source/rpc_server/srv_samr_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell                   1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton      1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997,
   7  *  Copyright (C) Marc Jacobsen                     1999,
   8  *  Copyright (C) Jeremy Allison                    2001-2002,
   9  *  Copyright (C) Jean François Micouleau          1998-2001,
  10  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
  11  *  Copyright (C) Gerald (Jerry) Carter             2003-2004,
  12  *
  13  *  This program is free software; you can redistribute it and/or modify
  14  *  it under the terms of the GNU General Public License as published by
  15  *  the Free Software Foundation; either version 2 of the License, or
  16  *  (at your option) any later version.
  17  *
  18  *  This program is distributed in the hope that it will be useful,
  19  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  *  GNU General Public License for more details.
  22  *
  23  *  You should have received a copy of the GNU General Public License
  24  *  along with this program; if not, write to the Free Software
  25  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  26  */
  27
  28 /*
  29  * This is the implementation of the SAMR code.
  30  */
  31
  32 #include "includes.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_RPC_SRV
  36
  37 #define SAMR_USR_RIGHTS_WRITE_PW \
  38                 ( READ_CONTROL_ACCESS           | \
  39                   SA_RIGHT_USER_CHANGE_PASSWORD | \
  40                   SA_RIGHT_USER_SET_LOC_COM )
  41
  42 extern rid_name domain_group_rids[];
  43 extern rid_name domain_alias_rids[];
  44 extern rid_name builtin_alias_rids[];
  45
  46 typedef struct disp_info {
  47         struct pdb_search *users;
  48         struct pdb_search *machines;
  49         struct pdb_search *groups;
  50         struct pdb_search *aliases;
  51         struct pdb_search *builtins;
  52 } DISP_INFO;
  53
  54 struct samr_info {
  55         /* for use by the \PIPE\samr policy */
  56         DOM_SID sid;
  57         uint32 status; /* some sort of flag.  best to record it.  comes from opnum 0x39 */
  58         uint32 acc_granted;
  59         uint16 acb_mask;
  60         BOOL only_machines;
  61         DISP_INFO disp_info;
  62
  63         TALLOC_CTX *mem_ctx;
  64 };
  65
  66 struct generic_mapping sam_generic_mapping = {GENERIC_RIGHTS_SAM_READ, GENERIC_RIGHTS_SAM_WRITE, GENERIC_RIGHTS_SAM_EXECUTE, GENERIC_RIGHTS_SAM_ALL_ACCESS};
  67 struct generic_mapping dom_generic_mapping = {GENERIC_RIGHTS_DOMAIN_READ, GENERIC_RIGHTS_DOMAIN_WRITE, GENERIC_RIGHTS_DOMAIN_EXECUTE, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
  68 struct generic_mapping usr_generic_mapping = {GENERIC_RIGHTS_USER_READ, GENERIC_RIGHTS_USER_WRITE, GENERIC_RIGHTS_USER_EXECUTE, GENERIC_RIGHTS_USER_ALL_ACCESS};
  69 struct generic_mapping grp_generic_mapping = {GENERIC_RIGHTS_GROUP_READ, GENERIC_RIGHTS_GROUP_WRITE, GENERIC_RIGHTS_GROUP_EXECUTE, GENERIC_RIGHTS_GROUP_ALL_ACCESS};
  70 struct generic_mapping ali_generic_mapping = {GENERIC_RIGHTS_ALIAS_READ, GENERIC_RIGHTS_ALIAS_WRITE, GENERIC_RIGHTS_ALIAS_EXECUTE, GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
  71
  72 /*******************************************************************
  73 *******************************************************************/
  74
  75 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
  76                                      struct generic_mapping *map,
  77                                      DOM_SID *sid, uint32 sid_access )
  78 {
  79         DOM_SID adm_sid, act_sid, domadmin_sid;
  80         SEC_ACE ace[5];         /* at most 5 entries */
  81         SEC_ACCESS mask;
  82         size_t i = 0;
  83
  84         SEC_ACL *psa = NULL;
  85
  86         /* basic access for Everyone */
  87
  88         init_sec_access(&mask, map->generic_execute | map->generic_read );
  89         init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
  90
  91         /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
  92
  93         sid_copy(&adm_sid, &global_sid_Builtin);
  94         sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
  95
  96         sid_copy(&act_sid, &global_sid_Builtin);
  97         sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
  98
  99         init_sec_access(&mask, map->generic_all);
 100
 101         init_sec_ace(&ace[i++], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 102         init_sec_ace(&ace[i++], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 103
 104         /* Add Full Access for Domain Admins if we are a DC */
 105
 106         if ( IS_DC ) {
 107                 sid_copy( &domadmin_sid, get_global_sam_sid() );
 108                 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
 109                 init_sec_ace(&ace[i++], &domadmin_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 110         }
 111
 112         /* if we have a sid, give it some special access */
 113
 114         if ( sid ) {
 115                 init_sec_access( &mask, sid_access );
 116                 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 117         }
 118
 119         /* create the security descriptor */
 120
 121         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
 122                 return NT_STATUS_NO_MEMORY;
 123
 124         if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
 125                 return NT_STATUS_NO_MEMORY;
 126
 127         return NT_STATUS_OK;
 128 }
 129
 130 /*******************************************************************
 131  Checks if access to an object should be granted, and returns that
 132  level of access for further checks.
 133 ********************************************************************/
 134
 135 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
 136                                           SE_PRIV *rights, uint32 rights_mask,
 137                                           uint32 des_access, uint32 *acc_granted,
 138                                           const char *debug )
 139 {
 140         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 141         uint32 saved_mask = 0;
 142
 143         /* check privileges; certain SAM access bits should be overridden
 144            by privileges (mostly having to do with creating/modifying/deleting
 145            users and groups) */
 146
 147         if ( rights && user_has_any_privilege( token, rights ) ) {
 148
 149                 saved_mask = (des_access & rights_mask);
 150                 des_access &= ~saved_mask;
 151
 152                 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
 153                         rights_mask));
 154         }
 155
 156
 157         /* check the security descriptor first */
 158
 159         if ( se_access_check(psd, token, des_access, acc_granted, &status) )
 160                 goto done;
 161
 162         /* give root a free pass */
 163
 164         if ( geteuid() == sec_initial_uid() ) {
 165
 166                 DEBUG(4,("%s: ACCESS should be DENIED  (requested: %#010x)\n", debug, des_access));
 167                 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
 168
 169                 *acc_granted = des_access;
 170
 171                 status = NT_STATUS_OK;
 172                 goto done;
 173         }
 174
 175
 176 done:
 177         /* add in any bits saved during the privilege check (only
 178            matters is status is ok) */
 179
 180         *acc_granted |= rights_mask;
 181
 182         DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
 183                 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
 184                 des_access, *acc_granted));
 185
 186         return status;
 187 }
 188
 189 /*******************************************************************
 190  Checks if access to a function can be granted
 191 ********************************************************************/
 192
 193 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
 194 {
 195         DEBUG(5,("%s: access check ((granted: %#010x;  required: %#010x)\n",
 196                 debug, acc_granted, acc_required));
 197
 198         /* check the security descriptor first */
 199
 200         if ( (acc_granted&acc_required) == acc_required )
 201                 return NT_STATUS_OK;
 202
 203         /* give root a free pass */
 204
 205         if (geteuid() == sec_initial_uid()) {
 206
 207                 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x;  required: %#010x)\n",
 208                         debug, acc_granted, acc_required));
 209                 DEBUGADD(4,("but overwritten by euid == 0\n"));
 210
 211                 return NT_STATUS_OK;
 212         }
 213
 214         DEBUG(2,("%s: ACCESS DENIED (granted: %#010x;  required: %#010x)\n",
 215                 debug, acc_granted, acc_required));
 216
 217         return NT_STATUS_ACCESS_DENIED;
 218 }
 219
 220
 221 /*******************************************************************
 222  Create a samr_info struct.
 223 ********************************************************************/
 224
 225 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
 226 {
 227         struct samr_info *info;
 228         fstring sid_str;
 229         TALLOC_CTX *mem_ctx;
 230
 231         if (psid) {
 232                 sid_to_string(sid_str, psid);
 233         } else {
 234                 fstrcpy(sid_str,"(NULL)");
 235         }
 236
 237         mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
 238
 239         if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL)
 240                 return NULL;
 241
 242         DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
 243         if (psid) {
 244                 sid_copy( &info->sid, psid);
 245         } else {
 246                 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
 247         }
 248         info->mem_ctx = mem_ctx;
 249         return info;
 250 }
 251
 252 /*******************************************************************
 253  Function to free the per handle data.
 254  ********************************************************************/
 255
 256 /*******************************************************************
 257  Function to free the per handle data.
 258  ********************************************************************/
 259
 260 static void free_samr_db(struct samr_info *info)
 261 {
 262         pdb_search_destroy(info->disp_info.users);
 263         info->disp_info.users = NULL;
 264         pdb_search_destroy(info->disp_info.machines);
 265         info->disp_info.machines = NULL;
 266         pdb_search_destroy(info->disp_info.groups);
 267         info->disp_info.groups = NULL;
 268         pdb_search_destroy(info->disp_info.aliases);
 269         info->disp_info.aliases = NULL;
 270         pdb_search_destroy(info->disp_info.builtins);
 271         info->disp_info.builtins = NULL;
 272 }
 273
 274 static void free_samr_info(void *ptr)
 275 {
 276         struct samr_info *info=(struct samr_info *) ptr;
 277
 278         free_samr_db(info);
 279         talloc_destroy(info->mem_ctx);
 280 }
 281
 282 /*******************************************************************
 283  Ensure password info is never given out. Paranioa... JRA.
 284  ********************************************************************/
 285
 286 static void samr_clear_sam_passwd(SAM_ACCOUNT *sam_pass)
 287 {
 288
 289         if (!sam_pass)
 290                 return;
 291
 292         /* These now zero out the old password */
 293
 294         pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
 295         pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
 296 }
 297
 298 static uint32 count_sam_users(struct disp_info *info, uint16 acct_flags)
 299 {
 300         struct samr_displayentry *entry;
 301         if (info->users == NULL)
 302                 info->users = pdb_search_users(acct_flags);
 303         if (info->users == NULL)
 304                 return 0;
 305         /* Fetch the last possible entry, thus trigger an enumeration */
 306         pdb_search_entries(info->users, 0xffffffff, 1, &entry);
 307         return info->users->num_entries;
 308 }
 309
 310 static uint32 count_sam_groups(struct disp_info *info)
 311 {
 312         struct samr_displayentry *entry;
 313         if (info->groups == NULL)
 314                 info->groups = pdb_search_groups();
 315         if (info->groups == NULL)
 316                 return 0;
 317         /* Fetch the last possible entry, thus trigger an enumeration */
 318         pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
 319         return info->groups->num_entries;
 320 }
 321
 322 /*******************************************************************
 323  _samr_close_hnd
 324  ********************************************************************/
 325
 326 NTSTATUS _samr_close_hnd(pipes_struct *p, SAMR_Q_CLOSE_HND *q_u, SAMR_R_CLOSE_HND *r_u)
 327 {
 328         r_u->status = NT_STATUS_OK;
 329
 330         /* close the policy handle */
 331         if (!close_policy_hnd(p, &q_u->pol))
 332                 return NT_STATUS_OBJECT_NAME_INVALID;
 333
 334         DEBUG(5,("samr_reply_close_hnd: %d\n", __LINE__));
 335
 336         return r_u->status;
 337 }
 338
 339 /*******************************************************************
 340  samr_reply_open_domain
 341  ********************************************************************/
 342
 343 NTSTATUS _samr_open_domain(pipes_struct *p, SAMR_Q_OPEN_DOMAIN *q_u, SAMR_R_OPEN_DOMAIN *r_u)
 344 {
 345         struct    samr_info *info;
 346         SEC_DESC *psd = NULL;
 347         uint32    acc_granted;
 348         uint32    des_access = q_u->flags;
 349         NTSTATUS  status;
 350         size_t sd_size;
 351         SE_PRIV se_rights;
 352
 353         r_u->status = NT_STATUS_OK;
 354
 355         /* find the connection policy handle. */
 356
 357         if ( !find_policy_by_hnd(p, &q_u->pol, (void**)&info) )
 358                 return NT_STATUS_INVALID_HANDLE;
 359
 360         status = access_check_samr_function( info->acc_granted,
 361                 SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_open_domain" );
 362
 363         if ( !NT_STATUS_IS_OK(status) )
 364                 return status;
 365
 366         /*check if access can be granted as requested by client. */
 367
 368         make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
 369         se_map_generic( &des_access, &dom_generic_mapping );
 370
 371         se_priv_copy( &se_rights, &se_machine_account );
 372         se_priv_add( &se_rights, &se_add_users );
 373
 374         status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
 375                 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
 376                 &acc_granted, "_samr_open_domain" );
 377
 378         if ( !NT_STATUS_IS_OK(status) )
 379                 return status;
 380
 381         /* associate the domain SID with the (unique) handle. */
 382         if ((info = get_samr_info_by_sid(&q_u->dom_sid.sid))==NULL)
 383                 return NT_STATUS_NO_MEMORY;
 384         info->acc_granted = acc_granted;
 385
 386         /* get a (unique) handle.  open a policy on it. */
 387         if (!create_policy_hnd(p, &r_u->domain_pol, free_samr_info, (void *)info))
 388                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 389
 390         DEBUG(5,("samr_open_domain: %d\n", __LINE__));
 391
 392         return r_u->status;
 393 }
 394
 395 /*******************************************************************
 396  _samr_get_usrdom_pwinfo
 397  ********************************************************************/
 398
 399 NTSTATUS _samr_get_usrdom_pwinfo(pipes_struct *p, SAMR_Q_GET_USRDOM_PWINFO *q_u, SAMR_R_GET_USRDOM_PWINFO *r_u)
 400 {
 401         struct samr_info *info = NULL;
 402
 403         r_u->status = NT_STATUS_OK;
 404
 405         /* find the policy handle.  open a policy on it. */
 406         if (!find_policy_by_hnd(p, &q_u->user_pol, (void **)&info))
 407                 return NT_STATUS_INVALID_HANDLE;
 408
 409         if (!sid_check_is_in_our_domain(&info->sid))
 410                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 411
 412         init_samr_r_get_usrdom_pwinfo(r_u, NT_STATUS_OK);
 413
 414         DEBUG(5,("_samr_get_usrdom_pwinfo: %d\n", __LINE__));
 415
 416         /*
 417          * NT sometimes return NT_STATUS_ACCESS_DENIED
 418          * I don't know yet why.
 419          */
 420
 421         return r_u->status;
 422 }
 423
 424
 425 /*******************************************************************
 426  _samr_set_sec_obj
 427  ********************************************************************/
 428
 429 NTSTATUS _samr_set_sec_obj(pipes_struct *p, SAMR_Q_SET_SEC_OBJ *q_u, SAMR_R_SET_SEC_OBJ *r_u)
 430 {
 431         DEBUG(0,("_samr_set_sec_obj: Not yet implemented!\n"));
 432         return NT_STATUS_NOT_IMPLEMENTED;
 433 }
 434
 435
 436 /*******************************************************************
 437 ********************************************************************/
 438
 439 static BOOL get_lsa_policy_samr_sid( pipes_struct *p, POLICY_HND *pol,
 440                                      DOM_SID *sid, uint32 *acc_granted)
 441 {
 442         struct samr_info *info = NULL;
 443
 444         /* find the policy handle.  open a policy on it. */
 445         if (!find_policy_by_hnd(p, pol, (void **)&info))
 446                 return False;
 447
 448         if (!info)
 449                 return False;
 450
 451         *sid = info->sid;
 452         *acc_granted = info->acc_granted;
 453         return True;
 454 }
 455
 456 /*******************************************************************
 457  _samr_query_sec_obj
 458  ********************************************************************/
 459
 460 NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_QUERY_SEC_OBJ *r_u)
 461 {
 462         DOM_SID pol_sid;
 463         fstring str_sid;
 464         SEC_DESC * psd = NULL;
 465         uint32 acc_granted;
 466         size_t sd_size;
 467
 468         r_u->status = NT_STATUS_OK;
 469
 470         /* Get the SID. */
 471         if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid, &acc_granted))
 472                 return NT_STATUS_INVALID_HANDLE;
 473
 474
 475
 476         DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 477
 478         /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
 479
 480         /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
 481         if (pol_sid.sid_rev_num == 0)
 482         {
 483                 DEBUG(5,("_samr_query_sec_obj: querying security on SAM\n"));
 484                 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
 485         }
 486         else if (sid_equal(&pol_sid,get_global_sam_sid()))  /* check if it is our domain SID */
 487
 488         {
 489                 DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 490                 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
 491         }
 492         else if (sid_equal(&pol_sid,&global_sid_Builtin)) /* check if it is the Builtin  Domain */
 493         {
 494                 /* TODO: Builtin probably needs a different SD with restricted write access*/
 495                 DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 496                 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
 497         }
 498         else if (sid_check_is_in_our_domain(&pol_sid) ||
 499                  sid_check_is_in_builtin(&pol_sid))
 500         {
 501                 /* TODO: different SDs have to be generated for aliases groups and users.
 502                          Currently all three get a default user SD  */
 503                 DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 504                 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
 505         }
 506         else return NT_STATUS_OBJECT_TYPE_MISMATCH;
 507
 508         if ((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
 509                 return NT_STATUS_NO_MEMORY;
 510
 511         if (NT_STATUS_IS_OK(r_u->status))
 512                 r_u->ptr = 1;
 513
 514         return r_u->status;
 515 }
 516
 517 /*******************************************************************
 518 makes a SAM_ENTRY / UNISTR2* structure from a user list.
