source3/rpc_server/srv_lsa_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997,
   7  *  Copyright (C) Jeremy Allison                    2001, 2006.
   8  *  Copyright (C) Rafal Szczesniak                  2002,
   9  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
  10  *  Copyright (C) Simo Sorce                        2003.
  11  *  Copyright (C) Gerald (Jerry) Carter             2005.
  12  *  Copyright (C) Volker Lendecke                   2005.
  13  *  Copyright (C) Guenther Deschner                 2008.
  14  *
  15  *  This program is free software; you can redistribute it and/or modify
  16  *  it under the terms of the GNU General Public License as published by
  17  *  the Free Software Foundation; either version 3 of the License, or
  18  *  (at your option) any later version.
  19  *
  20  *  This program is distributed in the hope that it will be useful,
  21  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  *  GNU General Public License for more details.
  24  *
  25  *  You should have received a copy of the GNU General Public License
  26  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  27  */
  28
  29 /* This is the implementation of the lsa server code. */
  30
  31 #include "includes.h"
  32
  33 #undef DBGC_CLASS
  34 #define DBGC_CLASS DBGC_RPC_SRV
  35
  36 #define MAX_LOOKUP_SIDS 0x5000 /* 20480 */
  37
  38 extern PRIVS privs[];
  39
  40 enum lsa_handle_type { LSA_HANDLE_POLICY_TYPE = 1, LSA_HANDLE_ACCOUNT_TYPE };
  41
  42 struct lsa_info {
  43         DOM_SID sid;
  44         uint32 access;
  45         enum lsa_handle_type type;
  46 };
  47
  48 const struct generic_mapping lsa_account_mapping = {
  49         LSA_ACCOUNT_READ,
  50         LSA_ACCOUNT_WRITE,
  51         LSA_ACCOUNT_EXECUTE,
  52         LSA_ACCOUNT_ALL_ACCESS
  53 };
  54
  55 const struct generic_mapping lsa_policy_mapping = {
  56         LSA_POLICY_READ,
  57         LSA_POLICY_WRITE,
  58         LSA_POLICY_EXECUTE,
  59         LSA_POLICY_ALL_ACCESS
  60 };
  61
  62 /***************************************************************************
  63  init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
  64 ***************************************************************************/
  65
  66 static int init_lsa_ref_domain_list(TALLOC_CTX *mem_ctx,
  67                                     struct lsa_RefDomainList *ref,
  68                                     const char *dom_name,
  69                                     DOM_SID *dom_sid)
  70 {
  71         int num = 0;
  72
  73         if (dom_name != NULL) {
  74                 for (num = 0; num < ref->count; num++) {
  75                         if (sid_equal(dom_sid, ref->domains[num].sid)) {
  76                                 return num;
  77                         }
  78                 }
  79         } else {
  80                 num = ref->count;
  81         }
  82
  83         if (num >= LSA_REF_DOMAIN_LIST_MULTIPLIER) {
  84                 /* index not found, already at maximum domain limit */
  85                 return -1;
  86         }
  87
  88         ref->count = num + 1;
  89         ref->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER;
  90
  91         ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
  92                                             struct lsa_DomainInfo, ref->count);
  93         if (!ref->domains) {
  94                 return -1;
  95         }
  96
  97         ZERO_STRUCT(ref->domains[num]);
  98
  99         init_lsa_StringLarge(&ref->domains[num].name, dom_name);
 100         ref->domains[num].sid = sid_dup_talloc(mem_ctx, dom_sid);
 101         if (!ref->domains[num].sid) {
 102                 return -1;
 103         }
 104
 105         return num;
 106 }
 107
 108
 109 /***************************************************************************
 110  initialize a lsa_DomainInfo structure.
 111  ***************************************************************************/
 112
 113 static void init_dom_query_3(struct lsa_DomainInfo *r,
 114                              const char *name,
 115                              DOM_SID *sid)
 116 {
 117         init_lsa_StringLarge(&r->name, name);
 118         r->sid = sid;
 119 }
 120
 121 /***************************************************************************
 122  initialize a lsa_DomainInfo structure.
 123  ***************************************************************************/
 124
 125 static void init_dom_query_5(struct lsa_DomainInfo *r,
 126                              const char *name,
 127                              DOM_SID *sid)
 128 {
 129         init_lsa_StringLarge(&r->name, name);
 130         r->sid = sid;
 131 }
 132
 133 /***************************************************************************
 134  lookup_lsa_rids. Must be called as root for lookup_name to work.
