source4/rpc_server/lsa/lsa_lookup.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the lsarpc pipe
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "rpc_server/lsa/lsa.h"
  24
  25 static const struct {
  26         const char *domain;
  27         const char *name;
  28         const char *sid;
  29         int rtype;
  30 } well_known[] = {
  31         {
  32                 .name = "EVERYONE",
  33                 .sid = SID_WORLD,
  34                 .rtype = SID_NAME_WKN_GRP,
  35         },
  36         {
  37                 .name = "CREATOR OWNER",
  38                 .sid = SID_CREATOR_OWNER,
  39                 .rtype = SID_NAME_WKN_GRP,
  40         },
  41         {
  42                 .name = "CREATOR GROUP",
  43                 .sid = SID_CREATOR_GROUP,
  44                 .rtype = SID_NAME_WKN_GRP,
  45         },
  46         {
  47                 .domain = "NT AUTHORITY",
  48                 .name = "Dialup",
  49                 .sid = SID_NT_DIALUP,
  50                 .rtype = SID_NAME_WKN_GRP,
  51         },
  52         {
  53                 .domain = "NT AUTHORITY",
  54                 .name = "Network",
  55                 .sid = SID_NT_NETWORK,
  56                 .rtype = SID_NAME_WKN_GRP,
  57         },
  58         {
  59                 .domain = "NT AUTHORITY",
  60                 .name = "Batch",
  61                 .sid = SID_NT_BATCH,
  62                 .rtype = SID_NAME_WKN_GRP,
  63         },
  64         {
  65                 .domain = "NT AUTHORITY",
  66                 .name = "Interactive",
  67                 .sid = SID_NT_INTERACTIVE,
  68                 .rtype = SID_NAME_WKN_GRP,
  69         },
  70         {
  71                 .domain = "NT AUTHORITY",
  72                 .name = "Service",
  73                 .sid = SID_NT_SERVICE,
  74                 .rtype = SID_NAME_WKN_GRP,
  75         },
  76         {
  77                 .domain = "NT AUTHORITY",
  78                 .name = "ANONYMOUS LOGON",
  79                 .sid = SID_NT_ANONYMOUS,
  80                 .rtype = SID_NAME_WKN_GRP,
  81         },
  82         {
  83                 .domain = "NT AUTHORITY",
  84                 .name = "Proxy",
  85                 .sid = SID_NT_PROXY,
  86                 .rtype = SID_NAME_WKN_GRP,
  87         },
  88         {
  89                 .domain = "NT AUTHORITY",
  90                 .name = "ServerLogon",
  91                 .sid = SID_NT_ENTERPRISE_DCS,
  92                 .rtype = SID_NAME_WKN_GRP,
  93         },
  94         {
  95                 .domain = "NT AUTHORITY",
  96                 .name = "Self",
  97                 .sid = SID_NT_SELF,
  98                 .rtype = SID_NAME_WKN_GRP,
  99         },
 100         {
 101                 .domain = "NT AUTHORITY",
 102                 .name = "Authenticated Users",
 103                 .sid = SID_NT_AUTHENTICATED_USERS,
 104                 .rtype = SID_NAME_WKN_GRP,
 105         },
 106         {
 107                 .domain = "NT AUTHORITY",
 108                 .name = "Restricted",
 109                 .sid = SID_NT_RESTRICTED,
 110                 .rtype = SID_NAME_WKN_GRP,
 111         },
 112         {
 113                 .domain = "NT AUTHORITY",
 114                 .name = "Termainal Server User",
 115                 .sid = SID_NT_TERMINAL_SERVER_USERS,
 116                 .rtype = SID_NAME_WKN_GRP,
 117         },
 118         {
 119                 .domain = "NT AUTHORITY",
 120                 .name = "Remote Interactive Logon",
 121                 .sid = SID_NT_REMOTE_INTERACTIVE,
 122                 .rtype = SID_NAME_WKN_GRP,
 123         },
 124         {
 125                 .domain = "NT AUTHORITY",
 126                 .name = "This Organization",
 127                 .sid = SID_NT_THIS_ORGANISATION,
 128                 .rtype = SID_NAME_WKN_GRP,
 129         },
 130         {
 131                 .domain = "NT AUTHORITY",
 132                 .name = "SYSTEM",
 133                 .sid = SID_NT_SYSTEM,
 134                 .rtype = SID_NAME_WKN_GRP,
 135         },
 136         {
 137                 .domain = "NT AUTHORITY",
 138                 .name = "Local Service",
 139                 .sid = SID_NT_LOCAL_SERVICE,
 140                 .rtype = SID_NAME_WKN_GRP,
 141         },
 142         {
 143                 .domain = "NT AUTHORITY",
 144                 .name = "Network Service",
 145                 .sid = SID_NT_NETWORK_SERVICE,