 519 ********************************************************************/
 520
 521 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp,
 522                                          UNISTR2 **uni_name_pp,
 523                                          uint32 num_entries, uint32 start_idx,
 524                                          struct samr_displayentry *entries)
 525 {
 526         uint32 i;
 527         SAM_ENTRY *sam;
 528         UNISTR2 *uni_name;
 529
 530         *sam_pp = NULL;
 531         *uni_name_pp = NULL;
 532
 533         if (num_entries == 0)
 534                 return NT_STATUS_OK;
 535
 536         sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_entries);
 537
 538         uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_entries);
 539
 540         if (sam == NULL || uni_name == NULL) {
 541                 DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));
 542                 return NT_STATUS_NO_MEMORY;
 543         }
 544
 545         for (i = 0; i < num_entries; i++) {
 546                 UNISTR2 uni_temp_name;
 547                 /*
 548                  * usrmgr expects a non-NULL terminated string with
 549                  * trust relationships
 550                  */
 551                 if (entries[i].acct_flags & ACB_DOMTRUST) {
 552                         init_unistr2(&uni_temp_name, entries[i].account_name,
 553                                      UNI_FLAGS_NONE);
 554                 } else {
 555                         init_unistr2(&uni_temp_name, entries[i].account_name,
 556                                      UNI_STR_TERMINATE);
 557                 }
 558
 559                 init_sam_entry(&sam[i], &uni_temp_name, entries[i].rid);
 560                 copy_unistr2(&uni_name[i], &uni_temp_name);
 561         }
 562
 563         *sam_pp = sam;
 564         *uni_name_pp = uni_name;
 565         return NT_STATUS_OK;
 566 }
 567
 568 /*******************************************************************
 569  samr_reply_enum_dom_users
 570  ********************************************************************/
 571
 572 NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u,
 573                               SAMR_R_ENUM_DOM_USERS *r_u)
 574 {
 575         struct samr_info *info = NULL;
 576         int num_account;
 577         uint32 enum_context=q_u->start_idx;
 578         enum remote_arch_types ra_type = get_remote_arch();
 579         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
 580         uint32 max_entries = max_sam_entries;
 581         struct samr_displayentry *entries = NULL;
 582
 583         r_u->status = NT_STATUS_OK;
 584
 585         /* find the policy handle.  open a policy on it. */
 586         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 587                 return NT_STATUS_INVALID_HANDLE;
 588
 589         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
 590                                         SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
 591                                         "_samr_enum_dom_users"))) {
 592                 return r_u->status;
 593         }
 594
 595         DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
 596
 597         become_root();
 598         if (info->disp_info.users == NULL)
 599                 info->disp_info.users = pdb_search_users(q_u->acb_mask);
 600         if (info->disp_info.users == NULL)
 601                 return NT_STATUS_ACCESS_DENIED;
 602         num_account = pdb_search_entries(info->disp_info.users,
 603                                          enum_context, max_entries,
 604                                          &entries);
 605         unbecome_root();
 606
 607         if (num_account == 0) {
 608                 DEBUG(5, ("_samr_enum_dom_users: enumeration handle over "
 609                           "total entries\n"));
 610                 return NT_STATUS_OK;
 611         }
 612
 613         r_u->status = make_user_sam_entry_list(p->mem_ctx, &r_u->sam,
 614                                                &r_u->uni_acct_name,
 615                                                num_account, enum_context,
 616                                                entries);
 617
 618         if (!NT_STATUS_IS_OK(r_u->status))
 619                 return r_u->status;
 620
 621         if (max_entries <= num_account)
 622                 r_u->status = STATUS_MORE_ENTRIES;
 623
 624         DEBUG(5, ("_samr_enum_dom_users: %d\n", __LINE__));
 625
 626         init_samr_r_enum_dom_users(r_u, q_u->start_idx + num_account,
 627                                    num_account);
 628
 629         DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
 630
 631         return r_u->status;
 632 }
 633
 634 /*******************************************************************
 635 makes a SAM_ENTRY / UNISTR2* structure from a group list.
 636 ********************************************************************/
 637
 638 static void make_group_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp,
 639                                       UNISTR2 **uni_name_pp,
 640                                       uint32 num_sam_entries,
 641                                       struct samr_displayentry *entries)
 642 {
 643         uint32 i;
 644         SAM_ENTRY *sam;
 645         UNISTR2 *uni_name;
 646
 647         *sam_pp = NULL;
 648         *uni_name_pp = NULL;
 649
 650         if (num_sam_entries == 0)
 651                 return;
 652
 653         sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
 654         uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
 655
 656         if (sam == NULL || uni_name == NULL) {
 657                 DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
 658                 return;
 659         }
 660
 661         for (i = 0; i < num_sam_entries; i++) {
 662                 /*
 663                  * JRA. I think this should include the null. TNG does not.
 664                  */
 665                 init_unistr2(&uni_name[i], entries[i].account_name,
 666                              UNI_STR_TERMINATE);
 667                 init_sam_entry(&sam[i], &uni_name[i], entries[i].rid);
 668         }
 669
 670         *sam_pp = sam;
 671         *uni_name_pp = uni_name;
 672 }
 673
 674 /*******************************************************************
 675  samr_reply_enum_dom_groups
 676  ********************************************************************/
 677
 678 NTSTATUS _samr_enum_dom_groups(pipes_struct *p, SAMR_Q_ENUM_DOM_GROUPS *q_u, SAMR_R_ENUM_DOM_GROUPS *r_u)
 679 {
 680         struct samr_info *info = NULL;
 681         struct samr_displayentry *groups;
 682         uint32 num_groups;
 683
 684         r_u->status = NT_STATUS_OK;
 685
 686         /* find the policy handle.  open a policy on it. */
 687         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 688                 return NT_STATUS_INVALID_HANDLE;
 689
 690         r_u->status = access_check_samr_function(info->acc_granted,
 691                                                  SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
 692                                                  "_samr_enum_dom_groups");
 693         if (!NT_STATUS_IS_OK(r_u->status))
 694                 return r_u->status;
 695
 696         DEBUG(5,("samr_reply_enum_dom_groups: %d\n", __LINE__));
 697
 698         /* the domain group array is being allocated in the function below */
 699
 700         become_root();
 701         if (info->disp_info.groups == NULL)
 702                 info->disp_info.groups = pdb_search_groups();
 703         unbecome_root();
 704
 705         if (info->disp_info.groups == NULL)
 706                 return NT_STATUS_ACCESS_DENIED;
 707
 708         become_root();
 709         num_groups = pdb_search_entries(info->disp_info.groups, q_u->start_idx,
 710                                         MAX_SAM_ENTRIES, &groups);
 711         unbecome_root();
 712
 713         make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name,
 714                                   num_groups, groups);
 715
 716         init_samr_r_enum_dom_groups(r_u, q_u->start_idx, num_groups);
 717
 718         DEBUG(5,("samr_enum_dom_groups: %d\n", __LINE__));
 719
 720         return r_u->status;
 721 }
 722
 723 /*******************************************************************
 724  samr_reply_enum_dom_aliases
 725  ********************************************************************/
 726
 727 NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, SAMR_R_ENUM_DOM_ALIASES *r_u)
 728 {
 729         struct samr_info *info;
 730         struct samr_displayentry *aliases;
 731         struct pdb_search **search = NULL;
 732         uint32 num_aliases = 0;
 733         NTSTATUS status;
 734
 735         r_u->status = NT_STATUS_OK;
 736
 737         /* find the policy handle.  open a policy on it. */
 738         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 739                 return NT_STATUS_INVALID_HANDLE;
 740
 741         r_u->status = access_check_samr_function(info->acc_granted,
 742                                                  SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
 743                                                  "_samr_enum_dom_aliases");
 744         if (!NT_STATUS_IS_OK(r_u->status))
 745                 return r_u->status;
 746
 747         DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n",
 748                  sid_string_static(&info->sid)));
 749
 750         if (sid_check_is_domain(&info->sid))
 751                 search = &info->disp_info.aliases;
 752         if (sid_check_is_builtin(&info->sid))
 753                 search = &info->disp_info.builtins;
 754
 755         if (search == NULL) return NT_STATUS_INVALID_HANDLE;
 756
 757         become_root();
 758         if (*search == NULL)
 759                 *search = pdb_search_aliases(&info->sid);
 760         unbecome_root();
 761
 762         if (*search == NULL) return NT_STATUS_ACCESS_DENIED;
 763
 764         become_root();
 765         num_aliases = pdb_search_entries(*search, q_u->start_idx,
 766                                          MAX_SAM_ENTRIES, &aliases);
 767         unbecome_root();
 768
 769         make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name,
 770                                   num_aliases, aliases);
 771
 772         if (!NT_STATUS_IS_OK(status)) return status;
 773
 774         init_samr_r_enum_dom_aliases(r_u, q_u->start_idx + num_aliases,
 775                                      num_aliases);
 776
 777         DEBUG(5,("samr_enum_dom_aliases: %d\n", __LINE__));
 778
 779         return r_u->status;
 780 }
 781
 782 /*******************************************************************
 783  samr_reply_query_dispinfo
 784  ********************************************************************/
 785
 786 NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
 787                               SAMR_R_QUERY_DISPINFO *r_u)
 788 {
 789         struct samr_info *info = NULL;
 790         uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
 791
 792         uint32 max_entries=q_u->max_entries;
 793         uint32 enum_context=q_u->start_idx;
 794         uint32 max_size=q_u->max_size;
 795
 796         SAM_DISPINFO_CTR *ctr;
 797         uint32 temp_size=0, total_data_size=0;
 798         NTSTATUS disp_ret;
 799         uint32 num_account = 0;
 800         enum remote_arch_types ra_type = get_remote_arch();
 801         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
 802         DOM_SID domain_sid;
 803         struct samr_displayentry *entries = NULL;
 804
 805         DEBUG(5, ("samr_reply_query_dispinfo: %d\n", __LINE__));
 806         r_u->status = NT_STATUS_OK;
 807
 808         /* find the policy handle.  open a policy on it. */
 809         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
 810                 return NT_STATUS_INVALID_HANDLE;
 811
 812         domain_sid = info->sid;
 813
 814         /*
 815          * calculate how many entries we will return.
 816          * based on
 817          * - the number of entries the client asked
 818          * - our limit on that
 819          * - the starting point (enumeration context)
 820          * - the buffer size the client will accept
 821          */
 822
 823         /*
 824          * We are a lot more like W2K. Instead of reading the SAM
 825          * each time to find the records we need to send back,
 826          * we read it once and link that copy to the sam handle.
 827          * For large user list (over the MAX_SAM_ENTRIES)
 828          * it's a definitive win.
 829          * second point to notice: between enumerations
 830          * our sam is now the same as it's a snapshoot.
 831          * third point: got rid of the static SAM_USER_21 struct
 832          * no more intermediate.
 833          * con: it uses much more memory, as a full copy is stored
 834          * in memory.
 835          *
 836          * If you want to change it, think twice and think
 837          * of the second point , that's really important.
 838          *
 839          * JFM, 12/20/2001
 840          */
 841
 842         if ((q_u->switch_level < 1) || (q_u->switch_level > 5)) {
 843                 DEBUG(0,("_samr_query_dispinfo: Unknown info level (%u)\n",
 844                          (unsigned int)q_u->switch_level ));
 845                 return NT_STATUS_INVALID_INFO_CLASS;
 846         }
 847
 848         /* first limit the number of entries we will return */
 849         if(max_entries > max_sam_entries) {
 850                 DEBUG(5, ("samr_reply_query_dispinfo: client requested %d "
 851                           "entries, limiting to %d\n", max_entries,
 852                           max_sam_entries));
 853                 max_entries = max_sam_entries;
 854         }
 855
 856         /* calculate the size and limit on the number of entries we will
 857          * return */
 858
 859         temp_size=max_entries*struct_size;
 860
 861         if (temp_size>max_size) {
 862                 max_entries=MIN((max_size/struct_size),max_entries);;
 863                 DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to "
 864                           "only %d entries\n", max_entries));
 865         }
 866
 867         if (!(ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_DISPINFO_CTR)))
 868                 return NT_STATUS_NO_MEMORY;
 869
 870         ZERO_STRUCTP(ctr);
 871
 872         become_root();
 873
 874         switch (q_u->switch_level) {
 875         case 0x1:
 876         case 0x4:
 877                 if (info->disp_info.users == NULL)
 878                         info->disp_info.users = pdb_search_users(ACB_NORMAL);
 879                 if (info->disp_info.users == NULL)
 880                         return NT_STATUS_ACCESS_DENIED;
 881                 num_account = pdb_search_entries(info->disp_info.users,
 882                                                  enum_context, max_entries,
 883                                                  &entries);
 884                 break;
 885         case 0x2:
 886                 if (info->disp_info.machines == NULL)
 887                         info->disp_info.machines =
 888                                 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
 889                 if (info->disp_info.machines == NULL)
 890                         return NT_STATUS_ACCESS_DENIED;
 891                 num_account = pdb_search_entries(info->disp_info.machines,
 892                                                  enum_context, max_entries,
 893                                                  &entries);
 894                 break;
 895         case 0x3:
 896         case 0x5:
 897                 if (info->disp_info.groups == NULL)
 898                         info->disp_info.groups = pdb_search_groups();
 899                 if (info->disp_info.groups == NULL)
 900                         return NT_STATUS_ACCESS_DENIED;
 901                 num_account = pdb_search_entries(info->disp_info.groups,
 902                                                  enum_context, max_entries,
 903                                                  &entries);
 904                 break;
 905         default:
 906                 smb_panic("info class changed");
 907                 break;
 908         }
 909         unbecome_root();
 910
 911         /* Now create reply structure */
 912         switch (q_u->switch_level) {
 913         case 0x1:
 914                 disp_ret = init_sam_dispinfo_1(p->mem_ctx, &ctr->sam.info1,
 915                                                num_account, enum_context,
 916                                                entries);
 917                 break;
 918         case 0x2:
 919                 disp_ret = init_sam_dispinfo_2(p->mem_ctx, &ctr->sam.info2,
 920                                                num_account, enum_context,
 921                                                entries);
 922                 break;
 923         case 0x3:
 924                 disp_ret = init_sam_dispinfo_3(p->mem_ctx, &ctr->sam.info3,
 925                                                num_account, enum_context,
 926                                                entries);
 927                 break;
 928         case 0x4:
 929                 disp_ret = init_sam_dispinfo_4(p->mem_ctx, &ctr->sam.info4,
 930                                                num_account, enum_context,
 931                                                entries);
 932                 break;
 933         case 0x5:
 934                 disp_ret = init_sam_dispinfo_5(p->mem_ctx, &ctr->sam.info5,
 935                                                num_account, enum_context,
 936                                                entries);
 937                 break;
 938         default:
 939                 smb_panic("info class changed");
 940                 break;
 941         }
 942
 943         if (!NT_STATUS_IS_OK(disp_ret))
 944                 return disp_ret;
 945
 946         /* calculate the total size */
 947         total_data_size=num_account*struct_size;
 948
 949         if (enum_context+max_entries < num_account)
 950                 r_u->status = STATUS_MORE_ENTRIES;
 951
 952         DEBUG(5, ("_samr_query_dispinfo: %d\n", __LINE__));
 953
 954         init_samr_r_query_dispinfo(r_u, num_account, total_data_size,
 955                                    temp_size, q_u->switch_level, ctr,
 956                                    r_u->status);
 957
 958         return r_u->status;
 959
 960 }
 961
 962 /*******************************************************************
 963  samr_reply_query_aliasinfo
 964  ********************************************************************/
 965
 966 NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAMR_R_QUERY_ALIASINFO *r_u)
 967 {
 968         DOM_SID   sid;
 969         struct acct_info info;
 970         uint32    acc_granted;
 971         BOOL ret;
 972
 973         r_u->status = NT_STATUS_OK;
 974
 975         DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
 976
 977         /* find the policy handle.  open a policy on it. */
 978         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
 979                 return NT_STATUS_INVALID_HANDLE;
 980         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
 981                 return r_u->status;
 982         }
 983
 984         become_root();
 985         ret = pdb_get_aliasinfo(&sid, &info);
 986         unbecome_root();
 987
 988         if ( !ret )
 989                 return NT_STATUS_NO_SUCH_ALIAS;
 990
 991         switch (q_u->switch_level) {
 992         case 1:
 993                 r_u->ptr = 1;
 994                 r_u->ctr.switch_value1 = 1;
 995                 init_samr_alias_info1(&r_u->ctr.alias.info1,
 996                                       info.acct_name, 1, info.acct_desc);
 997                 break;
 998         case 3:
 999                 r_u->ptr = 1;
1000                 r_u->ctr.switch_value1 = 3;
1001                 init_samr_alias_info3(&r_u->ctr.alias.info3, info.acct_desc);
1002                 break;
1003         default:
1004                 return NT_STATUS_INVALID_INFO_CLASS;
1005         }
1006
1007         DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1008
1009         return r_u->status;
1010 }
1011
1012 #if 0
1013 /*******************************************************************
1014  samr_reply_lookup_ids
1015  ********************************************************************/
1016
1017  uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
1018 {
1019     uint32 rid[MAX_SAM_ENTRIES];
1020     int num_rids = q_u->num_sids1;
1021
1022     r_u->status = NT_STATUS_OK;
1023
1024     DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1025
1026     if (num_rids > MAX_SAM_ENTRIES) {
1027         num_rids = MAX_SAM_ENTRIES;
1028         DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
1029     }
1030
1031 #if 0
1032     int i;
1033     SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
1034
1035     for (i = 0; i < num_rids && status == 0; i++)
1036     {
1037         struct sam_passwd *sam_pass;
1038         fstring user_name;
1039
1040
1041         fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
1042                                     q_u->uni_user_name[i].uni_str_len));
1043
1044         /* find the user account */
1045         become_root();
1046         sam_pass = get_smb21pwd_entry(user_name, 0);
1047         unbecome_root();
1048
1049         if (sam_pass == NULL)
1050         {
1051             status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
1052             rid[i] = 0;
1053         }
1054         else
1055         {
1056             rid[i] = sam_pass->user_rid;
1057         }
1058     }
1059 #endif
1060
1061     num_rids = 1;
1062     rid[0] = BUILTIN_ALIAS_RID_USERS;
1063
1064     init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
1065
1066     DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1067
1068     return r_u->status;
1069 }
1070 #endif
1071
1072 /*******************************************************************
1073  _samr_lookup_names
1074  ********************************************************************/
1075
1076 NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LOOKUP_NAMES *r_u)
1077 {
1078         uint32 rid[MAX_SAM_ENTRIES];
1079         uint32 local_rid;
1080         enum SID_NAME_USE type[MAX_SAM_ENTRIES];
1081         enum SID_NAME_USE local_type;
1082         int i;
1083         int num_rids = q_u->num_names2;
1084         DOM_SID pol_sid;
1085         fstring sid_str;
1086         uint32  acc_granted;
1087
1088         r_u->status = NT_STATUS_OK;
1089
1090         DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1091
1092         ZERO_ARRAY(rid);
1093         ZERO_ARRAY(type);
1094
1095         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted)) {
1096                 init_samr_r_lookup_names(p->mem_ctx, r_u, 0, NULL, NULL, NT_STATUS_OBJECT_TYPE_MISMATCH);
1097                 return r_u->status;
1098         }
1099
1100         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, 0, "_samr_lookup_names"))) { /* Don't know the acc_bits yet */
1101                 return r_u->status;
1102         }
1103
1104         if (num_rids > MAX_SAM_ENTRIES) {
1105                 num_rids = MAX_SAM_ENTRIES;
1106                 DEBUG(5,("_samr_lookup_names: truncating entries to %d\n", num_rids));
1107         }
1108
1109         DEBUG(5,("_samr_lookup_names: looking name on SID %s\n", sid_to_string(sid_str, &pol_sid)));
1110
1111         for (i = 0; i < num_rids; i++) {
1112                 fstring name;
1113                 DOM_SID sid;
1114                 int ret;
1115
1116                 r_u->status = NT_STATUS_NONE_MAPPED;
1117
1118                 rid [i] = 0xffffffff;
1119                 type[i] = SID_NAME_UNKNOWN;
1120
1121                 ret = rpcstr_pull(name, q_u->uni_name[i].buffer, sizeof(name), q_u->uni_name[i].uni_str_len*2, 0);
1122
1123                 /*
1124                  * we are only looking for a name
1125                  * the SID we get back can be outside
1126                  * the scope of the pol_sid
1127                  *
1128                  * in clear: it prevents to reply to domain\group: yes
1129                  * when only builtin\group exists.
