source3/rpc_server/srv_lsa_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997,
   7  *  Copyright (C) Jeremy Allison                    2001, 2006.
   8  *  Copyright (C) Rafal Szczesniak                  2002,
   9  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
  10  *  Copyright (C) Simo Sorce                        2003.
  11  *  Copyright (C) Gerald (Jerry) Carter             2005.
  12  *  Copyright (C) Volker Lendecke                   2005.
  13  *  Copyright (C) Guenther Deschner                 2008.
  14  *
  15  *  This program is free software; you can redistribute it and/or modify
  16  *  it under the terms of the GNU General Public License as published by
  17  *  the Free Software Foundation; either version 3 of the License, or
  18  *  (at your option) any later version.
  19  *
  20  *  This program is distributed in the hope that it will be useful,
  21  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  *  GNU General Public License for more details.
  24  *
  25  *  You should have received a copy of the GNU General Public License
  26  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  27  */
  28
  29 /* This is the implementation of the lsa server code. */
  30
  31 #include "includes.h"
  32
  33 #undef DBGC_CLASS
  34 #define DBGC_CLASS DBGC_RPC_SRV
  35
  36 #define MAX_LOOKUP_SIDS 0x5000 /* 20480 */
  37
  38 extern PRIVS privs[];
  39
  40 enum lsa_handle_type { LSA_HANDLE_POLICY_TYPE = 1, LSA_HANDLE_ACCOUNT_TYPE };
  41
  42 struct lsa_info {
  43         DOM_SID sid;
  44         uint32 access;
  45         enum lsa_handle_type type;
  46 };
  47
  48 const struct generic_mapping lsa_account_mapping = {
  49         LSA_ACCOUNT_READ,
  50         LSA_ACCOUNT_WRITE,
  51         LSA_ACCOUNT_EXECUTE,
  52         LSA_ACCOUNT_ALL_ACCESS
  53 };
  54
  55 const struct generic_mapping lsa_policy_mapping = {
  56         LSA_POLICY_READ,
  57         LSA_POLICY_WRITE,
  58         LSA_POLICY_EXECUTE,
  59         LSA_POLICY_ALL_ACCESS
  60 };
  61
  62 /***************************************************************************
  63  init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
  64 ***************************************************************************/
  65
  66 static int init_lsa_ref_domain_list(TALLOC_CTX *mem_ctx,
  67                                     struct lsa_RefDomainList *ref,
  68                                     const char *dom_name,
  69                                     DOM_SID *dom_sid)
  70 {
  71         int num = 0;
  72
  73         if (dom_name != NULL) {
  74                 for (num = 0; num < ref->count; num++) {
  75                         if (sid_equal(dom_sid, ref->domains[num].sid)) {
  76                                 return num;
  77                         }
  78                 }
  79         } else {
  80                 num = ref->count;
  81         }
  82
  83         if (num >= LSA_REF_DOMAIN_LIST_MULTIPLIER) {
  84                 /* index not found, already at maximum domain limit */
  85                 return -1;
  86         }
  87
  88         ref->count = num + 1;
  89         ref->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER;
  90
  91         ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
  92                                             struct lsa_DomainInfo, ref->count);
  93         if (!ref->domains) {
  94                 return -1;
  95         }
  96
  97         ZERO_STRUCT(ref->domains[num]);
  98
  99         init_lsa_StringLarge(&ref->domains[num].name, dom_name);
 100         ref->domains[num].sid = sid_dup_talloc(mem_ctx, dom_sid);
 101         if (!ref->domains[num].sid) {
 102                 return -1;
 103         }
 104
 105         return num;
 106 }
 107
 108
 109 /***************************************************************************
 110  initialize a lsa_DomainInfo structure.
 111  ***************************************************************************/
 112
 113 static void init_dom_query_3(struct lsa_DomainInfo *r,
 114                              const char *name,
 115                              DOM_SID *sid)
 116 {
 117         init_lsa_StringLarge(&r->name, name);
 118         r->sid = sid;
 119 }
 120
 121 /***************************************************************************
 122  initialize a lsa_DomainInfo structure.
 123  ***************************************************************************/
 124
 125 static void init_dom_query_5(struct lsa_DomainInfo *r,
 126                              const char *name,
 127                              DOM_SID *sid)
 128 {
 129         init_lsa_StringLarge(&r->name, name);
 130         r->sid = sid;
 131 }
 132
 133 /***************************************************************************
 134  lookup_lsa_rids. Must be called as root for lookup_name to work.
 135  ***************************************************************************/
 136
 137 static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
 138                                 struct lsa_RefDomainList *ref,
 139                                 struct lsa_TranslatedSid *prid,
 140                                 uint32_t num_entries,
 141                                 struct lsa_String *name,
 142                                 int flags,
 143                                 uint32_t *pmapped_count)
 144 {
 145         uint32 mapped_count, i;
 146
 147         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 148
 149         mapped_count = 0;
 150         *pmapped_count = 0;
 151
 152         for (i = 0; i < num_entries; i++) {
 153                 DOM_SID sid;
 154                 uint32 rid;
 155                 int dom_idx;
 156                 const char *full_name;
 157                 const char *domain;
 158                 enum lsa_SidType type = SID_NAME_UNKNOWN;
 159
 160                 /* Split name into domain and user component */
 161
 162                 full_name = name[i].string;
 163                 if (full_name == NULL) {
 164                         return NT_STATUS_NO_MEMORY;
 165                 }
 166
 167                 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
 168
 169                 /* We can ignore the result of lookup_name, it will not touch
 170                    "type" if it's not successful */
 171
 172                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
 173                             &sid, &type);
 174
 175                 switch (type) {
 176                 case SID_NAME_USER:
 177                 case SID_NAME_DOM_GRP:
 178                 case SID_NAME_DOMAIN:
 179                 case SID_NAME_ALIAS:
 180                 case SID_NAME_WKN_GRP:
 181                         DEBUG(5, ("init_lsa_rids: %s found\n", full_name));
 182                         /* Leave these unchanged */
 183                         break;
 184                 default:
 185                         /* Don't hand out anything but the list above */
 186                         DEBUG(5, ("init_lsa_rids: %s not found\n", full_name));
 187                         type = SID_NAME_UNKNOWN;
 188                         break;
 189                 }
 190
 191                 rid = 0;
 192                 dom_idx = -1;
 193
 194                 if (type != SID_NAME_UNKNOWN) {
 195                         sid_split_rid(&sid, &rid);
 196                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &sid);
 197                         mapped_count++;
 198                 }
 199
 200                 prid[i].sid_type        = type;
 201                 prid[i].rid             = rid;
 202                 prid[i].sid_index       = dom_idx;
 203         }
 204
 205         *pmapped_count = mapped_count;
 206         return NT_STATUS_OK;
 207 }
 208
 209 /***************************************************************************
 210  lookup_lsa_sids. Must be called as root for lookup_name to work.
 211  ***************************************************************************/
 212
 213 static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
 214                                 struct lsa_RefDomainList *ref,
 215                                 struct lsa_TranslatedSid3 *trans_sids,
 216                                 uint32_t num_entries,
 217                                 struct lsa_String *name,
 218                                 int flags,
 219                                 uint32 *pmapped_count)
 220 {
 221         uint32 mapped_count, i;
 222
 223         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 224
 225         mapped_count = 0;
 226         *pmapped_count = 0;
 227
 228         for (i = 0; i < num_entries; i++) {
 229                 DOM_SID sid;
 230                 uint32 rid;
 231                 int dom_idx;
 232                 const char *full_name;
 233                 const char *domain;
 234                 enum lsa_SidType type = SID_NAME_UNKNOWN;
 235
 236                 ZERO_STRUCT(sid);
 237
 238                 /* Split name into domain and user component */
 239
 240                 full_name = name[i].string;
 241                 if (full_name == NULL) {
 242                         return NT_STATUS_NO_MEMORY;
 243                 }
 244
 245                 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
 246
 247                 /* We can ignore the result of lookup_name, it will not touch
 248                    "type" if it's not successful */
 249
 250                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
 251                             &sid, &type);
 252
 253                 switch (type) {
 254                 case SID_NAME_USER:
 255                 case SID_NAME_DOM_GRP:
 256                 case SID_NAME_DOMAIN:
 257                 case SID_NAME_ALIAS:
 258                 case SID_NAME_WKN_GRP:
 259                         DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
 260                         /* Leave these unchanged */
 261                         break;
 262                 default:
 263                         /* Don't hand out anything but the list above */
 264                         DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
 265                         type = SID_NAME_UNKNOWN;
 266                         break;
 267                 }
 268
 269                 rid = 0;
 270                 dom_idx = -1;
 271
 272                 if (type != SID_NAME_UNKNOWN) {
 273                         DOM_SID domain_sid;
 274                         sid_copy(&domain_sid, &sid);
 275                         sid_split_rid(&domain_sid, &rid);
 276                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &domain_sid);
 277                         mapped_count++;
 278                 }
 279
 280                 /* Initialize the lsa_TranslatedSid3 return. */
 281                 trans_sids[i].sid_type = type;
 282                 trans_sids[i].sid = sid_dup_talloc(mem_ctx, &sid);
 283                 trans_sids[i].sid_index = dom_idx;
 284         }
 285
 286         *pmapped_count = mapped_count;
 287         return NT_STATUS_OK;
 288 }
 289
 290 static NTSTATUS make_lsa_object_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size,
 291                                         const struct generic_mapping *map,
 292                                         DOM_SID *sid, uint32_t sid_access)
 293 {
 294         DOM_SID adm_sid;
 295         SEC_ACE ace[5];
 296         size_t i = 0;
 297
 298         SEC_ACL *psa = NULL;
 299
 300         /* READ|EXECUTE access for Everyone */
 301
 302         init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
 303                         map->generic_execute | map->generic_read, 0);
 304
 305         /* Add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 306
 307         init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
 308                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 309         init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
 310                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 311
 312         /* Add Full Access for Domain Admins */
 313         sid_copy(&adm_sid, get_global_sam_sid());
 314         sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
 315         init_sec_ace(&ace[i++], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
 316                         map->generic_all, 0);
 317
 318         /* If we have a sid, give it some special access */
 319
 320         if (sid) {
 321                 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
 322                         sid_access, 0);
 323         }
 324
 325         if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, i, ace)) == NULL)
 326                 return NT_STATUS_NO_MEMORY;
 327
 328         if((*sd = make_sec_desc(mem_ctx, SECURITY_DESCRIPTOR_REVISION_1,
 329                                 SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL,
 330                                 psa, sd_size)) == NULL)
 331                 return NT_STATUS_NO_MEMORY;
 332
 333         return NT_STATUS_OK;
 334 }
 335
 336
 337 /***************************************************************************
 338  _lsa_OpenPolicy2
 339  ***************************************************************************/
 340
 341 NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
 342                           struct lsa_OpenPolicy2 *r)
 343 {
 344         struct lsa_info *info;
 345         SEC_DESC *psd = NULL;
 346         size_t sd_size;
 347         uint32 des_access = r->in.access_mask;
 348         uint32 acc_granted;
 349         NTSTATUS status;
 350
 351         /* Work out max allowed. */
 352         map_max_allowed_access(p->server_info->ptok,
 353                                &p->server_info->utok,
 354                                &des_access);
 355
 356         /* map the generic bits to the lsa policy ones */
 357         se_map_generic(&des_access, &lsa_policy_mapping);
 358
 359         /* get the generic lsa policy SD until we store it */
 360         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size, &lsa_policy_mapping,
 361                         NULL, 0);
 362         if (!NT_STATUS_IS_OK(status)) {
 363                 return status;
 364         }
 365
 366         status = access_check_object(psd, p->server_info->ptok,
 367                 NULL, 0, des_access,
 368                 &acc_granted, "_lsa_OpenPolicy2" );
 369
 370         if (!NT_STATUS_IS_OK(status)) {
 371                 return status;
 372         }
 373
 374         /* associate the domain SID with the (unique) handle. */
 375         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
 376         if (info == NULL) {
 377                 return NT_STATUS_NO_MEMORY;
 378         }
 379
 380         sid_copy(&info->sid,get_global_sam_sid());
 381         info->access = acc_granted;
 382         info->type = LSA_HANDLE_POLICY_TYPE;
 383
 384         /* set up the LSA QUERY INFO response */
 385         if (!create_policy_hnd(p, r->out.handle, info))
 386                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 387
 388         return NT_STATUS_OK;
 389 }
 390
 391 /***************************************************************************
 392  _lsa_OpenPolicy
 393  ***************************************************************************/
 394
 395 NTSTATUS _lsa_OpenPolicy(pipes_struct *p,
 396                          struct lsa_OpenPolicy *r)
 397 {
 398         struct lsa_OpenPolicy2 o;
 399
 400         o.in.system_name        = NULL; /* should be ignored */
 401         o.in.attr               = r->in.attr;
 402         o.in.access_mask        = r->in.access_mask;
 403
 404         o.out.handle            = r->out.handle;
 405
 406         return _lsa_OpenPolicy2(p, &o);
 407 }
 408
 409 /***************************************************************************
 410  _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
 411  ufff, done :)  mimir
 412  ***************************************************************************/
 413
 414 NTSTATUS _lsa_EnumTrustDom(pipes_struct *p,
 415                            struct lsa_EnumTrustDom *r)
 416 {
 417         struct lsa_info *info;
 418         uint32 next_idx;
 419         struct trustdom_info **domains;
 420         struct lsa_DomainInfo *lsa_domains = NULL;
 421         int i;
 422
 423         /*
 424          * preferred length is set to 5 as a "our" preferred length
 425          * nt sets this parameter to 2
 426          * update (20.08.2002): it's not preferred length, but preferred size!
