s3-lsa: also implement level 13 in lsa_QueryInfoPolicy.
[ira/wip.git] / source3 / rpc_server / srv_lsa_nt.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-1997,
5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6  *  Copyright (C) Paul Ashton                       1997,
7  *  Copyright (C) Jeremy Allison                    2001, 2006.
8  *  Copyright (C) Rafal Szczesniak                  2002,
9  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
10  *  Copyright (C) Simo Sorce                        2003.
11  *  Copyright (C) Gerald (Jerry) Carter             2005.
12  *  Copyright (C) Volker Lendecke                   2005.
13  *  Copyright (C) Guenther Deschner                 2008.
14  *
15  *  This program is free software; you can redistribute it and/or modify
16  *  it under the terms of the GNU General Public License as published by
17  *  the Free Software Foundation; either version 3 of the License, or
18  *  (at your option) any later version.
19  *
20  *  This program is distributed in the hope that it will be useful,
21  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
22  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
23  *  GNU General Public License for more details.
24  *
25  *  You should have received a copy of the GNU General Public License
26  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
27  */
28
29 /* This is the implementation of the lsa server code. */
30
31 #include "includes.h"
32
33 #undef DBGC_CLASS
34 #define DBGC_CLASS DBGC_RPC_SRV
35
36 #define MAX_LOOKUP_SIDS 0x5000 /* 20480 */
37
38 extern PRIVS privs[];
39
40 enum lsa_handle_type { LSA_HANDLE_POLICY_TYPE = 1, LSA_HANDLE_ACCOUNT_TYPE };
41
42 struct lsa_info {
43         DOM_SID sid;
44         uint32 access;
45         enum lsa_handle_type type;
46 };
47
48 const struct generic_mapping lsa_account_mapping = {
49         LSA_ACCOUNT_READ,
50         LSA_ACCOUNT_WRITE,
51         LSA_ACCOUNT_EXECUTE,
52         LSA_ACCOUNT_ALL_ACCESS
53 };
54
55 const struct generic_mapping lsa_policy_mapping = {
56         LSA_POLICY_READ,
57         LSA_POLICY_WRITE,
58         LSA_POLICY_EXECUTE,
59         LSA_POLICY_ALL_ACCESS
60 };
61
62 /***************************************************************************
63  init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
64 ***************************************************************************/
65
66 static int init_lsa_ref_domain_list(TALLOC_CTX *mem_ctx,
67                                     struct lsa_RefDomainList *ref,
68                                     const char *dom_name,
69                                     DOM_SID *dom_sid)
70 {
71         int num = 0;
72
73         if (dom_name != NULL) {
74                 for (num = 0; num < ref->count; num++) {
75                         if (sid_equal(dom_sid, ref->domains[num].sid)) {
76                                 return num;
77                         }
78                 }
79         } else {
80                 num = ref->count;
81         }
82
83         if (num >= LSA_REF_DOMAIN_LIST_MULTIPLIER) {
84                 /* index not found, already at maximum domain limit */
85                 return -1;
86         }
87
88         ref->count = num + 1;
89         ref->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER;
90
91         ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
92                                             struct lsa_DomainInfo, ref->count);
93         if (!ref->domains) {
94                 return -1;
95         }
96
97         ZERO_STRUCT(ref->domains[num]);
98
99         init_lsa_StringLarge(&ref->domains[num].name, dom_name);
100         ref->domains[num].sid = sid_dup_talloc(mem_ctx, dom_sid);
101         if (!ref->domains[num].sid) {
102                 return -1;
103         }
104
105         return num;
106 }
107
108
109 /***************************************************************************
110  initialize a lsa_DomainInfo structure.
111  ***************************************************************************/
112
113 static void init_dom_query_3(struct lsa_DomainInfo *r,
114                              const char *name,
115                              DOM_SID *sid)
116 {
117         init_lsa_StringLarge(&r->name, name);
118         r->sid = sid;
119 }
120
121 /***************************************************************************
122  initialize a lsa_DomainInfo structure.
123  ***************************************************************************/
124
125 static void init_dom_query_5(struct lsa_DomainInfo *r,
126                              const char *name,
127                              DOM_SID *sid)
128 {
129         init_lsa_StringLarge(&r->name, name);
130         r->sid = sid;
131 }
132
133 /***************************************************************************
134  lookup_lsa_rids. Must be called as root for lookup_name to work.
135  ***************************************************************************/
136
137 static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
138                                 struct lsa_RefDomainList *ref,
139                                 struct lsa_TranslatedSid *prid,
140                                 uint32_t num_entries,
141                                 struct lsa_String *name,
142                                 int flags,
143                                 uint32_t *pmapped_count)
144 {
145         uint32 mapped_count, i;
146
147         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
148
149         mapped_count = 0;
150         *pmapped_count = 0;
151
152         for (i = 0; i < num_entries; i++) {
153                 DOM_SID sid;
154                 uint32 rid;
155                 int dom_idx;
156                 const char *full_name;
157                 const char *domain;
158                 enum lsa_SidType type = SID_NAME_UNKNOWN;
159
160                 /* Split name into domain and user component */
161
162                 full_name = name[i].string;
163                 if (full_name == NULL) {
164                         return NT_STATUS_NO_MEMORY;
165                 }
166
167                 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
168
169                 /* We can ignore the result of lookup_name, it will not touch
170                    "type" if it's not successful */
171
172                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
173                             &sid, &type);
174
175                 switch (type) {
176                 case SID_NAME_USER:
177                 case SID_NAME_DOM_GRP:
178                 case SID_NAME_DOMAIN:
179                 case SID_NAME_ALIAS:
180                 case SID_NAME_WKN_GRP:
181                         DEBUG(5, ("init_lsa_rids: %s found\n", full_name));
182                         /* Leave these unchanged */
183                         break;
184                 default:
185                         /* Don't hand out anything but the list above */
186                         DEBUG(5, ("init_lsa_rids: %s not found\n", full_name));
187                         type = SID_NAME_UNKNOWN;
188                         break;
189                 }
190
191                 rid = 0;
192                 dom_idx = -1;
193
194                 if (type != SID_NAME_UNKNOWN) {
195                         sid_split_rid(&sid, &rid);
196                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &sid);
197                         mapped_count++;
198                 }
199
200                 prid[i].sid_type        = type;
201                 prid[i].rid             = rid;
202                 prid[i].sid_index       = dom_idx;
203         }
204
205         *pmapped_count = mapped_count;
206         return NT_STATUS_OK;
207 }
208
209 /***************************************************************************
210  lookup_lsa_sids. Must be called as root for lookup_name to work.
211  ***************************************************************************/
212
213 static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
214                                 struct lsa_RefDomainList *ref,
215                                 struct lsa_TranslatedSid3 *trans_sids,
216                                 uint32_t num_entries,
217                                 struct lsa_String *name,
218                                 int flags,
219                                 uint32 *pmapped_count)
220 {
221         uint32 mapped_count, i;
222
223         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
224
225         mapped_count = 0;
226         *pmapped_count = 0;
227
228         for (i = 0; i < num_entries; i++) {
229                 DOM_SID sid;
230                 uint32 rid;
231                 int dom_idx;
232                 const char *full_name;
233                 const char *domain;
234                 enum lsa_SidType type = SID_NAME_UNKNOWN;
235
236                 ZERO_STRUCT(sid);
237
238                 /* Split name into domain and user component */
239
240                 full_name = name[i].string;
241                 if (full_name == NULL) {
242                         return NT_STATUS_NO_MEMORY;
243                 }
244
245                 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
246
247                 /* We can ignore the result of lookup_name, it will not touch
248                    "type" if it's not successful */
249
250                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
251                             &sid, &type);
252
253                 switch (type) {
254                 case SID_NAME_USER:
255                 case SID_NAME_DOM_GRP:
256                 case SID_NAME_DOMAIN:
257                 case SID_NAME_ALIAS:
258                 case SID_NAME_WKN_GRP:
259                         DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
260                         /* Leave these unchanged */
261                         break;
262                 default:
263                         /* Don't hand out anything but the list above */
264                         DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
265                         type = SID_NAME_UNKNOWN;
266                         break;
267                 }
268
269                 rid = 0;
270                 dom_idx = -1;
271
272                 if (type != SID_NAME_UNKNOWN) {
273                         DOM_SID domain_sid;
274                         sid_copy(&domain_sid, &sid);
275                         sid_split_rid(&domain_sid, &rid);
276                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &domain_sid);
277                         mapped_count++;
278                 }
279
280                 /* Initialize the lsa_TranslatedSid3 return. */
281                 trans_sids[i].sid_type = type;
282                 trans_sids[i].sid = sid_dup_talloc(mem_ctx, &sid);
283                 trans_sids[i].sid_index = dom_idx;
284         }
285
286         *pmapped_count = mapped_count;
287         return NT_STATUS_OK;
288 }
289
290 static NTSTATUS make_lsa_object_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size,
291                                         const struct generic_mapping *map,
292                                         DOM_SID *sid, uint32_t sid_access)
293 {
294         DOM_SID adm_sid;
295         SEC_ACE ace[5];
296         size_t i = 0;
297
298         SEC_ACL *psa = NULL;
299
300         /* READ|EXECUTE access for Everyone */
301
302         init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
303                         map->generic_execute | map->generic_read, 0);
304
305         /* Add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
306
307         init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
308                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
309         init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
310                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
311
312         /* Add Full Access for Domain Admins */
313         sid_copy(&adm_sid, get_global_sam_sid());
314         sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
315         init_sec_ace(&ace[i++], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
316                         map->generic_all, 0);
317
318         /* If we have a sid, give it some special access */
319
320         if (sid) {
321                 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
322                         sid_access, 0);
323         }
324
325         if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, i, ace)) == NULL)
326                 return NT_STATUS_NO_MEMORY;
327
328         if((*sd = make_sec_desc(mem_ctx, SECURITY_DESCRIPTOR_REVISION_1,
329                                 SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL,
330                                 psa, sd_size)) == NULL)
331                 return NT_STATUS_NO_MEMORY;
332
333         return NT_STATUS_OK;
334 }
335
336
337 /***************************************************************************
338  _lsa_OpenPolicy2
339  ***************************************************************************/
340
341 NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
342                           struct lsa_OpenPolicy2 *r)
343 {
344         struct lsa_info *info;
345         SEC_DESC *psd = NULL;
346         size_t sd_size;
347         uint32 des_access = r->in.access_mask;
348         uint32 acc_granted;
349         NTSTATUS status;
350
351         /* Work out max allowed. */
352         map_max_allowed_access(p->server_info->ptok,
353                                &p->server_info->utok,
354                                &des_access);
355
356         /* map the generic bits to the lsa policy ones */
357         se_map_generic(&des_access, &lsa_policy_mapping);
358
359         /* get the generic lsa policy SD until we store it */
360         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size, &lsa_policy_mapping,
361                         NULL, 0);
362         if (!NT_STATUS_IS_OK(status)) {
363                 return status;
364         }
365
366         status = access_check_object(psd, p->server_info->ptok,
367                 NULL, 0, des_access,
368                 &acc_granted, "_lsa_OpenPolicy2" );
369
370         if (!NT_STATUS_IS_OK(status)) {
371                 return status;
372         }
373
374         /* associate the domain SID with the (unique) handle. */
375         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
376         if (info == NULL) {
377                 return NT_STATUS_NO_MEMORY;
378         }
379
380         sid_copy(&info->sid,get_global_sam_sid());
381         info->access = acc_granted;
382         info->type = LSA_HANDLE_POLICY_TYPE;
383
384         /* set up the LSA QUERY INFO response */
385         if (!create_policy_hnd(p, r->out.handle, info))
386                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
387
388         return NT_STATUS_OK;
389 }
390
391 /***************************************************************************
392  _lsa_OpenPolicy
393  ***************************************************************************/
394
395 NTSTATUS _lsa_OpenPolicy(pipes_struct *p,
396                          struct lsa_OpenPolicy *r)
397 {
398         struct lsa_OpenPolicy2 o;
399
400         o.in.system_name        = NULL; /* should be ignored */
401         o.in.attr               = r->in.attr;
402         o.in.access_mask        = r->in.access_mask;
403
404         o.out.handle            = r->out.handle;
405
406         return _lsa_OpenPolicy2(p, &o);
407 }
408
409 /***************************************************************************
410  _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
411  ufff, done :)  mimir
412  ***************************************************************************/
413
414 NTSTATUS _lsa_EnumTrustDom(pipes_struct *p,
415                            struct lsa_EnumTrustDom *r)
416 {
417         struct lsa_info *info;
418         uint32 next_idx;
419         struct trustdom_info **domains;
420         struct lsa_DomainInfo *lsa_domains = NULL;
421         int i;
422
423         /*
424          * preferred length is set to 5 as a "our" preferred length
425          * nt sets this parameter to 2
426          * update (20.08.2002): it's not preferred length, but preferred size!
