/* This is the implementation of the lsa server code. */
#include "includes.h"
+#include "ntdomain.h"
#include "../librpc/gen_ndr/srv_lsa.h"
#include "secrets.h"
#include "../librpc/gen_ndr/netlogon.h"
#include "../librpc/gen_ndr/ndr_drsblobs.h"
#include "../lib/crypto/arcfour.h"
#include "../libcli/security/dom_sid.h"
+#include "../librpc/gen_ndr/ndr_security.h"
+#include "passdb.h"
+#include "auth.h"
+#include "lib/privileges.h"
+#include "rpc_server/srv_access_check.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_SRV
ref->count = num + 1;
ref->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER;
- ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
+ ref->domains = talloc_realloc(mem_ctx, ref->domains,
struct lsa_DomainInfo, ref->count);
if (!ref->domains) {
return -1;
int dom_idx;
const char *full_name;
const char *domain;
- enum lsa_SidType type = SID_NAME_UNKNOWN;
+ enum lsa_SidType type;
/* Split name into domain and user component */
DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
- /* We can ignore the result of lookup_name, it will not touch
- "type" if it's not successful */
-
- lookup_name(mem_ctx, full_name, flags, &domain, NULL,
- &sid, &type);
+ if (!lookup_name(mem_ctx, full_name, flags, &domain, NULL,
+ &sid, &type)) {
+ type = SID_NAME_UNKNOWN;
+ }
switch (type) {
case SID_NAME_USER:
int dom_idx;
const char *full_name;
const char *domain;
- enum lsa_SidType type = SID_NAME_UNKNOWN;
+ enum lsa_SidType type;
ZERO_STRUCT(sid);
DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
- /* We can ignore the result of lookup_name, it will not touch
- "type" if it's not successful */
-
- lookup_name(mem_ctx, full_name, flags, &domain, NULL,
- &sid, &type);
+ if (!lookup_name(mem_ctx, full_name, flags, &domain, NULL,
+ &sid, &type)) {
+ type = SID_NAME_UNKNOWN;
+ }
switch (type) {
case SID_NAME_USER:
NTSTATUS status;
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ &p->session_info->utok,
&des_access);
/* map the generic bits to the lsa policy ones */
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0, des_access,
&acc_granted, "_lsa_OpenPolicy2" );
if (!NT_STATUS_IS_OK(status)) {
return NT_STATUS_OK;
}
- sids = TALLOC_ARRAY(p->mem_ctx, const struct dom_sid *, num_sids);
+ sids = talloc_array(p->mem_ctx, const struct dom_sid *, num_sids);
ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
if (sids == NULL || ref == NULL) {
return status;
}
- names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
+ names = talloc_array(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
if (names == NULL) {
return NT_STATUS_NO_MEMORY;
}
struct lsa_name_info *name = &name_infos[i];
if (name->type == SID_NAME_UNKNOWN) {
- fstring tmp;
name->dom_idx = -1;
/* Unknown sids should return the string
* representation of the SID. Windows 2003 behaves
* RID as 8 bytes hex, in others it returns the full
* SID. We (Jerry/VL) could not figure out which the
* hard cases are, so leave it with the SID. */
- name->name = talloc_asprintf(p->mem_ctx, "%s",
- sid_to_fstring(tmp,
- sids[i]));
+ name->name = dom_sid_string(p->mem_ctx, sids[i]);
if (name->name == NULL) {
return NT_STATUS_NO_MEMORY;
}
}
/* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
- names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
+ names_out = talloc_array(p->mem_ctx, struct lsa_TranslatedName,
num_sids);
if (!names_out) {
return NT_STATUS_NO_MEMORY;
status = _lsa_LookupNames(p, &q);
sid_array2->count = sid_array->count;
- sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
+ sid_array2->sids = talloc_array(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
if (!sid_array2->sids) {
return NT_STATUS_NO_MEMORY;
}
* handle - so don't check against policy handle. */
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ &p->session_info->utok,
&access_mask);
/* map the generic bits to the lsa account ones */
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
access_mask, &acc_granted,
"_lsa_OpenTrustedDomain");
struct lsa_OpenTrustedDomain *r)
{
struct lsa_info *handle = NULL;
- struct trustdom_info *info;
+ struct trustdom_info *info = NULL;
NTSTATUS status;
if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
struct lsa_OpenTrustedDomainByName *r)
{
struct lsa_info *handle = NULL;
- struct trustdom_info *info;
+ struct trustdom_info *info = NULL;
NTSTATUS status;
if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
static NTSTATUS add_trusted_domain_user(TALLOC_CTX *mem_ctx,
const char *netbios_name,
const char *domain_name,
- struct trustDomainPasswords auth_struct)
+ const struct trustDomainPasswords *auth_struct)
{
NTSTATUS status;
struct samu *sam_acct;
return NT_STATUS_UNSUCCESSFUL;
}
- for (i = 0; i < auth_struct.incoming.count; i++) {
- switch (auth_struct.incoming.current.array[i].AuthType) {
+ for (i = 0; i < auth_struct->incoming.count; i++) {
+ switch (auth_struct->incoming.current.array[i].AuthType) {
case TRUST_AUTH_TYPE_CLEAR:
if (!convert_string_talloc(mem_ctx,
CH_UTF16LE,
CH_UNIX,
- auth_struct.incoming.current.array[i].AuthInfo.clear.password,
- auth_struct.incoming.current.array[i].AuthInfo.clear.size,
