s3-lsa: Fix _lsa_LookupNames2() server implementation which always returned a NULL...
[ira/wip.git] / source3 / rpc_server / srv_lsa_nt.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-1997,
5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6  *  Copyright (C) Paul Ashton                       1997,
7  *  Copyright (C) Jeremy Allison                    2001, 2006.
8  *  Copyright (C) Rafal Szczesniak                  2002,
9  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
10  *  Copyright (C) Simo Sorce                        2003.
11  *  Copyright (C) Gerald (Jerry) Carter             2005.
12  *  Copyright (C) Volker Lendecke                   2005.
13  *  Copyright (C) Guenther Deschner                 2008.
14  *
15  *  This program is free software; you can redistribute it and/or modify
16  *  it under the terms of the GNU General Public License as published by
17  *  the Free Software Foundation; either version 3 of the License, or
18  *  (at your option) any later version.
19  *
20  *  This program is distributed in the hope that it will be useful,
21  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
22  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
23  *  GNU General Public License for more details.
24  *
25  *  You should have received a copy of the GNU General Public License
26  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
27  */
28
29 /* This is the implementation of the lsa server code. */
30
31 #include "includes.h"
32
33 #undef DBGC_CLASS
34 #define DBGC_CLASS DBGC_RPC_SRV
35
36 #define MAX_LOOKUP_SIDS 0x5000 /* 20480 */
37
38 extern PRIVS privs[];
39
40 struct lsa_info {
41         DOM_SID sid;
42         uint32 access;
43 };
44
45 const struct generic_mapping lsa_generic_mapping = {
46         LSA_POLICY_READ,
47         LSA_POLICY_WRITE,
48         LSA_POLICY_EXECUTE,
49         LSA_POLICY_ALL_ACCESS
50 };
51
52 /***************************************************************************
53  init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
54 ***************************************************************************/
55
56 static int init_lsa_ref_domain_list(TALLOC_CTX *mem_ctx,
57                                     struct lsa_RefDomainList *ref,
58                                     const char *dom_name,
59                                     DOM_SID *dom_sid)
60 {
61         int num = 0;
62
63         if (dom_name != NULL) {
64                 for (num = 0; num < ref->count; num++) {
65                         if (sid_equal(dom_sid, ref->domains[num].sid)) {
66                                 return num;
67                         }
68                 }
69         } else {
70                 num = ref->count;
71         }
72
73         if (num >= LSA_REF_DOMAIN_LIST_MULTIPLIER) {
74                 /* index not found, already at maximum domain limit */
75                 return -1;
76         }
77
78         ref->count = num + 1;
79         ref->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER;
80
81         ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
82                                             struct lsa_DomainInfo, ref->count);
83         if (!ref->domains) {
84                 return -1;
85         }
86
87         ZERO_STRUCT(ref->domains[num]);
88
89         init_lsa_StringLarge(&ref->domains[num].name, dom_name);
90         ref->domains[num].sid = sid_dup_talloc(mem_ctx, dom_sid);
91         if (!ref->domains[num].sid) {
92                 return -1;
93         }
94
95         return num;
96 }
97
98
99 /***************************************************************************
100  initialize a lsa_DomainInfo structure.
101  ***************************************************************************/
102
103 static void init_dom_query_3(struct lsa_DomainInfo *r,
104                              const char *name,
105                              DOM_SID *sid)
106 {
107         init_lsa_StringLarge(&r->name, name);
108         r->sid = sid;
109 }
110
111 /***************************************************************************
112  initialize a lsa_DomainInfo structure.
113  ***************************************************************************/
114
115 static void init_dom_query_5(struct lsa_DomainInfo *r,
116                              const char *name,
117                              DOM_SID *sid)
118 {
119         init_lsa_StringLarge(&r->name, name);
120         r->sid = sid;
121 }
122
123 /***************************************************************************
124  lookup_lsa_rids. Must be called as root for lookup_name to work.
125  ***************************************************************************/
126
127 static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
128                                 struct lsa_RefDomainList *ref,
129                                 struct lsa_TranslatedSid *prid,
130                                 uint32_t num_entries,
131                                 struct lsa_String *name,
132                                 int flags,
133                                 uint32_t *pmapped_count)
134 {
135         uint32 mapped_count, i;
136
137         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
138
139         mapped_count = 0;
140         *pmapped_count = 0;
141
142         for (i = 0; i < num_entries; i++) {
143                 DOM_SID sid;
144                 uint32 rid;
145                 int dom_idx;
146                 const char *full_name;
147                 const char *domain;
148                 enum lsa_SidType type = SID_NAME_UNKNOWN;
149
150                 /* Split name into domain and user component */
151
152                 full_name = name[i].string;
153                 if (full_name == NULL) {
154                         return NT_STATUS_NO_MEMORY;
155                 }
156
157                 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
158
159                 /* We can ignore the result of lookup_name, it will not touch
160                    "type" if it's not successful */
161
162                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
163                             &sid, &type);
164
165                 switch (type) {
166                 case SID_NAME_USER:
167                 case SID_NAME_DOM_GRP:
168                 case SID_NAME_DOMAIN:
169                 case SID_NAME_ALIAS:
170                 case SID_NAME_WKN_GRP:
171                         DEBUG(5, ("init_lsa_rids: %s found\n", full_name));
172                         /* Leave these unchanged */
173                         break;
174                 default:
175                         /* Don't hand out anything but the list above */
176                         DEBUG(5, ("init_lsa_rids: %s not found\n", full_name));
177                         type = SID_NAME_UNKNOWN;
178                         break;
179                 }
180
181                 rid = 0;
182                 dom_idx = -1;
183
184                 if (type != SID_NAME_UNKNOWN) {
185                         sid_split_rid(&sid, &rid);
186                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &sid);
187                         mapped_count++;
188                 }
189
190                 prid[i].sid_type        = type;
191                 prid[i].rid             = rid;
192                 prid[i].sid_index       = dom_idx;
193         }
194
195         *pmapped_count = mapped_count;
196         return NT_STATUS_OK;
197 }
198
199 /***************************************************************************
200  lookup_lsa_sids. Must be called as root for lookup_name to work.
201  ***************************************************************************/
202
203 static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
204                                 struct lsa_RefDomainList *ref,
205                                 struct lsa_TranslatedSid3 *trans_sids,
206                                 uint32_t num_entries,
207                                 struct lsa_String *name,
208                                 int flags,
209                                 uint32 *pmapped_count)
210 {
211         uint32 mapped_count, i;
212
213         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
214
215         mapped_count = 0;
216         *pmapped_count = 0;
217
218         for (i = 0; i < num_entries; i++) {
219                 DOM_SID sid;
220                 uint32 rid;
221                 int dom_idx;
222                 const char *full_name;
223                 const char *domain;
224                 enum lsa_SidType type = SID_NAME_UNKNOWN;
225
226                 ZERO_STRUCT(sid);
227
228                 /* Split name into domain and user component */
229
230                 full_name = name[i].string;
231                 if (full_name == NULL) {
232                         return NT_STATUS_NO_MEMORY;
233                 }
234
235                 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
236
237                 /* We can ignore the result of lookup_name, it will not touch
238                    "type" if it's not successful */
239
240                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
241                             &sid, &type);
242
243                 switch (type) {
244                 case SID_NAME_USER:
245                 case SID_NAME_DOM_GRP:
246                 case SID_NAME_DOMAIN:
247                 case SID_NAME_ALIAS:
248                 case SID_NAME_WKN_GRP:
249                         DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
250                         /* Leave these unchanged */
251                         break;
252                 default:
253                         /* Don't hand out anything but the list above */
254                         DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
255                         type = SID_NAME_UNKNOWN;
256                         break;
257                 }
258
259                 rid = 0;
260                 dom_idx = -1;
261
262                 if (type != SID_NAME_UNKNOWN) {
263                         DOM_SID domain_sid;
264                         sid_copy(&domain_sid, &sid);
265                         sid_split_rid(&domain_sid, &rid);
266                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &domain_sid);
267                         mapped_count++;
268                 }
269
270                 /* Initialize the lsa_TranslatedSid3 return. */
271                 trans_sids[i].sid_type = type;
272                 trans_sids[i].sid = sid_dup_talloc(mem_ctx, &sid);
273                 trans_sids[i].sid_index = dom_idx;
274         }
275
276         *pmapped_count = mapped_count;
277         return NT_STATUS_OK;
278 }
279
280 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
281 {
282         DOM_SID local_adm_sid;
283         DOM_SID adm_sid;
284
285         SEC_ACE ace[3];
286
287         SEC_ACL *psa = NULL;
288
289         init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_EXECUTE, 0);
290
291         sid_copy(&adm_sid, get_global_sam_sid());
292         sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
293         init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_ALL_ACCESS, 0);
294
295         sid_copy(&local_adm_sid, &global_sid_Builtin);
296         sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
297         init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_ALL_ACCESS, 0);
298
299         if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
300                 return NT_STATUS_NO_MEMORY;
301
302         if((*sd = make_sec_desc(mem_ctx, SECURITY_DESCRIPTOR_REVISION_1,
303                                 SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL,
304                                 psa, sd_size)) == NULL)
305                 return NT_STATUS_NO_MEMORY;
306
307         return NT_STATUS_OK;