 135  ***************************************************************************/
 136
 137 static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
 138                                 struct lsa_RefDomainList *ref,
 139                                 struct lsa_TranslatedSid *prid,
 140                                 uint32_t num_entries,
 141                                 struct lsa_String *name,
 142                                 int flags,
 143                                 uint32_t *pmapped_count)
 144 {
 145         uint32 mapped_count, i;
 146
 147         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 148
 149         mapped_count = 0;
 150         *pmapped_count = 0;
 151
 152         for (i = 0; i < num_entries; i++) {
 153                 DOM_SID sid;
 154                 uint32 rid;
 155                 int dom_idx;
 156                 const char *full_name;
 157                 const char *domain;
 158                 enum lsa_SidType type = SID_NAME_UNKNOWN;
 159
 160                 /* Split name into domain and user component */
 161
 162                 full_name = name[i].string;
 163                 if (full_name == NULL) {
 164                         return NT_STATUS_NO_MEMORY;
 165                 }
 166
 167                 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
 168
 169                 /* We can ignore the result of lookup_name, it will not touch
 170                    "type" if it's not successful */
 171
 172                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
 173                             &sid, &type);
 174
 175                 switch (type) {
 176                 case SID_NAME_USER:
 177                 case SID_NAME_DOM_GRP:
 178                 case SID_NAME_DOMAIN:
 179                 case SID_NAME_ALIAS:
 180                 case SID_NAME_WKN_GRP:
 181                         DEBUG(5, ("init_lsa_rids: %s found\n", full_name));
 182                         /* Leave these unchanged */
 183                         break;
 184                 default:
 185                         /* Don't hand out anything but the list above */
 186                         DEBUG(5, ("init_lsa_rids: %s not found\n", full_name));
 187                         type = SID_NAME_UNKNOWN;
 188                         break;
 189                 }
 190
 191                 rid = 0;
 192                 dom_idx = -1;
 193
 194                 if (type != SID_NAME_UNKNOWN) {
 195                         sid_split_rid(&sid, &rid);
 196                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &sid);
 197                         mapped_count++;
 198                 }
 199
 200                 prid[i].sid_type        = type;
 201                 prid[i].rid             = rid;
 202                 prid[i].sid_index       = dom_idx;
 203         }
 204
 205         *pmapped_count = mapped_count;
 206         return NT_STATUS_OK;
 207 }
 208
 209 /***************************************************************************
 210  lookup_lsa_sids. Must be called as root for lookup_name to work.
 211  ***************************************************************************/
 212
 213 static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
 214                                 struct lsa_RefDomainList *ref,
 215                                 struct lsa_TranslatedSid3 *trans_sids,
 216                                 uint32_t num_entries,
 217                                 struct lsa_String *name,
 218                                 int flags,
 219                                 uint32 *pmapped_count)
 220 {
 221         uint32 mapped_count, i;
 222
 223         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 224
 225         mapped_count = 0;
 226         *pmapped_count = 0;
 227
 228         for (i = 0; i < num_entries; i++) {
 229                 DOM_SID sid;
 230                 uint32 rid;
 231                 int dom_idx;
 232                 const char *full_name;
 233                 const char *domain;
 234                 enum lsa_SidType type = SID_NAME_UNKNOWN;
 235
 236                 ZERO_STRUCT(sid);
 237
 238                 /* Split name into domain and user component */
 239
 240                 full_name = name[i].string;
 241                 if (full_name == NULL) {
 242                         return NT_STATUS_NO_MEMORY;
 243                 }
 244
 245                 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
 246
 247                 /* We can ignore the result of lookup_name, it will not touch
 248                    "type" if it's not successful */
 249
 250                 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
 251                             &sid, &type);
 252
 253                 switch (type) {
 254                 case SID_NAME_USER:
 255                 case SID_NAME_DOM_GRP:
 256                 case SID_NAME_DOMAIN:
 257                 case SID_NAME_ALIAS:
 258                 case SID_NAME_WKN_GRP:
 259                         DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
 260                         /* Leave these unchanged */
 261                         break;
 262                 default:
 263                         /* Don't hand out anything but the list above */
 264                         DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
 265                         type = SID_NAME_UNKNOWN;
 266                         break;
 267                 }
 268
 269                 rid = 0;
 270                 dom_idx = -1;
 271
 272                 if (type != SID_NAME_UNKNOWN) {
 273                         DOM_SID domain_sid;
 274                         sid_copy(&domain_sid, &sid);
 275                         sid_split_rid(&domain_sid, &rid);
 276                         dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &domain_sid);
 277                         mapped_count++;
 278                 }
 279
 280                 /* Initialize the lsa_TranslatedSid3 return. */
 281                 trans_sids[i].sid_type = type;
 282                 trans_sids[i].sid = sid_dup_talloc(mem_ctx, &sid);
 283                 trans_sids[i].sid_index = dom_idx;
 284         }
 285
 286         *pmapped_count = mapped_count;
 287         return NT_STATUS_OK;
 288 }
 289
 290 static NTSTATUS make_lsa_object_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size,
 291                                         const struct generic_mapping *map,
 292                                         DOM_SID *sid, uint32_t sid_access)
 293 {
 294         DOM_SID adm_sid;
 295         SEC_ACE ace[5];
 296         size_t i = 0;
 297
 298         SEC_ACL *psa = NULL;
 299
 300         /* READ|EXECUTE access for Everyone */
 301
 302         init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
 303                         map->generic_execute | map->generic_read, 0);