 146                 .rtype = SID_NAME_WKN_GRP,
 147         },
 148         {
 149                 .sid = NULL,
 150         }
 151 };
 152
 153 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
 154                                         const char *name, const char **authority_name,
 155                                         struct dom_sid **sid, uint32_t *rtype)
 156 {
 157         int i;
 158         for (i=0; well_known[i].sid; i++) {
 159                 if (domain) {
 160                         if (strcasecmp_m(domain, well_known[i].domain) == 0
 161                             && strcasecmp_m(name, well_known[i].name) == 0) {
 162                                 *authority_name = well_known[i].domain;
 163                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
 164                                 *rtype = well_known[i].rtype;
 165                                 return NT_STATUS_OK;
 166                         }
 167                 } else {
 168                         if (strcasecmp_m(name, well_known[i].name) == 0) {
 169                                 *authority_name = well_known[i].domain;
 170                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
 171                                 *rtype = well_known[i].rtype;
 172                                 return NT_STATUS_OK;
 173                         }
 174                 }
 175         }
 176         return NT_STATUS_NOT_FOUND;
 177 }
 178
 179 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx,
 180                                        const char *sid_str, const char **authority_name,
 181                                        const char **name, uint32_t *rtype)
 182 {
 183         int i;
 184         for (i=0; well_known[i].sid; i++) {
 185                 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
 186                         *authority_name = well_known[i].domain;
 187                         *name = well_known[i].name;
 188                         *rtype = well_known[i].rtype;
 189                         return NT_STATUS_OK;
 190                 }
 191         }
 192         return NT_STATUS_NOT_FOUND;
 193 }
 194
 195 /*
 196   lookup a SID for 1 name
 197 */
 198 static NTSTATUS dcesrv_lsa_lookup_name(struct loadparm_context *lp_ctx,
 199                                        struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
 200                                 const char *name, const char **authority_name,
 201                                 struct dom_sid **sid, enum lsa_SidType *rtype)
 202 {
 203         int ret, atype, i;
 204         struct ldb_message **res;
 205         const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
 206         const char *p;
 207         const char *domain;
 208         const char *username;
 209         struct ldb_dn *domain_dn;
 210         struct dom_sid *domain_sid;
 211         NTSTATUS status;
 212
 213         p = strchr_m(name, '\\');
 214         if (p != NULL) {
 215                 domain = talloc_strndup(mem_ctx, name, p-name);
 216                 if (!domain) {
 217                         return NT_STATUS_NO_MEMORY;
 218                 }
 219                 username = p + 1;
 220         } else if (strchr_m(name, '@')) {
 221                 status = crack_name_to_nt4_name(mem_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
 222                 if (!NT_STATUS_IS_OK(status)) {
 223                         DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
 224                         return status;
 225                 }
 226         } else {
 227                 domain = NULL;
 228                 username = name;
 229         }
 230
 231         if (!domain) {
 232                 /* Look up table of well known names */
 233                 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
 234                 if (NT_STATUS_IS_OK(status)) {
 235                         return NT_STATUS_OK;
 236                 }
 237
 238                 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) {
 239                         *authority_name = NAME_NT_AUTHORITY;
 240                         *sid =  dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
 241                         *rtype = SID_NAME_DOMAIN;
 242                         return NT_STATUS_OK;
 243                 }
 244                 if (strcasecmp_m(username, NAME_BUILTIN) == 0) {
 245                         *authority_name = NAME_BUILTIN;