308 }
309
310 #if 0   /* AD DC work in ongoing in Samba 4 */
311
312 /***************************************************************************
313  Init_dns_dom_info.
314 ***************************************************************************/
315
316 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
317                               const char *dns_name, const char *forest_name,
318                               struct GUID *dom_guid, DOM_SID *dom_sid)
319 {
320         if (nb_name && *nb_name) {
321                 init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
322                 init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name);
323                 r_l->hdr_nb_dom_name.uni_max_len += 2;
324                 r_l->uni_nb_dom_name.uni_max_len += 1;
325         }
326
327         if (dns_name && *dns_name) {
328                 init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE);
329                 init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name);
330                 r_l->hdr_dns_dom_name.uni_max_len += 2;
331                 r_l->uni_dns_dom_name.uni_max_len += 1;
332         }
333
334         if (forest_name && *forest_name) {
335                 init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE);
336                 init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name);
337                 r_l->hdr_forest_name.uni_max_len += 2;
338                 r_l->uni_forest_name.uni_max_len += 1;
339         }
340
341         /* how do we init the guid ? probably should write an init fn */
342         if (dom_guid) {
343                 memcpy(&r_l->dom_guid, dom_guid, sizeof(struct GUID));
344         }
345
346         if (dom_sid) {
347                 r_l->ptr_dom_sid = 1;
348                 init_dom_sid2(&r_l->dom_sid, dom_sid);
349         }
350 }
351 #endif  /* AD DC work in ongoing in Samba 4 */
352
353
354 /***************************************************************************
355  _lsa_OpenPolicy2
356  ***************************************************************************/
357
358 NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
359                           struct lsa_OpenPolicy2 *r)
360 {
361         struct lsa_info *info;
362         SEC_DESC *psd = NULL;
363         size_t sd_size;
364         uint32 des_access = r->in.access_mask;
365         uint32 acc_granted;
366         NTSTATUS status;
367
368
369         /* map the generic bits to the lsa policy ones */
370         se_map_generic(&des_access, &lsa_generic_mapping);
371
372         /* get the generic lsa policy SD until we store it */
373         lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
374
375         status = se_access_check(psd, p->server_info->ptok, des_access,
376                                  &acc_granted);
377         if (!NT_STATUS_IS_OK(status)) {
378                 if (p->server_info->utok.uid != sec_initial_uid()) {
379                         return status;
380                 }
381                 DEBUG(4,("ACCESS should be DENIED (granted: %#010x;  required: %#010x)\n",
382                          acc_granted, des_access));
383                 DEBUGADD(4,("but overwritten by euid == 0\n"));
384         }
385
386         /* This is needed for lsa_open_account and rpcclient .... :-) */
387
388         if (p->server_info->utok.uid == sec_initial_uid())
389                 acc_granted = LSA_POLICY_ALL_ACCESS;
390
391         /* associate the domain SID with the (unique) handle. */
392         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
393         if (info == NULL) {
394                 return NT_STATUS_NO_MEMORY;
395         }
396
397         sid_copy(&info->sid,get_global_sam_sid());
398         info->access = acc_granted;
399
400         /* set up the LSA QUERY INFO response */
401         if (!create_policy_hnd(p, r->out.handle, info))
402                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
403
404         return NT_STATUS_OK;
405 }
406
407 /***************************************************************************
408  _lsa_OpenPolicy
409  ***************************************************************************/
410
411 NTSTATUS _lsa_OpenPolicy(pipes_struct *p,
412                          struct lsa_OpenPolicy *r)
413 {
414         struct lsa_info *info;
415         SEC_DESC *psd = NULL;
416         size_t sd_size;
417         uint32 des_access= r->in.access_mask;
418         uint32 acc_granted;
419         NTSTATUS status;
420
421
422         /* map the generic bits to the lsa policy ones */
423         se_map_generic(&des_access, &lsa_generic_mapping);
424
425         /* get the generic lsa policy SD until we store it */
426         lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
427
428         status = se_access_check(psd, p->server_info->ptok, des_access,
429                                  &acc_granted);
430         if (!NT_STATUS_IS_OK(status)) {
431                 if (p->server_info->utok.uid != sec_initial_uid()) {
432                         return status;
433                 }
434                 DEBUG(4,("ACCESS should be DENIED (granted: %#010x;  required: %#010x)\n",
435                          acc_granted, des_access));
436                 DEBUGADD(4,("but overwritten by euid == 0\n"));
437                 acc_granted = des_access;
438         }
439
440         /* associate the domain SID with the (unique) handle. */
441         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
442         if (info == NULL) {
443                 return NT_STATUS_NO_MEMORY;
444         }
445
446         sid_copy(&info->sid,get_global_sam_sid());
447         info->access = acc_granted;
448
449         /* set up the LSA QUERY INFO response */
450         if (!create_policy_hnd(p, r->out.handle, info))
451                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
452
453         return NT_STATUS_OK;
454 }
455
456 /***************************************************************************
457  _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
458  ufff, done :)  mimir
459  ***************************************************************************/
460
461 NTSTATUS _lsa_EnumTrustDom(pipes_struct *p,
462                            struct lsa_EnumTrustDom *r)
463 {
464         struct lsa_info *info;
465         uint32 next_idx;
466         struct trustdom_info **domains;
467         struct lsa_DomainInfo *lsa_domains = NULL;
468         int i;
469
470         /*
471          * preferred length is set to 5 as a "our" preferred length
472          * nt sets this parameter to 2
473          * update (20.08.2002): it's not preferred length, but preferred size!
474          * it needs further investigation how to optimally choose this value
475          */
476         uint32 max_num_domains =
477                 r->in.max_size < 5 ? r->in.max_size : 10;
478         uint32 num_domains;
479         NTSTATUS nt_status;
480         uint32 num_thistime;
481
482         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
483                 return NT_STATUS_INVALID_HANDLE;
484
485         /* check if the user has enough rights */
486         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
487                 return NT_STATUS_ACCESS_DENIED;
488
489         become_root();
490         nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
491         unbecome_root();
492
493         if (!NT_STATUS_IS_OK(nt_status)) {
494                 return nt_status;
495         }
496
497         if (*r->in.resume_handle < num_domains) {
498                 num_thistime = MIN(num_domains, max_num_domains);
499
500                 nt_status = STATUS_MORE_ENTRIES;
501
502                 if (*r->in.resume_handle + num_thistime > num_domains) {
503                         num_thistime = num_domains - *r->in.resume_handle;
504                         nt_status = NT_STATUS_OK;
505                 }
506
507                 next_idx = *r->in.resume_handle + num_thistime;
508         } else {
509                 num_thistime = 0;
510                 next_idx = 0xffffffff;
511                 nt_status = NT_STATUS_NO_MORE_ENTRIES;
512         }
513
514         /* set up the lsa_enum_trust_dom response */
515
516         lsa_domains = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_DomainInfo,
517                                         num_thistime);
518         if (!lsa_domains) {
519                 return NT_STATUS_NO_MEMORY;
520         }
521
522         for (i=0; i<num_thistime; i++) {
523                 init_lsa_StringLarge(&lsa_domains[i].name, domains[i]->name);
524                 lsa_domains[i].sid = &domains[i]->sid;
525         }
526
527         *r->out.resume_handle = next_idx;
528         r->out.domains->count = num_thistime;
529         r->out.domains->domains = lsa_domains;
530
531         return nt_status;
532 }
533
534 #define LSA_AUDIT_NUM_CATEGORIES_NT4    7
535 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K  9
536 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
537
538 /***************************************************************************
539  _lsa_QueryInfoPolicy
540  ***************************************************************************/
541
542 NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
543                               struct lsa_QueryInfoPolicy *r)
544 {
545         NTSTATUS status = NT_STATUS_OK;
546         struct lsa_info *handle;
547         DOM_SID domain_sid;
548         const char *name;
549         DOM_SID *sid = NULL;
550         union lsa_PolicyInformation *info = NULL;
551
552         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
553                 return NT_STATUS_INVALID_HANDLE;
554
555         info = TALLOC_ZERO_P(p->mem_ctx, union lsa_PolicyInformation);
556         if (!info) {
557                 return NT_STATUS_NO_MEMORY;
558         }
559
560         switch (r->in.level) {
561         case 0x02:
562                 {
563
564                 uint32 policy_def = LSA_AUDIT_POLICY_ALL;
565
566                 /* check if the user has enough rights */
567                 if (!(handle->access & LSA_POLICY_VIEW_AUDIT_INFORMATION)) {
568                         DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
569                         return NT_STATUS_ACCESS_DENIED;
570                 }
571
572                 /* fake info: We audit everything. ;) */
573
574                 info->audit_events.auditing_mode = true;
575                 info->audit_events.count = LSA_AUDIT_NUM_CATEGORIES;
576                 info->audit_events.settings = TALLOC_ZERO_ARRAY(p->mem_ctx,
577                                                                 enum lsa_PolicyAuditPolicy,
578                                                                 info->audit_events.count);
579                 if (!info->audit_events.settings) {
580                         return NT_STATUS_NO_MEMORY;
581                 }
582
583                 info->audit_events.settings[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT] = policy_def;
584                 info->audit_events.settings[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS] = policy_def;
585                 info->audit_events.settings[LSA_AUDIT_CATEGORY_LOGON] = policy_def;
586                 info->audit_events.settings[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING] = policy_def;
587                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES] = policy_def;
588                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SYSTEM] = policy_def;
589                 info->audit_events.settings[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS] = policy_def;
590
591                 break;
592                 }
593         case 0x03:
594                 /* check if the user has enough rights */
595                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
596                         return NT_STATUS_ACCESS_DENIED;
597
598                 /* Request PolicyPrimaryDomainInformation. */
599                 switch (lp_server_role()) {
600                         case ROLE_DOMAIN_PDC:
601                         case ROLE_DOMAIN_BDC:
602                                 name = get_global_sam_name();
603                                 sid = sid_dup_talloc(p->mem_ctx, get_global_sam_sid());
604                                 if (!sid) {
605                                         return NT_STATUS_NO_MEMORY;
606                                 }
607                                 break;
608                         case ROLE_DOMAIN_MEMBER:
609                                 name = lp_workgroup();
610                                 /* We need to return the Domain SID here. */
611                                 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
612                                         sid = sid_dup_talloc(p->mem_ctx, &domain_sid);
613                                         if (!sid) {
614                                                 return NT_STATUS_NO_MEMORY;
615                                         }
616                                 } else {
617                                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
618                                 }
619                                 break;
620                         case ROLE_STANDALONE:
621                                 name = lp_workgroup();
622                                 sid = NULL;
623                                 break;
624                         default:
625                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
626                 }
627                 init_dom_query_3(&info->domain, name, sid);
628                 break;
629         case 0x05:
630                 /* check if the user has enough rights */
631                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
632                         return NT_STATUS_ACCESS_DENIED;
633
634                 /* Request PolicyAccountDomainInformation. */
635                 name = get_global_sam_name();
636                 sid = get_global_sam_sid();
637
638                 init_dom_query_5(&info->account_domain, name, sid);
639                 break;
640         case 0x06:
641                 /* check if the user has enough rights */
642                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
643                         return NT_STATUS_ACCESS_DENIED;
644
645                 switch (lp_server_role()) {
646                         case ROLE_DOMAIN_BDC:
647                                 /*
648                                  * only a BDC is a backup controller
649                                  * of the domain, it controls.
