*
+ * If the previous credentials are not present
+ * we need to make a copy.
+ */
+ iopw->previous = iopw->current;
+ }
+
+ if (iopw->previous.count < iopw->current.count) {
+ struct AuthenticationInformationArray *c = &iopw->current;
+ struct AuthenticationInformationArray *p = &iopw->previous;
+
+ /*
+ * The previous array needs to have the same size
+ * as the current one.
+ *
+ * We may have to fill with TRUST_AUTH_TYPE_NONE
+ * elements.
+ */
+ p->array = talloc_realloc(mem_ctx, p->array,
+ struct AuthenticationInformation,
+ c->count);
+ if (p->array == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ while (p->count < c->count) {
+ struct AuthenticationInformation *a =
+ &p->array[p->count++];
+
+ *a = (struct AuthenticationInformation) {
+ .LastUpdateTime = p->array[0].LastUpdateTime,
+ .AuthType = TRUST_AUTH_TYPE_NONE,
+ };
+ }
+ }
+
+ ndr_err = ndr_push_struct_blob(trustauth_blob, mem_ctx,
+ iopw,
+ (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ _lsa_CreateTrustedDomainEx2
+ ***************************************************************************/
+
+NTSTATUS _lsa_CreateTrustedDomainEx2(struct pipes_struct *p,
+ struct lsa_CreateTrustedDomainEx2 *r)
+{
+ struct lsa_info *policy;
+ NTSTATUS status;
+ uint32_t acc_granted;
+ struct security_descriptor *psd;
+ size_t sd_size;
+ struct pdb_trusted_domain td;
+ struct trustDomainPasswords auth_struct;
+ DATA_BLOB auth_blob;
+
+ if (!IS_DC) {
+ return NT_STATUS_NOT_SUPPORTED;
+ }
+
+ if (!find_policy_by_hnd(p, r->in.policy_handle, (void **)(void *)&policy)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (!(policy->access & LSA_POLICY_TRUST_ADMIN)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ if (p->session_info->unix_token->uid != sec_initial_uid() &&
+ !nt_token_check_domain_rid(p->session_info->security_token, DOMAIN_RID_ADMINS)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ /* Work out max allowed. */
+ map_max_allowed_access(p->session_info->security_token,
+ p->session_info->unix_token,
+ &r->in.access_mask);
+
+ /* map the generic bits to the lsa policy ones */
+ se_map_generic(&r->in.access_mask, &lsa_account_mapping);
+
+ status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
+ &lsa_trusted_domain_mapping,
+ NULL, 0);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = access_check_object(psd, p->session_info->security_token,
+ SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
+ r->in.access_mask, &acc_granted,
+ "_lsa_CreateTrustedDomainEx2");
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ ZERO_STRUCT(td);
+
+ td.domain_name = talloc_strdup(p->mem_ctx,
+ r->in.info->domain_name.string);
+ if (td.domain_name == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ td.netbios_name = talloc_strdup(p->mem_ctx,
+ r->in.info->netbios_name.string);
+ if (td.netbios_name == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ sid_copy(&td.security_identifier, r->in.info->sid);
+ td.trust_direction = r->in.info->trust_direction;
+ td.trust_type = r->in.info->trust_type;
+ td.trust_attributes = r->in.info->trust_attributes;
+
+ if (r->in.auth_info_internal->auth_blob.size != 0) {
+ auth_blob.length = r->in.auth_info_internal->auth_blob.size;
+ auth_blob.data = r->in.auth_info_internal->auth_blob.data;
+
+ status = get_trustdom_auth_blob(p, p->mem_ctx, &auth_blob, &auth_struct);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ status = get_trustauth_inout_blob(p->mem_ctx, &auth_struct.incoming, &td.trust_auth_incoming);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ status = get_trustauth_inout_blob(p->mem_ctx, &auth_struct.outgoing, &td.trust_auth_outgoing);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+ } else {
+ td.trust_auth_incoming.data = NULL;
+ td.trust_auth_incoming.length = 0;
+ td.trust_auth_outgoing.data = NULL;
+ td.trust_auth_outgoing.length = 0;
+ }
+
+ status = pdb_set_trusted_domain(r->in.info->domain_name.string, &td);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = create_lsa_policy_handle(p->mem_ctx, p,
+ LSA_HANDLE_TRUST_TYPE,
+ acc_granted,
+ r->in.info->sid,
+ r->in.info->netbios_name.string,
+ psd,
+ r->out.trustdom_handle);
+ if (!NT_STATUS_IS_OK(status)) {
+ pdb_del_trusted_domain(r->in.info->netbios_name.string);
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ _lsa_CreateTrustedDomainEx
+ ***************************************************************************/
+
+NTSTATUS _lsa_CreateTrustedDomainEx(struct pipes_struct *p,
+ struct lsa_CreateTrustedDomainEx *r)
+{
+ struct lsa_CreateTrustedDomainEx2 q;
+ struct lsa_TrustDomainInfoAuthInfoInternal auth_info;
+
+ ZERO_STRUCT(auth_info);
+
+ q.in.policy_handle = r->in.policy_handle;
+ q.in.info = r->in.info;
+ q.in.auth_info_internal = &auth_info;
+ q.in.access_mask = r->in.access_mask;
+ q.out.trustdom_handle = r->out.trustdom_handle;
+
+ return _lsa_CreateTrustedDomainEx2(p, &q);
+}
+
+/***************************************************************************
+ _lsa_CreateTrustedDomain
+ ***************************************************************************/
+
+NTSTATUS _lsa_CreateTrustedDomain(struct pipes_struct *p,
+ struct lsa_CreateTrustedDomain *r)
+{
+ struct lsa_CreateTrustedDomainEx2 c;
+ struct lsa_TrustDomainInfoInfoEx info;
+ struct lsa_TrustDomainInfoAuthInfoInternal auth_info;
+
+ ZERO_STRUCT(auth_info);
+
+ info.domain_name = r->in.info->name;
+ info.netbios_name = r->in.info->name;
+ info.sid = r->in.info->sid;
+ info.trust_direction = LSA_TRUST_DIRECTION_OUTBOUND;
+ info.trust_type = LSA_TRUST_TYPE_DOWNLEVEL;
+ info.trust_attributes = 0;
+
+ c.in.policy_handle = r->in.policy_handle;
+ c.in.info = &info;
+ c.in.auth_info_internal = &auth_info;
+ c.in.access_mask = r->in.access_mask;
+ c.out.trustdom_handle = r->out.trustdom_handle;
+
+ return _lsa_CreateTrustedDomainEx2(p, &c);
+}
+
+/***************************************************************************
+ _lsa_DeleteTrustedDomain
+ ***************************************************************************/
+
+NTSTATUS _lsa_DeleteTrustedDomain(struct pipes_struct *p,
+ struct lsa_DeleteTrustedDomain *r)
+{
+ NTSTATUS status;
+ struct lsa_info *handle;
+ struct pdb_trusted_domain *td;
+
+ /* find the connection policy handle. */
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (handle->type != LSA_HANDLE_POLICY_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (!(handle->access & LSA_POLICY_TRUST_ADMIN)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ status = pdb_get_trusted_domain_by_sid(p->mem_ctx, r->in.dom_sid, &td);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ if (td->netbios_name == NULL || *td->netbios_name == '\0') {
+ DEBUG(10, ("Missing netbios name for for trusted domain %s.\n",
+ sid_string_tos(r->in.dom_sid)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ status = pdb_del_trusted_domain(td->netbios_name);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ _lsa_CloseTrustedDomainEx
+ ***************************************************************************/
