source4/rpc_server/samr/dcesrv_samr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the samr pipe
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Volker Lendecke 2004
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   9    Copyright (C) Matthias Dieter Wallnöfer 2009
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "librpc/gen_ndr/ndr_samr.h"
  27 #include "rpc_server/dcerpc_server.h"
  28 #include "rpc_server/common/common.h"
  29 #include "rpc_server/samr/dcesrv_samr.h"
  30 #include "system/time.h"
  31 #include <ldb.h>
  32 #include <ldb_errors.h>
  33 #include "../libds/common/flags.h"
  34 #include "dsdb/samdb/samdb.h"
  35 #include "dsdb/common/util.h"
  36 #include "libcli/ldap/ldap_ndr.h"
  37 #include "libcli/security/security.h"
  38 #include "rpc_server/samr/proto.h"
  39 #include "../lib/util/util_ldb.h"
  40 #include "param/param.h"
  41 #include "lib/util/tsort.h"
  42 #include "libds/common/flag_mapping.h"
  43
  44 #undef strcasecmp
  45
  46 #define DCESRV_INTERFACE_SAMR_BIND(context, iface) \
  47        dcesrv_interface_samr_bind(context, iface)
  48 static NTSTATUS dcesrv_interface_samr_bind(struct dcesrv_connection_context *context,
  49                                              const struct dcesrv_interface *iface)
  50 {
  51         return dcesrv_interface_bind_reject_connect(context, iface);
  52 }
  53
  54 /* these query macros make samr_Query[User|Group|Alias]Info a bit easier to read */
  55
  56 #define QUERY_STRING(msg, field, attr) \
  57         info->field.string = ldb_msg_find_attr_as_string(msg, attr, "");
  58 #define QUERY_UINT(msg, field, attr) \
  59         info->field = ldb_msg_find_attr_as_uint(msg, attr, 0);
  60 #define QUERY_RID(msg, field, attr) \
  61         info->field = samdb_result_rid_from_sid(mem_ctx, msg, attr, 0);
  62 #define QUERY_UINT64(msg, field, attr) \
  63         info->field = ldb_msg_find_attr_as_uint64(msg, attr, 0);
  64 #define QUERY_APASSC(msg, field, attr) \
  65         info->field = samdb_result_allow_password_change(sam_ctx, mem_ctx, \
  66                                                          a_state->domain_state->domain_dn, msg, attr);
  67 #define QUERY_BPWDCT(msg, field, attr) \
  68         info->field = samdb_result_effective_badPwdCount(sam_ctx, mem_ctx, \
  69                                                          a_state->domain_state->domain_dn, msg);
  70 #define QUERY_LHOURS(msg, field, attr) \
  71         info->field = samdb_result_logon_hours(mem_ctx, msg, attr);
  72 #define QUERY_AFLAGS(msg, field, attr) \
  73         info->field = samdb_result_acct_flags(msg, attr);
  74
  75
  76 /* these are used to make the Set[User|Group]Info code easier to follow */
  77
  78 #define SET_STRING(msg, field, attr) do {                               \
  79         struct ldb_message_element *set_el;                             \
  80         if (r->in.info->field.string == NULL) return NT_STATUS_INVALID_PARAMETER; \
  81         if (r->in.info->field.string[0] == '\0') {                      \
  82                 if (ldb_msg_add_empty(msg, attr, LDB_FLAG_MOD_DELETE, NULL) != LDB_SUCCESS) { \
  83                         return NT_STATUS_NO_MEMORY;                     \
  84                 }                                                       \
  85         }                                                               \
  86         if (ldb_msg_add_string(msg, attr, r->in.info->field.string) != LDB_SUCCESS) { \
  87                 return NT_STATUS_NO_MEMORY;                             \
  88         }                                                               \
  89         set_el = ldb_msg_find_element(msg, attr);                       \
  90         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
  91 } while (0)
  92
  93 #define SET_UINT(msg, field, attr) do {                                 \
  94         struct ldb_message_element *set_el;                             \
  95         if (samdb_msg_add_uint(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \
  96                 return NT_STATUS_NO_MEMORY;                             \
  97         }                                                               \
  98         set_el = ldb_msg_find_element(msg, attr);                       \
  99         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
 100 } while (0)
 101
 102 #define SET_INT64(msg, field, attr) do {                                \
 103         struct ldb_message_element *set_el;                             \
 104         if (samdb_msg_add_int64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \
 105                 return NT_STATUS_NO_MEMORY;                             \
 106         }                                                               \
 107         set_el = ldb_msg_find_element(msg, attr);                       \
 108         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
 109 } while (0)
 110
 111 #define SET_UINT64(msg, field, attr) do {                               \
 112         struct ldb_message_element *set_el;                             \
 113         if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \
 114                 return NT_STATUS_NO_MEMORY;                             \
 115         }                                                               \
 116         set_el = ldb_msg_find_element(msg, attr);                       \
 117         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
 118 } while (0)
 119
 120 /* Set account flags, discarding flags that cannot be set with SAMR */
 121 #define SET_AFLAGS(msg, field, attr) do {                               \
 122         struct ldb_message_element *set_el;                             \
 123         if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
 124                 return NT_STATUS_NO_MEMORY;                             \
 125         }                                                               \
 126         set_el = ldb_msg_find_element(msg, attr);                       \
 127         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
 128 } while (0)
 129
 130 #define SET_LHOURS(msg, field, attr) do {                               \
 131         struct ldb_message_element *set_el;                             \
 132         if (samdb_msg_add_logon_hours(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != LDB_SUCCESS) { \
 133                 return NT_STATUS_NO_MEMORY;                             \
 134         }                                                               \
 135         set_el = ldb_msg_find_element(msg, attr);                       \
 136         set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
 137 } while (0)
 138
 139 #define SET_PARAMETERS(msg, field, attr) do {                           \
 140         struct ldb_message_element *set_el;                             \
 141         if (r->in.info->field.length != 0) {                            \
 142                 if (samdb_msg_add_parameters(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != LDB_SUCCESS) { \
 143                         return NT_STATUS_NO_MEMORY;                     \
 144                 }                                                       \
 145                 set_el = ldb_msg_find_element(msg, attr);               \
 146                 set_el->flags = LDB_FLAG_MOD_REPLACE;                   \
 147         }                                                               \
 148 } while (0)
 149
 150 /*
 151  * Clear a GUID cache
 152  */
 153 static void clear_guid_cache(struct samr_guid_cache *cache)
 154 {
 155         cache->handle = 0;
 156         cache->size = 0;
 157         TALLOC_FREE(cache->entries);
 158 }
 159
 160 /*
 161  * initialize a GUID cache
 162  */
 163 static void initialize_guid_cache(struct samr_guid_cache *cache)
 164 {
 165         cache->handle = 0;
 166         cache->size = 0;
 167         cache->entries = NULL;
 168 }
 169
 170 static NTSTATUS load_guid_cache(
 171         struct samr_guid_cache *cache,
 172         struct samr_domain_state *d_state,
 173         unsigned int ldb_cnt,
 174         struct ldb_message **res)
 175 {
 176         NTSTATUS status = NT_STATUS_OK;
 177         unsigned int i;
 178         TALLOC_CTX *frame = talloc_stackframe();
 179
 180         clear_guid_cache(cache);
 181
 182         /*
 183          * Store the GUID's in the cache.
 184          */
 185         cache->handle = 0;
 186         cache->size = ldb_cnt;
 187         cache->entries = talloc_array(d_state, struct GUID, ldb_cnt);
 188         if (cache->entries == NULL) {
 189                 clear_guid_cache(cache);
 190                 status = NT_STATUS_NO_MEMORY;
 191                 goto exit;
 192         }
 193
 194         /*
 195          * Extract a list of the GUIDs for all the matching objects
 196          * we cache just the GUIDS to reduce the memory overhead of
 197          * the result cache.
 198          */
 199         for (i = 0; i < ldb_cnt; i++) {
 200                 cache->entries[i] = samdb_result_guid(res[i], "objectGUID");
 201         }
 202 exit:
 203         TALLOC_FREE(frame);
 204         return status;
 205 }
 206
 207 /*
 208   samr_Connect
 209
 210   create a connection to the SAM database
 211 */
 212 static NTSTATUS dcesrv_samr_Connect(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 213                              struct samr_Connect *r)
 214 {
 215         struct samr_connect_state *c_state;
 216         struct dcesrv_handle *handle;
 217
 218         ZERO_STRUCTP(r->out.connect_handle);
 219
 220         c_state = talloc(mem_ctx, struct samr_connect_state);
 221         if (!c_state) {
 222                 return NT_STATUS_NO_MEMORY;
 223         }
 224
 225         /* make sure the sam database is accessible */
 226         c_state->sam_ctx = dcesrv_samdb_connect_as_user(c_state, dce_call);
 227         if (c_state->sam_ctx == NULL) {
 228                 talloc_free(c_state);
 229                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 230         }
 231
 232         handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_CONNECT);
 233         if (!handle) {
 234                 talloc_free(c_state);
 235                 return NT_STATUS_NO_MEMORY;
 236         }
 237
 238         handle->data = talloc_steal(handle, c_state);
 239
 240         c_state->access_mask = r->in.access_mask;
 241         *r->out.connect_handle = handle->wire_handle;
 242
 243         return NT_STATUS_OK;
 244 }
 245
 246
 247 /*
 248   samr_Close
 249 */
 250 static NTSTATUS dcesrv_samr_Close(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 251                            struct samr_Close *r)
 252 {
 253         struct dcesrv_handle *h;
 254
 255         *r->out.handle = *r->in.handle;
 256
 257         DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
 258
 259         talloc_free(h);
 260
 261         ZERO_STRUCTP(r->out.handle);
 262
 263         return NT_STATUS_OK;
 264 }
 265
 266
 267 /*
 268   samr_SetSecurity
 269 */
 270 static NTSTATUS dcesrv_samr_SetSecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 271                                  struct samr_SetSecurity *r)
 272 {
 273         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 274 }
 275
 276
 277 /*
 278   samr_QuerySecurity
 279 */
 280 static NTSTATUS dcesrv_samr_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 281                                    struct samr_QuerySecurity *r)
 282 {
 283         struct dcesrv_handle *h;
 284         struct sec_desc_buf *sd;
 285
 286         *r->out.sdbuf = NULL;
 287
 288         DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
 289
 290         sd = talloc(mem_ctx, struct sec_desc_buf);
 291         if (sd == NULL) {
 292                 return NT_STATUS_NO_MEMORY;
 293         }
 294
 295         sd->sd = samdb_default_security_descriptor(mem_ctx);
 296
 297         *r->out.sdbuf = sd;
 298
 299         return NT_STATUS_OK;
 300 }
 301
 302
 303 /*
 304   samr_Shutdown
 305
 306   we refuse this operation completely. If a admin wants to shutdown samr
 307   in Samba then they should use the samba admin tools to disable the samr pipe
 308 */
 309 static NTSTATUS dcesrv_samr_Shutdown(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 310                               struct samr_Shutdown *r)
 311 {
 312         return NT_STATUS_ACCESS_DENIED;
 313 }
 314
 315
 316 /*
 317   samr_LookupDomain
 318
 319   this maps from a domain name to a SID
 320 */
 321 static NTSTATUS dcesrv_samr_LookupDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 322                                   struct samr_LookupDomain *r)
 323 {
 324         struct samr_connect_state *c_state;
 325         struct dcesrv_handle *h;
 326         struct dom_sid *sid;
 327         const char * const dom_attrs[] = { "objectSid", NULL};
 328         struct ldb_message **dom_msgs;
 329         int ret;
 330
 331         *r->out.sid = NULL;
 332
 333         DCESRV_PULL_HANDLE(h, r->in.connect_handle, SAMR_HANDLE_CONNECT);
 334
 335         c_state = h->data;
 336
 337         if (r->in.domain_name->string == NULL) {
 338                 return NT_STATUS_INVALID_PARAMETER;
 339         }
 340
 341         if (strcasecmp(r->in.domain_name->string, "BUILTIN") == 0) {
 342                 ret = gendb_search(c_state->sam_ctx,
 343                                    mem_ctx, NULL, &dom_msgs, dom_attrs,
 344                                    "(objectClass=builtinDomain)");
 345         } else if (strcasecmp_m(r->in.domain_name->string, lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx)) == 0) {
 346                 ret = gendb_search_dn(c_state->sam_ctx,
 347                                       mem_ctx, ldb_get_default_basedn(c_state->sam_ctx),
 348                                       &dom_msgs, dom_attrs);
 349         } else {
 350                 return NT_STATUS_NO_SUCH_DOMAIN;
 351         }
 352         if (ret != 1) {
 353                 return NT_STATUS_NO_SUCH_DOMAIN;
 354         }
 355
 356         sid = samdb_result_dom_sid(mem_ctx, dom_msgs[0],
 357                                    "objectSid");
 358
 359         if (sid == NULL) {
 360                 return NT_STATUS_NO_SUCH_DOMAIN;
 361         }
 362
 363         *r->out.sid = sid;
 364
 365         return NT_STATUS_OK;
 366 }
 367
 368
 369 /*
 370   samr_EnumDomains
 371
 372   list the domains in the SAM
 373 */
 374 static NTSTATUS dcesrv_samr_EnumDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 375                                  struct samr_EnumDomains *r)
 376 {
 377         struct dcesrv_handle *h;
 378         struct samr_SamArray *array;
 379         uint32_t i, start_i;
 380
 381         *r->out.resume_handle = 0;
 382         *r->out.sam = NULL;
 383         *r->out.num_entries = 0;
 384
 385         DCESRV_PULL_HANDLE(h, r->in.connect_handle, SAMR_HANDLE_CONNECT);
 386
 387         *r->out.resume_handle = 2;
 388
 389         start_i = *r->in.resume_handle;
 390
 391         if (start_i >= 2) {
 392                 /* search past end of list is not an error for this call */
 393                 return NT_STATUS_OK;
 394         }
 395
 396         array = talloc(mem_ctx, struct samr_SamArray);
 397         if (array == NULL) {
 398                 return NT_STATUS_NO_MEMORY;
 399         }
 400
 401         array->count = 0;
 402         array->entries = NULL;
 403
 404         array->entries = talloc_array(mem_ctx, struct samr_SamEntry, 2 - start_i);
 405         if (array->entries == NULL) {
 406                 return NT_STATUS_NO_MEMORY;
 407         }
 408
 409         for (i=0;i<2-start_i;i++) {
 410                 array->entries[i].idx = start_i + i;
 411                 if (i == 0) {
 412                         array->entries[i].name.string = lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx);
 413                 } else {
 414                         array->entries[i].name.string = "BUILTIN";
 415                 }
 416         }
 417
 418         *r->out.sam = array;
 419         *r->out.num_entries = i;
 420         array->count = *r->out.num_entries;
 421
 422         return NT_STATUS_OK;
 423 }
 424
 425
 426 /*
 427   samr_OpenDomain
 428 */
 429 static NTSTATUS dcesrv_samr_OpenDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 430                                 struct samr_OpenDomain *r)
 431 {
 432         struct dcesrv_handle *h_conn, *h_domain;
 433         struct samr_connect_state *c_state;
 434         struct samr_domain_state *d_state;
 435         const char * const dom_attrs[] = { "cn", NULL};
 436         struct ldb_message **dom_msgs;
 437         int ret;
 438         unsigned int i;
 439
 440         ZERO_STRUCTP(r->out.domain_handle);
 441
 442         DCESRV_PULL_HANDLE(h_conn, r->in.connect_handle, SAMR_HANDLE_CONNECT);
 443
 444         c_state = h_conn->data;
 445
 446         if (r->in.sid == NULL) {
 447                 return NT_STATUS_INVALID_PARAMETER;
 448         }
 449
 450         d_state = talloc(mem_ctx, struct samr_domain_state);
 451         if (!d_state) {
 452                 return NT_STATUS_NO_MEMORY;
 453         }
 454
 455         d_state->domain_sid = talloc_steal(d_state, r->in.sid);
 456
 457         if (dom_sid_equal(d_state->domain_sid, &global_sid_Builtin)) {
 458                 d_state->builtin = true;
 459                 d_state->domain_name = "BUILTIN";
 460         } else {
 461                 d_state->builtin = false;
 462                 d_state->domain_name = lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx);
 463         }
 464
 465         ret = gendb_search(c_state->sam_ctx,
 466                            mem_ctx, ldb_get_default_basedn(c_state->sam_ctx), &dom_msgs, dom_attrs,
 467                            "(objectSid=%s)",
 468                            ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
 469
 470         if (ret == 0) {
 471                 talloc_free(d_state);
 472                 return NT_STATUS_NO_SUCH_DOMAIN;
 473         } else if (ret > 1) {
 474                 talloc_free(d_state);
 475                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 476         } else if (ret == -1) {
 477                 talloc_free(d_state);
 478                 DEBUG(1, ("Failed to open domain %s: %s\n", dom_sid_string(mem_ctx, r->in.sid), ldb_errstring(c_state->sam_ctx)));
 479                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 480         }
 481
 482         d_state->domain_dn = talloc_steal(d_state, dom_msgs[0]->dn);
 483         d_state->role = lpcfg_server_role(dce_call->conn->dce_ctx->lp_ctx);
 484         d_state->connect_state = talloc_reference(d_state, c_state);
 485         d_state->sam_ctx = c_state->sam_ctx;
 486         d_state->access_mask = r->in.access_mask;
 487         d_state->domain_users_cached = NULL;
 488
 489         d_state->lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
 490
 491         for (i = 0; i < SAMR_LAST_CACHE; i++) {
 492                 initialize_guid_cache(&d_state->guid_caches[i]);
 493         }
 494
 495         h_domain = dcesrv_handle_create(dce_call, SAMR_HANDLE_DOMAIN);
 496         if (!h_domain) {
 497                 talloc_free(d_state);
 498                 return NT_STATUS_NO_MEMORY;
 499         }
 500
 501         h_domain->data = talloc_steal(h_domain, d_state);
 502
 503         *r->out.domain_handle = h_domain->wire_handle;
 504
 505         return NT_STATUS_OK;
 506 }
 507
 508 /*
 509   return DomInfo1
 510 */
 511 static NTSTATUS dcesrv_samr_info_DomInfo1(struct samr_domain_state *state,
 512                                           TALLOC_CTX *mem_ctx,
 513                                           struct ldb_message **dom_msgs,
 514                                           struct samr_DomInfo1 *info)
 515 {
 516         info->min_password_length =
 517                 ldb_msg_find_attr_as_uint(dom_msgs[0], "minPwdLength", 0);
 518         info->password_history_length =
 519                 ldb_msg_find_attr_as_uint(dom_msgs[0], "pwdHistoryLength", 0);
 520         info->password_properties =
 521                 ldb_msg_find_attr_as_uint(dom_msgs[0], "pwdProperties", 0);
 522         info->max_password_age =
 523                 ldb_msg_find_attr_as_int64(dom_msgs[0], "maxPwdAge", 0);
 524         info->min_password_age =
 525                 ldb_msg_find_attr_as_int64(dom_msgs[0], "minPwdAge", 0);
 526
 527         return NT_STATUS_OK;
 528 }
 529
 530 /*
 531   return DomInfo2
 532 */
 533 static NTSTATUS dcesrv_samr_info_DomGeneralInformation(struct samr_domain_state *state,
 534                                                        TALLOC_CTX *mem_ctx,
 535                                                        struct ldb_message **dom_msgs,
 536                                                        struct samr_DomGeneralInformation *info)
 537 {
 538         size_t count = 0;
 539         const enum ldb_scope scope = LDB_SCOPE_SUBTREE;
 540         int ret = 0;
 541
 542         /* MS-SAMR 2.2.4.1 - ReplicaSourceNodeName: "domainReplica" attribute */
 543         info->primary.string = ldb_msg_find_attr_as_string(dom_msgs[0],
 544                                                            "domainReplica",
 545                                                            "");
 546
 547         info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff",
 548                                                             0x8000000000000000LL);
 549
 550         info->oem_information.string = ldb_msg_find_attr_as_string(dom_msgs[0],
 551                                                                    "oEMInformation",
 552                                                                    "");
 553         info->domain_name.string  = state->domain_name;
 554
 555         info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount",
 556                                                  0);
 557         switch (state->role) {
 558         case ROLE_ACTIVE_DIRECTORY_DC:
 559                 /* This pulls the NetBIOS name from the
 560                    cn=NTDS Settings,cn=<NETBIOS name of PDC>,....
 561                    string */
 562                 if (samdb_is_pdc(state->sam_ctx)) {
 563                         info->role = SAMR_ROLE_DOMAIN_PDC;
 564                 } else {
 565                         info->role = SAMR_ROLE_DOMAIN_BDC;
 566                 }
 567                 break;
 568         case ROLE_DOMAIN_PDC:
 569         case ROLE_DOMAIN_BDC:
 570         case ROLE_IPA_DC:
 571         case ROLE_AUTO:
 572                 return NT_STATUS_INTERNAL_ERROR;
 573         case ROLE_DOMAIN_MEMBER:
 574                 info->role = SAMR_ROLE_DOMAIN_MEMBER;
 575                 break;
 576         case ROLE_STANDALONE:
 577                 info->role = SAMR_ROLE_STANDALONE;
 578                 break;
 579         }
 580
 581         /*
 582          * Users are not meant to be in BUILTIN
 583          * so to speed up the query we do not filter on domain_sid
 584          */
 585         ret = dsdb_domain_count(
 586                 state->sam_ctx,
 587                 &count,
 588                 state->domain_dn,
 589                 NULL,
 590                 scope,
 591                 "(objectClass=user)");
 592         if (ret != LDB_SUCCESS || count > UINT32_MAX) {
 593                 goto error;
 594         }
 595         info->num_users = count;
 596
 597         /*
 598          * Groups are not meant to be in BUILTIN
 599          * so to speed up the query we do not filter on domain_sid
 600          */
 601         ret = dsdb_domain_count(
 602                 state->sam_ctx,
 603                 &count,
 604                 state->domain_dn,
 605                 NULL,
 606                 scope,
 607                 "(&(objectClass=group)(|(groupType=%d)(groupType=%d)))",
 608                 GTYPE_SECURITY_UNIVERSAL_GROUP,
 609                 GTYPE_SECURITY_GLOBAL_GROUP);
 610         if (ret != LDB_SUCCESS || count > UINT32_MAX) {
 611                 goto error;
 612         }
 613         info->num_groups = count;
 614
 615         ret = dsdb_domain_count(
 616                 state->sam_ctx,
 617                 &count,
 618                 state->domain_dn,
 619                 state->domain_sid,
 620                 scope,
 621                 "(&(objectClass=group)(|(groupType=%d)(groupType=%d)))",
 622                 GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
 623                 GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
 624         if (ret != LDB_SUCCESS || count > UINT32_MAX) {
 625                 goto error;
 626         }
 627         info->num_aliases = count;
 628
 629         return NT_STATUS_OK;
 630
 631 error:
 632         if (count > UINT32_MAX) {
 633                 return NT_STATUS_INTEGER_OVERFLOW;
 634         }
 635         return dsdb_ldb_err_to_ntstatus(ret);
 636
 637 }
 638
 639 /*
 640   return DomInfo3
 641 */
 642 static NTSTATUS dcesrv_samr_info_DomInfo3(struct samr_domain_state *state,
 643                                           TALLOC_CTX *mem_ctx,
 644                                           struct ldb_message **dom_msgs,
 645                                           struct samr_DomInfo3 *info)
 646 {
 647         info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff",
 648                                                       0x8000000000000000LL);
 649
 650         return NT_STATUS_OK;
 651 }
 652
 653 /*
 654   return DomInfo4
 655 */
 656 static NTSTATUS dcesrv_samr_info_DomOEMInformation(struct samr_domain_state *state,
 657                                    TALLOC_CTX *mem_ctx,
 658                                     struct ldb_message **dom_msgs,
 659                                    struct samr_DomOEMInformation *info)
 660 {
 661         info->oem_information.string = ldb_msg_find_attr_as_string(dom_msgs[0],
 662                                                                    "oEMInformation",
 663                                                                    "");
 664
 665         return NT_STATUS_OK;
 666 }
 667
 668 /*
 669   return DomInfo5
 670 */
 671 static NTSTATUS dcesrv_samr_info_DomInfo5(struct samr_domain_state *state,
 672                                           TALLOC_CTX *mem_ctx,
 673                                           struct ldb_message **dom_msgs,
 674                                           struct samr_DomInfo5 *info)
 675 {
 676         info->domain_name.string  = state->domain_name;
 677
 678         return NT_STATUS_OK;
 679 }
 680
 681 /*
 682   return DomInfo6
 683 */
 684 static NTSTATUS dcesrv_samr_info_DomInfo6(struct samr_domain_state *state,
 685                                           TALLOC_CTX *mem_ctx,
 686                                           struct ldb_message **dom_msgs,
 687                                           struct samr_DomInfo6 *info)
 688 {
 689         /* MS-SAMR 2.2.4.1 - ReplicaSourceNodeName: "domainReplica" attribute */
 690         info->primary.string = ldb_msg_find_attr_as_string(dom_msgs[0],
 691                                                            "domainReplica",
 692                                                            "");
 693
 694         return NT_STATUS_OK;
 695 }
 696
 697 /*
 698   return DomInfo7
 699 */
 700 static NTSTATUS dcesrv_samr_info_DomInfo7(struct samr_domain_state *state,
 701                                           TALLOC_CTX *mem_ctx,
 702                                           struct ldb_message **dom_msgs,
 703                                           struct samr_DomInfo7 *info)
 704 {
 705
 706         switch (state->role) {
 707         case ROLE_ACTIVE_DIRECTORY_DC:
 708                 /* This pulls the NetBIOS name from the
 709                    cn=NTDS Settings,cn=<NETBIOS name of PDC>,....