 304
 305         /* Add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 306
 307         init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
 308                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 309         init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
 310                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 311
 312         /* Add Full Access for Domain Admins */
 313         sid_copy(&adm_sid, get_global_sam_sid());
 314         sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
 315         init_sec_ace(&ace[i++], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
 316                         map->generic_all, 0);
 317
 318         /* If we have a sid, give it some special access */
 319
 320         if (sid) {
 321                 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED,
 322                         sid_access, 0);
 323         }
 324
 325         if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, i, ace)) == NULL)
 326                 return NT_STATUS_NO_MEMORY;
 327
 328         if((*sd = make_sec_desc(mem_ctx, SECURITY_DESCRIPTOR_REVISION_1,
 329                                 SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL,
 330                                 psa, sd_size)) == NULL)
 331                 return NT_STATUS_NO_MEMORY;
 332
 333         return NT_STATUS_OK;
 334 }
 335
 336
 337 /***************************************************************************
 338  _lsa_OpenPolicy2
 339  ***************************************************************************/
 340
 341 NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
 342                           struct lsa_OpenPolicy2 *r)
 343 {
 344         struct lsa_info *info;
 345         SEC_DESC *psd = NULL;
 346         size_t sd_size;
 347         uint32 des_access = r->in.access_mask;
 348         uint32 acc_granted;
 349         NTSTATUS status;
 350
 351         /* Work out max allowed. */
 352         map_max_allowed_access(p->server_info->ptok, &des_access);
 353
 354         /* map the generic bits to the lsa policy ones */
 355         se_map_generic(&des_access, &lsa_policy_mapping);
 356
 357         /* get the generic lsa policy SD until we store it */
 358         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size, &lsa_policy_mapping,
 359                         NULL, 0);
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 return status;
 362         }
 363
 364         status = access_check_object(psd, p->server_info->ptok,
 365                 NULL, 0, des_access,
 366                 &acc_granted, "_lsa_OpenPolicy2" );
 367
 368         if (!NT_STATUS_IS_OK(status)) {
 369                 return status;
 370         }
 371
 372         /* associate the domain SID with the (unique) handle. */
 373         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
 374         if (info == NULL) {
 375                 return NT_STATUS_NO_MEMORY;
 376         }
 377
 378         sid_copy(&info->sid,get_global_sam_sid());
 379         info->access = acc_granted;
 380         info->type = LSA_HANDLE_POLICY_TYPE;
 381
 382         /* set up the LSA QUERY INFO response */
 383         if (!create_policy_hnd(p, r->out.handle, info))
 384                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 385
 386         return NT_STATUS_OK;
 387 }
 388
 389 /***************************************************************************
 390  _lsa_OpenPolicy
 391  ***************************************************************************/
 392
 393 NTSTATUS _lsa_OpenPolicy(pipes_struct *p,
 394                          struct lsa_OpenPolicy *r)
 395 {
 396         struct lsa_OpenPolicy2 o;
 397
 398         o.in.system_name        = NULL; /* should be ignored */
 399         o.in.attr               = r->in.attr;
 400         o.in.access_mask        = r->in.access_mask;
 401
 402         o.out.handle            = r->out.handle;
 403
 404         return _lsa_OpenPolicy2(p, &o);
 405 }
 406
 407 /***************************************************************************
 408  _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
 409  ufff, done :)  mimir
 410  ***************************************************************************/
 411
 412 NTSTATUS _lsa_EnumTrustDom(pipes_struct *p,
 413                            struct lsa_EnumTrustDom *r)
 414 {
 415         struct lsa_info *info;
 416         uint32 next_idx;
 417         struct trustdom_info **domains;
 418         struct lsa_DomainInfo *lsa_domains = NULL;
 419         int i;
 420
 421         /*
 422          * preferred length is set to 5 as a "our" preferred length
 423          * nt sets this parameter to 2
 424          * update (20.08.2002): it's not preferred length, but preferred size!
 425          * it needs further investigation how to optimally choose this value
 426          */
 427         uint32 max_num_domains =
 428                 r->in.max_size < 5 ? r->in.max_size : 10;
 429         uint32 num_domains;
 430         NTSTATUS nt_status;
 431         uint32 num_thistime;
 432
 433         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
 434                 return NT_STATUS_INVALID_HANDLE;
 435
 436         if (info->type != LSA_HANDLE_POLICY_TYPE) {
 437                 return NT_STATUS_INVALID_HANDLE;
 438         }
 439
 440         /* check if the user has enough rights */
 441         if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 442                 return NT_STATUS_ACCESS_DENIED;
 443
 444         become_root();
 445         nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
 446         unbecome_root();
 447
 448         if (!NT_STATUS_IS_OK(nt_status)) {
 449                 return nt_status;
 450         }
 451
 452         if (*r->in.resume_handle < num_domains) {
 453                 num_thistime = MIN(num_domains, max_num_domains);
 454
 455                 nt_status = STATUS_MORE_ENTRIES;
 456
 457                 if (*r->in.resume_handle + num_thistime > num_domains) {
 458                         num_thistime = num_domains - *r->in.resume_handle;
 459                         nt_status = NT_STATUS_OK;
 460                 }
 461
 462                 next_idx = *r->in.resume_handle + num_thistime;
 463         } else {
 464                 num_thistime = 0;
 465                 next_idx = 0xffffffff;
 466                 nt_status = NT_STATUS_NO_MORE_ENTRIES;
 467         }
 468
 469         /* set up the lsa_enum_trust_dom response */
 470
 471         lsa_domains = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_DomainInfo,
 472                                         num_thistime);
 473         if (!lsa_domains) {
 474                 return NT_STATUS_NO_MEMORY;
 475         }
 476
 477         for (i=0; i<num_thistime; i++) {