427          * it needs further investigation how to optimally choose this value
428          */
429         uint32 max_num_domains =
430                 r->in.max_size < 5 ? r->in.max_size : 10;
431         uint32 num_domains;
432         NTSTATUS nt_status;
433         uint32 num_thistime;
434
435         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
436                 return NT_STATUS_INVALID_HANDLE;
437
438         if (info->type != LSA_HANDLE_POLICY_TYPE) {
439                 return NT_STATUS_INVALID_HANDLE;
440         }
441
442         /* check if the user has enough rights */
443         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
444                 return NT_STATUS_ACCESS_DENIED;
445
446         become_root();
447         nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
448         unbecome_root();
449
450         if (!NT_STATUS_IS_OK(nt_status)) {
451                 return nt_status;
452         }
453
454         if (*r->in.resume_handle < num_domains) {
455                 num_thistime = MIN(num_domains, max_num_domains);
456
457                 nt_status = STATUS_MORE_ENTRIES;
458
459                 if (*r->in.resume_handle + num_thistime > num_domains) {
460                         num_thistime = num_domains - *r->in.resume_handle;
461                         nt_status = NT_STATUS_OK;
462                 }
463
464                 next_idx = *r->in.resume_handle + num_thistime;
465         } else {
466                 num_thistime = 0;
467                 next_idx = 0xffffffff;
468                 nt_status = NT_STATUS_NO_MORE_ENTRIES;
469         }
470
471         /* set up the lsa_enum_trust_dom response */
472
473         lsa_domains = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_DomainInfo,
474                                         num_thistime);
475         if (!lsa_domains) {
476                 return NT_STATUS_NO_MEMORY;
477         }
478
479         for (i=0; i<num_thistime; i++) {
480                 init_lsa_StringLarge(&lsa_domains[i].name, domains[i]->name);
481                 lsa_domains[i].sid = &domains[i]->sid;
482         }
483
484         *r->out.resume_handle = next_idx;
485         r->out.domains->count = num_thistime;
486         r->out.domains->domains = lsa_domains;
487
488         return nt_status;
489 }
490
491 #define LSA_AUDIT_NUM_CATEGORIES_NT4    7
492 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K  9
493 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
494
495 /***************************************************************************
496  _lsa_QueryInfoPolicy
497  ***************************************************************************/
498
499 NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
500                               struct lsa_QueryInfoPolicy *r)
501 {
502         NTSTATUS status = NT_STATUS_OK;
503         struct lsa_info *handle;
504         DOM_SID domain_sid;
505         const char *name;
506         DOM_SID *sid = NULL;
507         union lsa_PolicyInformation *info = NULL;
508
509         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
510                 return NT_STATUS_INVALID_HANDLE;
511
512         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
513                 return NT_STATUS_INVALID_HANDLE;
514         }
515
516         info = TALLOC_ZERO_P(p->mem_ctx, union lsa_PolicyInformation);
517         if (!info) {
518                 return NT_STATUS_NO_MEMORY;
519         }
520
521         switch (r->in.level) {
522         case LSA_POLICY_INFO_AUDIT_EVENTS:
523                 {
524
525                 uint32 policy_def = LSA_AUDIT_POLICY_ALL;
526
527                 /* check if the user has enough rights */
528                 if (!(handle->access & LSA_POLICY_VIEW_AUDIT_INFORMATION)) {
529                         DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
530                         return NT_STATUS_ACCESS_DENIED;
531                 }
532
533                 /* fake info: We audit everything. ;) */
534
535                 info->audit_events.auditing_mode = true;
536                 info->audit_events.count = LSA_AUDIT_NUM_CATEGORIES;
537                 info->audit_events.settings = TALLOC_ZERO_ARRAY(p->mem_ctx,
538                                                                 enum lsa_PolicyAuditPolicy,
539                                                                 info->audit_events.count);
540                 if (!info->audit_events.settings) {
541                         return NT_STATUS_NO_MEMORY;
542                 }
543
544                 info->audit_events.settings[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT] = policy_def;
545                 info->audit_events.settings[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS] = policy_def;
546                 info->audit_events.settings[LSA_AUDIT_CATEGORY_LOGON] = policy_def;
547                 info->audit_events.settings[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING] = policy_def;
548                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES] = policy_def;
549                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SYSTEM] = policy_def;
550                 info->audit_events.settings[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS] = policy_def;
551
552                 break;
553                 }
554         case LSA_POLICY_INFO_DOMAIN:
555                 /* check if the user has enough rights */
556                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
557                         return NT_STATUS_ACCESS_DENIED;
558
559                 /* Request PolicyPrimaryDomainInformation. */
560                 switch (lp_server_role()) {
561                         case ROLE_DOMAIN_PDC:
562                         case ROLE_DOMAIN_BDC:
563                                 name = get_global_sam_name();
564                                 sid = sid_dup_talloc(p->mem_ctx, get_global_sam_sid());
565                                 if (!sid) {
566                                         return NT_STATUS_NO_MEMORY;
567                                 }
568                                 break;
569                         case ROLE_DOMAIN_MEMBER:
570                                 name = lp_workgroup();
571                                 /* We need to return the Domain SID here. */
572                                 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
573                                         sid = sid_dup_talloc(p->mem_ctx, &domain_sid);
574                                         if (!sid) {
575                                                 return NT_STATUS_NO_MEMORY;
576                                         }
577                                 } else {
578                                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
579                                 }
580                                 break;
581                         case ROLE_STANDALONE:
582                                 name = lp_workgroup();
583                                 sid = NULL;
584                                 break;
585                         default:
586                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
587                 }
588                 init_dom_query_3(&info->domain, name, sid);
589                 break;
590         case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
591                 /* check if the user has enough rights */
592                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
593                         return NT_STATUS_ACCESS_DENIED;
594
595                 /* Request PolicyAccountDomainInformation. */
596                 name = get_global_sam_name();
597                 sid = get_global_sam_sid();
598
599                 init_dom_query_5(&info->account_domain, name, sid);
600                 break;
601         case LSA_POLICY_INFO_ROLE:
602                 /* check if the user has enough rights */
603                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
604                         return NT_STATUS_ACCESS_DENIED;
605
606                 switch (lp_server_role()) {
607                         case ROLE_DOMAIN_BDC:
608                                 /*
609                                  * only a BDC is a backup controller
610                                  * of the domain, it controls.
611                                  */
612                                 info->role.role = LSA_ROLE_BACKUP;
613                                 break;
614                         default:
615                                 /*
616                                  * any other role is a primary
617                                  * of the domain, it controls.
