source3/rpcclient/cmd_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4
   5    Copyright (C) Tim Potter              2000
   6    Copyright (C) Rafal Szczesniak        2002
   7    Copyright (C) Guenther Deschner       2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpcclient.h"
  25 #include "../libcli/auth/libcli_auth.h"
  26 #include "../librpc/gen_ndr/ndr_lsa.h"
  27 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  28 #include "rpc_client/cli_lsarpc.h"
  29 #include "rpc_client/init_lsa.h"
  30 #include "../libcli/security/security.h"
  31
  32 /* useful function to allow entering a name instead of a SID and
  33  * looking it up automatically */
  34 static NTSTATUS name_to_sid(struct rpc_pipe_client *cli,
  35                             TALLOC_CTX *mem_ctx,
  36                             struct dom_sid *sid, const char *name)
  37 {
  38         struct policy_handle pol;
  39         enum lsa_SidType *sid_types;
  40         NTSTATUS status, result;
  41         struct dom_sid *sids;
  42         struct dcerpc_binding_handle *b = cli->binding_handle;
  43
  44         /* maybe its a raw SID */
  45         if (strncmp(name, "S-", 2) == 0 &&
  46             string_to_sid(sid, name)) {
  47                 return NT_STATUS_OK;
  48         }
  49
  50         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
  51                                      SEC_FLAG_MAXIMUM_ALLOWED,
  52                                      &pol);
  53         if (!NT_STATUS_IS_OK(status))
  54                 goto done;
  55
  56         status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, NULL, 1, &sids, &sid_types);
  57         if (!NT_STATUS_IS_OK(status))
  58                 goto done;
  59
  60         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
  61
  62         *sid = sids[0];
  63
  64 done:
  65         return status;
  66 }
  67
  68 static void display_query_info_1(struct lsa_AuditLogInfo *r)
  69 {
  70         d_printf("percent_full:\t%d\n", r->percent_full);
  71         d_printf("maximum_log_size:\t%d\n", r->maximum_log_size);
  72         d_printf("retention_time:\t%lld\n", (long long)r->retention_time);
  73         d_printf("shutdown_in_progress:\t%d\n", r->shutdown_in_progress);
  74         d_printf("time_to_shutdown:\t%lld\n", (long long)r->time_to_shutdown);
  75         d_printf("next_audit_record:\t%d\n", r->next_audit_record);
  76 }
  77
  78 static void display_query_info_2(struct lsa_AuditEventsInfo *r)
  79 {
  80         int i;
  81         d_printf("Auditing enabled:\t%d\n", r->auditing_mode);
  82         d_printf("Auditing categories:\t%d\n", r->count);
  83         d_printf("Auditsettings:\n");
  84         for (i=0; i<r->count; i++) {
  85                 const char *val = audit_policy_str(talloc_tos(), r->settings[i]);
  86                 const char *policy = audit_description_str(i);
  87                 d_printf("%s:\t%s\n", policy, val);
  88         }
  89 }
  90
  91 static void display_query_info_3(struct lsa_DomainInfo *r)
  92 {
  93         struct dom_sid_buf buf;
  94         d_printf("Domain Name: %s\n", r->name.string);
  95         d_printf("Domain Sid: %s\n", dom_sid_str_buf(r->sid, &buf));
  96 }
  97
  98 static void display_query_info_5(struct lsa_DomainInfo *r)
  99 {
 100         struct dom_sid_buf buf;
 101         d_printf("Domain Name: %s\n", r->name.string);
 102         d_printf("Domain Sid: %s\n", dom_sid_str_buf(r->sid, &buf));
 103 }
 104
 105 static void display_query_info_10(struct lsa_AuditFullSetInfo *r)
 106 {
 107         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 108 }
 109
 110 static void display_query_info_11(struct lsa_AuditFullQueryInfo *r)
 111 {
 112         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 113         d_printf("Log is full: %d\n", r->log_is_full);
 114 }
 115
 116 static void display_query_info_12(struct lsa_DnsDomainInfo *r)
 117 {
 118         struct dom_sid_buf buf;
 119         d_printf("Domain NetBios Name: %s\n", r->name.string);
 120         d_printf("Domain DNS Name: %s\n", r->dns_domain.string);
 121         d_printf("Domain Forest Name: %s\n", r->dns_forest.string);
 122         d_printf("Domain Sid: %s\n", dom_sid_str_buf(r->sid, &buf));
 123         d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
 124                                                       &r->domain_guid));
 125 }
 126
 127 static void display_lsa_query_info(union lsa_PolicyInformation *info,
 128                                    enum lsa_PolicyInfo level)
 129 {
 130         switch (level) {
 131                 case 1:
 132                         display_query_info_1(&info->audit_log);
 133                         break;
 134                 case 2:
 135                         display_query_info_2(&info->audit_events);
 136                         break;
 137                 case 3:
 138                         display_query_info_3(&info->domain);
 139                         break;
 140                 case 5:
 141                         display_query_info_5(&info->account_domain);
 142                         break;
 143                 case 10:
 144                         display_query_info_10(&info->auditfullset);
 145                         break;
 146                 case 11:
 147                         display_query_info_11(&info->auditfullquery);
 148                         break;
 149                 case 12:
 150                         display_query_info_12(&info->dns);
 151                         break;
 152                 default:
 153                         printf("can't display info level: %d\n", level);
 154                         break;
 155         }
 156 }
 157
 158 static NTSTATUS cmd_lsa_query_info_policy(struct rpc_pipe_client *cli,
 159                                           TALLOC_CTX *mem_ctx, int argc,
 160                                           const char **argv)
 161 {
 162         struct policy_handle pol;
 163         NTSTATUS status, result;
 164         union lsa_PolicyInformation *info = NULL;
 165         struct dcerpc_binding_handle *b = cli->binding_handle;
 166
 167         uint32_t info_class = 3;
 168
 169         if (argc > 2) {
 170                 printf("Usage: %s [info_class]\n", argv[0]);
 171                 return NT_STATUS_OK;
 172         }
 173
 174         if (argc == 2)
 175                 info_class = atoi(argv[1]);
 176
 177         switch (info_class) {
 178         case 12:
 179                 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 180                                                  SEC_FLAG_MAXIMUM_ALLOWED,
 181                                                  &pol);
 182
 183                 if (!NT_STATUS_IS_OK(status))
 184                         goto done;
 185
 186                 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
 187                                                      &pol,
 188                                                      info_class,
 189                                                      &info,
 190                                                      &result);
 191                 break;
 192         default:
 193                 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 194                                                 SEC_FLAG_MAXIMUM_ALLOWED,
 195                                                 &pol);
 196
 197                 if (!NT_STATUS_IS_OK(status))
 198                         goto done;
 199
 200                 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
 201                                                     &pol,
 202                                                     info_class,
 203                                                     &info,
 204                                                     &result);
 205         }
 206
 207         if (!NT_STATUS_IS_OK(status)) {
 208                 goto done;
 209         }
 210         status = result;
 211         if (NT_STATUS_IS_OK(result)) {
 212                 display_lsa_query_info(info, info_class);
 213         }
 214
 215         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 216
 217  done:
 218         return status;
 219 }
 220
 221 /* Resolve a list of names to a list of sids */
 222
 223 static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
 224                                      TALLOC_CTX *mem_ctx, int argc,
 225                                      const char **argv)
 226 {
 227         struct policy_handle pol;
 228         NTSTATUS status, result;
 229         struct dom_sid *sids;
 230         enum lsa_SidType *types;
 231         int i;
 232         struct dcerpc_binding_handle *b = cli->binding_handle;
 233
 234         if (argc == 1) {
 235                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 236                 return NT_STATUS_OK;
 237         }
 238
 239         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 240                                      SEC_FLAG_MAXIMUM_ALLOWED,
 241                                      &pol);
 242
 243         if (!NT_STATUS_IS_OK(status))
 244                 goto done;
 245
 246         status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
 247                                       (const char**)(argv + 1), NULL, 1, &sids, &types);
 248
 249         if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
 250             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 251                 goto done;
 252
 253         status = NT_STATUS_OK;
 254
 255         /* Print results */
 256
 257         for (i = 0; i < (argc - 1); i++) {
 258                 struct dom_sid_buf sid_str;
 259                 printf("%s %s (%s: %d)\n",
 260                        argv[i + 1],
 261                        dom_sid_str_buf(&sids[i], &sid_str),
 262                        sid_type_lookup(types[i]),
 263                        types[i]);
 264         }
 265
 266         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 267
 268  done:
 269         return status;
 270 }
 271
 272 /* Resolve a list of names to a list of sids */
 273
 274 static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
 275                                            TALLOC_CTX *mem_ctx, int argc,
 276                                            const char **argv)
 277 {
 278         struct policy_handle pol;
 279         NTSTATUS status, result;
 280         struct dom_sid *sids = NULL;
 281         enum lsa_SidType *types = NULL;
 282         int i, level;
 283         struct dcerpc_binding_handle *b = cli->binding_handle;
 284
 285         if (argc < 3) {
 286                 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv[0]);
 287                 return NT_STATUS_OK;
 288         }
 289
 290         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 291                                      SEC_FLAG_MAXIMUM_ALLOWED,
 292                                      &pol);
 293         if (!NT_STATUS_IS_OK(status)) {
 294                 goto done;
 295         }
 296
 297         level = atoi(argv[1]);
 298
 299         status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 2,
 300                                       (const char**)(argv + 2), NULL, level, &sids, &types);
 301
 302         if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
 303             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 304         {
 305                 goto done;
 306         }
 307
 308         status = NT_STATUS_OK;
 309
 310         /* Print results */
 311
 312         for (i = 0; i < (argc - 2); i++) {
 313                 struct dom_sid_buf sid_str;
 314                 printf("%s %s (%s: %d)\n",
 315                        argv[i + 2],
 316                        dom_sid_str_buf(&sids[i], &sid_str),
 317                        sid_type_lookup(types[i]),
 318                        types[i]);
 319         }
 320
 321         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 322
 323  done:
 324         return status;
 325 }
 326
 327 static NTSTATUS cmd_lsa_lookup_names4(struct rpc_pipe_client *cli,
 328                                       TALLOC_CTX *mem_ctx, int argc,
 329                                       const char **argv)
 330 {
 331         NTSTATUS status, result;
 332
 333         uint32_t num_names;
 334         struct lsa_String *names;
 335         struct lsa_RefDomainList *domains = NULL;
 336         struct lsa_TransSidArray3 sids;
 337         uint32_t count = 0;
 338         int i;
 339         struct dcerpc_binding_handle *b = cli->binding_handle;
 340
 341         if (argc == 1) {
 342                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 343                 return NT_STATUS_OK;
 344         }
 345
 346         ZERO_STRUCT(sids);
 347
 348         num_names = argc-1;
 349         names = talloc_array(mem_ctx, struct lsa_String, num_names);
 350         NT_STATUS_HAVE_NO_MEMORY(names);
 351
 352         for (i=0; i < num_names; i++) {
 353                 init_lsa_String(&names[i], argv[i+1]);
 354         }
 355
 356         status = dcerpc_lsa_LookupNames4(b, mem_ctx,
 357                                          num_names,