 710                    string */
 711                 if (samdb_is_pdc(state->sam_ctx)) {
 712                         info->role = SAMR_ROLE_DOMAIN_PDC;
 713                 } else {
 714                         info->role = SAMR_ROLE_DOMAIN_BDC;
 715                 }
 716                 break;
 717         case ROLE_DOMAIN_PDC:
 718         case ROLE_DOMAIN_BDC:
 719         case ROLE_IPA_DC:
 720         case ROLE_AUTO:
 721                 return NT_STATUS_INTERNAL_ERROR;
 722         case ROLE_DOMAIN_MEMBER:
 723                 info->role = SAMR_ROLE_DOMAIN_MEMBER;
 724                 break;
 725         case ROLE_STANDALONE:
 726                 info->role = SAMR_ROLE_STANDALONE;
 727                 break;
 728         }
 729
 730         return NT_STATUS_OK;
 731 }
 732
 733 /*
 734   return DomInfo8
 735 */
 736 static NTSTATUS dcesrv_samr_info_DomInfo8(struct samr_domain_state *state,
 737                                           TALLOC_CTX *mem_ctx,
 738                                           struct ldb_message **dom_msgs,
 739                                           struct samr_DomInfo8 *info)
 740 {
 741         info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount",
 742                                                time(NULL));
 743
 744         info->domain_create_time = ldb_msg_find_attr_as_uint(dom_msgs[0], "creationTime",
 745                                                      0x0LL);
 746
 747         return NT_STATUS_OK;
 748 }
 749
 750 /*
 751   return DomInfo9
 752 */
 753 static NTSTATUS dcesrv_samr_info_DomInfo9(struct samr_domain_state *state,
 754                                           TALLOC_CTX *mem_ctx,
 755                                           struct ldb_message **dom_msgs,
 756                                           struct samr_DomInfo9 *info)
 757 {
 758         info->domain_server_state = DOMAIN_SERVER_ENABLED;
 759
 760         return NT_STATUS_OK;
 761 }
 762
 763 /*
 764   return DomInfo11
 765 */
 766 static NTSTATUS dcesrv_samr_info_DomGeneralInformation2(struct samr_domain_state *state,
 767                                                         TALLOC_CTX *mem_ctx,
 768                                                         struct ldb_message **dom_msgs,
 769                                                         struct samr_DomGeneralInformation2 *info)
 770 {
 771         NTSTATUS status;
 772         status = dcesrv_samr_info_DomGeneralInformation(state, mem_ctx, dom_msgs, &info->general);
 773         if (!NT_STATUS_IS_OK(status)) {
 774                 return status;
 775         }
 776
 777         info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration",
 778                                                     -18000000000LL);
 779         info->lockout_window = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockOutObservationWindow",
 780                                                     -18000000000LL);
 781         info->lockout_threshold = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutThreshold", 0);
 782
 783         return NT_STATUS_OK;
 784 }
 785
 786 /*
 787   return DomInfo12
 788 */
 789 static NTSTATUS dcesrv_samr_info_DomInfo12(struct samr_domain_state *state,
 790                                            TALLOC_CTX *mem_ctx,
 791                                            struct ldb_message **dom_msgs,
 792                                            struct samr_DomInfo12 *info)
 793 {
 794         info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration",
 795                                                     -18000000000LL);
 796         info->lockout_window = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockOutObservationWindow",
 797                                                     -18000000000LL);
 798         info->lockout_threshold = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutThreshold", 0);
 799
 800         return NT_STATUS_OK;
 801 }
 802
 803 /*
 804   return DomInfo13
 805 */
 806 static NTSTATUS dcesrv_samr_info_DomInfo13(struct samr_domain_state *state,
 807                                            TALLOC_CTX *mem_ctx,
 808                                            struct ldb_message **dom_msgs,
 809                                            struct samr_DomInfo13 *info)
 810 {
 811         info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount",
 812                                                time(NULL));
 813
 814         info->domain_create_time = ldb_msg_find_attr_as_uint(dom_msgs[0], "creationTime",
 815                                                      0x0LL);
 816
 817         info->modified_count_at_last_promotion = 0;
 818
 819         return NT_STATUS_OK;
 820 }
 821
 822 /*
 823   samr_QueryDomainInfo
 824 */
 825 static NTSTATUS dcesrv_samr_QueryDomainInfo(struct dcesrv_call_state *dce_call,
 826                                             TALLOC_CTX *mem_ctx,
 827                                             struct samr_QueryDomainInfo *r)
 828 {
 829         struct dcesrv_handle *h;
 830         struct samr_domain_state *d_state;
 831         union samr_DomainInfo *info;
 832
 833         struct ldb_message **dom_msgs;
 834         const char * const *attrs = NULL;
 835
 836         *r->out.info = NULL;
 837
 838         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
 839
 840         d_state = h->data;
 841
 842         switch (r->in.level) {
 843         case 1:
 844         {
 845                 static const char * const attrs2[] = { "minPwdLength",
 846                                                        "pwdHistoryLength",
 847                                                        "pwdProperties",
 848                                                        "maxPwdAge",
 849                                                        "minPwdAge",
 850                                                        NULL };
 851                 attrs = attrs2;
 852                 break;
 853         }
 854         case 2:
 855         {
 856                 static const char * const attrs2[] = {"forceLogoff",
 857                                                       "oEMInformation",
 858                                                       "modifiedCount",
 859                                                       "domainReplica",
 860                                                       NULL};
 861                 attrs = attrs2;
 862                 break;
 863         }
 864         case 3:
 865         {
 866                 static const char * const attrs2[] = {"forceLogoff",
 867                                                       NULL};
 868                 attrs = attrs2;
 869                 break;
 870         }
 871         case 4:
 872         {
 873                 static const char * const attrs2[] = {"oEMInformation",
 874                                                       NULL};
 875                 attrs = attrs2;
 876                 break;
 877         }
 878         case 5:
 879         {
 880                 attrs = NULL;
 881                 break;
 882         }
 883         case 6:
 884         {
 885                 static const char * const attrs2[] = { "domainReplica",
 886                                                        NULL };
 887                 attrs = attrs2;
 888                 break;
 889         }
 890         case 7:
 891         {
 892                 attrs = NULL;
 893                 break;
 894         }
 895         case 8:
 896         {
 897                 static const char * const attrs2[] = { "modifiedCount",
 898                                                        "creationTime",
 899                                                        NULL };
 900                 attrs = attrs2;
 901                 break;
 902         }
 903         case 9:
 904         {
 905                 attrs = NULL;
 906                 break;
 907         }
 908         case 11:
 909         {
 910                 static const char * const attrs2[] = { "oEMInformation",
 911                                                        "forceLogoff",
 912                                                        "modifiedCount",
 913                                                        "lockoutDuration",
 914                                                        "lockOutObservationWindow",
 915                                                        "lockoutThreshold",
 916                                                        NULL};
 917                 attrs = attrs2;
 918                 break;
 919         }
 920         case 12:
 921         {
 922                 static const char * const attrs2[] = { "lockoutDuration",
 923                                                        "lockOutObservationWindow",
 924                                                        "lockoutThreshold",
 925                                                        NULL};
 926                 attrs = attrs2;
 927                 break;
 928         }
 929         case 13:
 930         {
 931                 static const char * const attrs2[] = { "modifiedCount",
 932                                                        "creationTime",
 933                                                        NULL };
 934                 attrs = attrs2;
 935                 break;
 936         }
 937         default:
 938         {
 939                 return NT_STATUS_INVALID_INFO_CLASS;
 940         }
 941         }
 942
 943         /* some levels don't need a search */
 944         if (attrs) {
 945                 int ret;
 946                 ret = gendb_search_dn(d_state->sam_ctx, mem_ctx,
 947                                       d_state->domain_dn, &dom_msgs, attrs);
 948                 if (ret == 0) {
 949                         return NT_STATUS_NO_SUCH_DOMAIN;
 950                 }
 951                 if (ret != 1) {
 952                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 953                 }
 954         }
 955
 956         /* allocate the info structure */
 957         info = talloc_zero(mem_ctx, union samr_DomainInfo);
 958         if (info == NULL) {
 959                 return NT_STATUS_NO_MEMORY;
 960         }
 961
 962         *r->out.info = info;
 963
 964         switch (r->in.level) {
 965         case 1:
 966                 return dcesrv_samr_info_DomInfo1(d_state, mem_ctx, dom_msgs,
 967                                                  &info->info1);
 968         case 2:
 969                 return dcesrv_samr_info_DomGeneralInformation(d_state, mem_ctx, dom_msgs,
 970                                                               &info->general);
 971         case 3:
 972                 return dcesrv_samr_info_DomInfo3(d_state, mem_ctx, dom_msgs,
 973                                                  &info->info3);
 974         case 4:
 975                 return dcesrv_samr_info_DomOEMInformation(d_state, mem_ctx, dom_msgs,
 976                                                           &info->oem);
 977         case 5:
 978                 return dcesrv_samr_info_DomInfo5(d_state, mem_ctx, dom_msgs,
 979                                                  &info->info5);
 980         case 6:
 981                 return dcesrv_samr_info_DomInfo6(d_state, mem_ctx, dom_msgs,
 982                                                  &info->info6);
 983         case 7:
 984                 return dcesrv_samr_info_DomInfo7(d_state, mem_ctx, dom_msgs,
 985                                                  &info->info7);
 986         case 8:
 987                 return dcesrv_samr_info_DomInfo8(d_state, mem_ctx, dom_msgs,
 988                                                  &info->info8);
 989         case 9:
 990                 return dcesrv_samr_info_DomInfo9(d_state, mem_ctx, dom_msgs,
 991                                                  &info->info9);
 992         case 11:
 993                 return dcesrv_samr_info_DomGeneralInformation2(d_state, mem_ctx, dom_msgs,
 994                                                                &info->general2);
 995         case 12:
 996                 return dcesrv_samr_info_DomInfo12(d_state, mem_ctx, dom_msgs,
 997                                                   &info->info12);
 998         case 13:
 999                 return dcesrv_samr_info_DomInfo13(d_state, mem_ctx, dom_msgs,
1000                                                   &info->info13);
1001         default:
1002                 return NT_STATUS_INVALID_INFO_CLASS;
1003         }
1004 }
1005
1006
1007 /*
1008   samr_SetDomainInfo
1009 */
1010 static NTSTATUS dcesrv_samr_SetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1011                        struct samr_SetDomainInfo *r)
1012 {
1013         struct dcesrv_handle *h;
1014         struct samr_domain_state *d_state;
1015         struct ldb_message *msg;
1016         int ret;
1017         struct ldb_context *sam_ctx;
1018
1019         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
1020
1021         d_state = h->data;
1022         sam_ctx = d_state->sam_ctx;
1023
1024         msg = ldb_msg_new(mem_ctx);
1025         if (msg == NULL) {
1026                 return NT_STATUS_NO_MEMORY;
1027         }
1028
1029         msg->dn = talloc_reference(mem_ctx, d_state->domain_dn);
1030         if (!msg->dn) {
1031                 return NT_STATUS_NO_MEMORY;
1032         }
1033
1034         switch (r->in.level) {
1035         case 1:
1036                 SET_UINT  (msg, info1.min_password_length,     "minPwdLength");
1037                 SET_UINT  (msg, info1.password_history_length, "pwdHistoryLength");
1038                 SET_UINT  (msg, info1.password_properties,     "pwdProperties");
1039                 SET_INT64  (msg, info1.max_password_age,       "maxPwdAge");
1040                 SET_INT64  (msg, info1.min_password_age,       "minPwdAge");
1041                 break;
1042         case 3:
1043                 SET_UINT64  (msg, info3.force_logoff_time,     "forceLogoff");
1044                 break;
1045         case 4:
1046                 SET_STRING(msg, oem.oem_information,           "oEMInformation");
1047                 break;
1048
1049         case 6:
1050         case 7:
1051         case 9:
1052                 /* No op, we don't know where to set these */
1053                 return NT_STATUS_OK;
1054
1055         case 12:
1056                 /*
1057                  * It is not possible to set lockout_duration < lockout_window.
1058                  * (The test is the other way around since the negative numbers
1059                  *  are stored...)
1060                  *
1061                  * TODO:
1062                  *   This check should be moved to the backend, i.e. to some
1063                  *   ldb module under dsdb/samdb/ldb_modules/ .
1064                  *
1065                  * This constraint is documented here for the samr rpc service:
1066                  * MS-SAMR 3.1.1.6 Attribute Constraints for Originating Updates
1067                  * http://msdn.microsoft.com/en-us/library/cc245667%28PROT.10%29.aspx
1068                  *
1069                  * And here for the ldap backend:
1070                  * MS-ADTS 3.1.1.5.3.2 Constraints
1071                  * http://msdn.microsoft.com/en-us/library/cc223462(PROT.10).aspx
1072                  */
1073                 if (r->in.info->info12.lockout_duration >
1074                     r->in.info->info12.lockout_window)
1075                 {
1076                         return NT_STATUS_INVALID_PARAMETER;
1077                 }
1078                 SET_INT64  (msg, info12.lockout_duration,      "lockoutDuration");
1079                 SET_INT64  (msg, info12.lockout_window,        "lockOutObservationWindow");
1080                 SET_INT64  (msg, info12.lockout_threshold,     "lockoutThreshold");
1081                 break;
1082
1083         default:
1084                 /* many info classes are not valid for SetDomainInfo */
1085                 return NT_STATUS_INVALID_INFO_CLASS;
1086         }
1087
1088         /* modify the samdb record */
1089         ret = ldb_modify(sam_ctx, msg);
1090         if (ret != LDB_SUCCESS) {
1091                 DEBUG(1,("Failed to modify record %s: %s\n",
1092                          ldb_dn_get_linearized(d_state->domain_dn),
1093                          ldb_errstring(sam_ctx)));
1094                 return dsdb_ldb_err_to_ntstatus(ret);
1095         }
1096
1097         return NT_STATUS_OK;
1098 }
1099
1100 /*
1101   samr_CreateDomainGroup
1102 */
1103 static NTSTATUS dcesrv_samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1104                                        struct samr_CreateDomainGroup *r)
1105 {
1106         NTSTATUS status;
1107         struct samr_domain_state *d_state;
1108         struct samr_account_state *a_state;
1109         struct dcesrv_handle *h;
1110         const char *groupname;
1111         struct dom_sid *group_sid;
1112         struct ldb_dn *group_dn;
1113         struct dcesrv_handle *g_handle;
1114
1115         ZERO_STRUCTP(r->out.group_handle);
1116         *r->out.rid = 0;
1117
1118         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
1119
1120         d_state = h->data;
1121
1122         if (d_state->builtin) {
1123                 DEBUG(5, ("Cannot create a domain group in the BUILTIN domain\n"));
1124                 return NT_STATUS_ACCESS_DENIED;
1125         }
1126
1127         groupname = r->in.name->string;
1128
1129         if (groupname == NULL) {
1130                 return NT_STATUS_INVALID_PARAMETER;
1131         }
1132
1133         status = dsdb_add_domain_group(d_state->sam_ctx, mem_ctx, groupname, &group_sid, &group_dn);
1134         if (!NT_STATUS_IS_OK(status)) {
1135                 return status;
1136         }
1137
1138         a_state = talloc(mem_ctx, struct samr_account_state);
1139         if (!a_state) {
1140                 return NT_STATUS_NO_MEMORY;
1141         }
1142         a_state->sam_ctx = d_state->sam_ctx;
1143         a_state->access_mask = r->in.access_mask;
1144         a_state->domain_state = talloc_reference(a_state, d_state);
1145         a_state->account_dn = talloc_steal(a_state, group_dn);
1146
1147         a_state->account_name = talloc_steal(a_state, groupname);
1148
1149         /* create the policy handle */
1150         g_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_GROUP);
1151         if (!g_handle) {
1152                 return NT_STATUS_NO_MEMORY;
1153         }
1154
1155         g_handle->data = talloc_steal(g_handle, a_state);
1156
1157         *r->out.group_handle = g_handle->wire_handle;
1158         *r->out.rid = group_sid->sub_auths[group_sid->num_auths-1];
1159
1160         return NT_STATUS_OK;
1161 }
1162
1163
1164 /*
1165   comparison function for sorting SamEntry array
1166 */
1167 static int compare_SamEntry(struct samr_SamEntry *e1, struct samr_SamEntry *e2)
1168 {
1169         return e1->idx - e2->idx;
1170 }
1171
1172 static int compare_msgRid(struct ldb_message **m1, struct ldb_message **m2) {
1173         struct dom_sid *sid1 = NULL;
1174         struct dom_sid *sid2 = NULL;
1175         uint32_t rid1;
1176         uint32_t rid2;
1177         int res = 0;
1178         NTSTATUS status;
1179         TALLOC_CTX *frame = talloc_stackframe();
1180
1181         sid1 = samdb_result_dom_sid(frame, *m1, "objectSid");
1182         sid2 = samdb_result_dom_sid(frame, *m2, "objectSid");
1183
1184         /*
1185          * If entries don't have a SID we want to sort them to the end of
1186          * the list.
1187          */
1188         if (sid1 == NULL && sid2 == NULL) {
1189                 res = 0;
1190                 goto exit;
1191         } else if (sid2 == NULL) {
1192                 res = 1;
1193                 goto exit;
1194         } else if (sid1 == NULL) {
1195                 res = -1;
1196                 goto exit;
1197         }
1198
1199         /*
1200          * Get and compare the rids, if we fail to extract a rid treat it as a
1201          * missing SID and sort to the end of the list
1202          */
1203         status = dom_sid_split_rid(NULL, sid1, NULL, &rid1);
1204         if (!NT_STATUS_IS_OK(status)) {
1205                 res = 1;
1206                 goto exit;
1207         }
1208
1209         status = dom_sid_split_rid(NULL, sid2, NULL, &rid2);
1210         if (!NT_STATUS_IS_OK(status)) {
1211                 res = -1;
1212                 goto exit;
1213         }
1214
1215         if (rid1 == rid2) {
1216                 res = 0;
1217         }
1218         else if (rid1 > rid2) {
1219                 res = 1;
1220         }
1221         else {
1222                 res = -1;
1223         }
1224 exit:
1225         TALLOC_FREE(frame);
1226         return res;
1227 }
1228
1229 /*
1230   samr_EnumDomainGroups
1231 */
1232 static NTSTATUS dcesrv_samr_EnumDomainGroups(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1233                                       struct samr_EnumDomainGroups *r)
1234 {
1235         struct dcesrv_handle *h;
1236         struct samr_domain_state *d_state;
1237         struct ldb_message **res;
1238         uint32_t i;
1239         uint32_t count;
1240         uint32_t results;
1241         uint32_t max_entries;
1242         uint32_t remaining_entries;
1243         uint32_t resume_handle;
1244         struct samr_SamEntry *entries;
1245         const char * const attrs[] = { "objectSid", "sAMAccountName", NULL };
1246         const char * const cache_attrs[] = { "objectSid", "objectGUID", NULL };
1247         struct samr_SamArray *sam;
1248         struct samr_guid_cache *cache = NULL;
1249
1250         *r->out.resume_handle = 0;
1251         *r->out.sam = NULL;
1252         *r->out.num_entries = 0;
1253
1254         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
1255
1256         d_state = h->data;
1257         cache = &d_state->guid_caches[SAMR_ENUM_DOMAIN_GROUPS_CACHE];
1258
1259         /*
1260          * If the resume_handle is zero, query the database and cache the
1261          * matching GUID's
1262          */
1263         if (*r->in.resume_handle == 0) {
1264                 NTSTATUS status;
1265                 int ldb_cnt;
1266                 clear_guid_cache(cache);
1267                 /*
1268                  * search for all domain groups in this domain.
1269                  */
1270                 ldb_cnt = samdb_search_domain(
1271                     d_state->sam_ctx,
1272                     mem_ctx,
1273                     d_state->domain_dn,
1274                     &res,
1275                     cache_attrs,
1276                     d_state->domain_sid,
1277                     "(&(|(groupType=%d)(groupType=%d))(objectClass=group))",
1278                     GTYPE_SECURITY_UNIVERSAL_GROUP,
1279                     GTYPE_SECURITY_GLOBAL_GROUP);
1280                 if (ldb_cnt < 0) {
1281                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1282                 }
1283                 /*
1284                  * Sort the results into RID order, while the spec states there
1285                  * is no order, Windows appears to sort the results by RID and
1286                  * so it is possible that there are clients that depend on
1287                  * this ordering
1288                  */
1289                 TYPESAFE_QSORT(res, ldb_cnt, compare_msgRid);
1290
1291                 /*
1292                  * cache the sorted GUID's
1293                  */
1294                 status = load_guid_cache(cache, d_state, ldb_cnt, res);
1295                 TALLOC_FREE(res);
1296                 if (!NT_STATUS_IS_OK(status)) {
1297                         return status;
1298                 }
1299                 cache->handle = 0;
1300         }
1301
1302
1303         /*
1304          * If the resume handle is out of range we return an empty response
1305          * and invalidate the cache.
1306          *
1307          * From the specification:
1308          * Servers SHOULD validate that EnumerationContext is an expected
1309          * value for the server's implementation. Windows does NOT validate
1310          * the input, though the result of malformed information merely results
1311          * in inconsistent output to the client.
1312          */
1313         if (*r->in.resume_handle >= cache->size) {
1314                 clear_guid_cache(cache);
1315                 sam = talloc(mem_ctx, struct samr_SamArray);
1316                 if (!sam) {
1317                         return NT_STATUS_NO_MEMORY;
1318                 }
1319                 sam->entries = NULL;
1320                 sam->count = 0;
1321
1322                 *r->out.sam = sam;
1323                 *r->out.resume_handle = 0;
1324                 return NT_STATUS_OK;
1325         }
1326
1327
1328         /*
1329          * Calculate the number of entries to return limit by max_size.
1330          * Note that we use the w2k3 element size value of 54
1331          */
1332         max_entries = 1 + (r->in.max_size/SAMR_ENUM_USERS_MULTIPLIER);
1333         remaining_entries = cache->size - *r->in.resume_handle;
1334         results = MIN(remaining_entries, max_entries);
1335
1336         /*
1337          * Process the list of result GUID's.
1338          * Read the details of each object and populate the Entries
1339          * for the current level.
1340          */
1341         count = 0;
1342         resume_handle = *r->in.resume_handle;
1343         entries = talloc_array(mem_ctx, struct samr_SamEntry, results);
1344         if (entries == NULL) {
1345                 clear_guid_cache(cache);
1346                 return NT_STATUS_NO_MEMORY;
1347         }
1348         for (i = 0; i < results; i++) {
1349                 struct dom_sid *objectsid;
1350                 uint32_t rid;
1351                 struct ldb_result *rec;
1352                 const uint32_t idx = *r->in.resume_handle + i;
1353                 int ret;
1354                 NTSTATUS status;
1355                 const char *name = NULL;
1356                 resume_handle++;
1357                 /*
1358                  * Read an object from disk using the GUID as the key
1359                  *
1360                  * If the object can not be read, or it does not have a SID
1361                  * it is ignored.
1362                  *
1363                  * As a consequence of this, if all the remaining GUID's
1364                  * have been deleted an empty result will be returned.