 427          * it needs further investigation how to optimally choose this value
 428          */
 429         uint32 max_num_domains =
 430                 r->in.max_size < 5 ? r->in.max_size : 10;
 431         uint32 num_domains;
 432         NTSTATUS nt_status;
 433         uint32 num_thistime;
 434
 435         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
 436                 return NT_STATUS_INVALID_HANDLE;
 437
 438         if (info->type != LSA_HANDLE_POLICY_TYPE) {
 439                 return NT_STATUS_INVALID_HANDLE;
 440         }
 441
 442         /* check if the user has enough rights */
 443         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 444                 return NT_STATUS_ACCESS_DENIED;
 445
 446         become_root();
 447         nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
 448         unbecome_root();
 449
 450         if (!NT_STATUS_IS_OK(nt_status)) {
 451                 return nt_status;
 452         }
 453
 454         if (*r->in.resume_handle < num_domains) {
 455                 num_thistime = MIN(num_domains, max_num_domains);
 456
 457                 nt_status = STATUS_MORE_ENTRIES;
 458
 459                 if (*r->in.resume_handle + num_thistime > num_domains) {
 460                         num_thistime = num_domains - *r->in.resume_handle;
 461                         nt_status = NT_STATUS_OK;
 462                 }
 463
 464                 next_idx = *r->in.resume_handle + num_thistime;
 465         } else {
 466                 num_thistime = 0;
 467                 next_idx = 0xffffffff;
 468                 nt_status = NT_STATUS_NO_MORE_ENTRIES;
 469         }
 470
 471         /* set up the lsa_enum_trust_dom response */
 472
 473         lsa_domains = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_DomainInfo,
 474                                         num_thistime);
 475         if (!lsa_domains) {
 476                 return NT_STATUS_NO_MEMORY;
 477         }
 478
 479         for (i=0; i<num_thistime; i++) {
 480                 init_lsa_StringLarge(&lsa_domains[i].name, domains[i]->name);
 481                 lsa_domains[i].sid = &domains[i]->sid;
 482         }
 483
 484         *r->out.resume_handle = next_idx;
 485         r->out.domains->count = num_thistime;
 486         r->out.domains->domains = lsa_domains;
 487
 488         return nt_status;
 489 }
 490
 491 #define LSA_AUDIT_NUM_CATEGORIES_NT4    7
 492 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K  9
 493 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
 494
 495 /***************************************************************************
 496  _lsa_QueryInfoPolicy
 497  ***************************************************************************/
 498
 499 NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
 500                               struct lsa_QueryInfoPolicy *r)
 501 {
 502         NTSTATUS status = NT_STATUS_OK;
 503         struct lsa_info *handle;
 504         DOM_SID domain_sid;
 505         const char *name;
 506         DOM_SID *sid = NULL;
 507         union lsa_PolicyInformation *info = NULL;
 508         uint32_t acc_required = 0;
 509
 510         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
 511                 return NT_STATUS_INVALID_HANDLE;
 512
 513         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
 514                 return NT_STATUS_INVALID_HANDLE;
 515         }
 516
 517         switch (r->in.level) {
 518         case LSA_POLICY_INFO_AUDIT_LOG:
 519         case LSA_POLICY_INFO_AUDIT_EVENTS:
 520                 acc_required = LSA_POLICY_VIEW_AUDIT_INFORMATION;
 521                 break;
 522         case LSA_POLICY_INFO_DOMAIN:
 523                 acc_required = LSA_POLICY_VIEW_LOCAL_INFORMATION;
 524                 break;
 525         case LSA_POLICY_INFO_PD:
 526                 acc_required = LSA_POLICY_GET_PRIVATE_INFORMATION;
 527                 break;
 528         case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
 529                 acc_required = LSA_POLICY_VIEW_LOCAL_INFORMATION;
 530                 break;
 531         case LSA_POLICY_INFO_ROLE:
 532         case LSA_POLICY_INFO_REPLICA:
 533                 acc_required = LSA_POLICY_VIEW_LOCAL_INFORMATION;
 534                 break;
 535         case LSA_POLICY_INFO_QUOTA:
 536                 acc_required = LSA_POLICY_VIEW_LOCAL_INFORMATION;
 537                 break;
 538         case LSA_POLICY_INFO_MOD:
 539         case LSA_POLICY_INFO_AUDIT_FULL_SET:
 540                 /* according to MS-LSAD 3.1.4.4.3 */
 541                 return NT_STATUS_INVALID_PARAMETER;
 542         case LSA_POLICY_INFO_AUDIT_FULL_QUERY:
 543                 acc_required = LSA_POLICY_VIEW_AUDIT_INFORMATION;
 544                 break;
 545         case LSA_POLICY_INFO_DNS:
 546         case LSA_POLICY_INFO_DNS_INT:
 547         case LSA_POLICY_INFO_L_ACCOUNT_DOMAIN:
 548                 acc_required = LSA_POLICY_VIEW_LOCAL_INFORMATION;
 549                 break;
 550         default:
 551                 break;
 552         }
 553
 554         if (!(handle->access & acc_required)) {
 555                 /* return NT_STATUS_ACCESS_DENIED; */
 556         }
 557
 558         info = TALLOC_ZERO_P(p->mem_ctx, union lsa_PolicyInformation);
 559         if (!info) {
 560                 return NT_STATUS_NO_MEMORY;
 561         }
 562
 563         switch (r->in.level) {
 564         case LSA_POLICY_INFO_AUDIT_EVENTS:
 565                 {
 566
 567                 uint32 policy_def = LSA_AUDIT_POLICY_ALL;
 568
 569                 /* check if the user has enough rights */
 570                 if (!(handle->access & LSA_POLICY_VIEW_AUDIT_INFORMATION)) {
 571                         DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
 572                         return NT_STATUS_ACCESS_DENIED;
 573                 }
 574
 575                 /* fake info: We audit everything. ;) */
 576
 577                 info->audit_events.auditing_mode = true;
 578                 info->audit_events.count = LSA_AUDIT_NUM_CATEGORIES;
 579                 info->audit_events.settings = TALLOC_ZERO_ARRAY(p->mem_ctx,
 580                                                                 enum lsa_PolicyAuditPolicy,
 581                                                                 info->audit_events.count);
 582                 if (!info->audit_events.settings) {
 583                         return NT_STATUS_NO_MEMORY;
 584                 }
 585
 586                 info->audit_events.settings[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT] = policy_def;
 587                 info->audit_events.settings[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS] = policy_def;
 588                 info->audit_events.settings[LSA_AUDIT_CATEGORY_LOGON] = policy_def;
 589                 info->audit_events.settings[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING] = policy_def;
 590                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES] = policy_def;
 591                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SYSTEM] = policy_def;
 592                 info->audit_events.settings[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS] = policy_def;
 593
 594                 break;
 595                 }
 596         case LSA_POLICY_INFO_DOMAIN:
 597                 /* check if the user has enough rights */
 598                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 599                         return NT_STATUS_ACCESS_DENIED;
 600
 601                 /* Request PolicyPrimaryDomainInformation. */
 602                 switch (lp_server_role()) {
 603                         case ROLE_DOMAIN_PDC:
 604                         case ROLE_DOMAIN_BDC:
 605                                 name = get_global_sam_name();
 606                                 sid = sid_dup_talloc(p->mem_ctx, get_global_sam_sid());
 607                                 if (!sid) {
 608                                         return NT_STATUS_NO_MEMORY;
 609                                 }
 610                                 break;
 611                         case ROLE_DOMAIN_MEMBER:
 612                                 name = lp_workgroup();
 613                                 /* We need to return the Domain SID here. */
 614                                 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
 615                                         sid = sid_dup_talloc(p->mem_ctx, &domain_sid);
 616                                         if (!sid) {
 617                                                 return NT_STATUS_NO_MEMORY;
 618                                         }
 619                                 } else {
 620                                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 621                                 }
 622                                 break;
 623                         case ROLE_STANDALONE:
 624                                 name = lp_workgroup();
 625                                 sid = NULL;
 626                                 break;
 627                         default:
 628                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 629                 }
 630                 init_dom_query_3(&info->domain, name, sid);
 631                 break;
 632         case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
 633                 /* check if the user has enough rights */
 634                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 635                         return NT_STATUS_ACCESS_DENIED;
 636
 637                 /* Request PolicyAccountDomainInformation. */
 638                 name = get_global_sam_name();
 639                 sid = get_global_sam_sid();
 640
 641                 init_dom_query_5(&info->account_domain, name, sid);
 642                 break;
 643         case LSA_POLICY_INFO_ROLE:
 644                 /* check if the user has enough rights */
 645                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 646                         return NT_STATUS_ACCESS_DENIED;
 647
 648                 switch (lp_server_role()) {
 649                         case ROLE_DOMAIN_BDC:
 650                                 /*
 651                                  * only a BDC is a backup controller
 652                                  * of the domain, it controls.