650                                  */
651                                 info->role.role = LSA_ROLE_BACKUP;
652                                 break;
653                         default:
654                                 /*
655                                  * any other role is a primary
656                                  * of the domain, it controls.
657                                  */
658                                 info->role.role = LSA_ROLE_PRIMARY;
659                                 break;
660                 }
661                 break;
662         default:
663                 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
664                         r->in.level));
665                 status = NT_STATUS_INVALID_INFO_CLASS;
666                 break;
667         }
668
669         *r->out.info = info;
670
671         return status;
672 }
673
674 /***************************************************************************
675  _lsa_lookup_sids_internal
676  ***************************************************************************/
677
678 static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
679                                           TALLOC_CTX *mem_ctx,
680                                           uint16_t level,                       /* input */
681                                           int num_sids,                         /* input */
682                                           struct lsa_SidPtr *sid,               /* input */
683                                           struct lsa_RefDomainList **pp_ref,    /* input/output */
684                                           struct lsa_TranslatedName2 **pp_names,/* input/output */
685                                           uint32_t *pp_mapped_count)            /* input/output */
686 {
687         NTSTATUS status;
688         int i;
689         const DOM_SID **sids = NULL;
690         struct lsa_RefDomainList *ref = NULL;
691         uint32 mapped_count = 0;
692         struct lsa_dom_info *dom_infos = NULL;
693         struct lsa_name_info *name_infos = NULL;
694         struct lsa_TranslatedName2 *names = NULL;
695
696         *pp_mapped_count = 0;
697         *pp_names = NULL;
698         *pp_ref = NULL;
699
700         if (num_sids == 0) {
701                 return NT_STATUS_OK;
702         }
703
704         sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
705         ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
706
707         if (sids == NULL || ref == NULL) {
708                 return NT_STATUS_NO_MEMORY;
709         }
710
711         for (i=0; i<num_sids; i++) {
712                 sids[i] = sid[i].sid;
713         }
714
715         status = lookup_sids(p->mem_ctx, num_sids, sids, level,
716                                   &dom_infos, &name_infos);
717
718         if (!NT_STATUS_IS_OK(status)) {
719                 return status;
720         }
721
722         names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
723         if (names == NULL) {
724                 return NT_STATUS_NO_MEMORY;
725         }
726
727         for (i=0; i<LSA_REF_DOMAIN_LIST_MULTIPLIER; i++) {
728
729                 if (!dom_infos[i].valid) {
730                         break;
731                 }
732
733                 if (init_lsa_ref_domain_list(mem_ctx, ref,
734                                              dom_infos[i].name,
735                                              &dom_infos[i].sid) != i) {
736                         DEBUG(0, ("Domain %s mentioned twice??\n",
737                                   dom_infos[i].name));
738                         return NT_STATUS_INTERNAL_ERROR;
739                 }
740         }
741
742         for (i=0; i<num_sids; i++) {
743                 struct lsa_name_info *name = &name_infos[i];
744
745                 if (name->type == SID_NAME_UNKNOWN) {
746                         fstring tmp;
747                         name->dom_idx = -1;
748                         /* Unknown sids should return the string
749                          * representation of the SID. Windows 2003 behaves
750                          * rather erratic here, in many cases it returns the
751                          * RID as 8 bytes hex, in others it returns the full
752                          * SID. We (Jerry/VL) could not figure out which the
753                          * hard cases are, so leave it with the SID.  */
754                         name->name = talloc_asprintf(p->mem_ctx, "%s",
755                                                      sid_to_fstring(tmp,
756                                                                     sids[i]));
757                         if (name->name == NULL) {
758                                 return NT_STATUS_NO_MEMORY;
759                         }
760                 } else {
761                         mapped_count += 1;
762                 }
763
764                 names[i].sid_type       = name->type;
765                 names[i].name.string    = name->name;
766                 names[i].sid_index      = name->dom_idx;
767                 names[i].unknown        = 0;
768         }
769
770         status = NT_STATUS_NONE_MAPPED;
771         if (mapped_count > 0) {
772                 status = (mapped_count < num_sids) ?
773                         STATUS_SOME_UNMAPPED : NT_STATUS_OK;
774         }
775
776         DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
777                    num_sids, mapped_count, nt_errstr(status)));
778
779         *pp_mapped_count = mapped_count;
780         *pp_names = names;
781         *pp_ref = ref;
782
783         return status;
784 }
785
786 /***************************************************************************
787  _lsa_LookupSids
788  ***************************************************************************/
789
790 NTSTATUS _lsa_LookupSids(pipes_struct *p,
791                          struct lsa_LookupSids *r)
792 {
793         NTSTATUS status;
794         struct lsa_info *handle;
795         int num_sids = r->in.sids->num_sids;
796         uint32 mapped_count = 0;
797         struct lsa_RefDomainList *domains = NULL;
798         struct lsa_TranslatedName *names_out = NULL;
799         struct lsa_TranslatedName2 *names = NULL;
800         int i;
801
802         if ((r->in.level < 1) || (r->in.level > 6)) {
803                 return NT_STATUS_INVALID_PARAMETER;
804         }
805
806         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
807                 return NT_STATUS_INVALID_HANDLE;
808         }
809
810         /* check if the user has enough rights */
811         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
812                 return NT_STATUS_ACCESS_DENIED;
813         }
814
815         if (num_sids >  MAX_LOOKUP_SIDS) {
816                 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
817                          MAX_LOOKUP_SIDS, num_sids));
818                 return NT_STATUS_NONE_MAPPED;
819         }
820
821         status = _lsa_lookup_sids_internal(p,
822                                            p->mem_ctx,
823                                            r->in.level,
824                                            num_sids,
825                                            r->in.sids->sids,
826                                            &domains,
827                                            &names,
828                                            &mapped_count);
829
830         /* Only return here when there is a real error.
