source3/winbindd/winbindd_samr.c

   1 /*
   2  * Unix SMB/CIFS implementation.
   3  *
   4  * Winbind rpc backend functions
   5  *
   6  * Copyright (c) 2000-2003 Tim Potter
   7  * Copyright (c) 2001      Andrew Tridgell
   8  * Copyright (c) 2005      Volker Lendecke
   9  * Copyright (c) 2008      Guenther Deschner (pidl conversion)
  10  * Copyright (c) 2010      Andreas Schneider <asn@samba.org>
  11  *
  12  * This program is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU General Public License as published by
  14  * the Free Software Foundation; either version 3 of the License, or
  15  * (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24  */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "winbindd_rpc.h"
  29
  30 #include "../librpc/gen_ndr/cli_samr.h"
  31 #include "rpc_client/cli_samr.h"
  32 #include "../librpc/gen_ndr/srv_samr.h"
  33 #include "../librpc/gen_ndr/cli_lsa.h"
  34 #include "rpc_client/cli_lsarpc.h"
  35 #include "../librpc/gen_ndr/srv_lsa.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_WINBIND
  39
  40 static NTSTATUS open_internal_samr_pipe(TALLOC_CTX *mem_ctx,
  41                                         struct rpc_pipe_client **samr_pipe)
  42 {
  43         struct rpc_pipe_client *cli = NULL;
  44         struct auth_serversupplied_info *server_info = NULL;
  45         NTSTATUS status;
  46
  47         if (cli != NULL) {
  48                 goto done;
  49         }
  50
  51         if (server_info == NULL) {
  52                 status = make_server_info_system(mem_ctx, &server_info);
  53                 if (!NT_STATUS_IS_OK(status)) {
  54                         DEBUG(0, ("open_samr_pipe: Could not create auth_serversupplied_info: %s\n",
  55                                   nt_errstr(status)));
  56                         return status;
  57                 }
  58         }
  59
  60         /* create a samr connection */
  61         status = rpc_pipe_open_internal(mem_ctx,
  62                                         &ndr_table_samr.syntax_id,
  63                                         server_info,
  64                                         &cli);
  65         if (!NT_STATUS_IS_OK(status)) {
  66                 DEBUG(0, ("open_samr_pipe: Could not connect to samr_pipe: %s\n",
  67                           nt_errstr(status)));
  68                 return status;
  69         }
  70
  71 done:
  72         if (samr_pipe) {
  73                 *samr_pipe = cli;
  74         }
  75
  76         return NT_STATUS_OK;
  77 }
  78
  79 NTSTATUS open_internal_samr_conn(TALLOC_CTX *mem_ctx,
  80                                  struct winbindd_domain *domain,
  81                                  struct rpc_pipe_client **samr_pipe,
  82                                  struct policy_handle *samr_domain_hnd)
  83 {
  84         NTSTATUS status;
  85         struct policy_handle samr_connect_hnd;
  86
  87         status = open_internal_samr_pipe(mem_ctx, samr_pipe);
  88         if (!NT_STATUS_IS_OK(status)) {
  89                 return status;
  90         }
  91
  92         status = rpccli_samr_Connect2((*samr_pipe),
  93                                       mem_ctx,
  94                                       (*samr_pipe)->desthost,
  95                                       SEC_FLAG_MAXIMUM_ALLOWED,
  96                                       &samr_connect_hnd);
  97         if (!NT_STATUS_IS_OK(status)) {
  98                 return status;
  99         }
 100
 101         status = rpccli_samr_OpenDomain((*samr_pipe),
 102                                         mem_ctx,
 103                                         &samr_connect_hnd,
 104                                         SEC_FLAG_MAXIMUM_ALLOWED,
 105                                         &domain->sid,
 106                                         samr_domain_hnd);
 107
 108         return status;
 109 }
 110
 111 static NTSTATUS open_internal_lsa_pipe(TALLOC_CTX *mem_ctx,
 112                                        struct rpc_pipe_client **lsa_pipe)
 113 {
 114         struct rpc_pipe_client *cli = NULL;
 115         struct auth_serversupplied_info *server_info = NULL;
 116         NTSTATUS status;
 117
 118         if (cli != NULL) {
 119                 goto done;
 120         }
 121
 122         if (server_info == NULL) {
 123                 status = make_server_info_system(mem_ctx, &server_info);
 124                 if (!NT_STATUS_IS_OK(status)) {
 125                         DEBUG(0, ("open_lsa_pipe: Could not create auth_serversupplied_info: %s\n",
