source/lsarpcd/srv_lsa.c

   1
   2 /*
   3  *  Unix SMB/Netbios implementation.
   4  *  Version 1.9.
   5  *  RPC Pipe client / server routines
   6  *  Copyright (C) Andrew Tridgell              1992-1997,
   7  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   8  *  Copyright (C) Paul Ashton                       1997.
   9  *  Copyright (C) Jeremy Allison                    1998.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24  */
  25
  26
  27 #include "includes.h"
  28 #include "nterr.h"
  29
  30 extern int DEBUGLEVEL;
  31 extern DOM_SID global_sam_sid;
  32 extern fstring global_sam_name;
  33 extern DOM_SID global_member_sid;
  34 extern fstring global_myworkgroup;
  35 extern DOM_SID global_sid_S_1_5_20;
  36
  37 /***************************************************************************
  38 lsa_reply_open_policy2
  39  ***************************************************************************/
  40 static void lsa_reply_open_policy2(prs_struct *rdata)
  41 {
  42         int i;
  43         LSA_R_OPEN_POL2 r_o;
  44
  45         ZERO_STRUCT(r_o);
  46
  47         /* set up the LSA QUERY INFO response */
  48
  49         for (i = 4; i < POL_HND_SIZE; i++)
  50         {
  51                 r_o.pol.data[i] = i;
  52         }
  53         r_o.status = 0x0;
  54
  55         /* store the response in the SMB stream */
  56         lsa_io_r_open_pol2("", &r_o, rdata, 0);
  57 }
  58
  59 /***************************************************************************
  60 lsa_reply_open_policy
  61  ***************************************************************************/
  62 static void lsa_reply_open_policy(prs_struct *rdata)
  63 {
  64         int i;
  65         LSA_R_OPEN_POL r_o;
  66
  67         ZERO_STRUCT(r_o);
  68
  69         /* set up the LSA QUERY INFO response */
  70
  71         for (i = 4; i < POL_HND_SIZE; i++)
  72         {
  73                 r_o.pol.data[i] = i;
  74         }
  75         r_o.status = 0x0;
  76
  77         /* store the response in the SMB stream */
  78         lsa_io_r_open_pol("", &r_o, rdata, 0);
  79 }
  80
  81 /***************************************************************************
  82 make_dom_query
  83  ***************************************************************************/
  84 static void make_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
  85 {
  86         fstring sid_str;
  87         int domlen = strlen(dom_name);
  88
  89         d_q->uni_dom_max_len = domlen * 2;
  90         d_q->uni_dom_str_len = domlen * 2;
  91
  92         d_q->buffer_dom_name = domlen  != 0    ? 1 : 0; /* domain buffer pointer */
  93         d_q->buffer_dom_sid  = dom_sid != NULL ? 1 : 0; /* domain sid pointer */
  94
  95         /* this string is supposed to be character short */
  96         make_unistr2(&(d_q->uni_domain_name), dom_name, domlen);
  97
  98         sid_to_string(sid_str, dom_sid);
  99         make_dom_sid2(&(d_q->dom_sid), dom_sid);
 100 }
 101
 102 /***************************************************************************
 103 lsa_reply_query_info
 104  ***************************************************************************/
 105 static void lsa_reply_enum_trust_dom(LSA_Q_ENUM_TRUST_DOM *q_e,
 106                                 prs_struct *rdata,
 107                                 uint32 enum_context, char *dom_name, DOM_SID *dom_sid)
 108 {
 109         LSA_R_ENUM_TRUST_DOM r_e;
 110
 111         ZERO_STRUCT(r_e);
 112
 113         /* set up the LSA QUERY INFO response */
 114         make_r_enum_trust_dom(&r_e, enum_context, dom_name, dom_sid,
 115               dom_name != NULL ? 0x0 : 0x80000000 | NT_STATUS_UNABLE_TO_FREE_VM);
 116
 117         /* store the response in the SMB stream */
 118         lsa_io_r_enum_trust_dom("", &r_e, rdata, 0);
 119 }
 120
 121 /***************************************************************************
 122 lsa_reply_query_info
 123  ***************************************************************************/
 124 static void lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, prs_struct *rdata,
 125                                 char *dom_name, DOM_SID *dom_sid)
 126 {
 127         LSA_R_QUERY_INFO r_q;
 128
 129         ZERO_STRUCT(r_q);
 130
 131         /* set up the LSA QUERY INFO response */
 132
 133         r_q.undoc_buffer = 0x22000000; /* bizarre */
