added LSA_Q_CLOSE and LSA_R_CLOSE (also to smb.h). implemented in smbclient.

updated Query Info Policy to report domain name and domain sid for info levels
3 and 5.
fixed bug in dom_sid_to_string (idauths decoded wrong).  fixed bug in DOM_SID:
subauths are 32 bit not 16.
(This used to be commit 2f3cca23e2465ca6a3a31fda005af1fd74f6af92)

diff --git a/source3/client/ntclient.c b/source3/client/ntclient.c
index d141bb23c453f1f3a805df5b63ccb42595a56699..16bfaeccbe0a83ce7595647a65f6055db5791c93 100644 (file)
--- a/source3/client/ntclient.c
+++ b/source3/client/ntclient.c
@@ -116,7 +116,7 @@ static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd)
 
        /* create setup parameters. */
        setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
-       setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+       setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
 
        /* send the data on \PIPE\ */
        if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -183,7 +183,8 @@ static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd)
 /****************************************************************************
 do a LSA Query Info Policy
 ****************************************************************************/
-static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_class)
+static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_class,
+                       fstring domain_name, pstring domain_sid)
 {
        char *rparam = NULL;
        char *rdata = NULL;
@@ -195,7 +196,7 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla
        int call_id = 0x1;
     BOOL valid_response = False;
 
-       if (hnd == NULL) return False;
+       if (hnd == NULL || domain_name == NULL || domain_sid == NULL) return False;
 
        /* create and send a MSRPC command with api LSA_QUERYINFOPOLICY */
 
@@ -212,7 +213,7 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla
 
        /* create setup parameters. */
        setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
-       setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+       setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
 
        /* send the data on \PIPE\ */
        if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -262,10 +263,52 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla
                        p = NULL;
                }
 
+               if (p && r_q.info_class != q_q.info_class)
+               {
+                       /* report different info classes */
+                       DEBUG(0,("LSA_QUERYINFOPOLICY: error info_class (q,r) differ - (%x,%x)\n",
+                                       q_q.info_class, r_q.info_class));
+                       p = NULL;
+               }
+
                if (p)
                {
                        /* ok, at last: we're happy. */
-                       valid_response = True;
+                       switch (r_q.info_class)
+                       {
+                               case 3:
+                               {
+                                       char *dom_name = unistrn2(r_q.dom.id3.uni_domain_name.buffer,
+                                                                 r_q.dom.id3.uni_domain_name.uni_str_len);
+                                       char *dom_sid  = dom_sid_to_string(&(r_q.dom.id3.dom_sid));
+                                       fstrcpy(domain_name, dom_name);
+                                       pstrcpy(domain_sid , dom_sid);
+
+                                       valid_response = True;
+                                       break;
+                               }
+                               case 5:
+                               {
+                                       char *dom_name = unistrn2(r_q.dom.id5.uni_domain_name.buffer,
+                                                                 r_q.dom.id5.uni_domain_name.uni_str_len);
+                                       char *dom_sid  = dom_sid_to_string(&(r_q.dom.id5.dom_sid));
+                                       fstrcpy(domain_name, dom_name);
+                                       pstrcpy(domain_sid , dom_sid);
+
+                                       valid_response = True;
+                                       break;
+                               }
+                               default:
+                               {
+                                       DEBUG(3,("LSA_QUERYINFOPOLICY: unknown info class\n"));
+                                       domain_name[0] = 0;
+                                       domain_sid [0] = 0;
+
+                                       break;
+                               }
+                       }
+                       DEBUG(3,("LSA_QUERYINFOPOLICY (level %x): domain:%s  domain sid:%s\n",
+                                 r_q.info_class, domain_name, domain_sid));
                }
        }
 
@@ -275,6 +318,115 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla
        return valid_response;
 }
 