 126                                   nt_errstr(status)));
 127                         return status;
 128                 }
 129         }
 130
 131         /* create a samr connection */
 132         status = rpc_pipe_open_internal(mem_ctx,
 133                                         &ndr_table_lsarpc.syntax_id,
 134                                         server_info,
 135                                         &cli);
 136         if (!NT_STATUS_IS_OK(status)) {
 137                 DEBUG(0, ("open_lsa_pipe: Could not connect to lsa_pipe: %s\n",
 138                           nt_errstr(status)));
 139                 return status;
 140         }
 141
 142 done:
 143         if (lsa_pipe) {
 144                 *lsa_pipe = cli;
 145         }
 146
 147         return NT_STATUS_OK;
 148 }
 149
 150 static NTSTATUS open_internal_lsa_conn(TALLOC_CTX *mem_ctx,
 151                                        struct rpc_pipe_client **lsa_pipe,
 152                                        struct policy_handle *lsa_hnd)
 153 {
 154         NTSTATUS status;
 155
 156         status = open_internal_lsa_pipe(mem_ctx, lsa_pipe);
 157         if (!NT_STATUS_IS_OK(status)) {
 158                 return status;
 159         }
 160
 161         status = rpccli_lsa_open_policy((*lsa_pipe),
 162                                         mem_ctx,
 163                                         true,
 164                                         SEC_FLAG_MAXIMUM_ALLOWED,
 165                                         lsa_hnd);
 166
 167         return status;
 168 }
 169
 170 /*********************************************************************
 171  SAM specific functions.
 172 *********************************************************************/
 173
 174 /* List all domain groups */
 175 static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
 176                                     TALLOC_CTX *mem_ctx,
 177                                     uint32_t *pnum_info,
 178                                     struct acct_info **pinfo)
 179 {
 180         struct rpc_pipe_client *samr_pipe;
 181         struct policy_handle dom_pol;
 182         struct acct_info *info = NULL;
 183         uint32_t num_info = 0;
 184         TALLOC_CTX *tmp_ctx;
 185         NTSTATUS status;
 186
 187         DEBUG(3,("sam_enum_dom_groups\n"));
 188
 189         ZERO_STRUCT(dom_pol);
 190
 191         if (pnum_info) {
 192                 *pnum_info = 0;
 193         }
 194
 195         tmp_ctx = talloc_stackframe();
 196         if (tmp_ctx == NULL) {
 197                 return NT_STATUS_NO_MEMORY;
 198         }
 199
 200         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 201         if (!NT_STATUS_IS_OK(status)) {
 202                 goto error;
 203         }
 204
 205         status = rpc_enum_dom_groups(tmp_ctx,
 206                                      samr_pipe,
 207                                      &dom_pol,
 208                                      &num_info,
 209                                      &info);
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 goto error;
 212         }
 213
 214         if (pnum_info) {
 215                 *pnum_info = num_info;
 216         }
 217
 218         if (pinfo) {
 219                 *pinfo = talloc_move(mem_ctx, &info);
 220         }
 221
 222 error:
 223         if (is_valid_policy_hnd(&dom_pol)) {
 224                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 225         }
 226         TALLOC_FREE(tmp_ctx);
 227         return status;
 228 }
 229
 230 /* Query display info for a domain */
 231 static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
 232                                     TALLOC_CTX *mem_ctx,
 233                                     uint32_t *pnum_info,
 234                                     struct wbint_userinfo **pinfo)
 235 {
 236         struct rpc_pipe_client *samr_pipe = NULL;
 237         struct policy_handle dom_pol;
 238         struct wbint_userinfo *info = NULL;
 239         uint32_t num_info = 0;
 240         TALLOC_CTX *tmp_ctx;
 241         NTSTATUS status;
 242
 243         DEBUG(3,("samr_query_user_list\n"));
 244
 245         ZERO_STRUCT(dom_pol);
 246
 247         if (pnum_info) {
 248                 *pnum_info = 0;
 249         }
 250
 251         tmp_ctx = talloc_stackframe();
 252         if (tmp_ctx == NULL) {
 253                 return NT_STATUS_NO_MEMORY;
 254         }
 255
 256         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 257         if (!NT_STATUS_IS_OK(status)) {
 258                 goto done;
 259         }
 260