 358                                          names,
 359                                          &domains,
 360                                          &sids,
 361                                          1,
 362                                          &count,
 363                                          0,
 364                                          0,
 365                                          &result);
 366         if (!NT_STATUS_IS_OK(status)) {
 367                 return status;
 368         }
 369         if (!NT_STATUS_IS_OK(result)) {
 370                 return result;
 371         }
 372
 373         if (sids.count != num_names) {
 374                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 375         }
 376
 377         for (i = 0; i < sids.count; i++) {
 378                 struct dom_sid_buf sid_str;
 379                 printf("%s %s (%s: %d)\n",
 380                        argv[i+1],
 381                        dom_sid_str_buf(sids.sids[i].sid, &sid_str),
 382                        sid_type_lookup(sids.sids[i].sid_type),
 383                        sids.sids[i].sid_type);
 384         }
 385
 386         return status;
 387 }
 388
 389 /* Resolve a list of SIDs to a list of names */
 390
 391 static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 392                                     int argc, const char **argv)
 393 {
 394         struct policy_handle pol;
 395         NTSTATUS status, result;
 396         struct dom_sid *sids;
 397         char **domains;
 398         char **names;
 399         enum lsa_SidType *types;
 400         int i;
 401         struct dcerpc_binding_handle *b = cli->binding_handle;
 402
 403         if (argc == 1) {
 404                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 405                 return NT_STATUS_OK;
 406         }
 407
 408         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 409                                      SEC_FLAG_MAXIMUM_ALLOWED,
 410                                      &pol);
 411
 412         if (!NT_STATUS_IS_OK(status))
 413                 goto done;
 414
 415         /* Convert arguments to sids */
 416
 417         sids = talloc_array(mem_ctx, struct dom_sid, argc - 1);
 418
 419         if (!sids) {
 420                 printf("could not allocate memory for %d sids\n", argc - 1);
 421                 goto done;
 422         }
 423
 424         for (i = 0; i < argc - 1; i++)
 425                 if (!string_to_sid(&sids[i], argv[i + 1])) {
 426                         status = NT_STATUS_INVALID_SID;
 427                         goto done;
 428                 }
 429
 430         /* Lookup the SIDs */
 431
 432         status = rpccli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
 433                                      &domains, &names, &types);
 434
 435         if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
 436             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 437                 goto done;
 438
 439         status = NT_STATUS_OK;
 440
 441         /* Print results */
 442
 443         for (i = 0; i < (argc - 1); i++) {
 444                 struct dom_sid_buf sid_str;
 445
 446                 dom_sid_str_buf(&sids[i], &sid_str);
 447                 if (types[i] == SID_NAME_DOMAIN) {
 448                         printf("%s %s (%d)\n", sid_str.buf,
 449                                domains[i] ? domains[i] : "*unknown*",
 450                                types[i]);
 451                 } else {
 452                         printf("%s %s\\%s (%d)\n", sid_str.buf,
 453                                domains[i] ? domains[i] : "*unknown*",
 454                                names[i] ? names[i] : "*unknown*",
 455                                types[i]);
 456                 }
 457         }
 458
 459         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 460
 461  done:
 462         return status;
 463 }
 464
 465 static NTSTATUS cmd_lsa_lookup_sids_level(struct rpc_pipe_client *cli,
 466                                           TALLOC_CTX *mem_ctx, int argc,
 467                                           const char **argv)
 468 {
 469         struct policy_handle pol;
 470         NTSTATUS status, result;
 471         struct dom_sid *sids = NULL;
 472         char **domains = NULL;
 473         char **names = NULL;
 474         enum lsa_SidType *types = NULL;
 475         int i, level;
 476         struct dcerpc_binding_handle *b = cli->binding_handle;
 477
 478         if (argc < 3) {
 479                 printf("Usage: %s [level] [sid1 [sid2 [...]]]\n", argv[0]);
 480                 return NT_STATUS_OK;
 481         }
 482
 483         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 484                                      SEC_FLAG_MAXIMUM_ALLOWED,
 485                                      &pol);
 486         if (!NT_STATUS_IS_OK(status)) {
 487                 goto done;
 488         }
 489
 490         level = atoi(argv[1]);
 491
 492         /* Convert arguments to sids */
 493
 494         sids = talloc_array(mem_ctx, struct dom_sid, argc - 2);
 495         if (sids == NULL) {
 496                 printf("could not allocate memory for %d sids\n", argc - 2);
 497                 goto done;
 498         }
 499
 500         for (i = 0; i < argc - 2; i++) {
 501                 if (!string_to_sid(&sids[i], argv[i + 2])) {
 502                         status = NT_STATUS_INVALID_SID;
 503                         goto done;
 504                 }
 505         }
 506
 507         /* Lookup the SIDs */
 508
 509         status = dcerpc_lsa_lookup_sids_generic(cli->binding_handle,
 510                                                 mem_ctx,
 511                                                 &pol,
 512                                                 argc - 2,
 513                                                 sids,
 514                                                 level,
 515                                                 &domains,
 516                                                 &names,
 517                                                 &types,
 518                                                 false,
 519                                                 &result);
 520         if (!NT_STATUS_IS_OK(status)) {
 521                 goto done;
 522         }
 523         status = result;
 524
 525         if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
 526             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 527         {
 528                 goto done;
 529         }
 530
 531         status = NT_STATUS_OK;
 532
 533         /* Print results */
 534
 535         for (i = 0; i < (argc - 2); i++) {
 536                 struct dom_sid_buf sid_str;
 537
 538                 dom_sid_str_buf(&sids[i], &sid_str);
 539                 if (types[i] == SID_NAME_DOMAIN) {
 540                         printf("%s %s (%d)\n", sid_str.buf,
 541                                domains[i] ? domains[i] : "*unknown*",
 542                                types[i]);
 543                 } else {
 544                         printf("%s %s\\%s (%d)\n", sid_str.buf,
 545                                domains[i] ? domains[i] : "*unknown*",
 546                                names[i] ? names[i] : "*unknown*",
 547                                types[i]);
 548                 }
 549         }
 550
 551         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 552
 553  done:
 554         return status;
 555 }
 556
 557 /* Resolve a list of SIDs to a list of names */
 558
 559 static NTSTATUS cmd_lsa_lookup_sids3(struct rpc_pipe_client *cli,
 560                                      TALLOC_CTX *mem_ctx,
 561                                      int argc, const char **argv)
 562 {
 563         NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
 564         int i;
 565         struct lsa_SidArray sids;
 566         struct lsa_RefDomainList *domains = NULL;
 567         struct lsa_TransNameArray2 names;
 568         uint32_t count = 0;
 569         struct dcerpc_binding_handle *b = cli->binding_handle;
 570
 571         if (argc == 1) {
 572                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 573                 return NT_STATUS_OK;
 574         }
 575
 576         ZERO_STRUCT(names);
 577
 578         /* Convert arguments to sids */
 579
 580         sids.num_sids = argc-1;
 581         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
 582         if (!sids.sids) {
 583                 printf("could not allocate memory for %d sids\n", sids.num_sids);
 584                 goto done;
 585         }
 586
 587         for (i = 0; i < sids.num_sids; i++) {
 588                 sids.sids[i].sid = talloc(sids.sids, struct dom_sid);
 589                 if (sids.sids[i].sid == NULL) {
 590                         status = NT_STATUS_NO_MEMORY;
 591                         goto done;
 592                 }
 593                 if (!string_to_sid(sids.sids[i].sid, argv[i+1])) {
 594                         status = NT_STATUS_INVALID_SID;
 595                         goto done;
 596                 }
 597         }
 598
 599         /* Lookup the SIDs */
 600         status = dcerpc_lsa_LookupSids3(b, mem_ctx,
 601                                         &sids,
 602                                         &domains,
 603                                         &names,
 604                                         1,
 605                                         &count,
 606                                         0,
 607                                         0,
 608                                         &result);
 609         if (!NT_STATUS_IS_OK(status)) {
 610                 goto done;
 611         }
 612         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 613             NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
 614                 status = result;
 615                 goto done;
 616         }
 617
 618         status = NT_STATUS_OK;
 619
 620         /* Print results */
 621
 622         for (i = 0; i < names.count; i++) {
 623                 struct dom_sid_buf sid_str;
 624
 625                 if (i >= sids.num_sids) {
 626                         break;
 627                 }
 628                 printf("%s %s (%d)\n",
 629                        dom_sid_str_buf(sids.sids[i].sid, &sid_str),
 630                        names.names[i].name.string,
 631                        names.names[i].sid_type);
 632         }
 633
 634  done:
 635         return status;
 636 }
 637
 638
 639 /* Enumerate list of trusted domains */
 640
 641 static NTSTATUS cmd_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
 642                                        TALLOC_CTX *mem_ctx, int argc,
 643                                        const char **argv)
 644 {
 645         struct policy_handle pol;
 646         NTSTATUS status, result;
 647         struct lsa_DomainList domain_list;
 648         struct dcerpc_binding_handle *b = cli->binding_handle;
 649
 650         /* defaults, but may be changed using params */
 651         uint32_t enum_ctx = 0;
 652         int i;
 653         uint32_t max_size = (uint32_t)-1;
 654
 655         if (argc > 2) {
 656                 printf("Usage: %s [enum context (0)]\n", argv[0]);
 657                 return NT_STATUS_OK;
 658         }
 659
 660         if (argc == 2 && argv[1]) {
 661                 enum_ctx = atoi(argv[2]);
 662         }
 663
 664         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 665                                      LSA_POLICY_VIEW_LOCAL_INFORMATION,
 666                                      &pol);
 667
 668         if (!NT_STATUS_IS_OK(status))
 669                 goto done;
 670
 671         status = STATUS_MORE_ENTRIES;
 672
 673         while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 674
 675                 /* Lookup list of trusted domains */
 676
 677                 status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
 678                                                  &pol,
 679                                                  &enum_ctx,
 680                                                  &domain_list,
 681                                                  max_size,
 682                                                  &result);
 683                 if (!NT_STATUS_IS_OK(status)) {
 684                         goto done;
 685                 }
 686                 if (!NT_STATUS_IS_OK(result) &&
 687                     !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
 688                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
 689                         status = result;
 690                         goto done;
 691                 }
 692
 693                 /* Print results: list of names and sids returned in this
 694                  * response. */
 695                 for (i = 0; i < domain_list.count; i++) {
 696                         struct dom_sid_buf sid_str;
 697
 698                         printf("%s %s\n",
 699                                 domain_list.domains[i].name.string ?
