source3/rpc_client/cli_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4    Copyright (C) Tim Potter                        2000-2001,
   5    Copyright (C) Andrew Tridgell              1992-1997,2000,
   6    Copyright (C) Rafal Szczesniak                       2002
   7    Copyright (C) Jeremy Allison                         2005.
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25
  26 /** @defgroup lsa LSA - Local Security Architecture
  27  *  @ingroup rpc_client
  28  *
  29  * @{
  30  **/
  31
  32 /**
  33  * @file cli_lsarpc.c
  34  *
  35  * RPC client routines for the LSA RPC pipe.  LSA means "local
  36  * security authority", which is half of a password database.
  37  **/
  38
  39 /** Open a LSA policy handle
  40  *
  41  * @param cli Handle on an initialised SMB connection */
  42
  43 NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
  44                                 TALLOC_CTX *mem_ctx,
  45                                 BOOL sec_qos, uint32 des_access,
  46                                 POLICY_HND *pol)
  47 {
  48         prs_struct qbuf, rbuf;
  49         LSA_Q_OPEN_POL q;
  50         LSA_R_OPEN_POL r;
  51         LSA_SEC_QOS qos;
  52         NTSTATUS result;
  53
  54         ZERO_STRUCT(q);
  55         ZERO_STRUCT(r);
  56
  57         /* Initialise input parameters */
  58
  59         if (sec_qos) {
  60                 init_lsa_sec_qos(&qos, 2, 1, 0);
  61                 init_q_open_pol(&q, '\\', 0, des_access, &qos);
  62         } else {
  63                 init_q_open_pol(&q, '\\', 0, des_access, NULL);
  64         }
  65
  66         /* Marshall data and send request */
  67
  68         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY,
  69                         q, r,
  70                         qbuf, rbuf,
  71                         lsa_io_q_open_pol,
  72                         lsa_io_r_open_pol,
  73                         NT_STATUS_UNSUCCESSFUL );
  74
  75         /* Return output parameters */
  76
  77         result = r.status;
  78
  79         if (NT_STATUS_IS_OK(result)) {
  80                 *pol = r.pol;
  81         }
  82
  83         return result;
  84 }
  85
  86 /** Open a LSA policy handle
  87   *
  88   * @param cli Handle on an initialised SMB connection
  89   */
  90
  91 NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
  92                                  TALLOC_CTX *mem_ctx, BOOL sec_qos,
  93                                  uint32 des_access, POLICY_HND *pol)
  94 {
  95         prs_struct qbuf, rbuf;
  96         LSA_Q_OPEN_POL2 q;
  97         LSA_R_OPEN_POL2 r;
  98         LSA_SEC_QOS qos;
  99         NTSTATUS result;
 100         char *srv_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", cli->cli->desthost);
 101
 102         ZERO_STRUCT(q);
 103         ZERO_STRUCT(r);
 104
 105         if (sec_qos) {
 106                 init_lsa_sec_qos(&qos, 2, 1, 0);
 107                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, &qos);
 108         } else {
 109                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, NULL);
 110         }
 111
 112         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY2,
 113                         q, r,
 114                         qbuf, rbuf,
 115                         lsa_io_q_open_pol2,
 116                         lsa_io_r_open_pol2,
 117                         NT_STATUS_UNSUCCESSFUL );
 118
 119         /* Return output parameters */
 120
 121         result = r.status;
 122
 123         if (NT_STATUS_IS_OK(result)) {
 124                 *pol = r.pol;
 125         }
 126
 127         return result;
 128 }
 129
 130 /* Lookup a list of sids
 131  *
 132  * internal version withOUT memory allocation of the target arrays.
 133  * this assumes suffciently sized arrays to store domains, names and types. */
 134
 135 static NTSTATUS rpccli_lsa_lookup_sids_noalloc(struct rpc_pipe_client *cli,
 136                                                TALLOC_CTX *mem_ctx,
 137                                                POLICY_HND *pol,
 138                                                int num_sids,
 139                                                const DOM_SID *sids,
 140                                                char **domains,
 141                                                char **names,
 142                                                enum lsa_SidType *types)
 143 {
 144         prs_struct qbuf, rbuf;
 145         LSA_Q_LOOKUP_SIDS q;
 146         LSA_R_LOOKUP_SIDS r;
 147         DOM_R_REF ref;
 148         NTSTATUS result = NT_STATUS_OK;
 149         TALLOC_CTX *tmp_ctx = NULL;
 150         int i;
 151
 152         tmp_ctx = talloc_new(mem_ctx);
 153         if (!tmp_ctx) {
 154                 DEBUG(0, ("rpccli_lsa_lookup_sids_noalloc: out of memory!\n"));
 155                 result = NT_STATUS_UNSUCCESSFUL;
 156                 goto done;
 157         }
 158
 159         ZERO_STRUCT(q);
 160         ZERO_STRUCT(r);
 161
 162         init_q_lookup_sids(tmp_ctx, &q, pol, num_sids, sids, 1);
 163
 164         ZERO_STRUCT(ref);
 165
 166         r.dom_ref = &ref;
 167
 168         CLI_DO_RPC( cli, tmp_ctx, PI_LSARPC, LSA_LOOKUPSIDS,
 169                         q, r,
 170                         qbuf, rbuf,
 171                         lsa_io_q_lookup_sids,
 172                         lsa_io_r_lookup_sids,
 173                         NT_STATUS_UNSUCCESSFUL );
 174
 175         if (!NT_STATUS_IS_OK(r.status) &&
 176             !NT_STATUS_EQUAL(r.status, STATUS_SOME_UNMAPPED))
 177         {
 178                 /* An actual error occured */
 179                 result = r.status;
 180                 goto done;
 181         }
 182
 183         /* Return output parameters */
 184
 185         if (r.mapped_count == 0) {
 186                 result = NT_STATUS_NONE_MAPPED;
 187                 goto done;
 188         }
 189
 190         for (i = 0; i < num_sids; i++) {
 191                 fstring name, dom_name;
 192                 uint32 dom_idx = r.names.name[i].domain_idx;
 193
 194                 /* Translate optimised name through domain index array */
 195
 196                 if (dom_idx != 0xffffffff) {
 197
 198                         rpcstr_pull_unistr2_fstring(
 199                                 dom_name, &ref.ref_dom[dom_idx].uni_dom_name);
 200                         rpcstr_pull_unistr2_fstring(
 201                                 name, &r.names.uni_name[i]);
 202
 203                         (names)[i] = talloc_strdup(mem_ctx, name);
 204                         (domains)[i] = talloc_strdup(mem_ctx, dom_name);
 205                         (types)[i] = (enum lsa_SidType)r.names.name[i].sid_name_use;
 206
 207                         if (((names)[i] == NULL) || ((domains)[i] == NULL)) {
 208                                 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
 209                                 result = NT_STATUS_UNSUCCESSFUL;
 210                                 goto done;
 211                         }
 212
 213                 } else {
 214                         (names)[i] = NULL;
 215                         (domains)[i] = NULL;
 216                         (types)[i] = SID_NAME_UNKNOWN;
 217                 }
 218         }
 219
 220 done:
 221         TALLOC_FREE(tmp_ctx);
 222         return result;
 223 }
 224
 225 /* Lookup a list of sids
 226  *
 227  * do it the right way: there is a limit (of 20480 for w2k3) entries
 228  * returned by this call. when the sids list contains more entries,
 229  * empty lists are returned. This version of lsa_lookup_sids passes
 230  * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
 231
 232 /* This constant defines the limit of how many sids to look up
 233  * in one call (maximum). the limit from the server side is
 234  * at 20480 for win2k3, but we keep it at a save 1000 for now. */
 235 #define LOOKUP_SIDS_HUNK_SIZE 1000
 236
 237 NTSTATUS rpccli_lsa_lookup_sids_all(struct rpc_pipe_client *cli,
 238                                     TALLOC_CTX *mem_ctx,
 239                                     POLICY_HND *pol,
 240                                     int num_sids,
 241                                     const DOM_SID *sids,
 242                                     char ***domains,