 246                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
 247                         *rtype = SID_NAME_DOMAIN;
 248                         return NT_STATUS_OK;
 249                 }
 250                 if (strcasecmp_m(username, state->domain_dns) == 0) {
 251                         *authority_name = state->domain_name;
 252                         *sid =  state->domain_sid;
 253                         *rtype = SID_NAME_DOMAIN;
 254                         return NT_STATUS_OK;
 255                 }
 256                 if (strcasecmp_m(username, state->domain_name) == 0) {
 257                         *authority_name = state->domain_name;
 258                         *sid =  state->domain_sid;
 259                         *rtype = SID_NAME_DOMAIN;
 260                         return NT_STATUS_OK;
 261                 }
 262
 263                 /* Perhaps this is a well known user? */
 264                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
 265                 if (!name) {
 266                         return NT_STATUS_NO_MEMORY;
 267                 }
 268                 status = dcesrv_lsa_lookup_name(lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
 269                 if (NT_STATUS_IS_OK(status)) {
 270                         return status;
 271                 }
 272
 273                 /* Perhaps this is a BUILTIN user? */
 274                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
 275                 if (!name) {
 276                         return NT_STATUS_NO_MEMORY;
 277                 }
 278                 status = dcesrv_lsa_lookup_name(lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
 279                 if (NT_STATUS_IS_OK(status)) {
 280                         return status;
 281                 }
 282
 283                 /* OK, I give up - perhaps we need to assume the user is in our domain? */
 284                 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
 285                 if (!name) {
 286                         return NT_STATUS_NO_MEMORY;
 287                 }
 288                 status = dcesrv_lsa_lookup_name(lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
 289                 if (NT_STATUS_IS_OK(status)) {
 290                         return status;
 291                 }
 292
 293                 return STATUS_SOME_UNMAPPED;
 294         } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
 295                 if (!*username) {
 296                         *authority_name = NAME_NT_AUTHORITY;
 297                         *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
 298                         *rtype = SID_NAME_DOMAIN;
 299                         return NT_STATUS_OK;
 300                 }
 301
 302                 /* Look up table of well known names */
 303                 return lookup_well_known_names(mem_ctx, domain, username, authority_name,
 304                                                sid, rtype);
 305         } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
 306                 *authority_name = NAME_BUILTIN;
 307                 domain_dn = state->builtin_dn;
 308         } else if (strcasecmp_m(domain, state->domain_dns) == 0) {
 309                 *authority_name = state->domain_name;
 310                 domain_dn = state->domain_dn;
 311         } else if (strcasecmp_m(domain, state->domain_name) == 0) {
 312                 *authority_name = state->domain_name;
 313                 domain_dn = state->domain_dn;
 314         } else {
 315                 /* Not local, need to ask winbind in future */
 316                 return STATUS_SOME_UNMAPPED;
 317         }
 318
 319         ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
 320         if (ret == 1) {
 321                 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
 322                 if (domain_sid == NULL) {
 323                         return NT_STATUS_INVALID_SID;
 324                 }
 325         } else {
 326                 return NT_STATUS_INVALID_SID;
 327         }
 328
 329         if (!*username) {
 330                 *sid = domain_sid;
 331                 *rtype = SID_NAME_DOMAIN;
 332                 return NT_STATUS_OK;
 333         }
 334
 335         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
 336                            "(&(sAMAccountName=%s)(objectSid=*))",
 337                            ldb_binary_encode_string(mem_ctx, username));