 700                                 domain_list.domains[i].name.string : "*unknown*",
 701                                 dom_sid_str_buf(domain_list.domains[i].sid,
 702                                                 &sid_str));
 703                 }
 704         }
 705
 706         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 707  done:
 708         return status;
 709 }
 710
 711 /* Enumerates privileges */
 712
 713 static NTSTATUS cmd_lsa_enum_privilege(struct rpc_pipe_client *cli,
 714                                        TALLOC_CTX *mem_ctx, int argc,
 715                                        const char **argv)
 716 {
 717         struct policy_handle pol;
 718         NTSTATUS status, result;
 719         struct lsa_PrivArray priv_array;
 720         struct dcerpc_binding_handle *b = cli->binding_handle;
 721
 722         uint32_t enum_context=0;
 723         uint32_t pref_max_length=0x1000;
 724         int i;
 725
 726         if (argc > 3) {
 727                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 728                 return NT_STATUS_OK;
 729         }
 730
 731         if (argc>=2)
 732                 enum_context=atoi(argv[1]);
 733
 734         if (argc==3)
 735                 pref_max_length=atoi(argv[2]);
 736
 737         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 738                                      SEC_FLAG_MAXIMUM_ALLOWED,
 739                                      &pol);
 740
 741         if (!NT_STATUS_IS_OK(status))
 742                 goto done;
 743
 744         status = dcerpc_lsa_EnumPrivs(b, mem_ctx,
 745                                       &pol,
 746                                       &enum_context,
 747                                       &priv_array,
 748                                       pref_max_length,
 749                                       &result);
 750         if (!NT_STATUS_IS_OK(status))
 751                 goto done;
 752         if (!NT_STATUS_IS_OK(result)) {
 753                 status = result;
 754                 goto done;
 755         }
 756
 757         /* Print results */
 758         printf("found %d privileges\n\n", priv_array.count);
 759
 760         for (i = 0; i < priv_array.count; i++) {
 761                 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
 762                        priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*",
 763                        priv_array.privs[i].luid.high,
 764                        priv_array.privs[i].luid.low,
 765                        priv_array.privs[i].luid.high,
 766                        priv_array.privs[i].luid.low);
 767         }
 768
 769         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 770  done:
 771         return status;
 772 }
 773
 774 /* Get privilege name */
 775
 776 static NTSTATUS cmd_lsa_get_dispname(struct rpc_pipe_client *cli,
 777                                      TALLOC_CTX *mem_ctx, int argc,
 778                                      const char **argv)
 779 {
 780         struct policy_handle pol;
 781         NTSTATUS status, result;
 782         struct dcerpc_binding_handle *b = cli->binding_handle;
 783
 784         uint16_t lang_id=0;
 785         uint16_t lang_id_sys=0;
 786         uint16_t lang_id_desc;
 787         struct lsa_String lsa_name;
 788         struct lsa_StringLarge *description = NULL;
 789
 790         if (argc != 2) {
 791                 printf("Usage: %s privilege name\n", argv[0]);
 792                 return NT_STATUS_OK;
 793         }
 794
 795         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 796                                      SEC_FLAG_MAXIMUM_ALLOWED,
 797                                      &pol);
 798
 799         if (!NT_STATUS_IS_OK(status))
 800                 goto done;
 801
 802         init_lsa_String(&lsa_name, argv[1]);
 803
 804         status = dcerpc_lsa_LookupPrivDisplayName(b, mem_ctx,
 805                                                   &pol,
 806                                                   &lsa_name,
 807                                                   lang_id,
 808                                                   lang_id_sys,
 809                                                   &description,
 810                                                   &lang_id_desc,
 811                                                   &result);
 812         if (!NT_STATUS_IS_OK(status))
 813                 goto done;
 814         if (!NT_STATUS_IS_OK(result)) {
 815                 status = result;
 816                 goto done;
 817         }
 818
 819         /* Print results */
 820         printf("%s -> %s (language: 0x%x)\n", argv[1], description->string, lang_id_desc);
 821
 822         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 823  done:
 824         return status;
 825 }
 826
 827 /* Enumerate the LSA SIDS */
 828
 829 static NTSTATUS cmd_lsa_enum_sids(struct rpc_pipe_client *cli,
 830                                   TALLOC_CTX *mem_ctx, int argc,
 831                                   const char **argv)
 832 {
 833         struct policy_handle pol;
 834         NTSTATUS status, result;
 835         struct dcerpc_binding_handle *b = cli->binding_handle;
 836
 837         uint32_t enum_context=0;
 838         uint32_t pref_max_length=0x1000;
 839         struct lsa_SidArray sid_array;
 840         int i;
 841
 842         if (argc > 3) {
 843                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 844                 return NT_STATUS_OK;
 845         }
 846
 847         if (argc>=2)
 848                 enum_context=atoi(argv[1]);
 849
 850         if (argc==3)
 851                 pref_max_length=atoi(argv[2]);
 852
 853         status = rpccli_lsa_open_policy(cli, mem_ctx, True,
 854                                      SEC_FLAG_MAXIMUM_ALLOWED,
 855                                      &pol);
 856
 857         if (!NT_STATUS_IS_OK(status))
 858                 goto done;
 859
 860         status = dcerpc_lsa_EnumAccounts(b, mem_ctx,
 861                                          &pol,
 862                                          &enum_context,
 863                                          &sid_array,
 864                                          pref_max_length,
 865                                          &result);
 866         if (!NT_STATUS_IS_OK(status))
 867                 goto done;
 868         if (!NT_STATUS_IS_OK(result)) {
 869                 status = result;
 870                 goto done;
 871         }
 872
 873         /* Print results */
 874         printf("found %d SIDs\n\n", sid_array.num_sids);
 875
 876         for (i = 0; i < sid_array.num_sids; i++) {
 877                 struct dom_sid_buf sid_str;
 878
 879                 printf("%s\n",
 880                        dom_sid_str_buf(sid_array.sids[i].sid, &sid_str));
 881         }
 882
 883         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 884  done:
 885         return status;
 886 }
 887
 888 /* Create a new account */
 889
 890 static NTSTATUS cmd_lsa_create_account(struct rpc_pipe_client *cli,
 891                                            TALLOC_CTX *mem_ctx, int argc,
 892                                            const char **argv)
 893 {
 894         struct policy_handle dom_pol;
 895         struct policy_handle user_pol;
 896         NTSTATUS status, result;
 897         uint32_t des_access = 0x000f000f;
 898         struct dcerpc_binding_handle *b = cli->binding_handle;
 899
 900         struct dom_sid sid;
 901
 902         if (argc != 2 ) {
 903                 printf("Usage: %s SID\n", argv[0]);
 904                 return NT_STATUS_OK;
 905         }
 906
 907         status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 908         if (!NT_STATUS_IS_OK(status))
 909                 goto done;
 910
 911         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 912                                      SEC_FLAG_MAXIMUM_ALLOWED,
 913                                      &dom_pol);
 914
 915         if (!NT_STATUS_IS_OK(status))
 916                 goto done;
 917
 918         status = dcerpc_lsa_CreateAccount(b, mem_ctx,
 919                                           &dom_pol,
 920                                           &sid,
 921                                           des_access,
 922                                           &user_pol,
 923                                           &result);
 924         if (!NT_STATUS_IS_OK(status))
 925                 goto done;
 926         if (!NT_STATUS_IS_OK(result)) {
 927                 status = result;
 928                 goto done;
 929         }
 930
 931         printf("Account for SID %s successfully created\n\n", argv[1]);
 932         status = NT_STATUS_OK;
 933
 934         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
 935  done:
 936         return status;
 937 }
 938
 939
 940 /* Enumerate the privileges of an SID */
 941
 942 static NTSTATUS cmd_lsa_enum_privsaccounts(struct rpc_pipe_client *cli,
 943                                            TALLOC_CTX *mem_ctx, int argc,
 944                                            const char **argv)
 945 {
 946         struct policy_handle dom_pol;
 947         struct policy_handle user_pol;
 948         NTSTATUS status, result;
 949         uint32_t access_desired = 0x000f000f;
 950         struct dom_sid sid;
 951         struct lsa_PrivilegeSet *privs = NULL;
 952         int i;
 953         struct dcerpc_binding_handle *b = cli->binding_handle;
 954
 955         if (argc != 2 ) {
 956                 printf("Usage: %s SID\n", argv[0]);
 957                 return NT_STATUS_OK;
 958         }
 959
 960         status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 961         if (!NT_STATUS_IS_OK(status))
 962                 goto done;
 963
 964         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 965                                      SEC_FLAG_MAXIMUM_ALLOWED,
 966                                      &dom_pol);
 967
 968         if (!NT_STATUS_IS_OK(status))
 969                 goto done;
 970
 971         status = dcerpc_lsa_OpenAccount(b, mem_ctx,
 972                                         &dom_pol,
 973                                         &sid,
 974                                         access_desired,
 975                                         &user_pol,
 976                                         &result);
 977         if (!NT_STATUS_IS_OK(status))
 978                 goto done;
 979         if (!NT_STATUS_IS_OK(result)) {
 980                 status = result;
 981                 goto done;
 982         }
 983
 984         status = dcerpc_lsa_EnumPrivsAccount(b, mem_ctx,
 985                                              &user_pol,
 986                                              &privs,
 987                                              &result);
 988         if (!NT_STATUS_IS_OK(status))
 989                 goto done;
 990         if (!NT_STATUS_IS_OK(result)) {
 991                 status = result;
 992                 goto done;
 993         }
 994
 995         /* Print results */
 996         printf("found %d privileges for SID %s\n\n", privs->count, argv[1]);
 997         printf("high\tlow\tattribute\n");
 998
 999         for (i = 0; i < privs->count; i++) {
1000                 printf("%u\t%u\t%u\n",
1001                         privs->set[i].luid.high,
1002                         privs->set[i].luid.low,
1003                         privs->set[i].attribute);
1004         }
1005
1006         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1007  done:
1008         return status;
1009 }
1010
1011
1012 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
1013
1014 static NTSTATUS cmd_lsa_enum_acct_rights(struct rpc_pipe_client *cli,
1015                                          TALLOC_CTX *mem_ctx, int argc,
1016                                          const char **argv)
1017 {
1018         struct policy_handle dom_pol;
1019         NTSTATUS status, result;
1020         struct dom_sid sid;
1021         struct dom_sid_buf buf;
1022         struct lsa_RightSet rights;
1023         struct dcerpc_binding_handle *b = cli->binding_handle;
1024
1025         int i;
1026
1027         if (argc != 2 ) {
1028                 printf("Usage: %s SID\n", argv[0]);
1029                 return NT_STATUS_OK;
1030         }
1031
1032         status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1033         if (!NT_STATUS_IS_OK(status))
1034                 goto done;
1035
1036         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1037                                      SEC_FLAG_MAXIMUM_ALLOWED,
1038                                      &dom_pol);
1039
1040         if (!NT_STATUS_IS_OK(status))
1041                 goto done;
1042
1043         status = dcerpc_lsa_EnumAccountRights(b, mem_ctx,
1044                                               &dom_pol,
1045                                               &sid,
1046                                               &rights,
1047                                               &result);
1048         if (!NT_STATUS_IS_OK(status))
1049                 goto done;
1050         if (!NT_STATUS_IS_OK(result)) {
1051                 status = result;
1052                 goto done;
1053         }
1054
1055         printf("found %d privileges for SID %s\n", rights.count,
1056                dom_sid_str_buf(&sid, &buf));
1057