+
+NTSTATUS _lsa_CloseTrustedDomainEx(struct pipes_struct *p,
+ struct lsa_CloseTrustedDomainEx *r)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+/***************************************************************************
+ _lsa_QueryTrustedDomainInfo
+ ***************************************************************************/
+
+static NTSTATUS pdb_trusted_domain_2_info_ex(TALLOC_CTX *mem_ctx,
+ struct pdb_trusted_domain *td,
+ struct lsa_TrustDomainInfoInfoEx *info_ex)
+{
+ if (td->domain_name == NULL ||
+ td->netbios_name == NULL ||
+ is_null_sid(&td->security_identifier)) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ info_ex->domain_name.string = talloc_strdup(mem_ctx, td->domain_name);
+ info_ex->netbios_name.string = talloc_strdup(mem_ctx, td->netbios_name);
+ info_ex->sid = dom_sid_dup(mem_ctx, &td->security_identifier);
+ if (info_ex->domain_name.string == NULL ||
+ info_ex->netbios_name.string == NULL ||
+ info_ex->sid == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ info_ex->trust_direction = td->trust_direction;
+ info_ex->trust_type = td->trust_type;
+ info_ex->trust_attributes = td->trust_attributes;
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS _lsa_QueryTrustedDomainInfo(struct pipes_struct *p,
+ struct lsa_QueryTrustedDomainInfo *r)
+{
+ NTSTATUS status;
+ struct lsa_info *handle;
+ union lsa_TrustedDomainInfo *info;
+ struct pdb_trusted_domain *td;
+ uint32_t acc_required;
+
+ /* find the connection policy handle. */
+ if (!find_policy_by_hnd(p, r->in.trustdom_handle, (void **)(void *)&handle)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (handle->type != LSA_HANDLE_TRUST_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ switch (r->in.level) {
+ case LSA_TRUSTED_DOMAIN_INFO_NAME:
+ acc_required = LSA_TRUSTED_QUERY_DOMAIN_NAME;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_CONTROLLERS:
+ acc_required = LSA_TRUSTED_QUERY_CONTROLLERS;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET:
+ acc_required = LSA_TRUSTED_QUERY_POSIX;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
+ acc_required = LSA_TRUSTED_QUERY_AUTH;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_BASIC:
+ acc_required = LSA_TRUSTED_QUERY_DOMAIN_NAME;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_INFO_EX:
+ acc_required = LSA_TRUSTED_QUERY_DOMAIN_NAME;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO:
+ acc_required = LSA_TRUSTED_QUERY_AUTH;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO:
+ acc_required = LSA_TRUSTED_QUERY_DOMAIN_NAME |
+ LSA_TRUSTED_QUERY_POSIX |
+ LSA_TRUSTED_QUERY_AUTH;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO_INTERNAL:
+ acc_required = LSA_TRUSTED_QUERY_AUTH;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_INTERNAL:
+ acc_required = LSA_TRUSTED_QUERY_DOMAIN_NAME |
+ LSA_TRUSTED_QUERY_POSIX |
+ LSA_TRUSTED_QUERY_AUTH;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_INFO_EX2_INTERNAL:
+ acc_required = LSA_TRUSTED_QUERY_DOMAIN_NAME;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_2_INTERNAL:
+ acc_required = LSA_TRUSTED_QUERY_DOMAIN_NAME |
+ LSA_TRUSTED_QUERY_POSIX |
+ LSA_TRUSTED_QUERY_AUTH;
+ break;
+ case LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES:
+ acc_required = LSA_TRUSTED_QUERY_POSIX;
+ break;
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (!(handle->access & acc_required)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ status = pdb_get_trusted_domain_by_sid(p->mem_ctx, &handle->sid, &td);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ info = talloc_zero(p->mem_ctx, union lsa_TrustedDomainInfo);
+ if (!info) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ switch (r->in.level) {
+ case LSA_TRUSTED_DOMAIN_INFO_NAME:
+ init_lsa_StringLarge(&info->name.netbios_name, td->netbios_name);
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_CONTROLLERS:
+ return NT_STATUS_INVALID_PARAMETER;
+ case LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET:
+ info->posix_offset.posix_offset = *td->trust_posix_offset;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
+ return NT_STATUS_INVALID_INFO_CLASS;
+ case LSA_TRUSTED_DOMAIN_INFO_BASIC:
+ return NT_STATUS_INVALID_PARAMETER;
+ case LSA_TRUSTED_DOMAIN_INFO_INFO_EX:
+ status = pdb_trusted_domain_2_info_ex(info, td, &info->info_ex);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO:
+ return NT_STATUS_INVALID_INFO_CLASS;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO:
+ status = pdb_trusted_domain_2_info_ex(info, td,
+ &info->full_info.info_ex);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ info->full_info.posix_offset.posix_offset = *td->trust_posix_offset;
+ status = auth_blob_2_auth_info(p->mem_ctx,
+ td->trust_auth_incoming,
+ td->trust_auth_outgoing,
+ &info->full_info.auth_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO_INTERNAL:
+ return NT_STATUS_INVALID_INFO_CLASS;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_INTERNAL:
+ return NT_STATUS_INVALID_INFO_CLASS;
+ case LSA_TRUSTED_DOMAIN_INFO_INFO_EX2_INTERNAL:
+ return NT_STATUS_INVALID_PARAMETER;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_2_INTERNAL:
+ info->full_info2_internal.posix_offset.posix_offset = *td->trust_posix_offset;
+ status = auth_blob_2_auth_info(p->mem_ctx,
+ td->trust_auth_incoming,
+ td->trust_auth_outgoing,
+ &info->full_info2_internal.auth_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ break;
+ case LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES:
+ info->enc_types.enc_types = *td->supported_enc_type;
+ break;
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ *r->out.info = info;
+
+ return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ _lsa_QueryTrustedDomainInfoBySid
+ ***************************************************************************/
+
+NTSTATUS _lsa_QueryTrustedDomainInfoBySid(struct pipes_struct *p,
+ struct lsa_QueryTrustedDomainInfoBySid *r)
+{
+ NTSTATUS status;
+ struct policy_handle trustdom_handle;
+ struct lsa_OpenTrustedDomain o;
+ struct lsa_QueryTrustedDomainInfo q;
+ struct lsa_Close c;
+
+ o.in.handle = r->in.handle;
+ o.in.sid = r->in.dom_sid;
+ o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+ o.out.trustdom_handle = &trustdom_handle;
+
+ status = _lsa_OpenTrustedDomain(p, &o);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ q.in.trustdom_handle = &trustdom_handle;
+ q.in.level = r->in.level;
+ q.out.info = r->out.info;
+
+ status = _lsa_QueryTrustedDomainInfo(p, &q);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ c.in.handle = &trustdom_handle;
+ c.out.handle = &trustdom_handle;
+
+ return _lsa_Close(p, &c);
+}
+
+/***************************************************************************
+ _lsa_QueryTrustedDomainInfoByName
+ ***************************************************************************/
+
+NTSTATUS _lsa_QueryTrustedDomainInfoByName(struct pipes_struct *p,
+ struct lsa_QueryTrustedDomainInfoByName *r)
+{
+ NTSTATUS status;
+ struct policy_handle trustdom_handle;