1130                  *
1131                  * a cleaner code is to add the sid of the domain we're looking in
1132                  * to the local_lookup_name function.
1133                  */
1134
1135                 if ((ret > 0) && local_lookup_name(name, &sid, &local_type)) {
1136                         sid_split_rid(&sid, &local_rid);
1137
1138                         if (sid_equal(&sid, &pol_sid)) {
1139                                 rid[i]=local_rid;
1140
1141                                 /* Windows does not return WKN_GRP here, even
1142                                  * on lookups in builtin */
1143                                 type[i] = (local_type == SID_NAME_WKN_GRP) ?
1144                                         SID_NAME_ALIAS : local_type;
1145
1146                                 r_u->status = NT_STATUS_OK;
1147                         }
1148                 }
1149         }
1150
1151         init_samr_r_lookup_names(p->mem_ctx, r_u, num_rids, rid, (uint32 *)type, r_u->status);
1152
1153         DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1154
1155         return r_u->status;
1156 }
1157
1158 /*******************************************************************
1159  _samr_chgpasswd_user
1160  ********************************************************************/
1161
1162 NTSTATUS _samr_chgpasswd_user(pipes_struct *p, SAMR_Q_CHGPASSWD_USER *q_u, SAMR_R_CHGPASSWD_USER *r_u)
1163 {
1164         fstring user_name;
1165         fstring wks;
1166
1167         DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1168
1169         r_u->status = NT_STATUS_OK;
1170
1171         rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0);
1172         rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0);
1173
1174         DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name, wks));
1175
1176         /*
1177          * Pass the user through the NT -> unix user mapping
1178          * function.
1179          */
1180
1181         (void)map_username(user_name);
1182
1183         /*
1184          * UNIX username case mangling not required, pass_oem_change
1185          * is case insensitive.
1186          */
1187
1188         r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash,
1189                                 q_u->nt_newpass.pass, q_u->nt_oldhash.hash);
1190
1191         init_samr_r_chgpasswd_user(r_u, r_u->status);
1192
1193         DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1194
1195         return r_u->status;
1196 }
1197
1198 /*******************************************************************
1199 makes a SAMR_R_LOOKUP_RIDS structure.
1200 ********************************************************************/
1201
1202 static BOOL make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
1203                                   const char **names, UNIHDR **pp_hdr_name,
1204                                   UNISTR2 **pp_uni_name)
1205 {
1206         uint32 i;
1207         UNIHDR *hdr_name=NULL;
1208         UNISTR2 *uni_name=NULL;
1209
1210         *pp_uni_name = NULL;
1211         *pp_hdr_name = NULL;
1212
1213         if (num_names != 0) {
1214                 hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR, num_names);
1215                 if (hdr_name == NULL)
1216                         return False;
1217
1218                 uni_name = TALLOC_ZERO_ARRAY(ctx,UNISTR2, num_names);
1219                 if (uni_name == NULL)
1220                         return False;
1221         }
1222
1223         for (i = 0; i < num_names; i++) {
1224                 DEBUG(10, ("names[%d]:%s\n", i, *names[i] ? names[i] : ""));
1225                 init_unistr2(&uni_name[i], names[i], UNI_FLAGS_NONE);
1226                 init_uni_hdr(&hdr_name[i], &uni_name[i]);
1227         }
1228
1229         *pp_uni_name = uni_name;
1230         *pp_hdr_name = hdr_name;
1231
1232         return True;
1233 }
1234
1235 /*******************************************************************
1236  _samr_lookup_rids
1237  ********************************************************************/
1238
1239 NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOKUP_RIDS *r_u)
1240 {
1241         const char **names;
1242         uint32 *attrs = NULL;
1243         UNIHDR *hdr_name = NULL;
1244         UNISTR2 *uni_name = NULL;
1245         DOM_SID pol_sid;
1246         int num_rids = q_u->num_rids1;
1247         uint32 acc_granted;
1248
1249         r_u->status = NT_STATUS_OK;
1250
1251         DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1252
1253         /* find the policy handle.  open a policy on it. */
1254         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted))
1255                 return NT_STATUS_INVALID_HANDLE;
1256
1257         if (num_rids > 1000) {
1258                 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
1259                           "to samba4 idl this is not possible\n", num_rids));
1260                 return NT_STATUS_UNSUCCESSFUL;
1261         }
1262
1263         names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
1264         attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
1265
1266         if ((num_rids != 0) && ((names == NULL) || (attrs == NULL)))
1267                 return NT_STATUS_NO_MEMORY;
1268
1269         if (!sid_equal(&pol_sid, get_global_sam_sid())) {
1270                 /* TODO: Sooner or later we need to look up BUILTIN rids as
1271                  * well. -- vl */
1272                 goto done;
1273         }
1274
1275         become_root();  /* lookup_sid can require root privs */
1276         r_u->status = pdb_lookup_rids(p->mem_ctx, &pol_sid, num_rids, q_u->rid,
1277                                       &names, &attrs);
1278         unbecome_root();
1279
1280  done:
1281
1282         if(!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
1283                                   &hdr_name, &uni_name))
1284                 return NT_STATUS_NO_MEMORY;
1285
1286         init_samr_r_lookup_rids(r_u, num_rids, hdr_name, uni_name, attrs);
1287
1288         DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1289
1290         return r_u->status;
1291 }
1292
1293 /*******************************************************************
1294  _samr_open_user. Safe - gives out no passwd info.
1295  ********************************************************************/
1296
1297 NTSTATUS _samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN_USER *r_u)
1298 {
1299         SAM_ACCOUNT *sampass=NULL;
1300         DOM_SID sid;
1301         POLICY_HND domain_pol = q_u->domain_pol;
1302         POLICY_HND *user_pol = &r_u->user_pol;
1303         struct samr_info *info = NULL;
1304         SEC_DESC *psd = NULL;
1305         uint32    acc_granted;
1306         uint32    des_access = q_u->access_mask;
1307         size_t    sd_size;
1308         BOOL ret;
1309         NTSTATUS nt_status;
1310         SE_PRIV se_rights;
1311
1312         r_u->status = NT_STATUS_OK;
1313
1314         /* find the domain policy handle and get domain SID / access bits in the domain policy. */
1315
1316         if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted) )
1317                 return NT_STATUS_INVALID_HANDLE;
1318
1319         nt_status = access_check_samr_function( acc_granted,
1320                 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_user" );
1321
1322         if ( !NT_STATUS_IS_OK(nt_status) )
1323                 return nt_status;
1324
1325         nt_status = pdb_init_sam_talloc(p->mem_ctx, &sampass);
1326
1327         if (!NT_STATUS_IS_OK(nt_status))
1328                 return nt_status;
1329
1330         /* append the user's RID to it */
1331
1332         if (!sid_append_rid(&sid, q_u->user_rid))
1333                 return NT_STATUS_NO_SUCH_USER;
1334
1335         /* check if access can be granted as requested by client. */
1336
1337         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
1338         se_map_generic(&des_access, &usr_generic_mapping);
1339
1340         se_priv_copy( &se_rights, &se_machine_account );
1341         se_priv_add( &se_rights, &se_add_users );
1342
1343         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
1344                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
1345                 &acc_granted, "_samr_open_user");
1346
1347         if ( !NT_STATUS_IS_OK(nt_status) )
1348                 return nt_status;
1349
1350         become_root();
1351         ret=pdb_getsampwsid(sampass, &sid);
1352         unbecome_root();
1353
1354         /* check that the SID exists in our domain. */
1355         if (ret == False) {
1356                 return NT_STATUS_NO_SUCH_USER;
1357         }
1358
1359         pdb_free_sam(&sampass);
1360
1361         /* associate the user's SID and access bits with the new handle. */
1362         if ((info = get_samr_info_by_sid(&sid)) == NULL)
1363                 return NT_STATUS_NO_MEMORY;
1364         info->acc_granted = acc_granted;
1365
1366         /* get a (unique) handle.  open a policy on it. */
1367         if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
1368                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1369
1370         return r_u->status;
1371 }
1372
1373 /*************************************************************************
1374  get_user_info_7. Safe. Only gives out account_name.
1375  *************************************************************************/
1376
1377 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx, SAM_USER_INFO_7 *id7, DOM_SID *user_sid)
1378 {
1379         SAM_ACCOUNT *smbpass=NULL;
1380         BOOL ret;
1381         NTSTATUS nt_status;
1382
1383         nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1384
1385         if (!NT_STATUS_IS_OK(nt_status)) {
1386                 return nt_status;
1387         }
1388
1389         become_root();
1390         ret = pdb_getsampwsid(smbpass, user_sid);
1391         unbecome_root();
1392
1393         if (ret==False) {
1394                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1395                 return NT_STATUS_NO_SUCH_USER;
1396         }
1397
1398         DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1399
1400         ZERO_STRUCTP(id7);
1401         init_sam_user_info7(id7, pdb_get_username(smbpass) );
1402
1403         pdb_free_sam(&smbpass);
1404
1405         return NT_STATUS_OK;
1406 }
1407 /*************************************************************************
1408  get_user_info_10. Safe. Only gives out acb bits.
1409  *************************************************************************/
1410
1411 static NTSTATUS get_user_info_10(TALLOC_CTX *mem_ctx, SAM_USER_INFO_10 *id10, DOM_SID *user_sid)
1412 {
1413         SAM_ACCOUNT *smbpass=NULL;
1414         BOOL ret;
1415         NTSTATUS nt_status;
1416
1417         nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1418
1419         if (!NT_STATUS_IS_OK(nt_status)) {
1420                 return nt_status;
1421         }
1422
1423         become_root();
1424         ret = pdb_getsampwsid(smbpass, user_sid);
1425         unbecome_root();
1426
1427         if (ret==False) {
1428                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1429                 return NT_STATUS_NO_SUCH_USER;
1430         }
1431
1432         DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1433
1434         ZERO_STRUCTP(id10);
1435         init_sam_user_info10(id10, pdb_get_acct_ctrl(smbpass) );
1436
1437         pdb_free_sam(&smbpass);
1438
1439         return NT_STATUS_OK;
1440 }
1441
1442 /*************************************************************************
1443  get_user_info_12. OK - this is the killer as it gives out password info.
1444  Ensure that this is only allowed on an encrypted connection with a root
1445  user. JRA.
1446  *************************************************************************/
1447
1448 static NTSTATUS get_user_info_12(pipes_struct *p, TALLOC_CTX *mem_ctx, SAM_USER_INFO_12 * id12, DOM_SID *user_sid)
1449 {
1450         SAM_ACCOUNT *smbpass=NULL;
1451         BOOL ret;
1452         NTSTATUS nt_status;
1453
1454         if (!p->ntlmssp_auth_validated)
1455                 return NT_STATUS_ACCESS_DENIED;
1456
1457         if (!(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) || !(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL))
1458                 return NT_STATUS_ACCESS_DENIED;
1459
1460         /*
1461          * Do *NOT* do become_root()/unbecome_root() here ! JRA.