1058         for (i = 0; i < rights.count; i++) {
1059                 printf("\t%s\n", rights.names[i].string);
1060         }
1061
1062         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1063  done:
1064         return status;
1065 }
1066
1067
1068 /* add some privileges to a SID via LsaAddAccountRights */
1069
1070 static NTSTATUS cmd_lsa_add_acct_rights(struct rpc_pipe_client *cli,
1071                                         TALLOC_CTX *mem_ctx, int argc,
1072                                         const char **argv)
1073 {
1074         struct policy_handle dom_pol;
1075         NTSTATUS status, result;
1076         struct lsa_RightSet rights;
1077         struct dom_sid sid;
1078         int i;
1079         struct dcerpc_binding_handle *b = cli->binding_handle;
1080
1081         if (argc < 3 ) {
1082                 printf("Usage: %s SID [rights...]\n", argv[0]);
1083                 return NT_STATUS_OK;
1084         }
1085
1086         status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1087         if (!NT_STATUS_IS_OK(status))
1088                 goto done;
1089
1090         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1091                                      SEC_FLAG_MAXIMUM_ALLOWED,
1092                                      &dom_pol);
1093
1094         if (!NT_STATUS_IS_OK(status))
1095                 goto done;
1096
1097         rights.count = argc-2;
1098         rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
1099                                     rights.count);
1100         if (!rights.names) {
1101                 return NT_STATUS_NO_MEMORY;
1102         }
1103
1104         for (i=0; i<argc-2; i++) {
1105                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
1106         }
1107
1108         status = dcerpc_lsa_AddAccountRights(b, mem_ctx,
1109                                              &dom_pol,
1110                                              &sid,
1111                                              &rights,
1112                                              &result);
1113         if (!NT_STATUS_IS_OK(status))
1114                 goto done;
1115         if (!NT_STATUS_IS_OK(result)) {
1116                 status = result;
1117                 goto done;
1118         }
1119
1120         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1121  done:
1122         return status;
1123 }
1124
1125
1126 /* remove some privileges to a SID via LsaRemoveAccountRights */
1127
1128 static NTSTATUS cmd_lsa_remove_acct_rights(struct rpc_pipe_client *cli,
1129                                         TALLOC_CTX *mem_ctx, int argc,
1130                                         const char **argv)
1131 {
1132         struct policy_handle dom_pol;
1133         NTSTATUS status, result;
1134         struct lsa_RightSet rights;
1135         struct dom_sid sid;
1136         int i;
1137         struct dcerpc_binding_handle *b = cli->binding_handle;
1138
1139         if (argc < 3 ) {
1140                 printf("Usage: %s SID [rights...]\n", argv[0]);
1141                 return NT_STATUS_OK;
1142         }
1143
1144         status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1145         if (!NT_STATUS_IS_OK(status))
1146                 goto done;
1147
1148         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1149                                      SEC_FLAG_MAXIMUM_ALLOWED,
1150                                      &dom_pol);
1151
1152         if (!NT_STATUS_IS_OK(status))
1153                 goto done;
1154
1155         rights.count = argc-2;
1156         rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
1157                                     rights.count);
1158         if (!rights.names) {
1159                 return NT_STATUS_NO_MEMORY;
1160         }
1161
1162         for (i=0; i<argc-2; i++) {
1163                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
1164         }
1165
1166         status = dcerpc_lsa_RemoveAccountRights(b, mem_ctx,
1167                                                 &dom_pol,
1168                                                 &sid,
1169                                                 false,
1170                                                 &rights,
1171                                                 &result);
1172         if (!NT_STATUS_IS_OK(status))
1173                 goto done;
1174         if (!NT_STATUS_IS_OK(result)) {
1175                 status = result;
1176                 goto done;
1177         }
1178
1179         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1180
1181  done:
1182         return status;
1183 }
1184
1185
1186 /* Get a privilege value given its name */
1187
1188 static NTSTATUS cmd_lsa_lookup_priv_value(struct rpc_pipe_client *cli,
1189                                         TALLOC_CTX *mem_ctx, int argc,
1190                                         const char **argv)
1191 {
1192         struct policy_handle pol;
1193         NTSTATUS status, result;
1194         struct lsa_LUID luid;
1195         struct lsa_String name;
1196         struct dcerpc_binding_handle *b = cli->binding_handle;
1197
1198         if (argc != 2 ) {
1199                 printf("Usage: %s name\n", argv[0]);
1200                 return NT_STATUS_OK;
1201         }
1202
1203         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1204                                      SEC_FLAG_MAXIMUM_ALLOWED,
1205                                      &pol);
1206
1207         if (!NT_STATUS_IS_OK(status))
1208                 goto done;
1209
1210         init_lsa_String(&name, argv[1]);
1211
1212         status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1213                                             &pol,
1214                                             &name,
1215                                             &luid,
1216                                             &result);
1217         if (!NT_STATUS_IS_OK(status))
1218                 goto done;
1219         if (!NT_STATUS_IS_OK(result)) {
1220                 status = result;
1221                 goto done;
1222         }
1223
1224         /* Print results */
1225
1226         printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
1227
1228         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1229  done:
1230         return status;
1231 }
1232
1233 /* Query LSA security object */
1234
1235 static NTSTATUS cmd_lsa_query_secobj(struct rpc_pipe_client *cli,
1236                                      TALLOC_CTX *mem_ctx, int argc,
1237                                      const char **argv)
1238 {
1239         struct policy_handle pol;
1240         NTSTATUS status, result;
1241         struct sec_desc_buf *sdb;
1242         uint32_t sec_info = SECINFO_DACL;
1243         struct dcerpc_binding_handle *b = cli->binding_handle;
1244
1245         if (argc < 1 || argc > 2) {
1246                 printf("Usage: %s [sec_info]\n", argv[0]);
1247                 return NT_STATUS_OK;
1248         }
1249
1250         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1251                                       SEC_FLAG_MAXIMUM_ALLOWED,
1252                                       &pol);
1253
1254         if (argc == 2)
1255                 sscanf(argv[1], "%x", &sec_info);
1256
1257         if (!NT_STATUS_IS_OK(status))
1258                 goto done;
1259
1260         status = dcerpc_lsa_QuerySecurity(b, mem_ctx,
1261                                           &pol,
1262                                           sec_info,
1263                                           &sdb,
1264                                           &result);
1265         if (!NT_STATUS_IS_OK(status))
1266                 goto done;
1267         if (!NT_STATUS_IS_OK(result)) {
1268                 status = result;
1269                 goto done;
1270         }
1271
1272         /* Print results */
1273
1274         display_sec_desc(sdb->sd);
1275
1276         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1277  done:
1278         return status;
1279 }
1280
1281 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword *p,
1282                                      DATA_BLOB session_key)
1283 {
1284         char *pwd, *pwd_old;
1285
1286         DATA_BLOB data     = data_blob_const(p->password->data, p->password->length);
1287         DATA_BLOB data_old = data_blob_const(p->old_password->data, p->old_password->length);
1288
1289         pwd     = sess_decrypt_string(talloc_tos(), &data, &session_key);
1290         pwd_old = sess_decrypt_string(talloc_tos(), &data_old, &session_key);
1291
1292         d_printf("Password:\t%s\n", pwd);
1293         d_printf("Old Password:\t%s\n", pwd_old);
1294
1295         talloc_free(pwd);
1296         talloc_free(pwd_old);
1297 }
1298
1299 static void display_trust_dom_info(TALLOC_CTX *mem_ctx,
1300                                    union lsa_TrustedDomainInfo *info,
1301                                    enum lsa_TrustDomInfoEnum info_class,
1302                                    DATA_BLOB session_key)
1303 {
1304         switch (info_class) {
1305                 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
1306                         display_trust_dom_info_4(&info->password, session_key);
1307                         break;
1308                 default: {
1309                         const char *str = NULL;
1310                         str = NDR_PRINT_UNION_STRING(mem_ctx,
1311                                                      lsa_TrustedDomainInfo,
1312                                                      info_class, info);
1313                         if (str) {
1314                                 d_printf("%s\n", str);
1315                         }
1316                         break;
1317                 }
1318         }
1319 }
1320
1321 static NTSTATUS cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client *cli,
1322                                                 TALLOC_CTX *mem_ctx, int argc,
1323                                                 const char **argv)
1324 {
1325         struct policy_handle pol;
1326         NTSTATUS status, result;
1327         struct dom_sid dom_sid;
1328         uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1329         union lsa_TrustedDomainInfo *info = NULL;
1330         enum lsa_TrustDomInfoEnum info_class = 1;
1331         DATA_BLOB session_key;
1332         struct dcerpc_binding_handle *b = cli->binding_handle;
1333
1334         if (argc > 3 || argc < 2) {
1335                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1336                 return NT_STATUS_OK;
1337         }
1338
1339         if (!string_to_sid(&dom_sid, argv[1]))
1340                 return NT_STATUS_NO_MEMORY;
1341
1342         if (argc == 3)
1343                 info_class = atoi(argv[2]);
1344
1345         status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1346
1347         if (!NT_STATUS_IS_OK(status))
1348                 goto done;
1349
1350         status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
1351                                                         &pol,
1352                                                         &dom_sid,
1353                                                         info_class,
1354                                                         &info,
1355                                                         &result);
1356         if (!NT_STATUS_IS_OK(status))
1357                 goto done;
1358         if (!NT_STATUS_IS_OK(result)) {
1359                 status = result;
1360                 goto done;
1361         }
1362
1363         status = cli_get_session_key(mem_ctx, cli, &session_key);
1364         if (!NT_STATUS_IS_OK(status)) {
1365                 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1366                 goto done;
1367         }
1368
1369         display_trust_dom_info(mem_ctx, info, info_class, session_key);
1370
1371  done:
1372         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1373
1374         return status;
1375 }
1376
1377 static NTSTATUS cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client *cli,
1378                                                  TALLOC_CTX *mem_ctx, int argc,
1379                                                  const char **argv)
1380 {
1381         struct policy_handle pol;
1382         NTSTATUS status, result;
1383         uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1384         union lsa_TrustedDomainInfo *info = NULL;
1385         enum lsa_TrustDomInfoEnum info_class = 1;
1386         struct lsa_String trusted_domain;
1387         struct dcerpc_binding_handle *b = cli->binding_handle;
1388         DATA_BLOB session_key;
1389
1390         if (argc > 3 || argc < 2) {
1391                 printf("Usage: %s [name] [info_class]\n", argv[0]);
1392                 return NT_STATUS_OK;
1393         }
1394
1395         if (argc == 3)
1396                 info_class = atoi(argv[2]);
1397
1398         status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1399
1400         if (!NT_STATUS_IS_OK(status))
1401                 goto done;
1402
1403         init_lsa_String(&trusted_domain, argv[1]);
1404
1405         status = dcerpc_lsa_QueryTrustedDomainInfoByName(b, mem_ctx,
1406                                                          &pol,
1407                                                          &trusted_domain,
1408                                                          info_class,