618                                  */
619                                 info->role.role = LSA_ROLE_PRIMARY;
620                                 break;
621                 }
622                 break;
623         case LSA_POLICY_INFO_DNS:
624         case LSA_POLICY_INFO_DNS_INT: {
625                 struct pdb_domain_info *dominfo;
626
627                 if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
628                         DEBUG(10, ("Not replying to LSA_POLICY_INFO_DNS "
629                                    "without ADS passdb backend\n"));
630                         status = NT_STATUS_INVALID_INFO_CLASS;
631                         break;
632                 }
633
634                 dominfo = pdb_get_domain_info(info);
635                 if (dominfo == NULL) {
636                         status = NT_STATUS_NO_MEMORY;
637                         break;
638                 }
639
640                 init_lsa_StringLarge(&info->dns.name,
641                                      dominfo->name);
642                 init_lsa_StringLarge(&info->dns.dns_domain,
643                                      dominfo->dns_domain);
644                 init_lsa_StringLarge(&info->dns.dns_forest,
645                                      dominfo->dns_forest);
646                 info->dns.domain_guid = dominfo->guid;
647                 info->dns.sid = &dominfo->sid;
648                 break;
649         }
650         default:
651                 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
652                         r->in.level));
653                 status = NT_STATUS_INVALID_INFO_CLASS;
654                 break;
655         }
656
657         *r->out.info = info;
658
659         return status;
660 }
661
662 /***************************************************************************
663  _lsa_QueryInfoPolicy2
664  ***************************************************************************/
665
666 NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p,
667                                struct lsa_QueryInfoPolicy2 *r2)
668 {
669         struct lsa_QueryInfoPolicy r;
670
671         if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
672                 p->rng_fault_state = True;
673                 return NT_STATUS_NOT_IMPLEMENTED;
674         }
675
676         ZERO_STRUCT(r);
677         r.in.handle = r2->in.handle;
678         r.in.level = r2->in.level;
679         r.out.info = r2->out.info;
680
681         return _lsa_QueryInfoPolicy(p, &r);
682 }
683
684 /***************************************************************************
685  _lsa_lookup_sids_internal
686  ***************************************************************************/
687
688 static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
689                                           TALLOC_CTX *mem_ctx,
690                                           uint16_t level,                       /* input */
691                                           int num_sids,                         /* input */
692                                           struct lsa_SidPtr *sid,               /* input */
693                                           struct lsa_RefDomainList **pp_ref,    /* input/output */
694                                           struct lsa_TranslatedName2 **pp_names,/* input/output */
695                                           uint32_t *pp_mapped_count)            /* input/output */
696 {
697         NTSTATUS status;
698         int i;
699         const DOM_SID **sids = NULL;
700         struct lsa_RefDomainList *ref = NULL;
701         uint32 mapped_count = 0;
702         struct lsa_dom_info *dom_infos = NULL;
703         struct lsa_name_info *name_infos = NULL;
704         struct lsa_TranslatedName2 *names = NULL;
705
706         *pp_mapped_count = 0;
707         *pp_names = NULL;
708         *pp_ref = NULL;
709
710         if (num_sids == 0) {
711                 return NT_STATUS_OK;
712         }
713
714         sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
715         ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
716
717         if (sids == NULL || ref == NULL) {
718                 return NT_STATUS_NO_MEMORY;
719         }
720
721         for (i=0; i<num_sids; i++) {
722                 sids[i] = sid[i].sid;
723         }
724
725         status = lookup_sids(p->mem_ctx, num_sids, sids, level,
726                                   &dom_infos, &name_infos);
727
728         if (!NT_STATUS_IS_OK(status)) {
729                 return status;
730         }
731
732         names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
733         if (names == NULL) {
734                 return NT_STATUS_NO_MEMORY;
735         }
736
737         for (i=0; i<LSA_REF_DOMAIN_LIST_MULTIPLIER; i++) {
738
739                 if (!dom_infos[i].valid) {
740                         break;
741                 }
742
743                 if (init_lsa_ref_domain_list(mem_ctx, ref,
744                                              dom_infos[i].name,
745                                              &dom_infos[i].sid) != i) {
746                         DEBUG(0, ("Domain %s mentioned twice??\n",
747                                   dom_infos[i].name));
748                         return NT_STATUS_INTERNAL_ERROR;
749                 }
750         }
751
752         for (i=0; i<num_sids; i++) {
753                 struct lsa_name_info *name = &name_infos[i];
754
755                 if (name->type == SID_NAME_UNKNOWN) {
756                         fstring tmp;
757                         name->dom_idx = -1;
758                         /* Unknown sids should return the string
759                          * representation of the SID. Windows 2003 behaves
760                          * rather erratic here, in many cases it returns the
761                          * RID as 8 bytes hex, in others it returns the full
762                          * SID. We (Jerry/VL) could not figure out which the
763                          * hard cases are, so leave it with the SID.  */
764                         name->name = talloc_asprintf(p->mem_ctx, "%s",
765                                                      sid_to_fstring(tmp,
766                                                                     sids[i]));
767                         if (name->name == NULL) {
768                                 return NT_STATUS_NO_MEMORY;
769                         }
770                 } else {
771                         mapped_count += 1;
772                 }
773
774                 names[i].sid_type       = name->type;
775                 names[i].name.string    = name->name;
776                 names[i].sid_index      = name->dom_idx;
777                 names[i].unknown        = 0;
778         }
779
780         status = NT_STATUS_NONE_MAPPED;
781         if (mapped_count > 0) {
782                 status = (mapped_count < num_sids) ?
783                         STATUS_SOME_UNMAPPED : NT_STATUS_OK;
784         }
785
786         DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
787                    num_sids, mapped_count, nt_errstr(status)));
788
789         *pp_mapped_count = mapped_count;
790         *pp_names = names;
791         *pp_ref = ref;
792
793         return status;
794 }
795
796 /***************************************************************************
797  _lsa_LookupSids
798  ***************************************************************************/
799
800 NTSTATUS _lsa_LookupSids(pipes_struct *p,
801                          struct lsa_LookupSids *r)
802 {
803         NTSTATUS status;
804         struct lsa_info *handle;
805         int num_sids = r->in.sids->num_sids;
806         uint32 mapped_count = 0;
807         struct lsa_RefDomainList *domains = NULL;
808         struct lsa_TranslatedName *names_out = NULL;
809         struct lsa_TranslatedName2 *names = NULL;
810         int i;
811
812         if ((r->in.level < 1) || (r->in.level > 6)) {
813                 return NT_STATUS_INVALID_PARAMETER;
814         }
815
816         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
817                 return NT_STATUS_INVALID_HANDLE;
818         }
819
820         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
821                 return NT_STATUS_INVALID_HANDLE;
822         }
823
824         /* check if the user has enough rights */
825         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
826                 return NT_STATUS_ACCESS_DENIED;
827         }
828
829         if (num_sids >  MAX_LOOKUP_SIDS) {
830                 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
831                          MAX_LOOKUP_SIDS, num_sids));
832                 return NT_STATUS_NONE_MAPPED;
833         }
834
835         status = _lsa_lookup_sids_internal(p,
836                                            p->mem_ctx,
837                                            r->in.level,
838                                            num_sids,
839                                            r->in.sids->sids,
840                                            &domains,
841                                            &names,
842                                            &mapped_count);
843
844         /* Only return here when there is a real error.
845            NT_STATUS_NONE_MAPPED is a special case as it indicates that none of
846            the requested sids could be resolved. Older versions of XP (pre SP3)
847            rely that we return with the string representations of those SIDs in
848            that case. If we don't, XP crashes - Guenther
849            */
850
851         if (NT_STATUS_IS_ERR(status) &&
852             !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
853                 return status;
854         }
855
856         /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
857         names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
858                                  num_sids);
859         if (!names_out) {
860                 return NT_STATUS_NO_MEMORY;
861         }
862
863         for (i=0; i<num_sids; i++) {
864                 names_out[i].sid_type = names[i].sid_type;
865                 names_out[i].name = names[i].name;
866                 names_out[i].sid_index = names[i].sid_index;
867         }
868
869         *r->out.domains = domains;
870         r->out.names->count = num_sids;
871         r->out.names->names = names_out;
872         *r->out.count = mapped_count;
873
874         return status;
875 }
876
877 /***************************************************************************
878  _lsa_LookupSids2
879  ***************************************************************************/
880
881 NTSTATUS _lsa_LookupSids2(pipes_struct *p,
882                           struct lsa_LookupSids2 *r)
883 {
884         NTSTATUS status;
885         struct lsa_info *handle;
886         int num_sids = r->in.sids->num_sids;
887         uint32 mapped_count = 0;
888         struct lsa_RefDomainList *domains = NULL;
889         struct lsa_TranslatedName2 *names = NULL;
890         bool check_policy = true;
891
892         switch (p->hdr_req.opnum) {
893                 case NDR_LSA_LOOKUPSIDS3:
894                         check_policy = false;
895                         break;
896                 case NDR_LSA_LOOKUPSIDS2:
897                 default:
898                         check_policy = true;
899         }
900
901         if ((r->in.level < 1) || (r->in.level > 6)) {
902                 return NT_STATUS_INVALID_PARAMETER;
903         }
904
905         if (check_policy) {
906                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
907                         return NT_STATUS_INVALID_HANDLE;
908                 }
909
910                 if (handle->type != LSA_HANDLE_POLICY_TYPE) {
911                         return NT_STATUS_INVALID_HANDLE;
912                 }
913
914                 /* check if the user has enough rights */
915                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
916                         return NT_STATUS_ACCESS_DENIED;
917                 }
918         }
919
920         if (num_sids >  MAX_LOOKUP_SIDS) {
921                 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
922                          MAX_LOOKUP_SIDS, num_sids));
923                 return NT_STATUS_NONE_MAPPED;
924         }
925
926         status = _lsa_lookup_sids_internal(p,
927                                            p->mem_ctx,
928                                            r->in.level,
929                                            num_sids,
930                                            r->in.sids->sids,
931                                            &domains,
932                                            &names,
933                                            &mapped_count);
934
935         *r->out.domains = domains;