1462          */
1463
1464         nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1465
1466         if (!NT_STATUS_IS_OK(nt_status)) {
1467                 return nt_status;
1468         }
1469
1470         ret = pdb_getsampwsid(smbpass, user_sid);
1471
1472         if (ret == False) {
1473                 DEBUG(4, ("User %s not found\n", sid_string_static(user_sid)));
1474                 pdb_free_sam(&smbpass);
1475                 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
1476         }
1477
1478         DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
1479
1480         if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
1481                 pdb_free_sam(&smbpass);
1482                 return NT_STATUS_ACCOUNT_DISABLED;
1483         }
1484
1485         ZERO_STRUCTP(id12);
1486         init_sam_user_info12(id12, pdb_get_lanman_passwd(smbpass), pdb_get_nt_passwd(smbpass));
1487
1488         pdb_free_sam(&smbpass);
1489
1490         return NT_STATUS_OK;
1491 }
1492
1493 /*************************************************************************
1494  get_user_info_20
1495  *************************************************************************/
1496
1497 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx, SAM_USER_INFO_20 *id20, DOM_SID *user_sid)
1498 {
1499         SAM_ACCOUNT *sampass=NULL;
1500         BOOL ret;
1501
1502         pdb_init_sam_talloc(mem_ctx, &sampass);
1503
1504         become_root();
1505         ret = pdb_getsampwsid(sampass, user_sid);
1506         unbecome_root();
1507
1508         if (ret == False) {
1509                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1510                 return NT_STATUS_NO_SUCH_USER;
1511         }
1512
1513         samr_clear_sam_passwd(sampass);
1514
1515         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
1516
1517         ZERO_STRUCTP(id20);
1518         init_sam_user_info20A(id20, sampass);
1519
1520         pdb_free_sam(&sampass);
1521
1522         return NT_STATUS_OK;
1523 }
1524
1525 /*************************************************************************
1526  get_user_info_21
1527  *************************************************************************/
1528
1529 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
1530                                  DOM_SID *user_sid, DOM_SID *domain_sid)
1531 {
1532         SAM_ACCOUNT *sampass=NULL;
1533         BOOL ret;
1534         NTSTATUS nt_status;
1535
1536         nt_status = pdb_init_sam_talloc(mem_ctx, &sampass);
1537         if (!NT_STATUS_IS_OK(nt_status)) {
1538                 return nt_status;
1539         }
1540
1541         become_root();
1542         ret = pdb_getsampwsid(sampass, user_sid);
1543         unbecome_root();
1544
1545         if (ret == False) {
1546                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1547                 return NT_STATUS_NO_SUCH_USER;
1548         }
1549
1550         samr_clear_sam_passwd(sampass);
1551
1552         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
1553
1554         ZERO_STRUCTP(id21);
1555         nt_status = init_sam_user_info21A(id21, sampass, domain_sid);
1556
1557         pdb_free_sam(&sampass);
1558
1559         return NT_STATUS_OK;
1560 }
1561
1562 /*******************************************************************
1563  _samr_query_userinfo
1564  ********************************************************************/
1565
1566 NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_R_QUERY_USERINFO *r_u)
1567 {
1568         SAM_USERINFO_CTR *ctr;
1569         struct samr_info *info = NULL;
1570         DOM_SID domain_sid;
1571         uint32 rid;
1572
1573         r_u->status=NT_STATUS_OK;
1574
1575         /* search for the handle */
1576         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1577                 return NT_STATUS_INVALID_HANDLE;
1578
1579         domain_sid = info->sid;
1580
1581         sid_split_rid(&domain_sid, &rid);
1582
1583         if (!sid_check_is_in_our_domain(&info->sid))
1584                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1585
1586         DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
1587
1588         ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_USERINFO_CTR);
1589         if (!ctr)
1590                 return NT_STATUS_NO_MEMORY;
1591
1592         ZERO_STRUCTP(ctr);
1593
1594         /* ok!  user info levels (lots: see MSDEV help), off we go... */
1595         ctr->switch_value = q_u->switch_value;
1596
1597         switch (q_u->switch_value) {
1598         case 0x07:
1599                 ctr->info.id7 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_7);
1600                 if (ctr->info.id7 == NULL)
1601                         return NT_STATUS_NO_MEMORY;
1602
1603                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_7(p->mem_ctx, ctr->info.id7, &info->sid)))
1604                         return r_u->status;
1605                 break;
1606         case 0x10:
1607                 ctr->info.id10 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_10);
1608                 if (ctr->info.id10 == NULL)
1609                         return NT_STATUS_NO_MEMORY;
1610
1611                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_10(p->mem_ctx, ctr->info.id10, &info->sid)))
1612                         return r_u->status;
1613                 break;
1614
1615 #if 0
1616 /* whoops - got this wrong.  i think.  or don't understand what's happening. */
1617         case 0x11:
1618         {
1619             NTTIME expire;
1620             info = (void *)&id11;
1621
1622             expire.low = 0xffffffff;
1623             expire.high = 0x7fffffff;
1624
1625             ctr->info.id = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_11));
1626             ZERO_STRUCTP(ctr->info.id11);
1627             init_sam_user_info11(ctr->info.id11, &expire,
1628                          "BROOKFIELDS$",    /* name */
1629                          0x03ef,    /* user rid */
1630                          0x201, /* group rid */
1631                          0x0080);   /* acb info */
1632
1633             break;
1634         }
1635 #endif
1636
1637         case 0x12:
1638                 ctr->info.id12 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_12);
1639                 if (ctr->info.id12 == NULL)
1640                         return NT_STATUS_NO_MEMORY;
1641
1642                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_12(p, p->mem_ctx, ctr->info.id12, &info->sid)))
1643                         return r_u->status;
1644                 break;
1645
1646         case 20:
1647                 ctr->info.id20 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_20);
1648                 if (ctr->info.id20 == NULL)
1649                         return NT_STATUS_NO_MEMORY;
1650                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))
1651                         return r_u->status;
1652                 break;
1653
1654         case 21:
1655                 ctr->info.id21 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_21);
1656                 if (ctr->info.id21 == NULL)
1657                         return NT_STATUS_NO_MEMORY;
1658                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21,
1659                                                                     &info->sid, &domain_sid)))
1660                         return r_u->status;
1661                 break;
1662
1663         default:
1664                 return NT_STATUS_INVALID_INFO_CLASS;
1665         }
1666
1667         init_samr_r_query_userinfo(r_u, ctr, r_u->status);
1668
1669         DEBUG(5,("_samr_query_userinfo: %d\n", __LINE__));
1670
1671         return r_u->status;
1672 }
1673
1674 /*******************************************************************
1675  samr_reply_query_usergroups
1676  ********************************************************************/
1677
1678 NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, SAMR_R_QUERY_USERGROUPS *r_u)
1679 {
1680         SAM_ACCOUNT *sam_pass=NULL;
1681         struct passwd *passwd;
1682         DOM_SID  sid;
1683         DOM_SID *sids;
1684         DOM_GID *gids = NULL;
1685         int num_groups = 0;
1686         gid_t *unix_gids;
1687         int i, num_gids;
1688         uint32 acc_granted;
1689         BOOL ret;
1690         NTSTATUS result;
1691
1692         /*
1693          * from the SID in the request:
1694          * we should send back the list of DOMAIN GROUPS
1695          * the user is a member of
1696          *
1697          * and only the DOMAIN GROUPS
1698          * no ALIASES !!! neither aliases of the domain
1699          * nor aliases of the builtin SID
1700          *
1701          * JFM, 12/2/2001
1702          */
1703
1704         r_u->status = NT_STATUS_OK;
1705
1706         DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
1707
1708         /* find the policy handle.  open a policy on it. */
1709         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1710                 return NT_STATUS_INVALID_HANDLE;
1711
1712         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_USER_GET_GROUPS, "_samr_query_usergroups"))) {
1713                 return r_u->status;
1714         }
1715
1716         if (!sid_check_is_in_our_domain(&sid))
1717                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1718
1719         pdb_init_sam(&sam_pass);
1720
1721         become_root();
1722         ret = pdb_getsampwsid(sam_pass, &sid);
1723         unbecome_root();
1724
1725         if (ret == False) {
1726                 pdb_free_sam(&sam_pass);
1727                 return NT_STATUS_NO_SUCH_USER;
1728         }
1729
1730         passwd = getpwnam_alloc(pdb_get_username(sam_pass));
1731         if (passwd == NULL) {
1732                 pdb_free_sam(&sam_pass);
1733                 return NT_STATUS_NO_SUCH_USER;
1734         }
1735
1736         sids = NULL;
1737
1738         become_root();
1739         result = pdb_enum_group_memberships(pdb_get_username(sam_pass),
1740                                             passwd->pw_gid,
1741                                             &sids, &unix_gids, &num_groups);
1742         unbecome_root();
1743
1744         pdb_free_sam(&sam_pass);
1745         passwd_free(&passwd);
1746
1747         if (!NT_STATUS_IS_OK(result))
1748                 return result;
1749
1750         SAFE_FREE(unix_gids);
1751
1752         gids = NULL;
1753         num_gids = 0;
1754
1755         for (i=0; i<num_groups; i++) {
1756                 uint32 rid;
1757
1758                 if (!sid_peek_check_rid(get_global_sam_sid(),
1759                                         &(sids[i]), &rid))
1760                         continue;
1761
1762                 gids = TALLOC_REALLOC_ARRAY(p->mem_ctx, gids, DOM_GID, num_gids+1);
1763                 gids[num_gids].attr=7;
1764                 gids[num_gids].g_rid = rid;
1765                 num_gids += 1;
1766         }
1767         SAFE_FREE(sids);
1768
1769         /* construct the response.  lkclXXXX: gids are not copied! */
1770         init_samr_r_query_usergroups(r_u, num_groups, gids, r_u->status);
1771
1772         DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
1773
1774         return r_u->status;
1775 }
1776
1777 /*******************************************************************
1778  _samr_query_dom_info
1779  ********************************************************************/
1780
1781 NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SAMR_R_QUERY_DOMAIN_INFO *r_u)
1782 {
1783         struct samr_info *info = NULL;
1784         SAM_UNK_CTR *ctr;
1785         uint32 min_pass_len,pass_hist,flag;
1786         time_t u_expire, u_min_age;
1787         NTTIME nt_expire, nt_min_age;
1788
1789         time_t u_lock_duration, u_reset_time;
1790         NTTIME nt_lock_duration, nt_reset_time;
1791         uint32 lockout;
1792
1793         time_t u_logout;
1794         NTTIME nt_logout;
1795
1796         uint32 account_policy_temp;
1797         uint32 server_role;
1798
1799         uint32 num_users=0, num_groups=0, num_aliases=0;
1800
1801         if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
1802                 return NT_STATUS_NO_MEMORY;
1803
1804         ZERO_STRUCTP(ctr);
1805
1806         r_u->status = NT_STATUS_OK;
1807
1808         DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
1809
1810         /* find the policy handle.  open a policy on it. */
1811         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
1812                 return NT_STATUS_INVALID_HANDLE;
1813
1814         switch (q_u->switch_value) {
1815                 case 0x01:
1816
1817                         account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
1818                         min_pass_len = account_policy_temp;
1819
1820                         account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
1821                         pass_hist = account_policy_temp;
1822
1823                         account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
1824                         flag = account_policy_temp;
1825
1826                         account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
1827                         u_expire = account_policy_temp;
1828
1829                         account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
1830                         u_min_age = account_policy_temp;
1831
1832                         unix_to_nt_time_abs(&nt_expire, u_expire);
1833                         unix_to_nt_time_abs(&nt_min_age, u_min_age);
1834
1835                         init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
1836                                        flag, nt_expire, nt_min_age);
1837                         break;
1838                 case 0x02:
1839                         become_root();
1840                         num_users=count_sam_users(&info->disp_info,
1841                                                   ACB_NORMAL);
1842                         num_groups=count_sam_groups(&info->disp_info);
1843                         unbecome_root();
1844
1845                         account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
1846                         u_logout = account_policy_temp;
1847
1848                         unix_to_nt_time_abs(&nt_logout, u_logout);
1849
1850                         server_role = ROLE_DOMAIN_PDC;
1851                         if (lp_server_role() == ROLE_DOMAIN_BDC)
1852                                 server_role = ROLE_DOMAIN_BDC;
1853
1854                         /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
1855                         init_unk_info2(&ctr->info.inf2, lp_serverstring(), lp_workgroup(), global_myname(), time(NULL),
1856                                        num_users, num_groups, num_aliases, nt_logout, server_role);
1857                         break;
1858                 case 0x03:
1859                         account_policy_get(AP_TIME_TO_LOGOUT, (unsigned int *)&u_logout);
1860                         unix_to_nt_time_abs(&nt_logout, u_logout);
1861
1862                         init_unk_info3(&ctr->info.inf3, nt_logout);
1863                         break;
1864                 case 0x05:
1865                         init_unk_info5(&ctr->info.inf5, global_myname());
1866                         break;
1867                 case 0x06:
1868                         init_unk_info6(&ctr->info.inf6);
1869                         break;
1870                 case 0x07:
1871                         server_role = ROLE_DOMAIN_PDC;
1872                         if (lp_server_role() == ROLE_DOMAIN_BDC)
1873                                 server_role = ROLE_DOMAIN_BDC;
1874
1875                         init_unk_info7(&ctr->info.inf7, server_role);
1876                         break;
1877                 case 0x08:
1878                         init_unk_info8(&ctr->info.inf8, (uint32) time(NULL));
1879                         break;
1880                 case 0x0c:
1881                         account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
1882                         u_lock_duration = account_policy_temp;
1883                         if (u_lock_duration != -1)
1884                                 u_lock_duration *= 60;
1885
1886                         account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
1887                         u_reset_time = account_policy_temp * 60;
1888
1889                         account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
1890                         lockout = account_policy_temp;
1891
1892                         unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
1893                         unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
1894
1895                         init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
1896                         break;
1897                 default:
1898                         return NT_STATUS_INVALID_INFO_CLASS;
1899                 }
1900
1901         init_samr_r_query_dom_info(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
1902
1903         DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
1904
1905         return r_u->status;
1906 }
1907
1908 /*******************************************************************
1909  _samr_create_user
1910  Create an account, can be either a normal user or a machine.
1911  This funcion will need to be updated for bdc/domain trusts.
1912  ********************************************************************/
1913
1914 NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREATE_USER *r_u)
1915 {
1916         SAM_ACCOUNT *sam_pass=NULL;
1917         fstring account;
1918         DOM_SID sid;
1919         pstring add_script;
1920         POLICY_HND dom_pol = q_u->domain_pol;
1921         UNISTR2 user_account = q_u->uni_name;
1922         uint16 acb_info = q_u->acb_info;
1923         POLICY_HND *user_pol = &r_u->user_pol;
1924         struct samr_info *info = NULL;
1925         BOOL ret;
1926         NTSTATUS nt_status;
1927         struct passwd *pw;
1928         uint32 acc_granted;
1929         SEC_DESC *psd;
1930         size_t    sd_size;
1931         uint32 new_rid = 0;
1932         /* check this, when giving away 'add computer to domain' privs */
1933         uint32    des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
1934         BOOL can_add_account = False;
1935         SE_PRIV se_rights;
1936
1937         /* Get the domain SID stored in the domain policy */
1938         if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted))
1939                 return NT_STATUS_INVALID_HANDLE;
1940
1941         if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_USER, "_samr_create_user"))) {
1942                 return nt_status;
1943         }
1944
1945         if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST || acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
1946                 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
1947                    this parameter is not an account type */
1948                 return NT_STATUS_INVALID_PARAMETER;
1949         }
1950
1951         rpcstr_pull(account, user_account.buffer, sizeof(account), user_account.uni_str_len*2, 0);
1952         strlower_m(account);
1953
1954         pdb_init_sam(&sam_pass);
1955
1956         become_root();
1957         ret = pdb_getsampwnam(sam_pass, account);
1958         unbecome_root();
1959         if (ret == True) {
1960                 /* this account exists: say so */
1961                 pdb_free_sam(&sam_pass);
1962                 return NT_STATUS_USER_EXISTS;
1963         }
1964
1965         pdb_free_sam(&sam_pass);
1966
1967         /*********************************************************************
1968          * HEADS UP!  If we have to create a new user account, we have to get
1969          * a new RID from somewhere.  This used to be done by the passdb
1970          * backend. It has been moved into idmap now.  Since idmap is now
1971          * wrapped up behind winbind, this means you have to run winbindd if you
1972          * want new accounts to get a new RID when "enable rid algorithm = no".
1973          * Tough.  We now have a uniform way of allocating RIDs regardless
1974          * of what ever passdb backend people may use.
1975          *                                             --jerry (2003-07-10)
1976          *********************************************************************/
1977
1978         pw = Get_Pwnam(account);
1979
1980         /* determine which user right we need to check based on the acb_info */
1981
1982         if ( acb_info & ACB_WSTRUST )
1983         {
1984                 pstrcpy(add_script, lp_addmachine_script());
1985                 se_priv_copy( &se_rights, &se_machine_account );
1986                 can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
1987         }
1988         /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
1989            account for domain trusts and changes the ACB flags later */
1990         else if ( acb_info & ACB_NORMAL && (account[strlen(account)-1] != '$') )
1991         {
1992                 pstrcpy(add_script, lp_adduser_script());
1993                 se_priv_copy( &se_rights, &se_add_users );
1994                 can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
1995         }
1996         else    /* implicit assumption of a BDC or domain trust account here (we already check the flags earlier) */
1997         {
1998                 pstrcpy(add_script, lp_addmachine_script());
1999                 if ( lp_enable_privileges() ) {
2000                         /* only Domain Admins can add a BDC or domain trust */
2001                         se_priv_copy( &se_rights, &se_priv_none );
2002                         can_add_account = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
2003                 }
2004         }
2005
2006         DEBUG(5, ("_samr_create_user: %s can add this account : %s\n",
2007                 p->pipe_user_name, can_add_account ? "True":"False" ));
2008
2009         /********** BEGIN Admin BLOCK **********/
2010
2011         if ( can_add_account )
2012                 become_root();
2013
2014         if ( !pw ) {
2015                 if (*add_script) {
2016                         int add_ret;
2017
2018                         all_string_sub(add_script, "%u", account, sizeof(add_script));
2019                         add_ret = smbrun(add_script,NULL);
2020                         DEBUG(add_ret ? 0 : 3,("_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret));
2021                 }
2022                 else    /* no add user script -- ask winbindd to do it */
2023                 {
2024                         if ( !winbind_create_user( account, &new_rid ) ) {
2025                                 DEBUG(3,("_samr_create_user: winbind_create_user(%s) failed\n",
2026                                         account));
2027                         }
2028                 }
2029
2030         }
2031
2032         /* implicit call to getpwnam() next.  we have a valid SID coming out of this call */
2033
2034         flush_pwnam_cache();
2035         nt_status = pdb_init_sam_new(&sam_pass, account, new_rid);
2036
2037         /* this code is order such that we have no unnecessary retuns
2038            out of the admin block of code */
2039
2040         if ( NT_STATUS_IS_OK(nt_status) ) {
2041                 pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
2042
2043                 if ( !(ret = pdb_add_sam_account(sam_pass)) ) {
2044                         pdb_free_sam(&sam_pass);
2045                         DEBUG(0, ("could not add user/computer %s to passdb.  Check permissions?\n",
2046                                 account));
2047                         nt_status = NT_STATUS_ACCESS_DENIED;
2048                 }
2049         }
2050
2051         if ( can_add_account )
2052                 unbecome_root();
2053
2054         /********** END Admin BLOCK **********/
2055
2056         /* now check for failure */
2057
2058         if ( !NT_STATUS_IS_OK(nt_status) )
2059                 return nt_status;
2060
2061         /* Get the user's SID */
2062
2063         sid_copy(&sid, pdb_get_user_sid(sam_pass));
2064
2065         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2066         se_map_generic(&des_access, &usr_generic_mapping);
2067
2068         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2069                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2070                 &acc_granted, "_samr_create_user");
2071
2072         if ( !NT_STATUS_IS_OK(nt_status) ) {
2073                 return nt_status;
2074         }
2075
2076         /* associate the user's SID with the new handle. */
2077         if ((info = get_samr_info_by_sid(&sid)) == NULL) {
2078                 pdb_free_sam(&sam_pass);
2079                 return NT_STATUS_NO_MEMORY;
2080         }
2081
2082         ZERO_STRUCTP(info);
2083         info->sid = sid;
2084         info->acc_granted = acc_granted;
2085
2086         /* get a (unique) handle.  open a policy on it. */
2087         if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
2088                 pdb_free_sam(&sam_pass);
2089                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2090         }
2091
2092         r_u->user_rid=pdb_get_user_rid(sam_pass);
2093
2094         r_u->access_granted = acc_granted;
2095
2096         pdb_free_sam(&sam_pass);
2097
2098         return NT_STATUS_OK;
2099 }
2100
2101 /*******************************************************************
2102  samr_reply_connect_anon
2103  ********************************************************************/
2104
2105 NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CONNECT_ANON *r_u)
2106 {
2107         struct samr_info *info = NULL;
2108         uint32    des_access = q_u->access_mask;
2109
2110         /* Access check */
2111
2112         if (!pipe_access_check(p)) {
2113                 DEBUG(3, ("access denied to samr_connect_anon\n"));
2114                 r_u->status = NT_STATUS_ACCESS_DENIED;
2115                 return r_u->status;
2116         }
2117
2118         /* set up the SAMR connect_anon response */
2119
2120         r_u->status = NT_STATUS_OK;
2121
2122         /* associate the user's SID with the new handle. */
2123         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2124                 return NT_STATUS_NO_MEMORY;
2125
2126         /* don't give away the farm but this is probably ok.  The SA_RIGHT_SAM_ENUM_DOMAINS
2127            was observed from a win98 client trying to enumerate users (when configured
2128            user level access control on shares)   --jerry */
2129
2130         se_map_generic( &des_access, &sam_generic_mapping );
2131         info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
2132
2133         info->status = q_u->unknown_0;
2134
2135         /* get a (unique) handle.  open a policy on it. */
2136         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2137                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2138
2139         return r_u->status;
2140 }
2141
2142 /*******************************************************************
2143  samr_reply_connect
2144  ********************************************************************/
2145
2146 NTSTATUS _samr_connect(pipes_struct *p, SAMR_Q_CONNECT *q_u, SAMR_R_CONNECT *r_u)
2147 {
2148         struct samr_info *info = NULL;
2149         SEC_DESC *psd = NULL;
2150         uint32    acc_granted;
2151         uint32    des_access = q_u->access_mask;
2152         NTSTATUS  nt_status;
2153         size_t sd_size;
2154
2155
2156         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2157
2158         /* Access check */
2159
2160         if (!pipe_access_check(p)) {
2161                 DEBUG(3, ("access denied to samr_connect\n"));
2162                 r_u->status = NT_STATUS_ACCESS_DENIED;
2163                 return r_u->status;
2164         }
2165
2166         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
2167         se_map_generic(&des_access, &sam_generic_mapping);
2168
2169         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2170                 NULL, 0, des_access, &acc_granted, "_samr_connect");
2171
2172         if ( !NT_STATUS_IS_OK(nt_status) )
2173                 return nt_status;
2174
2175         r_u->status = NT_STATUS_OK;
2176
2177         /* associate the user's SID and access granted with the new handle. */
2178         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2179                 return NT_STATUS_NO_MEMORY;
2180
2181         info->acc_granted = acc_granted;
2182         info->status = q_u->access_mask;
2183
2184         /* get a (unique) handle.  open a policy on it. */
2185         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2186                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2187
2188         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2189
2190         return r_u->status;
2191 }
2192
2193 /*******************************************************************
2194  samr_connect4
2195  ********************************************************************/
2196
2197 NTSTATUS _samr_connect4(pipes_struct *p, SAMR_Q_CONNECT4 *q_u, SAMR_R_CONNECT4 *r_u)
2198 {
2199         struct samr_info *info = NULL;
2200         SEC_DESC *psd = NULL;
2201         uint32    acc_granted;
2202         uint32    des_access = q_u->access_mask;
2203         NTSTATUS  nt_status;
2204         size_t sd_size;
2205
2206
2207         DEBUG(5,("_samr_connect4: %d\n", __LINE__));
2208
2209         /* Access check */
2210
2211         if (!pipe_access_check(p)) {
2212                 DEBUG(3, ("access denied to samr_connect4\n"));
2213                 r_u->status = NT_STATUS_ACCESS_DENIED;
2214                 return r_u->status;
2215         }
2216
2217         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
2218         se_map_generic(&des_access, &sam_generic_mapping);
2219
2220         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2221                 NULL, 0, des_access, &acc_granted, "_samr_connect4");
2222
2223         if ( !NT_STATUS_IS_OK(nt_status) )
2224                 return nt_status;
2225
2226         r_u->status = NT_STATUS_OK;
2227
2228         /* associate the user's SID and access granted with the new handle. */
2229         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2230                 return NT_STATUS_NO_MEMORY;
2231
2232         info->acc_granted = acc_granted;
2233         info->status = q_u->access_mask;
2234
2235         /* get a (unique) handle.  open a policy on it. */
2236         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2237                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2238
2239         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2240
2241         return r_u->status;
2242 }
2243
2244 /**********************************************************************
2245  api_samr_lookup_domain
2246  **********************************************************************/
2247
2248 NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_LOOKUP_DOMAIN *r_u)
2249 {
2250         struct samr_info *info;
2251         fstring domain_name;
2252         DOM_SID sid;
2253
2254         r_u->status = NT_STATUS_OK;
2255
2256         if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)&info))
2257                 return NT_STATUS_INVALID_HANDLE;
2258
2259         /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
2260            Reverted that change so we will work with RAS servers again */
2261
2262         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
2263                 SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_lookup_domain")))
2264         {
2265                 return r_u->status;
2266         }
2267
2268         rpcstr_pull(domain_name, q_u->uni_domain.buffer, sizeof(domain_name), q_u->uni_domain.uni_str_len*2, 0);
2269
2270         ZERO_STRUCT(sid);
2271
2272         if (!secrets_fetch_domain_sid(domain_name, &sid)) {
2273                 r_u->status = NT_STATUS_NO_SUCH_DOMAIN;
2274         }
2275
2276         DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name, sid_string_static(&sid)));
2277
2278         init_samr_r_lookup_domain(r_u, &sid, r_u->status);
2279
2280         return r_u->status;
2281 }
2282
2283 /******************************************************************
2284 makes a SAMR_R_ENUM_DOMAINS structure.