 478                 init_lsa_StringLarge(&lsa_domains[i].name, domains[i]->name);
 479                 lsa_domains[i].sid = &domains[i]->sid;
 480         }
 481
 482         *r->out.resume_handle = next_idx;
 483         r->out.domains->count = num_thistime;
 484         r->out.domains->domains = lsa_domains;
 485
 486         return nt_status;
 487 }
 488
 489 #define LSA_AUDIT_NUM_CATEGORIES_NT4    7
 490 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K  9
 491 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
 492
 493 /***************************************************************************
 494  _lsa_QueryInfoPolicy
 495  ***************************************************************************/
 496
 497 NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
 498                               struct lsa_QueryInfoPolicy *r)
 499 {
 500         NTSTATUS status = NT_STATUS_OK;
 501         struct lsa_info *handle;
 502         DOM_SID domain_sid;
 503         const char *name;
 504         DOM_SID *sid = NULL;
 505         union lsa_PolicyInformation *info = NULL;
 506
 507         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
 508                 return NT_STATUS_INVALID_HANDLE;
 509
 510         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
 511                 return NT_STATUS_INVALID_HANDLE;
 512         }
 513
 514         info = TALLOC_ZERO_P(p->mem_ctx, union lsa_PolicyInformation);
 515         if (!info) {
 516                 return NT_STATUS_NO_MEMORY;
 517         }
 518
 519         switch (r->in.level) {
 520         case LSA_POLICY_INFO_AUDIT_EVENTS:
 521                 {
 522
 523                 uint32 policy_def = LSA_AUDIT_POLICY_ALL;
 524
 525                 /* check if the user has enough rights */
 526                 if (!(handle->access & LSA_POLICY_VIEW_AUDIT_INFORMATION)) {
 527                         DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
 528                         return NT_STATUS_ACCESS_DENIED;
 529                 }
 530
 531                 /* fake info: We audit everything. ;) */
 532
 533                 info->audit_events.auditing_mode = true;
 534                 info->audit_events.count = LSA_AUDIT_NUM_CATEGORIES;
 535                 info->audit_events.settings = TALLOC_ZERO_ARRAY(p->mem_ctx,
 536                                                                 enum lsa_PolicyAuditPolicy,
 537                                                                 info->audit_events.count);
 538                 if (!info->audit_events.settings) {
 539                         return NT_STATUS_NO_MEMORY;
 540                 }
 541
 542                 info->audit_events.settings[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT] = policy_def;
 543                 info->audit_events.settings[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS] = policy_def;
 544                 info->audit_events.settings[LSA_AUDIT_CATEGORY_LOGON] = policy_def;
 545                 info->audit_events.settings[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING] = policy_def;
 546                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES] = policy_def;
 547                 info->audit_events.settings[LSA_AUDIT_CATEGORY_SYSTEM] = policy_def;
 548                 info->audit_events.settings[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS] = policy_def;
 549
 550                 break;
 551                 }
 552         case LSA_POLICY_INFO_DOMAIN:
 553                 /* check if the user has enough rights */
 554                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 555                         return NT_STATUS_ACCESS_DENIED;
 556
 557                 /* Request PolicyPrimaryDomainInformation. */
 558                 switch (lp_server_role()) {
 559                         case ROLE_DOMAIN_PDC:
 560                         case ROLE_DOMAIN_BDC:
 561                                 name = get_global_sam_name();
 562                                 sid = sid_dup_talloc(p->mem_ctx, get_global_sam_sid());
 563                                 if (!sid) {
 564                                         return NT_STATUS_NO_MEMORY;
 565                                 }
 566                                 break;
 567                         case ROLE_DOMAIN_MEMBER:
 568                                 name = lp_workgroup();
 569                                 /* We need to return the Domain SID here. */
 570                                 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
 571                                         sid = sid_dup_talloc(p->mem_ctx, &domain_sid);
 572                                         if (!sid) {
 573                                                 return NT_STATUS_NO_MEMORY;
 574                                         }
 575                                 } else {
 576                                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 577                                 }
 578                                 break;
 579                         case ROLE_STANDALONE:
 580                                 name = lp_workgroup();
 581                                 sid = NULL;
 582                                 break;
 583                         default:
 584                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 585                 }
 586                 init_dom_query_3(&info->domain, name, sid);
 587                 break;
 588         case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
 589                 /* check if the user has enough rights */
 590                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 591                         return NT_STATUS_ACCESS_DENIED;
 592
 593                 /* Request PolicyAccountDomainInformation. */
 594                 name = get_global_sam_name();
 595                 sid = get_global_sam_sid();
 596
 597                 init_dom_query_5(&info->account_domain, name, sid);
 598                 break;
 599         case LSA_POLICY_INFO_ROLE:
 600                 /* check if the user has enough rights */
 601                 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
 602                         return NT_STATUS_ACCESS_DENIED;
 603
 604                 switch (lp_server_role()) {
 605                         case ROLE_DOMAIN_BDC:
 606                                 /*
 607                                  * only a BDC is a backup controller
 608                                  * of the domain, it controls.
 609                                  */
 610                                 info->role.role = LSA_ROLE_BACKUP;
 611                                 break;
 612                         default:
 613                                 /*
 614                                  * any other role is a primary
 615                                  * of the domain, it controls.
