2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 3 of the License, or
17 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 /* This is the implementation of the lsa server code. */
33 #define DBGC_CLASS DBGC_RPC_SRV
42 const struct generic_mapping lsa_generic_mapping = {
49 /*******************************************************************
50 Function to free the per handle data.
51 ********************************************************************/
53 static void free_lsa_info(void *ptr)
55 struct lsa_info *lsa = (struct lsa_info *)ptr;
60 /***************************************************************************
62 ***************************************************************************/
64 static void init_dom_query_3(DOM_QUERY_3 *d_q, const char *dom_name, DOM_SID *dom_sid)
66 d_q->buffer_dom_name = (dom_name != NULL) ? 1 : 0; /* domain buffer pointer */
67 d_q->buffer_dom_sid = (dom_sid != NULL) ? 1 : 0; /* domain sid pointer */
69 /* this string is supposed to be non-null terminated. */
70 /* But the maxlen in this UNISTR2 must include the terminating null. */
71 init_unistr2(&d_q->uni_domain_name, dom_name, UNI_BROKEN_NON_NULL);
74 * I'm not sure why this really odd combination of length
75 * values works, but it does appear to. I need to look at
76 * this *much* more closely - but at the moment leave alone
77 * until it's understood. This allows a W2k client to join
78 * a domain with both odd and even length names... JRA.
83 * The two fields below probably are reversed in meaning, ie.
84 * the first field is probably the str_len, the second the max
85 * len. Both are measured in bytes anyway.
88 d_q->uni_dom_str_len = d_q->uni_domain_name.uni_max_len * 2;
89 d_q->uni_dom_max_len = d_q->uni_domain_name.uni_str_len * 2;
92 init_dom_sid2(&d_q->dom_sid, dom_sid);
95 /***************************************************************************
97 ***************************************************************************/
99 static void init_dom_query_5(DOM_QUERY_5 *d_q, const char *dom_name, DOM_SID *dom_sid)
101 init_dom_query_3(d_q, dom_name, dom_sid);
104 /***************************************************************************
105 init_dom_ref - adds a domain if it's not already in, returns the index.
106 ***************************************************************************/
108 static int init_dom_ref(DOM_R_REF *ref, const char *dom_name, DOM_SID *dom_sid)
112 if (dom_name != NULL) {
113 for (num = 0; num < ref->num_ref_doms_1; num++) {
114 if (sid_equal(dom_sid, &ref->ref_dom[num].ref_dom.sid))
118 num = ref->num_ref_doms_1;
121 if (num >= MAX_REF_DOMAINS) {
122 /* index not found, already at maximum domain limit */
126 ref->num_ref_doms_1 = num+1;
127 ref->ptr_ref_dom = 1;
128 ref->max_entries = MAX_REF_DOMAINS;
129 ref->num_ref_doms_2 = num+1;
131 ref->hdr_ref_dom[num].ptr_dom_sid = 1; /* dom sid cannot be NULL. */
133 init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, UNI_FLAGS_NONE);
134 init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, &ref->ref_dom[num].uni_dom_name);
136 init_dom_sid2(&ref->ref_dom[num].ref_dom, dom_sid );
141 /***************************************************************************
142 lookup_lsa_rids. Must be called as root for lookup_name to work.
143 ***************************************************************************/
145 static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
151 uint32 *pmapped_count)
153 uint32 mapped_count, i;
155 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
160 for (i = 0; i < num_entries; i++) {
166 enum lsa_SidType type = SID_NAME_UNKNOWN;
168 /* Split name into domain and user component */
170 full_name = rpcstr_pull_unistr2_talloc(mem_ctx, &name[i]);
171 if (full_name == NULL) {
172 DEBUG(0, ("pull_ucs2_talloc failed\n"));
173 return NT_STATUS_NO_MEMORY;
176 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
178 /* We can ignore the result of lookup_name, it will not touch
179 "type" if it's not successful */
181 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
186 case SID_NAME_DOM_GRP:
187 case SID_NAME_DOMAIN:
189 case SID_NAME_WKN_GRP:
190 DEBUG(5, ("init_lsa_rids: %s found\n", full_name));
191 /* Leave these unchanged */
194 /* Don't hand out anything but the list above */
195 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name));
196 type = SID_NAME_UNKNOWN;
203 if (type != SID_NAME_UNKNOWN) {
204 sid_split_rid(&sid, &rid);
205 dom_idx = init_dom_ref(ref, domain, &sid);
209 init_dom_rid(&prid[i], rid, type, dom_idx);
212 *pmapped_count = mapped_count;
216 /***************************************************************************
217 lookup_lsa_sids. Must be called as root for lookup_name to work.
218 ***************************************************************************/
220 static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
222 LSA_TRANSLATED_SID3 *trans_sids,
226 uint32 *pmapped_count)
228 uint32 mapped_count, i;
230 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
235 for (i = 0; i < num_entries; i++) {
241 enum lsa_SidType type = SID_NAME_UNKNOWN;
243 /* Split name into domain and user component */
245 full_name = rpcstr_pull_unistr2_talloc(mem_ctx, &name[i]);
246 if (full_name == NULL) {
247 DEBUG(0, ("pull_ucs2_talloc failed\n"));
248 return NT_STATUS_NO_MEMORY;
251 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
253 /* We can ignore the result of lookup_name, it will not touch
254 "type" if it's not successful */
256 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
261 case SID_NAME_DOM_GRP:
262 case SID_NAME_DOMAIN:
264 case SID_NAME_WKN_GRP:
265 DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
266 /* Leave these unchanged */
269 /* Don't hand out anything but the list above */
270 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
271 type = SID_NAME_UNKNOWN;
278 if (type != SID_NAME_UNKNOWN) {
280 sid_copy(&domain_sid, &sid);
281 sid_split_rid(&domain_sid, &rid);
282 dom_idx = init_dom_ref(ref, domain, &domain_sid);
286 /* Initialize the LSA_TRANSLATED_SID3 return. */
287 trans_sids[i].sid_type = type;
288 trans_sids[i].sid2 = TALLOC_P(mem_ctx, DOM_SID2);
289 if (trans_sids[i].sid2 == NULL) {
290 return NT_STATUS_NO_MEMORY;
292 init_dom_sid2(trans_sids[i].sid2, &sid);
293 trans_sids[i].sid_idx = dom_idx;
296 *pmapped_count = mapped_count;
300 /***************************************************************************
301 init_reply_lookup_names
302 ***************************************************************************/
304 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
305 DOM_R_REF *ref, uint32 num_entries,
306 DOM_RID *rid, uint32 mapped_count)
308 r_l->ptr_dom_ref = 1;
311 r_l->num_entries = num_entries;
312 r_l->ptr_entries = 1;
313 r_l->num_entries2 = num_entries;
316 r_l->mapped_count = mapped_count;
319 /***************************************************************************
320 init_reply_lookup_names2
321 ***************************************************************************/
323 static void init_reply_lookup_names2(LSA_R_LOOKUP_NAMES2 *r_l,
324 DOM_R_REF *ref, uint32 num_entries,
325 DOM_RID2 *rid, uint32 mapped_count)
327 r_l->ptr_dom_ref = 1;
330 r_l->num_entries = num_entries;
331 r_l->ptr_entries = 1;
332 r_l->num_entries2 = num_entries;
335 r_l->mapped_count = mapped_count;
338 /***************************************************************************
339 init_reply_lookup_names3
340 ***************************************************************************/
342 static void init_reply_lookup_names3(LSA_R_LOOKUP_NAMES3 *r_l,
343 DOM_R_REF *ref, uint32 num_entries,
344 LSA_TRANSLATED_SID3 *trans_sids, uint32 mapped_count)
346 r_l->ptr_dom_ref = 1;
349 r_l->num_entries = num_entries;
350 r_l->ptr_entries = 1;
351 r_l->num_entries2 = num_entries;
352 r_l->trans_sids = trans_sids;
354 r_l->mapped_count = mapped_count;
357 /***************************************************************************
358 init_reply_lookup_names4
359 ***************************************************************************/
361 static void init_reply_lookup_names4(LSA_R_LOOKUP_NAMES4 *r_l,
362 DOM_R_REF *ref, uint32 num_entries,
363 LSA_TRANSLATED_SID3 *trans_sids, uint32 mapped_count)
365 r_l->ptr_dom_ref = 1;
368 r_l->num_entries = num_entries;
369 r_l->ptr_entries = 1;
370 r_l->num_entries2 = num_entries;
371 r_l->trans_sids = trans_sids;
373 r_l->mapped_count = mapped_count;