+ auth_struct->incoming.current.array[i].AuthInfo.clear.password,
+ auth_struct->incoming.current.array[i].AuthInfo.clear.size,
&dummy,
- &dummy_size,
- false)) {
+ &dummy_size)) {
return NT_STATUS_UNSUCCESSFUL;
}
if (!pdb_set_plaintext_passwd(sam_acct, dummy)) {
return NT_STATUS_ACCESS_DENIED;
}
- if (p->server_info->utok.uid != sec_initial_uid() &&
- !nt_token_check_domain_rid(p->server_info->security_token, DOMAIN_RID_ADMINS)) {
+ if (p->session_info->utok.uid != sec_initial_uid() &&
+ !nt_token_check_domain_rid(p->session_info->security_token, DOMAIN_RID_ADMINS)) {
return NT_STATUS_ACCESS_DENIED;
}
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ &p->session_info->utok,
&r->in.access_mask);
/* map the generic bits to the lsa policy ones */
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
r->in.access_mask, &acc_granted,
"_lsa_CreateTrustedDomainEx2");
auth_blob.data = r->in.auth_info->auth_blob.data;
arcfour_crypt_blob(auth_blob.data, auth_blob.length,
- &p->server_info->user_session_key);
+ &p->session_info->session_key);
ndr_err = ndr_pull_struct_blob(&auth_blob, p->mem_ctx,
&auth_struct,
status = add_trusted_domain_user(p->mem_ctx,
r->in.info->netbios_name.string,
r->in.info->domain_name.string,
- auth_struct);
+ &auth_struct);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
return NT_STATUS_INVALID_PARAMETER;
}
- if (p->server_info->guest) {
+ if (p->session_info->guest) {
/*
* I'm 99% sure this is not the right place to do this,
* global_sid_Anonymous should probably be put into the token
return NT_STATUS_NO_MEMORY;
}
} else {
- username = p->server_info->sanitized_username;
- domname = p->server_info->info3->base.domain.string;
+ username = p->session_info->sanitized_username;
+ domname = p->session_info->info3->base.domain.string;
}
account_name = TALLOC_P(p->mem_ctx, struct lsa_String);
}
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ &p->session_info->utok,
&r->in.access_mask);
/* map the generic bits to the lsa policy ones */
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0, r->in.access_mask,
&acc_granted, "_lsa_CreateAccount");
if (!NT_STATUS_IS_OK(status)) {
* handle - so don't check against policy handle. */
/* Work out max allowed. */
- map_max_allowed_access(p->server_info->security_token,
- &p->server_info->utok,
+ map_max_allowed_access(p->session_info->security_token,
+ &p->session_info->utok,
&des_access);
/* map the generic bits to the lsa account ones */
return status;
}
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0, des_access,
&acc_granted, "_lsa_OpenAccount" );
if (!NT_STATUS_IS_OK(status)) {
{
struct lsa_info *handle=NULL;
struct security_descriptor *psd = NULL;
- size_t sd_size;
+ size_t sd_size = 0;
NTSTATUS status;
/* find the connection policy handle. */
switch (handle->type) {
case LSA_HANDLE_POLICY_TYPE:
- status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
- &lsa_policy_mapping, NULL, 0);
- break;
case LSA_HANDLE_ACCOUNT_TYPE:
- status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
- &lsa_account_mapping,
- &handle->sid, LSA_ACCOUNT_ALL_ACCESS);
+ case LSA_HANDLE_TRUST_TYPE:
+ psd = handle->sd;
+ sd_size = ndr_size_security_descriptor(psd, 0);
+ status = NT_STATUS_OK;
break;
default:
status = NT_STATUS_INVALID_HANDLE;
* on the account sid. We don't check here so just use the latter. JRA.
*/
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
&acc_granted, "_lsa_AddAccountRights" );
* and DELETE on the account sid.
*/
- status = access_check_object(psd, p->server_info->security_token,
+ status = access_check_object(psd, p->session_info->security_token,
SEC_PRIV_INVALID, SEC_PRIV_INVALID, 0,
LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
LSA_ACCOUNT_VIEW|SEC_STD_DELETE,
int i;
NTSTATUS nt_status;
+ /* bail out early if pdb backend is not capable of ex trusted domains,
+ * if we dont do that, the client might not call
+ * _lsa_EnumTrustedDomains() afterwards - gd */
+
+ if (!(pdb_capabilities() & PDB_CAP_TRUSTED_DOMAINS_EX)) {
+ p->rng_fault_state = True;
+ return NT_STATUS_NOT_IMPLEMENTED;
+ }
+
if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
return NT_STATUS_INVALID_HANDLE;
int cret;
if (l1 == l2) {
- if (StrCaseCmp(s1, s2) == 0) {
+ if (strcasecmp_m(s1, s2) == 0) {
return DNS_CMP_MATCH;
}
return DNS_CMP_NO_MATCH;
return DNS_CMP_NO_MATCH;
}
- if (StrCaseCmp(&p1[t1 - t2], p2) == 0) {
+ if (strcasecmp_m(&p1[t1 - t2], p2) == 0) {
return cret;
}
ex_rule = false;
tname = trec->data.info.dns_name.string;
tlen = trec->data.info.dns_name.size;
+ break;
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
}
ret = dns_cmp(dns_name, dns_len, tname, tlen);
switch (ret) {
sid_conflict = true;
}
if (!(trec->flags & LSA_NB_DISABLED_ADMIN) &&
- StrCaseCmp(trec->data.info.netbios_name.string,
+ strcasecmp_m(trec->data.info.netbios_name.string,
nb_name) == 0) {
nb_conflict = true;
}
if (domains[i]->domain_name == NULL) {
return NT_STATUS_INVALID_DOMAIN_STATE;
}
- if (StrCaseCmp(domains[i]->domain_name,
+ if (strcasecmp_m(domains[i]->domain_name,
r->in.trusted_domain_name->string) == 0) {
break;
}
git.samba.org / samba.git / blobdiff