 243                                     char ***names,
 244                                     enum lsa_SidType **types)
 245 {
 246         NTSTATUS result = NT_STATUS_OK;
 247         int sids_left = 0;
 248         int sids_processed = 0;
 249         const DOM_SID *hunk_sids = sids;
 250         char **hunk_domains = NULL;
 251         char **hunk_names = NULL;
 252         enum lsa_SidType *hunk_types = NULL;
 253
 254         if (num_sids) {
 255                 if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 256                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
 257                         result = NT_STATUS_NO_MEMORY;
 258                         goto done;
 259                 }
 260
 261                 if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 262                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
 263                         result = NT_STATUS_NO_MEMORY;
 264                         goto done;
 265                 }
 266
 267                 if (!((*types) = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
 268                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
 269                         result = NT_STATUS_NO_MEMORY;
 270                         goto done;
 271                 }
 272         } else {
 273                 (*domains) = NULL;
 274                 (*names) = NULL;
 275                 (*types) = NULL;
 276         }
 277
 278         sids_left = num_sids;
 279         hunk_domains = *domains;
 280         hunk_names = *names;
 281         hunk_types = *types;
 282
 283         while (sids_left > 0) {
 284                 int hunk_num_sids;
 285                 NTSTATUS hunk_result = NT_STATUS_OK;
 286
 287                 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
 288                                 ? LOOKUP_SIDS_HUNK_SIZE
 289                                 : sids_left);
 290
 291                 DEBUG(10, ("rpccli_lsa_lookup_sids_all: processing items "
 292                            "%d -- %d of %d.\n",
 293                            sids_processed,
 294                            sids_processed + hunk_num_sids - 1,
 295                            num_sids));
 296
 297                 hunk_result = rpccli_lsa_lookup_sids_noalloc(cli,
 298                                                              mem_ctx,
 299                                                              pol,
 300                                                              hunk_num_sids,
 301                                                              hunk_sids,
 302                                                              hunk_domains,
 303                                                              hunk_names,
 304                                                              hunk_types);
 305
 306                 if (!NT_STATUS_IS_OK(hunk_result) &&
 307                     !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
 308                     !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED))
 309                 {
 310                         /* An actual error occured */
 311                         goto done;
 312                 }
 313
 314                 /* adapt overall result */
 315                 if (( NT_STATUS_IS_OK(result) &&
 316                      !NT_STATUS_IS_OK(hunk_result))
 317                     ||
 318                     ( NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
 319                      !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)))
 320                 {
 321                         result = STATUS_SOME_UNMAPPED;
 322                 }
 323
 324                 sids_left -= hunk_num_sids;
 325                 sids_processed += hunk_num_sids; /* only used in DEBUG */
 326                 hunk_sids += hunk_num_sids;
 327                 hunk_domains += hunk_num_sids;
 328                 hunk_names += hunk_num_sids;
 329                 hunk_types += hunk_num_sids;
 330         }
 331
 332 done:
 333         return result;
 334 }
 335
 336 /** Lookup a list of sids */
 337
 338 NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
 339                                 TALLOC_CTX *mem_ctx,
 340                                 POLICY_HND *pol, int num_sids,
 341                                 const DOM_SID *sids,
 342                                 char ***domains,
 343                                 char ***names,
 344                                 enum lsa_SidType **types)
 345 {
 346         prs_struct qbuf, rbuf;
 347         LSA_Q_LOOKUP_SIDS q;
 348         LSA_R_LOOKUP_SIDS r;
 349         DOM_R_REF ref;
 350         NTSTATUS result = NT_STATUS_OK;
 351         int i;
 352
 353         ZERO_STRUCT(q);
 354         ZERO_STRUCT(r);
 355
 356         init_q_lookup_sids(mem_ctx, &q, pol, num_sids, sids, 1);
 357
 358         ZERO_STRUCT(ref);
 359
 360         r.dom_ref = &ref;
 361
 362         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPSIDS,
 363                         q, r,
 364                         qbuf, rbuf,
 365                         lsa_io_q_lookup_sids,
 366                         lsa_io_r_lookup_sids,
 367                         NT_STATUS_UNSUCCESSFUL );
 368
 369         if (!NT_STATUS_IS_OK(r.status) &&
 370             !NT_STATUS_EQUAL(r.status, STATUS_SOME_UNMAPPED)) {
 371
 372                 /* An actual error occured */
 373                 result = r.status;
 374
 375                 goto done;
 376         }
 377
 378         /* Return output parameters */
 379
 380         if (r.mapped_count == 0) {
 381                 result = NT_STATUS_NONE_MAPPED;
 382                 goto done;
 383         }
 384
 385         if (num_sids) {
 386                 if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 387                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 388                         result = NT_STATUS_NO_MEMORY;
 389                         goto done;
 390                 }
 391
 392                 if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 393                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 394                         result = NT_STATUS_NO_MEMORY;
 395                         goto done;
 396                 }
 397
 398                 if (!((*types) = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
 399                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 400                         result = NT_STATUS_NO_MEMORY;
 401                         goto done;
 402                 }
 403         } else {
 404                 (*domains) = NULL;
 405                 (*names) = NULL;
 406                 (*types) = NULL;
 407         }
 408
 409         for (i = 0; i < num_sids; i++) {
 410                 fstring name, dom_name;
 411                 uint32 dom_idx = r.names.name[i].domain_idx;
 412
 413                 /* Translate optimised name through domain index array */
 414
 415                 if (dom_idx != 0xffffffff) {
 416
 417                         rpcstr_pull_unistr2_fstring(
 418                                 dom_name, &ref.ref_dom[dom_idx].uni_dom_name);
 419                         rpcstr_pull_unistr2_fstring(
 420                                 name, &r.names.uni_name[i]);
 421
 422                         (*names)[i] = talloc_strdup(mem_ctx, name);
 423                         (*domains)[i] = talloc_strdup(mem_ctx, dom_name);
 424                         (*types)[i] = (enum lsa_SidType)r.names.name[i].sid_name_use;
 425
 426                         if (((*names)[i] == NULL) || ((*domains)[i] == NULL)) {
 427                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 428                                 result = NT_STATUS_UNSUCCESSFUL;
 429                                 goto done;
 430                         }
 431
 432                 } else {
 433                         (*names)[i] = NULL;
 434                         (*domains)[i] = NULL;
 435                         (*types)[i] = SID_NAME_UNKNOWN;
 436                 }
 437         }
 438
 439  done:
 440
 441         return result;
 442 }
 443
 444 /** Lookup a list of names */
 445
 446 NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
 447                                  TALLOC_CTX *mem_ctx,
 448                                  POLICY_HND *pol, int num_names,