376 /***************************************************************************
377 Init_reply_lookup_sids.
378 ***************************************************************************/
380 static void init_reply_lookup_sids2(LSA_R_LOOKUP_SIDS2 *r_l,
384 r_l->ptr_dom_ref = ref ? 1 : 0;
386 r_l->mapped_count = mapped_count;
389 /***************************************************************************
390 Init_reply_lookup_sids.
391 ***************************************************************************/
393 static void init_reply_lookup_sids3(LSA_R_LOOKUP_SIDS3 *r_l,
397 r_l->ptr_dom_ref = ref ? 1 : 0;
399 r_l->mapped_count = mapped_count;
402 /***************************************************************************
403 Init_reply_lookup_sids.
404 ***************************************************************************/
406 static NTSTATUS init_reply_lookup_sids(TALLOC_CTX *mem_ctx,
407 LSA_R_LOOKUP_SIDS *r_l,
409 LSA_TRANS_NAME_ENUM2 *names,
412 LSA_TRANS_NAME_ENUM *oldnames = &r_l->names;
414 oldnames->num_entries = names->num_entries;
415 oldnames->ptr_trans_names = names->ptr_trans_names;
416 oldnames->num_entries2 = names->num_entries2;
417 oldnames->uni_name = names->uni_name;
419 if (names->num_entries) {
422 oldnames->name = TALLOC_ARRAY(mem_ctx, LSA_TRANS_NAME, names->num_entries);
424 if (!oldnames->name) {
425 return NT_STATUS_NO_MEMORY;
427 for (i = 0; i < names->num_entries; i++) {
428 oldnames->name[i].sid_name_use = names->name[i].sid_name_use;
429 oldnames->name[i].hdr_name = names->name[i].hdr_name;
430 oldnames->name[i].domain_idx = names->name[i].domain_idx;
434 r_l->ptr_dom_ref = ref ? 1 : 0;
436 r_l->mapped_count = mapped_count;
440 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
442 DOM_SID local_adm_sid;
450 init_sec_access(&mask, POLICY_EXECUTE);
451 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
453 sid_copy(&adm_sid, get_global_sam_sid());
454 sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
455 init_sec_access(&mask, POLICY_ALL_ACCESS);
456 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
458 sid_copy(&local_adm_sid, &global_sid_Builtin);
459 sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
460 init_sec_access(&mask, POLICY_ALL_ACCESS);
461 init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
463 if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
464 return NT_STATUS_NO_MEMORY;
466 if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL, psa, sd_size)) == NULL)
467 return NT_STATUS_NO_MEMORY;
472 #if 0 /* AD DC work in ongoing in Samba 4 */
474 /***************************************************************************
476 ***************************************************************************/
478 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
479 const char *dns_name, const char *forest_name,
480 struct GUID *dom_guid, DOM_SID *dom_sid)
482 if (nb_name && *nb_name) {
483 init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
484 init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name);
485 r_l->hdr_nb_dom_name.uni_max_len += 2;
486 r_l->uni_nb_dom_name.uni_max_len += 1;
489 if (dns_name && *dns_name) {
490 init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE);
491 init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name);
492 r_l->hdr_dns_dom_name.uni_max_len += 2;
493 r_l->uni_dns_dom_name.uni_max_len += 1;
496 if (forest_name && *forest_name) {
497 init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE);
498 init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name);
499 r_l->hdr_forest_name.uni_max_len += 2;
500 r_l->uni_forest_name.uni_max_len += 1;
503 /* how do we init the guid ? probably should write an init fn */
505 memcpy(&r_l->dom_guid, dom_guid, sizeof(struct GUID));
509 r_l->ptr_dom_sid = 1;
510 init_dom_sid2(&r_l->dom_sid, dom_sid);
513 #endif /* AD DC work in ongoing in Samba 4 */
516 /***************************************************************************
518 ***************************************************************************/
520 NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL2 *r_u)
522 struct lsa_info *info;
523 SEC_DESC *psd = NULL;
525 uint32 des_access=q_u->des_access;
530 /* map the generic bits to the lsa policy ones */
531 se_map_generic(&des_access, &lsa_generic_mapping);
533 /* get the generic lsa policy SD until we store it */
534 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
536 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
537 if (p->pipe_user.ut.uid != sec_initial_uid()) {
540 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
541 acc_granted, des_access));
542 DEBUGADD(4,("but overwritten by euid == 0\n"));
545 /* This is needed for lsa_open_account and rpcclient .... :-) */
547 if (p->pipe_user.ut.uid == sec_initial_uid())
548 acc_granted = POLICY_ALL_ACCESS;
550 /* associate the domain SID with the (unique) handle. */
551 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
552 return NT_STATUS_NO_MEMORY;
555 sid_copy(&info->sid,get_global_sam_sid());
556 info->access = acc_granted;
558 /* set up the LSA QUERY INFO response */
559 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
560 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
565 /***************************************************************************
567 ***************************************************************************/
569 NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *r_u)
571 struct lsa_info *info;
572 SEC_DESC *psd = NULL;
574 uint32 des_access=q_u->des_access;
579 /* map the generic bits to the lsa policy ones */
580 se_map_generic(&des_access, &lsa_generic_mapping);
582 /* get the generic lsa policy SD until we store it */
583 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
585 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
586 if (geteuid() != 0) {
589 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
590 acc_granted, des_access));
591 DEBUGADD(4,("but overwritten by euid == 0\n"));
592 acc_granted = des_access;
595 /* associate the domain SID with the (unique) handle. */
596 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
597 return NT_STATUS_NO_MEMORY;
600 sid_copy(&info->sid,get_global_sam_sid());
601 info->access = acc_granted;
603 /* set up the LSA QUERY INFO response */
604 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
605 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
610 /***************************************************************************
611 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
613 ***************************************************************************/
615 NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u,
616 LSA_R_ENUM_TRUST_DOM *r_u)
618 struct lsa_info *info;
620 struct trustdom_info **domains;
623 * preferred length is set to 5 as a "our" preferred length
624 * nt sets this parameter to 2
625 * update (20.08.2002): it's not preferred length, but preferred size!
626 * it needs further investigation how to optimally choose this value
628 uint32 max_num_domains =
629 q_u->preferred_len < 5 ? q_u->preferred_len : 10;
634 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
635 return NT_STATUS_INVALID_HANDLE;
637 /* check if the user have enough rights */
638 if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
639 return NT_STATUS_ACCESS_DENIED;
641 nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
643 if (!NT_STATUS_IS_OK(nt_status)) {
647 if (q_u->enum_context < num_domains) {
648 num_thistime = MIN(num_domains, max_num_domains);
650 r_u->status = STATUS_MORE_ENTRIES;
652 if (q_u->enum_context + num_thistime > num_domains) {
653 num_thistime = num_domains - q_u->enum_context;
654 r_u->status = NT_STATUS_OK;
657 next_idx = q_u->enum_context + num_thistime;
660 next_idx = 0xffffffff;
661 r_u->status = NT_STATUS_NO_MORE_ENTRIES;
664 /* set up the lsa_enum_trust_dom response */
666 init_r_enum_trust_dom(p->mem_ctx, r_u, next_idx,
667 num_thistime, domains+q_u->enum_context);
672 /***************************************************************************
673 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
674 ***************************************************************************/
676 NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INFO *r_u)
678 struct lsa_info *handle;
679 LSA_INFO_CTR *ctr = &r_u->ctr;
684 r_u->status = NT_STATUS_OK;
686 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
687 return NT_STATUS_INVALID_HANDLE;
689 switch (q_u->info_class) {
693 uint32 policy_def = LSA_AUDIT_POLICY_ALL;
695 /* check if the user have enough rights */
696 if (!(handle->access & POLICY_VIEW_AUDIT_INFORMATION)) {
697 DEBUG(10,("_lsa_query_info: insufficient access rights\n"));
698 return NT_STATUS_ACCESS_DENIED;
701 /* fake info: We audit everything. ;) */
702 ctr->info.id2.ptr = 1;
703 ctr->info.id2.auditing_enabled = True;
704 ctr->info.id2.count1 = ctr->info.id2.count2 = LSA_AUDIT_NUM_CATEGORIES;
706 if ((ctr->info.id2.auditsettings = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, LSA_AUDIT_NUM_CATEGORIES)) == NULL)
707 return NT_STATUS_NO_MEMORY;
709 ctr->info.id2.auditsettings[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT] = policy_def;
710 ctr->info.id2.auditsettings[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS] = policy_def;
711 ctr->info.id2.auditsettings[LSA_AUDIT_CATEGORY_LOGON] = policy_def;
712 ctr->info.id2.auditsettings[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING] = policy_def;
713 ctr->info.id2.auditsettings[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES] = policy_def;
714 ctr->info.id2.auditsettings[LSA_AUDIT_CATEGORY_SYSTEM] = policy_def;
715 ctr->info.id2.auditsettings[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS] = policy_def;
720 /* check if the user have enough rights */
721 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
722 return NT_STATUS_ACCESS_DENIED;
724 /* Request PolicyPrimaryDomainInformation. */
725 switch (lp_server_role()) {
726 case ROLE_DOMAIN_PDC:
727 case ROLE_DOMAIN_BDC:
728 name = get_global_sam_name();
729 sid = get_global_sam_sid();
731 case ROLE_DOMAIN_MEMBER:
732 name = lp_workgroup();
733 /* We need to return the Domain SID here. */
734 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid))
737 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
739 case ROLE_STANDALONE:
740 name = lp_workgroup();
744 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
746 init_dom_query_3(&r_u->ctr.info.id3, name, sid);
749 /* check if the user have enough rights */
750 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
751 return NT_STATUS_ACCESS_DENIED;
753 /* Request PolicyAccountDomainInformation. */
754 name = get_global_sam_name();
755 sid = get_global_sam_sid();
756 init_dom_query_5(&r_u->ctr.info.id5, name, sid);
759 /* check if the user have enough rights */
760 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
761 return NT_STATUS_ACCESS_DENIED;
763 switch (lp_server_role()) {
764 case ROLE_DOMAIN_BDC:
766 * only a BDC is a backup controller
767 * of the domain, it controls.