 616                                  */
 617                                 info->role.role = LSA_ROLE_PRIMARY;
 618                                 break;
 619                 }
 620                 break;
 621         case LSA_POLICY_INFO_DNS: {
 622                 struct pdb_domain_info *dominfo;
 623
 624                 if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
 625                         DEBUG(10, ("Not replying to LSA_POLICY_INFO_DNS "
 626                                    "without ADS passdb backend\n"));
 627                         status = NT_STATUS_INVALID_INFO_CLASS;
 628                         break;
 629                 }
 630
 631                 dominfo = pdb_get_domain_info(info);
 632                 if (dominfo == NULL) {
 633                         status = NT_STATUS_NO_MEMORY;
 634                         break;
 635                 }
 636
 637                 init_lsa_StringLarge(&info->dns.name,
 638                                      dominfo->name);
 639                 init_lsa_StringLarge(&info->dns.dns_domain,
 640                                      dominfo->dns_domain);
 641                 init_lsa_StringLarge(&info->dns.dns_forest,
 642                                      dominfo->dns_forest);
 643                 info->dns.domain_guid = dominfo->guid;
 644                 info->dns.sid = &dominfo->sid;
 645                 break;
 646         }
 647         default:
 648                 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
 649                         r->in.level));
 650                 status = NT_STATUS_INVALID_INFO_CLASS;
 651                 break;
 652         }
 653
 654         *r->out.info = info;
 655
 656         return status;
 657 }
 658
 659 /***************************************************************************
 660  _lsa_lookup_sids_internal
 661  ***************************************************************************/
 662
 663 static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
 664                                           TALLOC_CTX *mem_ctx,
 665                                           uint16_t level,                       /* input */
 666                                           int num_sids,                         /* input */
 667                                           struct lsa_SidPtr *sid,               /* input */
 668                                           struct lsa_RefDomainList **pp_ref,    /* input/output */
 669                                           struct lsa_TranslatedName2 **pp_names,/* input/output */
 670                                           uint32_t *pp_mapped_count)            /* input/output */
 671 {
 672         NTSTATUS status;
 673         int i;
 674         const DOM_SID **sids = NULL;
 675         struct lsa_RefDomainList *ref = NULL;
 676         uint32 mapped_count = 0;
 677         struct lsa_dom_info *dom_infos = NULL;
 678         struct lsa_name_info *name_infos = NULL;
 679         struct lsa_TranslatedName2 *names = NULL;
 680
 681         *pp_mapped_count = 0;
 682         *pp_names = NULL;
 683         *pp_ref = NULL;
 684
 685         if (num_sids == 0) {
 686                 return NT_STATUS_OK;
 687         }
 688
 689         sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
 690         ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
 691
 692         if (sids == NULL || ref == NULL) {
 693                 return NT_STATUS_NO_MEMORY;
 694         }
 695
 696         for (i=0; i<num_sids; i++) {
 697                 sids[i] = sid[i].sid;
 698         }
 699
 700         status = lookup_sids(p->mem_ctx, num_sids, sids, level,
 701                                   &dom_infos, &name_infos);
 702
 703         if (!NT_STATUS_IS_OK(status)) {
 704                 return status;
 705         }
 706
 707         names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
 708         if (names == NULL) {
 709                 return NT_STATUS_NO_MEMORY;
 710         }
 711
 712         for (i=0; i<LSA_REF_DOMAIN_LIST_MULTIPLIER; i++) {
 713
 714                 if (!dom_infos[i].valid) {
 715                         break;
 716                 }
 717
 718                 if (init_lsa_ref_domain_list(mem_ctx, ref,
 719                                              dom_infos[i].name,
 720                                              &dom_infos[i].sid) != i) {
 721                         DEBUG(0, ("Domain %s mentioned twice??\n",
 722                                   dom_infos[i].name));
 723                         return NT_STATUS_INTERNAL_ERROR;
 724                 }
 725         }
 726
 727         for (i=0; i<num_sids; i++) {
 728                 struct lsa_name_info *name = &name_infos[i];
 729
 730                 if (name->type == SID_NAME_UNKNOWN) {
 731                         fstring tmp;
 732                         name->dom_idx = -1;
 733                         /* Unknown sids should return the string
 734                          * representation of the SID. Windows 2003 behaves
 735                          * rather erratic here, in many cases it returns the
 736                          * RID as 8 bytes hex, in others it returns the full
 737                          * SID. We (Jerry/VL) could not figure out which the
 738                          * hard cases are, so leave it with the SID.  */
 739                         name->name = talloc_asprintf(p->mem_ctx, "%s",
 740                                                      sid_to_fstring(tmp,
 741                                                                     sids[i]));
 742                         if (name->name == NULL) {
 743                                 return NT_STATUS_NO_MEMORY;
 744                         }
 745                 } else {
 746                         mapped_count += 1;
 747                 }
 748
 749                 names[i].sid_type       = name->type;
 750                 names[i].name.string    = name->name;
 751                 names[i].sid_index      = name->dom_idx;
 752                 names[i].unknown        = 0;
 753         }
 754
 755         status = NT_STATUS_NONE_MAPPED;
 756         if (mapped_count > 0) {
 757                 status = (mapped_count < num_sids) ?