 338         if (ret == -1) {
 339                 return NT_STATUS_INVALID_SID;
 340         }
 341
 342         for (i=0; i < ret; i++) {
 343                 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
 344                 if (*sid == NULL) {
 345                         return NT_STATUS_INVALID_SID;
 346                 }
 347
 348                 /* Check that this is in the domain */
 349                 if (!dom_sid_in_domain(domain_sid, *sid)) {
 350                         continue;
 351                 }
 352
 353                 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
 354
 355                 *rtype = samdb_atype_map(atype);
 356                 if (*rtype == SID_NAME_UNKNOWN) {
 357                         return STATUS_SOME_UNMAPPED;
 358                 }
 359
 360                 return NT_STATUS_OK;
 361         }
 362
 363         /* need to add a call into sidmap to check for a allocated sid */
 364
 365         return NT_STATUS_INVALID_SID;
 366 }
 367
 368
 369 /*
 370   add to the lsa_RefDomainList for LookupSids and LookupNames
 371 */
 372 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
 373                                           enum lsa_SidType rtype,
 374                                           const char *authority_name,
 375                                           struct dom_sid *sid,
 376                                           struct lsa_RefDomainList *domains,
 377                                           uint32_t *sid_index)
 378 {
 379         struct dom_sid *authority_sid;
 380         int i;
 381
 382         if (rtype != SID_NAME_DOMAIN) {
 383                 authority_sid = dom_sid_dup(mem_ctx, sid);
 384                 if (authority_sid == NULL) {
 385                         return NT_STATUS_NO_MEMORY;
 386                 }
 387                 authority_sid->num_auths--;
 388         } else {
 389                 authority_sid = sid;
 390         }
 391
 392         /* see if we've already done this authority name */
 393         for (i=0;i<domains->count;i++) {
 394                 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
 395                         *sid_index = i;
 396                         return NT_STATUS_OK;
 397                 }
 398         }
 399
 400         domains->domains = talloc_realloc(domains,
 401                                           domains->domains,
 402                                           struct lsa_DomainInfo,
 403                                           domains->count+1);
 404         if (domains->domains == NULL) {
 405                 return NT_STATUS_NO_MEMORY;
 406         }
 407         domains->domains[i].name.string = authority_name;
 408         domains->domains[i].sid         = authority_sid;
 409         domains->count++;
 410         domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
 411         *sid_index = i;
 412
 413         return NT_STATUS_OK;
 414 }
 415
 416 /*
 417   lookup a name for 1 SID
 418 */
 419 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
 420                                       struct dom_sid *sid, const char *sid_str,
 421                                       const char **authority_name,
 422                                       const char **name, enum lsa_SidType *rtype)
 423 {
 424         NTSTATUS status;
 425         int ret;
 426         uint32_t atype;
 427         struct ldb_message **res;
 428         struct ldb_dn *domain_dn;
 429         const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
 430
 431         status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
 432         if (NT_STATUS_IS_OK(status)) {
 433                 return status;
 434         }
 435
 436         if (dom_sid_in_domain(state->domain_sid, sid)) {
 437                 *authority_name = state->domain_name;
 438                 domain_dn = state->domain_dn;
 439         } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
 440                 *authority_name = NAME_BUILTIN;
 441                 domain_dn = state->builtin_dn;
 442         } else {
 443                 /* Not well known, our domain or built in */
 444
 445                 /* In future, we must look at SID histories, and at trusted domains via winbind */
 446
 447                 return NT_STATUS_NOT_FOUND;
 448         }
 449
 450         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
 451                            "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