769 ctr->info.id6.server_role = 2;
773 * any other role is a primary
774 * of the domain, it controls.
776 ctr->info.id6.server_role = 3;
781 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u->info_class));
782 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
786 if (NT_STATUS_IS_OK(r_u->status)) {
787 r_u->dom_ptr = 0x22000000; /* bizarre */
788 ctr->info_class = q_u->info_class;
794 /***************************************************************************
795 _lsa_lookup_sids_internal
796 ***************************************************************************/
798 static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
799 uint16 level, /* input */
800 int num_sids, /* input */
801 const DOM_SID2 *sid, /* input */
802 DOM_R_REF **pp_ref, /* output */
803 LSA_TRANS_NAME_ENUM2 *names, /* input/output */
804 uint32 *pp_mapped_count)
808 const DOM_SID **sids = NULL;
809 DOM_R_REF *ref = NULL;
810 uint32 mapped_count = 0;
811 struct lsa_dom_info *dom_infos = NULL;
812 struct lsa_name_info *name_infos = NULL;
814 *pp_mapped_count = 0;
822 sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
823 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
825 if (sids == NULL || ref == NULL) {
826 return NT_STATUS_NO_MEMORY;
829 for (i=0; i<num_sids; i++) {
830 sids[i] = &sid[i].sid;
833 status = lookup_sids(p->mem_ctx, num_sids, sids, level,
834 &dom_infos, &name_infos);
836 if (!NT_STATUS_IS_OK(status)) {
840 names->name = TALLOC_ARRAY(p->mem_ctx, LSA_TRANS_NAME2, num_sids);
841 names->uni_name = TALLOC_ARRAY(p->mem_ctx, UNISTR2, num_sids);
842 if ((names->name == NULL) || (names->uni_name == NULL)) {
843 return NT_STATUS_NO_MEMORY;
846 for (i=0; i<MAX_REF_DOMAINS; i++) {
848 if (!dom_infos[i].valid) {
852 if (init_dom_ref(ref, dom_infos[i].name,
853 &dom_infos[i].sid) != i) {
854 DEBUG(0, ("Domain %s mentioned twice??\n",
856 return NT_STATUS_INTERNAL_ERROR;
860 for (i=0; i<num_sids; i++) {
861 struct lsa_name_info *name = &name_infos[i];
863 if (name->type == SID_NAME_UNKNOWN) {
865 /* Unknown sids should return the string
866 * representation of the SID. Windows 2003 behaves
867 * rather erratic here, in many cases it returns the
868 * RID as 8 bytes hex, in others it returns the full
869 * SID. We (Jerry/VL) could not figure out which the
870 * hard cases are, so leave it with the SID. */
871 name->name = talloc_asprintf(p->mem_ctx, "%s",
872 sid_string_static(sids[i]));
873 if (name->name == NULL) {
874 return NT_STATUS_NO_MEMORY;
879 init_lsa_trans_name2(&names->name[i], &names->uni_name[i],
880 name->type, name->name, name->dom_idx);
883 names->num_entries = num_sids;
884 names->ptr_trans_names = 1;
885 names->num_entries2 = num_sids;
887 status = NT_STATUS_NONE_MAPPED;
888 if (mapped_count > 0) {
889 status = (mapped_count < num_sids) ?
890 STATUS_SOME_UNMAPPED : NT_STATUS_OK;
893 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
894 num_sids, mapped_count, nt_errstr(status)));
896 *pp_mapped_count = mapped_count;
902 /***************************************************************************
904 ***************************************************************************/
906 NTSTATUS _lsa_lookup_sids(pipes_struct *p,
907 LSA_Q_LOOKUP_SIDS *q_u,
908 LSA_R_LOOKUP_SIDS *r_u)
910 struct lsa_info *handle;
911 int num_sids = q_u->sids.num_entries;
912 uint32 mapped_count = 0;
913 DOM_R_REF *ref = NULL;
914 LSA_TRANS_NAME_ENUM2 names;
917 if ((q_u->level < 1) || (q_u->level > 6)) {
918 return NT_STATUS_INVALID_PARAMETER;
921 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
922 return NT_STATUS_INVALID_HANDLE;
925 /* check if the user has enough rights */
926 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
927 return NT_STATUS_ACCESS_DENIED;
930 if (num_sids > MAX_LOOKUP_SIDS) {
931 DEBUG(5,("_lsa_lookup_sids: limit of %d exceeded, requested %d\n",
932 MAX_LOOKUP_SIDS, num_sids));
933 return NT_STATUS_NONE_MAPPED;
936 r_u->status = _lsa_lookup_sids_internal(p,
944 /* Convert from LSA_TRANS_NAME_ENUM2 to LSA_TRANS_NAME_ENUM */
946 status = init_reply_lookup_sids(p->mem_ctx, r_u, ref, &names, mapped_count);
947 if (!NT_STATUS_IS_OK(status)) {
953 /***************************************************************************
955 ***************************************************************************/
957 NTSTATUS _lsa_lookup_sids2(pipes_struct *p,
958 LSA_Q_LOOKUP_SIDS2 *q_u,
959 LSA_R_LOOKUP_SIDS2 *r_u)
961 struct lsa_info *handle;
962 int num_sids = q_u->sids.num_entries;
963 uint32 mapped_count = 0;
964 DOM_R_REF *ref = NULL;
966 if ((q_u->level < 1) || (q_u->level > 6)) {
967 return NT_STATUS_INVALID_PARAMETER;
970 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
971 return NT_STATUS_INVALID_HANDLE;
974 /* check if the user have enough rights */
975 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
976 return NT_STATUS_ACCESS_DENIED;
979 if (num_sids > MAX_LOOKUP_SIDS) {
980 DEBUG(5,("_lsa_lookup_sids2: limit of %d exceeded, requested %d\n",
981 MAX_LOOKUP_SIDS, num_sids));
982 return NT_STATUS_NONE_MAPPED;
985 r_u->status = _lsa_lookup_sids_internal(p,
993 init_reply_lookup_sids2(r_u, ref, mapped_count);
997 /***************************************************************************
999 ***************************************************************************/
1001 NTSTATUS _lsa_lookup_sids3(pipes_struct *p,
1002 LSA_Q_LOOKUP_SIDS3 *q_u,
1003 LSA_R_LOOKUP_SIDS3 *r_u)
1005 int num_sids = q_u->sids.num_entries;
1006 uint32 mapped_count = 0;
1007 DOM_R_REF *ref = NULL;
1009 if ((q_u->level < 1) || (q_u->level > 6)) {
1010 return NT_STATUS_INVALID_PARAMETER;
1013 /* No policy handle on this call. Restrict to crypto connections. */
1014 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1015 DEBUG(0,("_lsa_lookup_sids3: client %s not using schannel for netlogon\n",
1016 get_remote_machine_name() ));
1017 return NT_STATUS_INVALID_PARAMETER;