831            NT_STATUS_NONE_MAPPED is a special case as it indicates that none of
832            the requested sids could be resolved. Older versions of XP (pre SP3)
833            rely that we return with the string representations of those SIDs in
834            that case. If we don't, XP crashes - Guenther
835            */
836
837         if (NT_STATUS_IS_ERR(status) &&
838             !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
839                 return status;
840         }
841
842         /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
843         names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
844                                  num_sids);
845         if (!names_out) {
846                 return NT_STATUS_NO_MEMORY;
847         }
848
849         for (i=0; i<num_sids; i++) {
850                 names_out[i].sid_type = names[i].sid_type;
851                 names_out[i].name = names[i].name;
852                 names_out[i].sid_index = names[i].sid_index;
853         }
854
855         *r->out.domains = domains;
856         r->out.names->count = num_sids;
857         r->out.names->names = names_out;
858         *r->out.count = mapped_count;
859
860         return status;
861 }
862
863 /***************************************************************************
864  _lsa_LookupSids2
865  ***************************************************************************/
866
867 NTSTATUS _lsa_LookupSids2(pipes_struct *p,
868                           struct lsa_LookupSids2 *r)
869 {
870         NTSTATUS status;
871         struct lsa_info *handle;
872         int num_sids = r->in.sids->num_sids;
873         uint32 mapped_count = 0;
874         struct lsa_RefDomainList *domains = NULL;
875         struct lsa_TranslatedName2 *names = NULL;
876         bool check_policy = true;
877
878         switch (p->hdr_req.opnum) {
879                 case NDR_LSA_LOOKUPSIDS3:
880                         check_policy = false;
881                         break;
882                 case NDR_LSA_LOOKUPSIDS2:
883                 default:
884                         check_policy = true;
885         }
886
887         if ((r->in.level < 1) || (r->in.level > 6)) {
888                 return NT_STATUS_INVALID_PARAMETER;
889         }
890
891         if (check_policy) {
892                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
893                         return NT_STATUS_INVALID_HANDLE;
894                 }
895
896                 /* check if the user has enough rights */
897                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
898                         return NT_STATUS_ACCESS_DENIED;
899                 }
900         }
901
902         if (num_sids >  MAX_LOOKUP_SIDS) {
903                 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
904                          MAX_LOOKUP_SIDS, num_sids));
905                 return NT_STATUS_NONE_MAPPED;
906         }
907
908         status = _lsa_lookup_sids_internal(p,
909                                            p->mem_ctx,
910                                            r->in.level,
911                                            num_sids,
912                                            r->in.sids->sids,
913                                            &domains,
914                                            &names,
915                                            &mapped_count);
916
917         *r->out.domains = domains;
918         r->out.names->count = num_sids;
919         r->out.names->names = names;
920         *r->out.count = mapped_count;
921
922         return status;
923 }
924
925 /***************************************************************************
926  _lsa_LookupSids3
927  ***************************************************************************/
928
929 NTSTATUS _lsa_LookupSids3(pipes_struct *p,
930                           struct lsa_LookupSids3 *r)
931 {
932         struct lsa_LookupSids2 q;
933
934         /* No policy handle on this call. Restrict to crypto connections. */
935         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
936                 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
937                         get_remote_machine_name() ));
938                 return NT_STATUS_INVALID_PARAMETER;
939         }
940
941         q.in.handle             = NULL;
942         q.in.sids               = r->in.sids;
943         q.in.level              = r->in.level;
944         q.in.unknown1           = r->in.unknown1;
945         q.in.unknown2           = r->in.unknown2;
946         q.in.names              = r->in.names;
947         q.in.count              = r->in.count;
948
949         q.out.domains           = r->out.domains;
950         q.out.names             = r->out.names;
951         q.out.count             = r->out.count;
952
953         return _lsa_LookupSids2(p, &q);
954 }
955
956 /***************************************************************************
957  ***************************************************************************/
958
959 static int lsa_lookup_level_to_flags(uint16 level)
960 {
961         int flags;
962
963         switch (level) {
964                 case 1:
965                         flags = LOOKUP_NAME_ALL;
966                         break;
967                 case 2:
968                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_REMOTE|LOOKUP_NAME_ISOLATED;
969                         break;
970                 case 3:
971                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED;
972                         break;
973                 case 4:
974                 case 5:
975                 case 6:
976                 default:
977                         flags = LOOKUP_NAME_NONE;
978                         break;
979         }
980
981         return flags;
982 }
983
984 /***************************************************************************
985  _lsa_LookupNames
986  ***************************************************************************/
987
988 NTSTATUS _lsa_LookupNames(pipes_struct *p,
989                           struct lsa_LookupNames *r)
990 {
991         NTSTATUS status = NT_STATUS_NONE_MAPPED;
992         struct lsa_info *handle;
993         struct lsa_String *names = r->in.names;
994         uint32 num_entries = r->in.num_names;
995         struct lsa_RefDomainList *domains = NULL;
996         struct lsa_TranslatedSid *rids = NULL;
997         uint32 mapped_count = 0;
998         int flags = 0;
999
1000         if (num_entries >  MAX_LOOKUP_SIDS) {
1001                 num_entries = MAX_LOOKUP_SIDS;
1002                 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
1003                         num_entries));
1004         }
1005
1006         flags = lsa_lookup_level_to_flags(r->in.level);
1007
1008         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1009         if (!domains) {
1010                 return NT_STATUS_NO_MEMORY;
1011         }
1012
1013         if (num_entries) {
1014                 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid,
1015                                          num_entries);
1016                 if (!rids) {
1017                         return NT_STATUS_NO_MEMORY;
1018                 }
1019         } else {
1020                 rids = NULL;
1021         }
1022
1023         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1024                 status = NT_STATUS_INVALID_HANDLE;
1025                 goto done;
1026         }
1027
1028         /* check if the user has enough rights */
1029         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1030                 status = NT_STATUS_ACCESS_DENIED;
1031                 goto done;
1032         }
1033
1034         /* set up the LSA Lookup RIDs response */
1035         become_root(); /* lookup_name can require root privs */
1036         status = lookup_lsa_rids(p->mem_ctx, domains, rids, num_entries,
1037                                  names, flags, &mapped_count);
1038         unbecome_root();
1039
1040 done:
1041
1042         if (NT_STATUS_IS_OK(status) && (num_entries != 0) ) {
1043                 if (mapped_count == 0) {
1044                         status = NT_STATUS_NONE_MAPPED;
1045                 } else if (mapped_count != num_entries) {
1046                         status = STATUS_SOME_UNMAPPED;
1047                 }
1048         }
1049
1050         *r->out.count = mapped_count;
1051         *r->out.domains = domains;
1052         r->out.sids->sids = rids;
1053         r->out.sids->count = num_entries;
1054
1055         return status;
1056 }
1057
1058 /***************************************************************************
1059  _lsa_LookupNames2
1060  ***************************************************************************/
1061
1062 NTSTATUS _lsa_LookupNames2(pipes_struct *p,
1063                            struct lsa_LookupNames2 *r)
1064 {
1065         NTSTATUS status;
1066         struct lsa_LookupNames q;
1067         struct lsa_TransSidArray2 *sid_array2 = r->in.sids;
1068         struct lsa_TransSidArray *sid_array = NULL;
1069         uint32_t i;
1070
1071         sid_array = TALLOC_ZERO_P(p->mem_ctx, struct lsa_TransSidArray);
1072         if (!sid_array) {
1073                 return NT_STATUS_NO_MEMORY;
1074         }
1075
1076         q.in.handle             = r->in.handle;
1077         q.in.num_names          = r->in.num_names;
1078         q.in.names              = r->in.names;
1079         q.in.level              = r->in.level;
1080         q.in.sids               = sid_array;
1081         q.in.count              = r->in.count;
1082         /* we do not know what this is for */
1083         /*                      = r->in.unknown1; */
1084         /*                      = r->in.unknown2; */
1085
1086         q.out.domains           = r->out.domains;
1087         q.out.sids              = sid_array;
1088         q.out.count             = r->out.count;
1089
1090         status = _lsa_LookupNames(p, &q);
1091
1092         sid_array2->count = sid_array->count;
1093         sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
1094         if (!sid_array2->sids) {
1095                 return NT_STATUS_NO_MEMORY;
1096         }
1097
1098         for (i=0; i<sid_array->count; i++) {
1099                 sid_array2->sids[i].sid_type  = sid_array->sids[i].sid_type;
1100                 sid_array2->sids[i].rid       = sid_array->sids[i].rid;
1101                 sid_array2->sids[i].sid_index = sid_array->sids[i].sid_index;
1102                 sid_array2->sids[i].unknown   = 0;
1103         }
1104
1105         r->out.sids = sid_array2;
1106
1107         return status;
1108 }
1109
1110 /***************************************************************************
1111  _lsa_LookupNames3
1112  ***************************************************************************/
1113
1114 NTSTATUS _lsa_LookupNames3(pipes_struct *p,
1115                            struct lsa_LookupNames3 *r)
1116 {
1117         NTSTATUS status;
1118         struct lsa_info *handle;
1119         struct lsa_String *names = r->in.names;
1120         uint32 num_entries = r->in.num_names;
1121         struct lsa_RefDomainList *domains = NULL;
1122         struct lsa_TranslatedSid3 *trans_sids = NULL;
1123         uint32 mapped_count = 0;
1124         int flags = 0;
1125         bool check_policy = true;
1126
1127         switch (p->hdr_req.opnum) {
1128                 case NDR_LSA_LOOKUPNAMES4:
1129                         check_policy = false;
1130                         break;
1131                 case NDR_LSA_LOOKUPNAMES3:
1132                 default:
1133                         check_policy = true;
1134         }
1135
1136         if (num_entries >  MAX_LOOKUP_SIDS) {
1137                 num_entries = MAX_LOOKUP_SIDS;
1138                 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries));
1139         }
1140
1141         /* Probably the lookup_level is some sort of bitmask. */
1142         if (r->in.level == 1) {
1143                 flags = LOOKUP_NAME_ALL;
1144         }
1145
1146         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1147         if (!domains) {
1148                 return NT_STATUS_NO_MEMORY;
1149         }
1150
1151         if (num_entries) {
1152                 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid3,
1153                                                num_entries);
1154                 if (!trans_sids) {
1155                         return NT_STATUS_NO_MEMORY;
1156                 }
1157         } else {
1158                 trans_sids = NULL;
1159         }
1160
1161         if (check_policy) {
1162
1163                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1164                         status = NT_STATUS_INVALID_HANDLE;
1165                         goto done;
1166                 }
1167
1168                 /* check if the user has enough rights */
1169                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1170                         status = NT_STATUS_ACCESS_DENIED;
1171                         goto done;
1172                 }
1173         }
1174
1175         /* set up the LSA Lookup SIDs response */
1176         become_root(); /* lookup_name can require root privs */
1177         status = lookup_lsa_sids(p->mem_ctx, domains, trans_sids, num_entries,
1178                                  names, flags, &mapped_count);
1179         unbecome_root();
1180
1181 done:
1182
1183         if (NT_STATUS_IS_OK(status)) {
1184                 if (mapped_count == 0) {
1185                         status = NT_STATUS_NONE_MAPPED;