+ struct lsa_OpenTrustedDomainByName o;
+ struct lsa_QueryTrustedDomainInfo q;
+ struct lsa_Close c;
+
+ o.in.handle = r->in.handle;
+ o.in.name.string = r->in.trusted_domain->string;
+ o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+ o.out.trustdom_handle = &trustdom_handle;
+
+ status = _lsa_OpenTrustedDomainByName(p, &o);
+ if (!NT_STATUS_IS_OK(status)) {
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_DOMAIN)) {
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ }
+ return status;
+ }
+
+ q.in.trustdom_handle = &trustdom_handle;
+ q.in.level = r->in.level;
+ q.out.info = r->out.info;
+
+ status = _lsa_QueryTrustedDomainInfo(p, &q);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ c.in.handle = &trustdom_handle;
+ c.out.handle = &trustdom_handle;
+
+ return _lsa_Close(p, &c);
+}
+
+/***************************************************************************
+ _lsa_CreateSecret
+ ***************************************************************************/
+
+NTSTATUS _lsa_CreateSecret(struct pipes_struct *p,
+ struct lsa_CreateSecret *r)
+{
+ NTSTATUS status;
+ struct lsa_info *handle;
+ uint32_t acc_granted;
+ struct security_descriptor *psd;
+ size_t sd_size;
+
+ /* find the connection policy handle. */
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (handle->type != LSA_HANDLE_POLICY_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ /* check if the user has enough rights */
+
+ if (!(handle->access & LSA_POLICY_CREATE_SECRET)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ /* Work out max allowed. */
+ map_max_allowed_access(p->session_info->security_token,
+ p->session_info->unix_token,
+ &r->in.access_mask);
+
+ /* map the generic bits to the lsa policy ones */
+ se_map_generic(&r->in.access_mask, &lsa_secret_mapping);
+
+ status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
+ &lsa_secret_mapping,
+ NULL, 0);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = access_check_object(psd, p->session_info->security_token,
+ SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
+ r->in.access_mask,
+ &acc_granted, "_lsa_CreateSecret");
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ if (!r->in.name.string) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (strlen(r->in.name.string) > 128) {
+ return NT_STATUS_NAME_TOO_LONG;
+ }
+
+ status = pdb_get_secret(p->mem_ctx, r->in.name.string,
+ NULL, NULL, NULL, NULL, NULL);
+ if (NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_OBJECT_NAME_COLLISION;
+ }
+
+ status = pdb_set_secret(r->in.name.string, NULL, NULL, psd);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = create_lsa_policy_handle(p->mem_ctx, p,
+ LSA_HANDLE_SECRET_TYPE,
+ acc_granted,
+ NULL,
+ r->in.name.string,
+ psd,
+ r->out.sec_handle);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ _lsa_SetSecret
+ ***************************************************************************/
+
+NTSTATUS _lsa_SetSecret(struct pipes_struct *p,
+ struct lsa_SetSecret *r)
+{
+ NTSTATUS status;
+ struct lsa_info *info = NULL;
+ DATA_BLOB blob_new, blob_old;
+ DATA_BLOB cleartext_blob_new = data_blob_null;
+ DATA_BLOB cleartext_blob_old = data_blob_null;
+ DATA_BLOB *cleartext_blob_new_p = NULL;
+ DATA_BLOB *cleartext_blob_old_p = NULL;
+ DATA_BLOB session_key;
+
+ if (!find_policy_by_hnd(p, r->in.sec_handle, (void **)(void *)&info)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (info->type != LSA_HANDLE_SECRET_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (!(info->access & LSA_SECRET_SET_VALUE)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
+ if(!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ if (r->in.new_val) {
+ blob_new = data_blob_const(r->in.new_val->data,
+ r->in.new_val->length);
+
+ status = sess_decrypt_blob(p->mem_ctx, &blob_new,
+ &session_key,
+ &cleartext_blob_new);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ cleartext_blob_new_p = &cleartext_blob_new;
+ }
+
+ if (r->in.old_val) {
+ blob_old = data_blob_const(r->in.old_val->data,
+ r->in.old_val->length);
+
+ status = sess_decrypt_blob(p->mem_ctx, &blob_old,
+ &session_key,
+ &cleartext_blob_old);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ cleartext_blob_old_p = &cleartext_blob_old;
+ }
+
+ status = pdb_set_secret(info->name, cleartext_blob_new_p, cleartext_blob_old_p, NULL);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+#ifdef DEBUG_PASSWORD
+ DEBUG(10,("_lsa_SetSecret: successfully set new secret\n"));
+ dump_data(10, cleartext_blob_new.data, cleartext_blob_new.length);
+ DEBUG(10,("_lsa_SetSecret: successfully set old secret\n"));
+ dump_data(10, cleartext_blob_old.data, cleartext_blob_old.length);
+#endif
+
+ return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ _lsa_QuerySecret
+ ***************************************************************************/
+
+NTSTATUS _lsa_QuerySecret(struct pipes_struct *p,
+ struct lsa_QuerySecret *r)
+{
+ struct lsa_info *info = NULL;
+ DATA_BLOB blob_new, blob_old;
+ DATA_BLOB blob_new_crypt, blob_old_crypt;
+ DATA_BLOB session_key;
+ NTTIME nttime_new, nttime_old;
+ NTSTATUS status;
+
+ if (!find_policy_by_hnd(p, r->in.sec_handle, (void **)(void *)&info)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (info->type != LSA_HANDLE_SECRET_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (!(info->access & LSA_SECRET_QUERY_VALUE)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ status = pdb_get_secret(p->mem_ctx, info->name,
+ &blob_new, &nttime_new,
+ &blob_old, &nttime_old,
+ NULL);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
+ if(!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ if (r->in.new_val) {
+ if (blob_new.length) {
+ if (!r->out.new_val->buf) {
+ r->out.new_val->buf = talloc_zero(p->mem_ctx, struct lsa_DATA_BUF);
+ }
+ if (!r->out.new_val->buf) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ blob_new_crypt = sess_encrypt_blob(p->mem_ctx, &blob_new,
+ &session_key);
+ if (!blob_new_crypt.length) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ r->out.new_val->buf->data = blob_new_crypt.data;
+ r->out.new_val->buf->length = blob_new_crypt.length;
+ r->out.new_val->buf->size = blob_new_crypt.length;
+ }
+ }
+
+ if (r->in.old_val) {
+ if (blob_old.length) {
+ if (!r->out.old_val->buf) {
+ r->out.old_val->buf = talloc_zero(p->mem_ctx, struct lsa_DATA_BUF);
+ }
+ if (!r->out.old_val->buf) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ blob_old_crypt = sess_encrypt_blob(p->mem_ctx, &blob_old,
+ &session_key);
+ if (!blob_old_crypt.length) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ r->out.old_val->buf->data = blob_old_crypt.data;
+ r->out.old_val->buf->length = blob_old_crypt.length;
+ r->out.old_val->buf->size = blob_old_crypt.length;
+ }
+ }
+
+ if (r->out.new_mtime) {
+ *r->out.new_mtime = nttime_new;
+ }
+
+ if (r->out.old_mtime) {
+ *r->out.old_mtime = nttime_old;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/***************************************************************************
+ _lsa_DeleteObject