 452         if (ret == 1) {
 453                 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
 454                 if (!*name) {
 455                         *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
 456                         if (!*name) {
 457                                 *name = talloc_strdup(mem_ctx, sid_str);
 458                                 NT_STATUS_HAVE_NO_MEMORY(*name);
 459                         }
 460                 }
 461
 462                 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
 463
 464                 *rtype = samdb_atype_map(atype);
 465
 466                 return NT_STATUS_OK;
 467         }
 468
 469         /* need to re-add a call into sidmap to check for a allocated sid */
 470         /* status = sidmap_allocated_sid_lookup(state->sidmap, mem_ctx, sid, name, rtype); */
 471
 472         return NT_STATUS_NOT_FOUND;
 473 }
 474
 475
 476 /*
 477   lsa_LookupSids2
 478 */
 479 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
 480                                 TALLOC_CTX *mem_ctx,
 481                                 struct lsa_LookupSids2 *r)
 482 {
 483         struct lsa_policy_state *state;
 484         int i;
 485         NTSTATUS status = NT_STATUS_OK;
 486
 487         r->out.domains = NULL;
 488
 489         status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
 490         if (!NT_STATUS_IS_OK(status)) {
 491                 return status;
 492         }
 493
 494         r->out.domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
 495         if (r->out.domains == NULL) {
 496                 return NT_STATUS_NO_MEMORY;
 497         }
 498
 499         r->out.names = talloc_zero(mem_ctx,  struct lsa_TransNameArray2);
 500         if (r->out.names == NULL) {
 501                 return NT_STATUS_NO_MEMORY;
 502         }
 503
 504         *r->out.count = 0;
 505
 506         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2,
 507                                              r->in.sids->num_sids);
 508         if (r->out.names->names == NULL) {
 509                 return NT_STATUS_NO_MEMORY;
 510         }
 511
 512         for (i=0;i<r->in.sids->num_sids;i++) {
 513                 struct dom_sid *sid = r->in.sids->sids[i].sid;
 514                 char *sid_str = dom_sid_string(mem_ctx, sid);
 515                 const char *name, *authority_name;
 516                 enum lsa_SidType rtype;
 517                 uint32_t sid_index;
 518                 NTSTATUS status2;
 519
 520                 r->out.names->count++;
 521
 522                 r->out.names->names[i].sid_type    = SID_NAME_UNKNOWN;
 523                 r->out.names->names[i].name.string = sid_str;
 524                 r->out.names->names[i].sid_index   = 0xFFFFFFFF;
 525                 r->out.names->names[i].unknown     = 0;
 526
 527                 if (sid_str == NULL) {
 528                         r->out.names->names[i].name.string = "(SIDERROR)";
 529                         status = STATUS_SOME_UNMAPPED;
 530                         continue;
 531                 }
 532
 533                 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str,
 534                                                 &authority_name, &name, &rtype);
 535                 if (!NT_STATUS_IS_OK(status2)) {
 536                         status = STATUS_SOME_UNMAPPED;
 537                         continue;
 538                 }
 539
 540                 /* set up the authority table */
 541                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype,
 542                                                     authority_name, sid,
 543                                                     r->out.domains, &sid_index);
 544                 if (!NT_STATUS_IS_OK(status2)) {
 545                         return status2;
 546                 }
 547
 548                 r->out.names->names[i].sid_type    = rtype;
 549                 r->out.names->names[i].name.string = name;
 550                 r->out.names->names[i].sid_index   = sid_index;
 551                 r->out.names->names[i].unknown     = 0;
 552
 553                 (*r->out.count)++;
 554         }
 555
 556         if (*r->out.count == 0) {
 557                 return NT_STATUS_NONE_MAPPED;
 558         }
 559         if (*r->out.count != r->in.sids->num_sids) {
 560                 return STATUS_SOME_UNMAPPED;
 561         }
 562
 563         return NT_STATUS_OK;
 564 }