1409                                                          &info,
1410                                                          &result);
1411         if (!NT_STATUS_IS_OK(status))
1412                 goto done;
1413         if (!NT_STATUS_IS_OK(result)) {
1414                 status = result;
1415                 goto done;
1416         }
1417
1418         status = cli_get_session_key(mem_ctx, cli, &session_key);
1419         if (!NT_STATUS_IS_OK(status)) {
1420                 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1421                 goto done;
1422         }
1423
1424         display_trust_dom_info(mem_ctx, info, info_class, session_key);
1425
1426  done:
1427         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1428
1429         return status;
1430 }
1431
1432 static NTSTATUS cmd_lsa_set_trustdominfo(struct rpc_pipe_client *cli,
1433                                          TALLOC_CTX *mem_ctx, int argc,
1434                                          const char **argv)
1435 {
1436         struct policy_handle pol, trustdom_pol;
1437         NTSTATUS status, result;
1438         uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1439         union lsa_TrustedDomainInfo info;
1440         struct dom_sid dom_sid;
1441         enum lsa_TrustDomInfoEnum info_class = 1;
1442         struct dcerpc_binding_handle *b = cli->binding_handle;
1443
1444         if (argc > 4 || argc < 3) {
1445                 printf("Usage: %s [sid] [info_class] [value]\n", argv[0]);
1446                 return NT_STATUS_OK;
1447         }
1448
1449         if (!string_to_sid(&dom_sid, argv[1])) {
1450                 return NT_STATUS_NO_MEMORY;
1451         }
1452
1453
1454         info_class = atoi(argv[2]);
1455
1456         switch (info_class) {
1457         case 13: /* LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES */
1458                 info.enc_types.enc_types = atoi(argv[3]);
1459                 break;
1460         default:
1461                 return NT_STATUS_INVALID_PARAMETER;
1462         }
1463
1464         status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1465         if (!NT_STATUS_IS_OK(status)) {
1466                 goto done;
1467         }
1468
1469         status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
1470                                               &pol,
1471                                               &dom_sid,
1472                                               access_mask,
1473                                               &trustdom_pol,
1474                                               &result);
1475         if (!NT_STATUS_IS_OK(status)) {
1476                 goto done;
1477         }
1478         if (!NT_STATUS_IS_OK(result)) {
1479                 status = result;
1480                 goto done;
1481         }
1482
1483         status = dcerpc_lsa_SetInformationTrustedDomain(b, mem_ctx,
1484                                                         &trustdom_pol,
1485                                                         info_class,
1486                                                         &info,
1487                                                         &result);
1488         if (!NT_STATUS_IS_OK(status)) {
1489                 goto done;
1490         }
1491         if (!NT_STATUS_IS_OK(result)) {
1492                 status = result;
1493                 goto done;
1494         }
1495  done:
1496         dcerpc_lsa_Close(b, mem_ctx, &trustdom_pol, &result);
1497         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1498
1499         return status;
1500 }
1501
1502 static NTSTATUS cmd_lsa_query_trustdominfo(struct rpc_pipe_client *cli,
1503                                            TALLOC_CTX *mem_ctx, int argc,
1504                                            const char **argv)
1505 {
1506         struct policy_handle pol, trustdom_pol;
1507         NTSTATUS status, result;
1508         uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1509         union lsa_TrustedDomainInfo *info = NULL;
1510         struct dom_sid dom_sid;
1511         enum lsa_TrustDomInfoEnum info_class = 1;
1512         DATA_BLOB session_key;
1513         struct dcerpc_binding_handle *b = cli->binding_handle;
1514
1515         if (argc > 3 || argc < 2) {
1516                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1517                 return NT_STATUS_OK;
1518         }
1519
1520         if (!string_to_sid(&dom_sid, argv[1]))
1521                 return NT_STATUS_NO_MEMORY;
1522
1523
1524         if (argc == 3)
1525                 info_class = atoi(argv[2]);
1526
1527         status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1528
1529         if (!NT_STATUS_IS_OK(status))
1530                 goto done;
1531
1532         status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
1533                                               &pol,
1534                                               &dom_sid,
1535                                               access_mask,
1536                                               &trustdom_pol,
1537                                               &result);
1538         if (!NT_STATUS_IS_OK(status))
1539                 goto done;
1540         if (!NT_STATUS_IS_OK(result)) {
1541                 status = result;
1542                 goto done;
1543         }
1544
1545         status = dcerpc_lsa_QueryTrustedDomainInfo(b, mem_ctx,
1546                                                    &trustdom_pol,
1547                                                    info_class,
1548                                                    &info,
1549                                                    &result);
1550         if (!NT_STATUS_IS_OK(status))
1551                 goto done;
1552         if (!NT_STATUS_IS_OK(result)) {
1553                 status = result;
1554                 goto done;
1555         }
1556
1557         status = cli_get_session_key(mem_ctx, cli, &session_key);
1558         if (!NT_STATUS_IS_OK(status)) {
1559                 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1560                 goto done;
1561         }
1562
1563         display_trust_dom_info(mem_ctx, info, info_class, session_key);
1564
1565  done:
1566         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1567
1568         return status;
1569 }
1570
1571 static NTSTATUS cmd_lsa_get_username(struct rpc_pipe_client *cli,
1572                                      TALLOC_CTX *mem_ctx, int argc,
1573                                      const char **argv)
1574 {
1575         NTSTATUS status, result;
1576         const char *servername = cli->desthost;
1577         struct lsa_String *account_name = NULL;
1578         struct lsa_String *authority_name = NULL;
1579         struct dcerpc_binding_handle *b = cli->binding_handle;
1580
1581         if (argc > 2) {
1582                 printf("Usage: %s servername\n", argv[0]);
1583                 return NT_STATUS_OK;
1584         }
1585
1586         status = dcerpc_lsa_GetUserName(b, mem_ctx,
1587                                         servername,
1588                                         &account_name,
1589                                         &authority_name,
1590                                         &result);
1591         if (!NT_STATUS_IS_OK(status)) {
1592                 goto done;
1593         }
1594         if (!NT_STATUS_IS_OK(result)) {
1595                 status = result;
1596                 goto done;
1597         }
1598
1599         /* Print results */
1600
1601         printf("Account Name: %s, Authority Name: %s\n",
1602                 account_name->string, authority_name ? authority_name->string :
1603                 "");
1604
1605  done:
1606         return status;
1607 }
1608
1609 static NTSTATUS cmd_lsa_add_priv(struct rpc_pipe_client *cli,
1610                                  TALLOC_CTX *mem_ctx, int argc,
1611                                  const char **argv)
1612 {
1613         struct policy_handle dom_pol, user_pol;
1614         NTSTATUS status, result;
1615         struct lsa_PrivilegeSet privs;
1616         struct lsa_LUIDAttribute *set = NULL;
1617         struct dom_sid sid;
1618         int i;
1619         struct dcerpc_binding_handle *b = cli->binding_handle;
1620
1621         ZERO_STRUCT(privs);
1622
1623         if (argc < 3 ) {
1624                 printf("Usage: %s SID [rights...]\n", argv[0]);
1625                 return NT_STATUS_OK;
1626         }
1627
1628         status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1629         if (!NT_STATUS_IS_OK(status)) {
1630                 goto done;
1631         }
1632
1633         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1634                                          SEC_FLAG_MAXIMUM_ALLOWED,
1635                                          &dom_pol);
1636
1637         if (!NT_STATUS_IS_OK(status)) {
1638                 goto done;
1639         }
1640
1641         status = dcerpc_lsa_OpenAccount(b, mem_ctx,
1642                                         &dom_pol,
1643                                         &sid,
1644                                         SEC_FLAG_MAXIMUM_ALLOWED,
1645                                         &user_pol,
1646                                         &result);
1647         if (!NT_STATUS_IS_OK(status)) {
1648                 goto done;
1649         }
1650         if (!NT_STATUS_IS_OK(result)) {
1651                 status = result;
1652                 goto done;
1653         }
1654
1655         for (i=2; i<argc; i++) {
1656
1657                 struct lsa_String priv_name;
1658                 struct lsa_LUID luid;
1659
1660                 init_lsa_String(&priv_name, argv[i]);
1661
1662                 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1663                                                     &dom_pol,
1664                                                     &priv_name,
1665                                                     &luid,
1666                                                     &result);
1667                 if (!NT_STATUS_IS_OK(status)) {
1668                         continue;
1669                 }
1670                 if (!NT_STATUS_IS_OK(result)) {
1671                         status = result;
1672                         continue;
1673                 }
1674
1675                 privs.count++;
1676                 set = talloc_realloc(mem_ctx, set,
1677                                            struct lsa_LUIDAttribute,
1678                                            privs.count);
1679                 if (!set) {
1680                         return NT_STATUS_NO_MEMORY;
1681                 }
1682
1683                 set[privs.count-1].luid = luid;
1684                 set[privs.count-1].attribute = 0;
1685         }
1686
1687         privs.set = set;
1688
1689         status = dcerpc_lsa_AddPrivilegesToAccount(b, mem_ctx,
1690                                                    &user_pol,
1691                                                    &privs,
1692                                                    &result);
1693         if (!NT_STATUS_IS_OK(status)) {
1694                 goto done;
1695         }
1696         if (!NT_STATUS_IS_OK(result)) {
1697                 status = result;
1698                 goto done;
1699         }
1700
1701         dcerpc_lsa_Close(b, mem_ctx, &user_pol, &result);
1702         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1703  done:
1704         return status;
1705 }
1706
1707 static NTSTATUS cmd_lsa_del_priv(struct rpc_pipe_client *cli,
1708                                  TALLOC_CTX *mem_ctx, int argc,
1709                                  const char **argv)
1710 {
1711         struct policy_handle dom_pol, user_pol;
1712         NTSTATUS status, result;
1713         struct lsa_PrivilegeSet privs;
1714         struct lsa_LUIDAttribute *set = NULL;
1715         struct dom_sid sid;
1716         int i;
1717         struct dcerpc_binding_handle *b = cli->binding_handle;
1718
1719         ZERO_STRUCT(privs);
1720
1721         if (argc < 3 ) {
1722                 printf("Usage: %s SID [rights...]\n", argv[0]);
1723                 return NT_STATUS_OK;
1724         }
1725
1726         status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1727         if (!NT_STATUS_IS_OK(status)) {
1728                 goto done;
1729         }
1730
1731         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1732                                          SEC_FLAG_MAXIMUM_ALLOWED,
1733                                          &dom_pol);
1734
1735         if (!NT_STATUS_IS_OK(status)) {
1736                 goto done;
1737         }
1738
1739         status = dcerpc_lsa_OpenAccount(b, mem_ctx,
1740                                         &dom_pol,
1741                                         &sid,
1742                                         SEC_FLAG_MAXIMUM_ALLOWED,
1743                                         &user_pol,
1744                                         &result);
1745         if (!NT_STATUS_IS_OK(status)) {
1746                 goto done;
1747         }
1748         if (!NT_STATUS_IS_OK(result)) {
1749                 status = result;
1750                 goto done;
1751         }
1752
1753         for (i=2; i<argc; i++) {
1754
1755                 struct lsa_String priv_name;
1756                 struct lsa_LUID luid;
1757
1758                 init_lsa_String(&priv_name, argv[i]);