1365                  * i.e. even if the previous call returned a non zero
1366                  * resume_handle it is possible for no results to be returned.
1367                  *
1368                  */
1369                 ret = dsdb_search_by_dn_guid(d_state->sam_ctx,
1370                                              mem_ctx,
1371                                              &rec,
1372                                              &cache->entries[idx],
1373                                              attrs,
1374                                              0);
1375                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1376                         struct GUID_txt_buf guid_buf;
1377                         DBG_WARNING(
1378                             "GUID [%s] not found\n",
1379                             GUID_buf_string(&cache->entries[idx], &guid_buf));
1380                         continue;
1381                 } else if (ret != LDB_SUCCESS) {
1382                         clear_guid_cache(cache);
1383                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1384                 }
1385
1386                 objectsid = samdb_result_dom_sid(mem_ctx,
1387                                                  rec->msgs[0],
1388                                                  "objectSID");
1389                 if (objectsid == NULL) {
1390                         struct GUID_txt_buf guid_buf;
1391                         DBG_WARNING(
1392                             "objectSID for GUID [%s] not found\n",
1393                             GUID_buf_string(&cache->entries[idx], &guid_buf));
1394                         continue;
1395                 }
1396                 status = dom_sid_split_rid(NULL,
1397                                            objectsid,
1398                                            NULL,
1399                                            &rid);
1400                 if (!NT_STATUS_IS_OK(status)) {
1401                         struct dom_sid_buf sid_buf;
1402                         struct GUID_txt_buf guid_buf;
1403                         DBG_WARNING(
1404                             "objectSID [%s] for GUID [%s] invalid\n",
1405                             dom_sid_str_buf(objectsid, &sid_buf),
1406                             GUID_buf_string(&cache->entries[idx], &guid_buf));
1407                         continue;
1408                 }
1409
1410                 entries[count].idx = rid;
1411                 name = ldb_msg_find_attr_as_string(
1412                     rec->msgs[0], "sAMAccountName", "");
1413                 entries[count].name.string = talloc_strdup(entries, name);
1414                 count++;
1415         }
1416
1417         sam = talloc(mem_ctx, struct samr_SamArray);
1418         if (!sam) {
1419                 clear_guid_cache(cache);
1420                 return NT_STATUS_NO_MEMORY;
1421         }
1422
1423         sam->entries = entries;
1424         sam->count = count;
1425
1426         *r->out.sam = sam;
1427         *r->out.resume_handle = resume_handle;
1428         *r->out.num_entries = count;
1429
1430         /*
1431          * Signal no more results by returning zero resume handle,
1432          * the cache is also cleared at this point
1433          */
1434         if (*r->out.resume_handle >= cache->size) {
1435                 *r->out.resume_handle = 0;
1436                 clear_guid_cache(cache);
1437                 return NT_STATUS_OK;
1438         }
1439         /*
1440          * There are more results to be returned.
1441          */
1442         return STATUS_MORE_ENTRIES;
1443 }
1444
1445
1446 /*
1447   samr_CreateUser2
1448
1449   This call uses transactions to ensure we don't get a new conflicting
1450   user while we are processing this, and to ensure the user either
1451   completely exists, or does not.
1452 */
1453 static NTSTATUS dcesrv_samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1454                                  struct samr_CreateUser2 *r)
1455 {
1456         NTSTATUS status;
1457         struct samr_domain_state *d_state;
1458         struct samr_account_state *a_state;
1459         struct dcesrv_handle *h;
1460         struct ldb_dn *dn;
1461         struct dom_sid *sid;
1462         struct dcesrv_handle *u_handle;
1463         const char *account_name;
1464
1465         ZERO_STRUCTP(r->out.user_handle);
1466         *r->out.access_granted = 0;
1467         *r->out.rid = 0;
1468
1469         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
1470
1471         d_state = h->data;
1472
1473         if (d_state->builtin) {
1474                 DEBUG(5, ("Cannot create a user in the BUILTIN domain\n"));
1475                 return NT_STATUS_ACCESS_DENIED;
1476         } else if (r->in.acct_flags == ACB_DOMTRUST) {
1477                 /* Domain trust accounts must be created by the LSA calls */
1478                 return NT_STATUS_ACCESS_DENIED;
1479         }
1480         account_name = r->in.account_name->string;
1481
1482         if (account_name == NULL) {
1483                 return NT_STATUS_INVALID_PARAMETER;
1484         }
1485
1486         status = dsdb_add_user(d_state->sam_ctx, mem_ctx, account_name, r->in.acct_flags, NULL,
1487                                &sid, &dn);
1488         if (!NT_STATUS_IS_OK(status)) {
1489                 return status;
1490         }
1491         a_state = talloc(mem_ctx, struct samr_account_state);
1492         if (!a_state) {
1493                 return NT_STATUS_NO_MEMORY;
1494         }
1495         a_state->sam_ctx = d_state->sam_ctx;
1496         a_state->access_mask = r->in.access_mask;
1497         a_state->domain_state = talloc_reference(a_state, d_state);
1498         a_state->account_dn = talloc_steal(a_state, dn);
1499
1500         a_state->account_name = talloc_steal(a_state, account_name);
1501         if (!a_state->account_name) {
1502                 return NT_STATUS_NO_MEMORY;
1503         }
1504
1505         /* create the policy handle */
1506         u_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_USER);
1507         if (!u_handle) {
1508                 return NT_STATUS_NO_MEMORY;
1509         }
1510
1511         u_handle->data = talloc_steal(u_handle, a_state);
1512
1513         *r->out.user_handle = u_handle->wire_handle;
1514         *r->out.access_granted = 0xf07ff; /* TODO: fix access mask calculations */
1515
1516         *r->out.rid = sid->sub_auths[sid->num_auths-1];
1517
1518         return NT_STATUS_OK;
1519 }
1520
1521
1522 /*
1523   samr_CreateUser
1524 */
1525 static NTSTATUS dcesrv_samr_CreateUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1526                                 struct samr_CreateUser *r)
1527 {
1528         struct samr_CreateUser2 r2;
1529         uint32_t access_granted = 0;
1530
1531
1532         /* a simple wrapper around samr_CreateUser2 works nicely */
1533
1534         r2 = (struct samr_CreateUser2) {
1535                 .in.domain_handle = r->in.domain_handle,
1536                 .in.account_name = r->in.account_name,
1537                 .in.acct_flags = ACB_NORMAL,
1538                 .in.access_mask = r->in.access_mask,
1539                 .out.user_handle = r->out.user_handle,
1540                 .out.access_granted = &access_granted,
1541                 .out.rid = r->out.rid
1542         };
1543
1544         return dcesrv_samr_CreateUser2(dce_call, mem_ctx, &r2);
1545 }
1546
1547 struct enum_dom_users_ctx {
1548         struct samr_SamEntry *entries;
1549         uint32_t num_entries;
1550         uint32_t acct_flags;
1551         struct dom_sid *domain_sid;
1552 };
1553
1554 static int user_iterate_callback(struct ldb_request *req,
1555                                  struct ldb_reply *ares);
1556
1557 /*
1558  * Iterate users and add all those that match a domain SID and pass an acct
1559  * flags check to an array of SamEntry objects.
1560  */
1561 static int user_iterate_callback(struct ldb_request *req,
1562                                  struct ldb_reply *ares)
1563 {
1564         struct enum_dom_users_ctx *ac =\
1565                 talloc_get_type(req->context, struct enum_dom_users_ctx);
1566         int ret = LDB_ERR_OPERATIONS_ERROR;
1567
1568         if (!ares) {
1569                 return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
1570         }
1571         if (ares->error != LDB_SUCCESS) {
1572                 return ldb_request_done(req, ares->error);
1573         }
1574
1575         switch (ares->type) {
1576         case LDB_REPLY_ENTRY:
1577         {
1578                 struct ldb_message *msg = ares->message;
1579                 const struct ldb_val *val;
1580                 struct samr_SamEntry *ent;
1581                 struct dom_sid objectsid;
1582                 uint32_t rid;
1583                 size_t entries_array_len = 0;
1584                 NTSTATUS status;
1585                 ssize_t sid_size;
1586
1587                 if (ac->acct_flags && ((samdb_result_acct_flags(msg, NULL) &
1588                                         ac->acct_flags) == 0)) {
1589                         ret = LDB_SUCCESS;
1590                         break;
1591                 }
1592
1593                 val = ldb_msg_find_ldb_val(msg, "objectSID");
1594                 if (val == NULL) {
1595                         DBG_WARNING("objectSID for DN %s not found\n",
1596                                     ldb_dn_get_linearized(msg->dn));
1597                         ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
1598                         break;
1599                 }
1600
1601                 sid_size = sid_parse(val->data, val->length, &objectsid);
1602                 if (sid_size == -1) {
1603                         struct dom_sid_buf sid_buf;
1604                         DBG_WARNING("objectsid [%s] for DN [%s] invalid\n",
1605                                     dom_sid_str_buf(&objectsid, &sid_buf),
1606                                     ldb_dn_get_linearized(msg->dn));
1607                         ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
1608                         break;
1609                 }
1610
1611                 if (!dom_sid_in_domain(ac->domain_sid, &objectsid)) {
1612                         /* Ignore if user isn't in the domain */
1613                         ret = LDB_SUCCESS;
1614                         break;
1615                 }
1616
1617                 status = dom_sid_split_rid(ares, &objectsid, NULL, &rid);
1618                 if (!NT_STATUS_IS_OK(status)) {
1619                         struct dom_sid_buf sid_buf;
1620                         DBG_WARNING("Couldn't split RID from "
1621                                     "SID [%s] of DN [%s]\n",
1622                                     dom_sid_str_buf(&objectsid, &sid_buf),
1623                                     ldb_dn_get_linearized(msg->dn));
1624                         ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
1625                         break;
1626                 }
1627
1628                 entries_array_len = talloc_array_length(ac->entries);
1629                 if (ac->num_entries >= entries_array_len) {
1630                         if (entries_array_len * 2 < entries_array_len) {
1631                                 ret = ldb_request_done(req,
1632                                         LDB_ERR_OPERATIONS_ERROR);
1633                                 break;
1634                         }
1635                         ac->entries = talloc_realloc(ac,
1636                                                      ac->entries,
1637                                                      struct samr_SamEntry,
1638                                                      entries_array_len * 2);
1639                         if (ac->entries == NULL) {
1640                                 ret = ldb_request_done(req,
1641                                         LDB_ERR_OPERATIONS_ERROR);
1642                                 break;
1643                         }
1644                 }
1645
1646                 ent = &(ac->entries[ac->num_entries++]);
1647                 val = ldb_msg_find_ldb_val(msg, "samaccountname");
1648                 if (val == NULL) {
1649                         DBG_WARNING("samaccountname attribute not found\n");
1650                         ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
1651                         break;
1652                 }
1653                 ent->name.string = talloc_steal(ac->entries,
1654                                                 (char *)val->data);
1655                 ent->idx = rid;
1656                 ret = LDB_SUCCESS;
1657                 break;
1658         }
1659         case LDB_REPLY_DONE:
1660         {
1661                 if (ac->num_entries != 0 &&
1662                     ac->num_entries != talloc_array_length(ac->entries)) {
1663                         ac->entries = talloc_realloc(ac,
1664                                                      ac->entries,
1665                                                      struct samr_SamEntry,
1666                                                      ac->num_entries);
1667                         if (ac->entries == NULL) {
1668                                 ret = ldb_request_done(req,
1669                                         LDB_ERR_OPERATIONS_ERROR);
1670                                 break;
1671                         }
1672                 }
1673                 ret = ldb_request_done(req, LDB_SUCCESS);
1674                 break;
1675         }
1676         case LDB_REPLY_REFERRAL:
1677         {
1678                 ret = LDB_SUCCESS;
1679                 break;
1680         }
1681         default:
1682                 /* Doesn't happen */
1683                 ret = LDB_ERR_OPERATIONS_ERROR;
1684         }
1685         TALLOC_FREE(ares);
1686
1687         return ret;
1688 }
1689
1690 /*
1691  * samr_EnumDomainUsers
1692  * The previous implementation did an initial search and stored a list of
1693  * matching GUIDs on the connection handle's domain state, then did direct
1694  * GUID lookups for each record in a page indexed by resume_handle. That
1695  * approach was memory efficient, requiring only 16 bytes per record, but
1696  * was too slow for winbind which needs this RPC call for getpwent.
1697  *
1698  * Now we use an iterate pattern to populate a cached list of the rids and
1699  * names for each record. This improves runtime performance but requires
1700  * about 200 bytes per record which will mean for a 100k database we use
1701  * about 2MB, which is fine. The speedup achieved by this new approach is
1702  * around 50%.
1703  */
1704 static NTSTATUS dcesrv_samr_EnumDomainUsers(struct dcesrv_call_state *dce_call,
1705                                             TALLOC_CTX *mem_ctx,
1706                                             struct samr_EnumDomainUsers *r)
1707 {
1708         struct dcesrv_handle *h;
1709         struct samr_domain_state *d_state;
1710         uint32_t results;
1711         uint32_t max_entries;
1712         uint32_t num_entries;
1713         uint32_t remaining_entries;
1714         struct samr_SamEntry *entries;
1715         const char * const attrs[] = { "objectSid", "sAMAccountName",
1716                 "userAccountControl", NULL };
1717         struct samr_SamArray *sam;
1718         struct ldb_request *req;
1719
1720         *r->out.resume_handle = 0;
1721         *r->out.sam = NULL;
1722         *r->out.num_entries = 0;
1723
1724         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
1725
1726         d_state = h->data;
1727         entries = d_state->domain_users_cached;
1728
1729         /*
1730          * If the resume_handle is zero, query the database and cache the
1731          * matching entries.
1732          */
1733         if (*r->in.resume_handle == 0) {
1734                 int ret;
1735                 struct enum_dom_users_ctx *ac;
1736                 if (entries != NULL) {
1737                         talloc_free(entries);
1738                         d_state->domain_users_cached = NULL;
1739                 }
1740
1741                 ac = talloc(mem_ctx, struct enum_dom_users_ctx);
1742                 ac->num_entries = 0;
1743                 ac->domain_sid = d_state->domain_sid;
1744                 ac->entries = talloc_array(ac,
1745                                            struct samr_SamEntry,
1746                                            100);
1747                 if (ac->entries == NULL) {
1748                         talloc_free(ac);
1749                         return NT_STATUS_NO_MEMORY;
1750                 }
1751                 ac->acct_flags = r->in.acct_flags;
1752
1753                 ret = ldb_build_search_req(&req,
1754                                            d_state->sam_ctx,
1755                                            mem_ctx,
1756                                            d_state->domain_dn,
1757                                            LDB_SCOPE_SUBTREE,
1758                                            "(objectClass=user)",
1759                                            attrs,
1760                                            NULL,
1761                                            ac,
1762                                            user_iterate_callback,
1763                                            NULL);
1764                 if (ret != LDB_SUCCESS) {
1765                         talloc_free(ac);
1766                         return dsdb_ldb_err_to_ntstatus(ret);
1767                 }
1768
1769                 ret = ldb_request(d_state->sam_ctx, req);
1770                 if (ret != LDB_SUCCESS) {
1771                         talloc_free(ac);
1772                         return dsdb_ldb_err_to_ntstatus(ret);
1773                 }
1774
1775                 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
1776                 if (ret != LDB_SUCCESS) {
1777                         return dsdb_ldb_err_to_ntstatus(ret);
1778                 }
1779
1780                 if (ac->num_entries == 0) {
1781                         DBG_WARNING("No users in domain %s\n",
1782                                     ldb_dn_get_linearized(d_state->domain_dn));
1783                         talloc_free(ac);
1784
1785                         /*
1786                          * test_EnumDomainUsers_all() expects that r.out.sam
1787                          * should be non-NULL, even if we have no entries.
1788                          */
1789                         sam = talloc_zero(mem_ctx, struct samr_SamArray);
1790                         if (sam == NULL) {
1791                                 return NT_STATUS_NO_MEMORY;
1792                         }
1793                         *r->out.sam = sam;
1794
1795                         return NT_STATUS_OK;
1796                 }
1797
1798                 entries = talloc_steal(d_state, ac->entries);
1799                 d_state->domain_users_cached = entries;
1800                 num_entries = ac->num_entries;
1801                 talloc_free(ac);
1802
1803                 /*
1804                  * Sort the entries into RID order, while the spec states there
1805                  * is no order, Windows appears to sort the results by RID and
1806                  * so it is possible that there are clients that depend on
1807                  * this ordering
1808                  */
1809                 TYPESAFE_QSORT(entries, num_entries, compare_SamEntry);
1810         } else {
1811                 num_entries = talloc_array_length(entries);
1812         }
1813
1814         /*
1815          * If the resume handle is out of range we return an empty response
1816          * and invalidate the cache.
1817          *
1818          * From the specification:
1819          * Servers SHOULD validate that EnumerationContext is an expected
1820          * value for the server's implementation. Windows does NOT validate
1821          * the input, though the result of malformed information merely results
1822          * in inconsistent output to the client.
1823          */
1824         if (*r->in.resume_handle >= num_entries) {
1825                 talloc_free(entries);
1826                 d_state->domain_users_cached = NULL;
1827                 sam = talloc(mem_ctx, struct samr_SamArray);
1828                 if (!sam) {
1829                         return NT_STATUS_NO_MEMORY;
1830                 }
1831                 sam->entries = NULL;
1832                 sam->count = 0;
1833
1834                 *r->out.sam = sam;
1835                 *r->out.resume_handle = 0;
1836                 return NT_STATUS_OK;
1837         }
1838
1839         /*
1840          * Calculate the number of entries to return limit by max_size.
1841          * Note that we use the w2k3 element size value of 54
1842          */
1843         max_entries = 1 + (r->in.max_size / SAMR_ENUM_USERS_MULTIPLIER);
1844         remaining_entries = num_entries - *r->in.resume_handle;
1845         results = MIN(remaining_entries, max_entries);
1846
1847         sam = talloc(mem_ctx, struct samr_SamArray);
1848         if (!sam) {
1849                 d_state->domain_users_cached = NULL;
1850                 return NT_STATUS_NO_MEMORY;
1851         }
1852
1853         sam->entries = entries + *r->in.resume_handle;
1854         sam->count = results;
1855
1856         *r->out.sam = sam;
1857         *r->out.resume_handle = *r->in.resume_handle + results;
1858         *r->out.num_entries = results;
1859
1860         /*
1861          * Signal no more results by returning zero resume handle,
1862          * the cache is also cleared at this point
1863          */
1864         if (*r->out.resume_handle >= num_entries) {
1865                 *r->out.resume_handle = 0;
1866                 return NT_STATUS_OK;
1867         }
1868         /*
1869          * There are more results to be returned.