 653                                  */
 654                                 info->role.role = LSA_ROLE_BACKUP;
 655                                 break;
 656                         default:
 657                                 /*
 658                                  * any other role is a primary
 659                                  * of the domain, it controls.
 660                                  */
 661                                 info->role.role = LSA_ROLE_PRIMARY;
 662                                 break;
 663                 }
 664                 break;
 665         case LSA_POLICY_INFO_DNS:
 666         case LSA_POLICY_INFO_DNS_INT: {
 667                 struct pdb_domain_info *dominfo;
 668
 669                 if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
 670                         DEBUG(10, ("Not replying to LSA_POLICY_INFO_DNS "
 671                                    "without ADS passdb backend\n"));
 672                         status = NT_STATUS_INVALID_INFO_CLASS;
 673                         break;
 674                 }
 675
 676                 dominfo = pdb_get_domain_info(info);
 677                 if (dominfo == NULL) {
 678                         status = NT_STATUS_NO_MEMORY;
 679                         break;
 680                 }
 681
 682                 init_lsa_StringLarge(&info->dns.name,
 683                                      dominfo->name);
 684                 init_lsa_StringLarge(&info->dns.dns_domain,
 685                                      dominfo->dns_domain);
 686                 init_lsa_StringLarge(&info->dns.dns_forest,
 687                                      dominfo->dns_forest);
 688                 info->dns.domain_guid = dominfo->guid;
 689                 info->dns.sid = &dominfo->sid;
 690                 break;
 691         }
 692         default:
 693                 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
 694                         r->in.level));
 695                 status = NT_STATUS_INVALID_INFO_CLASS;
 696                 break;
 697         }
 698
 699         *r->out.info = info;
 700
 701         return status;
 702 }
 703
 704 /***************************************************************************
 705  _lsa_QueryInfoPolicy2
 706  ***************************************************************************/
 707
 708 NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p,
 709                                struct lsa_QueryInfoPolicy2 *r2)
 710 {
 711         struct lsa_QueryInfoPolicy r;
 712
 713         if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
 714                 p->rng_fault_state = True;
 715                 return NT_STATUS_NOT_IMPLEMENTED;
 716         }
 717
 718         ZERO_STRUCT(r);
 719         r.in.handle = r2->in.handle;
 720         r.in.level = r2->in.level;
 721         r.out.info = r2->out.info;
 722
 723         return _lsa_QueryInfoPolicy(p, &r);
 724 }
 725
 726 /***************************************************************************
 727  _lsa_lookup_sids_internal
 728  ***************************************************************************/
 729
 730 static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
 731                                           TALLOC_CTX *mem_ctx,
 732                                           uint16_t level,                       /* input */
 733                                           int num_sids,                         /* input */
 734                                           struct lsa_SidPtr *sid,               /* input */
 735                                           struct lsa_RefDomainList **pp_ref,    /* input/output */
 736                                           struct lsa_TranslatedName2 **pp_names,/* input/output */
 737                                           uint32_t *pp_mapped_count)            /* input/output */
 738 {
 739         NTSTATUS status;
 740         int i;
 741         const DOM_SID **sids = NULL;
 742         struct lsa_RefDomainList *ref = NULL;
 743         uint32 mapped_count = 0;
 744         struct lsa_dom_info *dom_infos = NULL;
 745         struct lsa_name_info *name_infos = NULL;
 746         struct lsa_TranslatedName2 *names = NULL;
 747
 748         *pp_mapped_count = 0;
 749         *pp_names = NULL;
 750         *pp_ref = NULL;
 751
 752         if (num_sids == 0) {
 753                 return NT_STATUS_OK;
 754         }
 755
 756         sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
 757         ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
 758
 759         if (sids == NULL || ref == NULL) {
 760                 return NT_STATUS_NO_MEMORY;
 761         }
 762
 763         for (i=0; i<num_sids; i++) {
 764                 sids[i] = sid[i].sid;
 765         }
 766
 767         status = lookup_sids(p->mem_ctx, num_sids, sids, level,
 768                                   &dom_infos, &name_infos);
 769
 770         if (!NT_STATUS_IS_OK(status)) {
 771                 return status;
 772         }
 773
 774         names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
 775         if (names == NULL) {
 776                 return NT_STATUS_NO_MEMORY;
 777         }
 778
 779         for (i=0; i<LSA_REF_DOMAIN_LIST_MULTIPLIER; i++) {
 780
 781                 if (!dom_infos[i].valid) {
 782                         break;
 783                 }
 784
 785                 if (init_lsa_ref_domain_list(mem_ctx, ref,
 786                                              dom_infos[i].name,
 787                                              &dom_infos[i].sid) != i) {
 788                         DEBUG(0, ("Domain %s mentioned twice??\n",
 789                                   dom_infos[i].name));
 790                         return NT_STATUS_INTERNAL_ERROR;
 791                 }
 792         }
 793
 794         for (i=0; i<num_sids; i++) {
 795                 struct lsa_name_info *name = &name_infos[i];
 796
 797                 if (name->type == SID_NAME_UNKNOWN) {
 798                         fstring tmp;
 799                         name->dom_idx = -1;
 800                         /* Unknown sids should return the string
 801                          * representation of the SID. Windows 2003 behaves
 802                          * rather erratic here, in many cases it returns the
 803                          * RID as 8 bytes hex, in others it returns the full
 804                          * SID. We (Jerry/VL) could not figure out which the
 805                          * hard cases are, so leave it with the SID.  */
 806                         name->name = talloc_asprintf(p->mem_ctx, "%s",
 807                                                      sid_to_fstring(tmp,
 808                                                                     sids[i]));
 809                         if (name->name == NULL) {
 810                                 return NT_STATUS_NO_MEMORY;
 811                         }
 812                 } else {
 813                         mapped_count += 1;
 814                 }
 815
 816                 names[i].sid_type       = name->type;
 817                 names[i].name.string    = name->name;
 818                 names[i].sid_index      = name->dom_idx;
 819                 names[i].unknown        = 0;
 820         }
 821
 822         status = NT_STATUS_NONE_MAPPED;
 823         if (mapped_count > 0) {
 824                 status = (mapped_count < num_sids) ?
 825                         STATUS_SOME_UNMAPPED : NT_STATUS_OK;
 826         }
 827
 828         DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
 829                    num_sids, mapped_count, nt_errstr(status)));
 830
 831         *pp_mapped_count = mapped_count;
 832         *pp_names = names;
 833         *pp_ref = ref;
 834
 835         return status;
 836 }
 837
 838 /***************************************************************************
 839  _lsa_LookupSids
 840  ***************************************************************************/
 841
 842 NTSTATUS _lsa_LookupSids(pipes_struct *p,
 843                          struct lsa_LookupSids *r)
 844 {
 845         NTSTATUS status;
 846         struct lsa_info *handle;
 847         int num_sids = r->in.sids->num_sids;
 848         uint32 mapped_count = 0;
 849         struct lsa_RefDomainList *domains = NULL;
 850         struct lsa_TranslatedName *names_out = NULL;
 851         struct lsa_TranslatedName2 *names = NULL;
 852         int i;
 853
 854         if ((r->in.level < 1) || (r->in.level > 6)) {
 855                 return NT_STATUS_INVALID_PARAMETER;
 856         }
 857
 858         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
 859                 return NT_STATUS_INVALID_HANDLE;
 860         }
 861
 862         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
 863                 return NT_STATUS_INVALID_HANDLE;
 864         }
 865
 866         /* check if the user has enough rights */
 867         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
 868                 return NT_STATUS_ACCESS_DENIED;
 869         }
 870
 871         if (num_sids >  MAX_LOOKUP_SIDS) {
 872                 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
 873                          MAX_LOOKUP_SIDS, num_sids));
 874                 return NT_STATUS_NONE_MAPPED;
 875         }
 876
 877         status = _lsa_lookup_sids_internal(p,
 878                                            p->mem_ctx,
 879                                            r->in.level,
 880                                            num_sids,
 881                                            r->in.sids->sids,
 882                                            &domains,
 883                                            &names,
 884                                            &mapped_count);
 885
 886         /* Only return here when there is a real error.