2285 ********************************************************************/
2286
2287 static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam,
2288                         UNISTR2 **pp_uni_name, uint32 num_sam_entries, fstring doms[])
2289 {
2290         uint32 i;
2291         SAM_ENTRY *sam;
2292         UNISTR2 *uni_name;
2293
2294         DEBUG(5, ("make_enum_domains\n"));
2295
2296         *pp_sam = NULL;
2297         *pp_uni_name = NULL;
2298
2299         if (num_sam_entries == 0)
2300                 return True;
2301
2302         sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
2303         uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
2304
2305         if (sam == NULL || uni_name == NULL)
2306                 return False;
2307
2308         for (i = 0; i < num_sam_entries; i++) {
2309                 init_unistr2(&uni_name[i], doms[i], UNI_FLAGS_NONE);
2310                 init_sam_entry(&sam[i], &uni_name[i], 0);
2311         }
2312
2313         *pp_sam = sam;
2314         *pp_uni_name = uni_name;
2315
2316         return True;
2317 }
2318
2319 /**********************************************************************
2320  api_samr_enum_domains
2321  **********************************************************************/
2322
2323 NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_ENUM_DOMAINS *r_u)
2324 {
2325         struct samr_info *info;
2326         uint32 num_entries = 2;
2327         fstring dom[2];
2328         const char *name;
2329
2330         r_u->status = NT_STATUS_OK;
2331
2332         if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
2333                 return NT_STATUS_INVALID_HANDLE;
2334
2335         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_enum_domains"))) {
2336                 return r_u->status;
2337         }
2338
2339         name = get_global_sam_name();
2340
2341         fstrcpy(dom[0],name);
2342         strupper_m(dom[0]);
2343         fstrcpy(dom[1],"Builtin");
2344
2345         if (!make_enum_domains(p->mem_ctx, &r_u->sam, &r_u->uni_dom_name, num_entries, dom))
2346                 return NT_STATUS_NO_MEMORY;
2347
2348         init_samr_r_enum_domains(r_u, q_u->start_idx + num_entries, num_entries);
2349
2350         return r_u->status;
2351 }
2352
2353 /*******************************************************************
2354  api_samr_open_alias
2355  ********************************************************************/
2356
2357 NTSTATUS _samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OPEN_ALIAS *r_u)
2358 {
2359         DOM_SID sid;
2360         POLICY_HND domain_pol = q_u->dom_pol;
2361         uint32 alias_rid = q_u->rid_alias;
2362         POLICY_HND *alias_pol = &r_u->pol;
2363         struct    samr_info *info = NULL;
2364         SEC_DESC *psd = NULL;
2365         uint32    acc_granted;
2366         uint32    des_access = q_u->access_mask;
2367         size_t    sd_size;
2368         NTSTATUS  status;
2369         SE_PRIV se_rights;
2370
2371         r_u->status = NT_STATUS_OK;
2372
2373         /* find the domain policy and get the SID / access bits stored in the domain policy */
2374
2375         if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted) )
2376                 return NT_STATUS_INVALID_HANDLE;
2377
2378         status = access_check_samr_function(acc_granted,
2379                 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_alias");
2380
2381         if ( !NT_STATUS_IS_OK(status) )
2382                 return status;
2383
2384         /* append the alias' RID to it */
2385
2386         if (!sid_append_rid(&sid, alias_rid))
2387                 return NT_STATUS_NO_SUCH_USER;
2388
2389         /*check if access can be granted as requested by client. */
2390
2391         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
2392         se_map_generic(&des_access,&ali_generic_mapping);
2393
2394         se_priv_add( &se_rights, &se_add_users );
2395
2396
2397         status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2398                 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
2399                 &acc_granted, "_samr_open_alias");
2400
2401         if ( !NT_STATUS_IS_OK(status) )
2402                 return status;
2403
2404         /*
2405          * we should check if the rid really exist !!!
2406          * JFM.
2407          */
2408
2409         /* associate the user's SID with the new handle. */
2410         if ((info = get_samr_info_by_sid(&sid)) == NULL)
2411                 return NT_STATUS_NO_MEMORY;
2412
2413         info->acc_granted = acc_granted;
2414
2415         /* get a (unique) handle.  open a policy on it. */
2416         if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
2417                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2418
2419         return r_u->status;
2420 }
2421
2422 /*******************************************************************
2423  set_user_info_10
2424  ********************************************************************/
2425
2426 static BOOL set_user_info_10(const SAM_USER_INFO_10 *id10, SAM_ACCOUNT *pwd)
2427 {
2428         if (id10 == NULL) {
2429                 DEBUG(5, ("set_user_info_10: NULL id10\n"));
2430                 pdb_free_sam(&pwd);
2431                 return False;
2432         }
2433
2434         /* FIX ME: check if the value is really changed --metze */
2435         if (!pdb_set_acct_ctrl(pwd, id10->acb_info, PDB_CHANGED)) {
2436                 pdb_free_sam(&pwd);
2437                 return False;
2438         }
2439
2440         if(!pdb_update_sam_account(pwd)) {
2441                 pdb_free_sam(&pwd);
2442                 return False;
2443         }
2444
2445         pdb_free_sam(&pwd);
2446
2447         return True;
2448 }
2449
2450 /*******************************************************************
2451  set_user_info_12
2452  ********************************************************************/
2453
2454 static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, SAM_ACCOUNT *pwd)
2455 {
2456
2457         if (id12 == NULL) {
2458                 DEBUG(2, ("set_user_info_12: id12 is NULL\n"));
2459                 pdb_free_sam(&pwd);
2460                 return False;
2461         }
2462
2463         if (!pdb_set_lanman_passwd (pwd, id12->lm_pwd, PDB_CHANGED)) {
2464                 pdb_free_sam(&pwd);
2465                 return False;
2466         }
2467         if (!pdb_set_nt_passwd     (pwd, id12->nt_pwd, PDB_CHANGED)) {
2468                 pdb_free_sam(&pwd);
2469                 return False;
2470         }
2471         if (!pdb_set_pass_changed_now (pwd)) {
2472                 pdb_free_sam(&pwd);
2473                 return False;
2474         }
2475
2476         if(!pdb_update_sam_account(pwd)) {
2477                 pdb_free_sam(&pwd);
2478                 return False;
2479         }
2480
2481         pdb_free_sam(&pwd);
2482         return True;
2483 }
2484
2485 /*******************************************************************
2486  The GROUPSID field in the SAM_ACCOUNT changed. Try to tell unix.
2487  ********************************************************************/
2488 static BOOL set_unix_primary_group(SAM_ACCOUNT *sampass)
2489 {
2490         struct group *grp;
2491         gid_t gid;
2492
2493         if (!NT_STATUS_IS_OK(sid_to_gid(pdb_get_group_sid(sampass),
2494                                         &gid))) {
2495                 DEBUG(2,("Could not get gid for primary group of "
2496                          "user %s\n", pdb_get_username(sampass)));
2497                 return False;
2498         }
2499
2500         grp = getgrgid(gid);
2501
2502         if (grp == NULL) {
2503                 DEBUG(2,("Could not find primary group %lu for "
2504                          "user %s\n", (unsigned long)gid,
2505                          pdb_get_username(sampass)));
2506                 return False;
2507         }
2508
2509         if (smb_set_primary_group(grp->gr_name,
2510                                   pdb_get_username(sampass)) != 0) {
2511                 DEBUG(2,("Could not set primary group for user %s to "
2512                          "%s\n",
2513                          pdb_get_username(sampass), grp->gr_name));
2514                 return False;
2515         }
2516
2517         return True;
2518 }
2519
2520
2521 /*******************************************************************
2522  set_user_info_20
2523  ********************************************************************/
2524
2525 static BOOL set_user_info_20(SAM_USER_INFO_20 *id20, SAM_ACCOUNT *pwd)
2526 {
2527         if (id20 == NULL) {
2528                 DEBUG(5, ("set_user_info_20: NULL id20\n"));
2529                 return False;
2530         }
2531
2532         copy_id20_to_sam_passwd(pwd, id20);
2533
2534         /* write the change out */
2535         if(!pdb_update_sam_account(pwd)) {
2536                 pdb_free_sam(&pwd);
2537                 return False;
2538         }
2539
2540         pdb_free_sam(&pwd);
2541
2542         return True;
2543 }
2544 /*******************************************************************
2545  set_user_info_21
2546  ********************************************************************/
2547
2548 static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, SAM_ACCOUNT *pwd)
2549 {
2550
2551         if (id21 == NULL) {
2552                 DEBUG(5, ("set_user_info_21: NULL id21\n"));
2553                 return False;
2554         }
2555
2556         copy_id21_to_sam_passwd(pwd, id21);
2557
2558         /*
2559          * The funny part about the previous two calls is
2560          * that pwd still has the password hashes from the
2561          * passdb entry.  These have not been updated from
2562          * id21.  I don't know if they need to be set.    --jerry
2563          */
2564
2565         if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2566                 set_unix_primary_group(pwd);
2567
2568         /* write the change out */
2569         if(!pdb_update_sam_account(pwd)) {
2570                 pdb_free_sam(&pwd);
2571                 return False;
2572         }
2573
2574         pdb_free_sam(&pwd);
2575
2576         return True;
2577 }
2578
2579 /*******************************************************************
2580  set_user_info_23
2581  ********************************************************************/
2582
2583 static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, SAM_ACCOUNT *pwd)
2584 {
2585         pstring plaintext_buf;
2586         uint32 len;
2587         uint16 acct_ctrl;
2588
2589         if (id23 == NULL) {
2590                 DEBUG(5, ("set_user_info_23: NULL id23\n"));
2591                 return False;
2592         }
2593
2594         DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
2595                   pdb_get_username(pwd)));
2596
2597         acct_ctrl = pdb_get_acct_ctrl(pwd);
2598
2599         if (!decode_pw_buffer(id23->pass, plaintext_buf, 256, &len, STR_UNICODE)) {
2600                 pdb_free_sam(&pwd);
2601                 return False;
2602         }
2603
2604         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2605                 pdb_free_sam(&pwd);
2606                 return False;
2607         }
2608
2609         copy_id23_to_sam_passwd(pwd, id23);
2610
2611         /* if it's a trust account, don't update /etc/passwd */
2612         if (    ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2613                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
2614                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
2615                 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2616         } else  {
2617                 /* update the UNIX password */
2618                 if (lp_unix_password_sync() ) {
2619                         struct passwd *passwd = Get_Pwnam(pdb_get_username(pwd));
2620                         if (!passwd) {
2621                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
2622                         }
2623
2624                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
2625                                 pdb_free_sam(&pwd);
2626                                 return False;
2627                         }
2628                 }
2629         }
2630
2631         ZERO_STRUCT(plaintext_buf);
2632
2633         if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2634                 set_unix_primary_group(pwd);
2635
2636         if(!pdb_update_sam_account(pwd)) {
2637                 pdb_free_sam(&pwd);
2638                 return False;
2639         }
2640
2641         pdb_free_sam(&pwd);
2642
2643         return True;
2644 }
2645
2646 /*******************************************************************
2647  set_user_info_pw
2648  ********************************************************************/
2649
2650 static BOOL set_user_info_pw(uint8 *pass, SAM_ACCOUNT *pwd)
2651 {
2652         uint32 len;
2653         pstring plaintext_buf;
2654         uint16 acct_ctrl;
2655
2656         DEBUG(5, ("Attempting administrator password change for user %s\n",
2657                   pdb_get_username(pwd)));
2658
2659         acct_ctrl = pdb_get_acct_ctrl(pwd);
2660
2661         ZERO_STRUCT(plaintext_buf);
2662
2663         if (!decode_pw_buffer(pass, plaintext_buf, 256, &len, STR_UNICODE)) {
2664                 pdb_free_sam(&pwd);
2665                 return False;
2666         }
2667
2668         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2669                 pdb_free_sam(&pwd);
2670                 return False;
2671         }
2672
2673         /* if it's a trust account, don't update /etc/passwd */
2674         if ( ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2675                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
2676                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
2677                 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2678         } else {
2679                 /* update the UNIX password */
2680                 if (lp_unix_password_sync()) {
2681                         struct passwd *passwd = Get_Pwnam(pdb_get_username(pwd));
2682                         if (!passwd) {
2683                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
2684                         }
2685
2686                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
2687                                 pdb_free_sam(&pwd);
2688                                 return False;
2689                         }
2690                 }
2691         }
2692
2693         ZERO_STRUCT(plaintext_buf);
2694
2695         DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
2696
2697         /* update the SAMBA password */
2698         if(!pdb_update_sam_account(pwd)) {
2699                 pdb_free_sam(&pwd);
2700                 return False;
2701         }
2702
2703         pdb_free_sam(&pwd);
2704
2705         return True;
2706 }
2707
2708 /*******************************************************************
2709  samr_reply_set_userinfo
2710  ********************************************************************/
2711
2712 NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SET_USERINFO *r_u)
2713 {
2714         SAM_ACCOUNT *pwd = NULL;
2715         DOM_SID sid;
2716         POLICY_HND *pol = &q_u->pol;
2717         uint16 switch_value = q_u->switch_value;
2718         SAM_USERINFO_CTR *ctr = q_u->ctr;
2719         uint32 acc_granted;
2720         uint32 acc_required;
2721         BOOL ret;
2722         BOOL has_enough_rights = False;
2723         uint32 acb_info;
2724
2725         DEBUG(5, ("_samr_set_userinfo: %d\n", __LINE__));
2726
2727         r_u->status = NT_STATUS_OK;
2728
2729         /* find the policy handle.  open a policy on it. */
2730         if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
2731                 return NT_STATUS_INVALID_HANDLE;
2732
2733         /* observed when joining an XP client to a Samba domain */
2734
2735         acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
2736
2737         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
2738                 return r_u->status;
2739         }
2740
2741         DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid), switch_value));
2742
2743         if (ctr == NULL) {
2744                 DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
2745                 return NT_STATUS_INVALID_INFO_CLASS;
2746         }
2747
2748         pdb_init_sam(&pwd);
2749
2750         become_root();
2751         ret = pdb_getsampwsid(pwd, &sid);
2752         unbecome_root();
2753
2754         if ( !ret ) {
2755                 pdb_free_sam(&pwd);
2756                 return NT_STATUS_NO_SUCH_USER;
2757         }
2758
2759         /* deal with machine password changes differently from userinfo changes */
2760         /* check to see if we have the sufficient rights */
2761
2762         acb_info = pdb_get_acct_ctrl(pwd);
2763         if ( acb_info & ACB_WSTRUST )
2764                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
2765         else if ( acb_info & ACB_NORMAL )
2766                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
2767         else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
2768                 if ( lp_enable_privileges() )
2769                         has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
2770         }
2771
2772         DEBUG(5, ("_samr_set_userinfo: %s does%s possess sufficient rights\n",
2773                 p->pipe_user_name, has_enough_rights ? "" : " not"));
2774
2775         /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
2776
2777         if ( has_enough_rights )
2778                 become_root();
2779
2780         /* ok!  user info levels (lots: see MSDEV help), off we go... */
2781
2782         switch (switch_value) {
2783                 case 18:
2784                         if (!set_user_info_12(ctr->info.id12, pwd))
2785                                 r_u->status = NT_STATUS_ACCESS_DENIED;
2786                         break;
2787
2788                 case 24:
2789                         if (!p->session_key.length) {
2790                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
2791                         }
2792                         SamOEMhashBlob(ctr->info.id24->pass, 516, &p->session_key);
2793
2794                         dump_data(100, (char *)ctr->info.id24->pass, 516);
2795
2796                         if (!set_user_info_pw(ctr->info.id24->pass, pwd))
2797                                 r_u->status = NT_STATUS_ACCESS_DENIED;
2798                         break;
2799
2800                 case 25:
2801 #if 0
2802                         /*
2803                          * Currently we don't really know how to unmarshall
2804                          * the level 25 struct, and the password encryption
2805                          * is different. This is a placeholder for when we
2806                          * do understand it. In the meantime just return INVALID
2807                          * info level and W2K SP2 drops down to level 23... JRA.
