source3/rpc_client/cli_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4    Copyright (C) Tim Potter                        2000-2001,
   5    Copyright (C) Andrew Tridgell              1992-1997,2000,
   6    Copyright (C) Rafal Szczesniak                       2002
   7    Copyright (C) Jeremy Allison                         2005.
   8    Copyright (C) Michael Adam                           2007.
   9    Copyright (C) Guenther Deschner                      2008.
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "rpc_client/rpc_client.h"
  27 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  28 #include "rpc_client/cli_lsarpc.h"
  29 #include "rpc_client/init_lsa.h"
  30 #include "../libcli/security/security.h"
  31
  32 /** @defgroup lsa LSA - Local Security Architecture
  33  *  @ingroup rpc_client
  34  *
  35  * @{
  36  **/
  37
  38 /**
  39  * @file cli_lsarpc.c
  40  *
  41  * RPC client routines for the LSA RPC pipe.  LSA means "local
  42  * security authority", which is half of a password database.
  43  **/
  44
  45 NTSTATUS dcerpc_lsa_open_policy(struct dcerpc_binding_handle *h,
  46                                 TALLOC_CTX *mem_ctx,
  47                                 bool sec_qos,
  48                                 uint32_t des_access,
  49                                 struct policy_handle *pol,
  50                                 NTSTATUS *result)
  51 {
  52         struct lsa_ObjectAttribute attr;
  53         struct lsa_QosInfo qos;
  54         uint16_t system_name = '\\';
  55
  56         ZERO_STRUCT(attr);
  57
  58         attr.len        = 0x18;
  59
  60         if (sec_qos) {
  61                 qos.len                 = 0xc;
  62                 qos.impersonation_level = 2;
  63                 qos.context_mode        = 1;
  64                 qos.effective_only      = 0;
  65
  66                 attr.sec_qos            = &qos;
  67         }
  68
  69         return dcerpc_lsa_OpenPolicy(h,
  70                                      mem_ctx,
  71                                      &system_name,
  72                                      &attr,
  73                                      des_access,
  74                                      pol,
  75                                      result);
  76 }
  77
  78 /** Open a LSA policy handle
  79  *
  80  * @param cli Handle on an initialised SMB connection */
  81
  82 NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
  83                                 TALLOC_CTX *mem_ctx,
  84                                 bool sec_qos, uint32_t des_access,
  85                                 struct policy_handle *pol)
  86 {
  87         NTSTATUS status;
  88         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  89
  90         status = dcerpc_lsa_open_policy(cli->binding_handle,
  91                                         mem_ctx,
  92                                         sec_qos,
  93                                         des_access,
  94                                         pol,
  95                                         &result);
  96         if (!NT_STATUS_IS_OK(status)) {
  97                 return status;
  98         }
  99
 100         return result;
 101 }
 102
 103 NTSTATUS dcerpc_lsa_open_policy2(struct dcerpc_binding_handle *h,
 104                                  TALLOC_CTX *mem_ctx,
 105                                  const char *srv_name_slash,
 106                                  bool sec_qos,
 107                                  uint32_t des_access,
 108                                  struct policy_handle *pol,
 109                                  NTSTATUS *result)
 110 {
 111         struct lsa_ObjectAttribute attr;
 112         struct lsa_QosInfo qos;
 113
 114         ZERO_STRUCT(attr);
 115
 116         attr.len        = 0x18;
 117
 118         if (sec_qos) {
 119                 qos.len                 = 0xc;
 120                 qos.impersonation_level = 2;
 121                 qos.context_mode        = 1;
 122                 qos.effective_only      = 0;
 123
 124                 attr.sec_qos            = &qos;
 125         }
 126
 127         return dcerpc_lsa_OpenPolicy2(h,
 128                                       mem_ctx,
 129                                       srv_name_slash,
 130                                       &attr,
 131                                       des_access,
 132                                       pol,
 133                                       result);
 134 }
 135
 136 /** Open a LSA policy handle
 137   *
 138   * @param cli Handle on an initialised SMB connection
 139   */
 140
 141 NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
 142                                  TALLOC_CTX *mem_ctx, bool sec_qos,
 143                                  uint32_t des_access, struct policy_handle *pol)
 144 {
 145         NTSTATUS status;
 146         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 147
 148         status = dcerpc_lsa_open_policy2(cli->binding_handle,
 149                                          mem_ctx,
 150                                          cli->srv_name_slash,
 151                                          sec_qos,
 152                                          des_access,
 153                                          pol,
 154                                          &result);
 155         if (!NT_STATUS_IS_OK(status)) {
 156                 return status;
 157         }
 158
 159         return result;
 160 }
 161
 162 /* Lookup a list of sids
 163  *
 164  * internal version withOUT memory allocation of the target arrays.