 887            NT_STATUS_NONE_MAPPED is a special case as it indicates that none of
 888            the requested sids could be resolved. Older versions of XP (pre SP3)
 889            rely that we return with the string representations of those SIDs in
 890            that case. If we don't, XP crashes - Guenther
 891            */
 892
 893         if (NT_STATUS_IS_ERR(status) &&
 894             !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
 895                 return status;
 896         }
 897
 898         /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
 899         names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
 900                                  num_sids);
 901         if (!names_out) {
 902                 return NT_STATUS_NO_MEMORY;
 903         }
 904
 905         for (i=0; i<num_sids; i++) {
 906                 names_out[i].sid_type = names[i].sid_type;
 907                 names_out[i].name = names[i].name;
 908                 names_out[i].sid_index = names[i].sid_index;
 909         }
 910
 911         *r->out.domains = domains;
 912         r->out.names->count = num_sids;
 913         r->out.names->names = names_out;
 914         *r->out.count = mapped_count;
 915
 916         return status;
 917 }
 918
 919 /***************************************************************************
 920  _lsa_LookupSids2
 921  ***************************************************************************/
 922
 923 NTSTATUS _lsa_LookupSids2(pipes_struct *p,
 924                           struct lsa_LookupSids2 *r)
 925 {
 926         NTSTATUS status;
 927         struct lsa_info *handle;
 928         int num_sids = r->in.sids->num_sids;
 929         uint32 mapped_count = 0;
 930         struct lsa_RefDomainList *domains = NULL;
 931         struct lsa_TranslatedName2 *names = NULL;
 932         bool check_policy = true;
 933
 934         switch (p->hdr_req.opnum) {
 935                 case NDR_LSA_LOOKUPSIDS3:
 936                         check_policy = false;
 937                         break;
 938                 case NDR_LSA_LOOKUPSIDS2:
 939                 default:
 940                         check_policy = true;
 941         }
 942
 943         if ((r->in.level < 1) || (r->in.level > 6)) {
 944                 return NT_STATUS_INVALID_PARAMETER;
 945         }
 946
 947         if (check_policy) {
 948                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
 949                         return NT_STATUS_INVALID_HANDLE;
 950                 }
 951
 952                 if (handle->type != LSA_HANDLE_POLICY_TYPE) {
 953                         return NT_STATUS_INVALID_HANDLE;
 954                 }
 955
 956                 /* check if the user has enough rights */
 957                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
 958                         return NT_STATUS_ACCESS_DENIED;
 959                 }
 960         }
 961
 962         if (num_sids >  MAX_LOOKUP_SIDS) {
 963                 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
 964                          MAX_LOOKUP_SIDS, num_sids));
 965                 return NT_STATUS_NONE_MAPPED;
 966         }
 967
 968         status = _lsa_lookup_sids_internal(p,
 969                                            p->mem_ctx,
 970                                            r->in.level,
 971                                            num_sids,
 972                                            r->in.sids->sids,
 973                                            &domains,
 974                                            &names,
 975                                            &mapped_count);
 976
 977         *r->out.domains = domains;
 978         r->out.names->count = num_sids;
 979         r->out.names->names = names;
 980         *r->out.count = mapped_count;
 981
 982         return status;
 983 }
 984
 985 /***************************************************************************
 986  _lsa_LookupSids3
 987  ***************************************************************************/
 988
 989 NTSTATUS _lsa_LookupSids3(pipes_struct *p,
 990                           struct lsa_LookupSids3 *r)
 991 {
 992         struct lsa_LookupSids2 q;
 993
 994         /* No policy handle on this call. Restrict to crypto connections. */
 995         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
 996                 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
 997                         get_remote_machine_name() ));
 998                 return NT_STATUS_INVALID_PARAMETER;
 999         }
1000
1001         q.in.handle             = NULL;
1002         q.in.sids               = r->in.sids;
1003         q.in.level              = r->in.level;
1004         q.in.unknown1           = r->in.unknown1;
1005         q.in.unknown2           = r->in.unknown2;
1006         q.in.names              = r->in.names;
1007         q.in.count              = r->in.count;
1008
1009         q.out.domains           = r->out.domains;
1010         q.out.names             = r->out.names;
1011         q.out.count             = r->out.count;
1012
1013         return _lsa_LookupSids2(p, &q);
1014 }
1015
1016 /***************************************************************************
1017  ***************************************************************************/
1018
1019 static int lsa_lookup_level_to_flags(uint16 level)
1020 {
1021         int flags;
1022
1023         switch (level) {
1024                 case 1:
1025                         flags = LOOKUP_NAME_ALL;
1026                         break;
1027                 case 2:
1028                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_REMOTE|LOOKUP_NAME_ISOLATED;
1029                         break;
1030                 case 3:
1031                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED;
1032                         break;
1033                 case 4:
1034                 case 5:
1035                 case 6:
1036                 default:
1037                         flags = LOOKUP_NAME_NONE;
1038                         break;
1039         }
1040
1041         return flags;
1042 }
1043
1044 /***************************************************************************
1045  _lsa_LookupNames
1046  ***************************************************************************/
1047
1048 NTSTATUS _lsa_LookupNames(pipes_struct *p,
1049                           struct lsa_LookupNames *r)
1050 {
1051         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1052         struct lsa_info *handle;
1053         struct lsa_String *names = r->in.names;
1054         uint32 num_entries = r->in.num_names;
1055         struct lsa_RefDomainList *domains = NULL;
1056         struct lsa_TranslatedSid *rids = NULL;
1057         uint32 mapped_count = 0;
1058         int flags = 0;
1059
1060         if (num_entries >  MAX_LOOKUP_SIDS) {
1061                 num_entries = MAX_LOOKUP_SIDS;
1062                 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
1063                         num_entries));
1064         }
1065
1066         flags = lsa_lookup_level_to_flags(r->in.level);
1067
1068         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1069         if (!domains) {
1070                 return NT_STATUS_NO_MEMORY;
1071         }
1072
1073         if (num_entries) {
1074                 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid,
1075                                          num_entries);
1076                 if (!rids) {
1077                         return NT_STATUS_NO_MEMORY;
1078                 }
1079         } else {
1080                 rids = NULL;
1081         }
1082
1083         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1084                 status = NT_STATUS_INVALID_HANDLE;
1085                 goto done;
1086         }
1087
1088         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1089                 return NT_STATUS_INVALID_HANDLE;
1090         }
1091
1092         /* check if the user has enough rights */
1093         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1094                 status = NT_STATUS_ACCESS_DENIED;
1095                 goto done;
1096         }
1097
1098         /* set up the LSA Lookup RIDs response */
1099         become_root(); /* lookup_name can require root privs */
1100         status = lookup_lsa_rids(p->mem_ctx, domains, rids, num_entries,
1101                                  names, flags, &mapped_count);
1102         unbecome_root();
1103
1104 done:
1105
1106         if (NT_STATUS_IS_OK(status) && (num_entries != 0) ) {
1107                 if (mapped_count == 0) {
1108                         status = NT_STATUS_NONE_MAPPED;
1109                 } else if (mapped_count != num_entries) {
1110                         status = STATUS_SOME_UNMAPPED;
1111                 }
1112         }
1113
1114         *r->out.count = mapped_count;
1115         *r->out.domains = domains;
1116         r->out.sids->sids = rids;
1117         r->out.sids->count = num_entries;
1118
1119         return status;
1120 }
1121
1122 /***************************************************************************
1123  _lsa_LookupNames2
1124  ***************************************************************************/
1125
1126 NTSTATUS _lsa_LookupNames2(pipes_struct *p,
1127                            struct lsa_LookupNames2 *r)
1128 {
1129         NTSTATUS status;
1130         struct lsa_LookupNames q;
1131         struct lsa_TransSidArray2 *sid_array2 = r->in.sids;
1132         struct lsa_TransSidArray *sid_array = NULL;
1133         uint32_t i;
1134
1135         sid_array = TALLOC_ZERO_P(p->mem_ctx, struct lsa_TransSidArray);
1136         if (!sid_array) {
1137                 return NT_STATUS_NO_MEMORY;
1138         }
1139
1140         q.in.handle             = r->in.handle;
1141         q.in.num_names          = r->in.num_names;
1142         q.in.names              = r->in.names;
1143         q.in.level              = r->in.level;
1144         q.in.sids               = sid_array;
1145         q.in.count              = r->in.count;
1146         /* we do not know what this is for */
1147         /*                      = r->in.unknown1; */
1148         /*                      = r->in.unknown2; */
1149
1150         q.out.domains           = r->out.domains;
1151         q.out.sids              = sid_array;
1152         q.out.count             = r->out.count;
1153
1154         status = _lsa_LookupNames(p, &q);
1155
1156         sid_array2->count = sid_array->count;
1157         sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
1158         if (!sid_array2->sids) {
1159                 return NT_STATUS_NO_MEMORY;
1160         }
1161
1162         for (i=0; i<sid_array->count; i++) {
1163                 sid_array2->sids[i].sid_type  = sid_array->sids[i].sid_type;
1164                 sid_array2->sids[i].rid       = sid_array->sids[i].rid;
1165                 sid_array2->sids[i].sid_index = sid_array->sids[i].sid_index;
1166                 sid_array2->sids[i].unknown   = 0;
1167         }
1168
1169         r->out.sids = sid_array2;
1170
1171         return status;
1172 }
1173
1174 /***************************************************************************
1175  _lsa_LookupNames3
1176  ***************************************************************************/
1177
1178 NTSTATUS _lsa_LookupNames3(pipes_struct *p,
1179                            struct lsa_LookupNames3 *r)
1180 {
1181         NTSTATUS status;
1182         struct lsa_info *handle;
1183         struct lsa_String *names = r->in.names;
1184         uint32 num_entries = r->in.num_names;
1185         struct lsa_RefDomainList *domains = NULL;
1186         struct lsa_TranslatedSid3 *trans_sids = NULL;
1187         uint32 mapped_count = 0;
1188         int flags = 0;
1189         bool check_policy = true;
1190
1191         switch (p->hdr_req.opnum) {
1192                 case NDR_LSA_LOOKUPNAMES4:
1193                         check_policy = false;
1194                         break;
1195                 case NDR_LSA_LOOKUPNAMES3:
1196                 default:
1197                         check_policy = true;
1198         }
1199
1200         if (num_entries >  MAX_LOOKUP_SIDS) {
1201                 num_entries = MAX_LOOKUP_SIDS;
1202                 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries));
1203         }
1204
1205         /* Probably the lookup_level is some sort of bitmask. */
1206         if (r->in.level == 1) {
1207                 flags = LOOKUP_NAME_ALL;
1208         }
1209
1210         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1211         if (!domains) {
1212                 return NT_STATUS_NO_MEMORY;
1213         }
1214
1215         if (num_entries) {
1216                 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid3,
1217                                                num_entries);
1218                 if (!trans_sids) {
1219                         return NT_STATUS_NO_MEMORY;
1220                 }
1221         } else {
1222                 trans_sids = NULL;
1223         }
1224
1225         if (check_policy) {
1226
1227                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1228                         status = NT_STATUS_INVALID_HANDLE;
1229                         goto done;
1230                 }
1231
1232                 if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1233                         return NT_STATUS_INVALID_HANDLE;
1234                 }
1235
1236                 /* check if the user has enough rights */
1237                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1238                         status = NT_STATUS_ACCESS_DENIED;
1239                         goto done;
1240                 }
1241         }
1242
1243         /* set up the LSA Lookup SIDs response */
1244         become_root(); /* lookup_name can require root privs */