+ ***************************************************************************/
+
+NTSTATUS _lsa_DeleteObject(struct pipes_struct *p,
+ struct lsa_DeleteObject *r)
+{
+ NTSTATUS status;
+ struct lsa_info *info = NULL;
+
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (!(info->access & SEC_STD_DELETE)) {
return NT_STATUS_ACCESS_DENIED;
}
return status;
}
break;
+ case LSA_HANDLE_TRUST_TYPE:
+ if (!pdb_del_trusteddom_pw(info->name)) {
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ }
+ status = NT_STATUS_OK;
+ break;
+ case LSA_HANDLE_SECRET_TYPE:
+ status = pdb_delete_secret(info->name);
+ if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+ break;
default:
return NT_STATUS_INVALID_HANDLE;
}
struct lsa_EnumPrivs *r)
{
struct lsa_info *handle;
- uint32 i;
- uint32 enum_context = *r->in.resume_handle;
+ uint32_t i;
+ uint32_t enum_context = *r->in.resume_handle;
int num_privs = num_privileges_in_short_list();
struct lsa_PrivEntry *entries = NULL;
return NT_STATUS_ACCESS_DENIED;
if (num_privs) {
- entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_PrivEntry, num_privs);
+ entries = talloc_zero_array(p->mem_ctx, struct lsa_PrivEntry, num_privs);
if (!entries) {
return NT_STATUS_NO_MEMORY;
}
DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description));
- lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
+ lsa_name = talloc_zero(p->mem_ctx, struct lsa_StringLarge);
if (!lsa_name) {
return NT_STATUS_NO_MEMORY;
}
}
if (num_entries - *r->in.resume_handle) {
- sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr,
+ sids = talloc_zero_array(p->mem_ctx, struct lsa_SidPtr,
num_entries - *r->in.resume_handle);
if (!sids) {
talloc_free(sid_list);
struct lsa_String *account_name = NULL;
struct lsa_String *authority_name = NULL;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if (r->in.account_name &&
*r->in.account_name) {
return NT_STATUS_INVALID_PARAMETER;
return NT_STATUS_INVALID_PARAMETER;
}
- if (p->server_info->guest) {
+ if (security_session_user_level(p->session_info, NULL) < SECURITY_USER) {
/*
* I'm 99% sure this is not the right place to do this,
* global_sid_Anonymous should probably be put into the token
return NT_STATUS_NO_MEMORY;
}
} else {
- username = p->server_info->sanitized_username;
- domname = p->server_info->info3->base.domain.string;
+ username = p->session_info->unix_info->sanitized_username;
+ domname = p->session_info->info->domain_name;
}
- account_name = TALLOC_P(p->mem_ctx, struct lsa_String);
+ account_name = talloc(p->mem_ctx, struct lsa_String);
if (!account_name) {
return NT_STATUS_NO_MEMORY;
}
init_lsa_String(account_name, username);
if (r->out.authority_name) {
- authority_name = TALLOC_P(p->mem_ctx, struct lsa_String);
+ authority_name = talloc(p->mem_ctx, struct lsa_String);
if (!authority_name) {
return NT_STATUS_NO_MEMORY;
}
uint32_t acc_granted;
struct security_descriptor *psd;
size_t sd_size;
+ uint32_t owner_access = (LSA_ACCOUNT_ALL_ACCESS &
+ ~(LSA_ACCOUNT_ADJUST_PRIVILEGES|
+ LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
+ SEC_STD_DELETE));
/* find the connection policy handle. */
if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
}
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ p->session_info->unix_token,
&r->in.access_mask);
/* map the generic bits to the lsa policy ones */
status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
&lsa_account_mapping,
- r->in.sid, LSA_POLICY_ALL_ACCESS);
+ r->in.sid, owner_access);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0, r->in.access_mask,
&acc_granted, "_lsa_CreateAccount");
if (!NT_STATUS_IS_OK(status)) {
size_t sd_size;
uint32_t des_access = r->in.access_mask;
uint32_t acc_granted;
+ uint32_t owner_access = (LSA_ACCOUNT_ALL_ACCESS &
+ ~(LSA_ACCOUNT_ADJUST_PRIVILEGES|
+ LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
+ SEC_STD_DELETE));
NTSTATUS status;
/* find the connection policy handle. */
* handle - so don't check against policy handle. */
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ p->session_info->unix_token,
&des_access);
/* map the generic bits to the lsa account ones */
/* get the generic lsa account SD until we store it */
status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
&lsa_account_mapping,
- r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
+ r->in.sid, owner_access);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0, des_access,
&acc_granted, "_lsa_OpenAccount" );
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- *r->out.privs = priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
+ *r->out.privs = priv_set = talloc_zero(p->mem_ctx, struct lsa_PrivilegeSet);
if (!priv_set) {
return NT_STATUS_NO_MEMORY;
}
struct lsa_SetSystemAccessAccount *r)
{
struct lsa_info *info=NULL;
- GROUP_MAP map;
+ NTSTATUS status;
+ GROUP_MAP *map;
/* find the connection policy handle. */
if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
return NT_STATUS_ACCESS_DENIED;
}
- if (!pdb_getgrsid(&map, info->sid))
+ map = talloc_zero(p->mem_ctx, GROUP_MAP);
+ if (!map) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_getgrsid(map, info->sid)) {
+ TALLOC_FREE(map);
return NT_STATUS_NO_SUCH_GROUP;
+ }
- return pdb_update_group_mapping_entry(&map);
+ status = pdb_update_group_mapping_entry(map);
+ TALLOC_FREE(map);
+ return status;
}
/***************************************************************************
return NT_STATUS_NO_SUCH_PRIVILEGE;
}
- lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
+ lsa_name = talloc_zero(p->mem_ctx, struct lsa_StringLarge);
if (!lsa_name) {
return NT_STATUS_NO_MEMORY;
}
{
struct lsa_info *handle=NULL;
struct security_descriptor *psd = NULL;
- size_t sd_size;
+ size_t sd_size = 0;
NTSTATUS status;
/* find the connection policy handle. */
switch (handle->type) {
case LSA_HANDLE_POLICY_TYPE:
- status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
- &lsa_policy_mapping, NULL, 0);
- break;
case LSA_HANDLE_ACCOUNT_TYPE:
- status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
- &lsa_account_mapping,
- &handle->sid, LSA_ACCOUNT_ALL_ACCESS);
+ case LSA_HANDLE_TRUST_TYPE:
+ case LSA_HANDLE_SECRET_TYPE:
+ psd = handle->sd;
+ sd_size = ndr_size_security_descriptor(psd, 0);
+ status = NT_STATUS_OK;
break;
default:
status = NT_STATUS_INVALID_HANDLE;
/* get the generic lsa account SD for this SID until we store it */
status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
&lsa_account_mapping,
- r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
+ NULL, 0);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
* on the account sid. We don't check here so just use the latter. JRA.
*/
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
&acc_granted, "_lsa_AddAccountRights" );
/* get the generic lsa account SD for this SID until we store it */
status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
&lsa_account_mapping,
- r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
+ NULL, 0);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
* and DELETE on the account sid.