 165  * this assumes sufficiently sized arrays to store domains, names and types. */
 166
 167 static NTSTATUS dcerpc_lsa_lookup_sids_noalloc(struct dcerpc_binding_handle *h,
 168                                                TALLOC_CTX *mem_ctx,
 169                                                TALLOC_CTX *domains_ctx,
 170                                                TALLOC_CTX *names_ctx,
 171                                                struct policy_handle *pol,
 172                                                int num_sids,
 173                                                const struct dom_sid *sids,
 174                                                char **domains,
 175                                                char **names,
 176                                                enum lsa_SidType *types,
 177                                                bool use_lookupsids3,
 178                                                NTSTATUS *presult)
 179 {
 180         NTSTATUS status = NT_STATUS_OK;
 181         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 182         struct lsa_SidArray sid_array;
 183         struct lsa_RefDomainList *ref_domains = NULL;
 184         struct lsa_TransNameArray lsa_names;
 185         enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
 186         uint32_t count = 0;
 187         int i;
 188
 189         ZERO_STRUCT(lsa_names);
 190
 191         sid_array.num_sids = num_sids;
 192         sid_array.sids = talloc_array(mem_ctx, struct lsa_SidPtr, num_sids);
 193         if (sid_array.sids == NULL) {
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196
 197         for (i = 0; i<num_sids; i++) {
 198                 sid_array.sids[i].sid = dom_sid_dup(mem_ctx, &sids[i]);
 199                 if (!sid_array.sids[i].sid) {
 200                         return NT_STATUS_NO_MEMORY;
 201                 }
 202         }
 203
 204         if (use_lookupsids3) {
 205                 struct lsa_TransNameArray2 lsa_names2;
 206                 uint32_t n;
 207
 208                 ZERO_STRUCT(lsa_names2);
 209
 210                 status = dcerpc_lsa_LookupSids3(h,
 211                                                 mem_ctx,
 212                                                 &sid_array,
 213                                                 &ref_domains,
 214                                                 &lsa_names2,
 215                                                 level,
 216                                                 &count,
 217                                                 LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
 218                                                 LSA_CLIENT_REVISION_2,
 219                                                 &result);
 220                 if (!NT_STATUS_IS_OK(status)) {
 221                         return status;
 222                 }
 223
 224                 if(!NT_STATUS_IS_ERR(result)) {
 225                         lsa_names.count = lsa_names2.count;
 226                         lsa_names.names = talloc_array(mem_ctx,
 227                                                        struct lsa_TranslatedName,
 228                                                        lsa_names.count);
 229                         if (lsa_names.names == NULL) {
 230                                 return NT_STATUS_NO_MEMORY;
 231                         }
 232                         for (n=0; n < lsa_names.count; n++) {
 233                                 lsa_names.names[n].sid_type     = lsa_names2.names[n].sid_type;
 234                                 lsa_names.names[n].name         = lsa_names2.names[n].name;
 235                                 lsa_names.names[n].sid_index    = lsa_names2.names[n].sid_index;
 236                         }
 237                 }
 238
 239         } else {
 240                 status = dcerpc_lsa_LookupSids(h,
 241                                                mem_ctx,
 242                                                pol,
 243                                                &sid_array,
 244                                                &ref_domains,
 245                                                &lsa_names,
 246                                                level,
 247                                                &count,
 248                                                &result);
 249         }
 250
 251         DEBUG(10, ("LSA_LOOKUPSIDS returned status: '%s', result: '%s', "
 252                    "mapped count = %d'\n",
 253                    nt_errstr(status), nt_errstr(result), count));
 254
 255         if (!NT_STATUS_IS_OK(status)) {
 256                 return status;
 257         }
 258
 259         if (!NT_STATUS_IS_OK(result) &&
 260             !NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
 261             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
 262         {
 263                 *presult = result;
 264                 return status;
 265         }
 266
 267         /* Return output parameters */
 268         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) ||
 269             (count == 0))
 270         {
 271                 for (i = 0; i < num_sids; i++) {
 272                         (names)[i] = NULL;
 273                         (domains)[i] = NULL;
 274                         (types)[i] = SID_NAME_UNKNOWN;
 275                 }
 276                 *presult = NT_STATUS_NONE_MAPPED;
 277                 return status;
 278         }
 279
 280         for (i = 0; i < num_sids; i++) {
 281                 const char *name, *dom_name;
 282                 uint32_t dom_idx;
 283
 284                 if (i >= lsa_names.count) {
 285                         *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
 286                         return status;
 287                 }
 288