1245         status = lookup_lsa_sids(p->mem_ctx, domains, trans_sids, num_entries,
1246                                  names, flags, &mapped_count);
1247         unbecome_root();
1248
1249 done:
1250
1251         if (NT_STATUS_IS_OK(status)) {
1252                 if (mapped_count == 0) {
1253                         status = NT_STATUS_NONE_MAPPED;
1254                 } else if (mapped_count != num_entries) {
1255                         status = STATUS_SOME_UNMAPPED;
1256                 }
1257         }
1258
1259         *r->out.count = mapped_count;
1260         *r->out.domains = domains;
1261         r->out.sids->sids = trans_sids;
1262         r->out.sids->count = num_entries;
1263
1264         return status;
1265 }
1266
1267 /***************************************************************************
1268  _lsa_LookupNames4
1269  ***************************************************************************/
1270
1271 NTSTATUS _lsa_LookupNames4(pipes_struct *p,
1272                            struct lsa_LookupNames4 *r)
1273 {
1274         struct lsa_LookupNames3 q;
1275
1276         /* No policy handle on this call. Restrict to crypto connections. */
1277         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1278                 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1279                         get_remote_machine_name() ));
1280                 return NT_STATUS_INVALID_PARAMETER;
1281         }
1282
1283         q.in.handle             = NULL;
1284         q.in.num_names          = r->in.num_names;
1285         q.in.names              = r->in.names;
1286         q.in.level              = r->in.level;
1287         q.in.lookup_options     = r->in.lookup_options;
1288         q.in.client_revision    = r->in.client_revision;
1289         q.in.sids               = r->in.sids;
1290         q.in.count              = r->in.count;
1291
1292         q.out.domains           = r->out.domains;
1293         q.out.sids              = r->out.sids;
1294         q.out.count             = r->out.count;
1295
1296         return _lsa_LookupNames3(p, &q);
1297 }
1298
1299 /***************************************************************************
1300  _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1301  ***************************************************************************/
1302
1303 NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
1304 {
1305         if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
1306                 return NT_STATUS_INVALID_HANDLE;
1307         }
1308
1309         close_policy_hnd(p, r->in.handle);
1310         ZERO_STRUCTP(r->out.handle);
1311         return NT_STATUS_OK;
1312 }
1313
1314 /***************************************************************************
1315  ***************************************************************************/
1316
1317 NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
1318 {
1319         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1320 }
1321
1322 /***************************************************************************
1323  ***************************************************************************/
1324
1325 NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
1326 {
1327         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1328 }
1329
1330 /***************************************************************************
1331  ***************************************************************************/
1332
1333 NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
1334 {
1335         return NT_STATUS_ACCESS_DENIED;
1336 }
1337
1338 /***************************************************************************
1339  ***************************************************************************/
1340
1341 NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
1342 {
1343         return NT_STATUS_ACCESS_DENIED;
1344 }
1345
1346 /***************************************************************************
1347  ***************************************************************************/
1348
1349 NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
1350 {
1351         return NT_STATUS_ACCESS_DENIED;
1352 }
1353
1354 /***************************************************************************
1355  _lsa_DeleteObject
1356  ***************************************************************************/
1357
1358 NTSTATUS _lsa_DeleteObject(pipes_struct *p,
1359                            struct lsa_DeleteObject *r)
1360 {
1361         NTSTATUS status;
1362         struct lsa_info *info = NULL;
1363
1364         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
1365                 return NT_STATUS_INVALID_HANDLE;
1366         }
1367
1368         if (!(info->access & STD_RIGHT_DELETE_ACCESS)) {
1369                 return NT_STATUS_ACCESS_DENIED;
1370         }
1371
1372         switch (info->type) {
1373         case LSA_HANDLE_ACCOUNT_TYPE:
1374                 status = privilege_delete_account(&info->sid);
1375                 if (!NT_STATUS_IS_OK(status)) {
1376                         DEBUG(10,("_lsa_DeleteObject: privilege_delete_account gave: %s\n",
1377                                 nt_errstr(status)));
1378                         return status;
1379                 }
1380                 break;
1381         default:
1382                 return NT_STATUS_INVALID_HANDLE;
1383         }
1384
1385         close_policy_hnd(p, r->in.handle);
1386         ZERO_STRUCTP(r->out.handle);
1387
1388         return status;
1389 }
1390
1391 /***************************************************************************
1392  _lsa_EnumPrivs
1393  ***************************************************************************/
1394
1395 NTSTATUS _lsa_EnumPrivs(pipes_struct *p,
1396                         struct lsa_EnumPrivs *r)
1397 {
1398         struct lsa_info *handle;
1399         uint32 i;
1400         uint32 enum_context = *r->in.resume_handle;
1401         int num_privs = count_all_privileges();
1402         struct lsa_PrivEntry *entries = NULL;
1403         LUID_ATTR luid;
1404
1405         /* remember that the enum_context starts at 0 and not 1 */
1406
1407         if ( enum_context >= num_privs )
1408                 return NT_STATUS_NO_MORE_ENTRIES;
1409
1410         DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1411                 enum_context, num_privs));
1412
1413         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1414                 return NT_STATUS_INVALID_HANDLE;
1415
1416         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1417                 return NT_STATUS_INVALID_HANDLE;
1418         }
1419
1420         /* check if the user has enough rights
1421            I don't know if it's the right one. not documented.  */
1422
1423         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1424                 return NT_STATUS_ACCESS_DENIED;
1425
1426         if (num_privs) {
1427                 entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_PrivEntry, num_privs);
1428                 if (!entries) {
1429                         return NT_STATUS_NO_MEMORY;
1430                 }
1431         } else {
1432                 entries = NULL;
1433         }
1434
1435         for (i = 0; i < num_privs; i++) {
1436                 if( i < enum_context) {
1437
1438                         init_lsa_StringLarge(&entries[i].name, NULL);
1439
1440                         entries[i].luid.low = 0;
1441                         entries[i].luid.high = 0;
1442                 } else {
1443
1444                         init_lsa_StringLarge(&entries[i].name, privs[i].name);
1445
1446                         luid = get_privilege_luid( &privs[i].se_priv );
1447
1448                         entries[i].luid.low = luid.luid.low;
1449                         entries[i].luid.high = luid.luid.high;
1450                 }
1451         }
1452
1453         enum_context = num_privs;
1454
1455         *r->out.resume_handle = enum_context;
1456         r->out.privs->count = num_privs;
1457         r->out.privs->privs = entries;
1458
1459         return NT_STATUS_OK;
1460 }
1461
1462 /***************************************************************************
1463  _lsa_LookupPrivDisplayName
1464  ***************************************************************************/
1465
1466 NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p,
1467                                     struct lsa_LookupPrivDisplayName *r)
1468 {
1469         struct lsa_info *handle;
1470         const char *description;
1471         struct lsa_StringLarge *lsa_name;
1472
1473         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1474                 return NT_STATUS_INVALID_HANDLE;
1475
1476         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1477                 return NT_STATUS_INVALID_HANDLE;
1478         }
1479
1480         /* check if the user has enough rights */
1481
1482         /*
1483          * I don't know if it's the right one. not documented.
1484          */
1485         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1486                 return NT_STATUS_ACCESS_DENIED;
1487
1488         DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r->in.name->string));
1489
1490         description = get_privilege_dispname(r->in.name->string);
1491         if (!description) {
1492                 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1493                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1494         }
1495
1496         DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description));
1497
1498         lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
1499         if (!lsa_name) {
1500                 return NT_STATUS_NO_MEMORY;
1501         }
1502
1503         init_lsa_StringLarge(lsa_name, description);
1504
1505         *r->out.returned_language_id = r->in.language_id;
1506         *r->out.disp_name = lsa_name;
1507
1508         return NT_STATUS_OK;
1509 }
1510
1511 /***************************************************************************
1512  _lsa_EnumAccounts
1513  ***************************************************************************/
1514
1515 NTSTATUS _lsa_EnumAccounts(pipes_struct *p,
1516                            struct lsa_EnumAccounts *r)
1517 {
1518         struct lsa_info *handle;
1519         DOM_SID *sid_list;
1520         int i, j, num_entries;
1521         NTSTATUS status;
1522         struct lsa_SidPtr *sids = NULL;
1523
1524         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1525                 return NT_STATUS_INVALID_HANDLE;
1526
1527         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1528                 return NT_STATUS_INVALID_HANDLE;
1529         }
1530
1531         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1532                 return NT_STATUS_ACCESS_DENIED;
1533
1534         sid_list = NULL;
1535         num_entries = 0;
1536
1537         /* The only way we can currently find out all the SIDs that have been
1538            privileged is to scan all privileges */
1539
1540         status = privilege_enumerate_accounts(&sid_list, &num_entries);
1541         if (!NT_STATUS_IS_OK(status)) {
1542                 return status;
1543         }
1544
1545         if (*r->in.resume_handle >= num_entries) {
1546                 return NT_STATUS_NO_MORE_ENTRIES;
1547         }
1548
1549         if (num_entries - *r->in.resume_handle) {
1550                 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr,
1551                                          num_entries - *r->in.resume_handle);
1552                 if (!sids) {
1553                         talloc_free(sid_list);
1554                         return NT_STATUS_NO_MEMORY;
1555                 }
1556
1557                 for (i = *r->in.resume_handle, j = 0; i < num_entries; i++, j++) {
1558                         sids[j].sid = sid_dup_talloc(p->mem_ctx, &sid_list[i]);
1559                         if (!sids[j].sid) {
1560                                 talloc_free(sid_list);
1561                                 return NT_STATUS_NO_MEMORY;
1562                         }
1563                 }
1564         }
1565
1566         talloc_free(sid_list);
1567
1568         *r->out.resume_handle = num_entries;
1569         r->out.sids->num_sids = num_entries;
1570         r->out.sids->sids = sids;
1571
1572         return NT_STATUS_OK;
1573 }
1574
1575 /***************************************************************************
1576  _lsa_GetUserName
1577  ***************************************************************************/
1578
1579 NTSTATUS _lsa_GetUserName(pipes_struct *p,
1580                           struct lsa_GetUserName *r)
1581 {
1582         const char *username, *domname;
1583         struct lsa_String *account_name = NULL;
1584         struct lsa_String *authority_name = NULL;
1585
1586         if (r->in.account_name &&
1587            *r->in.account_name) {
1588                 return NT_STATUS_INVALID_PARAMETER;
1589         }
1590
1591         if (r->in.authority_name &&
1592            *r->in.authority_name) {
1593                 return NT_STATUS_INVALID_PARAMETER;
1594         }
1595
1596         if (p->server_info->guest) {
1597                 /*
1598                  * I'm 99% sure this is not the right place to do this,
1599                  * global_sid_Anonymous should probably be put into the token
1600                  * instead of the guest id -- vl
1601                  */
1602                 if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
1603                                 &domname, &username, NULL)) {
1604                         return NT_STATUS_NO_MEMORY;
1605                 }
1606         } else {
1607                 username = p->server_info->sanitized_username;
1608                 domname = pdb_get_domain(p->server_info->sam_account);
1609         }
1610
1611         account_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1612         if (!account_name) {