1186                 } else if (mapped_count != num_entries) {
1187                         status = STATUS_SOME_UNMAPPED;
1188                 }
1189         }
1190
1191         *r->out.count = mapped_count;
1192         *r->out.domains = domains;
1193         r->out.sids->sids = trans_sids;
1194         r->out.sids->count = num_entries;
1195
1196         return status;
1197 }
1198
1199 /***************************************************************************
1200  _lsa_LookupNames4
1201  ***************************************************************************/
1202
1203 NTSTATUS _lsa_LookupNames4(pipes_struct *p,
1204                            struct lsa_LookupNames4 *r)
1205 {
1206         struct lsa_LookupNames3 q;
1207
1208         /* No policy handle on this call. Restrict to crypto connections. */
1209         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1210                 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1211                         get_remote_machine_name() ));
1212                 return NT_STATUS_INVALID_PARAMETER;
1213         }
1214
1215         q.in.handle             = NULL;
1216         q.in.num_names          = r->in.num_names;
1217         q.in.names              = r->in.names;
1218         q.in.level              = r->in.level;
1219         q.in.lookup_options     = r->in.lookup_options;
1220         q.in.client_revision    = r->in.client_revision;
1221         q.in.sids               = r->in.sids;
1222         q.in.count              = r->in.count;
1223
1224         q.out.domains           = r->out.domains;
1225         q.out.sids              = r->out.sids;
1226         q.out.count             = r->out.count;
1227
1228         return _lsa_LookupNames3(p, &q);
1229 }
1230
1231 /***************************************************************************
1232  _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1233  ***************************************************************************/
1234
1235 NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
1236 {
1237         if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
1238                 return NT_STATUS_INVALID_HANDLE;
1239         }
1240
1241         close_policy_hnd(p, r->in.handle);
1242         ZERO_STRUCTP(r->out.handle);
1243         return NT_STATUS_OK;
1244 }
1245
1246 /***************************************************************************
1247  ***************************************************************************/
1248
1249 NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
1250 {
1251         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1252 }
1253
1254 /***************************************************************************
1255  ***************************************************************************/
1256
1257 NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
1258 {
1259         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1260 }
1261
1262 /***************************************************************************
1263  ***************************************************************************/
1264
1265 NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
1266 {
1267         return NT_STATUS_ACCESS_DENIED;
1268 }
1269
1270 /***************************************************************************
1271  ***************************************************************************/
1272
1273 NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
1274 {
1275         return NT_STATUS_ACCESS_DENIED;
1276 }
1277
1278 /***************************************************************************
1279  ***************************************************************************/
1280
1281 NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
1282 {
1283         return NT_STATUS_ACCESS_DENIED;
1284 }
1285
1286 /***************************************************************************
1287  _lsa_DeleteObject
1288  ***************************************************************************/
1289
1290 NTSTATUS _lsa_DeleteObject(pipes_struct *p,
1291                            struct lsa_DeleteObject *r)
1292 {
1293         return NT_STATUS_ACCESS_DENIED;
1294 }
1295
1296 /***************************************************************************
1297  _lsa_EnumPrivs
1298  ***************************************************************************/
1299
1300 NTSTATUS _lsa_EnumPrivs(pipes_struct *p,
1301                         struct lsa_EnumPrivs *r)
1302 {
1303         struct lsa_info *handle;
1304         uint32 i;
1305         uint32 enum_context = *r->in.resume_handle;
1306         int num_privs = count_all_privileges();
1307         struct lsa_PrivEntry *entries = NULL;
1308         LUID_ATTR luid;
1309
1310         /* remember that the enum_context starts at 0 and not 1 */
1311
1312         if ( enum_context >= num_privs )
1313                 return NT_STATUS_NO_MORE_ENTRIES;
1314
1315         DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1316                 enum_context, num_privs));
1317
1318         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1319                 return NT_STATUS_INVALID_HANDLE;
1320
1321         /* check if the user has enough rights
1322            I don't know if it's the right one. not documented.  */
1323
1324         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1325                 return NT_STATUS_ACCESS_DENIED;
1326
1327         if (num_privs) {
1328                 entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_PrivEntry, num_privs);
1329                 if (!entries) {
1330                         return NT_STATUS_NO_MEMORY;
1331                 }
1332         } else {
1333                 entries = NULL;
1334         }
1335
1336         for (i = 0; i < num_privs; i++) {
1337                 if( i < enum_context) {
1338
1339                         init_lsa_StringLarge(&entries[i].name, NULL);
1340
1341                         entries[i].luid.low = 0;
1342                         entries[i].luid.high = 0;
1343                 } else {
1344
1345                         init_lsa_StringLarge(&entries[i].name, privs[i].name);
1346
1347                         luid = get_privilege_luid( &privs[i].se_priv );
1348
1349                         entries[i].luid.low = luid.luid.low;
1350                         entries[i].luid.high = luid.luid.high;
1351                 }
1352         }
1353
1354         enum_context = num_privs;
1355
1356         *r->out.resume_handle = enum_context;
1357         r->out.privs->count = num_privs;
1358         r->out.privs->privs = entries;
1359
1360         return NT_STATUS_OK;
1361 }
1362
1363 /***************************************************************************
1364  _lsa_LookupPrivDisplayName
1365  ***************************************************************************/
1366
1367 NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p,
1368                                     struct lsa_LookupPrivDisplayName *r)
1369 {
1370         struct lsa_info *handle;
1371         const char *description;
1372         struct lsa_StringLarge *lsa_name;
1373
1374         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1375                 return NT_STATUS_INVALID_HANDLE;
1376
1377         /* check if the user has enough rights */
1378
1379         /*
1380          * I don't know if it's the right one. not documented.
1381          */
1382         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1383                 return NT_STATUS_ACCESS_DENIED;
1384
1385         DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r->in.name->string));
1386
1387         description = get_privilege_dispname(r->in.name->string);
1388         if (!description) {
1389                 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1390                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1391         }
1392
1393         DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description));
1394
1395         lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
1396         if (!lsa_name) {
1397                 return NT_STATUS_NO_MEMORY;
1398         }
1399
1400         init_lsa_StringLarge(lsa_name, description);
1401
1402         *r->out.returned_language_id = r->in.language_id;
1403         *r->out.disp_name = lsa_name;
1404
1405         return NT_STATUS_OK;
1406 }
1407
1408 /***************************************************************************
1409  _lsa_EnumAccounts
1410  ***************************************************************************/
1411
1412 NTSTATUS _lsa_EnumAccounts(pipes_struct *p,
1413                            struct lsa_EnumAccounts *r)
1414 {
1415         struct lsa_info *handle;
1416         DOM_SID *sid_list;
1417         int i, j, num_entries;
1418         NTSTATUS status;
1419         struct lsa_SidPtr *sids = NULL;
1420
1421         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1422                 return NT_STATUS_INVALID_HANDLE;
1423
1424         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1425                 return NT_STATUS_ACCESS_DENIED;
1426
1427         sid_list = NULL;
1428         num_entries = 0;
1429
1430         /* The only way we can currently find out all the SIDs that have been
1431            privileged is to scan all privileges */
1432
1433         status = privilege_enumerate_accounts(&sid_list, &num_entries);
1434         if (!NT_STATUS_IS_OK(status)) {
1435                 return status;
1436         }
1437
1438         if (*r->in.resume_handle >= num_entries) {
1439                 return NT_STATUS_NO_MORE_ENTRIES;
1440         }
1441
1442         if (num_entries - *r->in.resume_handle) {
1443                 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr,
1444                                          num_entries - *r->in.resume_handle);
1445                 if (!sids) {
1446                         talloc_free(sid_list);
1447                         return NT_STATUS_NO_MEMORY;
1448                 }
1449
1450                 for (i = *r->in.resume_handle, j = 0; i < num_entries; i++, j++) {
1451                         sids[j].sid = sid_dup_talloc(p->mem_ctx, &sid_list[i]);
1452                         if (!sids[j].sid) {
1453                                 talloc_free(sid_list);
1454                                 return NT_STATUS_NO_MEMORY;
1455                         }
1456                 }
1457         }
1458
1459         talloc_free(sid_list);
1460
1461         *r->out.resume_handle = num_entries;
1462         r->out.sids->num_sids = num_entries;
1463         r->out.sids->sids = sids;
1464
1465         return NT_STATUS_OK;
1466 }
1467
1468 /***************************************************************************
1469  _lsa_GetUserName
1470  ***************************************************************************/
1471
1472 NTSTATUS _lsa_GetUserName(pipes_struct *p,
1473                           struct lsa_GetUserName *r)
1474 {
1475         const char *username, *domname;
1476         struct lsa_String *account_name = NULL;
1477         struct lsa_String *authority_name = NULL;
1478
1479         if (r->in.account_name &&
1480            *r->in.account_name) {
1481                 return NT_STATUS_INVALID_PARAMETER;
1482         }
1483
1484         if (r->in.authority_name &&
1485            *r->in.authority_name) {
1486                 return NT_STATUS_INVALID_PARAMETER;
1487         }
1488
1489         if (p->server_info->guest) {
1490                 /*
1491                  * I'm 99% sure this is not the right place to do this,
1492                  * global_sid_Anonymous should probably be put into the token
1493                  * instead of the guest id -- vl
1494                  */
1495                 if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
1496                                 &domname, &username, NULL)) {
1497                         return NT_STATUS_NO_MEMORY;
1498                 }
1499         } else {
1500                 username = p->server_info->sanitized_username;
1501                 domname = pdb_get_domain(p->server_info->sam_account);
1502         }
1503
1504         account_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1505         if (!account_name) {
1506                 return NT_STATUS_NO_MEMORY;
1507         }
1508         init_lsa_String(account_name, username);
1509
1510         if (r->out.authority_name) {
1511                 authority_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1512                 if (!authority_name) {
1513                         return NT_STATUS_NO_MEMORY;
1514                 }
1515                 init_lsa_String(authority_name, domname);
1516         }
1517
1518         *r->out.account_name = account_name;
1519         if (r->out.authority_name) {
1520                 *r->out.authority_name = authority_name;
1521         }
1522
1523         return NT_STATUS_OK;
1524 }
1525
1526 /***************************************************************************
1527  _lsa_CreateAccount
1528  ***************************************************************************/
1529
1530 NTSTATUS _lsa_CreateAccount(pipes_struct *p,
1531                             struct lsa_CreateAccount *r)
1532 {
1533         struct lsa_info *handle;
1534         struct lsa_info *info;
1535
1536         /* find the connection policy handle. */
1537         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1538                 return NT_STATUS_INVALID_HANDLE;
1539
1540         /* check if the user has enough rights */
1541
1542         /*
1543          * I don't know if it's the right one. not documented.