 289                 dom_idx = lsa_names.names[i].sid_index;
 290
 291                 /* Translate optimised name through domain index array */
 292
 293                 if (dom_idx != 0xffffffff) {
 294                         if (ref_domains == NULL) {
 295                                 *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
 296                                 return status;
 297                         }
 298                         if (dom_idx >= ref_domains->count) {
 299                                 *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
 300                                 return status;
 301                         }
 302
 303                         dom_name = ref_domains->domains[dom_idx].name.string;
 304                         name = lsa_names.names[i].name.string;
 305
 306                         if (name) {
 307                                 (names)[i] = talloc_strdup(names_ctx, name);
 308                                 if ((names)[i] == NULL) {
 309                                         DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
 310                                         *presult = NT_STATUS_UNSUCCESSFUL;
 311                                         return status;
 312                                 }
 313                         } else {
 314                                 (names)[i] = NULL;
 315                         }
 316                         domains[i] = talloc_strdup(domains_ctx,
 317                                                    dom_name ? dom_name : "");
 318                         (types)[i] = lsa_names.names[i].sid_type;
 319                         if ((domains)[i] == NULL) {
 320                                 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
 321                                 *presult = NT_STATUS_UNSUCCESSFUL;
 322                                 return status;
 323                         }
 324
 325                 } else {
 326                         (names)[i] = NULL;
 327                         (domains)[i] = NULL;
 328                         (types)[i] = SID_NAME_UNKNOWN;
 329                 }
 330         }
 331
 332         *presult = NT_STATUS_OK;
 333         return status;
 334 }
 335
 336 /* Lookup a list of sids
 337  *
 338  * do it the right way: there is a limit (of 20480 for w2k3) entries
 339  * returned by this call. when the sids list contains more entries,
 340  * empty lists are returned. This version of lsa_lookup_sids passes
 341  * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
 342
 343 /* This constant defines the limit of how many sids to look up
 344  * in one call (maximum). the limit from the server side is
 345  * at 20480 for win2k3, but we keep it at a save 1000 for now. */
 346 #define LOOKUP_SIDS_HUNK_SIZE 1000
 347
 348 NTSTATUS dcerpc_lsa_lookup_sids_generic(struct dcerpc_binding_handle *h,
 349                                         TALLOC_CTX *mem_ctx,
 350                                         struct policy_handle *pol,
 351                                         int num_sids,
 352                                         const struct dom_sid *sids,
 353                                         char ***pdomains,
 354                                         char ***pnames,
 355                                         enum lsa_SidType **ptypes,
 356                                         bool use_lookupsids3,
 357                                         NTSTATUS *presult)
 358 {
 359         NTSTATUS status = NT_STATUS_OK;
 360         NTSTATUS result = NT_STATUS_OK;
 361         int sids_left = 0;
 362         int sids_processed = 0;
 363         const struct dom_sid *hunk_sids = sids;
 364         char **hunk_domains;
 365         char **hunk_names;
 366         enum lsa_SidType *hunk_types;
 367         char **domains = NULL;
 368         char **names = NULL;
 369         enum lsa_SidType *types = NULL;
 370         bool have_mapped = false;
 371         bool have_unmapped = false;
 372
 373         if (num_sids) {
 374                 if (!(domains = talloc_array(mem_ctx, char *, num_sids))) {
 375                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 376                         status = NT_STATUS_NO_MEMORY;
 377                         goto fail;
 378                 }
 379
 380                 if (!(names = talloc_array(mem_ctx, char *, num_sids))) {
 381                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 382                         status = NT_STATUS_NO_MEMORY;
 383                         goto fail;
 384                 }
 385
 386                 if (!(types = talloc_array(mem_ctx, enum lsa_SidType, num_sids))) {
 387                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 388                         status = NT_STATUS_NO_MEMORY;
 389                         goto fail;
 390                 }
 391         }
 392
 393         sids_left = num_sids;
 394         hunk_domains = domains;
 395         hunk_names = names;
 396         hunk_types = types;
 397
 398         while (sids_left > 0) {
 399                 int hunk_num_sids;
 400                 NTSTATUS hunk_result = NT_STATUS_UNSUCCESSFUL;
 401
 402                 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
 403                                 ? LOOKUP_SIDS_HUNK_SIZE
 404                                 : sids_left);
 405
 406                 DEBUG(10, ("rpccli_lsa_lookup_sids: processing items "
 407                            "%d -- %d of %d.\n",
 408                            sids_processed,
 409                            sids_processed + hunk_num_sids - 1,
 410                            num_sids));
 411
 412                 status = dcerpc_lsa_lookup_sids_noalloc(h,
 413                                                         mem_ctx,
 414                                                         (TALLOC_CTX *)domains,