1613                 return NT_STATUS_NO_MEMORY;
1614         }
1615         init_lsa_String(account_name, username);
1616
1617         if (r->out.authority_name) {
1618                 authority_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1619                 if (!authority_name) {
1620                         return NT_STATUS_NO_MEMORY;
1621                 }
1622                 init_lsa_String(authority_name, domname);
1623         }
1624
1625         *r->out.account_name = account_name;
1626         if (r->out.authority_name) {
1627                 *r->out.authority_name = authority_name;
1628         }
1629
1630         return NT_STATUS_OK;
1631 }
1632
1633 /***************************************************************************
1634  _lsa_CreateAccount
1635  ***************************************************************************/
1636
1637 NTSTATUS _lsa_CreateAccount(pipes_struct *p,
1638                             struct lsa_CreateAccount *r)
1639 {
1640         NTSTATUS status;
1641         struct lsa_info *handle;
1642         struct lsa_info *info;
1643         uint32_t acc_granted;
1644         struct security_descriptor *psd;
1645         uint32_t sd_size;
1646
1647         /* find the connection policy handle. */
1648         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1649                 return NT_STATUS_INVALID_HANDLE;
1650
1651         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1652                 return NT_STATUS_INVALID_HANDLE;
1653         }
1654
1655         /* check if the user has enough rights */
1656
1657         if (!(handle->access & LSA_POLICY_CREATE_ACCOUNT)) {
1658                 return NT_STATUS_ACCESS_DENIED;
1659         }
1660
1661         /* map the generic bits to the lsa policy ones */
1662         se_map_generic(&r->in.access_mask, &lsa_account_mapping);
1663
1664         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
1665                                     &lsa_account_mapping,
1666                                     r->in.sid, LSA_POLICY_ALL_ACCESS);
1667         if (!NT_STATUS_IS_OK(status)) {
1668                 return status;
1669         }
1670
1671         status = access_check_object(psd, p->server_info->ptok,
1672                 NULL, 0, r->in.access_mask,
1673                 &acc_granted, "_lsa_CreateAccount");
1674         if (!NT_STATUS_IS_OK(status)) {
1675                 return status;
1676         }
1677
1678         if ( is_privileged_sid( r->in.sid ) )
1679                 return NT_STATUS_OBJECT_NAME_COLLISION;
1680
1681         /* associate the user/group SID with the (unique) handle. */
1682
1683         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1684         if (info == NULL) {
1685                 return NT_STATUS_NO_MEMORY;
1686         }
1687
1688         info->sid = *r->in.sid;
1689         info->access = acc_granted;
1690         info->type = LSA_HANDLE_ACCOUNT_TYPE;
1691
1692         /* get a (unique) handle.  open a policy on it. */
1693         if (!create_policy_hnd(p, r->out.acct_handle, info))
1694                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1695
1696         return privilege_create_account( &info->sid );
1697 }
1698
1699 /***************************************************************************
1700  _lsa_OpenAccount
1701  ***************************************************************************/
1702
1703 NTSTATUS _lsa_OpenAccount(pipes_struct *p,
1704                           struct lsa_OpenAccount *r)
1705 {
1706         struct lsa_info *handle;
1707         struct lsa_info *info;
1708         SEC_DESC *psd = NULL;
1709         size_t sd_size;
1710         uint32_t des_access = r->in.access_mask;
1711         uint32_t acc_granted;
1712         NTSTATUS status;
1713
1714         /* find the connection policy handle. */
1715         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1716                 return NT_STATUS_INVALID_HANDLE;
1717
1718         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1719                 return NT_STATUS_INVALID_HANDLE;
1720         }
1721
1722         /* des_access is for the account here, not the policy
1723          * handle - so don't check against policy handle. */
1724
1725         /* Work out max allowed. */
1726         map_max_allowed_access(p->server_info->ptok,
1727                                &p->server_info->utok,
1728                                &des_access);
1729
1730         /* map the generic bits to the lsa account ones */
1731         se_map_generic(&des_access, &lsa_account_mapping);
1732
1733         /* get the generic lsa account SD until we store it */
1734         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
1735                                 &lsa_account_mapping,
1736                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
1737         if (!NT_STATUS_IS_OK(status)) {
1738                 return status;
1739         }
1740
1741         status = access_check_object(psd, p->server_info->ptok,
1742                 NULL, 0, des_access,
1743                 &acc_granted, "_lsa_OpenAccount" );
1744
1745         if (!NT_STATUS_IS_OK(status)) {
1746                 return status;
1747         }
1748
1749         /* TODO: Fis the parsing routine before reenabling this check! */
1750         #if 0
1751         if (!lookup_sid(&handle->sid, dom_name, name, &type))
1752                 return NT_STATUS_ACCESS_DENIED;
1753         #endif
1754         /* associate the user/group SID with the (unique) handle. */
1755         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1756         if (info == NULL) {
1757                 return NT_STATUS_NO_MEMORY;
1758         }
1759
1760         info->sid = *r->in.sid;
1761         info->access = acc_granted;
1762         info->type = LSA_HANDLE_ACCOUNT_TYPE;
1763
1764         /* get a (unique) handle.  open a policy on it. */
1765         if (!create_policy_hnd(p, r->out.acct_handle, info))
1766                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1767
1768         return NT_STATUS_OK;
1769 }
1770
1771 /***************************************************************************
1772  _lsa_EnumPrivsAccount
1773  For a given SID, enumerate all the privilege this account has.
1774  ***************************************************************************/
1775
1776 NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
1777                                struct lsa_EnumPrivsAccount *r)
1778 {
1779         NTSTATUS status = NT_STATUS_OK;
1780         struct lsa_info *info=NULL;
1781         SE_PRIV mask;
1782         PRIVILEGE_SET privileges;
1783         struct lsa_PrivilegeSet *priv_set = NULL;
1784         struct lsa_LUIDAttribute *luid_attrs = NULL;
1785         int i;
1786
1787         /* find the connection policy handle. */
1788         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1789                 return NT_STATUS_INVALID_HANDLE;
1790
1791         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1792                 return NT_STATUS_INVALID_HANDLE;
1793         }
1794
1795         if (!(info->access & LSA_ACCOUNT_VIEW))
1796                 return NT_STATUS_ACCESS_DENIED;
1797
1798         get_privileges_for_sids(&mask, &info->sid, 1);
1799
1800         privilege_set_init( &privileges );
1801
1802         priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
1803         if (!priv_set) {
1804                 status = NT_STATUS_NO_MEMORY;
1805                 goto done;
1806         }
1807
1808         if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1809
1810                 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1811                           sid_string_dbg(&info->sid),
1812                           privileges.count));
1813
1814                 luid_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx,
1815                                                struct lsa_LUIDAttribute,
1816                                                privileges.count);
1817                 if (!luid_attrs) {
1818                         status = NT_STATUS_NO_MEMORY;
1819                         goto done;
1820                 }
1821
1822                 for (i=0; i<privileges.count; i++) {
1823                         luid_attrs[i].luid.low = privileges.set[i].luid.low;
1824                         luid_attrs[i].luid.high = privileges.set[i].luid.high;
1825                         luid_attrs[i].attribute = privileges.set[i].attr;
1826                 }
1827
1828                 priv_set->count = privileges.count;
1829                 priv_set->unknown = 0;
1830                 priv_set->set = luid_attrs;
1831
1832         } else {
1833                 priv_set->count = 0;
1834                 priv_set->unknown = 0;
1835                 priv_set->set = NULL;
1836         }
1837
1838         *r->out.privs = priv_set;
1839
1840  done:
1841         privilege_set_free( &privileges );
1842
1843         return status;
1844 }
1845
1846 /***************************************************************************
1847  _lsa_GetSystemAccessAccount
1848  ***************************************************************************/
1849
1850 NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p,
1851                                      struct lsa_GetSystemAccessAccount *r)
1852 {
1853         NTSTATUS status;
1854         struct lsa_info *info = NULL;
1855         struct lsa_EnumPrivsAccount e;
1856         struct lsa_PrivilegeSet *privset;
1857
1858         /* find the connection policy handle. */
1859
1860         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1861                 return NT_STATUS_INVALID_HANDLE;
1862
1863         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1864                 return NT_STATUS_INVALID_HANDLE;
1865         }
1866
1867         if (!(info->access & LSA_ACCOUNT_VIEW))
1868                 return NT_STATUS_ACCESS_DENIED;
1869
1870         privset = talloc_zero(p->mem_ctx, struct lsa_PrivilegeSet);
1871         if (!privset) {
1872                 return NT_STATUS_NO_MEMORY;
1873         }
1874
1875         e.in.handle = r->in.handle;
1876         e.out.privs = &privset;
1877
1878         status = _lsa_EnumPrivsAccount(p, &e);
1879         if (!NT_STATUS_IS_OK(status)) {
1880                 DEBUG(10,("_lsa_GetSystemAccessAccount: "
1881                         "failed to call _lsa_EnumPrivsAccount(): %s\n",
1882                         nt_errstr(status)));
1883                 return status;
1884         }
1885
1886         /* Samba4 would iterate over the privset to merge the policy mode bits,
1887          * not sure samba3 can do the same here, so just return what we did in
1888          * the past - gd */
1889
1890         /*
1891           0x01 -> Log on locally
1892           0x02 -> Access this computer from network
1893           0x04 -> Log on as a batch job
1894           0x10 -> Log on as a service
1895
1896           they can be ORed together
1897         */
1898
1899         *r->out.access_mask = LSA_POLICY_MODE_INTERACTIVE |
1900                               LSA_POLICY_MODE_NETWORK;
1901
1902         return NT_STATUS_OK;
1903 }
1904
1905 /***************************************************************************
1906   update the systemaccount information
1907  ***************************************************************************/
1908
1909 NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p,
1910                                      struct lsa_SetSystemAccessAccount *r)
1911 {
1912         struct lsa_info *info=NULL;
1913         GROUP_MAP map;
1914
1915         /* find the connection policy handle. */
1916         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1917                 return NT_STATUS_INVALID_HANDLE;
1918
1919         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1920                 return NT_STATUS_INVALID_HANDLE;
1921         }
1922
1923         if (!(info->access & LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS)) {
1924                 return NT_STATUS_ACCESS_DENIED;
1925         }
1926
1927         if (!pdb_getgrsid(&map, info->sid))
1928                 return NT_STATUS_NO_SUCH_GROUP;
1929
1930         return pdb_update_group_mapping_entry(&map);
1931 }
1932
1933 /***************************************************************************
1934  _lsa_AddPrivilegesToAccount
1935  For a given SID, add some privileges.
1936  ***************************************************************************/
1937
1938 NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p,
1939                                      struct lsa_AddPrivilegesToAccount *r)
1940 {
1941         struct lsa_info *info = NULL;
1942         SE_PRIV mask;
1943         struct lsa_PrivilegeSet *set = NULL;
1944
1945         /* find the connection policy handle. */
1946         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1947                 return NT_STATUS_INVALID_HANDLE;
1948
1949         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1950                 return NT_STATUS_INVALID_HANDLE;
1951         }
1952
1953         if (!(info->access & LSA_ACCOUNT_ADJUST_PRIVILEGES)) {
1954                 return NT_STATUS_ACCESS_DENIED;
1955         }
1956
1957         set = r->in.privs;
1958         if ( !privilege_set_to_se_priv( &mask, set ) )
1959                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1960
1961         if ( !grant_privilege( &info->sid, &mask ) ) {
1962                 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1963                          sid_string_dbg(&info->sid) ));
1964                 DEBUG(3,("Privilege mask:\n"));
1965                 dump_se_priv( DBGC_ALL, 3, &mask );
1966                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1967         }
1968
1969         return NT_STATUS_OK;
1970 }
1971
1972 /***************************************************************************