 134         r_q.info_class = q_q->info_class;
 135
 136         make_dom_query(&r_q.dom.id5, dom_name, dom_sid);
 137
 138         r_q.status = 0x0;
 139
 140         /* store the response in the SMB stream */
 141         lsa_io_r_query("", &r_q, rdata, 0);
 142 }
 143
 144
 145 /***************************************************************************
 146 make_dom_ref - adds a domain if it's not already in, returns the index
 147  ***************************************************************************/
 148 static int make_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid)
 149
 150 {
 151         int num = 0;
 152         int len;
 153
 154         if (dom_name != NULL)
 155         {
 156                 for (num = 0; num < ref->num_ref_doms_1; num++)
 157                 {
 158                         fstring domname;
 159                         fstrcpy(domname, unistr2_to_str(&ref->ref_dom[num].uni_dom_name));
 160                         if (strequal(domname, dom_name))
 161                         {
 162                                 return num;
 163                         }
 164                 }
 165
 166         }
 167         else
 168         {
 169                 num = ref->num_ref_doms_1;
 170         }
 171
 172         if (num >= MAX_REF_DOMAINS)
 173         {
 174                 /* index not found, already at maximum domain limit */
 175                 return -1;
 176         }
 177
 178         ref->undoc_buffer = 1;
 179         ref->num_ref_doms_1 = num+1;
 180         ref->undoc_buffer2 = 1;
 181         ref->max_entries = MAX_REF_DOMAINS;
 182         ref->num_ref_doms_2 = num+1;
 183
 184         len = dom_name != NULL ? strlen(dom_name) : 0;
 185
 186         make_uni_hdr(&(ref->hdr_ref_dom[num].hdr_dom_name), len, len, len != 0 ? 1 : 0);
 187         ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0;
 188
 189         make_unistr2 (&(ref->ref_dom[num].uni_dom_name), dom_name, len);
 190         make_dom_sid2(&(ref->ref_dom[num].ref_dom     ), dom_sid );
 191
 192         return num;
 193 }
 194
 195 /***************************************************************************
 196 make_reply_lookup_names
 197  ***************************************************************************/
 198 static void make_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
 199                                 int num_entries,
 200                                 DOM_SID dom_sids [MAX_LOOKUP_SIDS],
 201                                 uint8   dom_types[MAX_LOOKUP_SIDS])
 202 {
 203         int i;
 204
 205         r_l->num_entries = 0;
 206         r_l->undoc_buffer = 0;
 207         r_l->num_entries2 = 0;
 208
 209 #if 0
 210         r_l->num_entries = num_entries;
 211         r_l->undoc_buffer = 1;
 212         r_l->num_entries2 = num_entries;
 213
 214         SMB_ASSERT_ARRAY(r_l->dom_rid, num_entries);
 215
 216         for (i = 0; i < num_entries; i++)
 217         {
 218                 DOM_SID sid = dom_sids[i];
 219                 uint32 rid;
 220                 sid_split_rid(&sid, &rid);
 221                 make_dom_ref(&(r_l->dom_ref), dom_name, dom_sid);
 222                 make_dom_rid2(&(r_l->dom_rid[i]), rid, dom_types[i]);
 223         }
 224
 225         r_l->num_entries3 = num_entries;
 226 #endif
 227 }
 228
 229 /***************************************************************************
 230 make_lsa_trans_names
 231  ***************************************************************************/
 232 static void make_lsa_trans_names(DOM_R_REF *ref,
 233                                 LSA_TRANS_NAME_ENUM *trn,
 234                                 int num_entries, DOM_SID2 sid[MAX_LOOKUP_SIDS],
 235                                 uint32 *mapped_count)
 236 {
 237         int i;
 238         int total = 0;
 239         (*mapped_count) = 0;
 240
 241         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 242
 243         for (i = 0; i < num_entries; i++)
 244         {
 245                 uint32 status = 0x0;
 246                 DOM_SID find_sid = sid[i].sid;
 247                 DOM_SID tmp_sid  = sid[i].sid;
 248                 uint32 rid = 0xffffffff;
 249                 int dom_idx = -1;
 250                 fstring name;
 251                 fstring dom_name;
 252                 uint8 sid_name_use = 0;
 253
 254                 memset(dom_name, 0, sizeof(dom_name));