 415                                                         (TALLOC_CTX *)names,
 416                                                         pol,
 417                                                         hunk_num_sids,
 418                                                         hunk_sids,
 419                                                         hunk_domains,
 420                                                         hunk_names,
 421                                                         hunk_types,
 422                                                         use_lookupsids3,
 423                                                         &hunk_result);
 424                 if (!NT_STATUS_IS_OK(status)) {
 425                         goto fail;
 426                 }
 427
 428                 if (!NT_STATUS_IS_OK(hunk_result) &&
 429                     !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
 430                     !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED))
 431                 {
 432                         /* An actual error occured */
 433                         *presult = hunk_result;
 434                         goto fail;
 435                 }
 436
 437                 if (NT_STATUS_IS_OK(hunk_result)) {
 438                         have_mapped = true;
 439                 }
 440                 if (NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)) {
 441                         have_unmapped = true;
 442                 }
 443                 if (NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED)) {
 444                         int i;
 445                         for (i=0; i<hunk_num_sids; i++) {
 446                                 if (hunk_types[i] == SID_NAME_UNKNOWN) {
 447                                         have_unmapped = true;
 448                                 } else {
 449                                         have_mapped = true;
 450                                 }
 451                         }
 452                 }
 453
 454                 sids_left -= hunk_num_sids;
 455                 sids_processed += hunk_num_sids;
 456                 hunk_sids += hunk_num_sids;
 457                 hunk_domains += hunk_num_sids;
 458                 hunk_names += hunk_num_sids;
 459                 hunk_types += hunk_num_sids;
 460         }
 461
 462         *pdomains = domains;
 463         *pnames = names;
 464         *ptypes = types;
 465
 466         if (!have_mapped) {
 467                 result = NT_STATUS_NONE_MAPPED;
 468         }
 469         if (have_unmapped) {
 470                 result = STATUS_SOME_UNMAPPED;
 471         }
 472         *presult = result;
 473
 474         return status;
 475
 476 fail:
 477         TALLOC_FREE(domains);
 478         TALLOC_FREE(names);
 479         TALLOC_FREE(types);
 480
 481         return status;
 482 }
 483
 484 NTSTATUS dcerpc_lsa_lookup_sids(struct dcerpc_binding_handle *h,
 485                                 TALLOC_CTX *mem_ctx,
 486                                 struct policy_handle *pol,
 487                                 int num_sids,
 488                                 const struct dom_sid *sids,
 489                                 char ***pdomains,
 490                                 char ***pnames,
 491                                 enum lsa_SidType **ptypes,
 492                                 NTSTATUS *result)
 493 {
 494         return dcerpc_lsa_lookup_sids_generic(h,
 495                                               mem_ctx,
 496                                               pol,
 497                                               num_sids,
 498                                               sids,
 499                                               pdomains,
 500                                               pnames,
 501                                               ptypes,
 502                                               false,
 503                                               result);
 504 }
 505
 506 NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
 507                                 TALLOC_CTX *mem_ctx,
 508                                 struct policy_handle *pol,
 509                                 int num_sids,
 510                                 const struct dom_sid *sids,
 511                                 char ***pdomains,
 512                                 char ***pnames,
 513                                 enum lsa_SidType **ptypes)
 514 {
 515         NTSTATUS status;
 516         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 517
 518         status = dcerpc_lsa_lookup_sids_generic(cli->binding_handle,
 519                                                 mem_ctx,
 520                                                 pol,
 521                                                 num_sids,
 522                                                 sids,
 523                                                 pdomains,
 524                                                 pnames,
 525                                                 ptypes,
 526                                                 false,
 527                                                 &result);
 528         if (!NT_STATUS_IS_OK(status)) {
 529                 return status;
 530         }
 531
 532         return result;
 533 }
 534
 535 NTSTATUS dcerpc_lsa_lookup_sids3(struct dcerpc_binding_handle *h,
 536                                  TALLOC_CTX *mem_ctx,
 537                                  struct policy_handle *pol,
 538                                  int num_sids,
 539                                  const struct dom_sid *sids,
 540                                  char ***pdomains,
 541                                  char ***pnames,
 542                                  enum lsa_SidType **ptypes,