 261         status = rpc_query_user_list(tmp_ctx,
 262                                      samr_pipe,
 263                                      &dom_pol,
 264                                      &domain->sid,
 265                                      &num_info,
 266                                      &info);
 267         if (!NT_STATUS_IS_OK(status)) {
 268                 goto done;
 269         }
 270
 271         if (pnum_info) {
 272                 *pnum_info = num_info;
 273         }
 274
 275         if (pinfo) {
 276                 *pinfo = talloc_move(mem_ctx, &info);
 277         }
 278
 279 done:
 280         if (is_valid_policy_hnd(&dom_pol)) {
 281                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 282         }
 283
 284         TALLOC_FREE(tmp_ctx);
 285         return status;
 286 }
 287
 288 /* Lookup user information from a rid or username. */
 289 static NTSTATUS sam_query_user(struct winbindd_domain *domain,
 290                                TALLOC_CTX *mem_ctx,
 291                                const struct dom_sid *user_sid,
 292                                struct wbint_userinfo *user_info)
 293 {
 294         struct rpc_pipe_client *samr_pipe;
 295         struct policy_handle dom_pol;
 296         TALLOC_CTX *tmp_ctx;
 297         NTSTATUS status;
 298
 299         DEBUG(3,("sam_query_user\n"));
 300
 301         ZERO_STRUCT(dom_pol);
 302
 303         /* Paranoia check */
 304         if (!sid_check_is_in_our_domain(user_sid)) {
 305                 return NT_STATUS_NO_SUCH_USER;
 306         }
 307
 308         if (user_info) {
 309                 user_info->homedir = NULL;
 310                 user_info->shell = NULL;
 311                 user_info->primary_gid = (gid_t) -1;
 312         }
 313
 314         tmp_ctx = talloc_stackframe();
 315         if (tmp_ctx == NULL) {
 316                 return NT_STATUS_NO_MEMORY;
 317         }
 318
 319         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 320         if (!NT_STATUS_IS_OK(status)) {
 321                 goto done;
 322         }
 323
 324         status = rpc_query_user(tmp_ctx,
 325                                 samr_pipe,
 326                                 &dom_pol,
 327                                 &domain->sid,
 328                                 user_sid,
 329                                 user_info);
 330
 331 done:
 332         if (is_valid_policy_hnd(&dom_pol)) {
 333                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 334         }
 335
 336         TALLOC_FREE(tmp_ctx);
 337         return status;
 338 }
 339
 340 /* get a list of trusted domains - builtin domain */
 341 static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 342                                     TALLOC_CTX *mem_ctx,
 343                                     struct netr_DomainTrustList *ptrust_list)
 344 {
 345         struct rpc_pipe_client *lsa_pipe;
 346         struct policy_handle lsa_policy;
 347         struct netr_DomainTrust *trusts = NULL;
 348         uint32_t num_trusts = 0;
 349         TALLOC_CTX *tmp_ctx;
 350         NTSTATUS status;
 351
 352         DEBUG(3,("samr: trusted domains\n"));
 353
 354         ZERO_STRUCT(lsa_policy);
 355
 356         if (ptrust_list) {
 357                 ZERO_STRUCTP(ptrust_list);
 358         }
 359
 360         tmp_ctx = talloc_stackframe();
 361         if (tmp_ctx == NULL) {
 362                 return NT_STATUS_NO_MEMORY;
 363         }
 364
 365         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 366         if (!NT_STATUS_IS_OK(status)) {
 367                 goto done;
 368         }
 369
 370         status = rpc_trusted_domains(tmp_ctx,
 371                                      lsa_pipe,
 372                                      &lsa_policy,
 373                                      &num_trusts,
 374                                      &trusts);
 375         if (!NT_STATUS_IS_OK(status)) {
 376                 goto done;
 377         }
 378
 379         if (ptrust_list) {
 380                 ptrust_list->count = num_trusts;
 381                 ptrust_list->array = talloc_move(mem_ctx, &trusts);
 382         }
 383
 384 done:
 385         if (is_valid_policy_hnd(&lsa_policy)) {
 386                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 387         }
 388
 389         TALLOC_FREE(tmp_ctx);
 390         return status;
 391 }
 392
 393 /* Lookup group membership given a rid.   */
 394 static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
 395                                     TALLOC_CTX *mem_ctx,
