*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
+ * the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
/* This is the implementation of the lsa server code. */
uint32 access;
};
-struct generic_mapping lsa_generic_mapping = {
+const struct generic_mapping lsa_generic_mapping = {
POLICY_READ,
POLICY_WRITE,
POLICY_EXECUTE,
/***************************************************************************
_lsa_lookup_sida3
-
- Before someone actually re-activates this, please present a sniff showing
- this call against some Windows server. I (vl) could not make it work against
- w2k3 at all.
***************************************************************************/
NTSTATUS _lsa_lookup_sids3(pipes_struct *p,
LSA_Q_LOOKUP_SIDS3 *q_u,
LSA_R_LOOKUP_SIDS3 *r_u)
{
+ int num_sids = q_u->sids.num_entries;
uint32 mapped_count = 0;
- DOM_R_REF *ref;
+ DOM_R_REF *ref = NULL;
if ((q_u->level < 1) || (q_u->level > 6)) {
return NT_STATUS_INVALID_PARAMETER;
}
- r_u->status = NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED;
-
- ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
+ /* No policy handle on this call. Restrict to crypto connections. */
+ if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
+ DEBUG(0,("_lsa_lookup_sids3: client %s not using schannel for netlogon\n",
+ get_remote_machine_name() ));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
- if (ref == NULL) {
- /* We would segfault later on in lsa_io_r_lookup_sids3 anyway,
- * so do a planned exit here. We NEEEED pidl! */
- smb_panic("talloc failed");
+ if (num_sids > MAX_LOOKUP_SIDS) {
+ DEBUG(5,("_lsa_lookup_sids3: limit of %d exceeded, requested %d\n",
+ MAX_LOOKUP_SIDS, num_sids));
+ return NT_STATUS_NONE_MAPPED;
}
+ r_u->status = _lsa_lookup_sids_internal(p,
+ q_u->level,
+ num_sids,
+ q_u->sids.sid,
+ &ref,
+ &r_u->names,
+ &mapped_count);
+
init_reply_lookup_sids3(r_u, ref, mapped_count);
return r_u->status;
}
SAFE_FREE(sid_list);
return NT_STATUS_NO_MEMORY;
}
+
+ for (i = q_u->enum_context, j = 0; i < num_entries; i++, j++) {
+ init_dom_sid2(&(*sids).sid[j], &sid_list[i]);
+ (*sids).ptr_sid[j] = 1;
+ }
} else {
sids->ptr_sid = NULL;
sids->sid = NULL;
}
- for (i = q_u->enum_context, j = 0; i < num_entries; i++, j++) {
- init_dom_sid2(&(*sids).sid[j], &sid_list[i]);
- (*sids).ptr_sid[j] = 1;
- }
-
talloc_free(sid_list);
init_lsa_r_enum_accounts(r_u, num_entries);
* I don't know if it's the right one. not documented.
* but guessed with rpcclient.
*/
- if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION)) {
- DEBUG(10, ("_lsa_create_account: No POLICY_GET_PRIVATE_INFORMATION access right!\n"));
+ if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
return NT_STATUS_ACCESS_DENIED;
- }
/* check to see if the pipe_user is a Domain Admin since
account_pol.tdb was already opened as root, this is all we have */
- if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) ) {
- DEBUG(10, ("_lsa_create_account: The use is not a Domain Admin, deny access!\n"));
+ if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
return NT_STATUS_ACCESS_DENIED;
- }
- if ( is_privileged_sid( &q_u->sid.sid ) ) {
- DEBUG(10, ("_lsa_create_account: Policy account already exists!\n"));
+ if ( is_privileged_sid( &q_u->sid.sid ) )
return NT_STATUS_OBJECT_NAME_COLLISION;
- }
/* associate the user/group SID with the (unique) handle. */
if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
return NT_STATUS_OBJECT_NAME_NOT_FOUND;
- DEBUG(10, ("_lsa_create_account: call privileges code to create an account\n"));
return privilege_create_account( &info->sid );
}
return NT_STATUS_INVALID_HANDLE;
if (!lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, NULL))
- return NT_STATUS_OK;
+ return NT_STATUS_ACCESS_DENIED;
/*
0x01 -> Log on locally
/* ugly temp hack for these next two */
/* This should be a 'netbios domain -> DNS domain' mapping */
- dnsdomname[0] = '\0';
- get_mydnsdomname(dnsdomname);
+ dnsdomname = get_mydnsdomname(p->mem_ctx);
+ if (!dnsdomname || !*dnsdomname) {
+ return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ }
strlower_m(dnsdomname);
-
+
dns_name = dnsdomname;
forest_name = dnsdomname;
git.samba.org / amitay / samba.git / blobdiff