936         r->out.names->count = num_sids;
937         r->out.names->names = names;
938         *r->out.count = mapped_count;
939
940         return status;
941 }
942
943 /***************************************************************************
944  _lsa_LookupSids3
945  ***************************************************************************/
946
947 NTSTATUS _lsa_LookupSids3(pipes_struct *p,
948                           struct lsa_LookupSids3 *r)
949 {
950         struct lsa_LookupSids2 q;
951
952         /* No policy handle on this call. Restrict to crypto connections. */
953         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
954                 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
955                         get_remote_machine_name() ));
956                 return NT_STATUS_INVALID_PARAMETER;
957         }
958
959         q.in.handle             = NULL;
960         q.in.sids               = r->in.sids;
961         q.in.level              = r->in.level;
962         q.in.unknown1           = r->in.unknown1;
963         q.in.unknown2           = r->in.unknown2;
964         q.in.names              = r->in.names;
965         q.in.count              = r->in.count;
966
967         q.out.domains           = r->out.domains;
968         q.out.names             = r->out.names;
969         q.out.count             = r->out.count;
970
971         return _lsa_LookupSids2(p, &q);
972 }
973
974 /***************************************************************************
975  ***************************************************************************/
976
977 static int lsa_lookup_level_to_flags(uint16 level)
978 {
979         int flags;
980
981         switch (level) {
982                 case 1:
983                         flags = LOOKUP_NAME_ALL;
984                         break;
985                 case 2:
986                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_REMOTE|LOOKUP_NAME_ISOLATED;
987                         break;
988                 case 3:
989                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED;
990                         break;
991                 case 4:
992                 case 5:
993                 case 6:
994                 default:
995                         flags = LOOKUP_NAME_NONE;
996                         break;
997         }
998
999         return flags;
1000 }
1001
1002 /***************************************************************************
1003  _lsa_LookupNames
1004  ***************************************************************************/
1005
1006 NTSTATUS _lsa_LookupNames(pipes_struct *p,
1007                           struct lsa_LookupNames *r)
1008 {
1009         NTSTATUS status = NT_STATUS_NONE_MAPPED;
1010         struct lsa_info *handle;
1011         struct lsa_String *names = r->in.names;
1012         uint32 num_entries = r->in.num_names;
1013         struct lsa_RefDomainList *domains = NULL;
1014         struct lsa_TranslatedSid *rids = NULL;
1015         uint32 mapped_count = 0;
1016         int flags = 0;
1017
1018         if (num_entries >  MAX_LOOKUP_SIDS) {
1019                 num_entries = MAX_LOOKUP_SIDS;
1020                 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
1021                         num_entries));
1022         }
1023
1024         flags = lsa_lookup_level_to_flags(r->in.level);
1025
1026         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1027         if (!domains) {
1028                 return NT_STATUS_NO_MEMORY;
1029         }
1030
1031         if (num_entries) {
1032                 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid,
1033                                          num_entries);
1034                 if (!rids) {
1035                         return NT_STATUS_NO_MEMORY;
1036                 }
1037         } else {
1038                 rids = NULL;
1039         }
1040
1041         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1042                 status = NT_STATUS_INVALID_HANDLE;
1043                 goto done;
1044         }
1045
1046         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1047                 return NT_STATUS_INVALID_HANDLE;
1048         }
1049
1050         /* check if the user has enough rights */
1051         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1052                 status = NT_STATUS_ACCESS_DENIED;
1053                 goto done;
1054         }
1055
1056         /* set up the LSA Lookup RIDs response */
1057         become_root(); /* lookup_name can require root privs */
1058         status = lookup_lsa_rids(p->mem_ctx, domains, rids, num_entries,
1059                                  names, flags, &mapped_count);
1060         unbecome_root();
1061
1062 done:
1063
1064         if (NT_STATUS_IS_OK(status) && (num_entries != 0) ) {
1065                 if (mapped_count == 0) {
1066                         status = NT_STATUS_NONE_MAPPED;
1067                 } else if (mapped_count != num_entries) {
1068                         status = STATUS_SOME_UNMAPPED;
1069                 }
1070         }
1071
1072         *r->out.count = mapped_count;
1073         *r->out.domains = domains;
1074         r->out.sids->sids = rids;
1075         r->out.sids->count = num_entries;
1076
1077         return status;
1078 }
1079
1080 /***************************************************************************
1081  _lsa_LookupNames2
1082  ***************************************************************************/
1083
1084 NTSTATUS _lsa_LookupNames2(pipes_struct *p,
1085                            struct lsa_LookupNames2 *r)
1086 {
1087         NTSTATUS status;
1088         struct lsa_LookupNames q;
1089         struct lsa_TransSidArray2 *sid_array2 = r->in.sids;
1090         struct lsa_TransSidArray *sid_array = NULL;
1091         uint32_t i;
1092
1093         sid_array = TALLOC_ZERO_P(p->mem_ctx, struct lsa_TransSidArray);
1094         if (!sid_array) {
1095                 return NT_STATUS_NO_MEMORY;
1096         }
1097
1098         q.in.handle             = r->in.handle;
1099         q.in.num_names          = r->in.num_names;
1100         q.in.names              = r->in.names;
1101         q.in.level              = r->in.level;
1102         q.in.sids               = sid_array;
1103         q.in.count              = r->in.count;
1104         /* we do not know what this is for */
1105         /*                      = r->in.unknown1; */
1106         /*                      = r->in.unknown2; */
1107
1108         q.out.domains           = r->out.domains;
1109         q.out.sids              = sid_array;
1110         q.out.count             = r->out.count;
1111
1112         status = _lsa_LookupNames(p, &q);
1113
1114         sid_array2->count = sid_array->count;
1115         sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
1116         if (!sid_array2->sids) {
1117                 return NT_STATUS_NO_MEMORY;
1118         }
1119
1120         for (i=0; i<sid_array->count; i++) {
1121                 sid_array2->sids[i].sid_type  = sid_array->sids[i].sid_type;
1122                 sid_array2->sids[i].rid       = sid_array->sids[i].rid;
1123                 sid_array2->sids[i].sid_index = sid_array->sids[i].sid_index;
1124                 sid_array2->sids[i].unknown   = 0;
1125         }
1126
1127         r->out.sids = sid_array2;
1128
1129         return status;
1130 }
1131
1132 /***************************************************************************
1133  _lsa_LookupNames3
1134  ***************************************************************************/
1135
1136 NTSTATUS _lsa_LookupNames3(pipes_struct *p,
1137                            struct lsa_LookupNames3 *r)
1138 {
1139         NTSTATUS status;
1140         struct lsa_info *handle;
1141         struct lsa_String *names = r->in.names;
1142         uint32 num_entries = r->in.num_names;
1143         struct lsa_RefDomainList *domains = NULL;
1144         struct lsa_TranslatedSid3 *trans_sids = NULL;
1145         uint32 mapped_count = 0;
1146         int flags = 0;
1147         bool check_policy = true;
1148
1149         switch (p->hdr_req.opnum) {
1150                 case NDR_LSA_LOOKUPNAMES4:
1151                         check_policy = false;
1152                         break;
1153                 case NDR_LSA_LOOKUPNAMES3:
1154                 default:
1155                         check_policy = true;
1156         }
1157
1158         if (num_entries >  MAX_LOOKUP_SIDS) {
1159                 num_entries = MAX_LOOKUP_SIDS;
1160                 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries));
1161         }
1162
1163         /* Probably the lookup_level is some sort of bitmask. */
1164         if (r->in.level == 1) {
1165                 flags = LOOKUP_NAME_ALL;
1166         }
1167
1168         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1169         if (!domains) {
1170                 return NT_STATUS_NO_MEMORY;
1171         }
1172
1173         if (num_entries) {
1174                 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid3,
1175                                                num_entries);
1176                 if (!trans_sids) {
1177                         return NT_STATUS_NO_MEMORY;
1178                 }
1179         } else {
1180                 trans_sids = NULL;
1181         }
1182
1183         if (check_policy) {
1184
1185                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1186                         status = NT_STATUS_INVALID_HANDLE;
1187                         goto done;
1188                 }
1189
1190                 if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1191                         return NT_STATUS_INVALID_HANDLE;
1192                 }
1193
1194                 /* check if the user has enough rights */
1195                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1196                         status = NT_STATUS_ACCESS_DENIED;
1197                         goto done;
1198                 }
1199         }
1200
1201         /* set up the LSA Lookup SIDs response */
1202         become_root(); /* lookup_name can require root privs */
1203         status = lookup_lsa_sids(p->mem_ctx, domains, trans_sids, num_entries,
1204                                  names, flags, &mapped_count);
1205         unbecome_root();
1206
1207 done:
1208
1209         if (NT_STATUS_IS_OK(status)) {
1210                 if (mapped_count == 0) {
1211                         status = NT_STATUS_NONE_MAPPED;
1212                 } else if (mapped_count != num_entries) {
1213                         status = STATUS_SOME_UNMAPPED;
1214                 }
1215         }
1216
1217         *r->out.count = mapped_count;
1218         *r->out.domains = domains;
1219         r->out.sids->sids = trans_sids;
1220         r->out.sids->count = num_entries;
1221
1222         return status;
1223 }
1224
1225 /***************************************************************************
1226  _lsa_LookupNames4
1227  ***************************************************************************/
1228
1229 NTSTATUS _lsa_LookupNames4(pipes_struct *p,
1230                            struct lsa_LookupNames4 *r)
1231 {
1232         struct lsa_LookupNames3 q;
1233
1234         /* No policy handle on this call. Restrict to crypto connections. */
1235         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1236                 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1237                         get_remote_machine_name() ));
1238                 return NT_STATUS_INVALID_PARAMETER;
1239         }
1240
1241         q.in.handle             = NULL;
1242         q.in.num_names          = r->in.num_names;
1243         q.in.names              = r->in.names;
1244         q.in.level              = r->in.level;
1245         q.in.lookup_options     = r->in.lookup_options;
1246         q.in.client_revision    = r->in.client_revision;
1247         q.in.sids               = r->in.sids;
1248         q.in.count              = r->in.count;
1249
1250         q.out.domains           = r->out.domains;
1251         q.out.sids              = r->out.sids;
1252         q.out.count             = r->out.count;
1253
1254         return _lsa_LookupNames3(p, &q);
1255 }
1256
1257 /***************************************************************************
1258  _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1259  ***************************************************************************/
1260
1261 NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
1262 {
1263         if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
1264                 return NT_STATUS_INVALID_HANDLE;
1265         }
1266
1267         close_policy_hnd(p, r->in.handle);
1268         ZERO_STRUCTP(r->out.handle);
1269         return NT_STATUS_OK;
1270 }
1271