1870          */
1871         return STATUS_MORE_ENTRIES;
1872 }
1873
1874
1875 /*
1876   samr_CreateDomAlias
1877 */
1878 static NTSTATUS dcesrv_samr_CreateDomAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1879                        struct samr_CreateDomAlias *r)
1880 {
1881         struct samr_domain_state *d_state;
1882         struct samr_account_state *a_state;
1883         struct dcesrv_handle *h;
1884         const char *alias_name;
1885         struct dom_sid *sid;
1886         struct dcesrv_handle *a_handle;
1887         struct ldb_dn *dn;
1888         NTSTATUS status;
1889
1890         ZERO_STRUCTP(r->out.alias_handle);
1891         *r->out.rid = 0;
1892
1893         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
1894
1895         d_state = h->data;
1896
1897         if (d_state->builtin) {
1898                 DEBUG(5, ("Cannot create a domain alias in the BUILTIN domain\n"));
1899                 return NT_STATUS_ACCESS_DENIED;
1900         }
1901
1902         alias_name = r->in.alias_name->string;
1903
1904         if (alias_name == NULL) {
1905                 return NT_STATUS_INVALID_PARAMETER;
1906         }
1907
1908         status = dsdb_add_domain_alias(d_state->sam_ctx, mem_ctx, alias_name, &sid, &dn);
1909         if (!NT_STATUS_IS_OK(status)) {
1910                 return status;
1911         }
1912
1913         a_state = talloc(mem_ctx, struct samr_account_state);
1914         if (!a_state) {
1915                 return NT_STATUS_NO_MEMORY;
1916         }
1917
1918         a_state->sam_ctx = d_state->sam_ctx;
1919         a_state->access_mask = r->in.access_mask;
1920         a_state->domain_state = talloc_reference(a_state, d_state);
1921         a_state->account_dn = talloc_steal(a_state, dn);
1922
1923         a_state->account_name = talloc_steal(a_state, alias_name);
1924
1925         /* create the policy handle */
1926         a_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_ALIAS);
1927         if (a_handle == NULL)
1928                 return NT_STATUS_NO_MEMORY;
1929
1930         a_handle->data = talloc_steal(a_handle, a_state);
1931
1932         *r->out.alias_handle = a_handle->wire_handle;
1933
1934         *r->out.rid = sid->sub_auths[sid->num_auths-1];
1935
1936         return NT_STATUS_OK;
1937 }
1938
1939
1940 /*
1941   samr_EnumDomainAliases
1942 */
1943 static NTSTATUS dcesrv_samr_EnumDomainAliases(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1944                        struct samr_EnumDomainAliases *r)
1945 {
1946         struct dcesrv_handle *h;
1947         struct samr_domain_state *d_state;
1948         struct ldb_message **res;
1949         int i, ldb_cnt;
1950         uint32_t first, count;
1951         struct samr_SamEntry *entries;
1952         const char * const attrs[] = { "objectSid", "sAMAccountName", NULL };
1953         struct samr_SamArray *sam;
1954
1955         *r->out.resume_handle = 0;
1956         *r->out.sam = NULL;
1957         *r->out.num_entries = 0;
1958
1959         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
1960
1961         d_state = h->data;
1962
1963         /* search for all domain aliases in this domain. This could possibly be
1964            cached and resumed based on resume_key */
1965         ldb_cnt = samdb_search_domain(d_state->sam_ctx, mem_ctx, NULL,
1966                                       &res, attrs,
1967                                       d_state->domain_sid,
1968                                       "(&(|(grouptype=%d)(grouptype=%d)))"
1969                                       "(objectclass=group))",
1970                                       GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
1971                                       GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1972         if (ldb_cnt < 0) {
1973                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1974         }
1975
1976         /* convert to SamEntry format */
1977         entries = talloc_array(mem_ctx, struct samr_SamEntry, ldb_cnt);
1978         if (!entries) {
1979                 return NT_STATUS_NO_MEMORY;
1980         }
1981
1982         count = 0;
1983
1984         for (i=0;i<ldb_cnt;i++) {
1985                 struct dom_sid *alias_sid;
1986
1987                 alias_sid = samdb_result_dom_sid(mem_ctx, res[i],
1988                                                  "objectSid");
1989
1990                 if (alias_sid == NULL) {
1991                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1992                 }
1993
1994                 entries[count].idx =
1995                         alias_sid->sub_auths[alias_sid->num_auths-1];
1996                 entries[count].name.string =
1997                         ldb_msg_find_attr_as_string(res[i], "sAMAccountName", "");
1998                 count += 1;
1999         }
2000
2001         /* sort the results by rid */
2002         TYPESAFE_QSORT(entries, count, compare_SamEntry);
2003
2004         /* find the first entry to return */
2005         for (first=0;
2006              first<count && entries[first].idx <= *r->in.resume_handle;
2007              first++) ;
2008
2009         /* return the rest, limit by max_size. Note that we
2010            use the w2k3 element size value of 54 */
2011         *r->out.num_entries = count - first;
2012         *r->out.num_entries = MIN(*r->out.num_entries,
2013                                   1+(r->in.max_size/SAMR_ENUM_USERS_MULTIPLIER));
2014
2015         sam = talloc(mem_ctx, struct samr_SamArray);
2016         if (!sam) {
2017                 return NT_STATUS_NO_MEMORY;
2018         }
2019
2020         sam->entries = entries+first;
2021         sam->count = *r->out.num_entries;
2022
2023         *r->out.sam = sam;
2024
2025         if (first == count) {
2026                 return NT_STATUS_OK;
2027         }
2028
2029         if (*r->out.num_entries < count - first) {
2030                 *r->out.resume_handle =
2031                         entries[first+*r->out.num_entries-1].idx;
2032                 return STATUS_MORE_ENTRIES;
2033         }
2034
2035         return NT_STATUS_OK;
2036 }
2037
2038
2039 /*
2040   samr_GetAliasMembership
2041 */
2042 static NTSTATUS dcesrv_samr_GetAliasMembership(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2043                        struct samr_GetAliasMembership *r)
2044 {
2045         struct dcesrv_handle *h;
2046         struct samr_domain_state *d_state;
2047         char *filter;
2048         const char * const attrs[] = { "objectSid", NULL };
2049         struct ldb_message **res;
2050         uint32_t i;
2051         int count = 0;
2052
2053         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
2054
2055         d_state = h->data;
2056
2057         filter = talloc_asprintf(mem_ctx,
2058                                  "(&(|(grouptype=%d)(grouptype=%d))"
2059                                  "(objectclass=group)(|",
2060                                  GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
2061                                  GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
2062         if (filter == NULL) {
2063                 return NT_STATUS_NO_MEMORY;
2064         }
2065
2066         for (i=0; i<r->in.sids->num_sids; i++) {
2067                 struct dom_sid_buf buf;
2068
2069                 filter = talloc_asprintf_append(
2070                         filter,
2071                         "(member=<SID=%s>)",
2072                         dom_sid_str_buf(r->in.sids->sids[i].sid, &buf));
2073
2074                 if (filter == NULL) {
2075                         return NT_STATUS_NO_MEMORY;
2076                 }
2077         }
2078
2079         /* Find out if we had at least one valid member SID passed - otherwise
2080          * just skip the search. */
2081         if (strstr(filter, "member") != NULL) {
2082                 count = samdb_search_domain(d_state->sam_ctx, mem_ctx, NULL,
2083                                             &res, attrs, d_state->domain_sid,
2084                                             "%s))", filter);
2085                 if (count < 0) {
2086                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
2087                 }
2088         }
2089
2090         r->out.rids->count = 0;
2091         r->out.rids->ids = talloc_array(mem_ctx, uint32_t, count);
2092         if (r->out.rids->ids == NULL)
2093                 return NT_STATUS_NO_MEMORY;
2094
2095         for (i=0; i<count; i++) {
2096                 struct dom_sid *alias_sid;
2097
2098                 alias_sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
2099                 if (alias_sid == NULL) {
2100                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
2101                 }
2102
2103                 r->out.rids->ids[r->out.rids->count] =
2104                         alias_sid->sub_auths[alias_sid->num_auths-1];
2105                 r->out.rids->count += 1;
2106         }
2107
2108         return NT_STATUS_OK;
2109 }
2110
2111
2112 /*
2113   samr_LookupNames
2114 */
2115 static NTSTATUS dcesrv_samr_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2116                                  struct samr_LookupNames *r)
2117 {
2118         struct dcesrv_handle *h;
2119         struct samr_domain_state *d_state;
2120         uint32_t i, num_mapped;
2121         NTSTATUS status = NT_STATUS_OK;
2122         const char * const attrs[] = { "sAMAccountType", "objectSid", NULL };
2123         int count;
2124
2125         ZERO_STRUCTP(r->out.rids);
2126         ZERO_STRUCTP(r->out.types);
2127
2128         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
2129
2130         d_state = h->data;
2131
2132         if (r->in.num_names == 0) {
2133                 return NT_STATUS_OK;
2134         }
2135
2136         r->out.rids->ids = talloc_array(mem_ctx, uint32_t, r->in.num_names);
2137         r->out.types->ids = talloc_array(mem_ctx, uint32_t, r->in.num_names);
2138         if (!r->out.rids->ids || !r->out.types->ids) {
2139                 return NT_STATUS_NO_MEMORY;
2140         }
2141         r->out.rids->count = r->in.num_names;
2142         r->out.types->count = r->in.num_names;
2143
2144         num_mapped = 0;
2145
2146         for (i=0;i<r->in.num_names;i++) {
2147                 struct ldb_message **res;
2148                 struct dom_sid *sid;
2149                 uint32_t atype, rtype;
2150
2151                 r->out.rids->ids[i] = 0;
2152                 r->out.types->ids[i] = SID_NAME_UNKNOWN;
2153
2154                 count = gendb_search(d_state->sam_ctx, mem_ctx, d_state->domain_dn, &res, attrs,
2155                                      "sAMAccountName=%s",
2156                                      ldb_binary_encode_string(mem_ctx, r->in.names[i].string));
2157                 if (count != 1) {
2158                         status = STATUS_SOME_UNMAPPED;
2159                         continue;
2160                 }
2161
2162                 sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
2163                 if (sid == NULL) {
2164                         status = STATUS_SOME_UNMAPPED;
2165                         continue;
2166                 }
2167
2168                 atype = ldb_msg_find_attr_as_uint(res[0], "sAMAccountType", 0);
2169                 if (atype == 0) {
2170                         status = STATUS_SOME_UNMAPPED;
2171                         continue;
2172                 }
2173
2174                 rtype = ds_atype_map(atype);
2175
2176                 if (rtype == SID_NAME_UNKNOWN) {
2177                         status = STATUS_SOME_UNMAPPED;
2178                         continue;
2179                 }
2180
2181                 r->out.rids->ids[i] = sid->sub_auths[sid->num_auths-1];
2182                 r->out.types->ids[i] = rtype;
2183                 num_mapped++;
2184         }
2185
2186         if (num_mapped == 0) {
2187                 return NT_STATUS_NONE_MAPPED;
2188         }
2189         return status;
2190 }
2191
2192
2193 /*
2194   samr_LookupRids
2195 */
2196 static NTSTATUS dcesrv_samr_LookupRids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2197                        struct samr_LookupRids *r)
2198 {
2199         NTSTATUS status;
2200         struct dcesrv_handle *h;
2201         struct samr_domain_state *d_state;
2202         const char **names;
2203         struct lsa_String *lsa_names;
2204         enum lsa_SidType *ids;
2205
2206         ZERO_STRUCTP(r->out.names);
2207         ZERO_STRUCTP(r->out.types);
2208
2209         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
2210
2211         d_state = h->data;
2212
2213         if (r->in.num_rids == 0)
2214                 return NT_STATUS_OK;
2215
2216         lsa_names = talloc_zero_array(mem_ctx, struct lsa_String, r->in.num_rids);
2217         names = talloc_zero_array(mem_ctx, const char *, r->in.num_rids);
2218         ids = talloc_zero_array(mem_ctx, enum lsa_SidType, r->in.num_rids);
2219
2220         if ((lsa_names == NULL) || (names == NULL) || (ids == NULL))
2221                 return NT_STATUS_NO_MEMORY;
2222
2223         r->out.names->names = lsa_names;
2224         r->out.names->count = r->in.num_rids;
2225
2226         r->out.types->ids = (uint32_t *) ids;
2227         r->out.types->count = r->in.num_rids;
2228
2229         status = dsdb_lookup_rids(d_state->sam_ctx, mem_ctx, d_state->domain_sid,
2230                                   r->in.num_rids, r->in.rids, names, ids);
2231         if (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) || NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
2232                 uint32_t i;
2233                 for (i = 0; i < r->in.num_rids; i++) {
2234                         lsa_names[i].string = names[i];
2235                 }
2236         }
2237         return status;
2238 }
2239
2240
2241 /*
2242   samr_OpenGroup
2243 */
2244 static NTSTATUS dcesrv_samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2245                        struct samr_OpenGroup *r)
2246 {
2247         struct samr_domain_state *d_state;
2248         struct samr_account_state *a_state;
2249         struct dcesrv_handle *h;
2250         const char *groupname;
2251         struct dom_sid *sid;
2252         struct ldb_message **msgs;
2253         struct dcesrv_handle *g_handle;
2254         const char * const attrs[2] = { "sAMAccountName", NULL };
2255         int ret;
2256
2257         ZERO_STRUCTP(r->out.group_handle);
2258
2259         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
2260
2261         d_state = h->data;
2262
2263         /* form the group SID */
2264         sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
2265         if (!sid) {
2266                 return NT_STATUS_NO_MEMORY;
2267         }
2268
2269         /* search for the group record */
2270         if (d_state->builtin) {
2271                 ret = gendb_search(d_state->sam_ctx,
2272                                    mem_ctx, d_state->domain_dn, &msgs, attrs,
2273                                    "(&(objectSid=%s)(objectClass=group)"
2274                                    "(groupType=%d))",
2275                                    ldap_encode_ndr_dom_sid(mem_ctx, sid),
2276                                    GTYPE_SECURITY_BUILTIN_LOCAL_GROUP);
2277         } else {
2278                 ret = gendb_search(d_state->sam_ctx,
2279                                    mem_ctx, d_state->domain_dn, &msgs, attrs,
2280                                    "(&(objectSid=%s)(objectClass=group)"
2281                                    "(|(groupType=%d)(groupType=%d)))",
2282                                    ldap_encode_ndr_dom_sid(mem_ctx, sid),
2283                                    GTYPE_SECURITY_UNIVERSAL_GROUP,
2284                                    GTYPE_SECURITY_GLOBAL_GROUP);
2285         }
2286         if (ret == 0) {
2287                 return NT_STATUS_NO_SUCH_GROUP;
2288         }
2289         if (ret != 1) {
2290                 DEBUG(0,("Found %d records matching sid %s\n",
2291                          ret, dom_sid_string(mem_ctx, sid)));
2292                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2293         }
2294
2295         groupname = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL);
2296         if (groupname == NULL) {
2297                 DEBUG(0,("sAMAccountName field missing for sid %s\n",
2298                          dom_sid_string(mem_ctx, sid)));
2299                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2300         }
2301
2302         a_state = talloc(mem_ctx, struct samr_account_state);
2303         if (!a_state) {
2304                 return NT_STATUS_NO_MEMORY;
2305         }
2306         a_state->sam_ctx = d_state->sam_ctx;
2307         a_state->access_mask = r->in.access_mask;
2308         a_state->domain_state = talloc_reference(a_state, d_state);
2309         a_state->account_dn = talloc_steal(a_state, msgs[0]->dn);
2310         a_state->account_sid = talloc_steal(a_state, sid);
2311         a_state->account_name = talloc_strdup(a_state, groupname);
2312         if (!a_state->account_name) {
2313                 return NT_STATUS_NO_MEMORY;
2314         }
2315
2316         /* create the policy handle */
2317         g_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_GROUP);
2318         if (!g_handle) {
2319                 return NT_STATUS_NO_MEMORY;
2320         }
2321
2322         g_handle->data = talloc_steal(g_handle, a_state);
2323
2324         *r->out.group_handle = g_handle->wire_handle;
2325
2326         return NT_STATUS_OK;
2327 }
2328
2329 /*
2330   samr_QueryGroupInfo
2331 */
2332 static NTSTATUS dcesrv_samr_QueryGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2333                        struct samr_QueryGroupInfo *r)
2334 {
2335         struct dcesrv_handle *h;
2336         struct samr_account_state *a_state;
2337         struct ldb_message *msg, **res;
2338         const char * const attrs[4] = { "sAMAccountName", "description",
2339                                         "numMembers", NULL };
2340         int ret;
2341         union samr_GroupInfo *info;
2342
2343         *r->out.info = NULL;
2344
2345         DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
2346
2347         a_state = h->data;
2348
2349         /* pull all the group attributes */
2350         ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
2351                               a_state->account_dn, &res, attrs);
2352         if (ret == 0) {
2353                 return NT_STATUS_NO_SUCH_GROUP;
2354         }
2355         if (ret != 1) {
2356                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2357         }
2358         msg = res[0];
2359
2360         /* allocate the info structure */
2361         info = talloc_zero(mem_ctx, union samr_GroupInfo);
2362         if (info == NULL) {
2363                 return NT_STATUS_NO_MEMORY;
2364         }
2365
2366         /* Fill in the level */
2367         switch (r->in.level) {
2368         case GROUPINFOALL:
2369                 QUERY_STRING(msg, all.name,        "sAMAccountName");
2370                 info->all.attributes = SE_GROUP_DEFAULT_FLAGS; /* Do like w2k3 */
2371                 QUERY_UINT  (msg, all.num_members,      "numMembers")
2372                 QUERY_STRING(msg, all.description, "description");
2373                 break;
2374         case GROUPINFONAME:
2375                 QUERY_STRING(msg, name,            "sAMAccountName");
2376                 break;
2377         case GROUPINFOATTRIBUTES:
2378                 info->attributes.attributes = SE_GROUP_DEFAULT_FLAGS; /* Do like w2k3 */
2379                 break;
2380         case GROUPINFODESCRIPTION:
2381                 QUERY_STRING(msg, description, "description");
2382                 break;
2383         case GROUPINFOALL2:
2384                 QUERY_STRING(msg, all2.name,        "sAMAccountName");
2385                 info->all.attributes = SE_GROUP_DEFAULT_FLAGS; /* Do like w2k3 */
2386                 QUERY_UINT  (msg, all2.num_members,      "numMembers")
2387                 QUERY_STRING(msg, all2.description, "description");
2388                 break;
2389         default:
2390                 talloc_free(info);
2391                 return NT_STATUS_INVALID_INFO_CLASS;
2392         }
2393
2394         *r->out.info = info;
2395
2396         return NT_STATUS_OK;
2397 }
2398
2399
2400 /*
2401   samr_SetGroupInfo
2402 */
2403 static NTSTATUS dcesrv_samr_SetGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2404                                   struct samr_SetGroupInfo *r)
2405 {
2406         struct dcesrv_handle *h;
2407         struct samr_account_state *g_state;
2408         struct ldb_message *msg;
2409         int ret;
2410
2411         DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
2412
2413         g_state = h->data;
2414
2415         msg = ldb_msg_new(mem_ctx);
2416         if (msg == NULL) {
2417                 return NT_STATUS_NO_MEMORY;
2418         }
2419
2420         msg->dn = ldb_dn_copy(mem_ctx, g_state->account_dn);
2421         if (!msg->dn) {
2422                 return NT_STATUS_NO_MEMORY;
2423         }
2424
2425         switch (r->in.level) {
2426         case GROUPINFODESCRIPTION:
2427                 SET_STRING(msg, description,         "description");
2428                 break;
2429         case GROUPINFONAME:
2430                 /* On W2k3 this does not change the name, it changes the
2431                  * sAMAccountName attribute */
2432                 SET_STRING(msg, name,                "sAMAccountName");
2433                 break;
2434         case GROUPINFOATTRIBUTES:
2435                 /* This does not do anything obviously visible in W2k3 LDAP */
2436                 return NT_STATUS_OK;
2437         default:
2438                 return NT_STATUS_INVALID_INFO_CLASS;
2439         }
2440
2441         /* modify the samdb record */
2442         ret = ldb_modify(g_state->sam_ctx, msg);
2443         if (ret != LDB_SUCCESS) {
2444                 return dsdb_ldb_err_to_ntstatus(ret);
2445         }
2446
2447         return NT_STATUS_OK;
2448 }
2449
2450
2451 /*
2452   samr_AddGroupMember
2453 */
2454 static NTSTATUS dcesrv_samr_AddGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2455                        struct samr_AddGroupMember *r)
2456 {
2457         struct dcesrv_handle *h;
2458         struct samr_account_state *a_state;
2459         struct samr_domain_state *d_state;
2460         struct ldb_message *mod;
2461         struct dom_sid *membersid;
2462         const char *memberdn;
2463         struct ldb_result *res;
2464         const char * const attrs[] = { NULL };
2465         int ret;
2466
2467         DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
2468
2469         a_state = h->data;
2470         d_state = a_state->domain_state;
2471
2472         membersid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
2473         if (membersid == NULL) {
2474                 return NT_STATUS_NO_MEMORY;
2475         }
2476
2477         /* according to MS-SAMR 3.1.5.8.2 all type of accounts are accepted */
2478         ret = ldb_search(d_state->sam_ctx, mem_ctx, &res,
2479                          d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs,
2480                          "(objectSid=%s)",
2481                          ldap_encode_ndr_dom_sid(mem_ctx, membersid));
2482
2483         if (ret != LDB_SUCCESS) {
2484                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2485         }
2486
2487         if (res->count == 0) {
2488                 return NT_STATUS_NO_SUCH_USER;
2489         }
2490
2491         if (res->count > 1) {
2492                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2493         }
2494
2495         memberdn = ldb_dn_alloc_linearized(mem_ctx, res->msgs[0]->dn);
2496
2497         if (memberdn == NULL)
2498                 return NT_STATUS_NO_MEMORY;
2499
2500         mod = ldb_msg_new(mem_ctx);
2501         if (mod == NULL) {
2502                 return NT_STATUS_NO_MEMORY;
2503         }
2504
2505         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
2506
2507         ret = samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member",
2508                                                                 memberdn);
2509         if (ret != LDB_SUCCESS) {
2510                 return dsdb_ldb_err_to_ntstatus(ret);
2511         }
2512
2513         ret = ldb_modify(a_state->sam_ctx, mod);
2514         switch (ret) {
2515         case LDB_SUCCESS:
2516                 return NT_STATUS_OK;
2517         case LDB_ERR_ENTRY_ALREADY_EXISTS:
2518                 return NT_STATUS_MEMBER_IN_GROUP;
2519         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
2520                 return NT_STATUS_ACCESS_DENIED;
2521         default:
2522                 return dsdb_ldb_err_to_ntstatus(ret);
2523         }
2524 }
2525
2526
2527 /*
2528   samr_DeleteDomainGroup
2529 */
2530 static NTSTATUS dcesrv_samr_DeleteDomainGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2531                        struct samr_DeleteDomainGroup *r)
2532 {
2533         struct dcesrv_handle *h;
2534         struct samr_account_state *a_state;
2535         int ret;
2536
2537         *r->out.group_handle = *r->in.group_handle;
2538
2539         DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
2540
2541         a_state = h->data;
2542
2543         ret = ldb_delete(a_state->sam_ctx, a_state->account_dn);
2544         if (ret != LDB_SUCCESS) {
2545                 return dsdb_ldb_err_to_ntstatus(ret);
2546         }
2547
2548         talloc_free(h);
2549         ZERO_STRUCTP(r->out.group_handle);
2550
2551         return NT_STATUS_OK;
2552 }
2553
2554
2555 /*
2556   samr_DeleteGroupMember
2557 */
2558 static NTSTATUS dcesrv_samr_DeleteGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2559                        struct samr_DeleteGroupMember *r)
2560 {
2561         struct dcesrv_handle *h;
2562         struct samr_account_state *a_state;
2563         struct samr_domain_state *d_state;
2564         struct ldb_message *mod;
2565         struct dom_sid *membersid;
2566         const char *memberdn;
2567         struct ldb_result *res;
2568         const char * const attrs[] = { NULL };
2569         int ret;
2570
2571         DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
2572
2573         a_state = h->data;
2574         d_state = a_state->domain_state;
2575
2576         membersid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
2577         if (membersid == NULL) {
2578                 return NT_STATUS_NO_MEMORY;
2579         }
2580
2581         /* according to MS-SAMR 3.1.5.8.2 all type of accounts are accepted */
2582         ret = ldb_search(d_state->sam_ctx, mem_ctx, &res,
2583                          d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs,
2584                          "(objectSid=%s)",
2585                          ldap_encode_ndr_dom_sid(mem_ctx, membersid));
2586
2587         if (ret != LDB_SUCCESS) {
2588                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2589         }
2590
2591         if (res->count == 0) {
2592                 return NT_STATUS_NO_SUCH_USER;
2593         }
2594
2595         if (res->count > 1) {
2596                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2597         }
2598
2599         memberdn = ldb_dn_alloc_linearized(mem_ctx, res->msgs[0]->dn);
2600
2601         if (memberdn == NULL)
2602                 return NT_STATUS_NO_MEMORY;
2603
2604         mod = ldb_msg_new(mem_ctx);
2605         if (mod == NULL) {
2606                 return NT_STATUS_NO_MEMORY;
2607         }
2608
2609         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
2610
2611         ret = samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member",
2612                                                                 memberdn);
2613         if (ret != LDB_SUCCESS) {
2614                 return NT_STATUS_NO_MEMORY;
2615         }
2616
2617         ret = ldb_modify(a_state->sam_ctx, mod);
2618         switch (ret) {
2619         case LDB_SUCCESS:
2620                 return NT_STATUS_OK;
2621         case LDB_ERR_UNWILLING_TO_PERFORM:
2622         case LDB_ERR_NO_SUCH_ATTRIBUTE:
2623                 return NT_STATUS_MEMBER_NOT_IN_GROUP;
2624         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
2625                 return NT_STATUS_ACCESS_DENIED;
2626         default:
2627                 return dsdb_ldb_err_to_ntstatus(ret);
2628         }
2629 }
2630
2631
2632 /*
2633   samr_QueryGroupMember
2634 */
2635 static NTSTATUS dcesrv_samr_QueryGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2636                                       struct samr_QueryGroupMember *r)
2637 {
2638         struct dcesrv_handle *h;
2639         struct samr_account_state *a_state;
2640         struct samr_domain_state *d_state;
2641         struct samr_RidAttrArray *array;
2642         unsigned int i, num_members;
2643         struct dom_sid *members;
2644         NTSTATUS status;
2645
2646         DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP);
2647
2648         a_state = h->data;
2649         d_state = a_state->domain_state;
2650
2651         status = dsdb_enum_group_mem(d_state->sam_ctx, mem_ctx,
2652                                      a_state->account_dn, &members,
2653                                      &num_members);
2654         if (!NT_STATUS_IS_OK(status)) {
2655                 return status;
2656         }
2657
2658         array = talloc_zero(mem_ctx, struct samr_RidAttrArray);
2659         if (array == NULL) {
2660                 return NT_STATUS_NO_MEMORY;
2661         }
2662
2663         if (num_members == 0) {
2664                 *r->out.rids = array;
2665
2666                 return NT_STATUS_OK;
2667         }
2668
2669         array->rids = talloc_array(array, uint32_t, num_members);
2670         if (array->rids == NULL) {