1973  _lsa_RemovePrivilegesFromAccount
1974  For a given SID, remove some privileges.
1975  ***************************************************************************/
1976
1977 NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p,
1978                                           struct lsa_RemovePrivilegesFromAccount *r)
1979 {
1980         struct lsa_info *info = NULL;
1981         SE_PRIV mask;
1982         struct lsa_PrivilegeSet *set = NULL;
1983
1984         /* find the connection policy handle. */
1985         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1986                 return NT_STATUS_INVALID_HANDLE;
1987
1988         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1989                 return NT_STATUS_INVALID_HANDLE;
1990         }
1991
1992         if (!(info->access & LSA_ACCOUNT_ADJUST_PRIVILEGES)) {
1993                 return NT_STATUS_ACCESS_DENIED;
1994         }
1995
1996         set = r->in.privs;
1997
1998         if ( !privilege_set_to_se_priv( &mask, set ) )
1999                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2000
2001         if ( !revoke_privilege( &info->sid, &mask ) ) {
2002                 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
2003                          sid_string_dbg(&info->sid) ));
2004                 DEBUG(3,("Privilege mask:\n"));
2005                 dump_se_priv( DBGC_ALL, 3, &mask );
2006                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2007         }
2008
2009         return NT_STATUS_OK;
2010 }
2011
2012 /***************************************************************************
2013  _lsa_LookupPrivName
2014  ***************************************************************************/
2015
2016 NTSTATUS _lsa_LookupPrivName(pipes_struct *p,
2017                              struct lsa_LookupPrivName *r)
2018 {
2019         struct lsa_info *info = NULL;
2020         const char *name;
2021         struct lsa_StringLarge *lsa_name;
2022
2023         /* find the connection policy handle. */
2024         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
2025                 return NT_STATUS_INVALID_HANDLE;
2026         }
2027
2028         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2029                 return NT_STATUS_INVALID_HANDLE;
2030         }
2031
2032         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION)) {
2033                 return NT_STATUS_ACCESS_DENIED;
2034         }
2035
2036         name = luid_to_privilege_name((LUID *)r->in.luid);
2037         if (!name) {
2038                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2039         }
2040
2041         lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
2042         if (!lsa_name) {
2043                 return NT_STATUS_NO_MEMORY;
2044         }
2045
2046         lsa_name->string = talloc_strdup(lsa_name, name);
2047         if (!lsa_name->string) {
2048                 TALLOC_FREE(lsa_name);
2049                 return NT_STATUS_NO_MEMORY;
2050         }
2051
2052         *r->out.name = lsa_name;
2053
2054         return NT_STATUS_OK;
2055 }
2056
2057 /***************************************************************************
2058  _lsa_QuerySecurity
2059  ***************************************************************************/
2060
2061 NTSTATUS _lsa_QuerySecurity(pipes_struct *p,
2062                             struct lsa_QuerySecurity *r)
2063 {
2064         struct lsa_info *handle=NULL;
2065         SEC_DESC *psd = NULL;
2066         size_t sd_size;
2067         NTSTATUS status;
2068
2069         /* find the connection policy handle. */
2070         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
2071                 return NT_STATUS_INVALID_HANDLE;
2072
2073         if (handle->type == LSA_HANDLE_POLICY_TYPE) {
2074                 status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2075                                 &lsa_policy_mapping, NULL, 0);
2076         } else if (handle->type == LSA_HANDLE_ACCOUNT_TYPE) {
2077                 status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2078                                 &lsa_account_mapping,
2079                                 &handle->sid, LSA_ACCOUNT_ALL_ACCESS);
2080         } else {
2081                 status = NT_STATUS_INVALID_HANDLE;
2082         }
2083
2084         if (!NT_STATUS_IS_OK(status)) {
2085                 return status;
2086         }
2087
2088         *r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd);
2089         if (!*r->out.sdbuf) {
2090                 return NT_STATUS_NO_MEMORY;
2091         }
2092
2093         return status;
2094 }
2095
2096 /***************************************************************************
2097  _lsa_AddAccountRights
2098  ***************************************************************************/
2099
2100 NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
2101                                struct lsa_AddAccountRights *r)
2102 {
2103         struct lsa_info *info = NULL;
2104         int i = 0;
2105         uint32_t acc_granted = 0;
2106         SEC_DESC *psd = NULL;
2107         size_t sd_size;
2108         DOM_SID sid;
2109         NTSTATUS status;
2110
2111         /* find the connection policy handle. */
2112         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2113                 return NT_STATUS_INVALID_HANDLE;
2114
2115         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2116                 return NT_STATUS_INVALID_HANDLE;
2117         }
2118
2119         /* get the generic lsa account SD for this SID until we store it */
2120         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2121                                 &lsa_account_mapping,
2122                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
2123         if (!NT_STATUS_IS_OK(status)) {
2124                 return status;
2125         }
2126
2127         /*
2128          * From the MS DOCs. If the sid doesn't exist, ask for LSA_POLICY_CREATE_ACCOUNT
2129          * on the policy handle. If it does, ask for
2130          * LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
2131          * on the account sid. We don't check here so just use the latter. JRA.
2132          */
2133
2134         status = access_check_object(psd, p->server_info->ptok,
2135                 NULL, 0, LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
2136                 &acc_granted, "_lsa_AddAccountRights" );
2137
2138         if (!NT_STATUS_IS_OK(status)) {
2139                 return status;
2140         }
2141
2142         /* according to an NT4 PDC, you can add privileges to SIDs even without
2143            call_lsa_create_account() first.  And you can use any arbitrary SID. */
2144
2145         sid_copy( &sid, r->in.sid );
2146
2147         for ( i=0; i < r->in.rights->count; i++ ) {
2148
2149                 const char *privname = r->in.rights->names[i].string;
2150
2151                 /* only try to add non-null strings */
2152
2153                 if ( !privname )
2154                         continue;
2155
2156                 if ( !grant_privilege_by_name( &sid, privname ) ) {
2157                         DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
2158                                 privname ));
2159                         return NT_STATUS_NO_SUCH_PRIVILEGE;
2160                 }
2161         }
2162
2163         return NT_STATUS_OK;
2164 }
2165
2166 /***************************************************************************
2167  _lsa_RemoveAccountRights
2168  ***************************************************************************/
2169
2170 NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
2171                                   struct lsa_RemoveAccountRights *r)
2172 {
2173         struct lsa_info *info = NULL;
2174         int i = 0;
2175         SEC_DESC *psd = NULL;
2176         size_t sd_size;
2177         DOM_SID sid;
2178         const char *privname = NULL;
2179         uint32_t acc_granted = 0;
2180         NTSTATUS status;
2181
2182         /* find the connection policy handle. */
2183         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2184                 return NT_STATUS_INVALID_HANDLE;
2185
2186         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2187                 return NT_STATUS_INVALID_HANDLE;
2188         }
2189
2190         /* get the generic lsa account SD for this SID until we store it */
2191         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2192                                 &lsa_account_mapping,
2193                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
2194         if (!NT_STATUS_IS_OK(status)) {
2195                 return status;
2196         }
2197
2198         /*
2199          * From the MS DOCs. We need
2200          * LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW
2201          * and DELETE on the account sid.
2202          */
2203
2204         status = access_check_object(psd, p->server_info->ptok,
2205                 NULL, 0, LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
2206                         LSA_ACCOUNT_VIEW|STD_RIGHT_DELETE_ACCESS,
2207                 &acc_granted, "_lsa_AddAccountRights" );
2208
2209         if (!NT_STATUS_IS_OK(status)) {
2210                 return status;
2211         }
2212
2213         sid_copy( &sid, r->in.sid );
2214
2215         if ( r->in.remove_all ) {
2216                 if ( !revoke_all_privileges( &sid ) )
2217                         return NT_STATUS_ACCESS_DENIED;
2218
2219                 return NT_STATUS_OK;
2220         }
2221
2222         for ( i=0; i < r->in.rights->count; i++ ) {
2223
2224                 privname = r->in.rights->names[i].string;
2225
2226                 /* only try to add non-null strings */
2227
2228                 if ( !privname )
2229                         continue;
2230
2231                 if ( !revoke_privilege_by_name( &sid, privname ) ) {
2232                         DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2233                                 privname ));
2234                         return NT_STATUS_NO_SUCH_PRIVILEGE;
2235                 }
2236         }
2237
2238         return NT_STATUS_OK;
2239 }
2240
2241 /*******************************************************************
2242 ********************************************************************/
2243
2244 static NTSTATUS init_lsa_right_set(TALLOC_CTX *mem_ctx,
2245                                    struct lsa_RightSet *r,
2246                                    PRIVILEGE_SET *privileges)
2247 {
2248         uint32 i;
2249         const char *privname;
2250         const char **privname_array = NULL;
2251         int num_priv = 0;
2252
2253         for (i=0; i<privileges->count; i++) {
2254
2255                 privname = luid_to_privilege_name(&privileges->set[i].luid);
2256                 if (privname) {
2257                         if (!add_string_to_array(mem_ctx, privname,
2258                                                  &privname_array, &num_priv)) {
2259                                 return NT_STATUS_NO_MEMORY;
2260                         }
2261                 }
2262         }
2263
2264         if (num_priv) {
2265
2266                 r->names = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_StringLarge,
2267                                              num_priv);
2268                 if (!r->names) {
2269                         return NT_STATUS_NO_MEMORY;
2270                 }
2271
2272                 for (i=0; i<num_priv; i++) {
2273                         init_lsa_StringLarge(&r->names[i], privname_array[i]);
2274                 }
2275
2276                 r->count = num_priv;
2277         }
2278
2279         return NT_STATUS_OK;
2280 }
2281
2282 /***************************************************************************
2283  _lsa_EnumAccountRights
2284  ***************************************************************************/
2285
2286 NTSTATUS _lsa_EnumAccountRights(pipes_struct *p,
2287                                 struct lsa_EnumAccountRights *r)
2288 {
2289         NTSTATUS status;
2290         struct lsa_info *info = NULL;
2291         DOM_SID sid;
2292         PRIVILEGE_SET privileges;
2293         SE_PRIV mask;
2294
2295         /* find the connection policy handle. */
2296
2297         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2298                 return NT_STATUS_INVALID_HANDLE;
2299
2300         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2301                 return NT_STATUS_INVALID_HANDLE;