+/****************************************************************************
+do a LSA Close
+****************************************************************************/
+static BOOL do_lsa_close(uint16 fnum, LSA_POL_HND *hnd)
+{
+       char *rparam = NULL;
+       char *rdata = NULL;
+       char *p;
+       int rdrcnt,rprcnt;
+       pstring data; /* only 1024 bytes */
+       uint16 setup[2]; /* only need 2 uint16 setup parameters */
+       LSA_Q_CLOSE q_c;
+       int call_id = 0x1;
+    BOOL valid_close = False;
+
+       if (hnd == NULL) return False;
+
+       /* create and send a MSRPC command with api LSA_OPENPOLICY */
+
+       DEBUG(4,("LSA Close\n"));
+
+       /* store the parameters */
+       make_q_close(&q_c, hnd);
+
+       /* turn parameters into data stream */
+       p = lsa_io_q_close(False, &q_c, data + 0x18, data, 4, 0);
+
+       /* create the request RPC_HDR with no data */
+       create_rpc_request(call_id, LSA_CLOSE, data, PTR_DIFF(p, data));
+
+       /* create setup parameters. */
+       setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
+       setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+
+       /* send the data on \PIPE\ */
+       if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
+                BUFFER_SIZE,
+                               &rprcnt, &rdrcnt,
+                               NULL, data, setup,
+                               &rparam, &rdata))
+       {
+               LSA_R_CLOSE r_c;
+               RPC_HDR hdr;
+               int hdr_len;
+               int pkt_len;
+
+               DEBUG(5, ("cli_call_api: return OK\n"));
+
+               p = rdata;
+
+               if (p) p = smb_io_rpc_hdr   (True, &hdr, p, rdata, 4, 0);
+               if (p) p = align_offset(p, rdata, 4); /* oh, what a surprise */
+
+               hdr_len = PTR_DIFF(p, rdata);
+
+               if (p && hdr_len != hdr.frag_len - hdr.alloc_hint)
+               {
+                       /* header length not same as calculated header length */
+                       DEBUG(2,("do_lsa_close: hdr_len %x != frag_len-alloc_hint\n",
+                                 hdr_len, hdr.frag_len - hdr.alloc_hint));
+                       p = NULL;
+               }
+
+               if (p) p = lsa_io_r_close(True, &r_c, p, rdata, 4, 0);
+               
+               pkt_len = PTR_DIFF(p, rdata);
+
+               if (p && pkt_len != hdr.frag_len)
+               {
+                       /* packet data size not same as reported fragment length */
+                       DEBUG(2,("do_lsa_close: pkt_len %x != frag_len \n",
+                                                  pkt_len, hdr.frag_len));
+                       p = NULL;
+               }
+
+               if (p && r_c.status != 0)
+               {
+                       /* report error code */
+                       DEBUG(0,("LSA_OPENPOLICY: nt_status error %lx\n", r_c.status));
+                       p = NULL;
+               }
+
+               if (p)
+               {
+                       /* check that the returned policy handle is all zeros */
+                       int i;
+                       valid_close = True;
+
+                       for (i = 0; i < sizeof(r_c.pol.data); i++)
+                       {
+                               if (r_c.pol.data[i] != 0)
+                               {
+                                       valid_close = False;
+                                       break;
+                               }
+                       }       
+                       if (!valid_close)
+                       {
+                               DEBUG(0,("LSA_CLOSE: non-zero handle returned\n"));
+                       }
+               }
+       }
+
+       if (rparam) free(rparam);
+       if (rdata) free(rdata);
+
+       return valid_close;
+}
+
 /****************************************************************************
 do a LSA Request Challenge
 ****************************************************************************/
@@ -311,7 +463,7 @@ static BOOL do_lsa_req_chal(uint16 fnum,
 
        /* create setup parameters. */
        setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
-       setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+       setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
 
        /* send the data on \PIPE\ */
        if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -412,7 +564,7 @@ static BOOL do_lsa_auth2(uint16 fnum,
 
        /* create setup parameters. */
        setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
-       setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+       setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
 
        /* send the data on \PIPE\ */
        if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -526,7 +678,7 @@ static BOOL do_lsa_sam_logon(uint16 fnum, uint32 sess_key[2], DOM_CRED *sto_clnt
 
        /* create setup parameters. */
        setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
-       setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+       setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
 
        /* send the data on \PIPE\ */
        if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -649,7 +801,7 @@ static BOOL do_lsa_sam_logoff(uint16 fnum, uint32 sess_key[2], DOM_CRED *sto_cln
 
        /* create setup parameters. */
        setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
-       setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+       setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
 
        /* send the data on \PIPE\ */
        if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -754,6 +906,14 @@ BOOL do_nt_login(char *desthost, char *myhostname,
        fstring mach_pwd;
        fstring server_name;
 
+       /* received from LSA Query Info Policy, level 5 */
+       fstring level5_domain_name;
+       pstring level5_domain_sid;
+
+       /* received from LSA Query Info Policy, level 3 */
+       fstring level3_domain_name;
+       pstring level3_domain_sid;
+
        uint16 fnum;
        char *inbuf,*outbuf; 
 
@@ -789,10 +949,32 @@ BOOL do_nt_login(char *desthost, char *myhostname,
                return False;
        }
 