2671                 return NT_STATUS_NO_MEMORY;
2672         }
2673
2674         array->attributes = talloc_array(array, uint32_t, num_members);
2675         if (array->attributes == NULL) {
2676                 return NT_STATUS_NO_MEMORY;
2677         }
2678
2679         array->count = 0;
2680         for (i=0; i<num_members; i++) {
2681                 if (!dom_sid_in_domain(d_state->domain_sid, &members[i])) {
2682                         continue;
2683                 }
2684
2685                 status = dom_sid_split_rid(NULL, &members[i], NULL,
2686                                            &array->rids[array->count]);
2687                 if (!NT_STATUS_IS_OK(status)) {
2688                         return status;
2689                 }
2690
2691                 array->attributes[array->count] = SE_GROUP_DEFAULT_FLAGS;
2692                 array->count++;
2693         }
2694
2695         *r->out.rids = array;
2696
2697         return NT_STATUS_OK;
2698 }
2699
2700
2701 /*
2702   samr_SetMemberAttributesOfGroup
2703 */
2704 static NTSTATUS dcesrv_samr_SetMemberAttributesOfGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2705                        struct samr_SetMemberAttributesOfGroup *r)
2706 {
2707         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2708 }
2709
2710
2711 /*
2712   samr_OpenAlias
2713 */
2714 static NTSTATUS dcesrv_samr_OpenAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2715                        struct samr_OpenAlias *r)
2716 {
2717         struct samr_domain_state *d_state;
2718         struct samr_account_state *a_state;
2719         struct dcesrv_handle *h;
2720         const char *alias_name;
2721         struct dom_sid *sid;
2722         struct ldb_message **msgs;
2723         struct dcesrv_handle *g_handle;
2724         const char * const attrs[2] = { "sAMAccountName", NULL };
2725         int ret;
2726
2727         ZERO_STRUCTP(r->out.alias_handle);
2728
2729         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
2730
2731         d_state = h->data;
2732
2733         /* form the alias SID */
2734         sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
2735         if (sid == NULL)
2736                 return NT_STATUS_NO_MEMORY;
2737
2738         /* search for the group record */
2739         ret = gendb_search(d_state->sam_ctx, mem_ctx, NULL, &msgs, attrs,
2740                            "(&(objectSid=%s)(objectclass=group)"
2741                            "(|(grouptype=%d)(grouptype=%d)))",
2742                            ldap_encode_ndr_dom_sid(mem_ctx, sid),
2743                            GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
2744                            GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
2745         if (ret == 0) {
2746                 return NT_STATUS_NO_SUCH_ALIAS;
2747         }
2748         if (ret != 1) {
2749                 DEBUG(0,("Found %d records matching sid %s\n",
2750                          ret, dom_sid_string(mem_ctx, sid)));
2751                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2752         }
2753
2754         alias_name = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL);
2755         if (alias_name == NULL) {
2756                 DEBUG(0,("sAMAccountName field missing for sid %s\n",
2757                          dom_sid_string(mem_ctx, sid)));
2758                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2759         }
2760
2761         a_state = talloc(mem_ctx, struct samr_account_state);
2762         if (!a_state) {
2763                 return NT_STATUS_NO_MEMORY;
2764         }
2765         a_state->sam_ctx = d_state->sam_ctx;
2766         a_state->access_mask = r->in.access_mask;
2767         a_state->domain_state = talloc_reference(a_state, d_state);
2768         a_state->account_dn = talloc_steal(a_state, msgs[0]->dn);
2769         a_state->account_sid = talloc_steal(a_state, sid);
2770         a_state->account_name = talloc_strdup(a_state, alias_name);
2771         if (!a_state->account_name) {
2772                 return NT_STATUS_NO_MEMORY;
2773         }
2774
2775         /* create the policy handle */
2776         g_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_ALIAS);
2777         if (!g_handle) {
2778                 return NT_STATUS_NO_MEMORY;
2779         }
2780
2781         g_handle->data = talloc_steal(g_handle, a_state);
2782
2783         *r->out.alias_handle = g_handle->wire_handle;
2784
2785         return NT_STATUS_OK;
2786 }
2787
2788
2789 /*
2790   samr_QueryAliasInfo
2791 */
2792 static NTSTATUS dcesrv_samr_QueryAliasInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2793                        struct samr_QueryAliasInfo *r)
2794 {
2795         struct dcesrv_handle *h;
2796         struct samr_account_state *a_state;
2797         struct ldb_message *msg, **res;
2798         const char * const attrs[4] = { "sAMAccountName", "description",
2799                                         "numMembers", NULL };
2800         int ret;
2801         union samr_AliasInfo *info;
2802
2803         *r->out.info = NULL;
2804
2805         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
2806
2807         a_state = h->data;
2808
2809         /* pull all the alias attributes */
2810         ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
2811                               a_state->account_dn, &res, attrs);
2812         if (ret == 0) {
2813                 return NT_STATUS_NO_SUCH_ALIAS;
2814         }
2815         if (ret != 1) {
2816                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2817         }
2818         msg = res[0];
2819
2820         /* allocate the info structure */
2821         info = talloc_zero(mem_ctx, union samr_AliasInfo);
2822         if (info == NULL) {
2823                 return NT_STATUS_NO_MEMORY;
2824         }
2825
2826         switch(r->in.level) {
2827         case ALIASINFOALL:
2828                 QUERY_STRING(msg, all.name, "sAMAccountName");
2829                 QUERY_UINT  (msg, all.num_members, "numMembers");
2830                 QUERY_STRING(msg, all.description, "description");
2831                 break;
2832         case ALIASINFONAME:
2833                 QUERY_STRING(msg, name, "sAMAccountName");
2834                 break;
2835         case ALIASINFODESCRIPTION:
2836                 QUERY_STRING(msg, description, "description");
2837                 break;
2838         default:
2839                 talloc_free(info);
2840                 return NT_STATUS_INVALID_INFO_CLASS;
2841         }
2842
2843         *r->out.info = info;
2844
2845         return NT_STATUS_OK;
2846 }
2847
2848
2849 /*
2850   samr_SetAliasInfo
2851 */
2852 static NTSTATUS dcesrv_samr_SetAliasInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2853                        struct samr_SetAliasInfo *r)
2854 {
2855         struct dcesrv_handle *h;
2856         struct samr_account_state *a_state;
2857         struct ldb_message *msg;
2858         int ret;
2859
2860         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
2861
2862         a_state = h->data;
2863
2864         msg = ldb_msg_new(mem_ctx);
2865         if (msg == NULL) {
2866                 return NT_STATUS_NO_MEMORY;
2867         }
2868
2869         msg->dn = ldb_dn_copy(mem_ctx, a_state->account_dn);
2870         if (!msg->dn) {
2871                 return NT_STATUS_NO_MEMORY;
2872         }
2873
2874         switch (r->in.level) {
2875         case ALIASINFODESCRIPTION:
2876                 SET_STRING(msg, description,         "description");
2877                 break;
2878         case ALIASINFONAME:
2879                 /* On W2k3 this does not change the name, it changes the
2880                  * sAMAccountName attribute */
2881                 SET_STRING(msg, name,                "sAMAccountName");
2882                 break;
2883         default:
2884                 return NT_STATUS_INVALID_INFO_CLASS;
2885         }
2886
2887         /* modify the samdb record */
2888         ret = ldb_modify(a_state->sam_ctx, msg);
2889         if (ret != LDB_SUCCESS) {
2890                 return dsdb_ldb_err_to_ntstatus(ret);
2891         }
2892
2893         return NT_STATUS_OK;
2894 }
2895
2896
2897 /*
2898   samr_DeleteDomAlias
2899 */
2900 static NTSTATUS dcesrv_samr_DeleteDomAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2901                        struct samr_DeleteDomAlias *r)
2902 {
2903         struct dcesrv_handle *h;
2904         struct samr_account_state *a_state;
2905         int ret;
2906
2907         *r->out.alias_handle = *r->in.alias_handle;
2908
2909         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
2910
2911         a_state = h->data;
2912
2913         ret = ldb_delete(a_state->sam_ctx, a_state->account_dn);
2914         if (ret != LDB_SUCCESS) {
2915                 return dsdb_ldb_err_to_ntstatus(ret);
2916         }
2917
2918         talloc_free(h);
2919         ZERO_STRUCTP(r->out.alias_handle);
2920
2921         return NT_STATUS_OK;
2922 }
2923
2924
2925 /*
2926   samr_AddAliasMember
2927 */
2928 static NTSTATUS dcesrv_samr_AddAliasMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2929                        struct samr_AddAliasMember *r)
2930 {
2931         struct dcesrv_handle *h;
2932         struct samr_account_state *a_state;
2933         struct samr_domain_state *d_state;
2934         struct ldb_message *mod;
2935         struct ldb_message **msgs;
2936         const char * const attrs[] = { NULL };
2937         struct ldb_dn *memberdn = NULL;
2938         int ret;
2939         NTSTATUS status;
2940
2941         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
2942
2943         a_state = h->data;
2944         d_state = a_state->domain_state;
2945
2946         ret = gendb_search(d_state->sam_ctx, mem_ctx, NULL,
2947                            &msgs, attrs, "(objectsid=%s)",
2948                            ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
2949
2950         if (ret == 1) {
2951                 memberdn = msgs[0]->dn;
2952         } else if (ret == 0) {
2953                 status = samdb_create_foreign_security_principal(
2954                         d_state->sam_ctx, mem_ctx, r->in.sid, &memberdn);
2955                 if (!NT_STATUS_IS_OK(status)) {
2956                         return status;
2957                 }
2958         } else {
2959                 DEBUG(0,("Found %d records matching sid %s\n",
2960                          ret, dom_sid_string(mem_ctx, r->in.sid)));
2961                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2962         }
2963
2964         if (memberdn == NULL) {
2965                 DEBUG(0, ("Could not find memberdn\n"));
2966                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2967         }
2968
2969         mod = ldb_msg_new(mem_ctx);
2970         if (mod == NULL) {
2971                 return NT_STATUS_NO_MEMORY;
2972         }
2973
2974         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
2975
2976         ret = samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member",
2977                                  ldb_dn_alloc_linearized(mem_ctx, memberdn));
2978         if (ret != LDB_SUCCESS) {
2979                 return dsdb_ldb_err_to_ntstatus(ret);
2980         }
2981
2982         ret = ldb_modify(a_state->sam_ctx, mod);
2983         switch (ret) {
2984         case LDB_SUCCESS:
2985                 return NT_STATUS_OK;
2986         case LDB_ERR_ENTRY_ALREADY_EXISTS:
2987                 return NT_STATUS_MEMBER_IN_GROUP;
2988         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
2989                 return NT_STATUS_ACCESS_DENIED;
2990         default:
2991                 return dsdb_ldb_err_to_ntstatus(ret);
2992         }
2993 }
2994
2995
2996 /*
2997   samr_DeleteAliasMember
2998 */
2999 static NTSTATUS dcesrv_samr_DeleteAliasMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3000                        struct samr_DeleteAliasMember *r)
3001 {
3002         struct dcesrv_handle *h;
3003         struct samr_account_state *a_state;
3004         struct samr_domain_state *d_state;
3005         struct ldb_message *mod;
3006         const char *memberdn;
3007         int ret;
3008
3009         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
3010
3011         a_state = h->data;
3012         d_state = a_state->domain_state;
3013
3014         memberdn = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
3015                                        "distinguishedName", "(objectSid=%s)",
3016                                        ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
3017         if (memberdn == NULL) {
3018                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3019         }
3020
3021         mod = ldb_msg_new(mem_ctx);
3022         if (mod == NULL) {
3023                 return NT_STATUS_NO_MEMORY;
3024         }
3025
3026         mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
3027
3028         ret = samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member",
3029                                                                  memberdn);
3030         if (ret != LDB_SUCCESS) {
3031                 return dsdb_ldb_err_to_ntstatus(ret);
3032         }
3033
3034         ret = ldb_modify(a_state->sam_ctx, mod);
3035         switch (ret) {
3036         case LDB_SUCCESS:
3037                 return NT_STATUS_OK;
3038         case LDB_ERR_UNWILLING_TO_PERFORM:
3039                 return NT_STATUS_MEMBER_NOT_IN_GROUP;
3040         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
3041                 return NT_STATUS_ACCESS_DENIED;
3042         default:
3043                 return dsdb_ldb_err_to_ntstatus(ret);
3044         }
3045 }
3046
3047
3048 /*
3049   samr_GetMembersInAlias
3050 */
3051 static NTSTATUS dcesrv_samr_GetMembersInAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3052                        struct samr_GetMembersInAlias *r)
3053 {
3054         struct dcesrv_handle *h;
3055         struct samr_account_state *a_state;
3056         struct samr_domain_state *d_state;
3057         struct lsa_SidPtr *array;
3058         unsigned int i, num_members;
3059         struct dom_sid *members;
3060         NTSTATUS status;
3061
3062         DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS);
3063
3064         a_state = h->data;
3065         d_state = a_state->domain_state;
3066
3067         status = dsdb_enum_group_mem(d_state->sam_ctx, mem_ctx,
3068                                      a_state->account_dn, &members,
3069                                      &num_members);
3070         if (!NT_STATUS_IS_OK(status)) {
3071                 return status;
3072         }
3073
3074         if (num_members == 0) {
3075                 r->out.sids->sids = NULL;
3076
3077                 return NT_STATUS_OK;
3078         }
3079
3080         array = talloc_array(mem_ctx, struct lsa_SidPtr, num_members);
3081         if (array == NULL) {
3082                 return NT_STATUS_NO_MEMORY;
3083         }
3084
3085         for (i=0; i<num_members; i++) {
3086                 array[i].sid = &members[i];
3087         }
3088
3089         r->out.sids->num_sids = num_members;
3090         r->out.sids->sids = array;
3091
3092         return NT_STATUS_OK;
3093 }
3094
3095 /*
3096   samr_OpenUser
3097 */
3098 static NTSTATUS dcesrv_samr_OpenUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3099                               struct samr_OpenUser *r)
3100 {
3101         struct samr_domain_state *d_state;
3102         struct samr_account_state *a_state;
3103         struct dcesrv_handle *h;
3104         const char *account_name;
3105         struct dom_sid *sid;
3106         struct ldb_message **msgs;
3107         struct dcesrv_handle *u_handle;
3108         const char * const attrs[2] = { "sAMAccountName", NULL };
3109         int ret;
3110
3111         ZERO_STRUCTP(r->out.user_handle);
3112
3113         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
3114
3115         d_state = h->data;
3116
3117         /* form the users SID */
3118         sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
3119         if (!sid) {
3120                 return NT_STATUS_NO_MEMORY;
3121         }
3122
3123         /* search for the user record */
3124         ret = gendb_search(d_state->sam_ctx,
3125                            mem_ctx, d_state->domain_dn, &msgs, attrs,
3126                            "(&(objectSid=%s)(objectclass=user))",
3127                            ldap_encode_ndr_dom_sid(mem_ctx, sid));
3128         if (ret == 0) {
3129                 return NT_STATUS_NO_SUCH_USER;
3130         }
3131         if (ret != 1) {
3132                 DEBUG(0,("Found %d records matching sid %s\n", ret,
3133                          dom_sid_string(mem_ctx, sid)));
3134                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3135         }
3136
3137         account_name = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL);
3138         if (account_name == NULL) {
3139                 DEBUG(0,("sAMAccountName field missing for sid %s\n",
3140                          dom_sid_string(mem_ctx, sid)));
3141                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3142         }
3143
3144         a_state = talloc(mem_ctx, struct samr_account_state);
3145         if (!a_state) {
3146                 return NT_STATUS_NO_MEMORY;
3147         }
3148         a_state->sam_ctx = d_state->sam_ctx;
3149         a_state->access_mask = r->in.access_mask;
3150         a_state->domain_state = talloc_reference(a_state, d_state);
3151         a_state->account_dn = talloc_steal(a_state, msgs[0]->dn);
3152         a_state->account_sid = talloc_steal(a_state, sid);
3153         a_state->account_name = talloc_strdup(a_state, account_name);
3154         if (!a_state->account_name) {
3155                 return NT_STATUS_NO_MEMORY;
3156         }
3157
3158         /* create the policy handle */
3159         u_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_USER);
3160         if (!u_handle) {
3161                 return NT_STATUS_NO_MEMORY;
3162         }
3163
3164         u_handle->data = talloc_steal(u_handle, a_state);
3165
3166         *r->out.user_handle = u_handle->wire_handle;
3167
3168         return NT_STATUS_OK;
3169
3170 }
3171
3172
3173 /*
3174   samr_DeleteUser
3175 */
3176 static NTSTATUS dcesrv_samr_DeleteUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3177                                 struct samr_DeleteUser *r)
3178 {
3179         struct dcesrv_handle *h;
3180         struct samr_account_state *a_state;
3181         int ret;
3182
3183         *r->out.user_handle = *r->in.user_handle;
3184
3185         DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
3186
3187         a_state = h->data;
3188
3189         ret = ldb_delete(a_state->sam_ctx, a_state->account_dn);
3190         if (ret != LDB_SUCCESS) {
3191                 DEBUG(1, ("Failed to delete user: %s: %s\n",
3192                           ldb_dn_get_linearized(a_state->account_dn),
3193                           ldb_errstring(a_state->sam_ctx)));
3194                 return dsdb_ldb_err_to_ntstatus(ret);
3195         }
3196
3197         talloc_free(h);
3198         ZERO_STRUCTP(r->out.user_handle);
3199
3200         return NT_STATUS_OK;
3201 }
3202
3203
3204 /*
3205   samr_QueryUserInfo
3206 */
3207 static NTSTATUS dcesrv_samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3208                                    struct samr_QueryUserInfo *r)
3209 {
3210         struct dcesrv_handle *h;
3211         struct samr_account_state *a_state;
3212         struct ldb_message *msg, **res;
3213         int ret;
3214         struct ldb_context *sam_ctx;
3215
3216         const char * const *attrs = NULL;
3217         union samr_UserInfo *info;
3218
3219         NTSTATUS status;
3220
3221         *r->out.info = NULL;
3222
3223         DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
3224
3225         a_state = h->data;
3226         sam_ctx = a_state->sam_ctx;
3227
3228         /* fill in the reply */
3229         switch (r->in.level) {
3230         case 1:
3231         {
3232                 static const char * const attrs2[] = {"sAMAccountName",
3233                                                       "displayName",
3234                                                       "primaryGroupID",
3235                                                       "description",
3236                                                       "comment",
3237                                                       NULL};
3238                 attrs = attrs2;
3239                 break;
3240         }
3241         case 2:
3242         {
3243                 static const char * const attrs2[] = {"comment",
3244                                                       "countryCode",
3245                                                       "codePage",
3246                                                       NULL};
3247                 attrs = attrs2;
3248                 break;
3249         }
3250         case 3:
3251         {
3252                 static const char * const attrs2[] = {"sAMAccountName",
3253                                                       "displayName",
3254                                                       "objectSid",
3255                                                       "primaryGroupID",
3256                                                       "homeDirectory",
3257                                                       "homeDrive",
3258                                                       "scriptPath",
3259                                                       "profilePath",
3260                                                       "userWorkstations",
3261                                                       "lastLogon",
3262                                                       "lastLogoff",
3263                                                       "pwdLastSet",
3264                                                       "msDS-UserPasswordExpiryTimeComputed",
3265                                                       "logonHours",
3266                                                       "badPwdCount",
3267                                                       "badPasswordTime",
3268                                                       "logonCount",
3269                                                       "userAccountControl",
3270                                                       "msDS-User-Account-Control-Computed",
3271                                                       NULL};
3272                 attrs = attrs2;
3273                 break;
3274         }
3275         case 4:
3276         {
3277                 static const char * const attrs2[] = {"logonHours",
3278                                                       NULL};
3279                 attrs = attrs2;
3280                 break;
3281         }
3282         case 5:
3283         {
3284                 static const char * const attrs2[] = {"sAMAccountName",
3285                                                       "displayName",
3286                                                       "objectSid",
3287                                                       "primaryGroupID",
3288                                                       "homeDirectory",
3289                                                       "homeDrive",
3290                                                       "scriptPath",
3291                                                       "profilePath",
3292                                                       "description",
3293                                                       "userWorkstations",
3294                                                       "lastLogon",
3295                                                       "lastLogoff",
3296                                                       "logonHours",
3297                                                       "badPwdCount",
3298                                                       "badPasswordTime",
3299                                                       "logonCount",
3300                                                       "pwdLastSet",
3301                                                       "msDS-ResultantPSO",
3302                                                       "msDS-UserPasswordExpiryTimeComputed",
3303                                                       "accountExpires",
3304                                                       "userAccountControl",
3305                                                       "msDS-User-Account-Control-Computed",
3306                                                       NULL};
3307                 attrs = attrs2;
3308                 break;
3309         }
3310         case 6:
3311         {
3312                 static const char * const attrs2[] = {"sAMAccountName",
3313                                                       "displayName",
3314                                                       NULL};
3315                 attrs = attrs2;
3316                 break;
3317         }
3318         case 7:
3319         {
3320                 static const char * const attrs2[] = {"sAMAccountName",
3321                                                       NULL};
3322                 attrs = attrs2;
3323                 break;
3324         }
3325         case 8:
3326         {
3327                 static const char * const attrs2[] = {"displayName",
3328                                                       NULL};
3329                 attrs = attrs2;
3330                 break;
3331         }
3332         case 9:
3333         {
3334                 static const char * const attrs2[] = {"primaryGroupID",
3335                                                       NULL};
3336                 attrs = attrs2;
3337                 break;
3338         }
3339         case 10:
3340         {
3341                 static const char * const attrs2[] = {"homeDirectory",
3342                                                       "homeDrive",
3343                                                       NULL};
3344                 attrs = attrs2;
3345                 break;
3346         }
3347         case 11:
3348         {
3349                 static const char * const attrs2[] = {"scriptPath",
3350                                                       NULL};
3351                 attrs = attrs2;
3352                 break;
3353         }
3354         case 12:
3355         {
3356                 static const char * const attrs2[] = {"profilePath",
3357                                                       NULL};
3358                 attrs = attrs2;
3359                 break;
3360         }
3361         case 13:
3362         {
3363                 static const char * const attrs2[] = {"description",
3364                                                       NULL};
3365                 attrs = attrs2;
3366                 break;
3367         }
3368         case 14:
3369         {
3370                 static const char * const attrs2[] = {"userWorkstations",
3371                                                       NULL};
3372                 attrs = attrs2;
3373                 break;
3374         }
3375         case 16:
3376         {
3377                 static const char * const attrs2[] = {"userAccountControl",
3378                                                       "msDS-User-Account-Control-Computed",
3379                                                       "pwdLastSet",
3380                                                       "msDS-UserPasswordExpiryTimeComputed",
3381                                                       NULL};
3382                 attrs = attrs2;
3383                 break;
3384         }
3385         case 17:
3386         {
3387                 static const char * const attrs2[] = {"accountExpires",
3388                                                       NULL};
3389                 attrs = attrs2;
3390                 break;
3391         }
3392         case 18:
3393         {
3394                 return NT_STATUS_NOT_SUPPORTED;
3395         }
3396         case 20:
3397         {
3398                 static const char * const attrs2[] = {"userParameters",
3399                                                       NULL};
3400                 attrs = attrs2;
3401                 break;
3402         }
3403         case 21:
3404         {
3405                 static const char * const attrs2[] = {"lastLogon",
3406                                                       "lastLogoff",
3407                                                       "pwdLastSet",
3408                                                       "msDS-ResultantPSO",
3409                                                       "msDS-UserPasswordExpiryTimeComputed",
3410                                                       "accountExpires",
3411                                                       "sAMAccountName",
3412                                                       "displayName",
3413                                                       "homeDirectory",
3414                                                       "homeDrive",
3415                                                       "scriptPath",
3416                                                       "profilePath",
3417                                                       "description",
3418                                                       "userWorkstations",
3419                                                       "comment",
3420                                                       "userParameters",
3421                                                       "objectSid",
3422                                                       "primaryGroupID",
3423                                                       "userAccountControl",