 255                 memset(name    , 0, sizeof(name    ));
 256
 257                 if (map_domain_sid_to_name(&find_sid, dom_name))
 258                 {
 259                         sid_name_use = SID_NAME_DOMAIN;
 260                         dom_idx = make_dom_ref(ref, dom_name, &find_sid);
 261                 }
 262                 else if (sid_split_rid         (&find_sid, &rid) &&
 263                          map_domain_sid_to_name(&find_sid, dom_name))
 264                 {
 265                         if (sid_equal(&find_sid, &global_sam_sid) ||
 266                             sid_equal(&find_sid, &global_sid_S_1_5_20))
 267                         {
 268                                 status = lookup_sid(&tmp_sid, name, &sid_name_use);
 269                         }
 270                         else
 271                         {
 272                                 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 273                         }
 274                 }
 275                 else
 276                 {
 277                         status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 278                 }
 279
 280                 dom_idx = make_dom_ref(ref, dom_name, &find_sid);
 281
 282                 if (status == 0x0)
 283                 {
 284                         (*mapped_count)++;
 285                 }
 286                 else
 287                 {
 288                         snprintf(name, sizeof(name), "%08x", rid);
 289                         sid_name_use = SID_NAME_UNKNOWN;
 290
 291                 }
 292                 make_lsa_trans_name(&(trn->name    [total]),
 293                                     &(trn->uni_name[total]),
 294                                     sid_name_use, name, dom_idx);
 295                 total++;
 296         }
 297
 298         trn->num_entries = total;
 299         trn->ptr_trans_names = 1;
 300         trn->num_entries2 = total;
 301 }
 302
 303 /***************************************************************************
 304 make_reply_lookup_sids
 305  ***************************************************************************/
 306 static void make_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
 307                                 DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *names,
 308                                 uint32 mapped_count, uint32 status)
 309 {
 310         r_l->dom_ref      = ref;
 311         r_l->names        = names;
 312         r_l->mapped_count = mapped_count;
 313         r_l->status       = status;
 314 }
 315
 316 /***************************************************************************
 317 lsa_reply_lookup_sids
 318  ***************************************************************************/
 319 static void lsa_reply_lookup_sids(prs_struct *rdata,
 320                                 DOM_SID2 *sid, int num_entries)
 321 {
 322         LSA_R_LOOKUP_SIDS r_l;
 323         DOM_R_REF ref;
 324         LSA_TRANS_NAME_ENUM names;
 325         uint32 mapped_count = 0;
 326
 327         ZERO_STRUCT(r_l);
 328         ZERO_STRUCT(ref);
 329         ZERO_STRUCT(names);
 330
 331         /* set up the LSA Lookup SIDs response */
 332         make_lsa_trans_names(&ref, &names, num_entries, sid, &mapped_count);
 333         make_reply_lookup_sids(&r_l, &ref, &names, mapped_count, 0x0);
 334
 335         /* store the response in the SMB stream */
 336         lsa_io_r_lookup_sids("", &r_l, rdata, 0);
 337 }
 338
 339 /***************************************************************************
 340 lsa_reply_lookup_names
 341  ***************************************************************************/
 342 static void lsa_reply_lookup_names(prs_struct *rdata,
 343                                 int num_entries,
 344                                 DOM_SID dom_sids [MAX_LOOKUP_SIDS],
 345                                 uint8   dom_types[MAX_LOOKUP_SIDS])
 346 {
 347         LSA_R_LOOKUP_NAMES r_l;
 348
 349         ZERO_STRUCT(r_l);
 350
 351         /* set up the LSA Lookup RIDs response */
 352         make_reply_lookup_names(&r_l, num_entries, dom_sids, dom_types);
 353
 354         r_l.status = 0x0;
 355
 356         /* store the response in the SMB stream */
 357         lsa_io_r_lookup_names("", &r_l, rdata, 0);
 358 }
 359