 449                                  const char **names,
 450                                  const char ***dom_names,
 451                                  int level,
 452                                  DOM_SID **sids,
 453                                  enum lsa_SidType **types)
 454 {
 455         prs_struct qbuf, rbuf;
 456         LSA_Q_LOOKUP_NAMES q;
 457         LSA_R_LOOKUP_NAMES r;
 458         DOM_R_REF ref;
 459         NTSTATUS result;
 460         int i;
 461
 462         ZERO_STRUCT(q);
 463         ZERO_STRUCT(r);
 464
 465         ZERO_STRUCT(ref);
 466         r.dom_ref = &ref;
 467
 468         init_q_lookup_names(mem_ctx, &q, pol, num_names, names, level);
 469
 470         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPNAMES,
 471                         q, r,
 472                         qbuf, rbuf,
 473                         lsa_io_q_lookup_names,
 474                         lsa_io_r_lookup_names,
 475                         NT_STATUS_UNSUCCESSFUL);
 476
 477         result = r.status;
 478
 479         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 480             NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
 481
 482                 /* An actual error occured */
 483
 484                 goto done;
 485         }
 486
 487         /* Return output parameters */
 488
 489         if (r.mapped_count == 0) {
 490                 result = NT_STATUS_NONE_MAPPED;
 491                 goto done;
 492         }
 493
 494         if (num_names) {
 495                 if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
 496                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 497                         result = NT_STATUS_NO_MEMORY;
 498                         goto done;
 499                 }
 500
 501                 if (!((*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_names)))) {
 502                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 503                         result = NT_STATUS_NO_MEMORY;
 504                         goto done;
 505                 }
 506
 507                 if (dom_names != NULL) {
 508                         *dom_names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
 509                         if (*dom_names == NULL) {
 510                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 511                                 result = NT_STATUS_NO_MEMORY;
 512                                 goto done;
 513                         }
 514                 }
 515         } else {
 516                 *sids = NULL;
 517                 *types = NULL;
 518                 if (dom_names != NULL) {
 519                         *dom_names = NULL;
 520                 }
 521         }
 522
 523         for (i = 0; i < num_names; i++) {
 524                 DOM_RID *t_rids = r.dom_rid;
 525                 uint32 dom_idx = t_rids[i].rid_idx;
 526                 uint32 dom_rid = t_rids[i].rid;
 527                 DOM_SID *sid = &(*sids)[i];
 528
 529                 /* Translate optimised sid through domain index array */
 530
 531                 if (dom_idx == 0xffffffff) {
 532                         /* Nothing to do, this is unknown */
 533                         ZERO_STRUCTP(sid);
 534                         (*types)[i] = SID_NAME_UNKNOWN;
 535                         continue;
 536                 }
 537
 538                 sid_copy(sid, &ref.ref_dom[dom_idx].ref_dom.sid);
 539
 540                 if (dom_rid != 0xffffffff) {
 541                         sid_append_rid(sid, dom_rid);
 542                 }
 543
 544                 (*types)[i] = (enum lsa_SidType)t_rids[i].type;
 545
 546                 if (dom_names == NULL) {
 547                         continue;
 548                 }
 549
 550                 (*dom_names)[i] = rpcstr_pull_unistr2_talloc(
 551                         *dom_names, &ref.ref_dom[dom_idx].uni_dom_name);
 552         }
 553
 554  done:
 555
 556         return result;
 557 }
 558
 559 NTSTATUS rpccli_lsa_query_info_policy_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 560                                           POLICY_HND *pol, uint16 info_class,
 561                                           LSA_INFO_CTR *ctr)
 562 {
 563         prs_struct qbuf, rbuf;
 564         LSA_Q_QUERY_INFO q;
 565         LSA_R_QUERY_INFO r;
 566         NTSTATUS result;
 567
 568         ZERO_STRUCT(q);
 569         ZERO_STRUCT(r);
 570
 571         init_q_query(&q, pol, info_class);
 572
 573         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
 574                 q, r,
 575                 qbuf, rbuf,
 576                 lsa_io_q_query,
 577                 lsa_io_r_query,
 578                 NT_STATUS_UNSUCCESSFUL);
 579
 580         result = r.status;
 581
 582         if (!NT_STATUS_IS_OK(result)) {
 583                 goto done;
 584         }
 585
 586  done:
 587
 588         *ctr = r.ctr;
 589
 590         return result;
 591 }
 592
 593 NTSTATUS rpccli_lsa_query_info_policy2_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 594                                           POLICY_HND *pol, uint16 info_class,
 595                                           LSA_INFO_CTR2 *ctr)
 596 {
 597         prs_struct qbuf, rbuf;
 598         LSA_Q_QUERY_INFO2 q;
 599         LSA_R_QUERY_INFO2 r;
 600         NTSTATUS result;
 601
 602         ZERO_STRUCT(q);
 603         ZERO_STRUCT(r);
 604
 605         init_q_query2(&q, pol, info_class);
 606
 607         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
 608                 q, r,
 609                 qbuf, rbuf,
 610                 lsa_io_q_query_info2,
 611                 lsa_io_r_query_info2,
 612                 NT_STATUS_UNSUCCESSFUL);
 613
 614         result = r.status;
 615
 616         if (!NT_STATUS_IS_OK(result)) {
 617                 goto done;
 618         }
 619
 620  done:
 621
 622         *ctr = r.ctr;
 623
 624         return result;
 625 }
 626
 627
 628
 629 /** Query info policy
 630  *
 631  *  @param domain_sid - returned remote server's domain sid */
 632
 633 NTSTATUS rpccli_lsa_query_info_policy(struct rpc_pipe_client *cli,
 634                                       TALLOC_CTX *mem_ctx,
 635                                       POLICY_HND *pol, uint16 info_class,
 636                                       char **domain_name, DOM_SID **domain_sid)
 637 {
 638         prs_struct qbuf, rbuf;
 639         LSA_Q_QUERY_INFO q;
 640         LSA_R_QUERY_INFO r;
 641         NTSTATUS result;
 642
 643         ZERO_STRUCT(q);
 644         ZERO_STRUCT(r);
 645
 646         init_q_query(&q, pol, info_class);
 647
 648         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
 649                 q, r,
 650                 qbuf, rbuf,
 651                 lsa_io_q_query,
 652                 lsa_io_r_query,
 653                 NT_STATUS_UNSUCCESSFUL);
 654
 655         result = r.status;
 656
 657         if (!NT_STATUS_IS_OK(result)) {
 658                 goto done;
 659         }
 660
 661         /* Return output parameters */
 662
 663         switch (info_class) {
 664
 665         case 3:
 666                 if (domain_name && (r.ctr.info.id3.buffer_dom_name != 0)) {
 667                         *domain_name = unistr2_tdup(mem_ctx,
 668                                                    &r.ctr.info.id3.
 669                                                    uni_domain_name);
 670                         if (!*domain_name) {
 671                                 return NT_STATUS_NO_MEMORY;
 672                         }
 673                 }
 674
 675                 if (domain_sid && (r.ctr.info.id3.buffer_dom_sid != 0)) {
 676                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 677                         if (!*domain_sid) {
 678                                 return NT_STATUS_NO_MEMORY;
 679                         }
 680                         sid_copy(*domain_sid, &r.ctr.info.id3.dom_sid.sid);
 681                 }
 682
 683                 break;
 684
 685         case 5:
 686
 687                 if (domain_name && (r.ctr.info.id5.buffer_dom_name != 0)) {
 688                         *domain_name = unistr2_tdup(mem_ctx,
 689                                                    &r.ctr.info.id5.