1759
1760                 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1761                                                     &dom_pol,
1762                                                     &priv_name,
1763                                                     &luid,
1764                                                     &result);
1765                 if (!NT_STATUS_IS_OK(status)) {
1766                         continue;
1767                 }
1768                 if (!NT_STATUS_IS_OK(result)) {
1769                         status = result;
1770                         continue;
1771                 }
1772
1773                 privs.count++;
1774                 set = talloc_realloc(mem_ctx, set,
1775                                            struct lsa_LUIDAttribute,
1776                                            privs.count);
1777                 if (!set) {
1778                         return NT_STATUS_NO_MEMORY;
1779                 }
1780
1781                 set[privs.count-1].luid = luid;
1782                 set[privs.count-1].attribute = 0;
1783         }
1784
1785         privs.set = set;
1786
1787
1788         status = dcerpc_lsa_RemovePrivilegesFromAccount(b, mem_ctx,
1789                                                         &user_pol,
1790                                                         false,
1791                                                         &privs,
1792                                                         &result);
1793         if (!NT_STATUS_IS_OK(status)) {
1794                 goto done;
1795         }
1796         if (!NT_STATUS_IS_OK(result)) {
1797                 status = result;
1798                 goto done;
1799         }
1800
1801         dcerpc_lsa_Close(b, mem_ctx, &user_pol, &result);
1802         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1803  done:
1804         return status;
1805 }
1806
1807 static NTSTATUS cmd_lsa_create_secret(struct rpc_pipe_client *cli,
1808                                       TALLOC_CTX *mem_ctx, int argc,
1809                                       const char **argv)
1810 {
1811         NTSTATUS status, result;
1812         struct policy_handle handle, sec_handle;
1813         struct lsa_String name;
1814         struct dcerpc_binding_handle *b = cli->binding_handle;
1815
1816         if (argc < 2) {
1817                 printf("Usage: %s name\n", argv[0]);
1818                 return NT_STATUS_OK;
1819         }
1820
1821         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1822                                          true,
1823                                          SEC_FLAG_MAXIMUM_ALLOWED,
1824                                          &handle);
1825         if (!NT_STATUS_IS_OK(status)) {
1826                 return status;
1827         }
1828
1829         init_lsa_String(&name, argv[1]);
1830
1831         status = dcerpc_lsa_CreateSecret(b, mem_ctx,
1832                                          &handle,
1833                                          name,
1834                                          SEC_FLAG_MAXIMUM_ALLOWED,
1835                                          &sec_handle,
1836                                          &result);
1837         if (!NT_STATUS_IS_OK(status)) {
1838                 goto done;
1839         }
1840         if (!NT_STATUS_IS_OK(result)) {
1841                 status = result;
1842                 goto done;
1843         }
1844
1845  done:
1846         if (is_valid_policy_hnd(&sec_handle)) {
1847                 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1848         }
1849         if (is_valid_policy_hnd(&handle)) {
1850                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1851         }
1852
1853         return status;
1854 }
1855
1856 static NTSTATUS cmd_lsa_delete_secret(struct rpc_pipe_client *cli,
1857                                       TALLOC_CTX *mem_ctx, int argc,
1858                                       const char **argv)
1859 {
1860         NTSTATUS status, result;
1861         struct policy_handle handle, sec_handle;
1862         struct lsa_String name;
1863         struct dcerpc_binding_handle *b = cli->binding_handle;
1864
1865         if (argc < 2) {
1866                 printf("Usage: %s name\n", argv[0]);
1867                 return NT_STATUS_OK;
1868         }
1869
1870         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1871                                          true,
1872                                          SEC_FLAG_MAXIMUM_ALLOWED,
1873                                          &handle);
1874         if (!NT_STATUS_IS_OK(status)) {
1875                 return status;
1876         }
1877
1878         init_lsa_String(&name, argv[1]);
1879
1880         status = dcerpc_lsa_OpenSecret(b, mem_ctx,
1881                                        &handle,
1882                                        name,
1883                                        SEC_FLAG_MAXIMUM_ALLOWED,
1884                                        &sec_handle,
1885                                        &result);
1886         if (!NT_STATUS_IS_OK(status)) {
1887                 goto done;
1888         }
1889         if (!NT_STATUS_IS_OK(result)) {
1890                 status = result;
1891                 goto done;
1892         }
1893
1894         status = dcerpc_lsa_DeleteObject(b, mem_ctx,
1895                                          &sec_handle,
1896                                          &result);
1897         if (!NT_STATUS_IS_OK(status)) {
1898                 goto done;
1899         }
1900         if (!NT_STATUS_IS_OK(result)) {
1901                 status = result;
1902                 goto done;
1903         }
1904
1905  done:
1906         if (is_valid_policy_hnd(&sec_handle)) {
1907                 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1908         }
1909         if (is_valid_policy_hnd(&handle)) {
1910                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1911         }
1912
1913         return status;
1914 }
1915
1916 static NTSTATUS cmd_lsa_query_secret(struct rpc_pipe_client *cli,
1917                                      TALLOC_CTX *mem_ctx, int argc,
1918                                      const char **argv)
1919 {
1920         NTSTATUS status, result;
1921         struct policy_handle handle, sec_handle;
1922         struct lsa_String name;
1923         struct lsa_DATA_BUF_PTR new_val;
1924         NTTIME new_mtime = 0;
1925         struct lsa_DATA_BUF_PTR old_val;
1926         NTTIME old_mtime = 0;
1927         DATA_BLOB session_key;
1928         DATA_BLOB new_blob = data_blob_null;
1929         DATA_BLOB old_blob = data_blob_null;
1930         char *new_secret, *old_secret;
1931         struct dcerpc_binding_handle *b = cli->binding_handle;
1932
1933         if (argc < 2) {
1934                 printf("Usage: %s name\n", argv[0]);
1935                 return NT_STATUS_OK;
1936         }
1937
1938         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1939                                          true,
1940                                          SEC_FLAG_MAXIMUM_ALLOWED,
1941                                          &handle);
1942         if (!NT_STATUS_IS_OK(status)) {
1943                 return status;
1944         }
1945
1946         init_lsa_String(&name, argv[1]);
1947
1948         status = dcerpc_lsa_OpenSecret(b, mem_ctx,
1949                                        &handle,
1950                                        name,
1951                                        SEC_FLAG_MAXIMUM_ALLOWED,
1952                                        &sec_handle,
1953                                        &result);
1954         if (!NT_STATUS_IS_OK(status)) {
1955                 goto done;
1956         }
1957         if (!NT_STATUS_IS_OK(result)) {
1958                 status = result;
1959                 goto done;
1960         }
1961
1962         ZERO_STRUCT(new_val);
1963         ZERO_STRUCT(old_val);
1964
1965         status = dcerpc_lsa_QuerySecret(b, mem_ctx,
1966                                         &sec_handle,
1967                                         &new_val,
1968                                         &new_mtime,
1969                                         &old_val,
1970                                         &old_mtime,
1971                                         &result);
1972         if (!NT_STATUS_IS_OK(status)) {
1973                 goto done;
1974         }
1975         if (!NT_STATUS_IS_OK(result)) {
1976                 status = result;
1977                 goto done;
1978         }
1979
1980         status = cli_get_session_key(mem_ctx, cli, &session_key);
1981         if (!NT_STATUS_IS_OK(status)) {
1982                 goto done;
1983         }
1984
1985         if (new_val.buf) {
1986                 new_blob = data_blob_const(new_val.buf->data, new_val.buf->length);
1987         }
1988         if (old_val.buf) {
1989                 old_blob = data_blob_const(old_val.buf->data, old_val.buf->length);
1990         }
1991
1992         new_secret = sess_decrypt_string(mem_ctx, &new_blob, &session_key);
1993         old_secret = sess_decrypt_string(mem_ctx, &old_blob, &session_key);
1994         if (new_secret) {
1995                 d_printf("new secret: %s\n", new_secret);
1996         }
1997         if (old_secret) {
1998                 d_printf("old secret: %s\n", old_secret);
1999         }
2000
2001  done:
2002         if (is_valid_policy_hnd(&sec_handle)) {
2003                 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
2004         }
2005         if (is_valid_policy_hnd(&handle)) {
2006                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2007         }
2008
2009         return status;
2010 }
2011
2012 static NTSTATUS cmd_lsa_set_secret(struct rpc_pipe_client *cli,
2013                                    TALLOC_CTX *mem_ctx, int argc,
2014                                    const char **argv)
2015 {
2016         NTSTATUS status, result;
2017         struct policy_handle handle, sec_handle;
2018         struct lsa_String name;
2019         struct lsa_DATA_BUF new_val;
2020         struct lsa_DATA_BUF old_val;
2021         DATA_BLOB enc_key;
2022         DATA_BLOB session_key;
2023         struct dcerpc_binding_handle *b = cli->binding_handle;
2024
2025         if (argc < 3) {
2026                 printf("Usage: %s name secret\n", argv[0]);
2027                 return NT_STATUS_OK;
2028         }
2029
2030         status = rpccli_lsa_open_policy2(cli, mem_ctx,
2031                                          true,
2032                                          SEC_FLAG_MAXIMUM_ALLOWED,
2033                                          &handle);
2034         if (!NT_STATUS_IS_OK(status)) {
2035                 return status;
2036         }
2037
2038         init_lsa_String(&name, argv[1]);
2039
2040         status = dcerpc_lsa_OpenSecret(b, mem_ctx,
2041                                        &handle,
2042                                        name,
2043                                        SEC_FLAG_MAXIMUM_ALLOWED,
2044                                        &sec_handle,
2045                                        &result);
2046         if (!NT_STATUS_IS_OK(status)) {
2047                 goto done;
2048         }
2049         if (!NT_STATUS_IS_OK(result)) {
2050                 status = result;
2051                 goto done;
2052         }
2053
2054         ZERO_STRUCT(new_val);
2055         ZERO_STRUCT(old_val);
2056
2057         status = cli_get_session_key(mem_ctx, cli, &session_key);
2058         if (!NT_STATUS_IS_OK(status)) {
2059                 goto done;
2060         }
2061
2062         enc_key = sess_encrypt_string(argv[2], &session_key);
2063
2064         new_val.length = enc_key.length;
2065         new_val.size = enc_key.length;
2066         new_val.data = enc_key.data;
2067
2068         status = dcerpc_lsa_SetSecret(b, mem_ctx,
2069                                       &sec_handle,
2070                                       &new_val,
2071                                       NULL,
2072                                       &result);
2073         if (!NT_STATUS_IS_OK(status)) {
2074                 goto done;
2075         }
2076         if (!NT_STATUS_IS_OK(result)) {
2077                 status = result;
2078                 goto done;
2079         }
2080
2081  done:
2082         if (is_valid_policy_hnd(&sec_handle)) {
2083                 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
2084         }
2085         if (is_valid_policy_hnd(&handle)) {
2086                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2087         }
2088
2089         return status;
2090 }
2091
2092 static NTSTATUS cmd_lsa_retrieve_private_data(struct rpc_pipe_client *cli,
2093                                               TALLOC_CTX *mem_ctx, int argc,
2094                                               const char **argv)
2095 {
2096         NTSTATUS status, result;
2097         struct policy_handle handle;
2098         struct lsa_String name;
2099         struct lsa_DATA_BUF *val;
2100         DATA_BLOB session_key;
2101         DATA_BLOB blob = data_blob_null;
2102         char *secret;
2103         struct dcerpc_binding_handle *b = cli->binding_handle;
2104
2105         if (argc < 2) {
2106                 printf("Usage: %s name\n", argv[0]);
2107                 return NT_STATUS_OK;
2108         }
2109