3424                                                       "msDS-User-Account-Control-Computed",
3425                                                       "logonHours",
3426                                                       "badPwdCount",
3427                                                       "badPasswordTime",
3428                                                       "logonCount",
3429                                                       "countryCode",
3430                                                       "codePage",
3431                                                       NULL};
3432                 attrs = attrs2;
3433                 break;
3434         }
3435         case 23:
3436         case 24:
3437         case 25:
3438         case 26:
3439         {
3440                 return NT_STATUS_NOT_SUPPORTED;
3441         }
3442         default:
3443         {
3444                 return NT_STATUS_INVALID_INFO_CLASS;
3445         }
3446         }
3447
3448         /* pull all the user attributes */
3449         ret = gendb_search_dn(a_state->sam_ctx, mem_ctx,
3450                               a_state->account_dn, &res, attrs);
3451         if (ret == 0) {
3452                 return NT_STATUS_NO_SUCH_USER;
3453         }
3454         if (ret != 1) {
3455                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3456         }
3457         msg = res[0];
3458
3459         /* allocate the info structure */
3460         info = talloc_zero(mem_ctx, union samr_UserInfo);
3461         if (info == NULL) {
3462                 return NT_STATUS_NO_MEMORY;
3463         }
3464
3465         /* fill in the reply */
3466         switch (r->in.level) {
3467         case 1:
3468                 QUERY_STRING(msg, info1.account_name,          "sAMAccountName");
3469                 QUERY_STRING(msg, info1.full_name,             "displayName");
3470                 QUERY_UINT  (msg, info1.primary_gid,           "primaryGroupID");
3471                 QUERY_STRING(msg, info1.description,           "description");
3472                 QUERY_STRING(msg, info1.comment,               "comment");
3473                 break;
3474
3475         case 2:
3476                 QUERY_STRING(msg, info2.comment,               "comment");
3477                 QUERY_UINT  (msg, info2.country_code,          "countryCode");
3478                 QUERY_UINT  (msg, info2.code_page,             "codePage");
3479                 break;
3480
3481         case 3:
3482                 QUERY_STRING(msg, info3.account_name,          "sAMAccountName");
3483                 QUERY_STRING(msg, info3.full_name,             "displayName");
3484                 QUERY_RID   (msg, info3.rid,                   "objectSid");
3485                 QUERY_UINT  (msg, info3.primary_gid,           "primaryGroupID");
3486                 QUERY_STRING(msg, info3.home_directory,        "homeDirectory");
3487                 QUERY_STRING(msg, info3.home_drive,            "homeDrive");
3488                 QUERY_STRING(msg, info3.logon_script,          "scriptPath");
3489                 QUERY_STRING(msg, info3.profile_path,          "profilePath");
3490                 QUERY_STRING(msg, info3.workstations,          "userWorkstations");
3491                 QUERY_UINT64(msg, info3.last_logon,            "lastLogon");
3492                 QUERY_UINT64(msg, info3.last_logoff,           "lastLogoff");
3493                 QUERY_UINT64(msg, info3.last_password_change,  "pwdLastSet");
3494                 QUERY_APASSC(msg, info3.allow_password_change, "pwdLastSet");
3495                 QUERY_UINT64(msg, info3.force_password_change, "msDS-UserPasswordExpiryTimeComputed");
3496                 QUERY_LHOURS(msg, info3.logon_hours,           "logonHours");
3497                 /* level 3 gives the raw badPwdCount value */
3498                 QUERY_UINT  (msg, info3.bad_password_count,    "badPwdCount");
3499                 QUERY_UINT  (msg, info3.logon_count,           "logonCount");
3500                 QUERY_AFLAGS(msg, info3.acct_flags,            "msDS-User-Account-Control-Computed");
3501                 break;
3502
3503         case 4:
3504                 QUERY_LHOURS(msg, info4.logon_hours,           "logonHours");
3505                 break;
3506
3507         case 5:
3508                 QUERY_STRING(msg, info5.account_name,          "sAMAccountName");
3509                 QUERY_STRING(msg, info5.full_name,             "displayName");
3510                 QUERY_RID   (msg, info5.rid,                   "objectSid");
3511                 QUERY_UINT  (msg, info5.primary_gid,           "primaryGroupID");
3512                 QUERY_STRING(msg, info5.home_directory,        "homeDirectory");
3513                 QUERY_STRING(msg, info5.home_drive,            "homeDrive");
3514                 QUERY_STRING(msg, info5.logon_script,          "scriptPath");
3515                 QUERY_STRING(msg, info5.profile_path,          "profilePath");
3516                 QUERY_STRING(msg, info5.description,           "description");
3517                 QUERY_STRING(msg, info5.workstations,          "userWorkstations");
3518                 QUERY_UINT64(msg, info5.last_logon,            "lastLogon");
3519                 QUERY_UINT64(msg, info5.last_logoff,           "lastLogoff");
3520                 QUERY_LHOURS(msg, info5.logon_hours,           "logonHours");
3521                 QUERY_BPWDCT(msg, info5.bad_password_count,    "badPwdCount");
3522                 QUERY_UINT  (msg, info5.logon_count,           "logonCount");
3523                 QUERY_UINT64(msg, info5.last_password_change,  "pwdLastSet");
3524                 QUERY_UINT64(msg, info5.acct_expiry,           "accountExpires");
3525                 QUERY_AFLAGS(msg, info5.acct_flags,            "msDS-User-Account-Control-Computed");
3526                 break;
3527
3528         case 6:
3529                 QUERY_STRING(msg, info6.account_name,   "sAMAccountName");
3530                 QUERY_STRING(msg, info6.full_name,      "displayName");
3531                 break;
3532
3533         case 7:
3534                 QUERY_STRING(msg, info7.account_name,   "sAMAccountName");
3535                 break;
3536
3537         case 8:
3538                 QUERY_STRING(msg, info8.full_name,      "displayName");
3539                 break;
3540
3541         case 9:
3542                 QUERY_UINT  (msg, info9.primary_gid,    "primaryGroupID");
3543                 break;
3544
3545         case 10:
3546                 QUERY_STRING(msg, info10.home_directory,"homeDirectory");
3547                 QUERY_STRING(msg, info10.home_drive,    "homeDrive");
3548                 break;
3549
3550         case 11:
3551                 QUERY_STRING(msg, info11.logon_script,  "scriptPath");
3552                 break;
3553
3554         case 12:
3555                 QUERY_STRING(msg, info12.profile_path,  "profilePath");
3556                 break;
3557
3558         case 13:
3559                 QUERY_STRING(msg, info13.description,   "description");
3560                 break;
3561
3562         case 14:
3563                 QUERY_STRING(msg, info14.workstations,  "userWorkstations");
3564                 break;
3565
3566         case 16:
3567                 QUERY_AFLAGS(msg, info16.acct_flags,    "msDS-User-Account-Control-Computed");
3568                 break;
3569
3570         case 17:
3571                 QUERY_UINT64(msg, info17.acct_expiry,   "accountExpires");
3572                 break;
3573
3574         case 20:
3575                 status = samdb_result_parameters(mem_ctx, msg, "userParameters", &info->info20.parameters);
3576                 if (!NT_STATUS_IS_OK(status)) {
3577                         talloc_free(info);
3578                         return status;
3579                 }
3580                 break;
3581
3582         case 21:
3583                 QUERY_UINT64(msg, info21.last_logon,           "lastLogon");
3584                 QUERY_UINT64(msg, info21.last_logoff,          "lastLogoff");
3585                 QUERY_UINT64(msg, info21.last_password_change, "pwdLastSet");
3586                 QUERY_UINT64(msg, info21.acct_expiry,          "accountExpires");
3587                 QUERY_APASSC(msg, info21.allow_password_change,"pwdLastSet");
3588                 QUERY_UINT64(msg, info21.force_password_change, "msDS-UserPasswordExpiryTimeComputed");
3589                 QUERY_STRING(msg, info21.account_name,         "sAMAccountName");
3590                 QUERY_STRING(msg, info21.full_name,            "displayName");
3591                 QUERY_STRING(msg, info21.home_directory,       "homeDirectory");
3592                 QUERY_STRING(msg, info21.home_drive,           "homeDrive");
3593                 QUERY_STRING(msg, info21.logon_script,         "scriptPath");
3594                 QUERY_STRING(msg, info21.profile_path,         "profilePath");
3595                 QUERY_STRING(msg, info21.description,          "description");
3596                 QUERY_STRING(msg, info21.workstations,         "userWorkstations");
3597                 QUERY_STRING(msg, info21.comment,              "comment");
3598                 status = samdb_result_parameters(mem_ctx, msg, "userParameters", &info->info21.parameters);
3599                 if (!NT_STATUS_IS_OK(status)) {
3600                         talloc_free(info);
3601                         return status;
3602                 }
3603
3604                 QUERY_RID   (msg, info21.rid,                  "objectSid");
3605                 QUERY_UINT  (msg, info21.primary_gid,          "primaryGroupID");
3606                 QUERY_AFLAGS(msg, info21.acct_flags,           "msDS-User-Account-Control-Computed");
3607                 info->info21.fields_present = 0x08FFFFFF;
3608                 QUERY_LHOURS(msg, info21.logon_hours,          "logonHours");
3609                 QUERY_BPWDCT(msg, info21.bad_password_count,   "badPwdCount");
3610                 QUERY_UINT  (msg, info21.logon_count,          "logonCount");
3611                 if ((info->info21.acct_flags & ACB_PW_EXPIRED) != 0) {
3612                         info->info21.password_expired = PASS_MUST_CHANGE_AT_NEXT_LOGON;
3613                 } else {
3614                         info->info21.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
3615                 }
3616                 QUERY_UINT  (msg, info21.country_code,         "countryCode");
3617                 QUERY_UINT  (msg, info21.code_page,            "codePage");
3618                 break;
3619
3620
3621         default:
3622                 talloc_free(info);
3623                 return NT_STATUS_INVALID_INFO_CLASS;
3624         }
3625
3626         *r->out.info = info;
3627
3628         return NT_STATUS_OK;
3629 }
3630
3631
3632 /*
3633   samr_SetUserInfo
3634 */
3635 static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
3636                                  struct samr_SetUserInfo *r)
3637 {
3638         struct dcesrv_handle *h;
3639         struct samr_account_state *a_state;
3640         struct ldb_message *msg;
3641         int ret;
3642         NTSTATUS status = NT_STATUS_OK;
3643         struct ldb_context *sam_ctx;
3644         DATA_BLOB session_key = data_blob_null;
3645
3646         DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
3647
3648         a_state = h->data;
3649         sam_ctx = a_state->sam_ctx;
3650
3651         msg = ldb_msg_new(mem_ctx);
3652         if (msg == NULL) {
3653                 return NT_STATUS_NO_MEMORY;
3654         }
3655
3656         msg->dn = talloc_reference(mem_ctx, a_state->account_dn);
3657         if (!msg->dn) {
3658                 return NT_STATUS_NO_MEMORY;
3659         }
3660
3661         ret = ldb_transaction_start(sam_ctx);
3662         if (ret != LDB_SUCCESS) {
3663                 DBG_ERR("Failed to start a transaction: %s\n",
3664                         ldb_errstring(sam_ctx));
3665                 return NT_STATUS_LOCK_NOT_GRANTED;
3666         }
3667
3668         switch (r->in.level) {
3669         case 2:
3670                 SET_STRING(msg, info2.comment,          "comment");
3671                 SET_UINT  (msg, info2.country_code,     "countryCode");
3672                 SET_UINT  (msg, info2.code_page,        "codePage");
3673                 break;
3674
3675         case 4:
3676                 SET_LHOURS(msg, info4.logon_hours,      "logonHours");
3677                 break;
3678
3679         case 6:
3680                 SET_STRING(msg, info6.account_name,     "samAccountName");
3681                 SET_STRING(msg, info6.full_name,        "displayName");
3682                 break;
3683
3684         case 7:
3685                 SET_STRING(msg, info7.account_name,     "samAccountName");
3686                 break;
3687
3688         case 8:
3689                 SET_STRING(msg, info8.full_name,        "displayName");
3690                 break;
3691
3692         case 9:
3693                 SET_UINT(msg, info9.primary_gid,        "primaryGroupID");
3694                 break;
3695
3696         case 10:
3697                 SET_STRING(msg, info10.home_directory,  "homeDirectory");
3698                 SET_STRING(msg, info10.home_drive,      "homeDrive");
3699                 break;
3700
3701         case 11:
3702                 SET_STRING(msg, info11.logon_script,    "scriptPath");
3703                 break;
3704
3705         case 12:
3706                 SET_STRING(msg, info12.profile_path,    "profilePath");
3707                 break;
3708
3709         case 13:
3710                 SET_STRING(msg, info13.description,     "description");
3711                 break;
3712
3713         case 14:
3714                 SET_STRING(msg, info14.workstations,    "userWorkstations");
3715                 break;
3716
3717         case 16:
3718                 SET_AFLAGS(msg, info16.acct_flags,      "userAccountControl");
3719                 break;
3720
3721         case 17:
3722                 SET_UINT64(msg, info17.acct_expiry,     "accountExpires");
3723                 break;
3724
3725         case 18:
3726                 status = samr_set_password_buffers(dce_call,
3727                                                    sam_ctx,
3728                                                    a_state->account_dn,
3729                                                    mem_ctx,
3730                                                    r->in.info->info18.lm_pwd_active ? r->in.info->info18.lm_pwd.hash : NULL,
3731                                                    r->in.info->info18.nt_pwd_active ? r->in.info->info18.nt_pwd.hash : NULL);
3732                 if (!NT_STATUS_IS_OK(status)) {
3733                         goto done;
3734                 }
3735
3736                 if (r->in.info->info18.password_expired > 0) {
3737                         struct ldb_message_element *set_el;
3738                         if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) {
3739                                 status = NT_STATUS_NO_MEMORY;
3740                                 goto done;
3741                         }
3742                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
3743                         set_el->flags = LDB_FLAG_MOD_REPLACE;
3744                 }
3745                 break;
3746
3747         case 20:
3748                 SET_PARAMETERS(msg, info20.parameters,      "userParameters");
3749                 break;
3750
3751         case 21:
3752                 if (r->in.info->info21.fields_present == 0) {
3753                         status = NT_STATUS_INVALID_PARAMETER;
3754                         goto done;
3755                 }
3756
3757 #define IFSET(bit) if (bit & r->in.info->info21.fields_present)
3758                 IFSET(SAMR_FIELD_LAST_LOGON)
3759                         SET_UINT64(msg, info21.last_logon,     "lastLogon");
3760                 IFSET(SAMR_FIELD_LAST_LOGOFF)
3761                         SET_UINT64(msg, info21.last_logoff,    "lastLogoff");
3762                 IFSET(SAMR_FIELD_ACCT_EXPIRY)
3763                         SET_UINT64(msg, info21.acct_expiry,    "accountExpires");
3764                 IFSET(SAMR_FIELD_ACCOUNT_NAME)
3765                         SET_STRING(msg, info21.account_name,   "samAccountName");
3766                 IFSET(SAMR_FIELD_FULL_NAME)
3767                         SET_STRING(msg, info21.full_name,      "displayName");
3768                 IFSET(SAMR_FIELD_HOME_DIRECTORY)
3769                         SET_STRING(msg, info21.home_directory, "homeDirectory");
3770                 IFSET(SAMR_FIELD_HOME_DRIVE)
3771                         SET_STRING(msg, info21.home_drive,     "homeDrive");
3772                 IFSET(SAMR_FIELD_LOGON_SCRIPT)
3773                         SET_STRING(msg, info21.logon_script,   "scriptPath");
3774                 IFSET(SAMR_FIELD_PROFILE_PATH)
3775                         SET_STRING(msg, info21.profile_path,   "profilePath");
3776                 IFSET(SAMR_FIELD_DESCRIPTION)
3777                         SET_STRING(msg, info21.description,    "description");
3778                 IFSET(SAMR_FIELD_WORKSTATIONS)
3779                         SET_STRING(msg, info21.workstations,   "userWorkstations");
3780                 IFSET(SAMR_FIELD_COMMENT)
3781                         SET_STRING(msg, info21.comment,        "comment");
3782                 IFSET(SAMR_FIELD_PARAMETERS)
3783                         SET_PARAMETERS(msg, info21.parameters, "userParameters");
3784                 IFSET(SAMR_FIELD_PRIMARY_GID)
3785                         SET_UINT(msg, info21.primary_gid,      "primaryGroupID");
3786                 IFSET(SAMR_FIELD_ACCT_FLAGS)
3787                         SET_AFLAGS(msg, info21.acct_flags,     "userAccountControl");
3788                 IFSET(SAMR_FIELD_LOGON_HOURS)
3789                         SET_LHOURS(msg, info21.logon_hours,    "logonHours");
3790                 IFSET(SAMR_FIELD_BAD_PWD_COUNT)
3791                         SET_UINT  (msg, info21.bad_password_count, "badPwdCount");
3792                 IFSET(SAMR_FIELD_NUM_LOGONS)
3793                         SET_UINT  (msg, info21.logon_count,    "logonCount");
3794                 IFSET(SAMR_FIELD_COUNTRY_CODE)
3795                         SET_UINT  (msg, info21.country_code,   "countryCode");
3796                 IFSET(SAMR_FIELD_CODE_PAGE)
3797                         SET_UINT  (msg, info21.code_page,      "codePage");
3798
3799                 /* password change fields */
3800                 IFSET(SAMR_FIELD_LAST_PWD_CHANGE) {
3801                         status = NT_STATUS_ACCESS_DENIED;
3802                         goto done;
3803                 }
3804
3805                 IFSET((SAMR_FIELD_LM_PASSWORD_PRESENT
3806                                         | SAMR_FIELD_NT_PASSWORD_PRESENT)) {
3807                         uint8_t *lm_pwd_hash = NULL, *nt_pwd_hash = NULL;
3808
3809                         if (r->in.info->info21.lm_password_set) {
3810                                 if ((r->in.info->info21.lm_owf_password.length != 16)
3811                                  || (r->in.info->info21.lm_owf_password.size != 16)) {
3812                                         status = NT_STATUS_INVALID_PARAMETER;
3813                                         goto done;
3814                                 }
3815
3816                                 lm_pwd_hash = (uint8_t *) r->in.info->info21.lm_owf_password.array;
3817                         }
3818                         if (r->in.info->info21.nt_password_set) {
3819                                 if ((r->in.info->info21.nt_owf_password.length != 16)
3820                                  || (r->in.info->info21.nt_owf_password.size != 16)) {
3821                                         status = NT_STATUS_INVALID_PARAMETER;
3822                                         goto done;
3823                                 }
3824
3825                                 nt_pwd_hash = (uint8_t *) r->in.info->info21.nt_owf_password.array;
3826                         }
3827                         status = samr_set_password_buffers(dce_call,
3828                                                            sam_ctx,
3829                                                            a_state->account_dn,
3830                                                            mem_ctx,
3831                                                            lm_pwd_hash,
3832                                                            nt_pwd_hash);
3833                         if (!NT_STATUS_IS_OK(status)) {
3834                                 goto done;
3835                         }
3836                 }
3837
3838
3839                 IFSET(SAMR_FIELD_EXPIRED_FLAG) {
3840                         const char *t = "0";
3841                         struct ldb_message_element *set_el;
3842                         if (r->in.info->info21.password_expired
3843                                         == PASS_DONT_CHANGE_AT_NEXT_LOGON) {
3844                                 t = "-1";
3845                         }
3846                         if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) {
3847                                 status = NT_STATUS_NO_MEMORY;
3848                                 goto done;
3849                         }
3850                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
3851                         set_el->flags = LDB_FLAG_MOD_REPLACE;
3852                 }
3853 #undef IFSET
3854                 break;
3855
3856         case 23:
3857                 if (r->in.info->info23.info.fields_present == 0) {
3858                         status = NT_STATUS_INVALID_PARAMETER;
3859                         goto done;
3860                 }
3861
3862 #define IFSET(bit) if (bit & r->in.info->info23.info.fields_present)
3863                 IFSET(SAMR_FIELD_LAST_LOGON)
3864                         SET_UINT64(msg, info23.info.last_logon,     "lastLogon");
3865                 IFSET(SAMR_FIELD_LAST_LOGOFF)
3866                         SET_UINT64(msg, info23.info.last_logoff,    "lastLogoff");
3867                 IFSET(SAMR_FIELD_ACCT_EXPIRY)
3868                         SET_UINT64(msg, info23.info.acct_expiry,    "accountExpires");
3869                 IFSET(SAMR_FIELD_ACCOUNT_NAME)
3870                         SET_STRING(msg, info23.info.account_name,   "samAccountName");
3871                 IFSET(SAMR_FIELD_FULL_NAME)
3872                         SET_STRING(msg, info23.info.full_name,      "displayName");
3873                 IFSET(SAMR_FIELD_HOME_DIRECTORY)
3874                         SET_STRING(msg, info23.info.home_directory, "homeDirectory");
3875                 IFSET(SAMR_FIELD_HOME_DRIVE)
3876                         SET_STRING(msg, info23.info.home_drive,     "homeDrive");
3877                 IFSET(SAMR_FIELD_LOGON_SCRIPT)
3878                         SET_STRING(msg, info23.info.logon_script,   "scriptPath");
3879                 IFSET(SAMR_FIELD_PROFILE_PATH)
3880                         SET_STRING(msg, info23.info.profile_path,   "profilePath");
3881                 IFSET(SAMR_FIELD_DESCRIPTION)
3882                         SET_STRING(msg, info23.info.description,    "description");
3883                 IFSET(SAMR_FIELD_WORKSTATIONS)
3884                         SET_STRING(msg, info23.info.workstations,   "userWorkstations");
3885                 IFSET(SAMR_FIELD_COMMENT)
3886                         SET_STRING(msg, info23.info.comment,        "comment");
3887                 IFSET(SAMR_FIELD_PARAMETERS)
3888                         SET_PARAMETERS(msg, info23.info.parameters, "userParameters");
3889                 IFSET(SAMR_FIELD_PRIMARY_GID)
3890                         SET_UINT(msg, info23.info.primary_gid,      "primaryGroupID");
3891                 IFSET(SAMR_FIELD_ACCT_FLAGS)
3892                         SET_AFLAGS(msg, info23.info.acct_flags,     "userAccountControl");
3893                 IFSET(SAMR_FIELD_LOGON_HOURS)
3894                         SET_LHOURS(msg, info23.info.logon_hours,    "logonHours");
3895                 IFSET(SAMR_FIELD_BAD_PWD_COUNT)
3896                         SET_UINT  (msg, info23.info.bad_password_count, "badPwdCount");
3897                 IFSET(SAMR_FIELD_NUM_LOGONS)
3898                         SET_UINT  (msg, info23.info.logon_count,    "logonCount");
3899
3900                 IFSET(SAMR_FIELD_COUNTRY_CODE)
3901                         SET_UINT  (msg, info23.info.country_code,   "countryCode");
3902                 IFSET(SAMR_FIELD_CODE_PAGE)
3903                         SET_UINT  (msg, info23.info.code_page,      "codePage");
3904
3905                 /* password change fields */
3906                 IFSET(SAMR_FIELD_LAST_PWD_CHANGE) {
3907                         status = NT_STATUS_ACCESS_DENIED;
3908                         goto done;
3909                 }
3910
3911                 IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) {
3912                         status = samr_set_password(dce_call,
3913                                                    sam_ctx,
3914                                                    a_state->account_dn,
3915                                                    mem_ctx,
3916                                                    &r->in.info->info23.password);
3917                 } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) {
3918                         status = samr_set_password(dce_call,
3919                                                    sam_ctx,
3920                                                    a_state->account_dn,
3921                                                    mem_ctx,
3922                                                    &r->in.info->info23.password);
3923                 }
3924                 if (!NT_STATUS_IS_OK(status)) {
3925                         goto done;
3926                 }
3927
3928                 IFSET(SAMR_FIELD_EXPIRED_FLAG) {
3929                         const char *t = "0";
3930                         struct ldb_message_element *set_el;
3931                         if (r->in.info->info23.info.password_expired
3932                                         == PASS_DONT_CHANGE_AT_NEXT_LOGON) {
3933                                 t = "-1";
3934                         }
3935                         if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) {
3936                                 status = NT_STATUS_NO_MEMORY;
3937                                 goto done;
3938                         }
3939                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
3940                         set_el->flags = LDB_FLAG_MOD_REPLACE;
3941                 }
3942 #undef IFSET
3943                 break;
3944
3945                 /* the set password levels are handled separately */
3946         case 24:
3947                 status = samr_set_password(dce_call,
3948                                            sam_ctx,
3949                                            a_state->account_dn,
3950                                            mem_ctx,
3951                                            &r->in.info->info24.password);
3952                 if (!NT_STATUS_IS_OK(status)) {
3953                         goto done;
3954                 }
3955
3956                 if (r->in.info->info24.password_expired > 0) {
3957                         struct ldb_message_element *set_el;
3958                         if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) {
3959                                 status = NT_STATUS_NO_MEMORY;
3960                                 goto done;
3961                         }
3962                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
3963                         set_el->flags = LDB_FLAG_MOD_REPLACE;
3964                 }
3965                 break;
3966
3967         case 25:
3968                 if (r->in.info->info25.info.fields_present == 0) {
3969                         status = NT_STATUS_INVALID_PARAMETER;
3970                         goto done;
3971                 }
3972
3973 #define IFSET(bit) if (bit & r->in.info->info25.info.fields_present)
3974                 IFSET(SAMR_FIELD_LAST_LOGON)
3975                         SET_UINT64(msg, info25.info.last_logon,     "lastLogon");
3976                 IFSET(SAMR_FIELD_LAST_LOGOFF)
3977                         SET_UINT64(msg, info25.info.last_logoff,    "lastLogoff");
3978                 IFSET(SAMR_FIELD_ACCT_EXPIRY)
3979                         SET_UINT64(msg, info25.info.acct_expiry,    "accountExpires");
3980                 IFSET(SAMR_FIELD_ACCOUNT_NAME)
3981                         SET_STRING(msg, info25.info.account_name,   "samAccountName");
3982                 IFSET(SAMR_FIELD_FULL_NAME)
3983                         SET_STRING(msg, info25.info.full_name,      "displayName");
3984                 IFSET(SAMR_FIELD_HOME_DIRECTORY)
3985                         SET_STRING(msg, info25.info.home_directory, "homeDirectory");
3986                 IFSET(SAMR_FIELD_HOME_DRIVE)
3987                         SET_STRING(msg, info25.info.home_drive,     "homeDrive");
3988                 IFSET(SAMR_FIELD_LOGON_SCRIPT)
3989                         SET_STRING(msg, info25.info.logon_script,   "scriptPath");
3990                 IFSET(SAMR_FIELD_PROFILE_PATH)
3991                         SET_STRING(msg, info25.info.profile_path,   "profilePath");
3992                 IFSET(SAMR_FIELD_DESCRIPTION)
3993                         SET_STRING(msg, info25.info.description,    "description");
3994                 IFSET(SAMR_FIELD_WORKSTATIONS)
3995                         SET_STRING(msg, info25.info.workstations,   "userWorkstations");
3996                 IFSET(SAMR_FIELD_COMMENT)
3997                         SET_STRING(msg, info25.info.comment,        "comment");
3998                 IFSET(SAMR_FIELD_PARAMETERS)
3999                         SET_PARAMETERS(msg, info25.info.parameters, "userParameters");