 690                                                    uni_domain_name);
 691                         if (!*domain_name) {
 692                                 return NT_STATUS_NO_MEMORY;
 693                         }
 694                 }
 695
 696                 if (domain_sid && (r.ctr.info.id5.buffer_dom_sid != 0)) {
 697                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 698                         if (!*domain_sid) {
 699                                 return NT_STATUS_NO_MEMORY;
 700                         }
 701                         sid_copy(*domain_sid, &r.ctr.info.id5.dom_sid.sid);
 702                 }
 703                 break;
 704
 705         default:
 706                 DEBUG(3, ("unknown info class %d\n", info_class));
 707                 break;
 708         }
 709
 710  done:
 711
 712         return result;
 713 }
 714
 715 /** Query info policy2
 716  *
 717  *  @param domain_name - returned remote server's domain name
 718  *  @param dns_name - returned remote server's dns domain name
 719  *  @param forest_name - returned remote server's forest name
 720  *  @param domain_guid - returned remote server's domain guid
 721  *  @param domain_sid - returned remote server's domain sid */
 722
 723 NTSTATUS rpccli_lsa_query_info_policy2(struct rpc_pipe_client *cli,
 724                                        TALLOC_CTX *mem_ctx,
 725                                        POLICY_HND *pol, uint16 info_class,
 726                                        char **domain_name, char **dns_name,
 727                                        char **forest_name,
 728                                        struct GUID **domain_guid,
 729                                        DOM_SID **domain_sid)
 730 {
 731         prs_struct qbuf, rbuf;
 732         LSA_Q_QUERY_INFO2 q;
 733         LSA_R_QUERY_INFO2 r;
 734         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 735
 736         if (info_class != 12)
 737                 goto done;
 738
 739         ZERO_STRUCT(q);
 740         ZERO_STRUCT(r);
 741
 742         init_q_query2(&q, pol, info_class);
 743
 744         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
 745                 q, r,
 746                 qbuf, rbuf,
 747                 lsa_io_q_query_info2,
 748                 lsa_io_r_query_info2,
 749                 NT_STATUS_UNSUCCESSFUL);
 750
 751         result = r.status;
 752
 753         if (!NT_STATUS_IS_OK(result)) {
 754                 goto done;
 755         }
 756
 757         /* Return output parameters */
 758
 759         ZERO_STRUCTP(domain_guid);
 760
 761         if (domain_name && r.ctr.info.id12.hdr_nb_dom_name.buffer) {
 762                 *domain_name = unistr2_tdup(mem_ctx,
 763                                             &r.ctr.info.id12
 764                                             .uni_nb_dom_name);
 765                 if (!*domain_name) {
 766                         return NT_STATUS_NO_MEMORY;
 767                 }
 768         }
 769         if (dns_name && r.ctr.info.id12.hdr_dns_dom_name.buffer) {
 770                 *dns_name = unistr2_tdup(mem_ctx,
 771                                          &r.ctr.info.id12
 772                                          .uni_dns_dom_name);
 773                 if (!*dns_name) {
 774                         return NT_STATUS_NO_MEMORY;
 775                 }
 776         }
 777         if (forest_name && r.ctr.info.id12.hdr_forest_name.buffer) {
 778                 *forest_name = unistr2_tdup(mem_ctx,
 779                                             &r.ctr.info.id12
 780                                             .uni_forest_name);
 781                 if (!*forest_name) {
 782                         return NT_STATUS_NO_MEMORY;
 783                 }
 784         }
 785
 786         if (domain_guid) {
 787                 *domain_guid = TALLOC_P(mem_ctx, struct GUID);
 788                 if (!*domain_guid) {
 789                         return NT_STATUS_NO_MEMORY;
 790                 }
 791                 memcpy(*domain_guid,
 792                        &r.ctr.info.id12.dom_guid,
 793                        sizeof(struct GUID));
 794         }
 795
 796         if (domain_sid && r.ctr.info.id12.ptr_dom_sid != 0) {
 797                 *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 798                 if (!*domain_sid) {
 799                         return NT_STATUS_NO_MEMORY;
 800                 }
 801                 sid_copy(*domain_sid,
 802                          &r.ctr.info.id12.dom_sid.sid);
 803         }
 804
 805  done:
 806
 807         return result;
 808 }
 809
 810 NTSTATUS rpccli_lsa_set_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 811                                     POLICY_HND *pol, uint16 info_class,
 812                                     LSA_INFO_CTR ctr)
 813 {
 814         prs_struct qbuf, rbuf;
 815         LSA_Q_SET_INFO q;
 816         LSA_R_SET_INFO r;
 817         NTSTATUS result;
 818
 819         ZERO_STRUCT(q);
 820         ZERO_STRUCT(r);
 821
 822         init_q_set(&q, pol, info_class, ctr);
 823
 824         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_SETINFOPOLICY,
 825                 q, r,
 826                 qbuf, rbuf,
 827                 lsa_io_q_set,
 828                 lsa_io_r_set,
 829                 NT_STATUS_UNSUCCESSFUL);
 830
 831         result = r.status;
 832
 833         if (!NT_STATUS_IS_OK(result)) {
 834                 goto done;
 835         }
 836
 837         /* Return output parameters */
 838
 839  done:
 840
 841         return result;
 842 }
 843
 844
 845 /**
 846  * Enumerate list of trusted domains
 847  *
 848  * @param cli client state (cli_state) structure of the connection
 849  * @param mem_ctx memory context
 850  * @param pol opened lsa policy handle
 851  * @param enum_ctx enumeration context ie. index of first returned domain entry
 852  * @param pref_num_domains preferred max number of entries returned in one response
 853  * @param num_domains total number of trusted domains returned by response
 854  * @param domain_names returned trusted domain names
 855  * @param domain_sids returned trusted domain sids
 856  *
 857  * @return nt status code of response
 858  **/
 859
 860 NTSTATUS rpccli_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
 861                                    TALLOC_CTX *mem_ctx,
 862                                    POLICY_HND *pol, uint32 *enum_ctx,
 863                                    uint32 *num_domains,
 864                                    char ***domain_names, DOM_SID **domain_sids)
 865 {
 866         prs_struct qbuf, rbuf;
 867         LSA_Q_ENUM_TRUST_DOM in;
 868         LSA_R_ENUM_TRUST_DOM out;
 869         int i;
 870         fstring tmp;
 871
 872         ZERO_STRUCT(in);
 873         ZERO_STRUCT(out);
 874
 875         /* 64k is enough for about 2000 trusted domains */
 876
 877         init_q_enum_trust_dom(&in, pol, *enum_ctx, 0x10000);
 878
 879         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMTRUSTDOM,
 880                     in, out,
 881                     qbuf, rbuf,