1020 if (num_sids > MAX_LOOKUP_SIDS) {
1021 DEBUG(5,("_lsa_lookup_sids3: limit of %d exceeded, requested %d\n",
1022 MAX_LOOKUP_SIDS, num_sids));
1023 return NT_STATUS_NONE_MAPPED;
1026 r_u->status = _lsa_lookup_sids_internal(p,
1034 init_reply_lookup_sids3(r_u, ref, mapped_count);
1038 /***************************************************************************
1039 lsa_reply_lookup_names
1040 ***************************************************************************/
1042 NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP_NAMES *r_u)
1044 struct lsa_info *handle;
1045 UNISTR2 *names = q_u->uni_name;
1046 uint32 num_entries = q_u->num_entries;
1049 uint32 mapped_count = 0;
1052 if (num_entries > MAX_LOOKUP_SIDS) {
1053 num_entries = MAX_LOOKUP_SIDS;
1054 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
1057 /* Probably the lookup_level is some sort of bitmask. */
1058 if (q_u->lookup_level == 1) {
1059 flags = LOOKUP_NAME_ALL;
1062 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
1064 return NT_STATUS_NO_MEMORY;
1068 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID, num_entries);
1070 return NT_STATUS_NO_MEMORY;
1076 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
1077 r_u->status = NT_STATUS_INVALID_HANDLE;
1081 /* check if the user have enough rights */
1082 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
1083 r_u->status = NT_STATUS_ACCESS_DENIED;
1087 /* set up the LSA Lookup RIDs response */
1088 become_root(); /* lookup_name can require root privs */
1089 r_u->status = lookup_lsa_rids(p->mem_ctx, ref, rids, num_entries,
1090 names, flags, &mapped_count);
1095 if (NT_STATUS_IS_OK(r_u->status) && (num_entries != 0) ) {
1096 if (mapped_count == 0)
1097 r_u->status = NT_STATUS_NONE_MAPPED;
1098 else if (mapped_count != num_entries)
1099 r_u->status = STATUS_SOME_UNMAPPED;
1102 init_reply_lookup_names(r_u, ref, num_entries, rids, mapped_count);
1106 /***************************************************************************
1107 lsa_reply_lookup_names2
1108 ***************************************************************************/
1110 NTSTATUS _lsa_lookup_names2(pipes_struct *p, LSA_Q_LOOKUP_NAMES2 *q_u, LSA_R_LOOKUP_NAMES2 *r_u)
1112 struct lsa_info *handle;
1113 UNISTR2 *names = q_u->uni_name;
1114 uint32 num_entries = q_u->num_entries;
1119 uint32 mapped_count = 0;
1122 if (num_entries > MAX_LOOKUP_SIDS) {
1123 num_entries = MAX_LOOKUP_SIDS;
1124 DEBUG(5,("_lsa_lookup_names2: truncating name lookup list to %d\n", num_entries));
1127 /* Probably the lookup_level is some sort of bitmask. */
1128 if (q_u->lookup_level == 1) {
1129 flags = LOOKUP_NAME_ALL;
1132 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
1134 r_u->status = NT_STATUS_NO_MEMORY;
1135 return NT_STATUS_NO_MEMORY;
1139 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID, num_entries);
1140 rids2 = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, num_entries);
1141 if ((rids == NULL) || (rids2 == NULL)) {
1142 r_u->status = NT_STATUS_NO_MEMORY;
1143 return NT_STATUS_NO_MEMORY;
1150 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
1151 r_u->status = NT_STATUS_INVALID_HANDLE;
1155 /* check if the user have enough rights */
1156 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
1157 r_u->status = NT_STATUS_ACCESS_DENIED;
1161 /* set up the LSA Lookup RIDs response */
1162 become_root(); /* lookup_name can require root privs */
1163 r_u->status = lookup_lsa_rids(p->mem_ctx, ref, rids, num_entries,
1164 names, flags, &mapped_count);
1169 if (NT_STATUS_IS_OK(r_u->status)) {
1170 if (mapped_count == 0) {
1171 r_u->status = NT_STATUS_NONE_MAPPED;
1172 } else if (mapped_count != num_entries) {
1173 r_u->status = STATUS_SOME_UNMAPPED;
1177 /* Convert the rids array to rids2. */
1178 for (i = 0; i < num_entries; i++) {
1179 rids2[i].type = rids[i].type;
1180 rids2[i].rid = rids[i].rid;
1181 rids2[i].rid_idx = rids[i].rid_idx;
1182 rids2[i].unknown = 0;
1185 init_reply_lookup_names2(r_u, ref, num_entries, rids2, mapped_count);
1189 /***************************************************************************
1190 lsa_reply_lookup_names3.
1191 ***************************************************************************/
1193 NTSTATUS _lsa_lookup_names3(pipes_struct *p, LSA_Q_LOOKUP_NAMES3 *q_u, LSA_R_LOOKUP_NAMES3 *r_u)
1195 struct lsa_info *handle;
1196 UNISTR2 *names = q_u->uni_name;
1197 uint32 num_entries = q_u->num_entries;
1198 DOM_R_REF *ref = NULL;
1199 LSA_TRANSLATED_SID3 *trans_sids = NULL;
1200 uint32 mapped_count = 0;
1203 if (num_entries > MAX_LOOKUP_SIDS) {
1204 num_entries = MAX_LOOKUP_SIDS;
1205 DEBUG(5,("_lsa_lookup_names3: truncating name lookup list to %d\n", num_entries));
1208 /* Probably the lookup_level is some sort of bitmask. */
1209 if (q_u->lookup_level == 1) {
1210 flags = LOOKUP_NAME_ALL;
1213 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
1215 return NT_STATUS_NO_MEMORY;
1218 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_TRANSLATED_SID3, num_entries);
1220 return NT_STATUS_NO_MEMORY;
1226 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
1227 r_u->status = NT_STATUS_INVALID_HANDLE;
1231 /* check if the user have enough rights */
1232 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
1233 r_u->status = NT_STATUS_ACCESS_DENIED;
1237 /* set up the LSA Lookup SIDs response */
1238 become_root(); /* lookup_name can require root privs */
1239 r_u->status = lookup_lsa_sids(p->mem_ctx, ref, trans_sids, num_entries,
1240 names, flags, &mapped_count);
1245 if (NT_STATUS_IS_OK(r_u->status)) {
1246 if (mapped_count == 0) {
1247 r_u->status = NT_STATUS_NONE_MAPPED;
1248 } else if (mapped_count != num_entries) {
1249 r_u->status = STATUS_SOME_UNMAPPED;
1253 init_reply_lookup_names3(r_u, ref, num_entries, trans_sids, mapped_count);
1257 /***************************************************************************
1258 lsa_reply_lookup_names4.
