source/rpc_server/srv_lsa.c

   1
   2 /*
   3  *  Unix SMB/Netbios implementation.
   4  *  Version 1.9.
   5  *  RPC Pipe client / server routines
   6  *  Copyright (C) Andrew Tridgell              1992-1997,
   7  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   8  *  Copyright (C) Paul Ashton                       1997.
   9  *  Copyright (C) Jeremy Allison                    1998.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24  */
  25
  26
  27 #include "includes.h"
  28 #include "nterr.h"
  29
  30 extern int DEBUGLEVEL;
  31 extern DOM_SID global_sam_sid;
  32 extern fstring global_sam_name;
  33 extern DOM_SID global_member_sid;
  34 extern fstring global_myworkgroup;
  35 extern DOM_SID global_sid_S_1_5_20;
  36
  37 /***************************************************************************
  38 lsa_reply_open_policy2
  39  ***************************************************************************/
  40 static void lsa_reply_open_policy2(prs_struct *rdata)
  41 {
  42         int i;
  43         LSA_R_OPEN_POL2 r_o;
  44
  45         ZERO_STRUCT(r_o);
  46
  47         /* set up the LSA QUERY INFO response */
  48
  49         for (i = 4; i < POL_HND_SIZE; i++)
  50         {
  51                 r_o.pol.data[i] = i;
  52         }
  53         r_o.status = 0x0;
  54
  55         /* store the response in the SMB stream */
  56         lsa_io_r_open_pol2("", &r_o, rdata, 0);
  57 }
  58
  59 /***************************************************************************
  60 lsa_reply_open_policy
  61  ***************************************************************************/
  62 static void lsa_reply_open_policy(prs_struct *rdata)
  63 {
  64         int i;
  65         LSA_R_OPEN_POL r_o;
  66
  67         ZERO_STRUCT(r_o);
  68
  69         /* set up the LSA QUERY INFO response */
  70
  71         for (i = 4; i < POL_HND_SIZE; i++)
  72         {
  73                 r_o.pol.data[i] = i;
  74         }
  75         r_o.status = 0x0;
  76
  77         /* store the response in the SMB stream */
  78         lsa_io_r_open_pol("", &r_o, rdata, 0);
  79 }
  80
  81 /***************************************************************************
  82 make_dom_query
  83  ***************************************************************************/
  84 static void make_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
  85 {
  86         fstring sid_str;
  87         int domlen = strlen(dom_name);
  88
  89         d_q->uni_dom_max_len = domlen * 2;
  90         d_q->uni_dom_str_len = domlen * 2;
  91
  92         d_q->buffer_dom_name = domlen  != 0    ? 1 : 0; /* domain buffer pointer */
  93         d_q->buffer_dom_sid  = dom_sid != NULL ? 1 : 0; /* domain sid pointer */
  94
  95         /* this string is supposed to be character short */
  96         make_unistr2(&(d_q->uni_domain_name), dom_name, domlen);
  97
  98         sid_to_string(sid_str, dom_sid);
  99         make_dom_sid2(&(d_q->dom_sid), dom_sid);
 100 }
 101
 102 /***************************************************************************
 103 lsa_reply_query_info
 104  ***************************************************************************/
 105 static void lsa_reply_enum_trust_dom(LSA_Q_ENUM_TRUST_DOM *q_e,
 106                                 prs_struct *rdata,
 107                                 uint32 enum_context, char *dom_name, DOM_SID *dom_sid)
 108 {
 109         LSA_R_ENUM_TRUST_DOM r_e;
 110
 111         ZERO_STRUCT(r_e);
 112
 113         /* set up the LSA QUERY INFO response */
 114         make_r_enum_trust_dom(&r_e, enum_context, dom_name, dom_sid,
 115               dom_name != NULL ? 0x0 : 0x80000000 | NT_STATUS_UNABLE_TO_FREE_VM);
 116
 117         /* store the response in the SMB stream */
 118         lsa_io_r_enum_trust_dom("", &r_e, rdata, 0);
 119 }
 120
 121 /***************************************************************************
 122 lsa_reply_query_info
 123  ***************************************************************************/
 124 static void lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, prs_struct *rdata,
 125                                 char *dom_name, DOM_SID *dom_sid)
 126 {
 127         LSA_R_QUERY_INFO r_q;
 128
 129         ZERO_STRUCT(r_q);
 130
 131         /* set up the LSA QUERY INFO response */
 132
 133         r_q.undoc_buffer = 0x22000000; /* bizarre */
 134         r_q.info_class = q_q->info_class;
 135
 136         make_dom_query(&r_q.dom.id5, dom_name, dom_sid);
 137
 138         r_q.status = 0x0;
 139
 140         /* store the response in the SMB stream */
 141         lsa_io_r_query("", &r_q, rdata, 0);
 142 }
 143
 144