*/
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
LSA_ACCOUNT_VIEW|SEC_STD_DELETE,
struct lsa_RightSet *r,
PRIVILEGE_SET *privileges)
{
- uint32 i;
+ uint32_t i;
const char *privname;
const char **privname_array = NULL;
- int num_priv = 0;
+ size_t num_priv = 0;
for (i=0; i<privileges->count; i++) {
if (privileges->set[i].luid.high) {
if (num_priv) {
- r->names = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_StringLarge,
+ r->names = talloc_zero_array(mem_ctx, struct lsa_StringLarge,
num_priv);
if (!r->names) {
return NT_STATUS_NO_MEMORY;
return NT_STATUS_NOT_SUPPORTED;
}
+static NTSTATUS info_ex_2_pdb_trusted_domain(
+ struct lsa_TrustDomainInfoInfoEx *info_ex,
+ struct pdb_trusted_domain *td)
+{
+ if (info_ex->domain_name.string == NULL ||
+ info_ex->netbios_name.string == NULL ||
+ info_ex->sid == NULL) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ td->domain_name = talloc_strdup(td, info_ex->domain_name.string);
+ td->netbios_name = talloc_strdup(td, info_ex->netbios_name.string);
+ sid_copy(&td->security_identifier, info_ex->sid);
+ if (td->domain_name == NULL ||
+ td->netbios_name == NULL ||
+ is_null_sid(&td->security_identifier)) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ td->trust_direction = info_ex->trust_direction;
+ td->trust_type = info_ex->trust_type;
+ td->trust_attributes = info_ex->trust_attributes;
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS setInfoTrustedDomain_base(struct pipes_struct *p,
+ TALLOC_CTX *mem_ctx,
+ struct lsa_info *policy,
+ enum lsa_TrustDomInfoEnum level,
+ union lsa_TrustedDomainInfo *info)
+{
+ struct lsa_TrustDomainInfoAuthInfoInternal *auth_info_int = NULL;
+ DATA_BLOB auth_blob;
+ struct trustDomainPasswords auth_struct;
+ NTSTATUS nt_status;
+
+ struct pdb_trusted_domain *td;
+ struct pdb_trusted_domain *orig_td;
+
+ td = talloc_zero(mem_ctx, struct pdb_trusted_domain);
+ if (td == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ switch (level) {
+ case LSA_TRUSTED_DOMAIN_INFO_POSIX_OFFSET:
+ if (!(policy->access & LSA_TRUSTED_SET_POSIX)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ td->trust_posix_offset = &info->posix_offset.posix_offset;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_INFO_EX:
+ if (!(policy->access & LSA_TRUSTED_SET_POSIX)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ nt_status = info_ex_2_pdb_trusted_domain(&info->info_ex, td);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO:
+ if (!(policy->access & LSA_TRUSTED_SET_AUTH)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ nt_status = auth_info_2_auth_blob(td, &info->auth_info,
+ &td->trust_auth_incoming,
+ &td->trust_auth_outgoing);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO:
+ if (!(policy->access & (LSA_TRUSTED_SET_AUTH | LSA_TRUSTED_SET_POSIX))) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ td->trust_posix_offset = &info->full_info.posix_offset.posix_offset;
+ nt_status = info_ex_2_pdb_trusted_domain(&info->full_info.info_ex,
+ td);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ nt_status = auth_info_2_auth_blob(td,
+ &info->full_info.auth_info,
+ &td->trust_auth_incoming,
+ &td->trust_auth_outgoing);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_AUTH_INFO_INTERNAL:
+ if (!(policy->access & LSA_TRUSTED_SET_AUTH)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ auth_info_int = &info->auth_info_internal;
+ break;
+ case LSA_TRUSTED_DOMAIN_INFO_FULL_INFO_INTERNAL:
+ if (!(policy->access & (LSA_TRUSTED_SET_AUTH | LSA_TRUSTED_SET_POSIX))) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ td->trust_posix_offset = &info->full_info_internal.posix_offset.posix_offset;
+ nt_status = info_ex_2_pdb_trusted_domain(&info->full_info_internal.info_ex,
+ td);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ auth_info_int = &info->full_info_internal.auth_info;
+ break;
+ case LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES:
+ if (!(policy->access & LSA_TRUSTED_SET_POSIX)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ td->supported_enc_type = &info->enc_types.enc_types;
+ break;
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* decode auth_info_int if set */
+ if (auth_info_int) {
+
+ /* now decrypt blob */
+ auth_blob = data_blob_const(auth_info_int->auth_blob.data,
+ auth_info_int->auth_blob.size);
+
+ nt_status = get_trustdom_auth_blob(p, mem_ctx,
+ &auth_blob, &auth_struct);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ } else {
+ memset(&auth_struct, 0, sizeof(auth_struct));
+ }
+
+/* TODO: verify only one object matches the dns/netbios/sid triplet and that
+ * this is the one we already have */
+
+/* TODO: check if the trust direction is changed and we need to add or remove
+ * auth data */
+
+/* TODO: check if trust type shall be changed and return an error in this case
+ * */
+ nt_status = pdb_get_trusted_domain_by_sid(p->mem_ctx, &policy->sid,
+ &orig_td);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+
+
+ /* TODO: should we fetch previous values from the existing entry
+ * and append them ? */
+ if (auth_struct.incoming.count) {
+ nt_status = get_trustauth_inout_blob(mem_ctx,
+ &auth_struct.incoming,
+ &td->trust_auth_incoming);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ } else {
+ ZERO_STRUCT(td->trust_auth_incoming);
+ }
+
+ if (auth_struct.outgoing.count) {
+ nt_status = get_trustauth_inout_blob(mem_ctx,
+ &auth_struct.outgoing,
+ &td->trust_auth_outgoing);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+ } else {
+ ZERO_STRUCT(td->trust_auth_outgoing);
+ }
+
+ nt_status = pdb_set_trusted_domain(orig_td->domain_name, td);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS _lsa_SetTrustedDomainInfo(struct pipes_struct *p,
+ struct lsa_SetTrustedDomainInfo *r)
+{
+ NTSTATUS status;
+ struct policy_handle trustdom_handle;
+ struct lsa_OpenTrustedDomain o;
+ struct lsa_SetInformationTrustedDomain s;
+ struct lsa_Close c;
+
+ o.in.handle = r->in.handle;
+ o.in.sid = r->in.dom_sid;
+ o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+ o.out.trustdom_handle = &trustdom_handle;
+
+ status = _lsa_OpenTrustedDomain(p, &o);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ s.in.trustdom_handle = &trustdom_handle;
+ s.in.level = r->in.level;
+ s.in.info = r->in.info;
+
+ status = _lsa_SetInformationTrustedDomain(p, &s);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ c.in.handle = &trustdom_handle;
+ c.out.handle = &trustdom_handle;
+
+ return _lsa_Close(p, &c);
+}
+
+NTSTATUS _lsa_SetTrustedDomainInfoByName(struct pipes_struct *p,
+ struct lsa_SetTrustedDomainInfoByName *r)
+{
+ NTSTATUS status;
+ struct policy_handle trustdom_handle;
+ struct lsa_OpenTrustedDomainByName o;
+ struct lsa_SetInformationTrustedDomain s;
+ struct lsa_Close c;
+
+ o.in.handle = r->in.handle;
+ o.in.name.string = r->in.trusted_domain->string;
+ o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+ o.out.trustdom_handle = &trustdom_handle;
+
+ status = _lsa_OpenTrustedDomainByName(p, &o);
+ if (!NT_STATUS_IS_OK(status)) {
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_DOMAIN)) {
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ }
+ return status;
+ }
+
+ s.in.trustdom_handle = &trustdom_handle;
+ s.in.level = r->in.level;
+ s.in.info = r->in.info;
+
+ status = _lsa_SetInformationTrustedDomain(p, &s);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ c.in.handle = &trustdom_handle;
+ c.out.handle = &trustdom_handle;
+
+ return _lsa_Close(p, &c);
+}
+
+NTSTATUS _lsa_SetInformationTrustedDomain(struct pipes_struct *p,
+ struct lsa_SetInformationTrustedDomain *r)
+{
+ struct lsa_info *policy;
+
+ if (!find_policy_by_hnd(p, r->in.trustdom_handle, (void **)(void *)&policy)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (policy->type != LSA_HANDLE_TRUST_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ return setInfoTrustedDomain_base(p, p->mem_ctx, policy,
+ r->in.level, r->in.info);
+}
+
+
/*
* From here on the server routines are just dummy ones to make smbd link with
* librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
NTSTATUS _lsa_SetSecObj(struct pipes_struct *p, struct lsa_SetSecObj *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_ChangePassword(struct pipes_struct *p,
struct lsa_ChangePassword *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_SetInfoPolicy(struct pipes_struct *p, struct lsa_SetInfoPolicy *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_ClearAuditLog(struct pipes_struct *p, struct lsa_ClearAuditLog *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_GetQuotasForAccount(struct pipes_struct *p,
struct lsa_GetQuotasForAccount *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_SetQuotasForAccount(struct pipes_struct *p,
struct lsa_SetQuotasForAccount *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
-NTSTATUS _lsa_QueryTrustedDomainInfo(struct pipes_struct *p,
- struct lsa_QueryTrustedDomainInfo *r)
+NTSTATUS _lsa_StorePrivateData(struct pipes_struct *p,
+ struct lsa_StorePrivateData *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
-NTSTATUS _lsa_SetInformationTrustedDomain(struct pipes_struct *p,
- struct lsa_SetInformationTrustedDomain *r)
+NTSTATUS _lsa_RetrievePrivateData(struct pipes_struct *p,
+ struct lsa_RetrievePrivateData *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
-NTSTATUS _lsa_QuerySecret(struct pipes_struct *p, struct lsa_QuerySecret *r)
+NTSTATUS _lsa_SetInfoPolicy2(struct pipes_struct *p,
+ struct lsa_SetInfoPolicy2 *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
-NTSTATUS _lsa_QueryTrustedDomainInfoBySid(struct pipes_struct *p,
- struct lsa_QueryTrustedDomainInfoBySid *r)
+NTSTATUS _lsa_EnumTrustedDomainsEx(struct pipes_struct *p,
+ struct lsa_EnumTrustedDomainsEx *r)
{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ struct lsa_info *info;
+ uint32_t count;
+ struct pdb_trusted_domain **domains;
+ struct lsa_TrustDomainInfoInfoEx *entries;
+ int i;
+ NTSTATUS nt_status;
-NTSTATUS _lsa_SetTrustedDomainInfo(struct pipes_struct *p,
- struct lsa_SetTrustedDomainInfo *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ /* bail out early if pdb backend is not capable of ex trusted domains,
+ * if we don't do that, the client might not call
+ * _lsa_EnumTrustedDomains() afterwards - gd */
-NTSTATUS _lsa_DeleteTrustedDomain(struct pipes_struct *p,
- struct lsa_DeleteTrustedDomain *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ if (!(pdb_capabilities() & PDB_CAP_TRUSTED_DOMAINS_EX)) {
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
+ return NT_STATUS_NOT_IMPLEMENTED;
+ }
-NTSTATUS _lsa_StorePrivateData(struct pipes_struct *p,
- struct lsa_StorePrivateData *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
+ return NT_STATUS_INVALID_HANDLE;
+
+ if (info->type != LSA_HANDLE_POLICY_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ /* check if the user has enough rights */
+ if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
+ return NT_STATUS_ACCESS_DENIED;
+
+ become_root();
+ nt_status = pdb_enum_trusted_domains(p->mem_ctx, &count, &domains);
+ unbecome_root();
+
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
+ }
+
+ entries = talloc_zero_array(p->mem_ctx, struct lsa_TrustDomainInfoInfoEx,
+ count);
+ if (!entries) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ for (i=0; i<count; i++) {
+ init_lsa_StringLarge(&entries[i].domain_name,
+ domains[i]->domain_name);
+ init_lsa_StringLarge(&entries[i].netbios_name,
+ domains[i]->netbios_name);
+ entries[i].sid = &domains[i]->security_identifier;
+ entries[i].trust_direction = domains[i]->trust_direction;
+ entries[i].trust_type = domains[i]->trust_type;
+ entries[i].trust_attributes = domains[i]->trust_attributes;
+ }
+
+ if (*r->in.resume_handle >= count) {
+ *r->out.resume_handle = -1;
+ TALLOC_FREE(entries);
+ return NT_STATUS_NO_MORE_ENTRIES;
+ }
-NTSTATUS _lsa_RetrievePrivateData(struct pipes_struct *p,
- struct lsa_RetrievePrivateData *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ /* return the rest, limit by max_size. Note that we
+ use the w2k3 element size value of 60 */
+ r->out.domains->count = count - *r->in.resume_handle;
+ r->out.domains->count = MIN(r->out.domains->count,
+ (r->in.max_size/LSA_ENUM_TRUST_DOMAIN_EX_MULTIPLIER));
-NTSTATUS _lsa_SetInfoPolicy2(struct pipes_struct *p,
- struct lsa_SetInfoPolicy2 *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ r->out.domains->domains = entries + *r->in.resume_handle;
-NTSTATUS _lsa_QueryTrustedDomainInfoByName(struct pipes_struct *p,
- struct lsa_QueryTrustedDomainInfoByName *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ if (r->out.domains->count < count - *r->in.resume_handle) {
+ *r->out.resume_handle = *r->in.resume_handle + r->out.domains->count;
+ return STATUS_MORE_ENTRIES;
+ }
-NTSTATUS _lsa_SetTrustedDomainInfoByName(struct pipes_struct *p,
- struct lsa_SetTrustedDomainInfoByName *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ /* according to MS-LSAD 3.1.4.7.8 output resume handle MUST
+ * always be larger than the previous input resume handle, in
+ * particular when hitting the last query it is vital to set the
+ * resume handle correctly to avoid infinite client loops, as
+ * seen e.g. with Windows XP SP3 when resume handle is 0 and
+ * status is NT_STATUS_OK - gd */
-NTSTATUS _lsa_EnumTrustedDomainsEx(struct pipes_struct *p,
- struct lsa_EnumTrustedDomainsEx *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
+ *r->out.resume_handle = (uint32_t)-1;
-NTSTATUS _lsa_CloseTrustedDomainEx(struct pipes_struct *p,
- struct lsa_CloseTrustedDomainEx *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
+ return NT_STATUS_OK;
}
NTSTATUS _lsa_QueryDomainInformationPolicy(struct pipes_struct *p,
struct lsa_QueryDomainInformationPolicy *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_SetDomainInformationPolicy(struct pipes_struct *p,
struct lsa_SetDomainInformationPolicy *r)
{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-NTSTATUS _lsa_OpenTrustedDomainByName(struct pipes_struct *p,
- struct lsa_OpenTrustedDomainByName *r)
-{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_TestCall(struct pipes_struct *p, struct lsa_TestCall *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRWRITE(struct pipes_struct *p, struct lsa_CREDRWRITE *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRREAD(struct pipes_struct *p, struct lsa_CREDRREAD *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRENUMERATE(struct pipes_struct *p, struct lsa_CREDRENUMERATE *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(struct pipes_struct *p,
struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(struct pipes_struct *p,
struct lsa_CREDRREADDOMAINCREDENTIALS *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRDELETE(struct pipes_struct *p, struct lsa_CREDRDELETE *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRGETTARGETINFO(struct pipes_struct *p,
struct lsa_CREDRGETTARGETINFO *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRPROFILELOADED(struct pipes_struct *p,
struct lsa_CREDRPROFILELOADED *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_CREDRGETSESSIONTYPES(struct pipes_struct *p,
struct lsa_CREDRGETSESSIONTYPES *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_LSARREGISTERAUDITEVENT(struct pipes_struct *p,
struct lsa_LSARREGISTERAUDITEVENT *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_LSARGENAUDITEVENT(struct pipes_struct *p,
struct lsa_LSARGENAUDITEVENT *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(struct pipes_struct *p,
struct lsa_LSARUNREGISTERAUDITEVENT *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_lsaRQueryForestTrustInformation(struct pipes_struct *p,
struct lsa_lsaRQueryForestTrustInformation *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
+#define DNS_CMP_MATCH 0
+#define DNS_CMP_FIRST_IS_CHILD 1
+#define DNS_CMP_SECOND_IS_CHILD 2
+#define DNS_CMP_NO_MATCH 3
+
+/* this function assumes names are well formed DNS names.