2302         }
2303
2304         if (!(info->access & LSA_ACCOUNT_VIEW)) {
2305                 return NT_STATUS_ACCESS_DENIED;
2306         }
2307
2308         /* according to an NT4 PDC, you can add privileges to SIDs even without
2309            call_lsa_create_account() first.  And you can use any arbitrary SID. */
2310
2311         sid_copy( &sid, r->in.sid );
2312
2313         /* according to MS-LSAD 3.1.4.5.10 it is required to return
2314          * NT_STATUS_OBJECT_NAME_NOT_FOUND if the account sid was not found in
2315          * the lsa database */
2316
2317         if (!get_privileges_for_sids(&mask, &sid, 1)) {
2318                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2319         }
2320
2321         status = privilege_set_init(&privileges);
2322         if (!NT_STATUS_IS_OK(status)) {
2323                 return status;
2324         }
2325
2326         se_priv_to_privilege_set(&privileges, &mask);
2327
2328         DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2329                   sid_string_dbg(&sid), privileges.count));
2330
2331         status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
2332
2333         privilege_set_free( &privileges );
2334
2335         return status;
2336 }
2337
2338 /***************************************************************************
2339  _lsa_LookupPrivValue
2340  ***************************************************************************/
2341
2342 NTSTATUS _lsa_LookupPrivValue(pipes_struct *p,
2343                               struct lsa_LookupPrivValue *r)
2344 {
2345         struct lsa_info *info = NULL;
2346         const char *name = NULL;
2347         LUID_ATTR priv_luid;
2348         SE_PRIV mask;
2349
2350         /* find the connection policy handle. */
2351
2352         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2353                 return NT_STATUS_INVALID_HANDLE;
2354
2355         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2356                 return NT_STATUS_INVALID_HANDLE;
2357         }
2358
2359         if (!(info->access & LSA_POLICY_LOOKUP_NAMES))
2360                 return NT_STATUS_ACCESS_DENIED;
2361
2362         name = r->in.name->string;
2363
2364         DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
2365
2366         if ( !se_priv_from_name( name, &mask ) )
2367                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2368
2369         priv_luid = get_privilege_luid( &mask );
2370
2371         r->out.luid->low = priv_luid.luid.low;
2372         r->out.luid->high = priv_luid.luid.high;
2373
2374         return NT_STATUS_OK;
2375 }
2376
2377 /***************************************************************************
2378  _lsa_EnumAccountsWithUserRight
2379  ***************************************************************************/
2380
2381 NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p,
2382                                         struct lsa_EnumAccountsWithUserRight *r)
2383 {
2384         NTSTATUS status;
2385         struct lsa_info *info = NULL;
2386         struct dom_sid *sids = NULL;
2387         int num_sids = 0;
2388         uint32_t i;
2389         SE_PRIV mask;
2390
2391         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
2392                 return NT_STATUS_INVALID_HANDLE;
2393         }
2394
2395         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2396                 return NT_STATUS_INVALID_HANDLE;
2397         }
2398
2399         if (!(info->access & LSA_POLICY_LOOKUP_NAMES)) {
2400                 return NT_STATUS_ACCESS_DENIED;
2401         }
2402
2403         if (!r->in.name || !r->in.name->string) {
2404                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2405         }
2406
2407         if (!se_priv_from_name(r->in.name->string, &mask)) {
2408                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2409         }
2410
2411         status = privilege_enum_sids(&mask, p->mem_ctx,
2412                                      &sids, &num_sids);
2413         if (!NT_STATUS_IS_OK(status)) {
2414                 return status;
2415         }
2416
2417         r->out.sids->num_sids = num_sids;
2418         r->out.sids->sids = talloc_array(p->mem_ctx, struct lsa_SidPtr,
2419                                          r->out.sids->num_sids);
2420
2421         for (i=0; i < r->out.sids->num_sids; i++) {
2422                 r->out.sids->sids[i].sid = sid_dup_talloc(r->out.sids->sids,
2423                                                           &sids[i]);
2424                 if (!r->out.sids->sids[i].sid) {
2425                         TALLOC_FREE(r->out.sids->sids);
2426                         r->out.sids->num_sids = 0;
2427                         return NT_STATUS_NO_MEMORY;
2428                 }
2429         }
2430
2431         return NT_STATUS_OK;
2432 }
2433
2434 /*
2435  * From here on the server routines are just dummy ones to make smbd link with
2436  * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2437  * pulling the server stubs across one by one.
2438  */
2439
2440 NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
2441 {
2442         p->rng_fault_state = True;
2443         return NT_STATUS_NOT_IMPLEMENTED;
2444 }
2445
2446 NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
2447 {
2448         p->rng_fault_state = True;
2449         return NT_STATUS_NOT_IMPLEMENTED;
2450 }
2451
2452 NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
2453 {
2454         p->rng_fault_state = True;
2455         return NT_STATUS_NOT_IMPLEMENTED;
2456 }
2457
2458 NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
2459 {
2460         p->rng_fault_state = True;
2461         return NT_STATUS_NOT_IMPLEMENTED;
2462 }
2463
2464 NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
2465 {
2466         p->rng_fault_state = True;
2467         return NT_STATUS_NOT_IMPLEMENTED;
2468 }
2469
2470 NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
2471 {
2472         p->rng_fault_state = True;
2473         return NT_STATUS_NOT_IMPLEMENTED;
2474 }
2475
2476 NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
2477 {
2478         p->rng_fault_state = True;
2479         return NT_STATUS_NOT_IMPLEMENTED;
2480 }
2481
2482 NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
2483 {
2484         p->rng_fault_state = True;
2485         return NT_STATUS_NOT_IMPLEMENTED;
2486 }
2487
2488 NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
2489 {
2490         p->rng_fault_state = True;
2491         return NT_STATUS_NOT_IMPLEMENTED;
2492 }
2493
2494 NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
2495 {
2496         p->rng_fault_state = True;
2497         return NT_STATUS_NOT_IMPLEMENTED;
2498 }
2499
2500 NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
2501 {
2502         p->rng_fault_state = True;
2503         return NT_STATUS_NOT_IMPLEMENTED;
2504 }
2505
2506 NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
2507 {
2508         p->rng_fault_state = True;
2509         return NT_STATUS_NOT_IMPLEMENTED;
2510 }
2511
2512 NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
2513 {
2514         p->rng_fault_state = True;
2515         return NT_STATUS_NOT_IMPLEMENTED;
2516 }
2517
2518 NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
2519 {
2520         p->rng_fault_state = True;
2521         return NT_STATUS_NOT_IMPLEMENTED;
2522 }
2523
2524 NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
2525 {
2526         p->rng_fault_state = True;
2527         return NT_STATUS_NOT_IMPLEMENTED;
2528 }
2529
2530 NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
2531 {
2532         p->rng_fault_state = True;
2533         return NT_STATUS_NOT_IMPLEMENTED;
2534 }
2535
2536 NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
2537 {
2538         p->rng_fault_state = True;
2539         return NT_STATUS_NOT_IMPLEMENTED;
2540 }
2541
2542 NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
2543 {
2544         p->rng_fault_state = True;
2545         return NT_STATUS_NOT_IMPLEMENTED;
2546 }
2547
2548 NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
2549 {
2550         p->rng_fault_state = True;
2551         return NT_STATUS_NOT_IMPLEMENTED;
2552 }
2553
2554 NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
2555 {
2556         p->rng_fault_state = True;
2557         return NT_STATUS_NOT_IMPLEMENTED;
2558 }
2559
2560 NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
2561 {
2562         p->rng_fault_state = True;
2563         return NT_STATUS_NOT_IMPLEMENTED;
2564 }
2565
2566 NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
2567 {
2568         p->rng_fault_state = True;
2569         return NT_STATUS_NOT_IMPLEMENTED;
2570 }
2571
2572 NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
2573 {
2574         p->rng_fault_state = True;
2575         return NT_STATUS_NOT_IMPLEMENTED;
2576 }
2577
2578 NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
2579 {
2580         p->rng_fault_state = True;
2581         return NT_STATUS_NOT_IMPLEMENTED;
2582 }
2583
2584 NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
2585 {
2586         p->rng_fault_state = True;
2587         return NT_STATUS_NOT_IMPLEMENTED;
2588 }
2589
2590 NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
2591 {
2592         p->rng_fault_state = True;
2593         return NT_STATUS_NOT_IMPLEMENTED;
2594 }
2595
2596 NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
2597 {
2598         p->rng_fault_state = True;
2599         return NT_STATUS_NOT_IMPLEMENTED;
2600 }
2601
2602 NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
2603 {
2604         p->rng_fault_state = True;
2605         return NT_STATUS_NOT_IMPLEMENTED;
2606 }
2607
2608 NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
2609 {
2610         p->rng_fault_state = True;
2611         return NT_STATUS_NOT_IMPLEMENTED;
2612 }
2613
2614 NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
2615 {
2616         p->rng_fault_state = True;
2617         return NT_STATUS_NOT_IMPLEMENTED;
2618 }
2619
2620 NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
2621 {
2622         p->rng_fault_state = True;
2623         return NT_STATUS_NOT_IMPLEMENTED;
2624 }
2625
2626 NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
2627 {
2628         p->rng_fault_state = True;
2629         return NT_STATUS_NOT_IMPLEMENTED;
2630 }
2631
2632 NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
2633 {
2634         p->rng_fault_state = True;
2635         return NT_STATUS_NOT_IMPLEMENTED;
2636 }
2637
2638 NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
2639 {
2640         p->rng_fault_state = True;
2641         return NT_STATUS_NOT_IMPLEMENTED;
2642 }
2643
2644 NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
2645 {
2646         p->rng_fault_state = True;
2647         return NT_STATUS_NOT_IMPLEMENTED;
2648 }
2649
2650 NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
2651 {
2652         p->rng_fault_state = True;
2653         return NT_STATUS_NOT_IMPLEMENTED;
2654 }
2655
2656 NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
2657 {
2658         p->rng_fault_state = True;
2659         return NT_STATUS_NOT_IMPLEMENTED;
2660 }
2661
2662 NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
2663 {
2664         p->rng_fault_state = True;
2665         return NT_STATUS_NOT_IMPLEMENTED;
2666 }
2667
2668 NTSTATUS _lsa_lsaRQueryForestTrustInformation(pipes_struct *p, struct lsa_lsaRQueryForestTrustInformation *r)
2669 {
2670         p->rng_fault_state = True;
2671         return NT_STATUS_NOT_IMPLEMENTED;
2672 }
2673
2674 NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2675 {
2676         p->rng_fault_state = True;
2677         return NT_STATUS_NOT_IMPLEMENTED;
2678 }
2679
2680 NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
2681 {
2682         p->rng_fault_state = True;
2683         return NT_STATUS_NOT_IMPLEMENTED;
2684 }
2685
2686 NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
2687 {
2688         p->rng_fault_state = True;
2689         return NT_STATUS_NOT_IMPLEMENTED;
2690 }
2691
2692 NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2693 {
2694         p->rng_fault_state = True;
2695         return NT_STATUS_NOT_IMPLEMENTED;
2696 }
2697
2698 NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2699 {
2700         p->rng_fault_state = True;
2701         return NT_STATUS_NOT_IMPLEMENTED;
2702 }
2703
2704 NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
2705 {
2706         p->rng_fault_state = True;
2707         return NT_STATUS_NOT_IMPLEMENTED;
2708 }