1272 /***************************************************************************
1273  ***************************************************************************/
1274
1275 NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
1276 {
1277         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1278 }
1279
1280 /***************************************************************************
1281  ***************************************************************************/
1282
1283 NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
1284 {
1285         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1286 }
1287
1288 /***************************************************************************
1289  ***************************************************************************/
1290
1291 NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
1292 {
1293         return NT_STATUS_ACCESS_DENIED;
1294 }
1295
1296 /***************************************************************************
1297  ***************************************************************************/
1298
1299 NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
1300 {
1301         return NT_STATUS_ACCESS_DENIED;
1302 }
1303
1304 /***************************************************************************
1305  ***************************************************************************/
1306
1307 NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
1308 {
1309         return NT_STATUS_ACCESS_DENIED;
1310 }
1311
1312 /***************************************************************************
1313  _lsa_DeleteObject
1314  ***************************************************************************/
1315
1316 NTSTATUS _lsa_DeleteObject(pipes_struct *p,
1317                            struct lsa_DeleteObject *r)
1318 {
1319         NTSTATUS status;
1320         struct lsa_info *info = NULL;
1321
1322         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
1323                 return NT_STATUS_INVALID_HANDLE;
1324         }
1325
1326         if (!(info->access & STD_RIGHT_DELETE_ACCESS)) {
1327                 return NT_STATUS_ACCESS_DENIED;
1328         }
1329
1330         switch (info->type) {
1331         case LSA_HANDLE_ACCOUNT_TYPE:
1332                 status = privilege_delete_account(&info->sid);
1333                 if (!NT_STATUS_IS_OK(status)) {
1334                         DEBUG(10,("_lsa_DeleteObject: privilege_delete_account gave: %s\n",
1335                                 nt_errstr(status)));
1336                         return status;
1337                 }
1338                 break;
1339         default:
1340                 return NT_STATUS_INVALID_HANDLE;
1341         }
1342
1343         close_policy_hnd(p, r->in.handle);
1344         ZERO_STRUCTP(r->out.handle);
1345
1346         return status;
1347 }
1348
1349 /***************************************************************************
1350  _lsa_EnumPrivs
1351  ***************************************************************************/
1352
1353 NTSTATUS _lsa_EnumPrivs(pipes_struct *p,
1354                         struct lsa_EnumPrivs *r)
1355 {
1356         struct lsa_info *handle;
1357         uint32 i;
1358         uint32 enum_context = *r->in.resume_handle;
1359         int num_privs = count_all_privileges();
1360         struct lsa_PrivEntry *entries = NULL;
1361         LUID_ATTR luid;
1362
1363         /* remember that the enum_context starts at 0 and not 1 */
1364
1365         if ( enum_context >= num_privs )
1366                 return NT_STATUS_NO_MORE_ENTRIES;
1367
1368         DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1369                 enum_context, num_privs));
1370
1371         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1372                 return NT_STATUS_INVALID_HANDLE;
1373
1374         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1375                 return NT_STATUS_INVALID_HANDLE;
1376         }
1377
1378         /* check if the user has enough rights
1379            I don't know if it's the right one. not documented.  */
1380
1381         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1382                 return NT_STATUS_ACCESS_DENIED;
1383
1384         if (num_privs) {
1385                 entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_PrivEntry, num_privs);
1386                 if (!entries) {
1387                         return NT_STATUS_NO_MEMORY;
1388                 }
1389         } else {
1390                 entries = NULL;
1391         }
1392
1393         for (i = 0; i < num_privs; i++) {
1394                 if( i < enum_context) {
1395
1396                         init_lsa_StringLarge(&entries[i].name, NULL);
1397
1398                         entries[i].luid.low = 0;
1399                         entries[i].luid.high = 0;
1400                 } else {
1401
1402                         init_lsa_StringLarge(&entries[i].name, privs[i].name);
1403
1404                         luid = get_privilege_luid( &privs[i].se_priv );
1405
1406                         entries[i].luid.low = luid.luid.low;
1407                         entries[i].luid.high = luid.luid.high;
1408                 }
1409         }
1410
1411         enum_context = num_privs;
1412
1413         *r->out.resume_handle = enum_context;
1414         r->out.privs->count = num_privs;
1415         r->out.privs->privs = entries;
1416
1417         return NT_STATUS_OK;
1418 }
1419
1420 /***************************************************************************
1421  _lsa_LookupPrivDisplayName
1422  ***************************************************************************/
1423
1424 NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p,
1425                                     struct lsa_LookupPrivDisplayName *r)
1426 {
1427         struct lsa_info *handle;
1428         const char *description;
1429         struct lsa_StringLarge *lsa_name;
1430
1431         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1432                 return NT_STATUS_INVALID_HANDLE;
1433
1434         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1435                 return NT_STATUS_INVALID_HANDLE;
1436         }
1437
1438         /* check if the user has enough rights */
1439
1440         /*
1441          * I don't know if it's the right one. not documented.
1442          */
1443         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1444                 return NT_STATUS_ACCESS_DENIED;
1445
1446         DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r->in.name->string));
1447
1448         description = get_privilege_dispname(r->in.name->string);
1449         if (!description) {
1450                 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1451                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1452         }
1453
1454         DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description));
1455
1456         lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
1457         if (!lsa_name) {
1458                 return NT_STATUS_NO_MEMORY;
1459         }
1460
1461         init_lsa_StringLarge(lsa_name, description);
1462
1463         *r->out.returned_language_id = r->in.language_id;
1464         *r->out.disp_name = lsa_name;
1465
1466         return NT_STATUS_OK;
1467 }
1468
1469 /***************************************************************************
1470  _lsa_EnumAccounts
1471  ***************************************************************************/
1472
1473 NTSTATUS _lsa_EnumAccounts(pipes_struct *p,
1474                            struct lsa_EnumAccounts *r)
1475 {
1476         struct lsa_info *handle;
1477         DOM_SID *sid_list;
1478         int i, j, num_entries;
1479         NTSTATUS status;
1480         struct lsa_SidPtr *sids = NULL;
1481
1482         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1483                 return NT_STATUS_INVALID_HANDLE;
1484
1485         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1486                 return NT_STATUS_INVALID_HANDLE;
1487         }
1488
1489         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1490                 return NT_STATUS_ACCESS_DENIED;
1491
1492         sid_list = NULL;
1493         num_entries = 0;
1494
1495         /* The only way we can currently find out all the SIDs that have been
1496            privileged is to scan all privileges */
1497
1498         status = privilege_enumerate_accounts(&sid_list, &num_entries);
1499         if (!NT_STATUS_IS_OK(status)) {
1500                 return status;
1501         }
1502
1503         if (*r->in.resume_handle >= num_entries) {
1504                 return NT_STATUS_NO_MORE_ENTRIES;
1505         }
1506
1507         if (num_entries - *r->in.resume_handle) {
1508                 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr,
1509                                          num_entries - *r->in.resume_handle);
1510                 if (!sids) {
1511                         talloc_free(sid_list);
1512                         return NT_STATUS_NO_MEMORY;
1513                 }
1514
1515                 for (i = *r->in.resume_handle, j = 0; i < num_entries; i++, j++) {
1516                         sids[j].sid = sid_dup_talloc(p->mem_ctx, &sid_list[i]);
1517                         if (!sids[j].sid) {
1518                                 talloc_free(sid_list);
1519                                 return NT_STATUS_NO_MEMORY;
1520                         }
1521                 }
1522         }
1523
1524         talloc_free(sid_list);
1525
1526         *r->out.resume_handle = num_entries;
1527         r->out.sids->num_sids = num_entries;
1528         r->out.sids->sids = sids;
1529
1530         return NT_STATUS_OK;
1531 }
1532
1533 /***************************************************************************
1534  _lsa_GetUserName
1535  ***************************************************************************/
1536
1537 NTSTATUS _lsa_GetUserName(pipes_struct *p,
1538                           struct lsa_GetUserName *r)
1539 {
1540         const char *username, *domname;
1541         struct lsa_String *account_name = NULL;
1542         struct lsa_String *authority_name = NULL;
1543
1544         if (r->in.account_name &&
1545            *r->in.account_name) {
1546                 return NT_STATUS_INVALID_PARAMETER;
1547         }
1548
1549         if (r->in.authority_name &&
1550            *r->in.authority_name) {
1551                 return NT_STATUS_INVALID_PARAMETER;
1552         }
1553
1554         if (p->server_info->guest) {
1555                 /*
1556                  * I'm 99% sure this is not the right place to do this,
1557                  * global_sid_Anonymous should probably be put into the token
1558                  * instead of the guest id -- vl
1559                  */
1560                 if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
1561                                 &domname, &username, NULL)) {
1562                         return NT_STATUS_NO_MEMORY;
1563                 }
1564         } else {
1565                 username = p->server_info->sanitized_username;
1566                 domname = pdb_get_domain(p->server_info->sam_account);
1567         }
1568
1569         account_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1570         if (!account_name) {
1571                 return NT_STATUS_NO_MEMORY;
1572         }
1573         init_lsa_String(account_name, username);
1574
1575         if (r->out.authority_name) {
1576                 authority_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1577                 if (!authority_name) {
1578                         return NT_STATUS_NO_MEMORY;
1579                 }
1580                 init_lsa_String(authority_name, domname);
1581         }
1582
1583         *r->out.account_name = account_name;
1584         if (r->out.authority_name) {
1585                 *r->out.authority_name = authority_name;
1586         }
1587
1588         return NT_STATUS_OK;
1589 }
1590
1591 /***************************************************************************
1592  _lsa_CreateAccount
1593  ***************************************************************************/
1594
1595 NTSTATUS _lsa_CreateAccount(pipes_struct *p,
1596                             struct lsa_CreateAccount *r)
1597 {
1598         struct lsa_info *handle;
1599         struct lsa_info *info;
1600
1601         /* find the connection policy handle. */
1602         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1603                 return NT_STATUS_INVALID_HANDLE;
1604
1605         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1606                 return NT_STATUS_INVALID_HANDLE;
1607         }
1608
1609         /* check if the user has enough rights */
1610
1611         /*
1612          * I don't know if it's the right one. not documented.
1613          * but guessed with rpcclient.