2808                          */
2809
2810                         if (!p->session_key.length) {
2811                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
2812                         }
2813                         SamOEMhashBlob(ctr->info.id25->pass, 532, &p->session_key);
2814
2815                         dump_data(100, (char *)ctr->info.id25->pass, 532);
2816
2817                         if (!set_user_info_pw(ctr->info.id25->pass, &sid))
2818                                 r_u->status = NT_STATUS_ACCESS_DENIED;
2819                         break;
2820 #endif
2821                         r_u->status = NT_STATUS_INVALID_INFO_CLASS;
2822                         break;
2823
2824                 case 23:
2825                         if (!p->session_key.length) {
2826                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
2827                         }
2828                         SamOEMhashBlob(ctr->info.id23->pass, 516, &p->session_key);
2829
2830                         dump_data(100, (char *)ctr->info.id23->pass, 516);
2831
2832                         if (!set_user_info_23(ctr->info.id23, pwd))
2833                                 r_u->status = NT_STATUS_ACCESS_DENIED;
2834                         break;
2835
2836                 default:
2837                         r_u->status = NT_STATUS_INVALID_INFO_CLASS;
2838         }
2839
2840
2841         if ( has_enough_rights )
2842                 unbecome_root();
2843
2844         /* ================ END SeMachineAccountPrivilege BLOCK ================ */
2845
2846         return r_u->status;
2847 }
2848
2849 /*******************************************************************
2850  samr_reply_set_userinfo2
2851  ********************************************************************/
2852
2853 NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_SET_USERINFO2 *r_u)
2854 {
2855         SAM_ACCOUNT *pwd = NULL;
2856         DOM_SID sid;
2857         SAM_USERINFO_CTR *ctr = q_u->ctr;
2858         POLICY_HND *pol = &q_u->pol;
2859         uint16 switch_value = q_u->switch_value;
2860         uint32 acc_granted;
2861         uint32 acc_required;
2862         BOOL ret;
2863         BOOL has_enough_rights = False;
2864         uint32 acb_info;
2865
2866         DEBUG(5, ("samr_reply_set_userinfo2: %d\n", __LINE__));
2867
2868         r_u->status = NT_STATUS_OK;
2869
2870         /* find the policy handle.  open a policy on it. */
2871         if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
2872                 return NT_STATUS_INVALID_HANDLE;
2873
2874         /* observed when joining XP client to Samba domain */
2875
2876         acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
2877
2878         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo2"))) {
2879                 return r_u->status;
2880         }
2881
2882         DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid)));
2883
2884         if (ctr == NULL) {
2885                 DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
2886                 return NT_STATUS_INVALID_INFO_CLASS;
2887         }
2888
2889         switch_value=ctr->switch_value;
2890
2891         pdb_init_sam(&pwd);
2892
2893         become_root();
2894         ret = pdb_getsampwsid(pwd, &sid);
2895         unbecome_root();
2896
2897         if ( !ret ) {
2898                 pdb_free_sam(&pwd);
2899                 return NT_STATUS_NO_SUCH_USER;
2900         }
2901
2902         acb_info = pdb_get_acct_ctrl(pwd);
2903         if ( acb_info & ACB_WSTRUST )
2904                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
2905         else if ( acb_info & ACB_NORMAL )
2906                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
2907         else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
2908                 if ( lp_enable_privileges() )
2909                         has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
2910         }
2911
2912         DEBUG(5, ("_samr_set_userinfo: %s does%s possess sufficient rights\n",
2913                 p->pipe_user_name, has_enough_rights ? "" : " not"));
2914
2915         /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
2916
2917         if ( has_enough_rights )
2918                 become_root();
2919
2920         /* ok!  user info levels (lots: see MSDEV help), off we go... */
2921
2922         switch (switch_value) {
2923                 case 16:
2924                         if (!set_user_info_10(ctr->info.id10, pwd))
2925                                 r_u->status = NT_STATUS_ACCESS_DENIED;
2926                         break;
2927                 case 18:
2928                         /* Used by AS/U JRA. */
2929                         if (!set_user_info_12(ctr->info.id12, pwd))
2930                                 r_u->status = NT_STATUS_ACCESS_DENIED;
2931                         break;
2932                 case 20:
2933                         if (!set_user_info_20(ctr->info.id20, pwd))
2934                                 r_u->status = NT_STATUS_ACCESS_DENIED;
2935                         break;
2936                 case 21:
2937                         if (!set_user_info_21(ctr->info.id21, pwd))
2938                                 return NT_STATUS_ACCESS_DENIED;
2939                         break;
2940                 default:
2941                         r_u->status = NT_STATUS_INVALID_INFO_CLASS;
2942         }
2943
2944         if ( has_enough_rights )
2945                 unbecome_root();
2946
2947         /* ================ END SeMachineAccountPrivilege BLOCK ================ */
2948
2949         return r_u->status;
2950 }
2951
2952 /*********************************************************************
2953  _samr_query_aliasmem
2954 *********************************************************************/
2955
2956 NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u, SAMR_R_QUERY_USERALIASES *r_u)
2957 {
2958         int num_alias_rids;
2959         uint32 *alias_rids;
2960         struct samr_info *info = NULL;
2961         int i;
2962
2963         NTSTATUS ntstatus1;
2964         NTSTATUS ntstatus2;
2965
2966         DOM_SID *members;
2967         BOOL res;
2968
2969         r_u->status = NT_STATUS_OK;
2970
2971         DEBUG(5,("_samr_query_useraliases: %d\n", __LINE__));
2972
2973         /* find the policy handle.  open a policy on it. */
2974         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
2975                 return NT_STATUS_INVALID_HANDLE;
2976
2977         ntstatus1 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM, "_samr_query_useraliases");
2978         ntstatus2 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_query_useraliases");
2979
2980         if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
2981                 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
2982                     !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
2983                         return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
2984                 }
2985         }
2986
2987         if (!sid_check_is_domain(&info->sid) &&
2988             !sid_check_is_builtin(&info->sid))
2989                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2990
2991         members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, q_u->num_sids1);
2992
2993         if (members == NULL)
2994                 return NT_STATUS_NO_MEMORY;
2995
2996         for (i=0; i<q_u->num_sids1; i++)
2997                 sid_copy(&members[i], &q_u->sid[i].sid);
2998
2999         alias_rids = NULL;
3000         num_alias_rids = 0;
3001
3002         become_root();
3003         res = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
3004                                          q_u->num_sids1,
3005                                          &alias_rids, &num_alias_rids);
3006         unbecome_root();
3007
3008         if (!res)
3009                 return NT_STATUS_UNSUCCESSFUL;
3010
3011         init_samr_r_query_useraliases(r_u, num_alias_rids, alias_rids,
3012                                       NT_STATUS_OK);
3013         return NT_STATUS_OK;
3014 }
3015
3016 /*********************************************************************
3017  _samr_query_aliasmem
3018 *********************************************************************/
3019
3020 NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_R_QUERY_ALIASMEM *r_u)
3021 {
3022         int i;
3023
3024         int num_sids = 0;
3025         DOM_SID2 *sid;
3026         DOM_SID *sids=NULL;
3027
3028         DOM_SID alias_sid;
3029
3030         uint32 acc_granted;
3031
3032         /* find the policy handle.  open a policy on it. */
3033         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3034                 return NT_STATUS_INVALID_HANDLE;
3035
3036         if (!NT_STATUS_IS_OK(r_u->status =
3037                 access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_GET_MEMBERS, "_samr_query_aliasmem"))) {
3038                 return r_u->status;
3039         }
3040
3041         DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
3042
3043         if (!pdb_enum_aliasmem(&alias_sid, &sids, &num_sids))
3044                 return NT_STATUS_NO_SUCH_ALIAS;
3045
3046         sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_sids);
3047         if (num_sids!=0 && sid == NULL) {
3048                 SAFE_FREE(sids);
3049                 return NT_STATUS_NO_MEMORY;
3050         }
3051
3052         for (i = 0; i < num_sids; i++) {
3053                 init_dom_sid2(&sid[i], &sids[i]);
3054         }
3055
3056         init_samr_r_query_aliasmem(r_u, num_sids, sid, NT_STATUS_OK);
3057
3058         SAFE_FREE(sids);
3059
3060         return NT_STATUS_OK;
3061 }
3062
3063 static void add_uid_to_array_unique(uid_t uid, uid_t **uids, int *num)
3064 {
3065         int i;
3066
3067         for (i=0; i<*num; i++) {
3068                 if ((*uids)[i] == uid)
3069                         return;
3070         }
3071
3072         *uids = SMB_REALLOC_ARRAY(*uids, uid_t, *num+1);
3073
3074         if (*uids == NULL)
3075                 return;
3076
3077         (*uids)[*num] = uid;
3078         *num += 1;
3079 }
3080
3081
3082 static BOOL get_memberuids(gid_t gid, uid_t **uids, int *num)
3083 {
3084         struct group *grp;
3085         char **gr;
3086         struct sys_pwent *userlist, *user;
3087
3088         *uids = NULL;
3089         *num = 0;
3090
3091         /* We only look at our own sam, so don't care about imported stuff */
3092
3093         winbind_off();
3094
3095         if ((grp = getgrgid(gid)) == NULL) {
3096                 winbind_on();
3097                 return False;
3098         }
3099
3100         /* Primary group members */
3101
3102         userlist = getpwent_list();
3103
3104         for (user = userlist; user != NULL; user = user->next) {
3105                 if (user->pw_gid != gid)
3106                         continue;
3107                 add_uid_to_array_unique(user->pw_uid, uids, num);
3108         }
3109
3110         pwent_free(userlist);
3111
3112         /* Secondary group members */
3113
3114         for (gr = grp->gr_mem; (*gr != NULL) && ((*gr)[0] != '\0'); gr += 1) {
3115                 struct passwd *pw = getpwnam(*gr);
3116
3117                 if (pw == NULL)
3118                         continue;
3119                 add_uid_to_array_unique(pw->pw_uid, uids, num);
3120         }
3121
3122         winbind_on();
3123
3124         return True;
3125 }
3126
3127 /*********************************************************************
3128  _samr_query_groupmem
3129 *********************************************************************/
3130
3131 NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_R_QUERY_GROUPMEM *r_u)
3132 {
3133         DOM_SID group_sid;
3134         fstring group_sid_str;
3135         int i, num_members;
3136
3137         uint32 *rid=NULL;
3138         uint32 *attr=NULL;
3139
3140         uint32 acc_granted;
3141
3142         NTSTATUS result;
3143
3144         /* find the policy handle.  open a policy on it. */
3145         if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3146                 return NT_STATUS_INVALID_HANDLE;
3147
3148         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_GET_MEMBERS, "_samr_query_groupmem"))) {
3149                 return r_u->status;
3150         }
3151
3152         sid_to_string(group_sid_str, &group_sid);
3153         DEBUG(10, ("sid is %s\n", group_sid_str));
3154
3155         if (!sid_check_is_in_our_domain(&group_sid)) {
3156                 DEBUG(3, ("sid %s is not in our domain\n", group_sid_str));
3157                 return NT_STATUS_NO_SUCH_GROUP;
3158         }
3159
3160         DEBUG(10, ("lookup on Domain SID\n"));
3161
3162         become_root();
3163         result = pdb_enum_group_members(p->mem_ctx, &group_sid,
3164                                         &rid, &num_members);
3165         unbecome_root();
3166
3167         if (!NT_STATUS_IS_OK(result))
3168                 return result;
3169
3170         attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
3171
3172         if ((num_members!=0) && (rid==NULL))
3173                 return NT_STATUS_NO_MEMORY;
3174
3175         for (i=0; i<num_members; i++)
3176                 attr[i] = SID_NAME_USER;
3177
3178         init_samr_r_query_groupmem(r_u, num_members, rid, attr, NT_STATUS_OK);
3179
3180         return NT_STATUS_OK;
3181 }
3182
3183 /*********************************************************************
3184  _samr_add_aliasmem
3185 *********************************************************************/
3186
3187 NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_ADD_ALIASMEM *r_u)
3188 {
3189         DOM_SID alias_sid;
3190         uint32 acc_granted;
3191         SE_PRIV se_rights;
3192         BOOL can_add_accounts;
3193         BOOL ret;
3194
3195
3196         /* Find the policy handle. Open a policy on it. */
3197         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3198                 return NT_STATUS_INVALID_HANDLE;
3199
3200         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_ADD_MEMBER, "_samr_add_aliasmem"))) {
3201                 return r_u->status;
3202         }
3203
3204         DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
3205
3206         se_priv_copy( &se_rights, &se_add_users );
3207         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3208
3209         /******** BEGIN SeAddUsers BLOCK *********/
3210
3211         if ( can_add_accounts )
3212                 become_root();
3213
3214         ret = pdb_add_aliasmem(&alias_sid, &q_u->sid.sid);
3215
3216         if ( can_add_accounts )
3217                 unbecome_root();
3218
3219         /******** END SeAddUsers BLOCK *********/
3220
3221         return ret ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3222 }
3223
3224 /*********************************************************************
3225  _samr_del_aliasmem
3226 *********************************************************************/
3227
3228 NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DEL_ALIASMEM *r_u)
3229 {
3230         DOM_SID alias_sid;
3231         uint32 acc_granted;
3232         SE_PRIV se_rights;
3233         BOOL can_add_accounts;
3234         BOOL ret;
3235
3236         /* Find the policy handle. Open a policy on it. */
3237         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3238                 return NT_STATUS_INVALID_HANDLE;
3239
3240         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
3241                 return r_u->status;
3242         }
3243
3244         DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
3245                    sid_string_static(&alias_sid)));
3246
3247         se_priv_copy( &se_rights, &se_add_users );
3248         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3249
3250         /******** BEGIN SeAddUsers BLOCK *********/
3251
3252         if ( can_add_accounts )
3253                 become_root();
3254
3255         ret = pdb_del_aliasmem(&alias_sid, &q_u->sid.sid);
3256
3257         if ( can_add_accounts )
3258                 unbecome_root();
3259
3260         /******** END SeAddUsers BLOCK *********/
3261
3262         return ret ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3263 }
3264
3265 /*********************************************************************
3266  _samr_add_groupmem
3267 *********************************************************************/
3268
3269 NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_ADD_GROUPMEM *r_u)
3270 {
3271         DOM_SID group_sid;
3272         DOM_SID user_sid;
3273         fstring group_sid_str;
3274         uid_t uid;
3275         struct passwd *pwd;
3276         struct group *grp;
3277         fstring grp_name;
3278         GROUP_MAP map;
3279         NTSTATUS ret;
3280         SAM_ACCOUNT *sam_user=NULL;
3281         BOOL check;
3282         uint32 acc_granted;
3283         SE_PRIV se_rights;
3284         BOOL can_add_accounts;
3285
3286         /* Find the policy handle. Open a policy on it. */
3287         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3288                 return NT_STATUS_INVALID_HANDLE;
3289
3290         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_ADD_MEMBER, "_samr_add_groupmem"))) {
3291                 return r_u->status;
3292         }
3293
3294         sid_to_string(group_sid_str, &group_sid);
3295         DEBUG(10, ("sid is %s\n", group_sid_str));
3296
3297         if (sid_compare(&group_sid, get_global_sam_sid())<=0)
3298                 return NT_STATUS_NO_SUCH_GROUP;
3299
3300         DEBUG(10, ("lookup on Domain SID\n"));
3301
3302         if(!get_domain_group_from_sid(group_sid, &map))
3303                 return NT_STATUS_NO_SUCH_GROUP;
3304
3305         sid_copy(&user_sid, get_global_sam_sid());
3306         sid_append_rid(&user_sid, q_u->rid);
3307
3308         ret = pdb_init_sam(&sam_user);
3309         if (!NT_STATUS_IS_OK(ret))
3310                 return ret;
3311
3312         check = pdb_getsampwsid(sam_user, &user_sid);
3313
3314         if (check != True) {
3315                 pdb_free_sam(&sam_user);
3316                 return NT_STATUS_NO_SUCH_USER;
3317         }
3318
3319         /* check a real user exist before we run the script to add a user to a group */
3320         if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) {
3321                 pdb_free_sam(&sam_user);
3322                 return NT_STATUS_NO_SUCH_USER;
3323         }
3324
3325         pdb_free_sam(&sam_user);
3326
3327         if ((pwd=getpwuid_alloc(uid)) == NULL) {
3328                 return NT_STATUS_NO_SUCH_USER;
3329         }
3330
3331         if ((grp=getgrgid(map.gid)) == NULL) {
3332                 passwd_free(&pwd);
3333                 return NT_STATUS_NO_SUCH_GROUP;
3334         }
3335
3336         /* we need to copy the name otherwise it's overloaded in user_in_unix_group_list */
3337         fstrcpy(grp_name, grp->gr_name);
3338
3339         /* if the user is already in the group */
3340         if(user_in_unix_group_list(pwd->pw_name, grp_name)) {
3341                 passwd_free(&pwd);
3342                 return NT_STATUS_MEMBER_IN_GROUP;
3343         }
3344
3345         se_priv_copy( &se_rights, &se_add_users );
3346         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3347
3348         /******** BEGIN SeAddUsers BLOCK *********/
3349
3350         if ( can_add_accounts )
3351                 become_root();
3352
3353         /*
3354          * ok, the group exist, the user exist, the user is not in the group,
3355          *
3356          * we can (finally) add it to the group !