 145 /***************************************************************************
 146 make_dom_ref - adds a domain if it's not already in, returns the index
 147  ***************************************************************************/
 148 static int make_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid)
 149
 150 {
 151         int num = 0;
 152         int len;
 153
 154         if (dom_name != NULL)
 155         {
 156                 for (num = 0; num < ref->num_ref_doms_1; num++)
 157                 {
 158                         fstring domname;
 159                         fstrcpy(domname, unistr2_to_str(&ref->ref_dom[num].uni_dom_name));
 160                         if (strequal(domname, dom_name))
 161                         {
 162                                 return num;
 163                         }
 164                 }
 165
 166         }
 167         else
 168         {
 169                 num = ref->num_ref_doms_1;
 170         }
 171
 172         if (num >= MAX_REF_DOMAINS)
 173         {
 174                 /* index not found, already at maximum domain limit */
 175                 return -1;
 176         }
 177
 178         ref->undoc_buffer = 1;
 179         ref->num_ref_doms_1 = num+1;
 180         ref->undoc_buffer2 = 1;
 181         ref->max_entries = MAX_REF_DOMAINS;
 182         ref->num_ref_doms_2 = num+1;
 183
 184         len = dom_name != NULL ? strlen(dom_name) : 0;
 185
 186         make_uni_hdr(&(ref->hdr_ref_dom[num].hdr_dom_name), len, len, len != 0 ? 1 : 0);
 187         ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0;
 188
 189         make_unistr2 (&(ref->ref_dom[num].uni_dom_name), dom_name, len);
 190         make_dom_sid2(&(ref->ref_dom[num].ref_dom     ), dom_sid );
 191
 192         return num;
 193 }
 194
 195 /***************************************************************************
 196 make_lsa_rid2s
 197  ***************************************************************************/
 198 static void make_lsa_rid2s(DOM_R_REF *ref,
 199                                 DOM_RID2 *rid2,
 200                                 int num_entries, UNISTR2 name[MAX_LOOKUP_SIDS],
 201                                 uint32 *mapped_count)
 202 {
 203         int i;
 204         int total = 0;
 205         (*mapped_count) = 0;
 206
 207         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 208
 209         for (i = 0; i < num_entries; i++)
 210         {
 211                 uint32 status = 0x0;
 212                 DOM_SID find_sid;
 213                 DOM_SID sid;
 214                 uint32 rid = 0xffffffff;
 215                 int dom_idx = -1;
 216                 fstring find_name;
 217                 char *dom_name = NULL;
 218                 uint8 sid_name_use = SID_NAME_UNKNOWN;
 219
 220                 fstrcpy(find_name, unistr2_to_str(&name[i]));
 221                 dom_name = strdup(find_name);
 222
 223                 if (map_domain_name_to_sid(&sid, &dom_name))
 224                 {
 225                         sid_name_use = SID_NAME_DOMAIN;
 226                         dom_idx = make_dom_ref(ref, dom_name, &find_sid);
 227                 }
 228
 229                 if (lookup_name(find_name, &sid, &sid_name_use) == 0x0 &&
 230                     sid_split_rid(&sid, &rid))
 231                 {
 232                         if (map_domain_sid_to_name(&sid, find_name))
 233                         {
 234                                 dom_idx = make_dom_ref(ref, find_name, &sid);
 235                         }
 236                         else
 237                         {
 238                                 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 239                         }
 240                 }
 241                 else
 242                 {
 243                         status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 244                 }
 245
 246                 if (status == 0x0)
 247                 {
 248                         (*mapped_count)++;
 249                 }
 250                 else
 251                 {
 252                         dom_idx = -1;
 253                         rid = 0xffffffff;
 254                         sid_name_use = SID_NAME_UNKNOWN;
 255                 }
 256
 257                 make_dom_rid2(&rid2[total], rid, sid_name_use, dom_idx);
 258                 total++;
 259
 260                 if (dom_name != NULL)
 261                 {
 262                         free(dom_name);
 263                 }
 264         }
 265 }
 266
 267 /***************************************************************************
 268 make_reply_lookup_names
 269  ***************************************************************************/