1259 ***************************************************************************/
1261 NTSTATUS _lsa_lookup_names4(pipes_struct *p, LSA_Q_LOOKUP_NAMES4 *q_u, LSA_R_LOOKUP_NAMES4 *r_u)
1263 UNISTR2 *names = q_u->uni_name;
1264 uint32 num_entries = q_u->num_entries;
1265 DOM_R_REF *ref = NULL;
1266 LSA_TRANSLATED_SID3 *trans_sids = NULL;
1267 uint32 mapped_count = 0;
1270 if (num_entries > MAX_LOOKUP_SIDS) {
1271 num_entries = MAX_LOOKUP_SIDS;
1272 DEBUG(5,("_lsa_lookup_names4: truncating name lookup list to %d\n", num_entries));
1275 /* Probably the lookup_level is some sort of bitmask. */
1276 if (q_u->lookup_level == 1) {
1277 flags = LOOKUP_NAME_ALL;
1280 /* No policy handle on this call. Restrict to crypto connections. */
1281 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1282 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1283 get_remote_machine_name() ));
1284 return NT_STATUS_INVALID_PARAMETER;
1287 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
1289 return NT_STATUS_NO_MEMORY;
1293 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_TRANSLATED_SID3, num_entries);
1295 return NT_STATUS_NO_MEMORY;
1301 /* set up the LSA Lookup SIDs response */
1302 become_root(); /* lookup_name can require root privs */
1303 r_u->status = lookup_lsa_sids(p->mem_ctx, ref, trans_sids, num_entries,
1304 names, flags, &mapped_count);
1307 if (NT_STATUS_IS_OK(r_u->status)) {
1308 if (mapped_count == 0) {
1309 r_u->status = NT_STATUS_NONE_MAPPED;
1310 } else if (mapped_count != num_entries) {
1311 r_u->status = STATUS_SOME_UNMAPPED;
1315 init_reply_lookup_names4(r_u, ref, num_entries, trans_sids, mapped_count);
1319 /***************************************************************************
1320 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1321 ***************************************************************************/
1323 NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
1325 if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
1326 return NT_STATUS_INVALID_HANDLE;
1329 close_policy_hnd(p, r->in.handle);
1330 return NT_STATUS_OK;
1333 /***************************************************************************
1334 ***************************************************************************/
1336 NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
1338 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1341 /***************************************************************************
1342 ***************************************************************************/
1344 NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
1346 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1349 /***************************************************************************
1350 ***************************************************************************/
1352 NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
1354 return NT_STATUS_ACCESS_DENIED;
1357 /***************************************************************************
1358 ***************************************************************************/
1360 NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
1362 return NT_STATUS_ACCESS_DENIED;
1365 /***************************************************************************
1366 ***************************************************************************/
1368 NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
1370 return NT_STATUS_ACCESS_DENIED;
1373 /***************************************************************************
1374 ***************************************************************************/
1376 NTSTATUS _lsa_delete_object(pipes_struct *p, LSA_Q_DELETE_OBJECT *q_u, LSA_R_DELETE_OBJECT *r_u)
1378 return NT_STATUS_ACCESS_DENIED;
1381 /***************************************************************************
1383 ***************************************************************************/
1385 NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIVS *r_u)
1387 struct lsa_info *handle;
1389 uint32 enum_context = q_u->enum_context;
1390 int num_privs = count_all_privileges();
1391 LSA_PRIV_ENTRY *entries = NULL;
1394 /* remember that the enum_context starts at 0 and not 1 */
1396 if ( enum_context >= num_privs )
1397 return NT_STATUS_NO_MORE_ENTRIES;
1399 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n",
1400 enum_context, num_privs));
1402 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1403 return NT_STATUS_INVALID_HANDLE;
1405 /* check if the user have enough rights
1406 I don't know if it's the right one. not documented. */
1408 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1409 return NT_STATUS_ACCESS_DENIED;
1412 if ( !(entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, num_privs )) )
1413 return NT_STATUS_NO_MEMORY;
1418 for (i = 0; i < num_privs; i++) {
1419 if( i < enum_context) {
1420 init_unistr2(&entries[i].name, NULL, UNI_FLAGS_NONE);
1421 init_uni_hdr(&entries[i].hdr_name, &entries[i].name);
1423 entries[i].luid_low = 0;
1424 entries[i].luid_high = 0;
1426 init_unistr2(&entries[i].name, privs[i].name, UNI_FLAGS_NONE);
1427 init_uni_hdr(&entries[i].hdr_name, &entries[i].name);
1429 luid = get_privilege_luid( &privs[i].se_priv );
1431 entries[i].luid_low = luid.luid.low;
1432 entries[i].luid_high = luid.luid.high;
1436 enum_context = num_privs;
1438 init_lsa_r_enum_privs(r_u, enum_context, num_privs, entries);
1440 return NT_STATUS_OK;
1443 /***************************************************************************
1444 _lsa_priv_get_dispname.
1445 ***************************************************************************/
1447 NTSTATUS _lsa_priv_get_dispname(pipes_struct *p, LSA_Q_PRIV_GET_DISPNAME *q_u, LSA_R_PRIV_GET_DISPNAME *r_u)
1449 struct lsa_info *handle;
1451 const char *description;
1453 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1454 return NT_STATUS_INVALID_HANDLE;
1456 /* check if the user have enough rights */
1459 * I don't know if it's the right one. not documented.
1461 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1462 return NT_STATUS_ACCESS_DENIED;
1464 unistr2_to_ascii(name_asc, &q_u->name, sizeof(name_asc));
1466 DEBUG(10,("_lsa_priv_get_dispname: name = %s\n", name_asc));
1468 description = get_privilege_dispname( name_asc );
1470 if ( description ) {
1471 DEBUG(10,("_lsa_priv_get_dispname: display name = %s\n", description));
1473 init_unistr2(&r_u->desc, description, UNI_FLAGS_NONE);
1474 init_uni_hdr(&r_u->hdr_desc, &r_u->desc);
1476 r_u->ptr_info = 0xdeadbeef;
1477 r_u->lang_id = q_u->lang_id;
1479 return NT_STATUS_OK;
1481 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
1485 return NT_STATUS_NO_SUCH_PRIVILEGE;
1489 /***************************************************************************
1491 ***************************************************************************/
1493 NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENUM_ACCOUNTS *r_u)
1495 struct lsa_info *handle;
1497 int i, j, num_entries;
1498 LSA_SID_ENUM *sids=&r_u->sids;
1501 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1502 return NT_STATUS_INVALID_HANDLE;
1504 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1505 return NT_STATUS_ACCESS_DENIED;
1510 /* The only way we can currently find out all the SIDs that have been
1511 privileged is to scan all privileges */
1513 if (!NT_STATUS_IS_OK(ret = privilege_enumerate_accounts(&sid_list, &num_entries))) {
1517 if (q_u->enum_context >= num_entries)
1518 return NT_STATUS_NO_MORE_ENTRIES;
1520 if (num_entries-q_u->enum_context) {
1521 sids->ptr_sid = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_entries-q_u->enum_context);
1522 sids->sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_entries-q_u->enum_context);
1524 if (sids->ptr_sid==NULL || sids->sid==NULL) {
1525 SAFE_FREE(sid_list);
1526 return NT_STATUS_NO_MEMORY;
1529 for (i = q_u->enum_context, j = 0; i < num_entries; i++, j++) {
1530 init_dom_sid2(&(*sids).sid[j], &sid_list[i]);
1531 (*sids).ptr_sid[j] = 1;
1534 sids->ptr_sid = NULL;
1538 talloc_free(sid_list);
1540 init_lsa_r_enum_accounts(r_u, num_entries);
1542 return NT_STATUS_OK;
1546 NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u)
1548 const char *username, *domname;
1549 user_struct *vuser = get_valid_user_struct(p->vuid);
1552 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1556 * I'm 99% sure this is not the right place to do this,
1557 * global_sid_Anonymous should probably be put into the token
1558 * instead of the guest id -- vl
1560 if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
1561 &domname, &username, NULL)) {
1562 return NT_STATUS_NO_MEMORY;
1565 username = vuser->user.smb_name;
1566 domname = vuser->user.domain;
1569 r_u->ptr_user_name = 1;
1570 init_unistr2(&r_u->uni2_user_name, username, UNI_STR_TERMINATE);
1571 init_uni_hdr(&r_u->hdr_user_name, &r_u->uni2_user_name);
1575 r_u->ptr_dom_name = 1;
1576 init_unistr2(&r_u->uni2_dom_name, domname, UNI_STR_TERMINATE);
1577 init_uni_hdr(&r_u->hdr_dom_name, &r_u->uni2_dom_name);
1579 r_u->status = NT_STATUS_OK;
1584 /***************************************************************************
1586 ***************************************************************************/
1588 NTSTATUS _lsa_create_account(pipes_struct *p, LSA_Q_CREATEACCOUNT *q_u, LSA_R_CREATEACCOUNT *r_u)
1590 struct lsa_info *handle;
1591 struct lsa_info *info;
1593 /* find the connection policy handle. */
1594 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1595 return NT_STATUS_INVALID_HANDLE;
1597 /* check if the user have enough rights */
1600 * I don't know if it's the right one. not documented.
1601 * but guessed with rpcclient.
1603 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
1604 return NT_STATUS_ACCESS_DENIED;
1606 /* check to see if the pipe_user is a Domain Admin since
1607 account_pol.tdb was already opened as root, this is all we have */
1609 if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1610 return NT_STATUS_ACCESS_DENIED;
1612 if ( is_privileged_sid( &q_u->sid.sid ) )
1613 return NT_STATUS_OBJECT_NAME_COLLISION;
1615 /* associate the user/group SID with the (unique) handle. */
1617 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1618 return NT_STATUS_NO_MEMORY;
1621 info->sid = q_u->sid.sid;
1622 info->access = q_u->access;
1624 /* get a (unique) handle. open a policy on it. */
1625 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
1626 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1628 return privilege_create_account( &info->sid );
1632 /***************************************************************************
1634 ***************************************************************************/
1636 NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENACCOUNT *r_u)
1638 struct lsa_info *handle;
1639 struct lsa_info *info;
1641 /* find the connection policy handle. */
1642 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1643 return NT_STATUS_INVALID_HANDLE;
1645 /* check if the user have enough rights */
1648 * I don't know if it's the right one. not documented.
1649 * but guessed with rpcclient.