 396                                     const struct dom_sid *group_sid,
 397                                     enum lsa_SidType type,
 398                                     uint32_t *pnum_names,
 399                                     struct dom_sid **psid_mem,
 400                                     char ***pnames,
 401                                     uint32_t **pname_types)
 402 {
 403         struct rpc_pipe_client *samr_pipe;
 404         struct policy_handle dom_pol;
 405
 406         uint32_t num_names = 0;
 407         struct dom_sid *sid_mem = NULL;
 408         char **names = NULL;
 409         uint32_t *name_types = NULL;
 410
 411         TALLOC_CTX *tmp_ctx;
 412         NTSTATUS status;
 413
 414         DEBUG(3,("sam_lookup_groupmem\n"));
 415
 416         ZERO_STRUCT(dom_pol);
 417
 418         /* Paranoia check */
 419         if (sid_check_is_in_builtin(group_sid) && (type != SID_NAME_ALIAS)) {
 420                 /* There's no groups, only aliases in BUILTIN */
 421                 return NT_STATUS_NO_SUCH_GROUP;
 422         }
 423
 424         if (pnum_names) {
 425                 pnum_names = 0;
 426         }
 427
 428         tmp_ctx = talloc_stackframe();
 429         if (tmp_ctx == NULL) {
 430                 return NT_STATUS_NO_MEMORY;
 431         }
 432
 433         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 434         if (!NT_STATUS_IS_OK(status)) {
 435                 goto done;
 436         }
 437
 438         status = rpc_lookup_groupmem(tmp_ctx,
 439                                      samr_pipe,
 440                                      &dom_pol,
 441                                      domain->name,
 442                                      &domain->sid,
 443                                      group_sid,
 444                                      type,
 445                                      &num_names,
 446                                      &sid_mem,
 447                                      &names,
 448                                      &name_types);
 449
 450         if (pnum_names) {
 451                 *pnum_names = num_names;
 452         }
 453
 454         if (pnames) {
 455                 *pnames = talloc_move(mem_ctx, &names);
 456         }
 457
 458         if (pname_types) {
 459                 *pname_types = talloc_move(mem_ctx, &name_types);
 460         }
 461
 462         if (psid_mem) {
 463                 *psid_mem = talloc_move(mem_ctx, &sid_mem);
 464         }
 465
 466 done:
 467         if (is_valid_policy_hnd(&dom_pol)) {
 468                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 469         }
 470
 471         TALLOC_FREE(tmp_ctx);
 472         return status;
 473 }
 474
 475 /*********************************************************************
 476  BUILTIN specific functions.
 477 *********************************************************************/
 478
 479 /* List all domain groups */
 480 static NTSTATUS builtin_enum_dom_groups(struct winbindd_domain *domain,
 481                                 TALLOC_CTX *mem_ctx,
 482                                 uint32 *num_entries,
 483                                 struct acct_info **info)
 484 {
 485         /* BUILTIN doesn't have domain groups */
 486         *num_entries = 0;
 487         *info = NULL;
 488         return NT_STATUS_OK;
 489 }
 490
 491 /* Query display info for a domain */
 492 static NTSTATUS builtin_query_user_list(struct winbindd_domain *domain,
 493                                 TALLOC_CTX *mem_ctx,
 494                                 uint32 *num_entries,
 495                                 struct wbint_userinfo **info)
 496 {
 497         /* We don't have users */
 498         *num_entries = 0;
 499         *info = NULL;
 500         return NT_STATUS_OK;
 501 }
 502
 503 /* Lookup user information from a rid or username. */
 504 static NTSTATUS builtin_query_user(struct winbindd_domain *domain,
 505                                 TALLOC_CTX *mem_ctx,
 506                                 const struct dom_sid *user_sid,
 507                                 struct wbint_userinfo *user_info)
 508 {
 509         return NT_STATUS_NO_SUCH_USER;
 510 }
 511
 512 /* get a list of trusted domains - builtin domain */
 513 static NTSTATUS builtin_trusted_domains(struct winbindd_domain *domain,
 514                                         TALLOC_CTX *mem_ctx,
 515                                         struct netr_DomainTrustList *trusts)
 516 {
 517         ZERO_STRUCTP(trusts);
 518         return NT_STATUS_OK;