4000                 IFSET(SAMR_FIELD_PRIMARY_GID)
4001                         SET_UINT(msg, info25.info.primary_gid,      "primaryGroupID");
4002                 IFSET(SAMR_FIELD_ACCT_FLAGS)
4003                         SET_AFLAGS(msg, info25.info.acct_flags,     "userAccountControl");
4004                 IFSET(SAMR_FIELD_LOGON_HOURS)
4005                         SET_LHOURS(msg, info25.info.logon_hours,    "logonHours");
4006                 IFSET(SAMR_FIELD_BAD_PWD_COUNT)
4007                         SET_UINT  (msg, info25.info.bad_password_count, "badPwdCount");
4008                 IFSET(SAMR_FIELD_NUM_LOGONS)
4009                         SET_UINT  (msg, info25.info.logon_count,    "logonCount");
4010                 IFSET(SAMR_FIELD_COUNTRY_CODE)
4011                         SET_UINT  (msg, info25.info.country_code,   "countryCode");
4012                 IFSET(SAMR_FIELD_CODE_PAGE)
4013                         SET_UINT  (msg, info25.info.code_page,      "codePage");
4014
4015                 /* password change fields */
4016                 IFSET(SAMR_FIELD_LAST_PWD_CHANGE) {
4017                         status = NT_STATUS_ACCESS_DENIED;
4018                         goto done;
4019                 }
4020
4021                 IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) {
4022                         status = samr_set_password_ex(dce_call,
4023                                                       sam_ctx,
4024                                                       a_state->account_dn,
4025                                                       mem_ctx,
4026                                                       &r->in.info->info25.password);
4027                 } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) {
4028                         status = samr_set_password_ex(dce_call,
4029                                                       sam_ctx,
4030                                                       a_state->account_dn,
4031                                                       mem_ctx,
4032                                                       &r->in.info->info25.password);
4033                 }
4034                 if (!NT_STATUS_IS_OK(status)) {
4035                         goto done;
4036                 }
4037
4038                 IFSET(SAMR_FIELD_EXPIRED_FLAG) {
4039                         const char *t = "0";
4040                         struct ldb_message_element *set_el;
4041                         if (r->in.info->info25.info.password_expired
4042                                         == PASS_DONT_CHANGE_AT_NEXT_LOGON) {
4043                                 t = "-1";
4044                         }
4045                         if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) {
4046                                 status = NT_STATUS_NO_MEMORY;
4047                                 goto done;
4048                         }
4049                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
4050                         set_el->flags = LDB_FLAG_MOD_REPLACE;
4051                 }
4052 #undef IFSET
4053                 break;
4054
4055                 /* the set password levels are handled separately */
4056         case 26:
4057                 status = samr_set_password_ex(dce_call,
4058                                               sam_ctx,
4059                                               a_state->account_dn,
4060                                               mem_ctx,
4061                                               &r->in.info->info26.password);
4062                 if (!NT_STATUS_IS_OK(status)) {
4063                         goto done;
4064                 }
4065
4066                 if (r->in.info->info26.password_expired > 0) {
4067                         const char *t = "0";
4068                         struct ldb_message_element *set_el;
4069                         if (r->in.info->info26.password_expired
4070                                         == PASS_DONT_CHANGE_AT_NEXT_LOGON) {
4071                                 t = "-1";
4072                         }
4073                         if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) {
4074                                 status = NT_STATUS_NO_MEMORY;
4075                                 goto done;
4076                         }
4077                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
4078                         set_el->flags = LDB_FLAG_MOD_REPLACE;
4079                 }
4080                 break;
4081
4082         case 31:
4083                 status = dcesrv_transport_session_key(dce_call, &session_key);
4084                 if (!NT_STATUS_IS_OK(status)) {
4085                         DBG_NOTICE("samr: failed to get session key: %s\n",
4086                                    nt_errstr(status));
4087                         goto done;
4088                 }
4089
4090                 status = samr_set_password_aes(dce_call,
4091                                                mem_ctx,
4092                                                &session_key,
4093                                                sam_ctx,
4094                                                a_state->account_dn,
4095                                                &r->in.info->info31.password,
4096                                                DSDB_PASSWORD_RESET);
4097                 if (!NT_STATUS_IS_OK(status)) {
4098                         goto done;
4099                 }
4100
4101                 if (r->in.info->info31.password_expired > 0) {
4102                         const char *t = "0";
4103                         struct ldb_message_element *set_el = NULL;
4104
4105                         if (r->in.info->info31.password_expired ==
4106                             PASS_DONT_CHANGE_AT_NEXT_LOGON) {
4107                                 t = "-1";
4108                         }
4109
4110                         ret = ldb_msg_add_string(msg, "pwdLastSet", t);
4111                         if (ret != LDB_SUCCESS) {
4112                                 status = NT_STATUS_NO_MEMORY;
4113                                 goto done;
4114                         }
4115                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
4116                         set_el->flags = LDB_FLAG_MOD_REPLACE;
4117                 }
4118
4119                 break;
4120         case 32:
4121                 status = dcesrv_transport_session_key(dce_call, &session_key);
4122                 if (!NT_STATUS_IS_OK(status)) {
4123                         DBG_NOTICE("samr: failed to get session key: %s\n",
4124                                    nt_errstr(status));
4125                         goto done;
4126                 }
4127
4128                 if (r->in.info->info32.info.fields_present == 0) {
4129                         status = NT_STATUS_INVALID_PARAMETER;
4130                         goto done;
4131                 }
4132
4133 #define IFSET(bit) if (bit & r->in.info->info32.info.fields_present)
4134                 IFSET(SAMR_FIELD_LAST_LOGON)
4135                 {
4136                         SET_UINT64(msg, info32.info.last_logon, "lastLogon");
4137                 }
4138                 IFSET(SAMR_FIELD_LAST_LOGOFF)
4139                 {
4140                         SET_UINT64(msg, info32.info.last_logoff, "lastLogoff");
4141                 }
4142                 IFSET(SAMR_FIELD_ACCT_EXPIRY)
4143                 {
4144                         SET_UINT64(msg,
4145                                    info32.info.acct_expiry,
4146                                    "accountExpires");
4147                 }
4148                 IFSET(SAMR_FIELD_ACCOUNT_NAME)
4149                 {
4150                         SET_STRING(msg,
4151                                    info32.info.account_name,
4152                                    "samAccountName");
4153                 }
4154                 IFSET(SAMR_FIELD_FULL_NAME)
4155                 {
4156                         SET_STRING(msg, info32.info.full_name, "displayName");
4157                 }
4158                 IFSET(SAMR_FIELD_HOME_DIRECTORY)
4159                 {
4160                         SET_STRING(msg,
4161                                    info32.info.home_directory,
4162                                    "homeDirectory");
4163                 }
4164                 IFSET(SAMR_FIELD_HOME_DRIVE)
4165                 {
4166                         SET_STRING(msg, info32.info.home_drive, "homeDrive");
4167                 }
4168                 IFSET(SAMR_FIELD_LOGON_SCRIPT)
4169                 {
4170                         SET_STRING(msg, info32.info.logon_script, "scriptPath");
4171                 }
4172                 IFSET(SAMR_FIELD_PROFILE_PATH)
4173                 {
4174                         SET_STRING(msg,
4175                                    info32.info.profile_path,
4176                                    "profilePath");
4177                 }
4178                 IFSET(SAMR_FIELD_DESCRIPTION)
4179                 {
4180                         SET_STRING(msg, info32.info.description, "description");
4181                 }
4182                 IFSET(SAMR_FIELD_WORKSTATIONS)
4183                 {
4184                         SET_STRING(msg,
4185                                    info32.info.workstations,
4186                                    "userWorkstations");
4187                 }
4188                 IFSET(SAMR_FIELD_COMMENT)
4189                 {
4190                         SET_STRING(msg, info32.info.comment, "comment");
4191                 }
4192                 IFSET(SAMR_FIELD_PARAMETERS)
4193                 {
4194                         SET_PARAMETERS(msg,
4195                                        info32.info.parameters,
4196                                        "userParameters");
4197                 }
4198                 IFSET(SAMR_FIELD_PRIMARY_GID)
4199                 {
4200                         SET_UINT(msg,
4201                                  info32.info.primary_gid,
4202                                  "primaryGroupID");
4203                 }
4204                 IFSET(SAMR_FIELD_ACCT_FLAGS)
4205                 {
4206                         SET_AFLAGS(msg,
4207                                    info32.info.acct_flags,
4208                                    "userAccountControl");
4209                 }
4210                 IFSET(SAMR_FIELD_LOGON_HOURS)
4211                 {
4212                         SET_LHOURS(msg, info32.info.logon_hours, "logonHours");
4213                 }
4214                 IFSET(SAMR_FIELD_BAD_PWD_COUNT)
4215                 {
4216                         SET_UINT(msg,
4217                                  info32.info.bad_password_count,
4218                                  "badPwdCount");
4219                 }
4220                 IFSET(SAMR_FIELD_NUM_LOGONS)
4221                 {
4222                         SET_UINT(msg, info32.info.logon_count, "logonCount");
4223                 }
4224                 IFSET(SAMR_FIELD_COUNTRY_CODE)
4225                 {
4226                         SET_UINT(msg, info32.info.country_code, "countryCode");
4227                 }
4228                 IFSET(SAMR_FIELD_CODE_PAGE)
4229                 {
4230                         SET_UINT(msg, info32.info.code_page, "codePage");
4231                 }
4232
4233                 /* password change fields */
4234                 IFSET(SAMR_FIELD_LAST_PWD_CHANGE)
4235                 {
4236                         status = NT_STATUS_ACCESS_DENIED;
4237                         goto done;
4238                 }
4239
4240                 IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT)
4241                 {
4242                         status = samr_set_password_aes(
4243                                 dce_call,
4244                                 mem_ctx,
4245                                 &session_key,
4246                                 a_state->sam_ctx,
4247                                 a_state->account_dn,
4248                                 &r->in.info->info32.password,
4249                                 DSDB_PASSWORD_RESET);
4250                 }
4251                 else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT)
4252                 {
4253                         status = samr_set_password_aes(
4254                                 dce_call,
4255                                 mem_ctx,
4256                                 &session_key,
4257                                 a_state->sam_ctx,
4258                                 a_state->account_dn,
4259                                 &r->in.info->info32.password,
4260                                 DSDB_PASSWORD_RESET);
4261                 }
4262                 if (!NT_STATUS_IS_OK(status)) {
4263                         goto done;
4264                 }
4265
4266                 IFSET(SAMR_FIELD_EXPIRED_FLAG)
4267                 {
4268                         const char *t = "0";
4269                         struct ldb_message_element *set_el;
4270                         if (r->in.info->info32.info.password_expired ==
4271                             PASS_DONT_CHANGE_AT_NEXT_LOGON) {
4272                                 t = "-1";
4273                         }
4274                         if (ldb_msg_add_string(msg, "pwdLastSet", t) !=
4275                             LDB_SUCCESS) {
4276                                 status = NT_STATUS_NO_MEMORY;
4277                                 goto done;
4278                         }
4279                         set_el = ldb_msg_find_element(msg, "pwdLastSet");
4280                         set_el->flags = LDB_FLAG_MOD_REPLACE;
4281                 }
4282 #undef IFSET
4283
4284                 break;
4285         default:
4286                 /* many info classes are not valid for SetUserInfo */
4287                 status = NT_STATUS_INVALID_INFO_CLASS;
4288                 goto done;
4289         }
4290
4291         if (!NT_STATUS_IS_OK(status)) {
4292                 goto done;
4293         }
4294
4295         /* modify the samdb record */
4296         if (msg->num_elements > 0) {
4297                 ret = ldb_modify(sam_ctx, msg);
4298                 if (ret != LDB_SUCCESS) {
4299                         DEBUG(1,("Failed to modify record %s: %s\n",
4300                                  ldb_dn_get_linearized(a_state->account_dn),
4301                                  ldb_errstring(sam_ctx)));
4302
4303                         status = dsdb_ldb_err_to_ntstatus(ret);
4304                         goto done;
4305                 }
4306         }
4307
4308         ret = ldb_transaction_commit(sam_ctx);
4309         if (ret != LDB_SUCCESS) {
4310                 DBG_ERR("Failed to commit transaction modifying account record "
4311                         "%s: %s\n",
4312                         ldb_dn_get_linearized(msg->dn),
4313                         ldb_errstring(sam_ctx));
4314                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4315         }
4316
4317         status = NT_STATUS_OK;
4318 done:
4319         if (!NT_STATUS_IS_OK(status)) {
4320                 ldb_transaction_cancel(sam_ctx);
4321         }
4322
4323         return status;
4324 }
4325
4326
4327 /*
4328   samr_GetGroupsForUser
4329 */
4330 static NTSTATUS dcesrv_samr_GetGroupsForUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4331                        struct samr_GetGroupsForUser *r)
4332 {
4333         struct dcesrv_handle *h;
4334         struct samr_account_state *a_state;
4335         struct samr_domain_state *d_state;
4336         struct ldb_result *res, *res_memberof;
4337         const char * const attrs[] = { "primaryGroupID",
4338                                        "memberOf",
4339                                        NULL };
4340         const char * const group_attrs[] = { "objectSid",
4341                                              NULL };
4342
4343         struct samr_RidWithAttributeArray *array;
4344         struct ldb_message_element *memberof_el;
4345         int i, ret, count = 0;
4346         uint32_t primary_group_id;
4347         char *filter;
4348
4349         DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
4350
4351         a_state = h->data;
4352         d_state = a_state->domain_state;
4353
4354         ret = dsdb_search_dn(a_state->sam_ctx, mem_ctx,
4355                              &res,
4356                              a_state->account_dn,
4357                              attrs, DSDB_SEARCH_SHOW_EXTENDED_DN);
4358
4359         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
4360                 return NT_STATUS_NO_SUCH_USER;
4361         } else if (ret != LDB_SUCCESS) {
4362                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4363         } else if (res->count != 1) {
4364                 return NT_STATUS_NO_SUCH_USER;
4365         }
4366
4367         primary_group_id = ldb_msg_find_attr_as_uint(res->msgs[0], "primaryGroupID",
4368                                                      0);
4369
4370         filter = talloc_asprintf(mem_ctx,
4371                                  "(&(|(grouptype=%d)(grouptype=%d))"
4372                                  "(objectclass=group)(|",
4373                                  GTYPE_SECURITY_UNIVERSAL_GROUP,
4374                                  GTYPE_SECURITY_GLOBAL_GROUP);
4375         if (filter == NULL) {
4376                 return NT_STATUS_NO_MEMORY;
4377         }
4378
4379         memberof_el = ldb_msg_find_element(res->msgs[0], "memberOf");
4380         if (memberof_el != NULL) {
4381                 for (i = 0; i < memberof_el->num_values; i++) {
4382                         const struct ldb_val *memberof_sid_binary;
4383                         char *memberof_sid_escaped;
4384                         struct ldb_dn *memberof_dn
4385                                 = ldb_dn_from_ldb_val(mem_ctx,
4386                                                       a_state->sam_ctx,
4387                                                       &memberof_el->values[i]);
4388                         if (memberof_dn == NULL) {
4389                                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4390                         }
4391
4392                         memberof_sid_binary
4393                                 = ldb_dn_get_extended_component(memberof_dn,
4394                                                                 "SID");
4395                         if (memberof_sid_binary == NULL) {
4396                                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4397                         }
4398
4399                         memberof_sid_escaped = ldb_binary_encode(mem_ctx,
4400                                                                  *memberof_sid_binary);
4401                         if (memberof_sid_escaped == NULL) {
4402                                 return NT_STATUS_NO_MEMORY;
4403                         }
4404                         filter = talloc_asprintf_append(filter, "(objectSID=%s)",
4405                                                         memberof_sid_escaped);
4406                         if (filter == NULL) {
4407                                 return NT_STATUS_NO_MEMORY;
4408                         }
4409                 }
4410
4411                 ret = dsdb_search(a_state->sam_ctx, mem_ctx,
4412                                   &res_memberof,
4413                                   d_state->domain_dn,
4414                                   LDB_SCOPE_SUBTREE,
4415                                   group_attrs, 0,
4416                                   "%s))", filter);
4417
4418                 if (ret != LDB_SUCCESS) {
4419                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
4420                 }
4421                 count = res_memberof->count;
4422         }
4423
4424         array = talloc(mem_ctx, struct samr_RidWithAttributeArray);
4425         if (array == NULL)
4426                 return NT_STATUS_NO_MEMORY;
4427
4428         array->count = 0;
4429         array->rids = NULL;
4430
4431         array->rids = talloc_array(mem_ctx, struct samr_RidWithAttribute,
4432                                    count + 1);
4433         if (array->rids == NULL)
4434                 return NT_STATUS_NO_MEMORY;
4435
4436         /* Adds the primary group */
4437
4438         array->rids[0].rid = primary_group_id;
4439         array->rids[0].attributes = SE_GROUP_DEFAULT_FLAGS;
4440         array->count += 1;
4441
4442         /* Adds the additional groups */
4443         for (i = 0; i < count; i++) {
4444                 struct dom_sid *group_sid;
4445
4446                 group_sid = samdb_result_dom_sid(mem_ctx,
4447                                                  res_memberof->msgs[i],
4448                                                  "objectSid");
4449                 if (group_sid == NULL) {
4450                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
4451                 }
4452
4453                 array->rids[i + 1].rid =
4454                         group_sid->sub_auths[group_sid->num_auths-1];
4455                 array->rids[i + 1].attributes = SE_GROUP_DEFAULT_FLAGS;
4456                 array->count += 1;
4457         }
4458
4459         *r->out.rids = array;
4460
4461         return NT_STATUS_OK;
4462 }
4463
4464 /*
4465  * samr_QueryDisplayInfo
4466  *
4467  * A cache of the GUID's matching the last query is maintained
4468  * in the SAMR_QUERY_DISPLAY_INFO_CACHE guid_cache maintained o
4469  * n the dcesrv_handle.
4470  */
4471 static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4472                        struct samr_QueryDisplayInfo *r)
4473 {
4474         struct dcesrv_handle *h;
4475         struct samr_domain_state *d_state;
4476         struct ldb_result *res;
4477         uint32_t i;
4478         uint32_t results = 0;
4479         uint32_t count = 0;
4480         const char *const cache_attrs[] = {"objectGUID", NULL};
4481         const char *const attrs[] = {
4482             "objectSID", "sAMAccountName", "displayName", "description", NULL};
4483         struct samr_DispEntryFull *entriesFull = NULL;
4484         struct samr_DispEntryFullGroup *entriesFullGroup = NULL;
4485         struct samr_DispEntryAscii *entriesAscii = NULL;
4486         struct samr_DispEntryGeneral *entriesGeneral = NULL;
4487         const char *filter;
4488         int ret;
4489         NTSTATUS status;
4490         struct samr_guid_cache *cache = NULL;
4491
4492         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
4493
4494         d_state = h->data;
4495
4496         cache = &d_state->guid_caches[SAMR_QUERY_DISPLAY_INFO_CACHE];
4497         /*
4498          * Can the cached results be used?
4499          * The cache is discarded if the start index is zero, or the requested
4500          * level is different from that in the cache.
4501          */
4502         if ((r->in.start_idx == 0) || (r->in.level != cache->handle)) {
4503                 /*
4504                  * The cached results can not be used, so will need to query
4505                  * the database.
4506                  */
4507
4508                 /*
4509                  * Get the search filter for the current level
4510                  */
4511                 switch (r->in.level) {
4512                 case 1:
4513                 case 4:
4514                         filter = talloc_asprintf(mem_ctx,
4515                                                  "(&(objectclass=user)"
4516                                                  "(sAMAccountType=%d))",
4517                                                  ATYPE_NORMAL_ACCOUNT);
4518                         break;
4519                 case 2:
4520                         filter = talloc_asprintf(mem_ctx,
4521                                                  "(&(objectclass=user)"
4522                                                  "(sAMAccountType=%d))",
4523                                                  ATYPE_WORKSTATION_TRUST);
4524                         break;
4525                 case 3:
4526                 case 5:
4527                         filter =
4528                             talloc_asprintf(mem_ctx,
4529                                             "(&(|(groupType=%d)(groupType=%d))"
4530                                             "(objectClass=group))",
4531                                             GTYPE_SECURITY_UNIVERSAL_GROUP,
4532                                             GTYPE_SECURITY_GLOBAL_GROUP);
4533                         break;
4534                 default:
4535                         return NT_STATUS_INVALID_INFO_CLASS;
4536                 }
4537                 clear_guid_cache(cache);
4538
4539                 /*
4540                  * search for all requested objects in all domains.
4541                  */
4542                 ret = dsdb_search(d_state->sam_ctx,
4543                                   mem_ctx,
4544                                   &res,
4545                                   ldb_get_default_basedn(d_state->sam_ctx),
4546                                   LDB_SCOPE_SUBTREE,
4547                                   cache_attrs,
4548                                   0,
4549                                   "%s",
4550                                   filter);
4551                 if (ret != LDB_SUCCESS) {
4552                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
4553                 }
4554                 if ((res->count == 0) || (r->in.max_entries == 0)) {
4555                         return NT_STATUS_OK;
4556                 }
4557
4558                 status = load_guid_cache(cache, d_state, res->count, res->msgs);
4559                 TALLOC_FREE(res);
4560                 if (!NT_STATUS_IS_OK(status)) {
4561                         return status;
4562                 }
4563                 cache->handle = r->in.level;
4564         }
4565         *r->out.total_size = cache->size;
4566
4567         /*
4568          * if there are no entries or the requested start index is greater
4569          * than the number of entries, we return an empty response.
4570          */
4571         if (r->in.start_idx >= cache->size) {
4572                 *r->out.returned_size = 0;
4573                 switch(r->in.level) {
4574                 case 1:
4575                         r->out.info->info1.count = *r->out.returned_size;
4576                         r->out.info->info1.entries = NULL;
4577                         break;
4578                 case 2:
4579                         r->out.info->info2.count = *r->out.returned_size;
4580                         r->out.info->info2.entries = NULL;
4581                         break;
4582                 case 3:
4583                         r->out.info->info3.count = *r->out.returned_size;
4584                         r->out.info->info3.entries = NULL;
4585                         break;
4586                 case 4:
4587                         r->out.info->info4.count = *r->out.returned_size;
4588                         r->out.info->info4.entries = NULL;
4589                         break;
4590                 case 5:
4591                         r->out.info->info5.count = *r->out.returned_size;
4592                         r->out.info->info5.entries = NULL;
4593                         break;
4594                 }
4595                 return NT_STATUS_OK;
4596         }
4597
4598         /*
4599          * Allocate an array of the appropriate result structures for the
4600          * current query level.
4601          *
4602          * r->in.start_idx is always < cache->size due to the check above
4603          */
4604         results = MIN((cache->size - r->in.start_idx), r->in.max_entries);
4605         switch (r->in.level) {
4606         case 1:
4607                 entriesGeneral = talloc_array(
4608                     mem_ctx, struct samr_DispEntryGeneral, results);
4609                 break;
4610         case 2:
4611                 entriesFull =
4612                     talloc_array(mem_ctx, struct samr_DispEntryFull, results);
4613                 break;
4614         case 3:
4615                 entriesFullGroup = talloc_array(
4616                     mem_ctx, struct samr_DispEntryFullGroup, results);
4617                 break;
4618         case 4:
4619         case 5:
4620                 entriesAscii =
4621                     talloc_array(mem_ctx, struct samr_DispEntryAscii, results);
4622                 break;
4623         }
4624
4625         if ((entriesGeneral == NULL) && (entriesFull == NULL) &&
4626             (entriesAscii == NULL) && (entriesFullGroup == NULL))
4627                 return NT_STATUS_NO_MEMORY;
4628
4629         /*
4630          * Process the list of result GUID's.
4631          * Read the details of each object and populate the result structure
4632          * for the current level.
4633          */
4634         count = 0;
4635         for (i = 0; i < results; i++) {
4636                 struct dom_sid *objectsid;
4637                 struct ldb_result *rec;
4638                 const uint32_t idx = r->in.start_idx + i;
4639                 uint32_t rid;
4640
4641                 /*
4642                  * Read an object from disk using the GUID as the key
4643                  *
4644                  * If the object can not be read, or it does not have a SID
4645                  * it is ignored.  In this case the number of entries returned
4646                  * will be less than the requested size, there will also be
4647                  * a gap in the idx numbers in the returned elements e.g. if
4648                  * there are 3 GUIDs a, b, c in the cache and b is deleted from
4649                  * disk then details for a, and c will be returned with
4650                  * idx values of 1 and 3 respectively.