 882                     lsa_io_q_enum_trust_dom,
 883                     lsa_io_r_enum_trust_dom,
 884                     NT_STATUS_UNSUCCESSFUL );
 885
 886
 887         /* check for an actual error */
 888
 889         if ( !NT_STATUS_IS_OK(out.status)
 890                 && !NT_STATUS_EQUAL(out.status, NT_STATUS_NO_MORE_ENTRIES)
 891                 && !NT_STATUS_EQUAL(out.status, STATUS_MORE_ENTRIES) )
 892         {
 893                 return out.status;
 894         }
 895
 896         /* Return output parameters */
 897
 898         *num_domains  = out.count;
 899         *enum_ctx     = out.enum_context;
 900
 901         if ( out.count ) {
 902
 903                 /* Allocate memory for trusted domain names and sids */
 904
 905                 if ( !(*domain_names = TALLOC_ARRAY(mem_ctx, char *, out.count)) ) {
 906                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
 907                         return NT_STATUS_NO_MEMORY;
 908                 }
 909
 910                 if ( !(*domain_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, out.count)) ) {
 911                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
 912                         return NT_STATUS_NO_MEMORY;
 913                 }
 914
 915                 /* Copy across names and sids */
 916
 917                 for (i = 0; i < out.count; i++) {
 918
 919                         rpcstr_pull( tmp, out.domlist->domains[i].name.string->buffer,
 920                                 sizeof(tmp), out.domlist->domains[i].name.length, 0);
 921                         (*domain_names)[i] = talloc_strdup(mem_ctx, tmp);
 922
 923                         sid_copy(&(*domain_sids)[i], &out.domlist->domains[i].sid->sid );
 924                 }
 925         }
 926
 927         return out.status;
 928 }
 929
 930 /** Enumerate privileges*/
 931
 932 NTSTATUS rpccli_lsa_enum_privilege(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 933                                 POLICY_HND *pol, uint32 *enum_context, uint32 pref_max_length,
 934                                 uint32 *count, char ***privs_name, uint32 **privs_high, uint32 **privs_low)
 935 {
 936         prs_struct qbuf, rbuf;
 937         LSA_Q_ENUM_PRIVS q;
 938         LSA_R_ENUM_PRIVS r;
 939         NTSTATUS result;
 940         int i;
 941
 942         ZERO_STRUCT(q);
 943         ZERO_STRUCT(r);
 944
 945         init_q_enum_privs(&q, pol, *enum_context, pref_max_length);
 946
 947         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_PRIVS,
 948                 q, r,
 949                 qbuf, rbuf,
 950                 lsa_io_q_enum_privs,
 951                 lsa_io_r_enum_privs,
 952                 NT_STATUS_UNSUCCESSFUL);
 953
 954         result = r.status;
 955
 956         if (!NT_STATUS_IS_OK(result)) {
 957                 goto done;
 958         }
 959
 960         /* Return output parameters */
 961
 962         *enum_context = r.enum_context;
 963         *count = r.count;
 964
 965         if (r.count) {
 966                 if (!((*privs_name = TALLOC_ARRAY(mem_ctx, char *, r.count)))) {
 967                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 968                         result = NT_STATUS_UNSUCCESSFUL;
 969                         goto done;
 970                 }
 971
 972                 if (!((*privs_high = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
 973                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 974                         result = NT_STATUS_UNSUCCESSFUL;
 975                         goto done;
 976                 }
 977
 978                 if (!((*privs_low = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
 979                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 980                         result = NT_STATUS_UNSUCCESSFUL;
 981                         goto done;
 982                 }
 983         } else {
 984                 *privs_name = NULL;
 985                 *privs_high = NULL;
 986                 *privs_low = NULL;
 987         }
 988
 989         for (i = 0; i < r.count; i++) {
 990                 fstring name;
 991
 992                 rpcstr_pull_unistr2_fstring( name, &r.privs[i].name);
 993
 994                 (*privs_name)[i] = talloc_strdup(mem_ctx, name);
 995
 996                 (*privs_high)[i] = r.privs[i].luid_high;
 997                 (*privs_low)[i] = r.privs[i].luid_low;
 998         }
 999
1000  done:
1001
1002         return result;
1003 }
1004
1005 /** Get privilege name */
1006
1007 NTSTATUS rpccli_lsa_get_dispname(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1008                               POLICY_HND *pol, const char *name,
1009                               uint16 lang_id, uint16 lang_id_sys,
1010                               fstring description, uint16 *lang_id_desc)
1011 {
1012         prs_struct qbuf, rbuf;
1013         LSA_Q_PRIV_GET_DISPNAME q;
1014         LSA_R_PRIV_GET_DISPNAME r;
1015         NTSTATUS result;
1016
1017         ZERO_STRUCT(q);
1018         ZERO_STRUCT(r);
1019
1020         init_lsa_priv_get_dispname(&q, pol, name, lang_id, lang_id_sys);
1021
1022         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_PRIV_GET_DISPNAME,
1023                 q, r,
1024                 qbuf, rbuf,
1025                 lsa_io_q_priv_get_dispname,
1026                 lsa_io_r_priv_get_dispname,
1027                 NT_STATUS_UNSUCCESSFUL);
1028
1029         result = r.status;
1030
1031         if (!NT_STATUS_IS_OK(result)) {
1032                 goto done;
1033         }
1034
1035         /* Return output parameters */
1036
1037         rpcstr_pull_unistr2_fstring(description , &r.desc);
1038         *lang_id_desc = r.lang_id;
1039
1040  done:
1041
1042         return result;
1043 }
1044
1045 /** Enumerate list of SIDs  */
1046
1047 NTSTATUS rpccli_lsa_enum_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1048                                 POLICY_HND *pol, uint32 *enum_ctx, uint32 pref_max_length,
1049                                 uint32 *num_sids, DOM_SID **sids)
1050 {
1051         prs_struct qbuf, rbuf;
1052         LSA_Q_ENUM_ACCOUNTS q;
1053         LSA_R_ENUM_ACCOUNTS r;
1054         NTSTATUS result;
1055         int i;
1056
1057         ZERO_STRUCT(q);
1058         ZERO_STRUCT(r);
1059
1060         init_lsa_q_enum_accounts(&q, pol, *enum_ctx, pref_max_length);
1061
1062         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_ACCOUNTS,
1063                 q, r,
1064                 qbuf, rbuf,
1065                 lsa_io_q_enum_accounts,
1066                 lsa_io_r_enum_accounts,
1067                 NT_STATUS_UNSUCCESSFUL);
1068
1069         result = r.status;
1070
1071         if (!NT_STATUS_IS_OK(result)) {
1072                 goto done;
1073         }
1074
1075         if (r.sids.num_entries==0)
1076                 goto done;
1077
1078         /* Return output parameters */
1079
1080         *sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.sids.num_entries);
1081         if (!*sids) {
1082                 DEBUG(0, ("(cli_lsa_enum_sids): out of memory\n"));
1083                 result = NT_STATUS_UNSUCCESSFUL;