1651 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
1652 return NT_STATUS_ACCESS_DENIED;
1654 /* TODO: Fis the parsing routine before reenabling this check! */
1656 if (!lookup_sid(&handle->sid, dom_name, name, &type))
1657 return NT_STATUS_ACCESS_DENIED;
1659 /* associate the user/group SID with the (unique) handle. */
1660 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1661 return NT_STATUS_NO_MEMORY;
1664 info->sid = q_u->sid.sid;
1665 info->access = q_u->access;
1667 /* get a (unique) handle. open a policy on it. */
1668 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
1669 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1671 return NT_STATUS_OK;
1674 /***************************************************************************
1675 For a given SID, enumerate all the privilege this account has.
1676 ***************************************************************************/
1678 NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, prs_struct *ps, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u)
1680 struct lsa_info *info=NULL;
1682 PRIVILEGE_SET privileges;
1684 /* find the connection policy handle. */
1685 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1686 return NT_STATUS_INVALID_HANDLE;
1688 if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
1689 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1691 privilege_set_init( &privileges );
1693 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1695 DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n",
1696 sid_string_static(&info->sid), privileges.count));
1698 r_u->status = init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, privileges.set, privileges.count, 0);
1701 r_u->status = NT_STATUS_NO_SUCH_PRIVILEGE;
1703 privilege_set_free( &privileges );
1708 /***************************************************************************
1710 ***************************************************************************/
1712 NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA_R_GETSYSTEMACCOUNT *r_u)
1714 struct lsa_info *info=NULL;
1716 /* find the connection policy handle. */
1718 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1719 return NT_STATUS_INVALID_HANDLE;
1721 if (!lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, NULL))
1722 return NT_STATUS_ACCESS_DENIED;
1725 0x01 -> Log on locally
1726 0x02 -> Access this computer from network
1727 0x04 -> Log on as a batch job
1728 0x10 -> Log on as a service
1730 they can be ORed together
1733 r_u->access = PR_LOG_ON_LOCALLY | PR_ACCESS_FROM_NETWORK;
1735 return NT_STATUS_OK;
1738 /***************************************************************************
1739 update the systemaccount information
1740 ***************************************************************************/
1742 NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA_R_SETSYSTEMACCOUNT *r_u)
1744 struct lsa_info *info=NULL;
1746 r_u->status = NT_STATUS_OK;
1748 /* find the connection policy handle. */
1749 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1750 return NT_STATUS_INVALID_HANDLE;
1752 /* check to see if the pipe_user is a Domain Admin since
1753 account_pol.tdb was already opened as root, this is all we have */
1755 if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1756 return NT_STATUS_ACCESS_DENIED;
1758 if (!pdb_getgrsid(&map, info->sid))
1759 return NT_STATUS_NO_SUCH_GROUP;
1761 return pdb_update_group_mapping_entry(&map);
1764 /***************************************************************************
1765 For a given SID, add some privileges.
1766 ***************************************************************************/
1768 NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u)
1770 struct lsa_info *info = NULL;
1772 PRIVILEGE_SET *set = NULL;
1774 /* find the connection policy handle. */
1775 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1776 return NT_STATUS_INVALID_HANDLE;
1778 /* check to see if the pipe_user is root or a Domain Admin since
1779 account_pol.tdb was already opened as root, this is all we have */
1781 if ( p->pipe_user.ut.uid != sec_initial_uid()
1782 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1784 return NT_STATUS_ACCESS_DENIED;
1789 if ( !privilege_set_to_se_priv( &mask, set ) )
1790 return NT_STATUS_NO_SUCH_PRIVILEGE;
1792 if ( !grant_privilege( &info->sid, &mask ) ) {
1793 DEBUG(3,("_lsa_addprivs: grant_privilege(%s) failed!\n",
1794 sid_string_static(&info->sid) ));
1795 DEBUG(3,("Privilege mask:\n"));
1796 dump_se_priv( DBGC_ALL, 3, &mask );
1797 return NT_STATUS_NO_SUCH_PRIVILEGE;
1800 return NT_STATUS_OK;
1803 /***************************************************************************
1804 For a given SID, remove some privileges.
1805 ***************************************************************************/
1807 NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u)
1809 struct lsa_info *info = NULL;
1811 PRIVILEGE_SET *set = NULL;
1813 /* find the connection policy handle. */
1814 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1815 return NT_STATUS_INVALID_HANDLE;
1817 /* check to see if the pipe_user is root or a Domain Admin since
1818 account_pol.tdb was already opened as root, this is all we have */
1820 if ( p->pipe_user.ut.uid != sec_initial_uid()
1821 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1823 return NT_STATUS_ACCESS_DENIED;
1828 if ( !privilege_set_to_se_priv( &mask, set ) )
1829 return NT_STATUS_NO_SUCH_PRIVILEGE;
1831 if ( !revoke_privilege( &info->sid, &mask ) ) {
1832 DEBUG(3,("_lsa_removeprivs: revoke_privilege(%s) failed!\n",
1833 sid_string_static(&info->sid) ));
1834 DEBUG(3,("Privilege mask:\n"));
1835 dump_se_priv( DBGC_ALL, 3, &mask );
1836 return NT_STATUS_NO_SUCH_PRIVILEGE;
1839 return NT_STATUS_OK;
1842 /***************************************************************************
1843 For a given SID, remove some privileges.
1844 ***************************************************************************/
1846 NTSTATUS _lsa_query_secobj(pipes_struct *p, LSA_Q_QUERY_SEC_OBJ *q_u, LSA_R_QUERY_SEC_OBJ *r_u)
1848 struct lsa_info *handle=NULL;
1849 SEC_DESC *psd = NULL;
1853 r_u->status = NT_STATUS_OK;
1855 /* find the connection policy handle. */
1856 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1857 return NT_STATUS_INVALID_HANDLE;
1859 /* check if the user have enough rights */
1860 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1861 return NT_STATUS_ACCESS_DENIED;
1864 switch (q_u->sec_info) {
1866 /* SD contains only the owner */
1868 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1869 if(!NT_STATUS_IS_OK(status))
1870 return NT_STATUS_NO_MEMORY;
1873 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1874 return NT_STATUS_NO_MEMORY;
1877 /* SD contains only the ACL */
1879 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1880 if(!NT_STATUS_IS_OK(status))
1881 return NT_STATUS_NO_MEMORY;
1883 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1884 return NT_STATUS_NO_MEMORY;
1887 return NT_STATUS_INVALID_LEVEL;
1895 #if 0 /* AD DC work in ongoing in Samba 4 */
1897 /***************************************************************************
1898 ***************************************************************************/
1900 NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1902 struct lsa_info *handle;
1903 const char *nb_name;
1904 char *dns_name = NULL;
1905 char *forest_name = NULL;
1906 DOM_SID *sid = NULL;
1911 r_u->status = NT_STATUS_OK;
1913 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1914 return NT_STATUS_INVALID_HANDLE;
1916 switch (q_u->info_class) {
1918 /* check if the user have enough rights */
1919 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1920 return NT_STATUS_ACCESS_DENIED;
1922 /* Request PolicyPrimaryDomainInformation. */
1923 switch (lp_server_role()) {
1924 case ROLE_DOMAIN_PDC:
1925 case ROLE_DOMAIN_BDC:
1926 nb_name = get_global_sam_name();
1927 /* ugly temp hack for these next two */
1929 /* This should be a 'netbios domain -> DNS domain' mapping */
1930 dnsdomname = get_mydnsdomname(p->mem_ctx);
1932 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1934 strlower_m(dnsdomname);
1936 dns_name = dnsdomname;
1937 forest_name = dnsdomname;
1939 sid = get_global_sam_sid();
1940 secrets_fetch_domain_guid(lp_workgroup(), &guid);