1544          * but guessed with rpcclient.
1545          */
1546         if (!(handle->access & LSA_POLICY_GET_PRIVATE_INFORMATION))
1547                 return NT_STATUS_ACCESS_DENIED;
1548
1549         /* check to see if the pipe_user is a Domain Admin since
1550            account_pol.tdb was already opened as root, this is all we have */
1551
1552         if ( p->server_info->utok.uid != sec_initial_uid()
1553                 && !nt_token_check_domain_rid( p->server_info->ptok,
1554                                                DOMAIN_GROUP_RID_ADMINS ) )
1555                 return NT_STATUS_ACCESS_DENIED;
1556
1557         if ( is_privileged_sid( r->in.sid ) )
1558                 return NT_STATUS_OBJECT_NAME_COLLISION;
1559
1560         /* associate the user/group SID with the (unique) handle. */
1561
1562         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1563         if (info == NULL) {
1564                 return NT_STATUS_NO_MEMORY;
1565         }
1566
1567         info->sid = *r->in.sid;
1568         info->access = r->in.access_mask;
1569
1570         /* get a (unique) handle.  open a policy on it. */
1571         if (!create_policy_hnd(p, r->out.acct_handle, info))
1572                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1573
1574         return privilege_create_account( &info->sid );
1575 }
1576
1577
1578 /***************************************************************************
1579  _lsa_OpenAccount
1580  ***************************************************************************/
1581
1582 NTSTATUS _lsa_OpenAccount(pipes_struct *p,
1583                           struct lsa_OpenAccount *r)
1584 {
1585         struct lsa_info *handle;
1586         struct lsa_info *info;
1587
1588         /* find the connection policy handle. */
1589         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1590                 return NT_STATUS_INVALID_HANDLE;
1591
1592         /* check if the user has enough rights */
1593
1594         /*
1595          * I don't know if it's the right one. not documented.
1596          * but guessed with rpcclient.
1597          */
1598         if (!(handle->access & LSA_POLICY_GET_PRIVATE_INFORMATION))
1599                 return NT_STATUS_ACCESS_DENIED;
1600
1601         /* TODO: Fis the parsing routine before reenabling this check! */
1602         #if 0
1603         if (!lookup_sid(&handle->sid, dom_name, name, &type))
1604                 return NT_STATUS_ACCESS_DENIED;
1605         #endif
1606         /* associate the user/group SID with the (unique) handle. */
1607         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1608         if (info == NULL) {
1609                 return NT_STATUS_NO_MEMORY;
1610         }
1611
1612         info->sid = *r->in.sid;
1613         info->access = r->in.access_mask;
1614
1615         /* get a (unique) handle.  open a policy on it. */
1616         if (!create_policy_hnd(p, r->out.acct_handle, info))
1617                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1618
1619         return NT_STATUS_OK;
1620 }
1621
1622 /***************************************************************************
1623  _lsa_EnumPrivsAccount
1624  For a given SID, enumerate all the privilege this account has.
1625  ***************************************************************************/
1626
1627 NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
1628                                struct lsa_EnumPrivsAccount *r)
1629 {
1630         NTSTATUS status = NT_STATUS_OK;
1631         struct lsa_info *info=NULL;
1632         SE_PRIV mask;
1633         PRIVILEGE_SET privileges;
1634         struct lsa_PrivilegeSet *priv_set = NULL;
1635         struct lsa_LUIDAttribute *luid_attrs = NULL;
1636         int i;
1637
1638         /* find the connection policy handle. */
1639         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1640                 return NT_STATUS_INVALID_HANDLE;
1641
1642         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1643                 return NT_STATUS_ACCESS_DENIED;
1644
1645         if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
1646                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1647
1648         privilege_set_init( &privileges );
1649
1650         if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1651
1652                 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1653                           sid_string_dbg(&info->sid),
1654                           privileges.count));
1655
1656                 priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
1657                 if (!priv_set) {
1658                         status = NT_STATUS_NO_MEMORY;
1659                         goto done;
1660                 }
1661
1662                 luid_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx,
1663                                                struct lsa_LUIDAttribute,
1664                                                privileges.count);
1665                 if (!luid_attrs) {
1666                         status = NT_STATUS_NO_MEMORY;
1667                         goto done;
1668                 }
1669
1670                 for (i=0; i<privileges.count; i++) {
1671                         luid_attrs[i].luid.low = privileges.set[i].luid.low;
1672                         luid_attrs[i].luid.high = privileges.set[i].luid.high;
1673                         luid_attrs[i].attribute = privileges.set[i].attr;
1674                 }
1675
1676                 priv_set->count = privileges.count;
1677                 priv_set->unknown = 0;
1678                 priv_set->set = luid_attrs;
1679
1680                 *r->out.privs = priv_set;
1681         } else {
1682                 status = NT_STATUS_NO_SUCH_PRIVILEGE;
1683         }
1684
1685  done:
1686         privilege_set_free( &privileges );
1687
1688         return status;
1689 }
1690
1691 /***************************************************************************
1692  _lsa_GetSystemAccessAccount
1693  ***************************************************************************/
1694
1695 NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p,
1696                                      struct lsa_GetSystemAccessAccount *r)
1697 {
1698         struct lsa_info *info=NULL;
1699
1700         /* find the connection policy handle. */
1701
1702         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1703                 return NT_STATUS_INVALID_HANDLE;
1704
1705         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1706                 return NT_STATUS_ACCESS_DENIED;
1707
1708         if (!lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, NULL))
1709                 return NT_STATUS_ACCESS_DENIED;
1710
1711         /*
1712           0x01 -> Log on locally
1713           0x02 -> Access this computer from network
1714           0x04 -> Log on as a batch job
1715           0x10 -> Log on as a service
1716
1717           they can be ORed together
1718         */
1719
1720         *r->out.access_mask = LSA_POLICY_MODE_INTERACTIVE |
1721                               LSA_POLICY_MODE_NETWORK;
1722
1723         return NT_STATUS_OK;
1724 }
1725
1726 /***************************************************************************
1727   update the systemaccount information
1728  ***************************************************************************/
1729
1730 NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p,
1731                                      struct lsa_SetSystemAccessAccount *r)
1732 {
1733         struct lsa_info *info=NULL;
1734         GROUP_MAP map;
1735
1736         /* find the connection policy handle. */
1737         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1738                 return NT_STATUS_INVALID_HANDLE;
1739
1740         /* check to see if the pipe_user is a Domain Admin since
1741            account_pol.tdb was already opened as root, this is all we have */
1742
1743         if ( p->server_info->utok.uid != sec_initial_uid()
1744                 && !nt_token_check_domain_rid( p->server_info->ptok,
1745                                                DOMAIN_GROUP_RID_ADMINS ) )
1746                 return NT_STATUS_ACCESS_DENIED;
1747
1748         if (!pdb_getgrsid(&map, info->sid))
1749                 return NT_STATUS_NO_SUCH_GROUP;
1750
1751         return pdb_update_group_mapping_entry(&map);
1752 }
1753
1754 /***************************************************************************
1755  _lsa_AddPrivilegesToAccount
1756  For a given SID, add some privileges.
1757  ***************************************************************************/
1758
1759 NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p,
1760                                      struct lsa_AddPrivilegesToAccount *r)
1761 {
1762         struct lsa_info *info = NULL;
1763         SE_PRIV mask;
1764         struct lsa_PrivilegeSet *set = NULL;
1765
1766         /* find the connection policy handle. */
1767         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1768                 return NT_STATUS_INVALID_HANDLE;
1769
1770         /* check to see if the pipe_user is root or a Domain Admin since
1771            account_pol.tdb was already opened as root, this is all we have */
1772
1773         if ( p->server_info->utok.uid != sec_initial_uid()
1774                 && !nt_token_check_domain_rid( p->server_info->ptok,
1775                                                DOMAIN_GROUP_RID_ADMINS ) )
1776         {
1777                 return NT_STATUS_ACCESS_DENIED;
1778         }
1779
1780         set = r->in.privs;
1781         if ( !privilege_set_to_se_priv( &mask, set ) )
1782                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1783
1784         if ( !grant_privilege( &info->sid, &mask ) ) {
1785                 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1786                          sid_string_dbg(&info->sid) ));
1787                 DEBUG(3,("Privilege mask:\n"));
1788                 dump_se_priv( DBGC_ALL, 3, &mask );
1789                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1790         }
1791
1792         return NT_STATUS_OK;
1793 }
1794
1795 /***************************************************************************