1084                 goto done;
1085         }
1086
1087         /* Copy across names and sids */
1088
1089         for (i = 0; i < r.sids.num_entries; i++) {
1090                 sid_copy(&(*sids)[i], &r.sids.sid[i].sid);
1091         }
1092
1093         *num_sids= r.sids.num_entries;
1094         *enum_ctx = r.enum_context;
1095
1096  done:
1097
1098         return result;
1099 }
1100
1101 /** Create a LSA user handle
1102  *
1103  * @param cli Handle on an initialised SMB connection
1104  *
1105  * FIXME: The code is actually identical to open account
1106  * TODO: Check and code what the function should exactly do
1107  *
1108  * */
1109
1110 NTSTATUS rpccli_lsa_create_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1111                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 desired_access,
1112                              POLICY_HND *user_pol)
1113 {
1114         prs_struct qbuf, rbuf;
1115         LSA_Q_CREATEACCOUNT q;
1116         LSA_R_CREATEACCOUNT r;
1117         NTSTATUS result;
1118
1119         ZERO_STRUCT(q);
1120         ZERO_STRUCT(r);
1121
1122         /* Initialise input parameters */
1123
1124         init_lsa_q_create_account(&q, dom_pol, sid, desired_access);
1125
1126         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_CREATEACCOUNT,
1127                 q, r,
1128                 qbuf, rbuf,
1129                 lsa_io_q_create_account,
1130                 lsa_io_r_create_account,
1131                 NT_STATUS_UNSUCCESSFUL);
1132
1133         /* Return output parameters */
1134
1135         result = r.status;
1136
1137         if (NT_STATUS_IS_OK(result)) {
1138                 *user_pol = r.pol;
1139         }
1140
1141         return result;
1142 }
1143
1144 /** Open a LSA user handle
1145  *
1146  * @param cli Handle on an initialised SMB connection */
1147
1148 NTSTATUS rpccli_lsa_open_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1149                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 des_access,
1150                              POLICY_HND *user_pol)
1151 {
1152         prs_struct qbuf, rbuf;
1153         LSA_Q_OPENACCOUNT q;
1154         LSA_R_OPENACCOUNT r;
1155         NTSTATUS result;
1156
1157         ZERO_STRUCT(q);
1158         ZERO_STRUCT(r);
1159
1160         /* Initialise input parameters */
1161
1162         init_lsa_q_open_account(&q, dom_pol, sid, des_access);
1163
1164         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENACCOUNT,
1165                 q, r,
1166                 qbuf, rbuf,
1167                 lsa_io_q_open_account,
1168                 lsa_io_r_open_account,
1169                 NT_STATUS_UNSUCCESSFUL);
1170
1171         /* Return output parameters */
1172
1173         result = r.status;
1174
1175         if (NT_STATUS_IS_OK(result)) {
1176                 *user_pol = r.pol;
1177         }
1178
1179         return result;
1180 }
1181
1182 /** Enumerate user privileges
1183  *
1184  * @param cli Handle on an initialised SMB connection */
1185
1186 NTSTATUS rpccli_lsa_enum_privsaccount(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1187                              POLICY_HND *pol, uint32 *count, LUID_ATTR **set)
1188 {
1189         prs_struct qbuf, rbuf;
1190         LSA_Q_ENUMPRIVSACCOUNT q;
1191         LSA_R_ENUMPRIVSACCOUNT r;
1192         NTSTATUS result;
1193         int i;
1194
1195         ZERO_STRUCT(q);
1196         ZERO_STRUCT(r);
1197
1198         /* Initialise input parameters */
1199
1200         init_lsa_q_enum_privsaccount(&q, pol);
1201
1202         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMPRIVSACCOUNT,
1203                 q, r,
1204                 qbuf, rbuf,
1205                 lsa_io_q_enum_privsaccount,
1206                 lsa_io_r_enum_privsaccount,
1207                 NT_STATUS_UNSUCCESSFUL);
1208
1209         /* Return output parameters */
1210
1211         result = r.status;
1212
1213         if (!NT_STATUS_IS_OK(result)) {
1214                 goto done;
1215         }
1216
1217         if (r.count == 0)
1218                 goto done;
1219
1220         if (!((*set = TALLOC_ARRAY(mem_ctx, LUID_ATTR, r.count)))) {
1221                 DEBUG(0, ("(cli_lsa_enum_privsaccount): out of memory\n"));
1222                 result = NT_STATUS_UNSUCCESSFUL;
1223                 goto done;
1224         }
1225
1226         for (i=0; i<r.count; i++) {
1227                 (*set)[i].luid.low = r.set.set[i].luid.low;
1228                 (*set)[i].luid.high = r.set.set[i].luid.high;
1229                 (*set)[i].attr = r.set.set[i].attr;
1230         }
1231
1232         *count=r.count;
1233  done:
1234
1235         return result;
1236 }
1237
1238 /** Get a privilege value given its name */
1239
1240 NTSTATUS rpccli_lsa_lookup_priv_value(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1241                                  POLICY_HND *pol, const char *name, LUID *luid)
1242 {
1243         prs_struct qbuf, rbuf;
1244         LSA_Q_LOOKUP_PRIV_VALUE q;
1245         LSA_R_LOOKUP_PRIV_VALUE r;
1246         NTSTATUS result;
1247
1248         ZERO_STRUCT(q);
1249         ZERO_STRUCT(r);
1250
1251         /* Marshall data and send request */
1252
1253         init_lsa_q_lookup_priv_value(&q, pol, name);
1254
1255         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPPRIVVALUE,
1256                 q, r,
1257                 qbuf, rbuf,
1258                 lsa_io_q_lookup_priv_value,
1259                 lsa_io_r_lookup_priv_value,
1260                 NT_STATUS_UNSUCCESSFUL);
1261
1262         result = r.status;
1263
1264         if (!NT_STATUS_IS_OK(result)) {
1265                 goto done;
1266         }
1267
1268         /* Return output parameters */
1269
1270         (*luid).low=r.luid.low;
1271         (*luid).high=r.luid.high;
1272
1273  done:
1274
1275         return result;
1276 }
1277
1278 /** Query LSA security object */
1279
1280 NTSTATUS rpccli_lsa_query_secobj(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1281                               POLICY_HND *pol, uint32 sec_info,
1282                               SEC_DESC_BUF **psdb)
1283 {
1284         prs_struct qbuf, rbuf;
1285         LSA_Q_QUERY_SEC_OBJ q;
1286         LSA_R_QUERY_SEC_OBJ r;
1287         NTSTATUS result;
1288
1289         ZERO_STRUCT(q);
1290         ZERO_STRUCT(r);
1291
1292         /* Marshall data and send request */
1293
1294         init_q_query_sec_obj(&q, pol, sec_info);
1295
1296         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYSECOBJ,
1297                 q, r,
1298                 qbuf, rbuf,
1299                 lsa_io_q_query_sec_obj,
1300                 lsa_io_r_query_sec_obj,
1301                 NT_STATUS_UNSUCCESSFUL);
1302
1303         result = r.status;
1304
1305         if (!NT_STATUS_IS_OK(result)) {
1306                 goto done;
1307         }
1308
1309         /* Return output parameters */
1310
1311         if (psdb)
1312                 *psdb = r.buf;
1313
1314  done:
1315
1316         return result;
1317 }
1318
1319
1320 /* Enumerate account rights This is similar to enum_privileges but
1321    takes a SID directly, avoiding the open_account call.