 758                         STATUS_SOME_UNMAPPED : NT_STATUS_OK;
 759         }
 760
 761         DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
 762                    num_sids, mapped_count, nt_errstr(status)));
 763
 764         *pp_mapped_count = mapped_count;
 765         *pp_names = names;
 766         *pp_ref = ref;
 767
 768         return status;
 769 }
 770
 771 /***************************************************************************
 772  _lsa_LookupSids
 773  ***************************************************************************/
 774
 775 NTSTATUS _lsa_LookupSids(pipes_struct *p,
 776                          struct lsa_LookupSids *r)
 777 {
 778         NTSTATUS status;
 779         struct lsa_info *handle;
 780         int num_sids = r->in.sids->num_sids;
 781         uint32 mapped_count = 0;
 782         struct lsa_RefDomainList *domains = NULL;
 783         struct lsa_TranslatedName *names_out = NULL;
 784         struct lsa_TranslatedName2 *names = NULL;
 785         int i;
 786
 787         if ((r->in.level < 1) || (r->in.level > 6)) {
 788                 return NT_STATUS_INVALID_PARAMETER;
 789         }
 790
 791         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
 792                 return NT_STATUS_INVALID_HANDLE;
 793         }
 794
 795         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
 796                 return NT_STATUS_INVALID_HANDLE;
 797         }
 798
 799         /* check if the user has enough rights */
 800         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
 801                 return NT_STATUS_ACCESS_DENIED;
 802         }
 803
 804         if (num_sids >  MAX_LOOKUP_SIDS) {
 805                 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
 806                          MAX_LOOKUP_SIDS, num_sids));
 807                 return NT_STATUS_NONE_MAPPED;
 808         }
 809
 810         status = _lsa_lookup_sids_internal(p,
 811                                            p->mem_ctx,
 812                                            r->in.level,
 813                                            num_sids,
 814                                            r->in.sids->sids,
 815                                            &domains,
 816                                            &names,
 817                                            &mapped_count);
 818
 819         /* Only return here when there is a real error.
 820            NT_STATUS_NONE_MAPPED is a special case as it indicates that none of
 821            the requested sids could be resolved. Older versions of XP (pre SP3)
 822            rely that we return with the string representations of those SIDs in
 823            that case. If we don't, XP crashes - Guenther
 824            */
 825
 826         if (NT_STATUS_IS_ERR(status) &&
 827             !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
 828                 return status;
 829         }
 830
 831         /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
 832         names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
 833                                  num_sids);
 834         if (!names_out) {
 835                 return NT_STATUS_NO_MEMORY;
 836         }
 837
 838         for (i=0; i<num_sids; i++) {
 839                 names_out[i].sid_type = names[i].sid_type;
 840                 names_out[i].name = names[i].name;
 841                 names_out[i].sid_index = names[i].sid_index;
 842         }
 843
 844         *r->out.domains = domains;
 845         r->out.names->count = num_sids;
 846         r->out.names->names = names_out;
 847         *r->out.count = mapped_count;
 848
 849         return status;
 850 }
 851
 852 /***************************************************************************
 853  _lsa_LookupSids2
 854  ***************************************************************************/
 855
 856 NTSTATUS _lsa_LookupSids2(pipes_struct *p,
 857                           struct lsa_LookupSids2 *r)
 858 {
 859         NTSTATUS status;
 860         struct lsa_info *handle;
 861         int num_sids = r->in.sids->num_sids;
 862         uint32 mapped_count = 0;
 863         struct lsa_RefDomainList *domains = NULL;
 864         struct lsa_TranslatedName2 *names = NULL;
 865         bool check_policy = true;
 866
 867         switch (p->hdr_req.opnum) {
 868                 case NDR_LSA_LOOKUPSIDS3:
 869                         check_policy = false;
 870                         break;
 871                 case NDR_LSA_LOOKUPSIDS2:
 872                 default:
 873                         check_policy = true;
 874         }
 875
 876         if ((r->in.level < 1) || (r->in.level > 6)) {
 877                 return NT_STATUS_INVALID_PARAMETER;
 878         }
 879
 880         if (check_policy) {
 881                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
 882                         return NT_STATUS_INVALID_HANDLE;
 883                 }
 884
 885                 if (handle->type != LSA_HANDLE_POLICY_TYPE) {
 886                         return NT_STATUS_INVALID_HANDLE;
 887                 }
 888
 889                 /* check if the user has enough rights */
 890                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
 891                         return NT_STATUS_ACCESS_DENIED;
 892                 }
 893         }
 894
 895         if (num_sids >  MAX_LOOKUP_SIDS) {
 896                 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
 897                          MAX_LOOKUP_SIDS, num_sids));
 898                 return NT_STATUS_NONE_MAPPED;
 899         }
 900
 901         status = _lsa_lookup_sids_internal(p,
 902                                            p->mem_ctx,
 903                                            r->in.level,
 904                                            num_sids,
 905                                            r->in.sids->sids,
 906                                            &domains,
 907                                            &names,
 908                                            &mapped_count);
 909
 910         *r->out.domains = domains;
 911         r->out.names->count = num_sids;
 912         r->out.names->names = names;
 913         *r->out.count = mapped_count;