1614          */
1615         if (!(handle->access & LSA_POLICY_CREATE_ACCOUNT))
1616                 return NT_STATUS_ACCESS_DENIED;
1617
1618         if ( is_privileged_sid( r->in.sid ) )
1619                 return NT_STATUS_OBJECT_NAME_COLLISION;
1620
1621         /* associate the user/group SID with the (unique) handle. */
1622
1623         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1624         if (info == NULL) {
1625                 return NT_STATUS_NO_MEMORY;
1626         }
1627
1628         info->sid = *r->in.sid;
1629         info->access = r->in.access_mask;
1630         info->type = LSA_HANDLE_ACCOUNT_TYPE;
1631
1632         /* get a (unique) handle.  open a policy on it. */
1633         if (!create_policy_hnd(p, r->out.acct_handle, info))
1634                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1635
1636         return privilege_create_account( &info->sid );
1637 }
1638
1639 /***************************************************************************
1640  _lsa_OpenAccount
1641  ***************************************************************************/
1642
1643 NTSTATUS _lsa_OpenAccount(pipes_struct *p,
1644                           struct lsa_OpenAccount *r)
1645 {
1646         struct lsa_info *handle;
1647         struct lsa_info *info;
1648         SEC_DESC *psd = NULL;
1649         size_t sd_size;
1650         uint32_t des_access = r->in.access_mask;
1651         uint32_t acc_granted;
1652         NTSTATUS status;
1653
1654         /* find the connection policy handle. */
1655         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1656                 return NT_STATUS_INVALID_HANDLE;
1657
1658         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1659                 return NT_STATUS_INVALID_HANDLE;
1660         }
1661
1662         /* des_access is for the account here, not the policy
1663          * handle - so don't check against policy handle. */
1664
1665         /* Work out max allowed. */
1666         map_max_allowed_access(p->server_info->ptok,
1667                                &p->server_info->utok,
1668                                &des_access);
1669
1670         /* map the generic bits to the lsa account ones */
1671         se_map_generic(&des_access, &lsa_account_mapping);
1672
1673         /* get the generic lsa account SD until we store it */
1674         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
1675                                 &lsa_account_mapping,
1676                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
1677         if (!NT_STATUS_IS_OK(status)) {
1678                 return status;
1679         }
1680
1681         status = access_check_object(psd, p->server_info->ptok,
1682                 NULL, 0, des_access,
1683                 &acc_granted, "_lsa_OpenAccount" );
1684
1685         if (!NT_STATUS_IS_OK(status)) {
1686                 return status;
1687         }
1688
1689         /* TODO: Fis the parsing routine before reenabling this check! */
1690         #if 0
1691         if (!lookup_sid(&handle->sid, dom_name, name, &type))
1692                 return NT_STATUS_ACCESS_DENIED;
1693         #endif
1694         /* associate the user/group SID with the (unique) handle. */
1695         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1696         if (info == NULL) {
1697                 return NT_STATUS_NO_MEMORY;
1698         }
1699
1700         info->sid = *r->in.sid;
1701         info->access = acc_granted;
1702         info->type = LSA_HANDLE_ACCOUNT_TYPE;
1703
1704         /* get a (unique) handle.  open a policy on it. */
1705         if (!create_policy_hnd(p, r->out.acct_handle, info))
1706                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1707
1708         return NT_STATUS_OK;
1709 }
1710
1711 /***************************************************************************
1712  _lsa_EnumPrivsAccount
1713  For a given SID, enumerate all the privilege this account has.
1714  ***************************************************************************/
1715
1716 NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
1717                                struct lsa_EnumPrivsAccount *r)
1718 {
1719         NTSTATUS status = NT_STATUS_OK;
1720         struct lsa_info *info=NULL;
1721         SE_PRIV mask;
1722         PRIVILEGE_SET privileges;
1723         struct lsa_PrivilegeSet *priv_set = NULL;
1724         struct lsa_LUIDAttribute *luid_attrs = NULL;
1725         int i;
1726
1727         /* find the connection policy handle. */
1728         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1729                 return NT_STATUS_INVALID_HANDLE;
1730
1731         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1732                 return NT_STATUS_INVALID_HANDLE;
1733         }
1734
1735         if (!(info->access & LSA_ACCOUNT_VIEW))
1736                 return NT_STATUS_ACCESS_DENIED;
1737
1738         get_privileges_for_sids(&mask, &info->sid, 1);
1739
1740         privilege_set_init( &privileges );
1741
1742         priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
1743         if (!priv_set) {
1744                 status = NT_STATUS_NO_MEMORY;
1745                 goto done;
1746         }
1747
1748         if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1749
1750                 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1751                           sid_string_dbg(&info->sid),
1752                           privileges.count));
1753
1754                 luid_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx,
1755                                                struct lsa_LUIDAttribute,
1756                                                privileges.count);
1757                 if (!luid_attrs) {
1758                         status = NT_STATUS_NO_MEMORY;
1759                         goto done;
1760                 }
1761
1762                 for (i=0; i<privileges.count; i++) {
1763                         luid_attrs[i].luid.low = privileges.set[i].luid.low;
1764                         luid_attrs[i].luid.high = privileges.set[i].luid.high;
1765                         luid_attrs[i].attribute = privileges.set[i].attr;
1766                 }
1767
1768                 priv_set->count = privileges.count;
1769                 priv_set->unknown = 0;
1770                 priv_set->set = luid_attrs;
1771
1772         } else {
1773                 priv_set->count = 0;
1774                 priv_set->unknown = 0;
1775                 priv_set->set = NULL;
1776         }
1777
1778         *r->out.privs = priv_set;
1779
1780  done:
1781         privilege_set_free( &privileges );
1782
1783         return status;
1784 }
1785
1786 /***************************************************************************
1787  _lsa_GetSystemAccessAccount
1788  ***************************************************************************/
1789
1790 NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p,
1791                                      struct lsa_GetSystemAccessAccount *r)
1792 {
1793         NTSTATUS status;
1794         struct lsa_info *info = NULL;
1795         struct lsa_EnumPrivsAccount e;
1796         struct lsa_PrivilegeSet *privset;
1797
1798         /* find the connection policy handle. */
1799
1800         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1801                 return NT_STATUS_INVALID_HANDLE;
1802
1803         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1804                 return NT_STATUS_INVALID_HANDLE;
1805         }
1806
1807         if (!(info->access & LSA_ACCOUNT_VIEW))
1808                 return NT_STATUS_ACCESS_DENIED;
1809
1810         privset = talloc_zero(p->mem_ctx, struct lsa_PrivilegeSet);
1811         if (!privset) {
1812                 return NT_STATUS_NO_MEMORY;
1813         }
1814
1815         e.in.handle = r->in.handle;
1816         e.out.privs = &privset;
1817
1818         status = _lsa_EnumPrivsAccount(p, &e);
1819         if (!NT_STATUS_IS_OK(status)) {
1820                 DEBUG(10,("_lsa_GetSystemAccessAccount: "
1821                         "failed to call _lsa_EnumPrivsAccount(): %s\n",
1822                         nt_errstr(status)));
1823                 return status;
1824         }
1825
1826         /* Samba4 would iterate over the privset to merge the policy mode bits,
1827          * not sure samba3 can do the same here, so just return what we did in
1828          * the past - gd */
1829
1830         /*
1831           0x01 -> Log on locally
1832           0x02 -> Access this computer from network
1833           0x04 -> Log on as a batch job
1834           0x10 -> Log on as a service
1835
1836           they can be ORed together
1837         */
1838
1839         *r->out.access_mask = LSA_POLICY_MODE_INTERACTIVE |
1840                               LSA_POLICY_MODE_NETWORK;
1841
1842         return NT_STATUS_OK;
1843 }
1844
1845 /***************************************************************************
1846   update the systemaccount information
1847  ***************************************************************************/
1848
1849 NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p,
1850                                      struct lsa_SetSystemAccessAccount *r)
1851 {
1852         struct lsa_info *info=NULL;
1853         GROUP_MAP map;
1854
1855         /* find the connection policy handle. */
1856         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1857                 return NT_STATUS_INVALID_HANDLE;
1858
1859         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1860                 return NT_STATUS_INVALID_HANDLE;
1861         }
1862
1863         if (!(info->access & LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS)) {
1864                 return NT_STATUS_ACCESS_DENIED;
1865         }
1866
1867         if (!pdb_getgrsid(&map, info->sid))
1868                 return NT_STATUS_NO_SUCH_GROUP;
1869
1870         return pdb_update_group_mapping_entry(&map);
1871 }
1872
1873 /***************************************************************************
1874  _lsa_AddPrivilegesToAccount
1875  For a given SID, add some privileges.
1876  ***************************************************************************/
1877
1878 NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p,
1879                                      struct lsa_AddPrivilegesToAccount *r)
1880 {
1881         struct lsa_info *info = NULL;
1882         SE_PRIV mask;
1883         struct lsa_PrivilegeSet *set = NULL;
1884
1885         /* find the connection policy handle. */
1886         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1887                 return NT_STATUS_INVALID_HANDLE;
1888
1889         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1890                 return NT_STATUS_INVALID_HANDLE;
1891         }
1892
1893         if (!(info->access & LSA_ACCOUNT_ADJUST_PRIVILEGES)) {
1894                 return NT_STATUS_ACCESS_DENIED;
1895         }
1896
1897         set = r->in.privs;
1898         if ( !privilege_set_to_se_priv( &mask, set ) )
1899                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1900
1901         if ( !grant_privilege( &info->sid, &mask ) ) {
1902                 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1903                          sid_string_dbg(&info->sid) ));
1904                 DEBUG(3,("Privilege mask:\n"));
1905                 dump_se_priv( DBGC_ALL, 3, &mask );
1906                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1907         }
1908
1909         return NT_STATUS_OK;
1910 }
1911
1912 /***************************************************************************