 360 /***************************************************************************
 361 api_lsa_open_policy
 362  ***************************************************************************/
 363 static void api_lsa_open_policy2( uint16 vuid, prs_struct *data,
 364                              prs_struct *rdata )
 365 {
 366         LSA_Q_OPEN_POL2 q_o;
 367
 368         ZERO_STRUCT(q_o);
 369
 370         /* grab the server, object attributes and desired access flag...*/
 371         lsa_io_q_open_pol2("", &q_o, data, 0);
 372
 373         /* lkclXXXX having decoded it, ignore all fields in the open policy! */
 374
 375         /* return a 20 byte policy handle */
 376         lsa_reply_open_policy2(rdata);
 377 }
 378
 379 /***************************************************************************
 380 api_lsa_open_policy
 381  ***************************************************************************/
 382 static void api_lsa_open_policy( uint16 vuid, prs_struct *data,
 383                              prs_struct *rdata )
 384 {
 385         LSA_Q_OPEN_POL q_o;
 386
 387         ZERO_STRUCT(q_o);
 388
 389         /* grab the server, object attributes and desired access flag...*/
 390         lsa_io_q_open_pol("", &q_o, data, 0);
 391
 392         /* lkclXXXX having decoded it, ignore all fields in the open policy! */
 393
 394         /* return a 20 byte policy handle */
 395         lsa_reply_open_policy(rdata);
 396 }
 397
 398 /***************************************************************************
 399 api_lsa_enum_trust_dom
 400  ***************************************************************************/
 401 static void api_lsa_enum_trust_dom( uint16 vuid, prs_struct *data,
 402                                     prs_struct *rdata )
 403 {
 404         LSA_Q_ENUM_TRUST_DOM q_e;
 405
 406         ZERO_STRUCT(q_e);
 407
 408         /* grab the enum trust domain context etc. */
 409         lsa_io_q_enum_trust_dom("", &q_e, data, 0);
 410
 411         /* construct reply.  return status is always 0x0 */
 412         lsa_reply_enum_trust_dom(&q_e, rdata, 0, NULL, NULL);
 413 }
 414
 415 /***************************************************************************
 416 api_lsa_query_info
 417  ***************************************************************************/
 418 static void api_lsa_query_info( uint16 vuid, prs_struct *data,
 419                                 prs_struct *rdata )
 420 {
 421         LSA_Q_QUERY_INFO q_i;
 422         fstring name;
 423         DOM_SID *sid = NULL;
 424         memset(name, 0, sizeof(name));
 425
 426         ZERO_STRUCT(q_i);
 427
 428         /* grab the info class and policy handle */
 429         lsa_io_q_query("", &q_i, data, 0);
 430
 431         switch (q_i.info_class)
 432         {
 433                 case 0x03:
 434                 {
 435                         fstrcpy(name, global_myworkgroup);
 436                         sid = &global_member_sid;
 437                         break;
 438                 }
 439                 case 0x05:
 440                 {
 441                         fstrcpy(name, global_sam_name);
 442                         sid = &global_sam_sid;
 443                         break;
 444                 }
 445                 default:
 446                 {
 447                         DEBUG(5,("unknown info level in Lsa Query: %d\n",
 448                                   q_i.info_class));
 449                         break;
 450                 }
 451         }
 452
 453         /* construct reply.  return status is always 0x0 */
 454         lsa_reply_query_info(&q_i, rdata, name, sid);
 455 }
 456
 457 /***************************************************************************
 458 api_lsa_lookup_sids
 459  ***************************************************************************/
 460 static void api_lsa_lookup_sids( uint16 vuid, prs_struct *data,
 461                                  prs_struct *rdata )
 462 {
 463         LSA_Q_LOOKUP_SIDS q_l;
 464         ZERO_STRUCT(q_l);
 465
 466         /* grab the info class and policy handle */
 467         lsa_io_q_lookup_sids("", &q_l, data, 0);
 468
 469         /* construct reply.  return status is always 0x0 */
 470         lsa_reply_lookup_sids(rdata, q_l.sids.sid, q_l.sids.num_entries);
 471 }
 472
 473 /***************************************************************************
 474 api_lsa_lookup_names