 543                                  NTSTATUS *result)
 544 {
 545         return dcerpc_lsa_lookup_sids_generic(h,
 546                                               mem_ctx,
 547                                               pol,
 548                                               num_sids,
 549                                               sids,
 550                                               pdomains,
 551                                               pnames,
 552                                               ptypes,
 553                                               true,
 554                                               result);
 555 }
 556
 557 /** Lookup a list of names */
 558
 559 NTSTATUS dcerpc_lsa_lookup_names_generic(struct dcerpc_binding_handle *h,
 560                                          TALLOC_CTX *mem_ctx,
 561                                          struct policy_handle *pol,
 562                                          uint32_t num_names,
 563                                          const char **names,
 564                                          const char ***dom_names,
 565                                          enum lsa_LookupNamesLevel level,
 566                                          struct dom_sid **sids,
 567                                          enum lsa_SidType **types,
 568                                          bool use_lookupnames4,
 569                                          NTSTATUS *presult)
 570 {
 571         NTSTATUS status;
 572         struct lsa_String *lsa_names = NULL;
 573         struct lsa_RefDomainList *domains = NULL;
 574         struct lsa_TransSidArray sid_array;
 575         struct lsa_TransSidArray3 sid_array3;
 576         uint32_t count = 0;
 577         uint32_t i;
 578
 579         ZERO_STRUCT(sid_array);
 580         ZERO_STRUCT(sid_array3);
 581
 582         lsa_names = talloc_array(mem_ctx, struct lsa_String, num_names);
 583         if (lsa_names == NULL) {
 584                 return NT_STATUS_NO_MEMORY;
 585         }
 586
 587         for (i = 0; i < num_names; i++) {
 588                 init_lsa_String(&lsa_names[i], names[i]);
 589         }
 590
 591         if (use_lookupnames4) {
 592                 status = dcerpc_lsa_LookupNames4(h,
 593                                                  mem_ctx,
 594                                                  num_names,
 595                                                  lsa_names,
 596                                                  &domains,
 597                                                  &sid_array3,
 598                                                  level,
 599                                                  &count,
 600                                                  LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
 601                                                  LSA_CLIENT_REVISION_2,
 602                                                  presult);
 603         } else {
 604                 status = dcerpc_lsa_LookupNames(h,
 605                                                 mem_ctx,
 606                                                 pol,
 607                                                 num_names,
 608                                                 lsa_names,
 609                                                 &domains,
 610                                                 &sid_array,
 611                                                 level,
 612                                                 &count,
 613                                                 presult);
 614         }
 615         if (!NT_STATUS_IS_OK(status)) {
 616                 goto done;
 617         }
 618
 619         if (!NT_STATUS_IS_OK(*presult) &&
 620             !NT_STATUS_EQUAL(*presult, STATUS_SOME_UNMAPPED)) {
 621                 /* An actual error occured */
 622                 goto done;
 623         }
 624
 625         /* Return output parameters */
 626         if (count == 0) {
 627                 *presult = NT_STATUS_NONE_MAPPED;
 628                 goto done;
 629         }
 630
 631         if (num_names) {
 632                 if (!((*sids = talloc_array(mem_ctx, struct dom_sid, num_names)))) {
 633                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 634                         *presult = NT_STATUS_NO_MEMORY;
 635                         goto done;
 636                 }
 637
 638                 if (!((*types = talloc_array(mem_ctx, enum lsa_SidType, num_names)))) {
 639                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 640                         *presult = NT_STATUS_NO_MEMORY;
 641                         goto done;
 642                 }
 643
 644                 if (dom_names != NULL) {
 645                         *dom_names = talloc_array(mem_ctx, const char *, num_names);
 646                         if (*dom_names == NULL) {
 647                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 648                                 *presult = NT_STATUS_NO_MEMORY;
 649                                 goto done;
 650                         }
 651                 }
 652         } else {
 653                 *sids = NULL;
 654                 *types = NULL;
 655                 if (dom_names != NULL) {
 656                         *dom_names = NULL;
 657                 }
 658         }
 659
 660         for (i = 0; i < num_names; i++) {
 661                 uint32_t dom_idx;
 662                 struct dom_sid *sid = &(*sids)[i];
 663
 664                 if (use_lookupnames4) {
 665                         if (i >= sid_array3.count) {
 666                                 *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
 667                                 goto done;
 668                         }
 669
 670                         dom_idx         = sid_array3.sids[i].sid_index;