1322 */
1323
1324 NTSTATUS rpccli_lsa_enum_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1325                                      POLICY_HND *pol, DOM_SID *sid,
1326                                      uint32 *count, char ***priv_names)
1327 {
1328         prs_struct qbuf, rbuf;
1329         LSA_Q_ENUM_ACCT_RIGHTS q;
1330         LSA_R_ENUM_ACCT_RIGHTS r;
1331         NTSTATUS result;
1332         int i;
1333         fstring *privileges;
1334         char **names;
1335
1336         ZERO_STRUCT(q);
1337         ZERO_STRUCT(r);
1338
1339         /* Marshall data and send request */
1340         init_q_enum_acct_rights(&q, pol, 2, sid);
1341
1342         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMACCTRIGHTS,
1343                 q, r,
1344                 qbuf, rbuf,
1345                 lsa_io_q_enum_acct_rights,
1346                 lsa_io_r_enum_acct_rights,
1347                 NT_STATUS_UNSUCCESSFUL);
1348
1349         result = r.status;
1350
1351         if (!NT_STATUS_IS_OK(result)) {
1352                 goto done;
1353         }
1354
1355         *count = r.count;
1356         if (! *count) {
1357                 goto done;
1358         }
1359
1360
1361         privileges = TALLOC_ARRAY( mem_ctx, fstring, *count );
1362         names      = TALLOC_ARRAY( mem_ctx, char *, *count );
1363
1364         if ((privileges == NULL) || (names == NULL)) {
1365                 TALLOC_FREE(privileges);
1366                 TALLOC_FREE(names);
1367                 return NT_STATUS_NO_MEMORY;
1368         }
1369
1370         for ( i=0; i<*count; i++ ) {
1371                 UNISTR4 *uni_string = &r.rights->strings[i];
1372
1373                 if ( !uni_string->string )
1374                         continue;
1375
1376                 rpcstr_pull( privileges[i], uni_string->string->buffer, sizeof(privileges[i]), -1, STR_TERMINATE );
1377
1378                 /* now copy to the return array */
1379                 names[i] = talloc_strdup( mem_ctx, privileges[i] );
1380         }
1381
1382         *priv_names = names;
1383
1384 done:
1385
1386         return result;
1387 }
1388
1389
1390
1391 /* add account rights to an account. */
1392
1393 NTSTATUS rpccli_lsa_add_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1394                                     POLICY_HND *pol, DOM_SID sid,
1395                                         uint32 count, const char **privs_name)
1396 {
1397         prs_struct qbuf, rbuf;
1398         LSA_Q_ADD_ACCT_RIGHTS q;
1399         LSA_R_ADD_ACCT_RIGHTS r;
1400         NTSTATUS result;
1401
1402         ZERO_STRUCT(q);
1403         ZERO_STRUCT(r);
1404
1405         /* Marshall data and send request */
1406         init_q_add_acct_rights(&q, pol, &sid, count, privs_name);
1407
1408         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ADDACCTRIGHTS,
1409                 q, r,
1410                 qbuf, rbuf,
1411                 lsa_io_q_add_acct_rights,
1412                 lsa_io_r_add_acct_rights,
1413                 NT_STATUS_UNSUCCESSFUL);
1414
1415         result = r.status;
1416
1417         if (!NT_STATUS_IS_OK(result)) {
1418                 goto done;
1419         }
1420 done:
1421
1422         return result;
1423 }
1424
1425
1426 /* remove account rights for an account. */
1427
1428 NTSTATUS rpccli_lsa_remove_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1429                                        POLICY_HND *pol, DOM_SID sid, BOOL removeall,
1430                                        uint32 count, const char **privs_name)
1431 {
1432         prs_struct qbuf, rbuf;
1433         LSA_Q_REMOVE_ACCT_RIGHTS q;
1434         LSA_R_REMOVE_ACCT_RIGHTS r;
1435         NTSTATUS result;
1436
1437         ZERO_STRUCT(q);
1438         ZERO_STRUCT(r);
1439
1440         /* Marshall data and send request */
1441         init_q_remove_acct_rights(&q, pol, &sid, removeall?1:0, count, privs_name);
1442
1443         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_REMOVEACCTRIGHTS,
1444                 q, r,
1445                 qbuf, rbuf,
1446                 lsa_io_q_remove_acct_rights,
1447                 lsa_io_r_remove_acct_rights,
1448                 NT_STATUS_UNSUCCESSFUL);
1449
1450         result = r.status;
1451
1452         if (!NT_STATUS_IS_OK(result)) {
1453                 goto done;
1454         }
1455 done:
1456
1457         return result;
1458 }
1459
1460
1461 #if 0
1462
1463 /** An example of how to use the routines in this file.  Fetch a DOMAIN
1464     sid. Does complete cli setup / teardown anonymously. */
1465
1466 BOOL fetch_domain_sid( char *domain, char *remote_machine, DOM_SID *psid)
1467 {
1468         extern pstring global_myname;
1469         struct cli_state *cli;
1470         NTSTATUS result;
1471         POLICY_HND lsa_pol;
1472         BOOL ret = False;
1473
1474         ZERO_STRUCT(cli);
1475         if((cli = cli_initialise()) == NULL) {
1476                 DEBUG(0,("fetch_domain_sid: unable to initialize client connection.\n"));
1477                 return False;
1478         }
1479
1480         if(!resolve_name( remote_machine, &cli->dest_ip, 0x20)) {
1481                 DEBUG(0,("fetch_domain_sid: Can't resolve address for %s\n", remote_machine));
1482                 goto done;
1483         }
1484
1485         if (!cli_connect(cli, remote_machine, &cli->dest_ip)) {
1486                 DEBUG(0,("fetch_domain_sid: unable to connect to SMB server on \
1487 machine %s. Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1488                 goto done;
1489         }
1490
1491         if (!attempt_netbios_session_request(cli, global_myname, remote_machine, &cli->dest_ip)) {
1492                 DEBUG(0,("fetch_domain_sid: machine %s rejected the NetBIOS session request.\n",
1493                         remote_machine));
1494                 goto done;
1495         }
1496
1497         cli->protocol = PROTOCOL_NT1;
1498
1499         if (!cli_negprot(cli)) {
1500                 DEBUG(0,("fetch_domain_sid: machine %s rejected the negotiate protocol. \
1501 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1502                 goto done;
1503         }
1504
1505         if (cli->protocol != PROTOCOL_NT1) {
1506                 DEBUG(0,("fetch_domain_sid: machine %s didn't negotiate NT protocol.\n",
1507                         remote_machine));
1508                 goto done;
1509         }
1510
1511         /*
1512          * Do an anonymous session setup.