1943 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1945 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1946 forest_name,&guid,sid);
1949 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1950 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1954 if (NT_STATUS_IS_OK(r_u->status)) {
1956 r_u->info_class = q_u->info_class;
1961 #endif /* AD DC work in ongoing in Samba 4 */
1963 /***************************************************************************
1964 ***************************************************************************/
1966 NTSTATUS _lsa_add_acct_rights(pipes_struct *p, LSA_Q_ADD_ACCT_RIGHTS *q_u, LSA_R_ADD_ACCT_RIGHTS *r_u)
1968 struct lsa_info *info = NULL;
1972 UNISTR4_ARRAY *uni_privnames = q_u->rights;
1975 /* find the connection policy handle. */
1976 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1977 return NT_STATUS_INVALID_HANDLE;
1979 /* check to see if the pipe_user is a Domain Admin since
1980 account_pol.tdb was already opened as root, this is all we have */
1982 if ( p->pipe_user.ut.uid != sec_initial_uid()
1983 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1985 return NT_STATUS_ACCESS_DENIED;
1988 /* according to an NT4 PDC, you can add privileges to SIDs even without
1989 call_lsa_create_account() first. And you can use any arbitrary SID. */
1991 sid_copy( &sid, &q_u->sid.sid );
1993 /* just a little sanity check */
1995 if ( q_u->count != uni_privnames->count ) {
1996 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1997 return NT_STATUS_INVALID_HANDLE;
2000 for ( i=0; i<q_u->count; i++ ) {
2001 UNISTR4 *uni4_str = &uni_privnames->strings[i];
2003 /* only try to add non-null strings */
2005 if ( !uni4_str->string )
2008 rpcstr_pull( privname, uni4_str->string->buffer, sizeof(privname), -1, STR_TERMINATE );
2010 if ( !grant_privilege_by_name( &sid, privname ) ) {
2011 DEBUG(2,("_lsa_add_acct_rights: Failed to add privilege [%s]\n", privname ));
2012 return NT_STATUS_NO_SUCH_PRIVILEGE;
2016 return NT_STATUS_OK;
2019 /***************************************************************************
2020 ***************************************************************************/
2022 NTSTATUS _lsa_remove_acct_rights(pipes_struct *p, LSA_Q_REMOVE_ACCT_RIGHTS *q_u, LSA_R_REMOVE_ACCT_RIGHTS *r_u)
2024 struct lsa_info *info = NULL;
2028 UNISTR4_ARRAY *uni_privnames = q_u->rights;
2031 /* find the connection policy handle. */
2032 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
2033 return NT_STATUS_INVALID_HANDLE;
2035 /* check to see if the pipe_user is a Domain Admin since
2036 account_pol.tdb was already opened as root, this is all we have */
2038 if ( p->pipe_user.ut.uid != sec_initial_uid()
2039 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
2041 return NT_STATUS_ACCESS_DENIED;
2044 sid_copy( &sid, &q_u->sid.sid );
2046 if ( q_u->removeall ) {
2047 if ( !revoke_all_privileges( &sid ) )
2048 return NT_STATUS_ACCESS_DENIED;
2050 return NT_STATUS_OK;
2053 /* just a little sanity check */
2055 if ( q_u->count != uni_privnames->count ) {
2056 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
2057 return NT_STATUS_INVALID_HANDLE;
2060 for ( i=0; i<q_u->count; i++ ) {
2061 UNISTR4 *uni4_str = &uni_privnames->strings[i];
2063 /* only try to add non-null strings */
2065 if ( !uni4_str->string )
2068 rpcstr_pull( privname, uni4_str->string->buffer, sizeof(privname), -1, STR_TERMINATE );
2070 if ( !revoke_privilege_by_name( &sid, privname ) ) {
2071 DEBUG(2,("_lsa_remove_acct_rights: Failed to revoke privilege [%s]\n", privname ));
2072 return NT_STATUS_NO_SUCH_PRIVILEGE;
2076 return NT_STATUS_OK;
2080 /***************************************************************************
2081 ***************************************************************************/
2083 NTSTATUS _lsa_enum_acct_rights(pipes_struct *p, LSA_Q_ENUM_ACCT_RIGHTS *q_u, LSA_R_ENUM_ACCT_RIGHTS *r_u)
2085 struct lsa_info *info = NULL;
2087 PRIVILEGE_SET privileges;
2091 /* find the connection policy handle. */
2093 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
2094 return NT_STATUS_INVALID_HANDLE;
2096 /* according to an NT4 PDC, you can add privileges to SIDs even without
2097 call_lsa_create_account() first. And you can use any arbitrary SID. */
2099 sid_copy( &sid, &q_u->sid.sid );
2101 if ( !get_privileges_for_sids( &mask, &sid, 1 ) )
2102 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2104 privilege_set_init( &privileges );
2106 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
2108 DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n",
2109 sid_string_static(&sid), privileges.count));
2111 r_u->status = init_r_enum_acct_rights( r_u, &privileges );
2114 r_u->status = NT_STATUS_NO_SUCH_PRIVILEGE;
2116 privilege_set_free( &privileges );
2122 /***************************************************************************
2123 ***************************************************************************/
2125 NTSTATUS _lsa_lookup_priv_value(pipes_struct *p, LSA_Q_LOOKUP_PRIV_VALUE *q_u, LSA_R_LOOKUP_PRIV_VALUE *r_u)
2127 struct lsa_info *info = NULL;
2129 LUID_ATTR priv_luid;
2132 /* find the connection policy handle. */
2134 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
2135 return NT_STATUS_INVALID_HANDLE;
2137 unistr2_to_ascii(name, &q_u->privname.unistring, sizeof(name));
2139 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
2141 if ( !se_priv_from_name( name, &mask ) )
2142 return NT_STATUS_NO_SUCH_PRIVILEGE;
2144 priv_luid = get_privilege_luid( &mask );
2146 r_u->luid.low = priv_luid.luid.low;
2147 r_u->luid.high = priv_luid.luid.high;
2150 return NT_STATUS_OK;
2155 * From here on the server routines are just dummy ones to make smbd link with
2156 * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2157 * pulling the server stubs across one by one.
2160 NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
2162 p->rng_fault_state = True;
2163 return NT_STATUS_NOT_IMPLEMENTED;
2166 NTSTATUS _lsa_EnumPrivs(pipes_struct *p, struct lsa_EnumPrivs *r)
2168 p->rng_fault_state = True;
2169 return NT_STATUS_NOT_IMPLEMENTED;
2172 NTSTATUS _lsa_QuerySecurity(pipes_struct *p, struct lsa_QuerySecurity *r)
2174 p->rng_fault_state = True;
2175 return NT_STATUS_NOT_IMPLEMENTED;
2178 NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
2180 p->rng_fault_state = True;
2181 return NT_STATUS_NOT_IMPLEMENTED;
2184 NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
2186 p->rng_fault_state = True;
2187 return NT_STATUS_NOT_IMPLEMENTED;
2190 NTSTATUS _lsa_OpenPolicy(pipes_struct *p, struct lsa_OpenPolicy *r)
2192 p->rng_fault_state = True;
2193 return NT_STATUS_NOT_IMPLEMENTED;
2196 NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p, struct lsa_QueryInfoPolicy *r)
2198 p->rng_fault_state = True;
2199 return NT_STATUS_NOT_IMPLEMENTED;
2202 NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
2204 p->rng_fault_state = True;
2205 return NT_STATUS_NOT_IMPLEMENTED;
2208 NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
2210 p->rng_fault_state = True;
2211 return NT_STATUS_NOT_IMPLEMENTED;
2214 NTSTATUS _lsa_CreateAccount(pipes_struct *p, struct lsa_CreateAccount *r)
2216 p->rng_fault_state = True;
2217 return NT_STATUS_NOT_IMPLEMENTED;
2220 NTSTATUS _lsa_EnumAccounts(pipes_struct *p, struct lsa_EnumAccounts *r)
2222 p->rng_fault_state = True;
2223 return NT_STATUS_NOT_IMPLEMENTED;
2226 NTSTATUS _lsa_EnumTrustDom(pipes_struct *p, struct lsa_EnumTrustDom *r)
2228 p->rng_fault_state = True;
2229 return NT_STATUS_NOT_IMPLEMENTED;
2232 NTSTATUS _lsa_LookupNames(pipes_struct *p, struct lsa_LookupNames *r)
2234 p->rng_fault_state = True;
2235 return NT_STATUS_NOT_IMPLEMENTED;
2238 NTSTATUS _lsa_LookupSids(pipes_struct *p, struct lsa_LookupSids *r)
2240 p->rng_fault_state = True;
2241 return NT_STATUS_NOT_IMPLEMENTED;
2244 NTSTATUS _lsa_OpenAccount(pipes_struct *p, struct lsa_OpenAccount *r)
2246 p->rng_fault_state = True;
2247 return NT_STATUS_NOT_IMPLEMENTED;
2250 NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p, struct lsa_EnumPrivsAccount *r)
2252 p->rng_fault_state = True;
2253 return NT_STATUS_NOT_IMPLEMENTED;
2256 NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p, struct lsa_AddPrivilegesToAccount *r)
2258 p->rng_fault_state = True;
2259 return NT_STATUS_NOT_IMPLEMENTED;