2110         status = rpccli_lsa_open_policy2(cli, mem_ctx,
2111                                          true,
2112                                          SEC_FLAG_MAXIMUM_ALLOWED,
2113                                          &handle);
2114         if (!NT_STATUS_IS_OK(status)) {
2115                 return status;
2116         }
2117
2118         init_lsa_String(&name, argv[1]);
2119
2120         ZERO_STRUCT(val);
2121
2122         status = dcerpc_lsa_RetrievePrivateData(b, mem_ctx,
2123                                                 &handle,
2124                                                 &name,
2125                                                 &val,
2126                                                 &result);
2127         if (!NT_STATUS_IS_OK(status)) {
2128                 goto done;
2129         }
2130         if (!NT_STATUS_IS_OK(result)) {
2131                 status = result;
2132                 goto done;
2133         }
2134
2135         status = cli_get_session_key(mem_ctx, cli, &session_key);
2136         if (!NT_STATUS_IS_OK(status)) {
2137                 goto done;
2138         }
2139
2140         if (val) {
2141                 blob = data_blob_const(val->data, val->length);
2142         }
2143
2144         secret = sess_decrypt_string(mem_ctx, &blob, &session_key);
2145         if (secret) {
2146                 d_printf("secret: %s\n", secret);
2147         }
2148
2149  done:
2150         if (is_valid_policy_hnd(&handle)) {
2151                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2152         }
2153
2154         return status;
2155 }
2156
2157 static NTSTATUS cmd_lsa_store_private_data(struct rpc_pipe_client *cli,
2158                                            TALLOC_CTX *mem_ctx, int argc,
2159                                            const char **argv)
2160 {
2161         NTSTATUS status, result;
2162         struct policy_handle handle;
2163         struct lsa_String name;
2164         struct lsa_DATA_BUF val;
2165         DATA_BLOB session_key;
2166         DATA_BLOB enc_key;
2167         struct dcerpc_binding_handle *b = cli->binding_handle;
2168
2169         if (argc < 3) {
2170                 printf("Usage: %s name secret\n", argv[0]);
2171                 return NT_STATUS_OK;
2172         }
2173
2174         status = rpccli_lsa_open_policy2(cli, mem_ctx,
2175                                          true,
2176                                          SEC_FLAG_MAXIMUM_ALLOWED,
2177                                          &handle);
2178         if (!NT_STATUS_IS_OK(status)) {
2179                 return status;
2180         }
2181
2182         init_lsa_String(&name, argv[1]);
2183
2184         ZERO_STRUCT(val);
2185
2186         status = cli_get_session_key(mem_ctx, cli, &session_key);
2187         if (!NT_STATUS_IS_OK(status)) {
2188                 goto done;
2189         }
2190
2191         enc_key = sess_encrypt_string(argv[2], &session_key);
2192
2193         val.length = enc_key.length;
2194         val.size = enc_key.length;
2195         val.data = enc_key.data;
2196
2197         status = dcerpc_lsa_StorePrivateData(b, mem_ctx,
2198                                              &handle,
2199                                              &name,
2200                                              &val,
2201                                              &result);
2202         if (!NT_STATUS_IS_OK(status)) {
2203                 goto done;
2204         }
2205         if (!NT_STATUS_IS_OK(result)) {
2206                 status = result;
2207                 goto done;
2208         }
2209
2210  done:
2211         if (is_valid_policy_hnd(&handle)) {
2212                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2213         }
2214
2215         return status;
2216 }
2217
2218 static NTSTATUS cmd_lsa_create_trusted_domain(struct rpc_pipe_client *cli,
2219                                               TALLOC_CTX *mem_ctx, int argc,
2220                                               const char **argv)
2221 {
2222         NTSTATUS status, result;
2223         struct policy_handle handle, trustdom_handle;
2224         struct dom_sid sid;
2225         struct lsa_DomainInfo info;
2226         struct dcerpc_binding_handle *b = cli->binding_handle;
2227
2228         if (argc < 3) {
2229                 printf("Usage: %s name sid\n", argv[0]);
2230                 return NT_STATUS_OK;
2231         }
2232
2233         status = rpccli_lsa_open_policy2(cli, mem_ctx,
2234                                          true,
2235                                          SEC_FLAG_MAXIMUM_ALLOWED,
2236                                          &handle);
2237         if (!NT_STATUS_IS_OK(status)) {
2238                 return status;
2239         }
2240
2241         init_lsa_StringLarge(&info.name, argv[1]);
2242         info.sid = &sid;
2243         string_to_sid(&sid, argv[2]);
2244
2245         status = dcerpc_lsa_CreateTrustedDomain(b, mem_ctx,
2246                                                 &handle,
2247                                                 &info,
2248                                                 SEC_FLAG_MAXIMUM_ALLOWED,
2249                                                 &trustdom_handle,
2250                                                 &result);
2251         if (!NT_STATUS_IS_OK(status)) {
2252                 goto done;
2253         }
2254         if (!NT_STATUS_IS_OK(result)) {
2255                 status = result;
2256                 goto done;
2257         }
2258
2259  done:
2260         if (is_valid_policy_hnd(&trustdom_handle)) {
2261                 dcerpc_lsa_Close(b, mem_ctx, &trustdom_handle, &result);
2262         }
2263
2264         if (is_valid_policy_hnd(&handle)) {
2265                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2266         }
2267
2268         return status;
2269 }
2270
2271 static NTSTATUS cmd_lsa_delete_trusted_domain(struct rpc_pipe_client *cli,
2272                                               TALLOC_CTX *mem_ctx, int argc,
2273                                               const char **argv)
2274 {
2275         NTSTATUS status, result;
2276         struct policy_handle handle, trustdom_handle;
2277         struct lsa_String name;
2278         struct dom_sid *sid = NULL;
2279         struct dcerpc_binding_handle *b = cli->binding_handle;
2280
2281         if (argc < 2) {
2282                 printf("Usage: %s name\n", argv[0]);
2283                 return NT_STATUS_OK;
2284         }
2285
2286         status = rpccli_lsa_open_policy2(cli, mem_ctx,
2287                                          true,
2288                                          SEC_FLAG_MAXIMUM_ALLOWED,
2289                                          &handle);
2290         if (!NT_STATUS_IS_OK(status)) {
2291                 return status;
2292         }
2293
2294         init_lsa_String(&name, argv[1]);
2295
2296         status = dcerpc_lsa_OpenTrustedDomainByName(b, mem_ctx,
2297                                                     &handle,
2298                                                     name,
2299                                                     SEC_FLAG_MAXIMUM_ALLOWED,
2300                                                     &trustdom_handle,
2301                                                     &result);
2302         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2303                 goto delete_object;
2304         }
2305
2306         {
2307                 uint32_t resume_handle = 0;
2308                 struct lsa_DomainList domains;
2309                 int i;
2310
2311                 status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
2312                                                  &handle,
2313                                                  &resume_handle,
2314                                                  &domains,
2315                                                  0xffff,
2316                                                  &result);
2317                 if (!NT_STATUS_IS_OK(status)) {
2318                         goto done;
2319                 }
2320                 if (!NT_STATUS_IS_OK(result)) {
2321                         status = result;
2322                         goto done;
2323                 }
2324
2325                 for (i=0; i < domains.count; i++) {
2326                         if (strequal(domains.domains[i].name.string, argv[1])) {
2327                                 sid = domains.domains[i].sid;
2328                                 break;
2329                         }
2330                 }
2331
2332                 if (!sid) {
2333                         return NT_STATUS_INVALID_SID;
2334                 }
2335         }
2336
2337         status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
2338                                               &handle,
2339                                               sid,
2340                                               SEC_FLAG_MAXIMUM_ALLOWED,
2341                                               &trustdom_handle,
2342                                               &result);
2343         if (!NT_STATUS_IS_OK(status)) {
2344                 goto done;
2345         }
2346         if (!NT_STATUS_IS_OK(result)) {
2347                 status = result;
2348                 goto done;
2349         }
2350
2351  delete_object:
2352         status = dcerpc_lsa_DeleteObject(b, mem_ctx,
2353                                          &trustdom_handle,
2354                                          &result);
2355         if (!NT_STATUS_IS_OK(status)) {
2356                 goto done;
2357         }
2358         if (!NT_STATUS_IS_OK(result)) {
2359                 status = result;
2360                 goto done;
2361         }
2362
2363  done:
2364         if (is_valid_policy_hnd(&trustdom_handle)) {
2365                 dcerpc_lsa_Close(b, mem_ctx, &trustdom_handle, &result);
2366         }
2367
2368         if (is_valid_policy_hnd(&handle)) {
2369                 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2370         }
2371
2372         return status;
2373 }
2374
2375
2376 /* List of commands exported by this module */
2377
2378 struct cmd_set lsarpc_commands[] = {
2379
2380         {
2381                 .name = "LSARPC",
2382         },
2383
2384         {
2385                 .name               = "lsaquery",
2386                 .returntype         = RPC_RTYPE_NTSTATUS,
2387                 .ntfn               = cmd_lsa_query_info_policy,
2388                 .wfn                =  NULL,
2389                 .table              = &ndr_table_lsarpc,
2390                 .rpc_pipe           = NULL,
2391                 .description        = "Query info policy",
2392                 .usage              = "",
2393         },
2394         {
2395                 .name               = "lookupsids",
2396                 .returntype         = RPC_RTYPE_NTSTATUS,
2397                 .ntfn               = cmd_lsa_lookup_sids,
2398                 .wfn                = NULL,
2399                 .table              = &ndr_table_lsarpc,
2400                 .rpc_pipe           = NULL,
2401                 .description        = "Convert SIDs to names",
2402                 .usage              = "",
2403         },
2404         {
2405                 .name               = "lookupsids3",
2406                 .returntype         = RPC_RTYPE_NTSTATUS,
2407                 .ntfn               = cmd_lsa_lookup_sids3,
2408                 .wfn                = NULL,
2409                 .table              = &ndr_table_lsarpc,
2410                 .rpc_pipe           = NULL,
2411                 .description        = "Convert SIDs to names",
2412                 .usage              = "",
2413         },
2414         {
2415                 .name               = "lookupsids_level",
2416                 .returntype         = RPC_RTYPE_NTSTATUS,
2417                 .ntfn               = cmd_lsa_lookup_sids_level,
2418                 .wfn                = NULL,
2419                 .table              = &ndr_table_lsarpc,
2420                 .rpc_pipe           = NULL,
2421                 .description        = "Convert SIDs to names",
2422                 .usage              = "",
2423         },
2424         {
2425                 .name               = "lookupnames",
2426                 .returntype         = RPC_RTYPE_NTSTATUS,
2427                 .ntfn               = cmd_lsa_lookup_names,
2428                 .wfn                = NULL,
2429                 .table              = &ndr_table_lsarpc,
2430                 .rpc_pipe           = NULL,
2431                 .description        = "Convert names to SIDs",
2432                 .usage              = "",
2433         },
2434         {
2435                 .name               = "lookupnames4",
2436                 .returntype         = RPC_RTYPE_NTSTATUS,
2437                 .ntfn               = cmd_lsa_lookup_names4,
2438                 .wfn                = NULL,
2439                 .table              = &ndr_table_lsarpc,
2440                 .rpc_pipe           = NULL,
2441                 .description        = "Convert names to SIDs",
2442                 .usage              = "",
2443         },
2444         {
2445                 .name               = "lookupnames_level",
2446                 .returntype         = RPC_RTYPE_NTSTATUS,
2447                 .ntfn               = cmd_lsa_lookup_names_level,