 519 }
 520
 521 /*********************************************************************
 522  COMMON functions.
 523 *********************************************************************/
 524
 525 /* List all local groups (aliases) */
 526 static NTSTATUS sam_enum_local_groups(struct winbindd_domain *domain,
 527                                       TALLOC_CTX *mem_ctx,
 528                                       uint32_t *pnum_info,
 529                                       struct acct_info **pinfo)
 530 {
 531         struct rpc_pipe_client *samr_pipe;
 532         struct policy_handle dom_pol;
 533         struct acct_info *info = NULL;
 534         uint32_t num_info = 0;
 535         TALLOC_CTX *tmp_ctx;
 536         NTSTATUS status;
 537
 538         DEBUG(3,("samr: enum local groups\n"));
 539
 540         ZERO_STRUCT(dom_pol);
 541
 542         if (pnum_info) {
 543                 *pnum_info = 0;
 544         }
 545
 546         tmp_ctx = talloc_stackframe();
 547         if (tmp_ctx == NULL) {
 548                 return NT_STATUS_NO_MEMORY;
 549         }
 550
 551         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 552         if (!NT_STATUS_IS_OK(status)) {
 553                 goto done;
 554         }
 555
 556         status = rpc_enum_local_groups(mem_ctx,
 557                                        samr_pipe,
 558                                        &dom_pol,
 559                                        &num_info,
 560                                        &info);
 561         if (!NT_STATUS_IS_OK(status)) {
 562                 goto done;
 563         }
 564
 565         if (pnum_info) {
 566                 *pnum_info = num_info;
 567         }
 568
 569         if (pinfo) {
 570                 *pinfo = talloc_move(mem_ctx, &info);
 571         }
 572
 573 done:
 574         if (is_valid_policy_hnd(&dom_pol)) {
 575                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 576         }
 577
 578         TALLOC_FREE(tmp_ctx);
 579         return status;
 580 }
 581
 582 /* convert a single name to a sid in a domain */
 583 static NTSTATUS sam_name_to_sid(struct winbindd_domain *domain,
 584                                    TALLOC_CTX *mem_ctx,
 585                                    const char *domain_name,
 586                                    const char *name,
 587                                    uint32_t flags,
 588                                    struct dom_sid *psid,
 589                                    enum lsa_SidType *ptype)
 590 {
 591         struct rpc_pipe_client *lsa_pipe;
 592         struct policy_handle lsa_policy;
 593         struct dom_sid sid;
 594         enum lsa_SidType type;
 595         TALLOC_CTX *tmp_ctx;
 596         NTSTATUS status;
 597
 598         DEBUG(3,("sam_name_to_sid\n"));
 599
 600         ZERO_STRUCT(lsa_policy);
 601
 602         tmp_ctx = talloc_stackframe();
 603         if (tmp_ctx == NULL) {
 604                 return NT_STATUS_NO_MEMORY;
 605         }
 606
 607         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 goto done;
 610         }
 611
 612         status = rpc_name_to_sid(tmp_ctx,
 613                                  lsa_pipe,
 614                                  &lsa_policy,
 615                                  domain_name,
 616                                  name,
 617                                  flags,
 618                                  &sid,
 619                                  &type);
 620         if (!NT_STATUS_IS_OK(status)) {
 621                 goto done;
 622         }
 623
 624         if (psid) {
 625                 sid_copy(psid, &sid);
 626         }
 627         if (ptype) {
 628                 *ptype = type;
 629         }
 630
 631 done:
 632         if (is_valid_policy_hnd(&lsa_policy)) {
 633                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 634         }
 635
 636         TALLOC_FREE(tmp_ctx);
 637         return status;
 638 }
 639
 640 /* convert a domain SID to a user or group name */
 641 static NTSTATUS sam_sid_to_name(struct winbindd_domain *domain,
 642                                 TALLOC_CTX *mem_ctx,
 643                                 const struct dom_sid *sid,
 644                                 char **pdomain_name,
 645                                 char **pname,
 646                                 enum lsa_SidType *ptype)
 647 {
 648         struct rpc_pipe_client *lsa_pipe;
 649         struct policy_handle lsa_policy;
 650         char *domain_name = NULL;
 651         char *name = NULL;
 652         enum lsa_SidType type;
 653         TALLOC_CTX *tmp_ctx;
 654         NTSTATUS status;
 655
 656         DEBUG(3,("sam_sid_to_name\n"));
 657
 658         ZERO_STRUCT(lsa_policy);
 659
 660         /* Paranoia check */
 661         if (!sid_check_is_in_builtin(sid) &&
 662             !sid_check_is_in_our_domain(sid) &&
 663             !sid_check_is_in_unix_users(sid) &&
 664             !sid_check_is_unix_users(sid) &&
 665             !sid_check_is_in_unix_groups(sid) &&
 666             !sid_check_is_unix_groups(sid) &&