 914
 915         return status;
 916 }
 917
 918 /***************************************************************************
 919  _lsa_LookupSids3
 920  ***************************************************************************/
 921
 922 NTSTATUS _lsa_LookupSids3(pipes_struct *p,
 923                           struct lsa_LookupSids3 *r)
 924 {
 925         struct lsa_LookupSids2 q;
 926
 927         /* No policy handle on this call. Restrict to crypto connections. */
 928         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
 929                 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
 930                         get_remote_machine_name() ));
 931                 return NT_STATUS_INVALID_PARAMETER;
 932         }
 933
 934         q.in.handle             = NULL;
 935         q.in.sids               = r->in.sids;
 936         q.in.level              = r->in.level;
 937         q.in.unknown1           = r->in.unknown1;
 938         q.in.unknown2           = r->in.unknown2;
 939         q.in.names              = r->in.names;
 940         q.in.count              = r->in.count;
 941
 942         q.out.domains           = r->out.domains;
 943         q.out.names             = r->out.names;
 944         q.out.count             = r->out.count;
 945
 946         return _lsa_LookupSids2(p, &q);
 947 }
 948
 949 /***************************************************************************
 950  ***************************************************************************/
 951
 952 static int lsa_lookup_level_to_flags(uint16 level)
 953 {
 954         int flags;
 955
 956         switch (level) {
 957                 case 1:
 958                         flags = LOOKUP_NAME_ALL;
 959                         break;
 960                 case 2:
 961                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_REMOTE|LOOKUP_NAME_ISOLATED;
 962                         break;
 963                 case 3:
 964                         flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED;
 965                         break;
 966                 case 4:
 967                 case 5:
 968                 case 6:
 969                 default:
 970                         flags = LOOKUP_NAME_NONE;
 971                         break;
 972         }
 973
 974         return flags;
 975 }
 976
 977 /***************************************************************************
 978  _lsa_LookupNames
 979  ***************************************************************************/
 980
 981 NTSTATUS _lsa_LookupNames(pipes_struct *p,
 982                           struct lsa_LookupNames *r)
 983 {
 984         NTSTATUS status = NT_STATUS_NONE_MAPPED;
 985         struct lsa_info *handle;
 986         struct lsa_String *names = r->in.names;
 987         uint32 num_entries = r->in.num_names;
 988         struct lsa_RefDomainList *domains = NULL;
 989         struct lsa_TranslatedSid *rids = NULL;
 990         uint32 mapped_count = 0;
 991         int flags = 0;
 992
 993         if (num_entries >  MAX_LOOKUP_SIDS) {
 994                 num_entries = MAX_LOOKUP_SIDS;
 995                 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
 996                         num_entries));
 997         }
 998
 999         flags = lsa_lookup_level_to_flags(r->in.level);
1000
1001         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1002         if (!domains) {
1003                 return NT_STATUS_NO_MEMORY;
1004         }
1005
1006         if (num_entries) {
1007                 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid,
1008                                          num_entries);
1009                 if (!rids) {
1010                         return NT_STATUS_NO_MEMORY;
1011                 }
1012         } else {
1013                 rids = NULL;
1014         }
1015
1016         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1017                 status = NT_STATUS_INVALID_HANDLE;
1018                 goto done;
1019         }
1020
1021         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1022                 return NT_STATUS_INVALID_HANDLE;
1023         }
1024
1025         /* check if the user has enough rights */
1026         if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1027                 status = NT_STATUS_ACCESS_DENIED;
1028                 goto done;
1029         }
1030
1031         /* set up the LSA Lookup RIDs response */
1032         become_root(); /* lookup_name can require root privs */
1033         status = lookup_lsa_rids(p->mem_ctx, domains, rids, num_entries,
1034                                  names, flags, &mapped_count);
1035         unbecome_root();
1036
1037 done:
1038
1039         if (NT_STATUS_IS_OK(status) && (num_entries != 0) ) {
1040                 if (mapped_count == 0) {
1041                         status = NT_STATUS_NONE_MAPPED;
1042                 } else if (mapped_count != num_entries) {
1043                         status = STATUS_SOME_UNMAPPED;
1044                 }
1045         }
1046
1047         *r->out.count = mapped_count;
1048         *r->out.domains = domains;
1049         r->out.sids->sids = rids;
1050         r->out.sids->count = num_entries;
1051
1052         return status;
1053 }
1054
1055 /***************************************************************************
1056  _lsa_LookupNames2
1057  ***************************************************************************/
1058
1059 NTSTATUS _lsa_LookupNames2(pipes_struct *p,
1060                            struct lsa_LookupNames2 *r)
1061 {
1062         NTSTATUS status;
1063         struct lsa_LookupNames q;
1064         struct lsa_TransSidArray2 *sid_array2 = r->in.sids;
1065         struct lsa_TransSidArray *sid_array = NULL;
1066         uint32_t i;
1067
1068         sid_array = TALLOC_ZERO_P(p->mem_ctx, struct lsa_TransSidArray);
1069         if (!sid_array) {
1070                 return NT_STATUS_NO_MEMORY;
1071         }
1072
1073         q.in.handle             = r->in.handle;
1074         q.in.num_names          = r->in.num_names;
1075         q.in.names              = r->in.names;
1076         q.in.level              = r->in.level;
1077         q.in.sids               = sid_array;