3357          */
3358
3359         smb_add_user_group(grp_name, pwd->pw_name);
3360
3361         if ( can_add_accounts )
3362                 unbecome_root();
3363
3364         /******** END SeAddUsers BLOCK *********/
3365
3366         /* check if the user has been added then ... */
3367         if(!user_in_unix_group_list(pwd->pw_name, grp_name)) {
3368                 passwd_free(&pwd);
3369                 return NT_STATUS_MEMBER_NOT_IN_GROUP;           /* don't know what to reply else */
3370         }
3371
3372         passwd_free(&pwd);
3373         return NT_STATUS_OK;
3374 }
3375
3376 /*********************************************************************
3377  _samr_del_groupmem
3378 *********************************************************************/
3379
3380 NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DEL_GROUPMEM *r_u)
3381 {
3382         DOM_SID group_sid;
3383         DOM_SID user_sid;
3384         SAM_ACCOUNT *sam_pass=NULL;
3385         GROUP_MAP map;
3386         fstring grp_name;
3387         struct group *grp;
3388         uint32 acc_granted;
3389         SE_PRIV se_rights;
3390         BOOL can_add_accounts;
3391
3392         /*
3393          * delete the group member named q_u->rid
3394          * who is a member of the sid associated with the handle
3395          * the rid is a user's rid as the group is a domain group.
3396          */
3397
3398         /* Find the policy handle. Open a policy on it. */
3399         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3400                 return NT_STATUS_INVALID_HANDLE;
3401
3402         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_REMOVE_MEMBER, "_samr_del_groupmem"))) {
3403                 return r_u->status;
3404         }
3405
3406         if (!sid_check_is_in_our_domain(&group_sid))
3407                 return NT_STATUS_NO_SUCH_GROUP;
3408
3409         sid_copy(&user_sid, get_global_sam_sid());
3410         sid_append_rid(&user_sid, q_u->rid);
3411
3412         if (!get_domain_group_from_sid(group_sid, &map))
3413                 return NT_STATUS_NO_SUCH_GROUP;
3414
3415         if ((grp=getgrgid(map.gid)) == NULL)
3416                 return NT_STATUS_NO_SUCH_GROUP;
3417
3418         /* we need to copy the name otherwise it's overloaded in user_in_group_list */
3419         fstrcpy(grp_name, grp->gr_name);
3420
3421         /* check if the user exists before trying to remove it from the group */
3422         pdb_init_sam(&sam_pass);
3423         if (!pdb_getsampwsid(sam_pass, &user_sid)) {
3424                 DEBUG(5,("User %s doesn't exist.\n", pdb_get_username(sam_pass)));
3425                 pdb_free_sam(&sam_pass);
3426                 return NT_STATUS_NO_SUCH_USER;
3427         }
3428
3429         /* if the user is not in the group */
3430         if (!user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3431                 pdb_free_sam(&sam_pass);
3432                 return NT_STATUS_MEMBER_NOT_IN_GROUP;
3433         }
3434
3435
3436         se_priv_copy( &se_rights, &se_add_users );
3437         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3438
3439         /******** BEGIN SeAddUsers BLOCK *********/
3440
3441         if ( can_add_accounts )
3442                 become_root();
3443
3444         smb_delete_user_group(grp_name, pdb_get_username(sam_pass));
3445
3446         if ( can_add_accounts )
3447                 unbecome_root();
3448
3449         /******** END SeAddUsers BLOCK *********/
3450
3451         /* check if the user has been removed then ... */
3452         if (user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3453                 pdb_free_sam(&sam_pass);
3454                 return NT_STATUS_ACCESS_DENIED;         /* don't know what to reply else */
3455         }
3456
3457         pdb_free_sam(&sam_pass);
3458         return NT_STATUS_OK;
3459
3460 }
3461
3462 /****************************************************************************
3463  Delete a UNIX user on demand.
3464 ****************************************************************************/
3465
3466 static int smb_delete_user(const char *unix_user)
3467 {
3468         pstring del_script;
3469         int ret;
3470
3471         /* try winbindd first since it is impossible to determine where
3472            a user came from via NSS.  Try the delete user script if this fails
3473            meaning the user did not exist in winbindd's list of accounts */
3474
3475         if ( winbind_delete_user( unix_user ) ) {
3476                 DEBUG(3,("winbind_delete_user: removed user (%s)\n", unix_user));
3477                 return 0;
3478         }
3479
3480
3481         /* fall back to 'delete user script' */
3482
3483         pstrcpy(del_script, lp_deluser_script());
3484         if (! *del_script)
3485                 return -1;
3486         all_string_sub(del_script, "%u", unix_user, sizeof(del_script));
3487         ret = smbrun(del_script,NULL);
3488         flush_pwnam_cache();
3489         DEBUG(ret ? 0 : 3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
3490
3491         return ret;
3492 }
3493
3494 /*********************************************************************
3495  _samr_delete_dom_user
3496 *********************************************************************/
3497
3498 NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAMR_R_DELETE_DOM_USER *r_u )
3499 {
3500         DOM_SID user_sid;
3501         SAM_ACCOUNT *sam_pass=NULL;
3502         uint32 acc_granted;
3503         BOOL can_add_accounts;
3504         BOOL ret;
3505
3506         DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__));
3507
3508         /* Find the policy handle. Open a policy on it. */
3509         if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid, &acc_granted))
3510                 return NT_STATUS_INVALID_HANDLE;
3511
3512         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_user"))) {
3513                 return r_u->status;
3514         }
3515
3516         if (!sid_check_is_in_our_domain(&user_sid))
3517                 return NT_STATUS_CANNOT_DELETE;
3518
3519         /* check if the user exists before trying to delete */
3520         pdb_init_sam(&sam_pass);
3521         if(!pdb_getsampwsid(sam_pass, &user_sid)) {
3522                 DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n",
3523                         sid_string_static(&user_sid)));
3524                 pdb_free_sam(&sam_pass);
3525                 return NT_STATUS_NO_SUCH_USER;
3526         }
3527
3528         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
3529
3530         /******** BEGIN SeAddUsers BLOCK *********/
3531
3532         if ( can_add_accounts )
3533                 become_root();
3534
3535         /* First delete the samba side....
3536            code is order to prevent unnecessary returns out of the admin
3537            block of code */
3538
3539         if ( (ret = pdb_delete_sam_account(sam_pass)) == True ) {
3540                 /*
3541                  * Now delete the unix side ....
3542                  * note: we don't check if the delete really happened
3543                  * as the script is not necessary present
3544                  * and maybe the sysadmin doesn't want to delete the unix side
3545                  */
3546                 smb_delete_user( pdb_get_username(sam_pass) );
3547         }
3548
3549         if ( can_add_accounts )
3550                 unbecome_root();
3551
3552         /******** END SeAddUsers BLOCK *********/
3553
3554         if ( !ret ) {
3555                 DEBUG(5,("_samr_delete_dom_user:Failed to delete entry for user %s.\n", pdb_get_username(sam_pass)));
3556                 pdb_free_sam(&sam_pass);
3557                 return NT_STATUS_CANNOT_DELETE;
3558         }
3559
3560
3561         pdb_free_sam(&sam_pass);
3562
3563         if (!close_policy_hnd(p, &q_u->user_pol))
3564                 return NT_STATUS_OBJECT_NAME_INVALID;
3565
3566         return NT_STATUS_OK;
3567 }
3568
3569 /*********************************************************************
3570  _samr_delete_dom_group
3571 *********************************************************************/
3572
3573 NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, SAMR_R_DELETE_DOM_GROUP *r_u)
3574 {
3575         DOM_SID group_sid;
3576         DOM_SID dom_sid;
3577         uint32 group_rid;
3578         fstring group_sid_str;
3579         gid_t gid;
3580         struct group *grp;
3581         GROUP_MAP map;
3582         uint32 acc_granted;
3583         SE_PRIV se_rights;
3584         BOOL can_add_accounts;
3585         BOOL ret;
3586
3587         DEBUG(5, ("samr_delete_dom_group: %d\n", __LINE__));
3588
3589         /* Find the policy handle. Open a policy on it. */
3590         if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3591                 return NT_STATUS_INVALID_HANDLE;
3592
3593         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_group"))) {
3594                 return r_u->status;
3595         }
3596
3597         sid_copy(&dom_sid, &group_sid);
3598         sid_to_string(group_sid_str, &dom_sid);
3599         sid_split_rid(&dom_sid, &group_rid);
3600
3601         DEBUG(10, ("sid is %s\n", group_sid_str));
3602
3603         /* we check if it's our SID before deleting */
3604         if (!sid_equal(&dom_sid, get_global_sam_sid()))
3605                 return NT_STATUS_NO_SUCH_GROUP;
3606
3607         DEBUG(10, ("lookup on Domain SID\n"));
3608
3609         if(!get_domain_group_from_sid(group_sid, &map))
3610                 return NT_STATUS_NO_SUCH_GROUP;
3611
3612         gid=map.gid;
3613
3614         /* check if group really exists */
3615         if ( (grp=getgrgid(gid)) == NULL)
3616                 return NT_STATUS_NO_SUCH_GROUP;
3617
3618         se_priv_copy( &se_rights, &se_add_users );
3619         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3620
3621         /******** BEGIN SeAddUsers BLOCK *********/
3622
3623         if ( can_add_accounts )
3624                 become_root();
3625
3626         /* delete mapping first */
3627
3628         if ( (ret = pdb_delete_group_mapping_entry(group_sid)) == True ) {
3629                 smb_delete_group( grp->gr_name );
3630         }
3631
3632         if ( can_add_accounts )
3633                 unbecome_root();
3634
3635         /******** END SeAddUsers BLOCK *********/
3636
3637         if ( !ret ) {
3638                 DEBUG(5,("_samr_delete_dom_group: Failed to delete mapping entry for group %s.\n",
3639                         group_sid_str));
3640                 return NT_STATUS_ACCESS_DENIED;
3641         }
3642
3643         /* don't check that the unix group has been deleted.  Work like
3644            _samr_delet_dom_user() */
3645
3646         if (!close_policy_hnd(p, &q_u->group_pol))
3647                 return NT_STATUS_OBJECT_NAME_INVALID;
3648
3649         return NT_STATUS_OK;
3650 }
3651
3652 /*********************************************************************
3653  _samr_delete_dom_alias
3654 *********************************************************************/
3655
3656 NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, SAMR_R_DELETE_DOM_ALIAS *r_u)
3657 {
3658         DOM_SID alias_sid;
3659         uint32 acc_granted;
3660         SE_PRIV se_rights;
3661         BOOL can_add_accounts;
3662         BOOL ret;
3663
3664         DEBUG(5, ("_samr_delete_dom_alias: %d\n", __LINE__));
3665
3666         /* Find the policy handle. Open a policy on it. */
3667         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3668                 return NT_STATUS_INVALID_HANDLE;
3669
3670         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_alias"))) {
3671                 return r_u->status;
3672         }
3673
3674         DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
3675
3676         if (!sid_check_is_in_our_domain(&alias_sid))
3677                 return NT_STATUS_NO_SUCH_ALIAS;
3678
3679         DEBUG(10, ("lookup on Local SID\n"));
3680
3681         se_priv_copy( &se_rights, &se_add_users );
3682         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3683
3684         /******** BEGIN SeAddUsers BLOCK *********/
3685
3686         if ( can_add_accounts )
3687                 become_root();
3688
3689         /* Have passdb delete the alias */
3690         ret = pdb_delete_alias(&alias_sid);
3691
3692         if ( can_add_accounts )
3693                 unbecome_root();
3694
3695         /******** END SeAddUsers BLOCK *********/
3696
3697         if ( !ret )
3698                 return NT_STATUS_ACCESS_DENIED;
3699
3700         if (!close_policy_hnd(p, &q_u->alias_pol))
3701                 return NT_STATUS_OBJECT_NAME_INVALID;
3702
3703         return NT_STATUS_OK;
3704 }
3705
3706 /*********************************************************************
3707  _samr_create_dom_group
3708 *********************************************************************/
3709
3710 NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, SAMR_R_CREATE_DOM_GROUP *r_u)
3711 {
3712         DOM_SID dom_sid;
3713         DOM_SID info_sid;
3714         fstring name;
3715         fstring sid_string;
3716         struct group *grp;
3717         struct samr_info *info;
3718         uint32 acc_granted;
3719         gid_t gid;
3720         SE_PRIV se_rights;
3721         BOOL can_add_accounts;
3722         NTSTATUS result;
3723
3724         /* Find the policy handle. Open a policy on it. */
3725         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted))
3726                 return NT_STATUS_INVALID_HANDLE;
3727
3728         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_GROUP, "_samr_create_dom_group"))) {
3729                 return r_u->status;
3730         }
3731
3732         if (!sid_equal(&dom_sid, get_global_sam_sid()))
3733                 return NT_STATUS_ACCESS_DENIED;
3734
3735         unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
3736
3737         /* check if group already exist */
3738         if ((grp=getgrnam(name)) != NULL)
3739                 return NT_STATUS_GROUP_EXISTS;
3740
3741         se_priv_copy( &se_rights, &se_add_users );
3742         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3743
3744         /******** BEGIN SeAddUsers BLOCK *********/
3745
3746         if ( can_add_accounts )
3747                 become_root();
3748
3749         /* check that we successfully create the UNIX group */
3750
3751         result = NT_STATUS_ACCESS_DENIED;
3752         if ( (smb_create_group(name, &gid) == 0) && ((grp=getgrgid(gid)) != NULL) ) {
3753
3754                 /* so far, so good */
3755
3756                 result = NT_STATUS_OK;
3757
3758                 r_u->rid = pdb_gid_to_group_rid( grp->gr_gid );
3759
3760                 /* add the group to the mapping table */
3761
3762                 sid_copy( &info_sid, get_global_sam_sid() );
3763                 sid_append_rid( &info_sid, r_u->rid );
3764                 sid_to_string( sid_string, &info_sid );
3765
3766                 /* reset the error code if we fail to add the mapping entry */
3767
3768                 if ( !add_initial_entry(grp->gr_gid, sid_string, SID_NAME_DOM_GRP, name, NULL) )
3769                         result = NT_STATUS_ACCESS_DENIED;
3770         }
3771
3772         if ( can_add_accounts )
3773                 unbecome_root();
3774
3775         /******** END SeAddUsers BLOCK *********/
3776
3777         /* check if we should bail out here */
3778
3779         if ( !NT_STATUS_IS_OK(result) )
3780                 return result;
3781
3782         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
3783                 return NT_STATUS_NO_MEMORY;
3784
3785         /* get a (unique) handle.  open a policy on it. */
3786         if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
3787                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3788
3789         return NT_STATUS_OK;
3790 }
3791
3792 /*********************************************************************
3793  _samr_create_dom_alias
3794 *********************************************************************/
3795
3796 NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, SAMR_R_CREATE_DOM_ALIAS *r_u)
3797 {
3798         DOM_SID dom_sid;
3799         DOM_SID info_sid;
3800         fstring name;
3801         struct samr_info *info;
3802         uint32 acc_granted;
3803         gid_t gid;
3804         NTSTATUS result;
3805         SE_PRIV se_rights;
3806         BOOL can_add_accounts;
3807
3808         /* Find the policy handle. Open a policy on it. */
3809         if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
3810                 return NT_STATUS_INVALID_HANDLE;
3811
3812         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_ALIAS, "_samr_create_alias"))) {
3813                 return r_u->status;
3814         }
3815
3816         if (!sid_equal(&dom_sid, get_global_sam_sid()))
3817                 return NT_STATUS_ACCESS_DENIED;
3818
3819         unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
3820
3821         se_priv_copy( &se_rights, &se_add_users );
3822         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3823
3824         /******** BEGIN SeAddUsers BLOCK *********/
3825
3826         if ( can_add_accounts )
3827                 become_root();
3828
3829         /* Have passdb create the alias */
3830         result = pdb_create_alias(name, &r_u->rid);
3831
3832         if ( can_add_accounts )
3833                 unbecome_root();
3834
3835         /******** END SeAddUsers BLOCK *********/
3836
3837         if (!NT_STATUS_IS_OK(result))
3838                 return result;
3839
3840         sid_copy(&info_sid, get_global_sam_sid());
3841         sid_append_rid(&info_sid, r_u->rid);
3842
3843         if (!NT_STATUS_IS_OK(sid_to_gid(&info_sid, &gid)))
3844                 return NT_STATUS_ACCESS_DENIED;
3845
3846         /* check if the group has been successfully created */
3847         if ( getgrgid(gid) == NULL )
3848                 return NT_STATUS_ACCESS_DENIED;
3849
3850         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
3851                 return NT_STATUS_NO_MEMORY;
3852
3853         /* get a (unique) handle.  open a policy on it. */
3854         if (!create_policy_hnd(p, &r_u->alias_pol, free_samr_info, (void *)info))
3855                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3856
3857         return NT_STATUS_OK;
3858 }
3859
3860 /*********************************************************************
3861  _samr_query_groupinfo
3862
3863 sends the name/comment pair of a domain group
3864 level 1 send also the number of users of that group
3865 *********************************************************************/
3866
3867 NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAMR_R_QUERY_GROUPINFO *r_u)
3868 {
3869         DOM_SID group_sid;
3870         GROUP_MAP map;
3871         DOM_SID *sids=NULL;
3872         uid_t *uids;
3873         int num=0;
3874         GROUP_INFO_CTR *ctr;
3875         uint32 acc_granted;
3876         BOOL ret;
3877
3878         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3879                 return NT_STATUS_INVALID_HANDLE;
3880
3881         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_LOOKUP_INFO, "_samr_query_groupinfo"))) {
3882                 return r_u->status;
3883         }
3884
3885         become_root();
3886         ret = get_domain_group_from_sid(group_sid, &map);
3887         unbecome_root();
3888         if (!ret)
3889                 return NT_STATUS_INVALID_HANDLE;
3890
3891         ctr=TALLOC_ZERO_P(p->mem_ctx, GROUP_INFO_CTR);
3892         if (ctr==NULL)
3893                 return NT_STATUS_NO_MEMORY;
3894
3895         switch (q_u->switch_level) {
3896                 case 1:
3897                         ctr->switch_value1 = 1;
3898                         if(!get_memberuids(map.gid, &uids, &num))
3899                                 return NT_STATUS_NO_SUCH_GROUP;
3900                         SAFE_FREE(uids);
3901                         init_samr_group_info1(&ctr->group.info1, map.nt_name, map.comment, num);
3902                         SAFE_FREE(sids);
3903                         break;
3904                 case 3:
3905                         ctr->switch_value1 = 3;
3906                         init_samr_group_info3(&ctr->group.info3);
3907                         break;
3908                 case 4:
3909                         ctr->switch_value1 = 4;
3910                         init_samr_group_info4(&ctr->group.info4, map.comment);
3911                         break;
3912                 default:
3913                         return NT_STATUS_INVALID_INFO_CLASS;
3914         }
3915
3916         init_samr_r_query_groupinfo(r_u, ctr, NT_STATUS_OK);
3917
3918         return NT_STATUS_OK;
3919 }
3920
3921 /*********************************************************************
3922  _samr_set_groupinfo
3923
3924  update a domain group's comment.