 667             !sid_check_is_in_wellknown_domain(sid)) {
 668                 DEBUG(0, ("sam_sid_to_name: possible deadlock - trying to "
 669                           "lookup SID %s\n", sid_string_dbg(sid)));
 670                 return NT_STATUS_NONE_MAPPED;
 671         }
 672
 673         tmp_ctx = talloc_stackframe();
 674         if (tmp_ctx == NULL) {
 675                 return NT_STATUS_NO_MEMORY;
 676         }
 677
 678         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 679         if (!NT_STATUS_IS_OK(status)) {
 680                 goto done;
 681         }
 682
 683         status = rpc_sid_to_name(tmp_ctx,
 684                                  lsa_pipe,
 685                                  &lsa_policy,
 686                                  domain,
 687                                  sid,
 688                                  &domain_name,
 689                                  &name,
 690                                  &type);
 691
 692         if (ptype) {
 693                 *ptype = type;
 694         }
 695
 696         if (pname) {
 697                 *pname = talloc_move(mem_ctx, &name);
 698         }
 699
 700         if (pdomain_name) {
 701                 *pdomain_name = talloc_move(mem_ctx, &domain_name);
 702         }
 703
 704 done:
 705         if (is_valid_policy_hnd(&lsa_policy)) {
 706                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 707         }
 708
 709         TALLOC_FREE(tmp_ctx);
 710         return status;
 711 }
 712
 713 static NTSTATUS sam_rids_to_names(struct winbindd_domain *domain,
 714                                   TALLOC_CTX *mem_ctx,
 715                                   const struct dom_sid *sid,
 716                                   uint32 *rids,
 717                                   size_t num_rids,
 718                                   char **pdomain_name,
 719                                   char ***pnames,
 720                                   enum lsa_SidType **ptypes)
 721 {
 722         struct rpc_pipe_client *lsa_pipe;
 723         struct policy_handle lsa_policy;
 724         enum lsa_SidType *types = NULL;
 725         char *domain_name = NULL;
 726         char **names = NULL;
 727         TALLOC_CTX *tmp_ctx;
 728         NTSTATUS status;
 729
 730         DEBUG(3,("sam_rids_to_names for %s\n", domain->name));
 731
 732         ZERO_STRUCT(lsa_policy);
 733
 734         /* Paranoia check */
 735         if (!sid_check_is_in_builtin(sid) &&
 736             !sid_check_is_in_our_domain(sid) &&
 737             !sid_check_is_in_unix_users(sid) &&
 738             !sid_check_is_unix_users(sid) &&
 739             !sid_check_is_in_unix_groups(sid) &&
 740             !sid_check_is_unix_groups(sid) &&
 741             !sid_check_is_in_wellknown_domain(sid)) {
 742                 DEBUG(0, ("sam_rids_to_names: possible deadlock - trying to "
 743                           "lookup SID %s\n", sid_string_dbg(sid)));
 744                 return NT_STATUS_NONE_MAPPED;
 745         }
 746
 747         tmp_ctx = talloc_stackframe();
 748         if (tmp_ctx == NULL) {
 749                 return NT_STATUS_NO_MEMORY;
 750         }
 751
 752         status = open_internal_lsa_conn(tmp_ctx, &lsa_pipe, &lsa_policy);
 753         if (!NT_STATUS_IS_OK(status)) {
 754                 goto done;
 755         }
 756
 757         status = rpc_rids_to_names(tmp_ctx,
 758                                    lsa_pipe,
 759                                    &lsa_policy,
 760                                    domain,
 761                                    sid,
 762                                    rids,
 763                                    num_rids,
 764                                    &domain_name,
 765                                    &names,
 766                                    &types);
 767         if (!NT_STATUS_IS_OK(status)) {
 768                 goto done;
 769         }
 770
 771         if (pdomain_name) {
 772                 *pdomain_name = talloc_move(mem_ctx, &domain_name);
 773         }
 774
 775         if (ptypes) {
 776                 *ptypes = talloc_move(mem_ctx, &types);
 777         }
 778
 779         if (pnames) {
 780                 *pnames = talloc_move(mem_ctx, &names);
 781         }
 782
 783 done:
 784         if (is_valid_policy_hnd(&lsa_policy)) {
 785                 rpccli_lsa_Close(lsa_pipe, mem_ctx, &lsa_policy);
 786         }
 787
 788         TALLOC_FREE(tmp_ctx);
 789         return status;
 790 }
 791
 792 static NTSTATUS sam_lockout_policy(struct winbindd_domain *domain,
 793                                    TALLOC_CTX *mem_ctx,
 794                                    struct samr_DomInfo12 *lockout_policy)
 795 {
 796         struct rpc_pipe_client *samr_pipe;
 797         struct policy_handle dom_pol;
 798         union samr_DomainInfo *info = NULL;
 799         TALLOC_CTX *tmp_ctx;
 800         NTSTATUS status;
 801
 802         DEBUG(3,("sam_lockout_policy\n"));
 803
 804         ZERO_STRUCT(dom_pol);
 805
 806         tmp_ctx = talloc_stackframe();