2448                 .wfn                = NULL,
2449                 .table              = &ndr_table_lsarpc,
2450                 .rpc_pipe           = NULL,
2451                 .description        = "Convert names to SIDs",
2452                 .usage              = "",
2453         },
2454         {
2455                 .name               = "enumtrust",
2456                 .returntype         = RPC_RTYPE_NTSTATUS,
2457                 .ntfn               = cmd_lsa_enum_trust_dom,
2458                 .wfn                = NULL,
2459                 .table              = &ndr_table_lsarpc,
2460                 .rpc_pipe           = NULL,
2461                 .description        = "Enumerate trusted domains",
2462                 .usage              = "Usage: [preferred max number] [enum context (0)]",
2463         },
2464         {
2465                 .name               = "enumprivs",
2466                 .returntype         = RPC_RTYPE_NTSTATUS,
2467                 .ntfn               = cmd_lsa_enum_privilege,
2468                 .wfn                = NULL,
2469                 .table              = &ndr_table_lsarpc,
2470                 .rpc_pipe           = NULL,
2471                 .description        = "Enumerate privileges",
2472                 .usage              = "",
2473         },
2474         {
2475                 .name               = "getdispname",
2476                 .returntype         = RPC_RTYPE_NTSTATUS,
2477                 .ntfn               = cmd_lsa_get_dispname,
2478                 .wfn                = NULL,
2479                 .table              = &ndr_table_lsarpc,
2480                 .rpc_pipe           = NULL,
2481                 .description        = "Get the privilege name",
2482                 .usage              = "",
2483         },
2484         {
2485                 .name               = "lsaenumsid",
2486                 .returntype         = RPC_RTYPE_NTSTATUS,
2487                 .ntfn               = cmd_lsa_enum_sids,
2488                 .wfn                = NULL,
2489                 .table              = &ndr_table_lsarpc,
2490                 .rpc_pipe           = NULL,
2491                 .description        = "Enumerate the LSA SIDS",
2492                 .usage              = "",
2493         },
2494         {
2495                 .name               = "lsacreateaccount",
2496                 .returntype         = RPC_RTYPE_NTSTATUS,
2497                 .ntfn               = cmd_lsa_create_account,
2498                 .wfn                = NULL,
2499                 .table              = &ndr_table_lsarpc,
2500                 .rpc_pipe           = NULL,
2501                 .description        = "Create a new lsa account",
2502                 .usage              = "",
2503         },
2504         {
2505                 .name               = "lsaenumprivsaccount",
2506                 .returntype         = RPC_RTYPE_NTSTATUS,
2507                 .ntfn               = cmd_lsa_enum_privsaccounts,
2508                 .wfn                = NULL,
2509                 .table              = &ndr_table_lsarpc,
2510                 .rpc_pipe           = NULL,
2511                 .description        = "Enumerate the privileges of an SID",
2512                 .usage              = "",
2513         },
2514         {
2515                 .name               = "lsaenumacctrights",
2516                 .returntype         = RPC_RTYPE_NTSTATUS,
2517                 .ntfn               = cmd_lsa_enum_acct_rights,
2518                 .wfn                = NULL,
2519                 .table              = &ndr_table_lsarpc,
2520                 .rpc_pipe           = NULL,
2521                 .description        = "Enumerate the rights of an SID",
2522                 .usage              = "",
2523         },
2524         {
2525                 .name               = "lsaaddpriv",
2526                 .returntype         = RPC_RTYPE_NTSTATUS,
2527                 .ntfn               = cmd_lsa_add_priv,
2528                 .wfn                = NULL,
2529                 .table              = &ndr_table_lsarpc,
2530                 .rpc_pipe           = NULL,
2531                 .description        = "Assign a privilege to a SID",
2532                 .usage              = "",
2533         },
2534         {
2535                 .name               = "lsadelpriv",
2536                 .returntype         = RPC_RTYPE_NTSTATUS,
2537                 .ntfn               = cmd_lsa_del_priv,
2538                 .wfn                = NULL,
2539                 .table              = &ndr_table_lsarpc,
2540                 .rpc_pipe           = NULL,
2541                 .description        = "Revoke a privilege from a SID",
2542                 .usage              = "",
2543         },
2544         {
2545                 .name               = "lsaaddacctrights",
2546                 .returntype         = RPC_RTYPE_NTSTATUS,
2547                 .ntfn               = cmd_lsa_add_acct_rights,
2548                 .wfn                = NULL,
2549                 .table              = &ndr_table_lsarpc,
2550                 .rpc_pipe           = NULL,
2551                 .description        = "Add rights to an account",
2552                 .usage              = "",
2553         },
2554         {
2555                 .name               = "lsaremoveacctrights",
2556                 .returntype         = RPC_RTYPE_NTSTATUS,
2557                 .ntfn               = cmd_lsa_remove_acct_rights,
2558                 .wfn                = NULL,
2559                 .table              = &ndr_table_lsarpc,
2560                 .rpc_pipe           = NULL,
2561                 .description        = "Remove rights from an account",
2562                 .usage              = "",
2563         },
2564         {
2565                 .name               = "lsalookupprivvalue",
2566                 .returntype         = RPC_RTYPE_NTSTATUS,
2567                 .ntfn               = cmd_lsa_lookup_priv_value,
2568                 .wfn                = NULL,
2569                 .table              = &ndr_table_lsarpc,
2570                 .rpc_pipe           = NULL,
2571                 .description        = "Get a privilege value given its name",
2572                 .usage              = "",
2573         },
2574         {
2575                 .name               = "lsaquerysecobj",
2576                 .returntype         = RPC_RTYPE_NTSTATUS,
2577                 .ntfn               = cmd_lsa_query_secobj,
2578                 .wfn                = NULL,
2579                 .table              = &ndr_table_lsarpc,
2580                 .rpc_pipe           = NULL,
2581                 .description        = "Query LSA security object",
2582                 .usage              = "",
2583         },
2584         {
2585                 .name               = "lsaquerytrustdominfo",
2586                 .returntype         = RPC_RTYPE_NTSTATUS,
2587                 .ntfn               = cmd_lsa_query_trustdominfo,
2588                 .wfn                = NULL,
2589                 .table              = &ndr_table_lsarpc,
2590                 .rpc_pipe           = NULL,
2591                 .description        = "Query LSA trusted domains info (given a SID)",
2592                 .usage              = "",
2593         },
2594         {
2595                 .name               = "lsaquerytrustdominfobyname",
2596                 .returntype         = RPC_RTYPE_NTSTATUS,
2597                 .ntfn               = cmd_lsa_query_trustdominfobyname,
2598                 .wfn                = NULL,
2599                 .table              = &ndr_table_lsarpc,
2600                 .rpc_pipe           = NULL,
2601                 .description        = "Query LSA trusted domains info (given a name), only works for Windows > 2k",
2602                 .usage              = "",
2603         },
2604         {
2605                 .name               = "lsaquerytrustdominfobysid",
2606                 .returntype         = RPC_RTYPE_NTSTATUS,
2607                 .ntfn               = cmd_lsa_query_trustdominfobysid,
2608                 .wfn                = NULL,
2609                 .table              = &ndr_table_lsarpc,
2610                 .rpc_pipe           = NULL,
2611                 .description        = "Query LSA trusted domains info (given a SID)",
2612                 .usage              = "",
2613         },
2614         {
2615                 .name               = "lsasettrustdominfo",
2616                 .returntype         = RPC_RTYPE_NTSTATUS,
2617                 .ntfn               = cmd_lsa_set_trustdominfo,
2618                 .wfn                = NULL,
2619                 .table              = &ndr_table_lsarpc,
2620                 .rpc_pipe           = NULL,
2621                 .description        = "Set LSA trusted domain info",
2622                 .usage              = "",
2623         },
2624         {
2625                 .name               = "getusername",
2626                 .returntype         = RPC_RTYPE_NTSTATUS,
2627                 .ntfn               = cmd_lsa_get_username,
2628                 .wfn                = NULL,
2629                 .table              = &ndr_table_lsarpc,
2630                 .rpc_pipe           = NULL,
2631                 .description        = "Get username",
2632                 .usage              = "",
2633         },
2634         {
2635                 .name               = "createsecret",
2636                 .returntype         = RPC_RTYPE_NTSTATUS,
2637                 .ntfn               = cmd_lsa_create_secret,
2638                 .wfn                = NULL,
2639                 .table              = &ndr_table_lsarpc,
2640                 .rpc_pipe           = NULL,
2641                 .description        = "Create Secret",
2642                 .usage              = "",
2643         },
2644         {
2645                 .name               = "deletesecret",
2646                 .returntype         = RPC_RTYPE_NTSTATUS,
2647                 .ntfn               = cmd_lsa_delete_secret,
2648                 .wfn                = NULL,
2649                 .table              = &ndr_table_lsarpc,
2650                 .rpc_pipe           = NULL,
2651                 .description        = "Delete Secret",
2652                 .usage              = "",
2653         },
2654         {
2655                 .name               = "querysecret",
2656                 .returntype         = RPC_RTYPE_NTSTATUS,
2657                 .ntfn               = cmd_lsa_query_secret,
2658                 .wfn                = NULL,
2659                 .table              = &ndr_table_lsarpc,
2660                 .rpc_pipe           = NULL,
2661                 .description        = "Query Secret",
2662                 .usage              = "",
2663         },
2664         {
2665                 .name               = "setsecret",
2666                 .returntype         = RPC_RTYPE_NTSTATUS,
2667                 .ntfn               = cmd_lsa_set_secret,
2668                 .wfn                = NULL,
2669                 .table              = &ndr_table_lsarpc,
2670                 .rpc_pipe           = NULL,
2671                 .description        = "Set Secret",
2672                 .usage              = "",
2673         },
2674         {
2675                 .name               = "retrieveprivatedata",
2676                 .returntype         = RPC_RTYPE_NTSTATUS,
2677                 .ntfn               = cmd_lsa_retrieve_private_data,
2678                 .wfn                = NULL,
2679                 .table              = &ndr_table_lsarpc,
2680                 .rpc_pipe           = NULL,
2681                 .description        = "Retrieve Private Data",
2682                 .usage              = "",
2683         },
2684         {
2685                 .name               = "storeprivatedata",
2686                 .returntype         = RPC_RTYPE_NTSTATUS,
2687                 .ntfn               = cmd_lsa_store_private_data,
2688                 .wfn                = NULL,
2689                 .table              = &ndr_table_lsarpc,
2690                 .rpc_pipe           = NULL,
2691                 .description        = "Store Private Data",
2692                 .usage              = "",
2693         },
2694         {
2695                 .name               = "createtrustdom",
2696                 .returntype         = RPC_RTYPE_NTSTATUS,
2697                 .ntfn               = cmd_lsa_create_trusted_domain,
2698                 .wfn                = NULL,
2699                 .table              = &ndr_table_lsarpc,
2700                 .rpc_pipe           = NULL,
2701                 .description        = "Create Trusted Domain",
2702                 .usage              = "",
2703         },
2704         {
2705                 .name               = "deletetrustdom",
2706                 .returntype         = RPC_RTYPE_NTSTATUS,
2707                 .ntfn               = cmd_lsa_delete_trusted_domain,
2708                 .wfn                = NULL,
2709                 .table              = &ndr_table_lsarpc,
2710                 .rpc_pipe           = NULL,
2711                 .description        = "Delete Trusted Domain",
2712                 .usage              = "",
2713         },
2714         {
2715                 .name = NULL,
2716         },
2717 };