1913  _lsa_RemovePrivilegesFromAccount
1914  For a given SID, remove some privileges.
1915  ***************************************************************************/
1916
1917 NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p,
1918                                           struct lsa_RemovePrivilegesFromAccount *r)
1919 {
1920         struct lsa_info *info = NULL;
1921         SE_PRIV mask;
1922         struct lsa_PrivilegeSet *set = NULL;
1923
1924         /* find the connection policy handle. */
1925         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1926                 return NT_STATUS_INVALID_HANDLE;
1927
1928         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1929                 return NT_STATUS_INVALID_HANDLE;
1930         }
1931
1932         if (!(info->access & LSA_ACCOUNT_ADJUST_PRIVILEGES)) {
1933                 return NT_STATUS_ACCESS_DENIED;
1934         }
1935
1936         set = r->in.privs;
1937
1938         if ( !privilege_set_to_se_priv( &mask, set ) )
1939                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1940
1941         if ( !revoke_privilege( &info->sid, &mask ) ) {
1942                 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1943                          sid_string_dbg(&info->sid) ));
1944                 DEBUG(3,("Privilege mask:\n"));
1945                 dump_se_priv( DBGC_ALL, 3, &mask );
1946                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1947         }
1948
1949         return NT_STATUS_OK;
1950 }
1951
1952 /***************************************************************************
1953  _lsa_LookupPrivName
1954  ***************************************************************************/
1955
1956 NTSTATUS _lsa_LookupPrivName(pipes_struct *p,
1957                              struct lsa_LookupPrivName *r)
1958 {
1959         struct lsa_info *info = NULL;
1960         const char *name;
1961         struct lsa_StringLarge *lsa_name;
1962
1963         /* find the connection policy handle. */
1964         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
1965                 return NT_STATUS_INVALID_HANDLE;
1966         }
1967
1968         if (info->type != LSA_HANDLE_POLICY_TYPE) {
1969                 return NT_STATUS_INVALID_HANDLE;
1970         }
1971
1972         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION)) {
1973                 return NT_STATUS_ACCESS_DENIED;
1974         }
1975
1976         name = luid_to_privilege_name((LUID *)r->in.luid);
1977         if (!name) {
1978                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1979         }
1980
1981         lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
1982         if (!lsa_name) {
1983                 return NT_STATUS_NO_MEMORY;
1984         }
1985
1986         lsa_name->string = talloc_strdup(lsa_name, name);
1987         if (!lsa_name->string) {
1988                 TALLOC_FREE(lsa_name);
1989                 return NT_STATUS_NO_MEMORY;
1990         }
1991
1992         *r->out.name = lsa_name;
1993
1994         return NT_STATUS_OK;
1995 }
1996
1997 /***************************************************************************
1998  _lsa_QuerySecurity
1999  ***************************************************************************/
2000
2001 NTSTATUS _lsa_QuerySecurity(pipes_struct *p,
2002                             struct lsa_QuerySecurity *r)
2003 {
2004         struct lsa_info *handle=NULL;
2005         SEC_DESC *psd = NULL;
2006         size_t sd_size;
2007         NTSTATUS status;
2008
2009         /* find the connection policy handle. */
2010         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
2011                 return NT_STATUS_INVALID_HANDLE;
2012
2013         if (handle->type == LSA_HANDLE_POLICY_TYPE) {
2014                 status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2015                                 &lsa_policy_mapping, NULL, 0);
2016         } else if (handle->type == LSA_HANDLE_ACCOUNT_TYPE) {
2017                 status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2018                                 &lsa_account_mapping,
2019                                 &handle->sid, LSA_ACCOUNT_ALL_ACCESS);
2020         } else {
2021                 status = NT_STATUS_INVALID_HANDLE;
2022         }
2023
2024         if (!NT_STATUS_IS_OK(status)) {
2025                 return status;
2026         }
2027
2028         *r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd);
2029         if (!*r->out.sdbuf) {
2030                 return NT_STATUS_NO_MEMORY;
2031         }
2032
2033         return status;
2034 }
2035
2036 /***************************************************************************
2037  _lsa_AddAccountRights
2038  ***************************************************************************/
2039
2040 NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
2041                                struct lsa_AddAccountRights *r)
2042 {
2043         struct lsa_info *info = NULL;
2044         int i = 0;
2045         uint32_t acc_granted = 0;
2046         SEC_DESC *psd = NULL;
2047         size_t sd_size;
2048         DOM_SID sid;
2049         NTSTATUS status;
2050
2051         /* find the connection policy handle. */
2052         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2053                 return NT_STATUS_INVALID_HANDLE;
2054
2055         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2056                 return NT_STATUS_INVALID_HANDLE;
2057         }
2058
2059         /* get the generic lsa account SD for this SID until we store it */
2060         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2061                                 &lsa_account_mapping,
2062                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
2063         if (!NT_STATUS_IS_OK(status)) {
2064                 return status;
2065         }
2066
2067         /*
2068          * From the MS DOCs. If the sid doesn't exist, ask for LSA_POLICY_CREATE_ACCOUNT
2069          * on the policy handle. If it does, ask for
2070          * LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
2071          * on the account sid. We don't check here so just use the latter. JRA.
2072          */
2073
2074         status = access_check_object(psd, p->server_info->ptok,
2075                 NULL, 0, LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
2076                 &acc_granted, "_lsa_AddAccountRights" );
2077
2078         if (!NT_STATUS_IS_OK(status)) {
2079                 return status;
2080         }
2081
2082         /* according to an NT4 PDC, you can add privileges to SIDs even without
2083            call_lsa_create_account() first.  And you can use any arbitrary SID. */
2084
2085         sid_copy( &sid, r->in.sid );
2086
2087         for ( i=0; i < r->in.rights->count; i++ ) {
2088
2089                 const char *privname = r->in.rights->names[i].string;
2090
2091                 /* only try to add non-null strings */
2092
2093                 if ( !privname )
2094                         continue;
2095
2096                 if ( !grant_privilege_by_name( &sid, privname ) ) {
2097                         DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
2098                                 privname ));
2099                         return NT_STATUS_NO_SUCH_PRIVILEGE;
2100                 }
2101         }
2102
2103         return NT_STATUS_OK;
2104 }
2105
2106 /***************************************************************************
2107  _lsa_RemoveAccountRights
2108  ***************************************************************************/
2109
2110 NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
2111                                   struct lsa_RemoveAccountRights *r)
2112 {
2113         struct lsa_info *info = NULL;
2114         int i = 0;
2115         SEC_DESC *psd = NULL;
2116         size_t sd_size;
2117         DOM_SID sid;
2118         const char *privname = NULL;
2119         uint32_t acc_granted = 0;
2120         NTSTATUS status;
2121
2122         /* find the connection policy handle. */
2123         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2124                 return NT_STATUS_INVALID_HANDLE;
2125
2126         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2127                 return NT_STATUS_INVALID_HANDLE;
2128         }
2129
2130         /* get the generic lsa account SD for this SID until we store it */
2131         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2132                                 &lsa_account_mapping,
2133                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
2134         if (!NT_STATUS_IS_OK(status)) {
2135                 return status;
2136         }
2137
2138         /*
2139          * From the MS DOCs. We need
2140          * LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW
2141          * and DELETE on the account sid.
2142          */
2143
2144         status = access_check_object(psd, p->server_info->ptok,
2145                 NULL, 0, LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
2146                         LSA_ACCOUNT_VIEW|STD_RIGHT_DELETE_ACCESS,
2147                 &acc_granted, "_lsa_AddAccountRights" );
2148
2149         if (!NT_STATUS_IS_OK(status)) {
2150                 return status;
2151         }
2152
2153         sid_copy( &sid, r->in.sid );
2154
2155         if ( r->in.remove_all ) {
2156                 if ( !revoke_all_privileges( &sid ) )
2157                         return NT_STATUS_ACCESS_DENIED;
2158
2159                 return NT_STATUS_OK;
2160         }
2161
2162         for ( i=0; i < r->in.rights->count; i++ ) {
2163
2164                 privname = r->in.rights->names[i].string;
2165
2166                 /* only try to add non-null strings */
2167
2168                 if ( !privname )
2169                         continue;
2170
2171                 if ( !revoke_privilege_by_name( &sid, privname ) ) {
2172                         DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2173                                 privname ));
2174                         return NT_STATUS_NO_SUCH_PRIVILEGE;
2175                 }
2176         }
2177
2178         return NT_STATUS_OK;
2179 }
2180
2181 /*******************************************************************
2182 ********************************************************************/
2183
2184 static NTSTATUS init_lsa_right_set(TALLOC_CTX *mem_ctx,
2185                                    struct lsa_RightSet *r,
2186                                    PRIVILEGE_SET *privileges)
2187 {
2188         uint32 i;
2189         const char *privname;
2190         const char **privname_array = NULL;
2191         int num_priv = 0;
2192
2193         for (i=0; i<privileges->count; i++) {
2194
2195                 privname = luid_to_privilege_name(&privileges->set[i].luid);
2196                 if (privname) {
2197                         if (!add_string_to_array(mem_ctx, privname,
2198                                                  &privname_array, &num_priv)) {
2199                                 return NT_STATUS_NO_MEMORY;
2200                         }
2201                 }
2202         }
2203
2204         if (num_priv) {
2205
2206                 r->names = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_StringLarge,
2207                                              num_priv);
2208                 if (!r->names) {
2209                         return NT_STATUS_NO_MEMORY;
2210                 }
2211
2212                 for (i=0; i<num_priv; i++) {
2213                         init_lsa_StringLarge(&r->names[i], privname_array[i]);
2214                 }
2215
2216                 r->count = num_priv;
2217         }
2218
2219         return NT_STATUS_OK;
2220 }
2221
2222 /***************************************************************************
2223  _lsa_EnumAccountRights
2224  ***************************************************************************/
2225
2226 NTSTATUS _lsa_EnumAccountRights(pipes_struct *p,
2227                                 struct lsa_EnumAccountRights *r)
2228 {
2229         NTSTATUS status;
2230         struct lsa_info *info = NULL;
2231         DOM_SID sid;
2232         PRIVILEGE_SET privileges;
2233         SE_PRIV mask;
2234
2235         /* find the connection policy handle. */
2236
2237         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2238                 return NT_STATUS_INVALID_HANDLE;
2239
2240         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2241                 return NT_STATUS_INVALID_HANDLE;