 807         if (tmp_ctx == NULL) {
 808                 return NT_STATUS_NO_MEMORY;
 809         }
 810
 811         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 812         if (!NT_STATUS_IS_OK(status)) {
 813                 goto error;
 814         }
 815
 816         status = rpccli_samr_QueryDomainInfo(samr_pipe,
 817                                              mem_ctx,
 818                                              &dom_pol,
 819                                              12,
 820                                              &info);
 821         if (!NT_STATUS_IS_OK(status)) {
 822                 goto error;
 823         }
 824
 825         *lockout_policy = info->info12;
 826
 827 error:
 828         if (is_valid_policy_hnd(&dom_pol)) {
 829                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 830         }
 831
 832         TALLOC_FREE(tmp_ctx);
 833         return status;
 834 }
 835
 836 static NTSTATUS sam_password_policy(struct winbindd_domain *domain,
 837                                     TALLOC_CTX *mem_ctx,
 838                                     struct samr_DomInfo1 *passwd_policy)
 839 {
 840         struct rpc_pipe_client *samr_pipe;
 841         struct policy_handle dom_pol;
 842         union samr_DomainInfo *info = NULL;
 843         TALLOC_CTX *tmp_ctx;
 844         NTSTATUS status;
 845
 846         DEBUG(3,("sam_password_policy\n"));
 847
 848         ZERO_STRUCT(dom_pol);
 849
 850         tmp_ctx = talloc_stackframe();
 851         if (tmp_ctx == NULL) {
 852                 return NT_STATUS_NO_MEMORY;
 853         }
 854
 855         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 856         if (!NT_STATUS_IS_OK(status)) {
 857                 goto error;
 858         }
 859
 860         status = rpccli_samr_QueryDomainInfo(samr_pipe,
 861                                              mem_ctx,
 862                                              &dom_pol,
 863                                              1,
 864                                              &info);
 865         if (!NT_STATUS_IS_OK(status)) {
 866                 goto error;
 867         }
 868
 869         *passwd_policy = info->info1;
 870
 871 error:
 872         if (is_valid_policy_hnd(&dom_pol)) {
 873                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 874         }
 875
 876         TALLOC_FREE(tmp_ctx);
 877         return status;
 878 }
 879
 880 /* Lookup groups a user is a member of. */
 881 static NTSTATUS sam_lookup_usergroups(struct winbindd_domain *domain,
 882                                       TALLOC_CTX *mem_ctx,
 883                                       const struct dom_sid *user_sid,
 884                                       uint32_t *pnum_groups,
 885                                       struct dom_sid **puser_grpsids)
 886 {
 887         struct rpc_pipe_client *samr_pipe;
 888         struct policy_handle dom_pol;
 889         struct dom_sid *user_grpsids = NULL;
 890         uint32_t num_groups = 0;
 891         TALLOC_CTX *tmp_ctx;
 892         NTSTATUS status;
 893
 894         DEBUG(3,("sam_lookup_usergroups\n"));
 895
 896         ZERO_STRUCT(dom_pol);
 897
 898         if (pnum_groups) {
 899                 *pnum_groups = 0;
 900         }
 901
 902         tmp_ctx = talloc_stackframe();
 903         if (tmp_ctx == NULL) {
 904                 return NT_STATUS_NO_MEMORY;
 905         }
 906
 907         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 908         if (!NT_STATUS_IS_OK(status)) {
 909                 goto done;
 910         }
 911
 912         status = rpc_lookup_usergroups(tmp_ctx,
 913                                        samr_pipe,
 914                                        &dom_pol,
 915                                        &domain->sid,
 916                                        user_sid,
 917                                        &num_groups,
 918                                        &user_grpsids);
 919         if (!NT_STATUS_IS_OK(status)) {
 920                 goto done;
 921         }
 922
 923         if (pnum_groups) {
 924                 *pnum_groups = num_groups;
 925         }
 926
 927         if (puser_grpsids) {
 928                 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
 929         }
 930
 931 done:
 932         if (is_valid_policy_hnd(&dom_pol)) {
 933                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 934         }
 935
 936         TALLOC_FREE(tmp_ctx);
 937         return status;
 938 }
 939
 940 static NTSTATUS sam_lookup_useraliases(struct winbindd_domain *domain,
 941                                        TALLOC_CTX *mem_ctx,
 942                                        uint32_t num_sids,
 943                                        const struct dom_sid *sids,
 944                                        uint32_t *pnum_aliases,
 945                                        uint32_t **palias_rids)
 946 {
 947         struct rpc_pipe_client *samr_pipe;
 948         struct policy_handle dom_pol;
 949         uint32_t num_aliases = 0;