 475  ***************************************************************************/
 476 static void api_lsa_lookup_names( uint16 vuid, prs_struct *data,
 477                                   prs_struct *rdata )
 478 {
 479         int i;
 480         LSA_Q_LOOKUP_NAMES q_l;
 481         DOM_SID dom_sids [MAX_LOOKUP_SIDS];
 482         uint8   dom_types[MAX_LOOKUP_SIDS];
 483
 484         ZERO_STRUCT(q_l);
 485         ZERO_ARRAY(dom_sids);
 486
 487         /* grab the info class and policy handle */
 488         lsa_io_q_lookup_names("", &q_l, data, 0);
 489
 490         SMB_ASSERT_ARRAY(q_l.uni_name, q_l.num_entries);
 491
 492         /* convert received RIDs to strings, so we can do them. */
 493         for (i = 0; i < q_l.num_entries; i++)
 494         {
 495                 fstring name;
 496                 fstrcpy(name, unistr2_to_str(&q_l.uni_name[i]));
 497
 498                 if (!lookup_name(name, &dom_sids[i], &dom_types[i]))
 499                 {
 500                         dom_types[i] = SID_NAME_UNKNOWN;
 501                 }
 502         }
 503
 504         /* construct reply.  return status is always 0x0 */
 505         lsa_reply_lookup_names(rdata,
 506                               q_l.num_entries,
 507                               dom_sids, /* text-converted SIDs */
 508                               dom_types); /* SID_NAME_USE types */
 509 }
 510
 511 /***************************************************************************
 512  api_lsa_close
 513  ***************************************************************************/
 514 static void api_lsa_close( uint16 vuid, prs_struct *data,
 515                                   prs_struct *rdata)
 516 {
 517         /* XXXX this is NOT good */
 518         char *q = mem_data(&(rdata->data), rdata->offset);
 519
 520         SIVAL(q, 0, 0);
 521         q += 4;
 522         SIVAL(q, 0, 0);
 523         q += 4;
 524         SIVAL(q, 0, 0);
 525         q += 4;
 526         SIVAL(q, 0, 0);
 527         q += 4;
 528         SIVAL(q, 0, 0);
 529         q += 4;
 530         SIVAL(q, 0, 0);
 531         q += 4;
 532
 533         rdata->offset += 24;
 534 }
 535
 536 /***************************************************************************
 537  api_lsa_open_secret
 538  ***************************************************************************/
 539 static void api_lsa_open_secret( uint16 vuid, prs_struct *data,
 540                                   prs_struct *rdata)
 541 {
 542         /* XXXX this is NOT good */
 543         char *q = mem_data(&(rdata->data), rdata->offset);
 544
 545         SIVAL(q, 0, 0);
 546         q += 4;
 547         SIVAL(q, 0, 0);
 548         q += 4;
 549         SIVAL(q, 0, 0);
 550         q += 4;
 551         SIVAL(q, 0, 0);
 552         q += 4;
 553         SIVAL(q, 0, 0);
 554         q += 4;
 555         SIVAL(q, 0, 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND);
 556         q += 4;
 557
 558         rdata->offset += 24;
 559 }
 560
 561 /***************************************************************************
 562  \PIPE\ntlsa commands
 563  ***************************************************************************/
 564 static struct api_struct api_lsa_cmds[] =
 565 {
 566         { "LSA_OPENPOLICY2"     , LSA_OPENPOLICY2     , api_lsa_open_policy2   },
 567         { "LSA_OPENPOLICY"      , LSA_OPENPOLICY      , api_lsa_open_policy    },
 568         { "LSA_QUERYINFOPOLICY" , LSA_QUERYINFOPOLICY , api_lsa_query_info     },
 569         { "LSA_ENUMTRUSTDOM"    , LSA_ENUMTRUSTDOM    , api_lsa_enum_trust_dom },
 570         { "LSA_CLOSE"           , LSA_CLOSE           , api_lsa_close          },
 571         { "LSA_OPENSECRET"      , LSA_OPENSECRET      , api_lsa_open_secret    },
 572         { "LSA_LOOKUPSIDS"      , LSA_LOOKUPSIDS      , api_lsa_lookup_sids    },
 573         { "LSA_LOOKUPNAMES"     , LSA_LOOKUPNAMES     , api_lsa_lookup_names   },
 574         { NULL                  , 0                   , NULL                   }
 575 };
 576
 577 /***************************************************************************
 578  api_ntLsarpcTNP
 579  ***************************************************************************/
 580 BOOL api_ntlsa_rpc(pipes_struct *p, prs_struct *data)
 581 {
 582         return api_rpcTNP(p, "api_ntlsa_rpc", api_lsa_cmds, data);
 583 }