+ * it doesn't validate them */
+static int dns_cmp(const char *s1, size_t l1,
+ const char *s2, size_t l2)
+{
+ const char *p1, *p2;
+ size_t t1, t2;
+ int cret;
+
+ if (l1 == l2) {
+ if (strcasecmp_m(s1, s2) == 0) {
+ return DNS_CMP_MATCH;
+ }
+ return DNS_CMP_NO_MATCH;
+ }
+
+ if (l1 > l2) {
+ p1 = s1;
+ p2 = s2;
+ t1 = l1;
+ t2 = l2;
+ cret = DNS_CMP_FIRST_IS_CHILD;
+ } else {
+ p1 = s2;
+ p2 = s1;
+ t1 = l2;
+ t2 = l1;
+ cret = DNS_CMP_SECOND_IS_CHILD;
+ }
+
+ if (p1[t1 - t2 - 1] != '.') {
+ return DNS_CMP_NO_MATCH;
+ }
+
+ if (strcasecmp_m(&p1[t1 - t2], p2) == 0) {
+ return cret;
+ }
+
+ return DNS_CMP_NO_MATCH;
+}
+
+static NTSTATUS make_ft_info(TALLOC_CTX *mem_ctx,
+ struct lsa_ForestTrustInformation *lfti,
+ struct ForestTrustInfo *fti)
+{
+ struct lsa_ForestTrustRecord *lrec;
+ struct ForestTrustInfoRecord *rec;
+ struct lsa_StringLarge *tln;
+ struct lsa_ForestTrustDomainInfo *info;
+ uint32_t i;
+
+ fti->version = 1;
+ fti->count = lfti->count;
+ fti->records = talloc_array(mem_ctx,
+ struct ForestTrustInfoRecordArmor,
+ fti->count);
+ if (!fti->records) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ for (i = 0; i < fti->count; i++) {
+ lrec = lfti->entries[i];
+ rec = &fti->records[i].record;
+
+ rec->flags = lrec->flags;
+ rec->timestamp = lrec->time;
+ rec->type = lrec->type;
+
+ switch (lrec->type) {
+ case LSA_FOREST_TRUST_TOP_LEVEL_NAME:
+ case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
+ tln = &lrec->forest_trust_data.top_level_name;
+ rec->data.name.string =
+ talloc_strdup(mem_ctx, tln->string);
+ if (!rec->data.name.string) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ rec->data.name.size = strlen(rec->data.name.string);
+ break;
+ case LSA_FOREST_TRUST_DOMAIN_INFO:
+ info = &lrec->forest_trust_data.domain_info;
+ rec->data.info.sid = *info->domain_sid;
+ rec->data.info.dns_name.string =
+ talloc_strdup(mem_ctx,
+ info->dns_domain_name.string);
+ if (!rec->data.info.dns_name.string) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ rec->data.info.dns_name.size =
+ strlen(rec->data.info.dns_name.string);
+ rec->data.info.netbios_name.string =
+ talloc_strdup(mem_ctx,
+ info->netbios_domain_name.string);
+ if (!rec->data.info.netbios_name.string) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ rec->data.info.netbios_name.size =
+ strlen(rec->data.info.netbios_name.string);
+ break;
+ default:
+ return NT_STATUS_INVALID_DOMAIN_STATE;
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS add_collision(struct lsa_ForestTrustCollisionInfo *c_info,
+ uint32_t index, uint32_t collision_type,
+ uint32_t conflict_type, const char *tdo_name);
+
+static NTSTATUS check_ft_info(TALLOC_CTX *mem_ctx,
+ const char *tdo_name,
+ struct ForestTrustInfo *tdo_fti,
+ struct ForestTrustInfo *new_fti,
+ struct lsa_ForestTrustCollisionInfo *c_info)
+{
+ struct ForestTrustInfoRecord *nrec;
+ struct ForestTrustInfoRecord *trec;
+ const char *dns_name;
+ const char *nb_name = NULL;
+ struct dom_sid *sid = NULL;
+ const char *tname = NULL;
+ size_t dns_len = 0;
+ size_t tlen = 0;
+ uint32_t new_fti_idx;
+ uint32_t i;
+ /* use always TDO type, until we understand when Xref can be used */
+ uint32_t collision_type = LSA_FOREST_TRUST_COLLISION_TDO;
+ bool tln_conflict;
+ bool sid_conflict;
+ bool nb_conflict;
+ bool exclusion;
+ bool ex_rule = false;
+ int ret;
+
+ for (new_fti_idx = 0; new_fti_idx < new_fti->count; new_fti_idx++) {
+
+ nrec = &new_fti->records[new_fti_idx].record;
+ dns_name = NULL;
+ tln_conflict = false;
+ sid_conflict = false;
+ nb_conflict = false;
+ exclusion = false;
+
+ switch (nrec->type) {
+ case LSA_FOREST_TRUST_TOP_LEVEL_NAME_EX:
+ /* exclusions do not conflict by definition */
+ break;
+
+ case FOREST_TRUST_TOP_LEVEL_NAME:
+ dns_name = nrec->data.name.string;
+ dns_len = nrec->data.name.size;
+ break;
+
+ case LSA_FOREST_TRUST_DOMAIN_INFO:
+ dns_name = nrec->data.info.dns_name.string;
+ dns_len = nrec->data.info.dns_name.size;
+ nb_name = nrec->data.info.netbios_name.string;
+ sid = &nrec->data.info.sid;
+ break;
+ }
+
+ if (!dns_name) continue;
+
+ /* check if this is already taken and not excluded */
+ for (i = 0; i < tdo_fti->count; i++) {
+ trec = &tdo_fti->records[i].record;
+
+ switch (trec->type) {
+ case FOREST_TRUST_TOP_LEVEL_NAME:
+ ex_rule = false;
+ tname = trec->data.name.string;
+ tlen = trec->data.name.size;
+ break;
+ case FOREST_TRUST_TOP_LEVEL_NAME_EX:
+ ex_rule = true;
+ tname = trec->data.name.string;
+ tlen = trec->data.name.size;
+ break;
+ case FOREST_TRUST_DOMAIN_INFO:
+ ex_rule = false;
+ tname = trec->data.info.dns_name.string;
+ tlen = trec->data.info.dns_name.size;
+ break;
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ ret = dns_cmp(dns_name, dns_len, tname, tlen);
+ switch (ret) {
+ case DNS_CMP_MATCH:
+ /* if it matches exclusion,
+ * it doesn't conflict */
+ if (ex_rule) {
+ exclusion = true;
+ break;
+ }
+ /* fall through */
+ case DNS_CMP_FIRST_IS_CHILD:
+ case DNS_CMP_SECOND_IS_CHILD:
+ tln_conflict = true;
+ /* fall through */
+ default:
+ break;
+ }
+
+ /* explicit exclusion, no dns name conflict here */
+ if (exclusion) {
+ tln_conflict = false;
+ }
+
+ if (trec->type != FOREST_TRUST_DOMAIN_INFO) {
+ continue;
+ }
+
+ /* also test for domain info */
+ if (!(trec->flags & LSA_SID_DISABLED_ADMIN) &&
+ dom_sid_compare(&trec->data.info.sid, sid) == 0) {
+ sid_conflict = true;
+ }
+ if (!(trec->flags & LSA_NB_DISABLED_ADMIN) &&
+ strcasecmp_m(trec->data.info.netbios_name.string,
+ nb_name) == 0) {
+ nb_conflict = true;
+ }
+ }
+
+ if (tln_conflict) {
+ (void)add_collision(c_info, new_fti_idx,
+ collision_type,
+ LSA_TLN_DISABLED_CONFLICT,
+ tdo_name);
+ }
+ if (sid_conflict) {
+ (void)add_collision(c_info, new_fti_idx,
+ collision_type,
+ LSA_SID_DISABLED_CONFLICT,
+ tdo_name);
+ }
+ if (nb_conflict) {
+ (void)add_collision(c_info, new_fti_idx,
+ collision_type,
+ LSA_NB_DISABLED_CONFLICT,
+ tdo_name);
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS add_collision(struct lsa_ForestTrustCollisionInfo *c_info,
+ uint32_t idx, uint32_t collision_type,
+ uint32_t conflict_type, const char *tdo_name)
+{
+ struct lsa_ForestTrustCollisionRecord **es;
+ uint32_t i = c_info->count;
+
+ es = talloc_realloc(c_info, c_info->entries,
+ struct lsa_ForestTrustCollisionRecord *, i + 1);
+ if (!es) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ c_info->entries = es;
+ c_info->count = i + 1;
+