 565
 566
 567 /*
 568   lsa_LookupSids3
 569
 570   Identical to LookupSids2, but doesn't take a policy handle
 571
 572 */
 573 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
 574                                 TALLOC_CTX *mem_ctx,
 575                                 struct lsa_LookupSids3 *r)
 576 {
 577         struct lsa_LookupSids2 r2;
 578         struct lsa_OpenPolicy2 pol;
 579         NTSTATUS status;
 580         struct dcesrv_handle *h;
 581
 582         /* No policy handle on the wire, so make one up here */
 583         r2.in.handle = talloc(mem_ctx, struct policy_handle);
 584         if (!r2.in.handle) {
 585                 return NT_STATUS_NO_MEMORY;
 586         }
 587
 588         pol.out.handle = r2.in.handle;
 589         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 590         pol.in.attr = NULL;
 591         pol.in.system_name = NULL;
 592         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
 593         if (!NT_STATUS_IS_OK(status)) {
 594                 return status;
 595         }
 596
 597         /* ensure this handle goes away at the end of this call */
 598         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
 599         talloc_steal(mem_ctx, h);
 600
 601         r2.in.sids     = r->in.sids;
 602         r2.in.names    = r->in.names;
 603         r2.in.level    = r->in.level;
 604         r2.in.count    = r->in.count;
 605         r2.in.unknown1 = r->in.unknown1;
 606         r2.in.unknown2 = r->in.unknown2;
 607         r2.out.count   = r->out.count;
 608         r2.out.names   = r->out.names;
 609
 610         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
 611         if (dce_call->fault_code != 0) {
 612                 return status;
 613         }
 614
 615         r->out.domains = r2.out.domains;
 616         r->out.names   = r2.out.names;
 617         r->out.count   = r2.out.count;
 618
 619         return status;
 620 }
 621
 622
 623 /*
 624   lsa_LookupSids
 625 */
 626 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 627                                struct lsa_LookupSids *r)
 628 {
 629         struct lsa_LookupSids2 r2;
 630         NTSTATUS status;
 631         int i;
 632
 633         r2.in.handle   = r->in.handle;
 634         r2.in.sids     = r->in.sids;
 635         r2.in.names    = NULL;
 636         r2.in.level    = r->in.level;
 637         r2.in.count    = r->in.count;
 638         r2.in.unknown1 = 0;
 639         r2.in.unknown2 = 0;
 640         r2.out.count   = r->out.count;
 641         r2.out.names   = NULL;
 642
 643         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
 644         if (dce_call->fault_code != 0) {
 645                 return status;
 646         }
 647
 648         r->out.domains = r2.out.domains;
 649         if (!r2.out.names) {
 650                 r->out.names = NULL;
 651                 return status;
 652         }
 653
 654         r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
 655         if (r->out.names == NULL) {
 656                 return NT_STATUS_NO_MEMORY;
 657         }
 658         r->out.names->count = r2.out.names->count;
 659         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName,
 660                                              r->out.names->count);
 661         if (r->out.names->names == NULL) {
 662                 return NT_STATUS_NO_MEMORY;
 663         }
 664         for (i=0;i<r->out.names->count;i++) {
 665                 r->out.names->names[i].sid_type    = r2.out.names->names[i].sid_type;
 666                 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
 667                 r->out.names->names[i].sid_index   = r2.out.names->names[i].sid_index;
 668         }
 669
 670         return status;
 671 }
 672
 673
 674 /*
 675   lsa_LookupNames3
 676 */
 677 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
 678                                  TALLOC_CTX *mem_ctx,
 679                                  struct lsa_LookupNames3 *r)
 680 {
 681         struct lsa_policy_state *policy_state;
 682         struct dcesrv_handle *policy_handle;
 683         int i;
 684         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
 685
 686         DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
 687
 688         policy_state = policy_handle->data;
 689
 690         r->out.domains = NULL;
 691
 692         r->out.domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
 693         if (r->out.domains == NULL) {