1796  _lsa_RemovePrivilegesFromAccount
1797  For a given SID, remove some privileges.
1798  ***************************************************************************/
1799
1800 NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p,
1801                                           struct lsa_RemovePrivilegesFromAccount *r)
1802 {
1803         struct lsa_info *info = NULL;
1804         SE_PRIV mask;
1805         struct lsa_PrivilegeSet *set = NULL;
1806
1807         /* find the connection policy handle. */
1808         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1809                 return NT_STATUS_INVALID_HANDLE;
1810
1811         /* check to see if the pipe_user is root or a Domain Admin since
1812            account_pol.tdb was already opened as root, this is all we have */
1813
1814         if ( p->server_info->utok.uid != sec_initial_uid()
1815                 && !nt_token_check_domain_rid( p->server_info->ptok,
1816                                                DOMAIN_GROUP_RID_ADMINS ) )
1817         {
1818                 return NT_STATUS_ACCESS_DENIED;
1819         }
1820
1821         set = r->in.privs;
1822
1823         if ( !privilege_set_to_se_priv( &mask, set ) )
1824                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1825
1826         if ( !revoke_privilege( &info->sid, &mask ) ) {
1827                 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1828                          sid_string_dbg(&info->sid) ));
1829                 DEBUG(3,("Privilege mask:\n"));
1830                 dump_se_priv( DBGC_ALL, 3, &mask );
1831                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1832         }
1833
1834         return NT_STATUS_OK;
1835 }
1836
1837 /***************************************************************************
1838  _lsa_QuerySecurity
1839  ***************************************************************************/
1840
1841 NTSTATUS _lsa_QuerySecurity(pipes_struct *p,
1842                             struct lsa_QuerySecurity *r)
1843 {
1844         struct lsa_info *handle=NULL;
1845         SEC_DESC *psd = NULL;
1846         size_t sd_size;
1847         NTSTATUS status;
1848
1849         /* find the connection policy handle. */
1850         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1851                 return NT_STATUS_INVALID_HANDLE;
1852
1853         /* check if the user has enough rights */
1854         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1855                 return NT_STATUS_ACCESS_DENIED;
1856
1857         switch (r->in.sec_info) {
1858         case 1:
1859                 /* SD contains only the owner */
1860
1861                 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1862                 if(!NT_STATUS_IS_OK(status))
1863                         return NT_STATUS_NO_MEMORY;
1864
1865
1866                 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1867                         return NT_STATUS_NO_MEMORY;
1868                 break;
1869         case 4:
1870                 /* SD contains only the ACL */
1871
1872                 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1873                 if(!NT_STATUS_IS_OK(status))
1874                         return NT_STATUS_NO_MEMORY;
1875
1876                 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1877                         return NT_STATUS_NO_MEMORY;
1878                 break;
1879         default:
1880                 return NT_STATUS_INVALID_LEVEL;
1881         }
1882
1883         return status;
1884 }
1885
1886 #if 0   /* AD DC work in ongoing in Samba 4 */
1887
1888 /***************************************************************************
1889  ***************************************************************************/
1890
1891  NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1892 {
1893         struct lsa_info *handle;
1894         const char *nb_name;
1895         char *dns_name = NULL;
1896         char *forest_name = NULL;
1897         DOM_SID *sid = NULL;
1898         struct GUID guid;
1899         fstring dnsdomname;
1900
1901         ZERO_STRUCT(guid);
1902         r_u->status = NT_STATUS_OK;
1903
1904         if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1905                 return NT_STATUS_INVALID_HANDLE;
1906
1907         switch (q_u->info_class) {
1908         case 0x0c:
1909                 /* check if the user has enough rights */
1910                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1911                         return NT_STATUS_ACCESS_DENIED;
1912
1913                 /* Request PolicyPrimaryDomainInformation. */
1914                 switch (lp_server_role()) {
1915                         case ROLE_DOMAIN_PDC:
1916                         case ROLE_DOMAIN_BDC:
1917                                 nb_name = get_global_sam_name();
1918                                 /* ugly temp hack for these next two */
1919
1920                                 /* This should be a 'netbios domain -> DNS domain' mapping */
1921                                 dnsdomname = get_mydnsdomname(p->mem_ctx);
1922                                 if (!dnsdomname || !*dnsdomname) {
1923                                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1924                                 }
1925                                 strlower_m(dnsdomname);
1926
1927                                 dns_name = dnsdomname;
1928                                 forest_name = dnsdomname;
1929
1930                                 sid = get_global_sam_sid();
1931                                 secrets_fetch_domain_guid(lp_workgroup(), &guid);
1932                                 break;
1933                         default:
1934                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1935                 }
1936                 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1937                                   forest_name,&guid,sid);
1938                 break;
1939         default:
1940                 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1941                 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1942                 break;
1943         }
1944
1945         if (NT_STATUS_IS_OK(r_u->status)) {
1946                 r_u->ptr = 0x1;
1947                 r_u->info_class = q_u->info_class;
1948         }
1949
1950         return r_u->status;
1951 }
1952 #endif  /* AD DC work in ongoing in Samba 4 */
1953
1954 /***************************************************************************
1955  _lsa_AddAccountRights
1956  ***************************************************************************/
1957
1958 NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
1959                                struct lsa_AddAccountRights *r)
1960 {
1961         struct lsa_info *info = NULL;
1962         int i = 0;
1963         DOM_SID sid;
1964
1965         /* find the connection policy handle. */
1966         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1967                 return NT_STATUS_INVALID_HANDLE;
1968
1969         /* check to see if the pipe_user is a Domain Admin since
1970            account_pol.tdb was already opened as root, this is all we have */
1971
1972         if ( p->server_info->utok.uid != sec_initial_uid()
1973                 && !nt_token_check_domain_rid( p->server_info->ptok,
1974                                                DOMAIN_GROUP_RID_ADMINS ) )
1975         {
1976                 return NT_STATUS_ACCESS_DENIED;
1977         }
1978
1979         /* according to an NT4 PDC, you can add privileges to SIDs even without
1980            call_lsa_create_account() first.  And you can use any arbitrary SID. */
1981
1982         sid_copy( &sid, r->in.sid );
1983
1984         for ( i=0; i < r->in.rights->count; i++ ) {
1985
1986                 const char *privname = r->in.rights->names[i].string;
1987
1988                 /* only try to add non-null strings */
1989
1990                 if ( !privname )
1991                         continue;
1992
1993                 if ( !grant_privilege_by_name( &sid, privname ) ) {
1994                         DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
1995                                 privname ));
1996                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1997                 }
1998         }
1999
2000         return NT_STATUS_OK;
2001 }
2002
2003 /***************************************************************************
2004  _lsa_RemoveAccountRights
2005  ***************************************************************************/
2006
2007 NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
2008                                   struct lsa_RemoveAccountRights *r)
2009 {
2010         struct lsa_info *info = NULL;
2011         int i = 0;
2012         DOM_SID sid;
2013         const char *privname = NULL;
2014
2015         /* find the connection policy handle. */
2016         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2017                 return NT_STATUS_INVALID_HANDLE;
2018
2019         /* check to see if the pipe_user is a Domain Admin since
2020            account_pol.tdb was already opened as root, this is all we have */
2021
2022         if ( p->server_info->utok.uid != sec_initial_uid()
2023                 && !nt_token_check_domain_rid( p->server_info->ptok,
2024                                                DOMAIN_GROUP_RID_ADMINS ) )
2025         {
2026                 return NT_STATUS_ACCESS_DENIED;
2027         }
2028
2029         sid_copy( &sid, r->in.sid );
2030
2031         if ( r->in.remove_all ) {
2032                 if ( !revoke_all_privileges( &sid ) )
2033                         return NT_STATUS_ACCESS_DENIED;
2034
2035                 return NT_STATUS_OK;
2036         }
2037
2038         for ( i=0; i < r->in.rights->count; i++ ) {
2039
2040                 privname = r->in.rights->names[i].string;
2041
2042                 /* only try to add non-null strings */
2043
2044                 if ( !privname )
2045                         continue;
2046
2047                 if ( !revoke_privilege_by_name( &sid, privname ) ) {
2048                         DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2049                                 privname ));
2050                         return NT_STATUS_NO_SUCH_PRIVILEGE;
2051                 }
2052         }
2053
2054         return NT_STATUS_OK;
2055 }
2056
2057 /*******************************************************************
2058 ********************************************************************/
2059
2060 static NTSTATUS init_lsa_right_set(TALLOC_CTX *mem_ctx,
2061                                    struct lsa_RightSet *r,
2062                                    PRIVILEGE_SET *privileges)
2063 {
2064         uint32 i;
2065         const char *privname;
2066         const char **privname_array = NULL;
2067         int num_priv = 0;
2068
2069         for (i=0; i<privileges->count; i++) {
2070
2071                 privname = luid_to_privilege_name(&privileges->set[i].luid);
2072                 if (privname) {
2073                         if (!add_string_to_array(mem_ctx, privname,
2074                                                  &privname_array, &num_priv)) {
2075                                 return NT_STATUS_NO_MEMORY;
2076                         }
2077                 }
2078         }
2079
2080         if (num_priv) {
2081
2082                 r->names = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_StringLarge,
2083                                              num_priv);
2084                 if (!r->names) {
2085                         return NT_STATUS_NO_MEMORY;
2086                 }
2087
2088                 for (i=0; i<num_priv; i++) {
2089                         init_lsa_StringLarge(&r->names[i], privname_array[i]);
2090                 }
2091
2092                 r->count = num_priv;
2093         }
2094
2095         return NT_STATUS_OK;
2096 }
2097
2098 /***************************************************************************
2099  _lsa_EnumAccountRights
2100  ***************************************************************************/
2101
2102 NTSTATUS _lsa_EnumAccountRights(pipes_struct *p,
2103                                 struct lsa_EnumAccountRights *r)
2104 {
2105         NTSTATUS status;
2106         struct lsa_info *info = NULL;
2107         DOM_SID sid;
2108         PRIVILEGE_SET privileges;
2109         SE_PRIV mask;
2110
2111         /* find the connection policy handle. */
2112
2113         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2114                 return NT_STATUS_INVALID_HANDLE;
2115
2116         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
2117                 return NT_STATUS_ACCESS_DENIED;
2118
2119         /* according to an NT4 PDC, you can add privileges to SIDs even without
2120            call_lsa_create_account() first.  And you can use any arbitrary SID. */
2121
2122         sid_copy( &sid, r->in.sid );
2123
2124         if ( !get_privileges_for_sids( &mask, &sid, 1 ) )
2125                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2126
2127         privilege_set_init( &privileges );
2128
2129         if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
2130
2131                 DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2132                           sid_string_dbg(&sid), privileges.count));
2133
2134                 status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
2135         } else {
2136                 status = NT_STATUS_NO_SUCH_PRIVILEGE;
2137         }
2138
2139         privilege_set_free( &privileges );
2140
2141         return status;
2142 }
2143
2144 /***************************************************************************
2145  _lsa_LookupPrivValue
2146  ***************************************************************************/
2147
2148 NTSTATUS _lsa_LookupPrivValue(pipes_struct *p,
2149                               struct lsa_LookupPrivValue *r)
2150 {
2151         struct lsa_info *info = NULL;
2152         const char *name = NULL;
2153         LUID_ATTR priv_luid;
2154         SE_PRIV mask;
2155
2156         /* find the connection policy handle. */
2157
2158         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2159                 return NT_STATUS_INVALID_HANDLE;
2160
2161         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
2162                 return NT_STATUS_ACCESS_DENIED;
2163
2164         name = r->in.name->string;
2165
2166         DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
2167
2168         if ( !se_priv_from_name( name, &mask ) )
2169                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2170
2171         priv_luid = get_privilege_luid( &mask );
2172
2173         r->out.luid->low = priv_luid.luid.low;
2174         r->out.luid->high = priv_luid.luid.high;
2175
2176         return NT_STATUS_OK;
2177 }
2178
2179 /*
2180  * From here on the server routines are just dummy ones to make smbd link with
2181  * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2182  * pulling the server stubs across one by one.