 270 static void make_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
 271                                 DOM_R_REF *ref, DOM_RID2 *rid2,
 272                                 uint32 mapped_count, uint32 status)
 273 {
 274         r_l->dom_ref      = ref;
 275         r_l->dom_rid      = rid2;
 276         r_l->mapped_count = mapped_count;
 277         r_l->status       = status;
 278 }
 279
 280 /***************************************************************************
 281 make_lsa_trans_names
 282  ***************************************************************************/
 283 static void make_lsa_trans_names(DOM_R_REF *ref,
 284                                 LSA_TRANS_NAME_ENUM *trn,
 285                                 int num_entries, DOM_SID2 sid[MAX_LOOKUP_SIDS],
 286                                 uint32 *mapped_count)
 287 {
 288         int i;
 289         int total = 0;
 290         (*mapped_count) = 0;
 291
 292         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 293
 294         for (i = 0; i < num_entries; i++)
 295         {
 296                 uint32 status = 0x0;
 297                 DOM_SID find_sid = sid[i].sid;
 298                 DOM_SID tmp_sid  = sid[i].sid;
 299                 uint32 rid = 0xffffffff;
 300                 int dom_idx = -1;
 301                 fstring name;
 302                 fstring dom_name;
 303                 uint8 sid_name_use = 0;
 304
 305                 memset(dom_name, 0, sizeof(dom_name));
 306                 memset(name    , 0, sizeof(name    ));
 307
 308                 if (map_domain_sid_to_name(&find_sid, dom_name))
 309                 {
 310                         sid_name_use = SID_NAME_DOMAIN;
 311                         dom_idx = make_dom_ref(ref, dom_name, &find_sid);
 312                 }
 313                 else if (sid_split_rid         (&find_sid, &rid) &&
 314                          map_domain_sid_to_name(&find_sid, dom_name))
 315                 {
 316                         if (sid_equal(&find_sid, &global_sam_sid) ||
 317                             sid_equal(&find_sid, &global_sid_S_1_5_20))
 318                         {
 319                                 status = lookup_sid(&tmp_sid, name, &sid_name_use);
 320                         }
 321                         else
 322                         {
 323                                 status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 324                         }
 325                 }
 326                 else
 327                 {
 328                         status = 0xC0000000 | NT_STATUS_NONE_MAPPED;
 329                 }
 330
 331                 dom_idx = make_dom_ref(ref, dom_name, &find_sid);
 332
 333                 if (status == 0x0)
 334                 {
 335                         (*mapped_count)++;
 336                 }
 337                 else
 338                 {
 339                         snprintf(name, sizeof(name), "%08x", rid);
 340                         sid_name_use = SID_NAME_UNKNOWN;
 341
 342                 }
 343                 make_lsa_trans_name(&(trn->name    [total]),
 344                                     &(trn->uni_name[total]),
 345                                     sid_name_use, name, dom_idx);
 346                 total++;
 347         }
 348
 349         trn->num_entries = total;
 350         trn->ptr_trans_names = 1;
 351         trn->num_entries2 = total;
 352 }
 353
 354 /***************************************************************************
 355 make_reply_lookup_sids
 356  ***************************************************************************/
 357 static void make_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
 358                                 DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *names,
 359                                 uint32 mapped_count, uint32 status)
 360 {
 361         r_l->dom_ref      = ref;
 362         r_l->names        = names;
 363         r_l->mapped_count = mapped_count;
 364         r_l->status       = status;
 365 }
 366
 367 /***************************************************************************
 368 lsa_reply_lookup_sids
 369  ***************************************************************************/
 370 static void lsa_reply_lookup_sids(prs_struct *rdata,
 371                                 DOM_SID2 *sid, int num_entries)
 372 {
 373         LSA_R_LOOKUP_SIDS r_l;
 374         DOM_R_REF ref;
 375         LSA_TRANS_NAME_ENUM names;
 376         uint32 mapped_count = 0;
 377
 378         ZERO_STRUCT(r_l);
 379         ZERO_STRUCT(ref);
 380         ZERO_STRUCT(names);
 381