 694                 return NT_STATUS_NO_MEMORY;
 695         }
 696
 697         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray3);
 698         if (r->out.sids == NULL) {
 699                 return NT_STATUS_NO_MEMORY;
 700         }
 701
 702         *r->out.count = 0;
 703
 704         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3,
 705                                            r->in.num_names);
 706         if (r->out.sids->sids == NULL) {
 707                 return NT_STATUS_NO_MEMORY;
 708         }
 709
 710         for (i=0;i<r->in.num_names;i++) {
 711                 const char *name = r->in.names[i].string;
 712                 const char *authority_name;
 713                 struct dom_sid *sid;
 714                 uint32_t sid_index;
 715                 enum lsa_SidType rtype;
 716                 NTSTATUS status2;
 717
 718                 r->out.sids->count++;
 719
 720                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
 721                 r->out.sids->sids[i].sid         = NULL;
 722                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
 723                 r->out.sids->sids[i].unknown     = 0;
 724
 725                 status2 = dcesrv_lsa_lookup_name(lp_ctx, policy_state, mem_ctx, name, &authority_name, &sid, &rtype);
 726                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
 727                         continue;
 728                 }
 729
 730                 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name,
 731                                                     sid, r->out.domains, &sid_index);
 732                 if (!NT_STATUS_IS_OK(status2)) {
 733                         return status2;
 734                 }
 735
 736                 r->out.sids->sids[i].sid_type    = rtype;
 737                 r->out.sids->sids[i].sid         = sid;
 738                 r->out.sids->sids[i].sid_index   = sid_index;
 739                 r->out.sids->sids[i].unknown     = 0;
 740
 741                 (*r->out.count)++;
 742         }
 743
 744         if (*r->out.count == 0) {
 745                 return NT_STATUS_NONE_MAPPED;
 746         }
 747         if (*r->out.count != r->in.num_names) {
 748                 return STATUS_SOME_UNMAPPED;
 749         }
 750
 751         return NT_STATUS_OK;
 752 }
 753
 754 /*
 755   lsa_LookupNames4
 756
 757   Identical to LookupNames3, but doesn't take a policy handle
 758
 759 */
 760 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 761                                  struct lsa_LookupNames4 *r)
 762 {
 763         struct lsa_LookupNames3 r2;
 764         struct lsa_OpenPolicy2 pol;
 765         NTSTATUS status;
 766         struct dcesrv_handle *h;
 767
 768         /* No policy handle on the wire, so make one up here */
 769         r2.in.handle = talloc(mem_ctx, struct policy_handle);
 770         if (!r2.in.handle) {
 771                 return NT_STATUS_NO_MEMORY;
 772         }
 773
 774         pol.out.handle = r2.in.handle;
 775         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 776         pol.in.attr = NULL;
 777         pol.in.system_name = NULL;
 778         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
 779         if (!NT_STATUS_IS_OK(status)) {
 780                 return status;
 781         }
 782
 783         /* ensure this handle goes away at the end of this call */
 784         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
 785         talloc_steal(mem_ctx, h);
 786
 787         r2.in.num_names = r->in.num_names;
 788         r2.in.names = r->in.names;
 789         r2.in.sids = r->in.sids;
 790         r2.in.count = r->in.count;
 791         r2.in.unknown1 = r->in.unknown1;
 792         r2.in.unknown2 = r->in.unknown2;
 793         r2.out.domains = r->out.domains;
 794         r2.out.sids = r->out.sids;
 795         r2.out.count = r->out.count;
 796
 797         status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
 798         if (dce_call->fault_code != 0) {
 799                 return status;
 800         }
 801
 802         r->out.domains = r2.out.domains;
 803         r->out.sids = r2.out.sids;
 804         r->out.count = r2.out.count;
 805         return status;
 806 }
 807
 808 /*
 809   lsa_LookupNames2
 810 */
 811 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
 812                                  TALLOC_CTX *mem_ctx,
 813                                  struct lsa_LookupNames2 *r)
 814 {