2262 NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p, struct lsa_RemovePrivilegesFromAccount *r)
2264 p->rng_fault_state = True;
2265 return NT_STATUS_NOT_IMPLEMENTED;
2268 NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
2270 p->rng_fault_state = True;
2271 return NT_STATUS_NOT_IMPLEMENTED;
2274 NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
2276 p->rng_fault_state = True;
2277 return NT_STATUS_NOT_IMPLEMENTED;
2280 NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p, struct lsa_GetSystemAccessAccount *r)
2282 p->rng_fault_state = True;
2283 return NT_STATUS_NOT_IMPLEMENTED;
2286 NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p, struct lsa_SetSystemAccessAccount *r)
2288 p->rng_fault_state = True;
2289 return NT_STATUS_NOT_IMPLEMENTED;
2292 NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
2294 p->rng_fault_state = True;
2295 return NT_STATUS_NOT_IMPLEMENTED;
2298 NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
2300 p->rng_fault_state = True;
2301 return NT_STATUS_NOT_IMPLEMENTED;
2304 NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
2306 p->rng_fault_state = True;
2307 return NT_STATUS_NOT_IMPLEMENTED;
2310 NTSTATUS _lsa_LookupPrivValue(pipes_struct *p, struct lsa_LookupPrivValue *r)
2312 p->rng_fault_state = True;
2313 return NT_STATUS_NOT_IMPLEMENTED;
2316 NTSTATUS _lsa_LookupPrivName(pipes_struct *p, struct lsa_LookupPrivName *r)
2318 p->rng_fault_state = True;
2319 return NT_STATUS_NOT_IMPLEMENTED;
2322 NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p, struct lsa_LookupPrivDisplayName *r)
2324 p->rng_fault_state = True;
2325 return NT_STATUS_NOT_IMPLEMENTED;
2328 NTSTATUS _lsa_DeleteObject(pipes_struct *p, struct lsa_DeleteObject *r)
2330 p->rng_fault_state = True;
2331 return NT_STATUS_NOT_IMPLEMENTED;
2334 NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p, struct lsa_EnumAccountsWithUserRight *r)
2336 p->rng_fault_state = True;
2337 return NT_STATUS_NOT_IMPLEMENTED;
2340 NTSTATUS _lsa_EnumAccountRights(pipes_struct *p, struct lsa_EnumAccountRights *r)
2342 p->rng_fault_state = True;
2343 return NT_STATUS_NOT_IMPLEMENTED;
2346 NTSTATUS _lsa_AddAccountRights(pipes_struct *p, struct lsa_AddAccountRights *r)
2348 p->rng_fault_state = True;
2349 return NT_STATUS_NOT_IMPLEMENTED;
2352 NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p, struct lsa_RemoveAccountRights *r)
2354 p->rng_fault_state = True;
2355 return NT_STATUS_NOT_IMPLEMENTED;
2358 NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
2360 p->rng_fault_state = True;
2361 return NT_STATUS_NOT_IMPLEMENTED;
2364 NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
2366 p->rng_fault_state = True;
2367 return NT_STATUS_NOT_IMPLEMENTED;
2370 NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
2372 p->rng_fault_state = True;
2373 return NT_STATUS_NOT_IMPLEMENTED;
2376 NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
2378 p->rng_fault_state = True;
2379 return NT_STATUS_NOT_IMPLEMENTED;
2382 NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
2384 p->rng_fault_state = True;
2385 return NT_STATUS_NOT_IMPLEMENTED;
2388 NTSTATUS _lsa_OpenPolicy2(pipes_struct *p, struct lsa_OpenPolicy2 *r)
2390 p->rng_fault_state = True;
2391 return NT_STATUS_NOT_IMPLEMENTED;
2394 NTSTATUS _lsa_GetUserName(pipes_struct *p, struct lsa_GetUserName *r)
2396 p->rng_fault_state = True;
2397 return NT_STATUS_NOT_IMPLEMENTED;
2400 NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p, struct lsa_QueryInfoPolicy2 *r)
2402 p->rng_fault_state = True;
2403 return NT_STATUS_NOT_IMPLEMENTED;
2406 NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
2408 p->rng_fault_state = True;
2409 return NT_STATUS_NOT_IMPLEMENTED;
2412 NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
2414 p->rng_fault_state = True;
2415 return NT_STATUS_NOT_IMPLEMENTED;
2418 NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
2420 p->rng_fault_state = True;
2421 return NT_STATUS_NOT_IMPLEMENTED;
2424 NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
2426 p->rng_fault_state = True;
2427 return NT_STATUS_NOT_IMPLEMENTED;
2430 NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
2432 p->rng_fault_state = True;
2433 return NT_STATUS_NOT_IMPLEMENTED;
2436 NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
2438 p->rng_fault_state = True;
2439 return NT_STATUS_NOT_IMPLEMENTED;
2442 NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
2444 p->rng_fault_state = True;
2445 return NT_STATUS_NOT_IMPLEMENTED;
2448 NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
2450 p->rng_fault_state = True;
2451 return NT_STATUS_NOT_IMPLEMENTED;
2454 NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
2456 p->rng_fault_state = True;
2457 return NT_STATUS_NOT_IMPLEMENTED;
2460 NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
2462 p->rng_fault_state = True;
2463 return NT_STATUS_NOT_IMPLEMENTED;
2466 NTSTATUS _lsa_LookupSids2(pipes_struct *p, struct lsa_LookupSids2 *r)
2468 p->rng_fault_state = True;
2469 return NT_STATUS_NOT_IMPLEMENTED;
2472 NTSTATUS _lsa_LookupNames2(pipes_struct *p, struct lsa_LookupNames2 *r)
2474 p->rng_fault_state = True;
2475 return NT_STATUS_NOT_IMPLEMENTED;
2478 NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
2480 p->rng_fault_state = True;
2481 return NT_STATUS_NOT_IMPLEMENTED;
2484 NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
2486 p->rng_fault_state = True;
2487 return NT_STATUS_NOT_IMPLEMENTED;
2490 NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
2492 p->rng_fault_state = True;
2493 return NT_STATUS_NOT_IMPLEMENTED;
2496 NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
2498 p->rng_fault_state = True;
2499 return NT_STATUS_NOT_IMPLEMENTED;
2502 NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
2504 p->rng_fault_state = True;
2505 return NT_STATUS_NOT_IMPLEMENTED;
2508 NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
2510 p->rng_fault_state = True;
2511 return NT_STATUS_NOT_IMPLEMENTED;
2514 NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
2516 p->rng_fault_state = True;
2517 return NT_STATUS_NOT_IMPLEMENTED;
2520 NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
2522 p->rng_fault_state = True;
2523 return NT_STATUS_NOT_IMPLEMENTED;
2526 NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
2528 p->rng_fault_state = True;
2529 return NT_STATUS_NOT_IMPLEMENTED;
2532 NTSTATUS _lsa_LookupNames3(pipes_struct *p, struct lsa_LookupNames3 *r)
2534 p->rng_fault_state = True;
2535 return NT_STATUS_NOT_IMPLEMENTED;
2538 NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
2540 p->rng_fault_state = True;
2541 return NT_STATUS_NOT_IMPLEMENTED;
2544 NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
2546 p->rng_fault_state = True;
2547 return NT_STATUS_NOT_IMPLEMENTED;
2550 NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
2552 p->rng_fault_state = True;
2553 return NT_STATUS_NOT_IMPLEMENTED;
2556 NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
2558 p->rng_fault_state = True;
2559 return NT_STATUS_NOT_IMPLEMENTED;
2562 NTSTATUS _lsa_LSARQUERYFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARQUERYFORESTTRUSTINFORMATION *r)
2564 p->rng_fault_state = True;
2565 return NT_STATUS_NOT_IMPLEMENTED;
2568 NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2570 p->rng_fault_state = True;
2571 return NT_STATUS_NOT_IMPLEMENTED;
2574 NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
2576 p->rng_fault_state = True;
2577 return NT_STATUS_NOT_IMPLEMENTED;
2580 NTSTATUS _lsa_LookupSids3(pipes_struct *p, struct lsa_LookupSids3 *r)
2582 p->rng_fault_state = True;
2583 return NT_STATUS_NOT_IMPLEMENTED;
2586 NTSTATUS _lsa_LookupNames4(pipes_struct *p, struct lsa_LookupNames4 *r)
2588 p->rng_fault_state = True;
2589 return NT_STATUS_NOT_IMPLEMENTED;
2592 NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
2594 p->rng_fault_state = True;
2595 return NT_STATUS_NOT_IMPLEMENTED;
2598 NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2600 p->rng_fault_state = True;
2601 return NT_STATUS_NOT_IMPLEMENTED;
2604 NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2606 p->rng_fault_state = True;
2607 return NT_STATUS_NOT_IMPLEMENTED;
2610 NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
2612 p->rng_fault_state = True;
2613 return NT_STATUS_NOT_IMPLEMENTED;