+ es[i] = talloc(es, struct lsa_ForestTrustCollisionRecord);
+ if (!es[i]) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ es[i]->index = idx;
+ es[i]->type = collision_type;
+ es[i]->flags = conflict_type;
+ es[i]->name.string = talloc_strdup(es[i], tdo_name);
+ if (!es[i]->name.string) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ es[i]->name.size = strlen(es[i]->name.string);
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS get_ft_info(TALLOC_CTX *mem_ctx,
+ struct pdb_trusted_domain *td,
+ struct ForestTrustInfo *info)
+{
+ enum ndr_err_code ndr_err;
+
+ if (td->trust_forest_trust_info.length == 0 ||
+ td->trust_forest_trust_info.data == NULL) {
+ return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+ }
+ ndr_err = ndr_pull_struct_blob_all(&td->trust_forest_trust_info, mem_ctx,
+ info,
+ (ndr_pull_flags_fn_t)ndr_pull_ForestTrustInfo);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NT_STATUS_INVALID_DOMAIN_STATE;
+ }
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS own_ft_info(struct pdb_domain_info *dom_info,
+ struct ForestTrustInfo *fti)
+{
+ struct ForestTrustDataDomainInfo *info;
+ struct ForestTrustInfoRecord *rec;
+
+ fti->version = 1;
+ fti->count = 2;
+ fti->records = talloc_array(fti,
+ struct ForestTrustInfoRecordArmor, 2);
+ if (!fti->records) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* TLN info */
+ rec = &fti->records[0].record;
+
+ rec->flags = 0;
+ rec->timestamp = 0;
+ rec->type = LSA_FOREST_TRUST_TOP_LEVEL_NAME;
+
+ rec->data.name.string = talloc_strdup(fti, dom_info->dns_forest);
+ if (!rec->data.name.string) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ rec->data.name.size = strlen(rec->data.name.string);
+
+ /* DOMAIN info */
+ rec = &fti->records[1].record;
+
+ rec->flags = 0;
+ rec->timestamp = 0;
+ rec->type = LSA_FOREST_TRUST_DOMAIN_INFO;
+
+ info = &rec->data.info;
+
+ info->sid = dom_info->sid;
+ info->dns_name.string = talloc_strdup(fti, dom_info->dns_domain);
+ if (!info->dns_name.string) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ info->dns_name.size = strlen(info->dns_name.string);
+ info->netbios_name.string = talloc_strdup(fti, dom_info->name);
+ if (!info->netbios_name.string) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ info->netbios_name.size = strlen(info->netbios_name.string);
+
+ return NT_STATUS_OK;
+}
+
NTSTATUS _lsa_lsaRSetForestTrustInformation(struct pipes_struct *p,
struct lsa_lsaRSetForestTrustInformation *r)
{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
+ NTSTATUS status;
+ int i;
+ int j;
+ struct lsa_info *handle;
+ uint32_t num_domains;
+ struct pdb_trusted_domain **domains;
+ struct ForestTrustInfo *nfti;
+ struct ForestTrustInfo *fti;
+ struct lsa_ForestTrustCollisionInfo *c_info;
+ struct pdb_domain_info *dom_info;
+ enum ndr_err_code ndr_err;
+
+ if (!IS_DC) {
+ return NT_STATUS_NOT_SUPPORTED;
+ }
+
+ if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (handle->type != LSA_HANDLE_TRUST_TYPE) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (!(handle->access & LSA_TRUSTED_SET_AUTH)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ status = pdb_enum_trusted_domains(p->mem_ctx, &num_domains, &domains);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ if (num_domains == 0) {
+ return NT_STATUS_NO_SUCH_DOMAIN;
+ }
+
+ for (i = 0; i < num_domains; i++) {
+ if (domains[i]->domain_name == NULL) {
+ return NT_STATUS_INVALID_DOMAIN_STATE;
+ }
+ if (strcasecmp_m(domains[i]->domain_name,
+ r->in.trusted_domain_name->string) == 0) {
+ break;
+ }
+ }
+ if (i >= num_domains) {
+ return NT_STATUS_NO_SUCH_DOMAIN;
+ }
+
+ if (!(domains[i]->trust_attributes &
+ LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (r->in.highest_record_type >= LSA_FOREST_TRUST_RECORD_TYPE_LAST) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* The following section until COPY_END is a copy from
+ * source4/rpmc_server/lsa/scesrc_lsa.c */
+ nfti = talloc(p->mem_ctx, struct ForestTrustInfo);
+ if (!nfti) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ status = make_ft_info(nfti, r->in.forest_trust_info, nfti);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ c_info = talloc_zero(r->out.collision_info,
+ struct lsa_ForestTrustCollisionInfo);
+ if (!c_info) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* first check own info, then other domains */
+ fti = talloc(p->mem_ctx, struct ForestTrustInfo);
+ if (!fti) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ dom_info = pdb_get_domain_info(p->mem_ctx);
+
+ status = own_ft_info(dom_info, fti);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = check_ft_info(c_info, dom_info->dns_domain, fti, nfti, c_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ for (j = 0; j < num_domains; j++) {
+ fti = talloc(p->mem_ctx, struct ForestTrustInfo);
+ if (!fti) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ status = get_ft_info(p->mem_ctx, domains[j], fti);
+ if (!NT_STATUS_IS_OK(status)) {
+ if (NT_STATUS_EQUAL(status,
+ NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+ continue;
+ }
+ return status;
+ }
+
+ if (domains[j]->domain_name == NULL) {
+ return NT_STATUS_INVALID_DOMAIN_STATE;
+ }
+
+ status = check_ft_info(c_info, domains[j]->domain_name,
+ fti, nfti, c_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ }
+
+ if (c_info->count != 0) {
+ *r->out.collision_info = c_info;
+ }
+
+ if (r->in.check_only != 0) {
+ return NT_STATUS_OK;
+ }
+
+ /* COPY_END */
+
+ ndr_err = ndr_push_struct_blob(&domains[i]->trust_forest_trust_info,
+ p->mem_ctx, nfti,
+ (ndr_push_flags_fn_t)ndr_push_ForestTrustInfo);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ status = pdb_set_trusted_domain(domains[i]->domain_name, domains[i]);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ return NT_STATUS_OK;
}
NTSTATUS _lsa_CREDRRENAME(struct pipes_struct *p,
struct lsa_CREDRRENAME *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_LSAROPENPOLICYSCE(struct pipes_struct *p,
struct lsa_LSAROPENPOLICYSCE *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(struct pipes_struct *p,
struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(struct pipes_struct *p,
struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(struct pipes_struct *p,
struct lsa_LSARADTREPORTSECURITYEVENT *r)
{
- p->rng_fault_state = True;
+ p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
return NT_STATUS_NOT_IMPLEMENTED;
}
git.samba.org / metze / samba / wip.git / blobdiff