-       /******************* Query Info Policy ********************/
+       /**************** Query Info Policy, level 3 ********************/
+
+       /* send a query info policy at level 3; receive an info policy */
+       if (!do_lsa_query_info_pol(fnum, &pol, 0x3,
+                                  level3_domain_name, level3_domain_sid))
+       {
+               cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
+               free(inbuf); free(outbuf);
+               return False;
+       }
+
+       /**************** Query Info Policy, level 5 ********************/
 
        /* send a query info policy at level 5; receive an info policy */
-       if (!do_lsa_query_info_pol(fnum, &pol, 0x5))
+       if (!do_lsa_query_info_pol(fnum, &pol, 0x5,
+                                  level5_domain_name, level5_domain_sid))
+       {
+               cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
+               free(inbuf); free(outbuf);
+               return False;
+       }
+
+       /******************* Open Policy ********************/
+
+       /* send a close policy request; receive a close pol response */
+       if (!do_lsa_close(fnum, &pol))
        {
                cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
                free(inbuf); free(outbuf);

diff --git a/source3/include/proto.h b/source3/include/proto.h
index e0d5d31f4001af270166945f0ce2c260e268ef25..669ed5fd8d850c55d6c449022a2317d83b61f190 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -380,6 +380,10 @@ char* lsa_io_q_open_pol(BOOL io, LSA_Q_OPEN_POL *r_q, char *q, char *base, int a
 char* lsa_io_r_open_pol(BOOL io, LSA_R_OPEN_POL *r_p, char *q, char *base, int align, int depth);
 void make_q_query(LSA_Q_QUERY_INFO *q_q, LSA_POL_HND *hnd, uint16 info_class);
 char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int align, int depth);
+void make_q_close(LSA_Q_CLOSE *q_c, LSA_POL_HND *hnd);
+char* lsa_io_q_close(BOOL io, LSA_Q_CLOSE *q_c, char *q, char *base, int align, int depth);
+void make_r_close(LSA_R_CLOSE *q_r, LSA_POL_HND *hnd);
+char* lsa_io_r_close(BOOL io, LSA_R_CLOSE *r_c, char *q, char *base, int align, int depth);
 char* lsa_io_r_query(BOOL io, LSA_R_QUERY_INFO *r_q, char *q, char *base, int align, int depth);
 char* lsa_io_q_lookup_sids(BOOL io, LSA_Q_LOOKUP_SIDS *q_s, char *q, char *base, int align, int depth);
 char* lsa_io_r_lookup_sids(BOOL io, LSA_R_LOOKUP_SIDS *r_s, char *q, char *base, int align, int depth);

diff --git a/source3/include/smb.h b/source3/include/smb.h
index e9734f379d1d92ec279bb97ea70e902638616e8c..057a0b755060d27f2a70ecc6ad4bc3f9e8164f19 100644 (file)
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -364,7 +364,7 @@ typedef struct sid_info
   uint8  sid_rev_num;             /* SID revision number */
   uint8  num_auths;               /* number of sub-authorities */
   uint8  id_auth[6];              /* Identifier Authority */
-  uint16 sub_auths[MAXSUBAUTHS];  /* pointer to sub-authorities. */
+  uint32 sub_auths[MAXSUBAUTHS];  /* pointer to sub-authorities. */
 
 } DOM_SID;
 
@@ -632,10 +632,27 @@ typedef struct lsa_r_query_info
 
     } dom;
 
-  uint32 status; /* return code */
+       uint32 status; /* return code */
 
 } LSA_R_QUERY_INFO;
 
+/* LSA_Q_CLOSE */
+typedef struct lsa_q_close_info
+{
+       LSA_POL_HND pol; /* policy handle */
+
+} LSA_Q_CLOSE;
+
+/* LSA_R_CLOSE */
+typedef struct lsa_r_close_info
+{
+       LSA_POL_HND pol; /* policy handle.  should be all zeros. */
+
+       uint32 status; /* return code */
+
+} LSA_R_CLOSE;
+
+
 #define MAX_REF_DOMAINS 10
 
 /* DOM_R_REF */

diff --git a/source3/lsaparse.c b/source3/lsaparse.c
index 39ef6c596bf39ba4d2a29dedc9a840c0c1a71fbf..7a62b7c903395088a6b70eb933b1a6065f3c5bf2 100644 (file)
--- a/source3/lsaparse.c
+++ b/source3/lsaparse.c
@@ -107,6 +107,64 @@ char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int al
        return q;
 }
 