4651                  *
4652                  */
4653                 ret = dsdb_search_by_dn_guid(d_state->sam_ctx,
4654                                              mem_ctx,
4655                                              &rec,
4656                                              &cache->entries[idx],
4657                                              attrs,
4658                                              0);
4659                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
4660                         struct GUID_txt_buf guid_buf;
4661                         char *guid_str =
4662                                 GUID_buf_string(&cache->entries[idx],
4663                                                 &guid_buf);
4664                         DBG_WARNING("GUID [%s] not found\n", guid_str);
4665                         continue;
4666                 } else if (ret != LDB_SUCCESS) {
4667                         clear_guid_cache(cache);
4668                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
4669                 }
4670                 objectsid = samdb_result_dom_sid(mem_ctx,
4671                                                  rec->msgs[0],
4672                                                  "objectSID");
4673                 if (objectsid == NULL) {
4674                         struct GUID_txt_buf guid_buf;
4675                         DBG_WARNING(
4676                             "objectSID for GUID [%s] not found\n",
4677                             GUID_buf_string(&cache->entries[idx], &guid_buf));
4678                         continue;
4679                 }
4680                 status = dom_sid_split_rid(NULL,
4681                                            objectsid,
4682                                            NULL,
4683                                            &rid);
4684                 if (!NT_STATUS_IS_OK(status)) {
4685                         struct dom_sid_buf sid_buf;
4686                         struct GUID_txt_buf guid_buf;
4687                         DBG_WARNING(
4688                             "objectSID [%s] for GUID [%s] invalid\n",
4689                             dom_sid_str_buf(objectsid, &sid_buf),
4690                             GUID_buf_string(&cache->entries[idx], &guid_buf));
4691                         continue;
4692                 }
4693
4694                 /*
4695                  * Populate the result structure for the current object
4696                  */
4697                 switch(r->in.level) {
4698                 case 1:
4699
4700                         entriesGeneral[count].idx = idx + 1;
4701                         entriesGeneral[count].rid = rid;
4702
4703                         entriesGeneral[count].acct_flags =
4704                             samdb_result_acct_flags(rec->msgs[0], NULL);
4705                         entriesGeneral[count].account_name.string =
4706                             ldb_msg_find_attr_as_string(
4707                                 rec->msgs[0], "sAMAccountName", "");
4708                         entriesGeneral[count].full_name.string =
4709                             ldb_msg_find_attr_as_string(
4710                                 rec->msgs[0], "displayName", "");
4711                         entriesGeneral[count].description.string =
4712                             ldb_msg_find_attr_as_string(
4713                                 rec->msgs[0], "description", "");
4714                         break;
4715                 case 2:
4716                         entriesFull[count].idx = idx + 1;
4717                         entriesFull[count].rid = rid;
4718
4719                         /*
4720                          * No idea why we need to or in ACB_NORMAL here,
4721                          * but this is what Win2k3 seems to do...
4722                          */
4723                         entriesFull[count].acct_flags =
4724                             samdb_result_acct_flags(rec->msgs[0], NULL) |
4725                             ACB_NORMAL;
4726                         entriesFull[count].account_name.string =
4727                             ldb_msg_find_attr_as_string(
4728                                 rec->msgs[0], "sAMAccountName", "");
4729                         entriesFull[count].description.string =
4730                             ldb_msg_find_attr_as_string(
4731                                 rec->msgs[0], "description", "");
4732                         break;
4733                 case 3:
4734                         entriesFullGroup[count].idx = idx + 1;
4735                         entriesFullGroup[count].rid = rid;
4736
4737                         /*
4738                          * We get a "7" here for groups
4739                          */
4740                         entriesFullGroup[count].acct_flags = SE_GROUP_DEFAULT_FLAGS;
4741                         entriesFullGroup[count].account_name.string =
4742                             ldb_msg_find_attr_as_string(
4743                                 rec->msgs[0], "sAMAccountName", "");
4744                         entriesFullGroup[count].description.string =
4745                             ldb_msg_find_attr_as_string(
4746                                 rec->msgs[0], "description", "");
4747                         break;
4748                 case 4:
4749                 case 5:
4750                         entriesAscii[count].idx = idx + 1;
4751                         entriesAscii[count].account_name.string =
4752                             ldb_msg_find_attr_as_string(
4753                                 rec->msgs[0], "sAMAccountName", "");
4754                         break;
4755                 }
4756                 count++;
4757         }
4758
4759         /*
4760          * Build the response based on the request level.
4761          */
4762         *r->out.returned_size = count;
4763         switch(r->in.level) {
4764         case 1:
4765                 r->out.info->info1.count = count;
4766                 r->out.info->info1.entries = entriesGeneral;
4767                 break;
4768         case 2:
4769                 r->out.info->info2.count = count;
4770                 r->out.info->info2.entries = entriesFull;
4771                 break;
4772         case 3:
4773                 r->out.info->info3.count = count;
4774                 r->out.info->info3.entries = entriesFullGroup;
4775                 break;
4776         case 4:
4777                 r->out.info->info4.count = count;
4778                 r->out.info->info4.entries = entriesAscii;
4779                 break;
4780         case 5:
4781                 r->out.info->info5.count = count;
4782                 r->out.info->info5.entries = entriesAscii;
4783                 break;
4784         }
4785
4786         return ((r->in.start_idx + results) < cache->size)
4787                    ? STATUS_MORE_ENTRIES
4788                    : NT_STATUS_OK;
4789 }
4790
4791
4792 /*
4793   samr_GetDisplayEnumerationIndex
4794 */
4795 static NTSTATUS dcesrv_samr_GetDisplayEnumerationIndex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4796                        struct samr_GetDisplayEnumerationIndex *r)
4797 {
4798         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
4799 }
4800
4801
4802 /*
4803   samr_TestPrivateFunctionsDomain
4804 */
4805 static NTSTATUS dcesrv_samr_TestPrivateFunctionsDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4806                        struct samr_TestPrivateFunctionsDomain *r)
4807 {
4808         return NT_STATUS_NOT_IMPLEMENTED;
4809 }
4810
4811
4812 /*
4813   samr_TestPrivateFunctionsUser
4814 */
4815 static NTSTATUS dcesrv_samr_TestPrivateFunctionsUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4816                        struct samr_TestPrivateFunctionsUser *r)
4817 {
4818         return NT_STATUS_NOT_IMPLEMENTED;
4819 }
4820
4821
4822 /*
4823   samr_GetUserPwInfo
4824 */
4825 static NTSTATUS dcesrv_samr_GetUserPwInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4826                                    struct samr_GetUserPwInfo *r)
4827 {
4828         struct dcesrv_handle *h;
4829         struct samr_account_state *a_state;
4830
4831         ZERO_STRUCTP(r->out.info);
4832
4833         DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
4834
4835         a_state = h->data;
4836
4837         r->out.info->min_password_length = samdb_search_uint(a_state->sam_ctx,
4838                 mem_ctx, 0, a_state->domain_state->domain_dn, "minPwdLength",
4839                 NULL);
4840         r->out.info->password_properties = samdb_search_uint(a_state->sam_ctx,
4841                 mem_ctx, 0, a_state->account_dn, "pwdProperties", NULL);
4842
4843         return NT_STATUS_OK;
4844 }
4845
4846
4847 /*
4848   samr_RemoveMemberFromForeignDomain
4849 */
4850 static NTSTATUS dcesrv_samr_RemoveMemberFromForeignDomain(struct dcesrv_call_state *dce_call,
4851                                                           TALLOC_CTX *mem_ctx,
4852                                                           struct samr_RemoveMemberFromForeignDomain *r)
4853 {
4854         struct dcesrv_handle *h;
4855         struct samr_domain_state *d_state;
4856         const char *memberdn;
4857         struct ldb_message **res;
4858         const char *no_attrs[] = { NULL };
4859         int i, count;
4860
4861         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
4862
4863         d_state = h->data;
4864
4865         memberdn = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
4866                                        "distinguishedName", "(objectSid=%s)",
4867                                        ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid));
4868         /* Nothing to do */
4869         if (memberdn == NULL) {
4870                 return NT_STATUS_OK;
4871         }
4872
4873         count = samdb_search_domain(d_state->sam_ctx, mem_ctx,
4874                                     d_state->domain_dn, &res, no_attrs,
4875                                     d_state->domain_sid,
4876                                     "(&(member=%s)(objectClass=group)"
4877                                     "(|(groupType=%d)(groupType=%d)))",
4878                                     memberdn,
4879                                     GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
4880                                     GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
4881
4882         if (count < 0)
4883                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4884
4885         for (i=0; i<count; i++) {
4886                 struct ldb_message *mod;
4887                 int ret;
4888
4889                 mod = ldb_msg_new(mem_ctx);
4890                 if (mod == NULL) {
4891                         return NT_STATUS_NO_MEMORY;
4892                 }
4893
4894                 mod->dn = res[i]->dn;
4895
4896                 if (samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod,
4897                                          "member", memberdn) != LDB_SUCCESS)
4898                         return NT_STATUS_NO_MEMORY;
4899
4900                 ret = ldb_modify(d_state->sam_ctx, mod);
4901                 talloc_free(mod);
4902                 if (ret != LDB_SUCCESS) {
4903                         return dsdb_ldb_err_to_ntstatus(ret);
4904                 }
4905         }
4906
4907         return NT_STATUS_OK;
4908 }
4909
4910
4911 /*
4912   samr_QueryDomainInfo2
4913
4914   just an alias for samr_QueryDomainInfo
4915 */
4916 static NTSTATUS dcesrv_samr_QueryDomainInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4917                        struct samr_QueryDomainInfo2 *r)
4918 {
4919         struct samr_QueryDomainInfo r1;
4920         NTSTATUS status;
4921
4922         r1 = (struct samr_QueryDomainInfo) {
4923                 .in.domain_handle = r->in.domain_handle,
4924                 .in.level  = r->in.level,
4925                 .out.info  = r->out.info,
4926         };
4927
4928         status = dcesrv_samr_QueryDomainInfo(dce_call, mem_ctx, &r1);
4929
4930         return status;
4931 }
4932
4933
4934 /*
4935   samr_QueryUserInfo2
4936
4937   just an alias for samr_QueryUserInfo
4938 */
4939 static NTSTATUS dcesrv_samr_QueryUserInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4940                                     struct samr_QueryUserInfo2 *r)
4941 {
4942         struct samr_QueryUserInfo r1;
4943         NTSTATUS status;
4944
4945         r1 = (struct samr_QueryUserInfo) {
4946                 .in.user_handle = r->in.user_handle,
4947                 .in.level  = r->in.level,
4948                 .out.info  = r->out.info
4949         };
4950
4951         status = dcesrv_samr_QueryUserInfo(dce_call, mem_ctx, &r1);
4952
4953         return status;
4954 }
4955
4956
4957 /*
4958   samr_QueryDisplayInfo2
4959 */
4960 static NTSTATUS dcesrv_samr_QueryDisplayInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4961                                        struct samr_QueryDisplayInfo2 *r)
4962 {
4963         struct samr_QueryDisplayInfo q;
4964         NTSTATUS result;
4965
4966         q = (struct samr_QueryDisplayInfo) {
4967                 .in.domain_handle = r->in.domain_handle,
4968                 .in.level = r->in.level,
4969                 .in.start_idx = r->in.start_idx,
4970                 .in.max_entries = r->in.max_entries,
4971                 .in.buf_size = r->in.buf_size,
4972                 .out.total_size = r->out.total_size,
4973                 .out.returned_size = r->out.returned_size,
4974                 .out.info = r->out.info,
4975         };
4976
4977         result = dcesrv_samr_QueryDisplayInfo(dce_call, mem_ctx, &q);
4978
4979         return result;
4980 }
4981
4982
4983 /*
4984   samr_GetDisplayEnumerationIndex2
4985 */
4986 static NTSTATUS dcesrv_samr_GetDisplayEnumerationIndex2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4987                        struct samr_GetDisplayEnumerationIndex2 *r)
4988 {
4989         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
4990 }
4991
4992
4993 /*
4994   samr_QueryDisplayInfo3
4995 */
4996 static NTSTATUS dcesrv_samr_QueryDisplayInfo3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
4997                        struct samr_QueryDisplayInfo3 *r)
4998 {
4999         struct samr_QueryDisplayInfo q;
5000         NTSTATUS result;
5001
5002         q = (struct samr_QueryDisplayInfo) {
5003                 .in.domain_handle = r->in.domain_handle,
5004                 .in.level = r->in.level,
5005                 .in.start_idx = r->in.start_idx,
5006                 .in.max_entries = r->in.max_entries,
5007                 .in.buf_size = r->in.buf_size,
5008                 .out.total_size = r->out.total_size,
5009                 .out.returned_size = r->out.returned_size,
5010                 .out.info = r->out.info,
5011         };
5012
5013         result = dcesrv_samr_QueryDisplayInfo(dce_call, mem_ctx, &q);
5014
5015         return result;
5016 }
5017
5018
5019 /*
5020   samr_AddMultipleMembersToAlias
5021 */
5022 static NTSTATUS dcesrv_samr_AddMultipleMembersToAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5023                        struct samr_AddMultipleMembersToAlias *r)
5024 {
5025         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
5026 }
5027
5028
5029 /*
5030   samr_RemoveMultipleMembersFromAlias
5031 */
5032 static NTSTATUS dcesrv_samr_RemoveMultipleMembersFromAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5033                        struct samr_RemoveMultipleMembersFromAlias *r)
5034 {
5035         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
5036 }
5037
5038
5039 /*
5040   samr_GetDomPwInfo
5041
5042   this fetches the default password properties for a domain
5043
5044   note that w2k3 completely ignores the domain name in this call, and
5045   always returns the information for the servers primary domain
5046 */
5047 static NTSTATUS dcesrv_samr_GetDomPwInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5048                                   struct samr_GetDomPwInfo *r)
5049 {
5050         struct ldb_message **msgs;
5051         int ret;
5052         const char * const attrs[] = {"minPwdLength", "pwdProperties", NULL };
5053         struct ldb_context *sam_ctx;
5054
5055         ZERO_STRUCTP(r->out.info);
5056
5057         sam_ctx = dcesrv_samdb_connect_as_user(mem_ctx, dce_call);
5058         if (sam_ctx == NULL) {
5059                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
5060         }
5061
5062         /* The domain name in this call is ignored */
5063         ret = gendb_search_dn(sam_ctx,
5064                            mem_ctx, NULL, &msgs, attrs);
5065         if (ret <= 0) {
5066                 talloc_free(sam_ctx);
5067
5068                 return NT_STATUS_NO_SUCH_DOMAIN;
5069         }
5070         if (ret > 1) {
5071                 talloc_free(msgs);
5072                 talloc_free(sam_ctx);
5073
5074                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5075         }
5076
5077         r->out.info->min_password_length = ldb_msg_find_attr_as_uint(msgs[0],
5078                 "minPwdLength", 0);
5079         r->out.info->password_properties = ldb_msg_find_attr_as_uint(msgs[0],
5080                 "pwdProperties", 1);
5081
5082         talloc_free(msgs);
5083         talloc_unlink(mem_ctx, sam_ctx);
5084
5085         return NT_STATUS_OK;
5086 }
5087
5088
5089 /*
5090   samr_Connect2
5091 */
5092 static NTSTATUS dcesrv_samr_Connect2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5093                               struct samr_Connect2 *r)
5094 {
5095         struct samr_Connect c;
5096
5097         c = (struct samr_Connect) {
5098                 .in.system_name = NULL,
5099                 .in.access_mask = r->in.access_mask,
5100                 .out.connect_handle = r->out.connect_handle,
5101         };
5102
5103         return dcesrv_samr_Connect(dce_call, mem_ctx, &c);
5104 }
5105
5106
5107 /*
5108   samr_SetUserInfo2
5109
5110   just an alias for samr_SetUserInfo
5111 */
5112 static NTSTATUS dcesrv_samr_SetUserInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5113                                   struct samr_SetUserInfo2 *r)
5114 {
5115         struct samr_SetUserInfo r2;
5116
5117         r2 = (struct samr_SetUserInfo) {
5118                 .in.user_handle = r->in.user_handle,
5119                 .in.level = r->in.level,
5120                 .in.info = r->in.info,
5121         };
5122
5123         return dcesrv_samr_SetUserInfo(dce_call, mem_ctx, &r2);
5124 }
5125
5126
5127 /*
5128   samr_SetBootKeyInformation
5129 */
5130 static NTSTATUS dcesrv_samr_SetBootKeyInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5131                        struct samr_SetBootKeyInformation *r)
5132 {
5133         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
5134 }
5135
5136
5137 /*
5138   samr_GetBootKeyInformation
5139 */
5140 static NTSTATUS dcesrv_samr_GetBootKeyInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5141                        struct samr_GetBootKeyInformation *r)
5142 {
5143         /* Windows Server 2008 returns this */
5144         return NT_STATUS_NOT_SUPPORTED;
5145 }
5146
5147
5148 /*
5149   samr_Connect3
5150 */
5151 static NTSTATUS dcesrv_samr_Connect3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5152                        struct samr_Connect3 *r)
5153 {
5154         struct samr_Connect c;
5155
5156         c = (struct samr_Connect) {
5157                 .in.system_name = NULL,
5158                 .in.access_mask = r->in.access_mask,
5159                 .out.connect_handle = r->out.connect_handle,
5160         };
5161
5162         return dcesrv_samr_Connect(dce_call, mem_ctx, &c);
5163 }
5164
5165
5166 /*
5167   samr_Connect4
5168 */
5169 static NTSTATUS dcesrv_samr_Connect4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5170                        struct samr_Connect4 *r)
5171 {
5172         struct samr_Connect c;
5173
5174         c = (struct samr_Connect) {
5175                 .in.system_name = NULL,
5176                 .in.access_mask = r->in.access_mask,
5177                 .out.connect_handle = r->out.connect_handle,
5178         };
5179
5180         return dcesrv_samr_Connect(dce_call, mem_ctx, &c);
5181 }
5182
5183
5184 /*
5185   samr_Connect5
5186 */
5187 static NTSTATUS dcesrv_samr_Connect5(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5188                               struct samr_Connect5 *r)
5189 {
5190         struct samr_Connect c;
5191         NTSTATUS status;
5192
5193         c = (struct samr_Connect) {
5194                 .in.system_name = NULL,
5195                 .in.access_mask = r->in.access_mask,
5196                 .out.connect_handle = r->out.connect_handle,
5197         };
5198
5199         status = dcesrv_samr_Connect(dce_call, mem_ctx, &c);
5200
5201         r->out.info_out->info1.client_version = SAMR_CONNECT_AFTER_W2K;
5202         r->out.info_out->info1.supported_features = 0;
5203         *r->out.level_out = r->in.level_in;
5204
5205         return status;
5206 }
5207
5208
5209 /*
5210   samr_RidToSid
5211 */
5212 static NTSTATUS dcesrv_samr_RidToSid(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5213                               struct samr_RidToSid *r)
5214 {
5215         struct samr_domain_state *d_state;
5216         struct dcesrv_handle *h;
5217
5218         DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN);
5219
5220         d_state = h->data;
5221
5222         /* form the users SID */
5223         *r->out.sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid);
5224         if (!*r->out.sid) {
5225                 return NT_STATUS_NO_MEMORY;
5226         }
5227
5228         return NT_STATUS_OK;
5229 }
5230
5231
5232 /*
5233   samr_SetDsrmPassword
5234 */
5235 static NTSTATUS dcesrv_samr_SetDsrmPassword(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
5236                        struct samr_SetDsrmPassword *r)
5237 {
5238         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
5239 }
5240
5241
5242 /*
5243   samr_ValidatePassword
5244
5245   For now the call checks the password complexity (if active) and the minimum
5246   password length on level 2 and 3. Level 1 is ignored for now.
5247 */
5248 static NTSTATUS dcesrv_samr_ValidatePassword(struct dcesrv_call_state *dce_call,
5249                                              TALLOC_CTX *mem_ctx,
5250                                              struct samr_ValidatePassword *r)
5251 {
5252         struct samr_GetDomPwInfo r2 = {};
5253         struct samr_PwInfo pwInfo = {};
5254         const char *account = NULL;
5255         DATA_BLOB password;
5256         enum samr_ValidationStatus res;
5257         NTSTATUS status;
5258         enum dcerpc_transport_t transport =
5259                 dcerpc_binding_get_transport(dce_call->conn->endpoint->ep_description);
5260         enum dcerpc_AuthLevel auth_level = DCERPC_AUTH_LEVEL_NONE;
5261
5262         if (transport != NCACN_IP_TCP && transport != NCALRPC) {
5263                 DCESRV_FAULT(DCERPC_FAULT_ACCESS_DENIED);
5264         }
5265
5266         dcesrv_call_auth_info(dce_call, NULL, &auth_level);
5267         if (auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
5268                 DCESRV_FAULT(DCERPC_FAULT_ACCESS_DENIED);
5269         }
5270
5271         (*r->out.rep) = talloc_zero(mem_ctx, union samr_ValidatePasswordRep);
5272
5273         r2 = (struct samr_GetDomPwInfo) {
5274                 .in.domain_name = NULL,
5275                 .out.info = &pwInfo,
5276         };
5277
5278         status = dcesrv_samr_GetDomPwInfo(dce_call, mem_ctx, &r2);
5279         if (!NT_STATUS_IS_OK(status)) {
5280                 return status;
5281         }
5282
5283         switch (r->in.level) {
5284         case NetValidateAuthentication:
5285                 /* we don't support this yet */
5286                 return NT_STATUS_NOT_SUPPORTED;
5287         break;
5288         case NetValidatePasswordChange:
5289                 account = r->in.req->req2.account.string;
5290                 password = data_blob_const(r->in.req->req2.password.string,
5291                                            r->in.req->req2.password.length);
5292                 res = samdb_check_password(mem_ctx,
5293                                            dce_call->conn->dce_ctx->lp_ctx,
5294                                            account,
5295                                            NULL, /* userPrincipalName */
5296                                            NULL, /* displayName/full_name */
5297                                            &password,
5298                                            pwInfo.password_properties,
5299                                            pwInfo.min_password_length);
5300                 (*r->out.rep)->ctr2.status = res;
5301         break;
5302         case NetValidatePasswordReset:
5303                 account = r->in.req->req3.account.string;
5304                 password = data_blob_const(r->in.req->req3.password.string,
5305                                            r->in.req->req3.password.length);
5306                 res = samdb_check_password(mem_ctx,
5307                                            dce_call->conn->dce_ctx->lp_ctx,
5308                                            account,
5309                                            NULL, /* userPrincipalName */
5310                                            NULL, /* displayName/full_name */
5311                                            &password,
5312                                            pwInfo.password_properties,
5313                                            pwInfo.min_password_length);
5314                 (*r->out.rep)->ctr3.status = res;
5315         break;
5316         default:
5317                 return NT_STATUS_INVALID_INFO_CLASS;
5318         break;
5319         }
5320
5321         return NT_STATUS_OK;
5322 }
5323
5324 static void dcesrv_samr_Opnum68NotUsedOnWire(struct dcesrv_call_state *dce_call,
5325                                              TALLOC_CTX *mem_ctx,
5326                                              struct samr_Opnum68NotUsedOnWire *r)
5327 {
5328         DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR);
5329 }
5330
5331 static void dcesrv_samr_Opnum69NotUsedOnWire(struct dcesrv_call_state *dce_call,
5332                                              TALLOC_CTX *mem_ctx,
5333                                              struct samr_Opnum69NotUsedOnWire *r)
5334 {
5335         DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR);
5336 }
5337
5338 static void dcesrv_samr_Opnum70NotUsedOnWire(struct dcesrv_call_state *dce_call,
5339                                              TALLOC_CTX *mem_ctx,
5340                                              struct samr_Opnum70NotUsedOnWire *r)
5341 {
5342         DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR);
5343 }
5344
5345 static void dcesrv_samr_Opnum71NotUsedOnWire(struct dcesrv_call_state *dce_call,
5346                                              TALLOC_CTX *mem_ctx,
5347                                              struct samr_Opnum71NotUsedOnWire *r)
5348 {
5349         DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR);
5350 }
5351
5352 static void dcesrv_samr_Opnum72NotUsedOnWire(struct dcesrv_call_state *dce_call,
5353                                              TALLOC_CTX *mem_ctx,
5354                                              struct samr_Opnum72NotUsedOnWire *r)
5355 {
5356         DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR);
5357 }
5358
5359 /* include the generated boilerplate */
5360 #include "librpc/gen_ndr/ndr_samr_s.c"