3925 *********************************************************************/
3926
3927 NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_SET_GROUPINFO *r_u)
3928 {
3929         DOM_SID group_sid;
3930         GROUP_MAP map;
3931         GROUP_INFO_CTR *ctr;
3932         uint32 acc_granted;
3933
3934         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3935                 return NT_STATUS_INVALID_HANDLE;
3936
3937         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_SET_INFO, "_samr_set_groupinfo"))) {
3938                 return r_u->status;
3939         }
3940
3941         if (!get_domain_group_from_sid(group_sid, &map))
3942                 return NT_STATUS_NO_SUCH_GROUP;
3943
3944         ctr=q_u->ctr;
3945
3946         switch (ctr->switch_value1) {
3947                 case 1:
3948                         unistr2_to_ascii(map.comment, &(ctr->group.info1.uni_acct_desc), sizeof(map.comment)-1);
3949                         break;
3950                 case 4:
3951                         unistr2_to_ascii(map.comment, &(ctr->group.info4.uni_acct_desc), sizeof(map.comment)-1);
3952                         break;
3953                 default:
3954                         return NT_STATUS_INVALID_INFO_CLASS;
3955         }
3956
3957         if(!pdb_update_group_mapping_entry(&map)) {
3958                 return NT_STATUS_NO_SUCH_GROUP;
3959         }
3960
3961         return NT_STATUS_OK;
3962 }
3963
3964 /*********************************************************************
3965  _samr_set_aliasinfo
3966
3967  update an alias's comment.
3968 *********************************************************************/
3969
3970 NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_SET_ALIASINFO *r_u)
3971 {
3972         DOM_SID group_sid;
3973         struct acct_info info;
3974         ALIAS_INFO_CTR *ctr;
3975         uint32 acc_granted;
3976
3977         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid, &acc_granted))
3978                 return NT_STATUS_INVALID_HANDLE;
3979
3980         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_SET_INFO, "_samr_set_aliasinfo"))) {
3981                 return r_u->status;
3982         }
3983
3984         ctr=&q_u->ctr;
3985
3986         switch (ctr->switch_value1) {
3987                 case 3:
3988                         unistr2_to_ascii(info.acct_desc,
3989                                          &(ctr->alias.info3.uni_acct_desc),
3990                                          sizeof(info.acct_desc)-1);
3991                         break;
3992                 default:
3993                         return NT_STATUS_INVALID_INFO_CLASS;
3994         }
3995
3996         if(!pdb_set_aliasinfo(&group_sid, &info)) {
3997                 return NT_STATUS_ACCESS_DENIED;
3998         }
3999
4000         return NT_STATUS_OK;
4001 }
4002
4003 /*********************************************************************
4004  _samr_get_dom_pwinfo
4005 *********************************************************************/
4006
4007 NTSTATUS _samr_get_dom_pwinfo(pipes_struct *p, SAMR_Q_GET_DOM_PWINFO *q_u, SAMR_R_GET_DOM_PWINFO *r_u)
4008 {
4009         /* Perform access check.  Since this rpc does not require a
4010            policy handle it will not be caught by the access checks on
4011            SAMR_CONNECT or SAMR_CONNECT_ANON. */
4012
4013         if (!pipe_access_check(p)) {
4014                 DEBUG(3, ("access denied to samr_get_dom_pwinfo\n"));
4015                 r_u->status = NT_STATUS_ACCESS_DENIED;
4016                 return r_u->status;
4017         }
4018
4019         /* Actually, returning zeros here works quite well :-). */
4020
4021         return NT_STATUS_OK;
4022 }
4023
4024 /*********************************************************************
4025  _samr_open_group
4026 *********************************************************************/
4027
4028 NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_GROUP *r_u)
4029 {
4030         DOM_SID sid;
4031         DOM_SID info_sid;
4032         GROUP_MAP map;
4033         struct samr_info *info;
4034         SEC_DESC         *psd = NULL;
4035         uint32            acc_granted;
4036         uint32            des_access = q_u->access_mask;
4037         size_t            sd_size;
4038         NTSTATUS          status;
4039         fstring sid_string;
4040         BOOL ret;
4041         SE_PRIV se_rights;
4042
4043         if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid, &acc_granted))
4044                 return NT_STATUS_INVALID_HANDLE;
4045
4046         status = access_check_samr_function(acc_granted,
4047                 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_group");
4048
4049         if ( !NT_STATUS_IS_OK(status) )
4050                 return status;
4051
4052         /*check if access can be granted as requested by client. */
4053         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
4054         se_map_generic(&des_access,&grp_generic_mapping);
4055
4056         se_priv_copy( &se_rights, &se_add_users );
4057
4058         status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
4059                 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
4060                 &acc_granted, "_samr_open_group");
4061
4062         if ( !NT_STATUS_IS_OK(status) )
4063                 return status;
4064
4065         /* this should not be hard-coded like this */
4066
4067         if (!sid_equal(&sid, get_global_sam_sid()))
4068                 return NT_STATUS_ACCESS_DENIED;
4069
4070         sid_copy(&info_sid, get_global_sam_sid());
4071         sid_append_rid(&info_sid, q_u->rid_group);
4072         sid_to_string(sid_string, &info_sid);
4073
4074         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4075                 return NT_STATUS_NO_MEMORY;
4076
4077         info->acc_granted = acc_granted;
4078
4079         DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string));
4080
4081         /* check if that group really exists */
4082         become_root();
4083         ret = get_domain_group_from_sid(info->sid, &map);
4084         unbecome_root();
4085         if (!ret)
4086                 return NT_STATUS_NO_SUCH_GROUP;
4087
4088         /* get a (unique) handle.  open a policy on it. */
4089         if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
4090                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4091
4092         return NT_STATUS_OK;
4093 }
4094
4095 /*********************************************************************
4096  _samr_remove_sid_foreign_domain
4097 *********************************************************************/
4098
4099 NTSTATUS _samr_remove_sid_foreign_domain(pipes_struct *p,
4100                                           SAMR_Q_REMOVE_SID_FOREIGN_DOMAIN *q_u,
4101                                           SAMR_R_REMOVE_SID_FOREIGN_DOMAIN *r_u)
4102 {
4103         DOM_SID                 delete_sid, domain_sid;
4104         uint32                  acc_granted;
4105         NTSTATUS                result;
4106
4107         sid_copy( &delete_sid, &q_u->sid.sid );
4108
4109         DEBUG(5,("_samr_remove_sid_foreign_domain: removing SID [%s]\n",
4110                 sid_string_static(&delete_sid)));
4111
4112         /* Find the policy handle. Open a policy on it. */
4113
4114         if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &domain_sid,
4115                                      &acc_granted))
4116                 return NT_STATUS_INVALID_HANDLE;
4117
4118         result = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS,
4119                 "_samr_remove_sid_foreign_domain");
4120
4121         if (!NT_STATUS_IS_OK(result))
4122                 return result;
4123
4124         DEBUG(8, ("_samr_remove_sid_foreign_domain:sid is %s\n",
4125                 sid_string_static(&domain_sid)));
4126
4127         /* we can only delete a user from a group since we don't have
4128            nested groups anyways.  So in the latter case, just say OK */
4129
4130         /* TODO: The above comment nowadays is bogus. Since we have nested
4131          * groups now, and aliases members are never reported out of the unix
4132          * group membership, the "just say OK" makes this call a no-op. For
4133          * us. This needs fixing however. */
4134
4135         /* I've only ever seen this in the wild when deleting a user from
4136          * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
4137          * is the user about to be deleted. I very much suspect this is the
4138          * only application of this call. To verify this, let people report
4139          * other cases. */
4140
4141         if (!sid_check_is_builtin(&domain_sid)) {
4142                 DEBUG(1,("_samr_remove_sid_foreign_domain: domain_sid = %s, "
4143                          "global_sam_sid() = %s\n",
4144                          sid_string_static(&domain_sid),
4145                          sid_string_static(get_global_sam_sid())));
4146                 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
4147                 return NT_STATUS_OK;
4148         }
4149
4150
4151         result = NT_STATUS_OK;
4152
4153         return result;
4154 }
4155
4156 /*******************************************************************
4157  _samr_unknown_2e
4158  ********************************************************************/
4159
4160 NTSTATUS _samr_unknown_2e(pipes_struct *p, SAMR_Q_UNKNOWN_2E *q_u, SAMR_R_UNKNOWN_2E *r_u)
4161 {
4162         struct samr_info *info = NULL;
4163         SAM_UNK_CTR *ctr;
4164         uint32 min_pass_len,pass_hist,flag;
4165         time_t u_expire, u_min_age;
4166         NTTIME nt_expire, nt_min_age;
4167
4168         time_t u_lock_duration, u_reset_time;
4169         NTTIME nt_lock_duration, nt_reset_time;
4170         uint32 lockout;
4171
4172         time_t u_logout;
4173         NTTIME nt_logout;
4174
4175         uint32 num_users=0, num_groups=0, num_aliases=0;
4176
4177         uint32 account_policy_temp;
4178         uint32 server_role;
4179
4180         if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
4181                 return NT_STATUS_NO_MEMORY;
4182
4183         ZERO_STRUCTP(ctr);
4184
4185         r_u->status = NT_STATUS_OK;
4186
4187         DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4188
4189         /* find the policy handle.  open a policy on it. */
4190         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
4191                 return NT_STATUS_INVALID_HANDLE;
4192
4193         switch (q_u->switch_value) {
4194                 case 0x01:
4195                         account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
4196                         min_pass_len = account_policy_temp;
4197
4198                         account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
4199                         pass_hist = account_policy_temp;
4200
4201                         account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
4202                         flag = account_policy_temp;
4203
4204                         account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
4205                         u_expire = account_policy_temp;
4206
4207                         account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
4208                         u_min_age = account_policy_temp;
4209
4210                         unix_to_nt_time_abs(&nt_expire, u_expire);
4211                         unix_to_nt_time_abs(&nt_min_age, u_min_age);
4212
4213                         init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
4214                                        flag, nt_expire, nt_min_age);
4215                         break;
4216                 case 0x02:
4217                         become_root();
4218                         num_users = count_sam_users(&info->disp_info,
4219                                                     ACB_NORMAL);
4220                         num_groups = count_sam_groups(&info->disp_info);
4221                         unbecome_root();
4222
4223                         free_samr_db(info);
4224
4225                         account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
4226                         u_logout = account_policy_temp;
4227
4228                         unix_to_nt_time_abs(&nt_logout, u_logout);
4229
4230                         server_role = ROLE_DOMAIN_PDC;
4231                         if (lp_server_role() == ROLE_DOMAIN_BDC)
4232                                 server_role = ROLE_DOMAIN_BDC;
4233
4234                         /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
4235                         init_unk_info2(&ctr->info.inf2, lp_serverstring(), lp_workgroup(), global_myname(), time(NULL),
4236                                        num_users, num_groups, num_aliases, nt_logout, server_role);
4237                         break;
4238                 case 0x03:
4239                         account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
4240                         u_logout = account_policy_temp;
4241
4242                         unix_to_nt_time_abs(&nt_logout, u_logout);
4243
4244                         init_unk_info3(&ctr->info.inf3, nt_logout);
4245                         break;
4246                 case 0x05:
4247                         init_unk_info5(&ctr->info.inf5, global_myname());
4248                         break;
4249                 case 0x06:
4250                         init_unk_info6(&ctr->info.inf6);
4251                         break;
4252                 case 0x07:
4253                         server_role = ROLE_DOMAIN_PDC;
4254                         if (lp_server_role() == ROLE_DOMAIN_BDC)
4255                                 server_role = ROLE_DOMAIN_BDC;
4256                         init_unk_info7(&ctr->info.inf7, server_role);
4257                         break;
4258                 case 0x08:
4259                         init_unk_info8(&ctr->info.inf8, (uint32) time(NULL));
4260                         break;
4261                 case 0x0c:
4262                         account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
4263                         u_lock_duration = account_policy_temp;
4264                         if (u_lock_duration != -1)
4265                                 u_lock_duration *= 60;
4266
4267                         account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
4268                         u_reset_time = account_policy_temp * 60;
4269
4270                         account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
4271                         lockout = account_policy_temp;
4272
4273                         unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
4274                         unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
4275
4276                         init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
4277                         break;
4278                 default:
4279                         return NT_STATUS_INVALID_INFO_CLASS;
4280         }
4281
4282         init_samr_r_samr_unknown_2e(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
4283
4284         DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4285
4286         return r_u->status;
4287 }
4288
4289 /*******************************************************************
4290  _samr_
4291  ********************************************************************/
4292
4293 NTSTATUS _samr_set_dom_info(pipes_struct *p, SAMR_Q_SET_DOMAIN_INFO *q_u, SAMR_R_SET_DOMAIN_INFO *r_u)
4294 {
4295         time_t u_expire, u_min_age;
4296         time_t u_logout;
4297         time_t u_lock_duration, u_reset_time;
4298
4299         r_u->status = NT_STATUS_OK;
4300
4301         DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4302
4303         /* find the policy handle.  open a policy on it. */
4304         if (!find_policy_by_hnd(p, &q_u->domain_pol, NULL))
4305                 return NT_STATUS_INVALID_HANDLE;
4306
4307         DEBUG(5,("_samr_set_dom_info: switch_value: %d\n", q_u->switch_value));
4308
4309         switch (q_u->switch_value) {
4310                 case 0x01:
4311                         u_expire=nt_time_to_unix_abs(&q_u->ctr->info.inf1.expire);
4312                         u_min_age=nt_time_to_unix_abs(&q_u->ctr->info.inf1.min_passwordage);
4313
4314                         account_policy_set(AP_MIN_PASSWORD_LEN, (uint32)q_u->ctr->info.inf1.min_length_password);
4315                         account_policy_set(AP_PASSWORD_HISTORY, (uint32)q_u->ctr->info.inf1.password_history);
4316                         account_policy_set(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)q_u->ctr->info.inf1.flag);
4317                         account_policy_set(AP_MAX_PASSWORD_AGE, (int)u_expire);
4318                         account_policy_set(AP_MIN_PASSWORD_AGE, (int)u_min_age);
4319                         break;
4320                 case 0x02:
4321                         break;
4322                 case 0x03:
4323                         u_logout=nt_time_to_unix_abs(&q_u->ctr->info.inf3.logout);
4324                         account_policy_set(AP_TIME_TO_LOGOUT, (int)u_logout);
4325                         break;
4326                 case 0x05:
4327                         break;
4328                 case 0x06:
4329                         break;
4330                 case 0x07:
4331                         break;
4332                 case 0x0c:
4333                         u_lock_duration=nt_time_to_unix_abs(&q_u->ctr->info.inf12.duration);
4334                         if (u_lock_duration != -1)
4335                                 u_lock_duration /= 60;
4336
4337                         u_reset_time=nt_time_to_unix_abs(&q_u->ctr->info.inf12.reset_count)/60;
4338
4339                         account_policy_set(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
4340                         account_policy_set(AP_RESET_COUNT_TIME, (int)u_reset_time);
4341                         account_policy_set(AP_BAD_ATTEMPT_LOCKOUT, (uint32)q_u->ctr->info.inf12.bad_attempt_lockout);
4342                         break;
4343                 default:
4344                         return NT_STATUS_INVALID_INFO_CLASS;
4345         }
4346
4347         init_samr_r_set_domain_info(r_u, NT_STATUS_OK);
4348
4349         DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4350
4351         return r_u->status;
4352 }