+/*******************************************************************
+makes an LSA_Q_CLOSE structure.
+********************************************************************/
+void make_q_close(LSA_Q_CLOSE *q_c, LSA_POL_HND *hnd)
+{
+       if (q_c == NULL || hnd == NULL) return;
+
+       DEBUG(5,("make_q_close\n"));
+
+       memcpy(&(q_c->pol), hnd, sizeof(q_c->pol));
+}
+
+
+/*******************************************************************
+reads or writes an LSA_Q_CLOSE structure.
+********************************************************************/
+char* lsa_io_q_close(BOOL io, LSA_Q_CLOSE *q_c, char *q, char *base, int align, int depth)
+{
+       if (q_c == NULL) return NULL;
+
+       DEBUG(5,("%s%04x lsa_io_q_close\n", tab_depth(depth), PTR_DIFF(q, base)));
+       depth++;
+
+       q = smb_io_pol_hnd(io, &(q_c->pol), q, base, align, depth);
+
+       return q;
+}
+
+/*******************************************************************
+makes an LSA_R_CLOSE structure.
+********************************************************************/
+void make_r_close(LSA_R_CLOSE *q_r, LSA_POL_HND *hnd)
+{
+       if (q_r == NULL || hnd == NULL) return;
+
+       DEBUG(5,("make_r_close\n"));
+
+       memcpy(&(q_r->pol), hnd, sizeof(q_r->pol));
+}
+
+
+/*******************************************************************
+reads or writes an LSA_R_CLOSE structure.
+********************************************************************/
+char* lsa_io_r_close(BOOL io, LSA_R_CLOSE *r_c, char *q, char *base, int align, int depth)
+{
+       if (r_c == NULL) return NULL;
+
+       DEBUG(5,("%s%04x lsa_io_r_close\n", tab_depth(depth), PTR_DIFF(q, base)));
+       depth++;
+
+       q = smb_io_pol_hnd(io, &(r_c->pol), q, base, align, depth);
+
+       DBG_RW_IVAL("status", depth, base, io, q, r_c->status); q += 4;
+
+       return q;
+}
+
 /*******************************************************************
 reads or writes an LSA_Q_QUERY_INFO structure.
 ********************************************************************/

diff --git a/source3/pipeutil.c b/source3/pipeutil.c
index dff037443309ad2cbd915bf1d6d06abc906193d8..93a78df4933b6990305a3af0d5925e9339213c72 100644 (file)
--- a/source3/pipeutil.c
+++ b/source3/pipeutil.c
@@ -106,10 +106,10 @@ char *dom_sid_to_string(DOM_SID *sid)
   static pstring sidstr;
   char subauth[16];
   int i;
-  uint32 ia = (sid->id_auth[0]) +
-              (sid->id_auth[1] << 8 ) +
-              (sid->id_auth[2] << 16) +
-              (sid->id_auth[3] << 24);
+  uint32 ia = (sid->id_auth[5]) +
+              (sid->id_auth[4] << 8 ) +
+              (sid->id_auth[3] << 16) +
+              (sid->id_auth[2] << 24);
 
   sprintf(sidstr, "S-%d-%d", sid->sid_rev_num, ia);
 

diff --git a/source3/smbparse.c b/source3/smbparse.c
index 028f172b8e79ff9a32490e882ef52a9509180f7a..6b028270060492b07d305a6187afc11f094a8424 100644 (file)
--- a/source3/smbparse.c
+++ b/source3/smbparse.c
@@ -136,7 +136,7 @@ char* smb_io_dom_sid(BOOL io, DOM_SID *sid, char *q, char *base, int align, int
        /* oops! XXXX should really issue a warning here... */
        if (sid->num_auths > MAXSUBAUTHS) sid->num_auths = MAXSUBAUTHS;
 
-       DBG_RW_PIVAL("num_auths ", depth, base, io, q, sid->sub_auths, sid->num_auths); q += sid->num_auths * 4;
+       DBG_RW_PIVAL("sub_auths ", depth, base, io, q, sid->sub_auths, sid->num_auths); q += sid->num_auths * 4;
 
        return q;
 }
@@ -278,7 +278,7 @@ char* smb_io_unistr2(BOOL io, UNISTR2 *uni2, char *q, char *base, int align, int
 
        /* buffer advanced by indicated length of string
        NOT by searching for null-termination */
-       DBG_RW_PSVAL("buffer    ", depth, base, io, q, uni2->buffer, uni2->uni_max_len); q += uni2->uni_max_len * 2;
+       DBG_RW_PSVAL("buffer     ", depth, base, io, q, uni2->buffer, uni2->uni_max_len); q += uni2->uni_max_len * 2;
 
        return q;
 }