 815         struct lsa_policy_state *state;
 816         struct dcesrv_handle *h;
 817         int i;
 818         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
 819
 820         r->out.domains = NULL;
 821
 822         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
 823
 824         state = h->data;
 825
 826         r->out.domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
 827         if (r->out.domains == NULL) {
 828                 return NT_STATUS_NO_MEMORY;
 829         }
 830
 831         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray2);
 832         if (r->out.sids == NULL) {
 833                 return NT_STATUS_NO_MEMORY;
 834         }
 835
 836         *r->out.count = 0;
 837
 838         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2,
 839                                            r->in.num_names);
 840         if (r->out.sids->sids == NULL) {
 841                 return NT_STATUS_NO_MEMORY;
 842         }
 843
 844         for (i=0;i<r->in.num_names;i++) {
 845                 const char *name = r->in.names[i].string;
 846                 const char *authority_name;
 847                 struct dom_sid *sid;
 848                 uint32_t rtype, sid_index;
 849                 NTSTATUS status2;
 850
 851                 r->out.sids->count++;
 852
 853                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
 854                 r->out.sids->sids[i].rid         = 0xFFFFFFFF;
 855                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
 856                 r->out.sids->sids[i].unknown     = 0;
 857
 858                 status2 = dcesrv_lsa_lookup_name(lp_ctx, state, mem_ctx, name,
 859                                                  &authority_name, &sid, &rtype);
 860                 if (!NT_STATUS_IS_OK(status2)) {
 861                         continue;
 862                 }
 863
 864                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name,
 865                                                     sid, r->out.domains, &sid_index);
 866                 if (!NT_STATUS_IS_OK(status2)) {
 867                         return status2;
 868                 }
 869
 870                 r->out.sids->sids[i].sid_type    = rtype;
 871                 r->out.sids->sids[i].rid         = sid->sub_auths[sid->num_auths-1];
 872                 r->out.sids->sids[i].sid_index   = sid_index;
 873                 r->out.sids->sids[i].unknown     = 0;
 874
 875                 (*r->out.count)++;
 876         }
 877
 878         if (*r->out.count == 0) {
 879                 return NT_STATUS_NONE_MAPPED;
 880         }
 881         if (*r->out.count != r->in.num_names) {
 882                 return STATUS_SOME_UNMAPPED;
 883         }
 884
 885         return NT_STATUS_OK;
 886 }
 887
 888 /*
 889   lsa_LookupNames
 890 */
 891 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 892                        struct lsa_LookupNames *r)
 893 {
 894         struct lsa_LookupNames2 r2;
 895         NTSTATUS status;
 896         int i;
 897
 898         r2.in.handle    = r->in.handle;
 899         r2.in.num_names = r->in.num_names;
 900         r2.in.names     = r->in.names;
 901         r2.in.sids      = NULL;
 902         r2.in.level     = r->in.level;
 903         r2.in.count     = r->in.count;
 904         r2.in.unknown1  = 0;
 905         r2.in.unknown2  = 0;
 906         r2.out.count    = r->out.count;
 907
 908         status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
 909         if (dce_call->fault_code != 0) {
 910                 return status;
 911         }
 912
 913         r->out.domains = r2.out.domains;
 914         r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
 915         if (r->out.sids == NULL) {
 916                 return NT_STATUS_NO_MEMORY;
 917         }
 918         r->out.sids->count = r2.out.sids->count;
 919         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid,
 920                                            r->out.sids->count);
 921         if (r->out.sids->sids == NULL) {
 922                 return NT_STATUS_NO_MEMORY;
 923         }
 924         for (i=0;i<r->out.sids->count;i++) {
 925                 r->out.sids->sids[i].sid_type    = r2.out.sids->sids[i].sid_type;
 926                 r->out.sids->sids[i].rid         = r2.out.sids->sids[i].rid;
 927                 r->out.sids->sids[i].sid_index   = r2.out.sids->sids[i].sid_index;
 928         }
 929
 930         return status;
 931 }
 932