 671                         (*types)[i]     = sid_array3.sids[i].sid_type;
 672                 } else {
 673                         if (i >= sid_array.count) {
 674                                 *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
 675                                 goto done;
 676                         }
 677
 678                         dom_idx         = sid_array.sids[i].sid_index;
 679                         (*types)[i]     = sid_array.sids[i].sid_type;
 680                 }
 681
 682                 /* Translate optimised sid through domain index array */
 683
 684                 if (dom_idx == 0xffffffff) {
 685                         /* Nothing to do, this is unknown */
 686                         ZERO_STRUCTP(sid);
 687                         (*types)[i] = SID_NAME_UNKNOWN;
 688                         continue;
 689                 }
 690                 if (domains == NULL) {
 691                         *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
 692                         goto done;
 693                 }
 694                 if (dom_idx >= domains->count) {
 695                         *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
 696                         goto done;
 697                 }
 698
 699                 if (use_lookupnames4) {
 700                         sid_copy(sid, sid_array3.sids[i].sid);
 701                 } else {
 702                         sid_copy(sid, domains->domains[dom_idx].sid);
 703
 704                         if (sid_array.sids[i].rid != 0xffffffff) {
 705                                 sid_append_rid(sid, sid_array.sids[i].rid);
 706                         }
 707                 }
 708
 709                 if (dom_names == NULL) {
 710                         continue;
 711                 }
 712
 713                 (*dom_names)[i] = domains->domains[dom_idx].name.string;
 714         }
 715
 716  done:
 717         return status;
 718 }
 719
 720 NTSTATUS dcerpc_lsa_lookup_names(struct dcerpc_binding_handle *h,
 721                                  TALLOC_CTX *mem_ctx,
 722                                  struct policy_handle *pol,
 723                                  uint32_t num_names,
 724                                  const char **names,
 725                                  const char ***dom_names,
 726                                  enum lsa_LookupNamesLevel level,
 727                                  struct dom_sid **sids,
 728                                  enum lsa_SidType **types,
 729                                  NTSTATUS *result)
 730 {
 731         return dcerpc_lsa_lookup_names_generic(h,
 732                                                mem_ctx,
 733                                                pol,
 734                                                num_names,
 735                                                names,
 736                                                dom_names,
 737                                                level,
 738                                                sids,
 739                                                types,
 740                                                false,
 741                                                result);
 742 }
 743
 744 NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
 745                                  TALLOC_CTX *mem_ctx,
 746                                  struct policy_handle *pol,
 747                                  int num_names,
 748                                  const char **names,
 749                                  const char ***dom_names,
 750                                  int level,
 751                                  struct dom_sid **sids,
 752                                  enum lsa_SidType **types)
 753 {
 754         NTSTATUS status;
 755         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 756
 757         status = dcerpc_lsa_lookup_names(cli->binding_handle,
 758                                          mem_ctx,
 759                                          pol,
 760                                          num_names,
 761                                          names,
 762                                          dom_names,
 763                                          level,
 764                                          sids,
 765                                          types,
 766                                          &result);
 767         if (!NT_STATUS_IS_OK(status)) {
 768                 return status;
 769         }
 770
 771         return result;
 772 }
 773
 774 NTSTATUS dcerpc_lsa_lookup_names4(struct dcerpc_binding_handle *h,
 775                                   TALLOC_CTX *mem_ctx,
 776                                   struct policy_handle *pol,
 777                                   uint32_t num_names,
 778                                   const char **names,
 779                                   const char ***dom_names,
 780                                   enum lsa_LookupNamesLevel level,
 781                                   struct dom_sid **sids,
 782                                   enum lsa_SidType **types,
 783                                   NTSTATUS *result)
 784 {
 785         return dcerpc_lsa_lookup_names_generic(h,
 786                                                mem_ctx,
 787                                                pol,
 788                                                num_names,
 789                                                names,
 790                                                dom_names,
 791                                                level,
 792                                                sids,
 793                                                types,
 794                                                true,
 795                                                result);
 796 }