1513          */
1514
1515         if (!cli_session_setup(cli, "", "", 0, "", 0, "")) {
1516                 DEBUG(0,("fetch_domain_sid: machine %s rejected the session setup. \
1517 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1518                 goto done;
1519         }
1520
1521         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
1522                 DEBUG(0,("fetch_domain_sid: machine %s isn't in user level security mode\n",
1523                         remote_machine));
1524                 goto done;
1525         }
1526
1527         if (!cli_send_tconX(cli, "IPC$", "IPC", "", 1)) {
1528                 DEBUG(0,("fetch_domain_sid: machine %s rejected the tconX on the IPC$ share. \
1529 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1530                 goto done;
1531         }
1532
1533         /* Fetch domain sid */
1534
1535         if (!cli_nt_session_open(cli, PI_LSARPC)) {
1536                 DEBUG(0, ("fetch_domain_sid: Error connecting to SAM pipe\n"));
1537                 goto done;
1538         }
1539
1540         result = cli_lsa_open_policy(cli, cli->mem_ctx, True, SEC_RIGHTS_QUERY_VALUE, &lsa_pol);
1541         if (!NT_STATUS_IS_OK(result)) {
1542                 DEBUG(0, ("fetch_domain_sid: Error opening lsa policy handle. %s\n",
1543                         nt_errstr(result) ));
1544                 goto done;
1545         }
1546
1547         result = cli_lsa_query_info_policy(cli, cli->mem_ctx, &lsa_pol, 5, domain, psid);
1548         if (!NT_STATUS_IS_OK(result)) {
1549                 DEBUG(0, ("fetch_domain_sid: Error querying lsa policy handle. %s\n",
1550                         nt_errstr(result) ));
1551                 goto done;
1552         }
1553
1554         ret = True;
1555
1556   done:
1557
1558         cli_shutdown(cli);
1559         return ret;
1560 }
1561
1562 #endif
1563
1564 NTSTATUS rpccli_lsa_open_trusted_domain(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1565                                      POLICY_HND *pol, DOM_SID *dom_sid, uint32 access_mask,
1566                                      POLICY_HND *trustdom_pol)
1567 {
1568         prs_struct qbuf, rbuf;
1569         LSA_Q_OPEN_TRUSTED_DOMAIN q;
1570         LSA_R_OPEN_TRUSTED_DOMAIN r;
1571         NTSTATUS result;
1572
1573         ZERO_STRUCT(q);
1574         ZERO_STRUCT(r);
1575
1576         /* Initialise input parameters */
1577
1578         init_lsa_q_open_trusted_domain(&q, pol, dom_sid, access_mask);
1579
1580         /* Marshall data and send request */
1581
1582         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOM,
1583                 q, r,
1584                 qbuf, rbuf,
1585                 lsa_io_q_open_trusted_domain,
1586                 lsa_io_r_open_trusted_domain,
1587                 NT_STATUS_UNSUCCESSFUL);
1588
1589         /* Return output parameters */
1590
1591         result = r.status;
1592
1593         if (NT_STATUS_IS_OK(result)) {
1594                 *trustdom_pol = r.handle;
1595         }
1596
1597         return result;
1598 }
1599
1600 NTSTATUS rpccli_lsa_query_trusted_domain_info(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1601                                            POLICY_HND *pol,
1602                                            uint16 info_class,
1603                                            LSA_TRUSTED_DOMAIN_INFO **info)
1604 {
1605         prs_struct qbuf, rbuf;
1606         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO q;
1607         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1608         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1609
1610         ZERO_STRUCT(q);
1611         ZERO_STRUCT(r);
1612
1613         /* Marshall data and send request */
1614
1615         init_q_query_trusted_domain_info(&q, pol, info_class);
1616
1617         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFO,
1618                 q, r,
1619                 qbuf, rbuf,
1620                 lsa_io_q_query_trusted_domain_info,
1621                 lsa_io_r_query_trusted_domain_info,
1622                 NT_STATUS_UNSUCCESSFUL);
1623
1624         result = r.status;
1625
1626         if (!NT_STATUS_IS_OK(result)) {
1627                 goto done;
1628         }
1629
1630         *info = r.info;
1631
1632 done:
1633         return result;
1634 }
1635
1636 NTSTATUS rpccli_lsa_open_trusted_domain_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1637                                                 POLICY_HND *pol, const char *name, uint32 access_mask,
1638                                                 POLICY_HND *trustdom_pol)
1639 {
1640         prs_struct qbuf, rbuf;
1641         LSA_Q_OPEN_TRUSTED_DOMAIN_BY_NAME q;
1642         LSA_R_OPEN_TRUSTED_DOMAIN_BY_NAME r;
1643         NTSTATUS result;
1644
1645         ZERO_STRUCT(q);
1646         ZERO_STRUCT(r);
1647
1648         /* Initialise input parameters */
1649
1650         init_lsa_q_open_trusted_domain_by_name(&q, pol, name, access_mask);
1651
1652         /* Marshall data and send request */
1653
1654         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOMBYNAME,
1655                 q, r,
1656                 qbuf, rbuf,
1657                 lsa_io_q_open_trusted_domain_by_name,
1658                 lsa_io_r_open_trusted_domain_by_name,
1659                 NT_STATUS_UNSUCCESSFUL);
1660
1661         /* Return output parameters */
1662
1663         result = r.status;
1664
1665         if (NT_STATUS_IS_OK(result)) {
1666                 *trustdom_pol = r.handle;
1667         }
1668
1669         return result;
1670 }
1671
1672
1673 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_sid(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1674                                                   POLICY_HND *pol,
1675                                                   uint16 info_class, DOM_SID *dom_sid,
1676                                                   LSA_TRUSTED_DOMAIN_INFO **info)
1677 {
1678         prs_struct qbuf, rbuf;
1679         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_SID q;
1680         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1681         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1682
1683         ZERO_STRUCT(q);
1684         ZERO_STRUCT(r);
1685
1686         /* Marshall data and send request */
1687
1688         init_q_query_trusted_domain_info_by_sid(&q, pol, info_class, dom_sid);
1689
1690         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYSID,
1691                 q, r,
1692                 qbuf, rbuf,
1693                 lsa_io_q_query_trusted_domain_info_by_sid,
1694                 lsa_io_r_query_trusted_domain_info,
1695                 NT_STATUS_UNSUCCESSFUL);
1696
1697         result = r.status;
1698
1699         if (!NT_STATUS_IS_OK(result)) {
1700                 goto done;
1701         }
1702
1703         *info = r.info;
1704
1705 done:
1706
1707         return result;
1708 }
1709
1710 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1711                                                    POLICY_HND *pol,
1712                                                    uint16 info_class, const char *domain_name,
1713                                                    LSA_TRUSTED_DOMAIN_INFO **info)
1714 {
1715         prs_struct qbuf, rbuf;
1716         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_NAME q;
1717         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1718         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1719
1720         ZERO_STRUCT(q);
1721         ZERO_STRUCT(r);
1722
1723         /* Marshall data and send request */
1724
1725         init_q_query_trusted_domain_info_by_name(&q, pol, info_class, domain_name);
1726
1727         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYNAME,
1728                 q, r,
1729                 qbuf, rbuf,
1730                 lsa_io_q_query_trusted_domain_info_by_name,
1731                 lsa_io_r_query_trusted_domain_info,
1732                 NT_STATUS_UNSUCCESSFUL);
1733
1734         result = r.status;
1735
1736         if (!NT_STATUS_IS_OK(result)) {
1737                 goto done;
1738         }
1739
1740         *info = r.info;
1741
1742 done:
1743
1744         return result;
1745 }
1746
1747 NTSTATUS cli_lsa_query_domain_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1748                                           POLICY_HND *pol,
1749                                           uint16 info_class, LSA_DOM_INFO_UNION **info)
1750 {
1751         prs_struct qbuf, rbuf;
1752         LSA_Q_QUERY_DOM_INFO_POLICY q;
1753         LSA_R_QUERY_DOM_INFO_POLICY r;
1754         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1755
1756         ZERO_STRUCT(q);
1757         ZERO_STRUCT(r);
1758
1759         /* Marshall data and send request */
1760
1761         init_q_query_dom_info(&q, pol, info_class);
1762
1763         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYDOMINFOPOL,
1764                 q, r,
1765                 qbuf, rbuf,
1766                 lsa_io_q_query_dom_info,
1767                 lsa_io_r_query_dom_info,
1768                 NT_STATUS_UNSUCCESSFUL);
1769
1770         result = r.status;
1771
1772         if (!NT_STATUS_IS_OK(result)) {
1773                 goto done;
1774         }
1775
1776         *info = r.info;
1777
1778 done:
1779         return result;
1780 }
1781