 382         /* set up the LSA Lookup SIDs response */
 383         make_lsa_trans_names(&ref, &names, num_entries, sid, &mapped_count);
 384         make_reply_lookup_sids(&r_l, &ref, &names, mapped_count, 0x0);
 385
 386         /* store the response in the SMB stream */
 387         lsa_io_r_lookup_sids("", &r_l, rdata, 0);
 388 }
 389
 390 /***************************************************************************
 391 lsa_reply_lookup_names
 392  ***************************************************************************/
 393 static void lsa_reply_lookup_names(prs_struct *rdata,
 394                                 UNISTR2 names[MAX_LOOKUP_SIDS], int num_entries)
 395 {
 396         LSA_R_LOOKUP_NAMES r_l;
 397         DOM_R_REF ref;
 398         DOM_RID2 rids[MAX_LOOKUP_SIDS];
 399         uint32 mapped_count = 0;
 400
 401         ZERO_STRUCT(r_l);
 402         ZERO_STRUCT(ref);
 403         ZERO_STRUCT(rids);
 404
 405         /* set up the LSA Lookup RIDs response */
 406         make_lsa_rid2s(&ref, rids, num_entries, names, &mapped_count);
 407         make_reply_lookup_names(&r_l, &ref, rids, mapped_count, 0x0);
 408
 409         r_l.num_entries  = num_entries;
 410         r_l.undoc_buffer = 1;
 411         r_l.num_entries2 = num_entries;
 412
 413         /* store the response in the SMB stream */
 414         lsa_io_r_lookup_names("", &r_l, rdata, 0);
 415 }
 416
 417 /***************************************************************************
 418 api_lsa_open_policy
 419  ***************************************************************************/
 420 static void api_lsa_open_policy2( uint16 vuid, prs_struct *data,
 421                              prs_struct *rdata )
 422 {
 423         LSA_Q_OPEN_POL2 q_o;
 424
 425         ZERO_STRUCT(q_o);
 426
 427         /* grab the server, object attributes and desired access flag...*/
 428         lsa_io_q_open_pol2("", &q_o, data, 0);
 429
 430         /* lkclXXXX having decoded it, ignore all fields in the open policy! */
 431
 432         /* return a 20 byte policy handle */
 433         lsa_reply_open_policy2(rdata);
 434 }
 435
 436 /***************************************************************************
 437 api_lsa_open_policy
 438  ***************************************************************************/
 439 static void api_lsa_open_policy( uint16 vuid, prs_struct *data,
 440                              prs_struct *rdata )
 441 {
 442         LSA_Q_OPEN_POL q_o;
 443
 444         ZERO_STRUCT(q_o);
 445
 446         /* grab the server, object attributes and desired access flag...*/
 447         lsa_io_q_open_pol("", &q_o, data, 0);
 448
 449         /* lkclXXXX having decoded it, ignore all fields in the open policy! */
 450
 451         /* return a 20 byte policy handle */
 452         lsa_reply_open_policy(rdata);
 453 }
 454
 455 /***************************************************************************
 456 api_lsa_enum_trust_dom
 457  ***************************************************************************/
 458 static void api_lsa_enum_trust_dom( uint16 vuid, prs_struct *data,
 459                                     prs_struct *rdata )
 460 {
 461         LSA_Q_ENUM_TRUST_DOM q_e;
 462
 463         ZERO_STRUCT(q_e);
 464
 465         /* grab the enum trust domain context etc. */
 466         lsa_io_q_enum_trust_dom("", &q_e, data, 0);
 467
 468         /* construct reply.  return status is always 0x0 */
 469         lsa_reply_enum_trust_dom(&q_e, rdata, 0, NULL, NULL);
 470 }
 471
 472 /***************************************************************************
 473 api_lsa_query_info
 474  ***************************************************************************/
 475 static void api_lsa_query_info( uint16 vuid, prs_struct *data,
 476                                 prs_struct *rdata )
 477 {
 478         LSA_Q_QUERY_INFO q_i;
 479         fstring name;
 480         DOM_SID *sid = NULL;
 481         memset(name, 0, sizeof(name));
 482
 483         ZERO_STRUCT(q_i);
 484
 485         /* grab the info class and policy handle */
 486         lsa_io_q_query("", &q_i, data, 0);
 487
 488         switch (q_i.info_class)
 489         {
 490                 case 0x03:
 491                 {
 492                         fstrcpy(name, global_myworkgroup);
 493                         sid = &global_member_sid;
 494                         break;
 495                 }
 496                 case 0x05:
 497                 {
 498                         fstrcpy(name, global_sam_name);
 499                         sid = &global_sam_sid;
 500                         break;
 501                 }
 502                 default:
 503                 {