 950         uint32_t *alias_rids = NULL;
 951         TALLOC_CTX *tmp_ctx;
 952         NTSTATUS status;
 953
 954         DEBUG(3,("sam_lookup_useraliases\n"));
 955
 956         ZERO_STRUCT(dom_pol);
 957
 958         if (pnum_aliases) {
 959                 *pnum_aliases = 0;
 960         }
 961
 962         tmp_ctx = talloc_stackframe();
 963         if (tmp_ctx == NULL) {
 964                 return NT_STATUS_NO_MEMORY;
 965         }
 966
 967         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
 968         if (!NT_STATUS_IS_OK(status)) {
 969                 goto done;
 970         }
 971
 972         status = rpc_lookup_useraliases(tmp_ctx,
 973                                         samr_pipe,
 974                                         &dom_pol,
 975                                         num_sids,
 976                                         sids,
 977                                         &num_aliases,
 978                                         &alias_rids);
 979         if (!NT_STATUS_IS_OK(status)) {
 980                 goto done;
 981         }
 982
 983         if (pnum_aliases) {
 984                 *pnum_aliases = num_aliases;
 985         }
 986
 987         if (palias_rids) {
 988                 *palias_rids = talloc_move(mem_ctx, &alias_rids);
 989         }
 990
 991 done:
 992         if (is_valid_policy_hnd(&dom_pol)) {
 993                 rpccli_samr_Close(samr_pipe, mem_ctx, &dom_pol);
 994         }
 995
 996         TALLOC_FREE(tmp_ctx);
 997         return status;
 998 }
 999
1000 /* find the sequence number for a domain */
1001 static NTSTATUS sam_sequence_number(struct winbindd_domain *domain,
1002                                     uint32_t *pseq)
1003 {
1004         struct rpc_pipe_client *samr_pipe;
1005         struct policy_handle dom_pol;
1006         uint32_t seq;
1007         TALLOC_CTX *tmp_ctx;
1008         NTSTATUS status;
1009
1010         DEBUG(3,("samr: sequence number\n"));
1011
1012         ZERO_STRUCT(dom_pol);
1013
1014         if (pseq) {
1015                 *pseq = DOM_SEQUENCE_NONE;
1016         }
1017
1018         tmp_ctx = talloc_stackframe();
1019         if (tmp_ctx == NULL) {
1020                 return NT_STATUS_NO_MEMORY;
1021         }
1022
1023         status = open_internal_samr_conn(tmp_ctx, domain, &samr_pipe, &dom_pol);
1024         if (!NT_STATUS_IS_OK(status)) {
1025                 goto done;
1026         }
1027
1028         status = rpc_sequence_number(tmp_ctx,
1029                                      samr_pipe,
1030                                      &dom_pol,
1031                                      domain->name,
1032                                      &seq);
1033         if (!NT_STATUS_IS_OK(status)) {
1034                 goto done;
1035         }
1036
1037         if (pseq) {
1038                 *pseq = seq;
1039         }
1040 done:
1041         if (is_valid_policy_hnd(&dom_pol)) {
1042                 rpccli_samr_Close(samr_pipe, tmp_ctx, &dom_pol);
1043         }
1044
1045         TALLOC_FREE(tmp_ctx);
1046         return status;
1047 }
1048
1049 /* the rpc backend methods are exposed via this structure */
1050 struct winbindd_methods builtin_passdb_methods = {
1051         .consistent            = false,
1052
1053         .query_user_list       = builtin_query_user_list,
1054         .enum_dom_groups       = builtin_enum_dom_groups,
1055         .enum_local_groups     = sam_enum_local_groups,
1056         .name_to_sid           = sam_name_to_sid,
1057         .sid_to_name           = sam_sid_to_name,
1058         .rids_to_names         = sam_rids_to_names,
1059         .query_user            = builtin_query_user,
1060         .lookup_usergroups     = sam_lookup_usergroups,
1061         .lookup_useraliases    = sam_lookup_useraliases,
1062         .lookup_groupmem       = sam_lookup_groupmem,
1063         .sequence_number       = sam_sequence_number,
1064         .lockout_policy        = sam_lockout_policy,
1065         .password_policy       = sam_password_policy,
1066         .trusted_domains       = builtin_trusted_domains
1067 };
1068
1069 /* the rpc backend methods are exposed via this structure */
1070 struct winbindd_methods sam_passdb_methods = {
1071         .consistent            = false,
1072
1073         .query_user_list       = sam_query_user_list,
1074         .enum_dom_groups       = sam_enum_dom_groups,
1075         .enum_local_groups     = sam_enum_local_groups,
1076         .name_to_sid           = sam_name_to_sid,
1077         .sid_to_name           = sam_sid_to_name,
1078         .rids_to_names         = sam_rids_to_names,
1079         .query_user            = sam_query_user,
1080         .lookup_usergroups     = sam_lookup_usergroups,
1081         .lookup_useraliases    = sam_lookup_useraliases,
1082         .lookup_groupmem       = sam_lookup_groupmem,
1083         .sequence_number       = sam_sequence_number,
1084         .lockout_policy        = sam_lockout_policy,
1085         .password_policy       = sam_password_policy,
1086         .trusted_domains       = sam_trusted_domains
1087 };