2183  */
2184
2185 NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
2186 {
2187         p->rng_fault_state = True;
2188         return NT_STATUS_NOT_IMPLEMENTED;
2189 }
2190
2191 NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
2192 {
2193         p->rng_fault_state = True;
2194         return NT_STATUS_NOT_IMPLEMENTED;
2195 }
2196
2197 NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
2198 {
2199         p->rng_fault_state = True;
2200         return NT_STATUS_NOT_IMPLEMENTED;
2201 }
2202
2203 NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
2204 {
2205         p->rng_fault_state = True;
2206         return NT_STATUS_NOT_IMPLEMENTED;
2207 }
2208
2209 NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
2210 {
2211         p->rng_fault_state = True;
2212         return NT_STATUS_NOT_IMPLEMENTED;
2213 }
2214
2215 NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
2216 {
2217         p->rng_fault_state = True;
2218         return NT_STATUS_NOT_IMPLEMENTED;
2219 }
2220
2221 NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
2222 {
2223         p->rng_fault_state = True;
2224         return NT_STATUS_NOT_IMPLEMENTED;
2225 }
2226
2227 NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
2228 {
2229         p->rng_fault_state = True;
2230         return NT_STATUS_NOT_IMPLEMENTED;
2231 }
2232
2233 NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
2234 {
2235         p->rng_fault_state = True;
2236         return NT_STATUS_NOT_IMPLEMENTED;
2237 }
2238
2239 NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
2240 {
2241         p->rng_fault_state = True;
2242         return NT_STATUS_NOT_IMPLEMENTED;
2243 }
2244
2245 NTSTATUS _lsa_LookupPrivName(pipes_struct *p, struct lsa_LookupPrivName *r)
2246 {
2247         p->rng_fault_state = True;
2248         return NT_STATUS_NOT_IMPLEMENTED;
2249 }
2250
2251 NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p, struct lsa_EnumAccountsWithUserRight *r)
2252 {
2253         p->rng_fault_state = True;
2254         return NT_STATUS_NOT_IMPLEMENTED;
2255 }
2256
2257 NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
2258 {
2259         p->rng_fault_state = True;
2260         return NT_STATUS_NOT_IMPLEMENTED;
2261 }
2262
2263 NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
2264 {
2265         p->rng_fault_state = True;
2266         return NT_STATUS_NOT_IMPLEMENTED;
2267 }
2268
2269 NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
2270 {
2271         p->rng_fault_state = True;
2272         return NT_STATUS_NOT_IMPLEMENTED;
2273 }
2274
2275 NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
2276 {
2277         p->rng_fault_state = True;
2278         return NT_STATUS_NOT_IMPLEMENTED;
2279 }
2280
2281 NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
2282 {
2283         p->rng_fault_state = True;
2284         return NT_STATUS_NOT_IMPLEMENTED;
2285 }
2286
2287 NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p, struct lsa_QueryInfoPolicy2 *r)
2288 {
2289         p->rng_fault_state = True;
2290         return NT_STATUS_NOT_IMPLEMENTED;
2291 }
2292
2293 NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
2294 {
2295         p->rng_fault_state = True;
2296         return NT_STATUS_NOT_IMPLEMENTED;
2297 }
2298
2299 NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
2300 {
2301         p->rng_fault_state = True;
2302         return NT_STATUS_NOT_IMPLEMENTED;
2303 }
2304
2305 NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
2306 {
2307         p->rng_fault_state = True;
2308         return NT_STATUS_NOT_IMPLEMENTED;
2309 }
2310
2311 NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
2312 {
2313         p->rng_fault_state = True;
2314         return NT_STATUS_NOT_IMPLEMENTED;
2315 }
2316
2317 NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
2318 {
2319         p->rng_fault_state = True;
2320         return NT_STATUS_NOT_IMPLEMENTED;
2321 }
2322
2323 NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
2324 {
2325         p->rng_fault_state = True;
2326         return NT_STATUS_NOT_IMPLEMENTED;
2327 }
2328
2329 NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
2330 {
2331         p->rng_fault_state = True;
2332         return NT_STATUS_NOT_IMPLEMENTED;
2333 }
2334
2335 NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
2336 {
2337         p->rng_fault_state = True;
2338         return NT_STATUS_NOT_IMPLEMENTED;
2339 }
2340
2341 NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
2342 {
2343         p->rng_fault_state = True;
2344         return NT_STATUS_NOT_IMPLEMENTED;
2345 }
2346
2347 NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
2348 {
2349         p->rng_fault_state = True;
2350         return NT_STATUS_NOT_IMPLEMENTED;
2351 }
2352
2353 NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
2354 {
2355         p->rng_fault_state = True;
2356         return NT_STATUS_NOT_IMPLEMENTED;
2357 }
2358
2359 NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
2360 {
2361         p->rng_fault_state = True;
2362         return NT_STATUS_NOT_IMPLEMENTED;
2363 }
2364
2365 NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
2366 {
2367         p->rng_fault_state = True;
2368         return NT_STATUS_NOT_IMPLEMENTED;
2369 }
2370
2371 NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
2372 {
2373         p->rng_fault_state = True;
2374         return NT_STATUS_NOT_IMPLEMENTED;
2375 }
2376
2377 NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
2378 {
2379         p->rng_fault_state = True;
2380         return NT_STATUS_NOT_IMPLEMENTED;
2381 }
2382
2383 NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
2384 {
2385         p->rng_fault_state = True;
2386         return NT_STATUS_NOT_IMPLEMENTED;
2387 }
2388
2389 NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
2390 {
2391         p->rng_fault_state = True;
2392         return NT_STATUS_NOT_IMPLEMENTED;
2393 }
2394
2395 NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
2396 {
2397         p->rng_fault_state = True;
2398         return NT_STATUS_NOT_IMPLEMENTED;
2399 }
2400
2401 NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
2402 {
2403         p->rng_fault_state = True;
2404         return NT_STATUS_NOT_IMPLEMENTED;
2405 }
2406
2407 NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
2408 {
2409         p->rng_fault_state = True;
2410         return NT_STATUS_NOT_IMPLEMENTED;
2411 }
2412
2413 NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
2414 {
2415         p->rng_fault_state = True;
2416         return NT_STATUS_NOT_IMPLEMENTED;
2417 }
2418
2419 NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
2420 {
2421         p->rng_fault_state = True;
2422         return NT_STATUS_NOT_IMPLEMENTED;
2423 }
2424
2425 NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
2426 {
2427         p->rng_fault_state = True;
2428         return NT_STATUS_NOT_IMPLEMENTED;
2429 }
2430
2431 NTSTATUS _lsa_lsaRQueryForestTrustInformation(pipes_struct *p, struct lsa_lsaRQueryForestTrustInformation *r)
2432 {
2433         p->rng_fault_state = True;
2434         return NT_STATUS_NOT_IMPLEMENTED;
2435 }
2436
2437 NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2438 {
2439         p->rng_fault_state = True;
2440         return NT_STATUS_NOT_IMPLEMENTED;
2441 }
2442
2443 NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
2444 {
2445         p->rng_fault_state = True;
2446         return NT_STATUS_NOT_IMPLEMENTED;
2447 }
2448
2449 NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
2450 {
2451         p->rng_fault_state = True;
2452         return NT_STATUS_NOT_IMPLEMENTED;
2453 }
2454
2455 NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2456 {
2457         p->rng_fault_state = True;
2458         return NT_STATUS_NOT_IMPLEMENTED;
2459 }
2460
2461 NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2462 {
2463         p->rng_fault_state = True;
2464         return NT_STATUS_NOT_IMPLEMENTED;
2465 }
2466
2467 NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
2468 {
2469         p->rng_fault_state = True;
2470         return NT_STATUS_NOT_IMPLEMENTED;
2471 }