 504                         DEBUG(5,("unknown info level in Lsa Query: %d\n",
 505                                   q_i.info_class));
 506                         break;
 507                 }
 508         }
 509
 510         /* construct reply.  return status is always 0x0 */
 511         lsa_reply_query_info(&q_i, rdata, name, sid);
 512 }
 513
 514 /***************************************************************************
 515 api_lsa_lookup_sids
 516  ***************************************************************************/
 517 static void api_lsa_lookup_sids( uint16 vuid, prs_struct *data,
 518                                  prs_struct *rdata )
 519 {
 520         LSA_Q_LOOKUP_SIDS q_l;
 521         ZERO_STRUCT(q_l);
 522
 523         /* grab the info class and policy handle */
 524         lsa_io_q_lookup_sids("", &q_l, data, 0);
 525
 526         /* construct reply.  return status is always 0x0 */
 527         lsa_reply_lookup_sids(rdata, q_l.sids.sid, q_l.sids.num_entries);
 528 }
 529
 530 /***************************************************************************
 531 api_lsa_lookup_names
 532  ***************************************************************************/
 533 static void api_lsa_lookup_names( uint16 vuid, prs_struct *data,
 534                                   prs_struct *rdata )
 535 {
 536         LSA_Q_LOOKUP_NAMES q_l;
 537         ZERO_STRUCT(q_l);
 538
 539         /* grab the info class and policy handle */
 540         lsa_io_q_lookup_names("", &q_l, data, 0);
 541
 542         SMB_ASSERT_ARRAY(q_l.uni_name, q_l.num_entries);
 543
 544         /* construct reply.  return status is always 0x0 */
 545         lsa_reply_lookup_names(rdata, q_l.uni_name, q_l.num_entries);
 546 }
 547
 548 /***************************************************************************
 549  api_lsa_close
 550  ***************************************************************************/
 551 static void api_lsa_close( uint16 vuid, prs_struct *data,
 552                                   prs_struct *rdata)
 553 {
 554         /* XXXX this is NOT good */
 555         char *q = mem_data(&(rdata->data), rdata->offset);
 556
 557         SIVAL(q, 0, 0);
 558         q += 4;
 559         SIVAL(q, 0, 0);
 560         q += 4;
 561         SIVAL(q, 0, 0);
 562         q += 4;
 563         SIVAL(q, 0, 0);
 564         q += 4;
 565         SIVAL(q, 0, 0);
 566         q += 4;
 567         SIVAL(q, 0, 0);
 568         q += 4;
 569
 570         rdata->offset += 24;
 571 }
 572
 573 /***************************************************************************
 574  api_lsa_open_secret
 575  ***************************************************************************/
 576 static void api_lsa_open_secret( uint16 vuid, prs_struct *data,
 577                                   prs_struct *rdata)
 578 {
 579         /* XXXX this is NOT good */
 580         char *q = mem_data(&(rdata->data), rdata->offset);
 581
 582         SIVAL(q, 0, 0);
 583         q += 4;
 584         SIVAL(q, 0, 0);
 585         q += 4;
 586         SIVAL(q, 0, 0);
 587         q += 4;
 588         SIVAL(q, 0, 0);
 589         q += 4;
 590         SIVAL(q, 0, 0);
 591         q += 4;
 592         SIVAL(q, 0, 0xC0000000 | NT_STATUS_OBJECT_NAME_NOT_FOUND);
 593         q += 4;
 594
 595         rdata->offset += 24;
 596 }
 597
 598 /***************************************************************************
 599  \PIPE\ntlsa commands
 600  ***************************************************************************/
 601 static struct api_struct api_lsa_cmds[] =
 602 {
 603         { "LSA_OPENPOLICY2"     , LSA_OPENPOLICY2     , api_lsa_open_policy2   },
 604         { "LSA_OPENPOLICY"      , LSA_OPENPOLICY      , api_lsa_open_policy    },
 605         { "LSA_QUERYINFOPOLICY" , LSA_QUERYINFOPOLICY , api_lsa_query_info     },
 606         { "LSA_ENUMTRUSTDOM"    , LSA_ENUMTRUSTDOM    , api_lsa_enum_trust_dom },
 607         { "LSA_CLOSE"           , LSA_CLOSE           , api_lsa_close          },
 608         { "LSA_OPENSECRET"      , LSA_OPENSECRET      , api_lsa_open_secret    },
 609         { "LSA_LOOKUPSIDS"      , LSA_LOOKUPSIDS      , api_lsa_lookup_sids    },
 610         { "LSA_LOOKUPNAMES"     , LSA_LOOKUPNAMES     , api_lsa_lookup_names   },
 611         { NULL                  , 0                   , NULL                   }
 612 };
 613
 614 /***************************************************************************
 615  api_ntLsarpcTNP
 616  ***************************************************************************/
 617 BOOL api_ntlsa_rpc(pipes_struct *p, prs_struct *data)
 618 {
 619         return api_rpcTNP(p, "api_ntlsa_rpc", api_lsa_cmds, data);
 620 }