2242         }
2243
2244         if (!(info->access & LSA_ACCOUNT_VIEW)) {
2245                 return NT_STATUS_ACCESS_DENIED;
2246         }
2247
2248         /* according to an NT4 PDC, you can add privileges to SIDs even without
2249            call_lsa_create_account() first.  And you can use any arbitrary SID. */
2250
2251         sid_copy( &sid, r->in.sid );
2252
2253         /* according to MS-LSAD 3.1.4.5.10 it is required to return
2254          * NT_STATUS_OBJECT_NAME_NOT_FOUND if the account sid was not found in
2255          * the lsa database */
2256
2257         if (!get_privileges_for_sids(&mask, &sid, 1)) {
2258                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2259         }
2260
2261         status = privilege_set_init(&privileges);
2262         if (!NT_STATUS_IS_OK(status)) {
2263                 return status;
2264         }
2265
2266         se_priv_to_privilege_set(&privileges, &mask);
2267
2268         DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2269                   sid_string_dbg(&sid), privileges.count));
2270
2271         status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
2272
2273         privilege_set_free( &privileges );
2274
2275         return status;
2276 }
2277
2278 /***************************************************************************
2279  _lsa_LookupPrivValue
2280  ***************************************************************************/
2281
2282 NTSTATUS _lsa_LookupPrivValue(pipes_struct *p,
2283                               struct lsa_LookupPrivValue *r)
2284 {
2285         struct lsa_info *info = NULL;
2286         const char *name = NULL;
2287         LUID_ATTR priv_luid;
2288         SE_PRIV mask;
2289
2290         /* find the connection policy handle. */
2291
2292         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2293                 return NT_STATUS_INVALID_HANDLE;
2294
2295         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2296                 return NT_STATUS_INVALID_HANDLE;
2297         }
2298
2299         if (!(info->access & LSA_POLICY_LOOKUP_NAMES))
2300                 return NT_STATUS_ACCESS_DENIED;
2301
2302         name = r->in.name->string;
2303
2304         DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
2305
2306         if ( !se_priv_from_name( name, &mask ) )
2307                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2308
2309         priv_luid = get_privilege_luid( &mask );
2310
2311         r->out.luid->low = priv_luid.luid.low;
2312         r->out.luid->high = priv_luid.luid.high;
2313
2314         return NT_STATUS_OK;
2315 }
2316
2317 /***************************************************************************
2318  _lsa_EnumAccountsWithUserRight
2319  ***************************************************************************/
2320
2321 NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p,
2322                                         struct lsa_EnumAccountsWithUserRight *r)
2323 {
2324         NTSTATUS status;
2325         struct lsa_info *info = NULL;
2326         struct dom_sid *sids = NULL;
2327         int num_sids = 0;
2328         uint32_t i;
2329         SE_PRIV mask;
2330
2331         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
2332                 return NT_STATUS_INVALID_HANDLE;
2333         }
2334
2335         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2336                 return NT_STATUS_INVALID_HANDLE;
2337         }
2338
2339         if (!(info->access & LSA_POLICY_LOOKUP_NAMES)) {
2340                 return NT_STATUS_ACCESS_DENIED;
2341         }
2342
2343         if (!r->in.name || !r->in.name->string) {
2344                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2345         }
2346
2347         if (!se_priv_from_name(r->in.name->string, &mask)) {
2348                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2349         }
2350
2351         status = privilege_enum_sids(&mask, p->mem_ctx,
2352                                      &sids, &num_sids);
2353         if (!NT_STATUS_IS_OK(status)) {
2354                 return status;
2355         }
2356
2357         r->out.sids->num_sids = num_sids;
2358         r->out.sids->sids = talloc_array(p->mem_ctx, struct lsa_SidPtr,
2359                                          r->out.sids->num_sids);
2360
2361         for (i=0; i < r->out.sids->num_sids; i++) {
2362                 r->out.sids->sids[i].sid = sid_dup_talloc(r->out.sids->sids,
2363                                                           &sids[i]);
2364                 if (!r->out.sids->sids[i].sid) {
2365                         TALLOC_FREE(r->out.sids->sids);
2366                         r->out.sids->num_sids = 0;
2367                         return NT_STATUS_NO_MEMORY;
2368                 }
2369         }
2370
2371         return NT_STATUS_OK;
2372 }
2373
2374 /*
2375  * From here on the server routines are just dummy ones to make smbd link with
2376  * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2377  * pulling the server stubs across one by one.
2378  */
2379
2380 NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
2381 {
2382         p->rng_fault_state = True;
2383         return NT_STATUS_NOT_IMPLEMENTED;
2384 }
2385
2386 NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
2387 {
2388         p->rng_fault_state = True;
2389         return NT_STATUS_NOT_IMPLEMENTED;
2390 }
2391
2392 NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
2393 {
2394         p->rng_fault_state = True;
2395         return NT_STATUS_NOT_IMPLEMENTED;
2396 }
2397
2398 NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
2399 {
2400         p->rng_fault_state = True;
2401         return NT_STATUS_NOT_IMPLEMENTED;
2402 }
2403
2404 NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
2405 {
2406         p->rng_fault_state = True;
2407         return NT_STATUS_NOT_IMPLEMENTED;
2408 }
2409
2410 NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
2411 {
2412         p->rng_fault_state = True;
2413         return NT_STATUS_NOT_IMPLEMENTED;
2414 }
2415
2416 NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
2417 {
2418         p->rng_fault_state = True;
2419         return NT_STATUS_NOT_IMPLEMENTED;
2420 }
2421
2422 NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
2423 {
2424         p->rng_fault_state = True;
2425         return NT_STATUS_NOT_IMPLEMENTED;
2426 }
2427
2428 NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
2429 {
2430         p->rng_fault_state = True;
2431         return NT_STATUS_NOT_IMPLEMENTED;
2432 }
2433
2434 NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
2435 {
2436         p->rng_fault_state = True;
2437         return NT_STATUS_NOT_IMPLEMENTED;
2438 }
2439
2440 NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
2441 {
2442         p->rng_fault_state = True;
2443         return NT_STATUS_NOT_IMPLEMENTED;
2444 }
2445
2446 NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
2447 {
2448         p->rng_fault_state = True;
2449         return NT_STATUS_NOT_IMPLEMENTED;
2450 }
2451
2452 NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
2453 {
2454         p->rng_fault_state = True;
2455         return NT_STATUS_NOT_IMPLEMENTED;
2456 }
2457
2458 NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
2459 {
2460         p->rng_fault_state = True;
2461         return NT_STATUS_NOT_IMPLEMENTED;
2462 }
2463
2464 NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
2465 {
2466         p->rng_fault_state = True;
2467         return NT_STATUS_NOT_IMPLEMENTED;
2468 }
2469
2470 NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
2471 {
2472         p->rng_fault_state = True;
2473         return NT_STATUS_NOT_IMPLEMENTED;
2474 }
2475
2476 NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
2477 {
2478         p->rng_fault_state = True;
2479         return NT_STATUS_NOT_IMPLEMENTED;
2480 }
2481
2482 NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
2483 {
2484         p->rng_fault_state = True;
2485         return NT_STATUS_NOT_IMPLEMENTED;
2486 }
2487
2488 NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
2489 {
2490         p->rng_fault_state = True;
2491         return NT_STATUS_NOT_IMPLEMENTED;
2492 }
2493
2494 NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
2495 {
2496         p->rng_fault_state = True;
2497         return NT_STATUS_NOT_IMPLEMENTED;
2498 }
2499
2500 NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
2501 {
2502         p->rng_fault_state = True;
2503         return NT_STATUS_NOT_IMPLEMENTED;
2504 }
2505
2506 NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
2507 {
2508         p->rng_fault_state = True;
2509         return NT_STATUS_NOT_IMPLEMENTED;
2510 }
2511
2512 NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
2513 {
2514         p->rng_fault_state = True;
2515         return NT_STATUS_NOT_IMPLEMENTED;
2516 }
2517
2518 NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
2519 {
2520         p->rng_fault_state = True;
2521         return NT_STATUS_NOT_IMPLEMENTED;
2522 }
2523
2524 NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
2525 {
2526         p->rng_fault_state = True;
2527         return NT_STATUS_NOT_IMPLEMENTED;
2528 }
2529
2530 NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
2531 {
2532         p->rng_fault_state = True;
2533         return NT_STATUS_NOT_IMPLEMENTED;
2534 }
2535
2536 NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
2537 {
2538         p->rng_fault_state = True;
2539         return NT_STATUS_NOT_IMPLEMENTED;
2540 }
2541
2542 NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
2543 {
2544         p->rng_fault_state = True;
2545         return NT_STATUS_NOT_IMPLEMENTED;
2546 }
2547
2548 NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
2549 {
2550         p->rng_fault_state = True;
2551         return NT_STATUS_NOT_IMPLEMENTED;
2552 }
2553
2554 NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
2555 {
2556         p->rng_fault_state = True;
2557         return NT_STATUS_NOT_IMPLEMENTED;
2558 }
2559
2560 NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
2561 {
2562         p->rng_fault_state = True;
2563         return NT_STATUS_NOT_IMPLEMENTED;
2564 }
2565
2566 NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
2567 {
2568         p->rng_fault_state = True;
2569         return NT_STATUS_NOT_IMPLEMENTED;
2570 }
2571
2572 NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
2573 {
2574         p->rng_fault_state = True;
2575         return NT_STATUS_NOT_IMPLEMENTED;
2576 }
2577
2578 NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
2579 {
2580         p->rng_fault_state = True;
2581         return NT_STATUS_NOT_IMPLEMENTED;
2582 }
2583
2584 NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
2585 {
2586         p->rng_fault_state = True;
2587         return NT_STATUS_NOT_IMPLEMENTED;
2588 }
2589
2590 NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
2591 {
2592         p->rng_fault_state = True;
2593         return NT_STATUS_NOT_IMPLEMENTED;
2594 }
2595
2596 NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
2597 {
2598         p->rng_fault_state = True;
2599         return NT_STATUS_NOT_IMPLEMENTED;
2600 }
2601
2602 NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
2603 {
2604         p->rng_fault_state = True;
2605         return NT_STATUS_NOT_IMPLEMENTED;
2606 }
2607
2608 NTSTATUS _lsa_lsaRQueryForestTrustInformation(pipes_struct *p, struct lsa_lsaRQueryForestTrustInformation *r)
2609 {
2610         p->rng_fault_state = True;
2611         return NT_STATUS_NOT_IMPLEMENTED;
2612 }
2613
2614 NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2615 {
2616         p->rng_fault_state = True;
2617         return NT_STATUS_NOT_IMPLEMENTED;
2618 }
2619
2620 NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
2621 {
2622         p->rng_fault_state = True;
2623         return NT_STATUS_NOT_IMPLEMENTED;
2624 }
2625
2626 NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
2627 {
2628         p->rng_fault_state = True;
2629         return NT_STATUS_NOT_IMPLEMENTED;
2630 }
2631
2632 NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2633 {
2634         p->rng_fault_state = True;
2635         return NT_STATUS_NOT_IMPLEMENTED;
2636 }
2637
2638 NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2639 {
2640         p->rng_fault_state = True;
2641         return NT_STATUS_NOT_IMPLEMENTED;
2642 }
2643
2644 NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
2645 {
2646         p->rng_fault_state = True;
2647         return NT_STATUS_NOT_IMPLEMENTED;
2648 }