1078         q.in.count              = r->in.count;
1079         /* we do not know what this is for */
1080         /*                      = r->in.unknown1; */
1081         /*                      = r->in.unknown2; */
1082
1083         q.out.domains           = r->out.domains;
1084         q.out.sids              = sid_array;
1085         q.out.count             = r->out.count;
1086
1087         status = _lsa_LookupNames(p, &q);
1088
1089         sid_array2->count = sid_array->count;
1090         sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
1091         if (!sid_array2->sids) {
1092                 return NT_STATUS_NO_MEMORY;
1093         }
1094
1095         for (i=0; i<sid_array->count; i++) {
1096                 sid_array2->sids[i].sid_type  = sid_array->sids[i].sid_type;
1097                 sid_array2->sids[i].rid       = sid_array->sids[i].rid;
1098                 sid_array2->sids[i].sid_index = sid_array->sids[i].sid_index;
1099                 sid_array2->sids[i].unknown   = 0;
1100         }
1101
1102         r->out.sids = sid_array2;
1103
1104         return status;
1105 }
1106
1107 /***************************************************************************
1108  _lsa_LookupNames3
1109  ***************************************************************************/
1110
1111 NTSTATUS _lsa_LookupNames3(pipes_struct *p,
1112                            struct lsa_LookupNames3 *r)
1113 {
1114         NTSTATUS status;
1115         struct lsa_info *handle;
1116         struct lsa_String *names = r->in.names;
1117         uint32 num_entries = r->in.num_names;
1118         struct lsa_RefDomainList *domains = NULL;
1119         struct lsa_TranslatedSid3 *trans_sids = NULL;
1120         uint32 mapped_count = 0;
1121         int flags = 0;
1122         bool check_policy = true;
1123
1124         switch (p->hdr_req.opnum) {
1125                 case NDR_LSA_LOOKUPNAMES4:
1126                         check_policy = false;
1127                         break;
1128                 case NDR_LSA_LOOKUPNAMES3:
1129                 default:
1130                         check_policy = true;
1131         }
1132
1133         if (num_entries >  MAX_LOOKUP_SIDS) {
1134                 num_entries = MAX_LOOKUP_SIDS;
1135                 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries));
1136         }
1137
1138         /* Probably the lookup_level is some sort of bitmask. */
1139         if (r->in.level == 1) {
1140                 flags = LOOKUP_NAME_ALL;
1141         }
1142
1143         domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1144         if (!domains) {
1145                 return NT_STATUS_NO_MEMORY;
1146         }
1147
1148         if (num_entries) {
1149                 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid3,
1150                                                num_entries);
1151                 if (!trans_sids) {
1152                         return NT_STATUS_NO_MEMORY;
1153                 }
1154         } else {
1155                 trans_sids = NULL;
1156         }
1157
1158         if (check_policy) {
1159
1160                 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1161                         status = NT_STATUS_INVALID_HANDLE;
1162                         goto done;
1163                 }
1164
1165                 if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1166                         return NT_STATUS_INVALID_HANDLE;
1167                 }
1168
1169                 /* check if the user has enough rights */
1170                 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1171                         status = NT_STATUS_ACCESS_DENIED;
1172                         goto done;
1173                 }
1174         }
1175
1176         /* set up the LSA Lookup SIDs response */
1177         become_root(); /* lookup_name can require root privs */
1178         status = lookup_lsa_sids(p->mem_ctx, domains, trans_sids, num_entries,
1179                                  names, flags, &mapped_count);
1180         unbecome_root();
1181
1182 done:
1183
1184         if (NT_STATUS_IS_OK(status)) {
1185                 if (mapped_count == 0) {
1186                         status = NT_STATUS_NONE_MAPPED;
1187                 } else if (mapped_count != num_entries) {
1188                         status = STATUS_SOME_UNMAPPED;
1189                 }
1190         }
1191
1192         *r->out.count = mapped_count;
1193         *r->out.domains = domains;
1194         r->out.sids->sids = trans_sids;
1195         r->out.sids->count = num_entries;
1196
1197         return status;
1198 }
1199
1200 /***************************************************************************
1201  _lsa_LookupNames4
1202  ***************************************************************************/
1203
1204 NTSTATUS _lsa_LookupNames4(pipes_struct *p,
1205                            struct lsa_LookupNames4 *r)
1206 {
1207         struct lsa_LookupNames3 q;
1208
1209         /* No policy handle on this call. Restrict to crypto connections. */
1210         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1211                 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1212                         get_remote_machine_name() ));
1213                 return NT_STATUS_INVALID_PARAMETER;
1214         }
1215
1216         q.in.handle             = NULL;
1217         q.in.num_names          = r->in.num_names;
1218         q.in.names              = r->in.names;
1219         q.in.level              = r->in.level;
1220         q.in.lookup_options     = r->in.lookup_options;
1221         q.in.client_revision    = r->in.client_revision;
1222         q.in.sids               = r->in.sids;
1223         q.in.count              = r->in.count;
1224
1225         q.out.domains           = r->out.domains;
1226         q.out.sids              = r->out.sids;
1227         q.out.count             = r->out.count;
1228
1229         return _lsa_LookupNames3(p, &q);
1230 }
1231
1232 /***************************************************************************
1233  _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1234  ***************************************************************************/
1235
1236 NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
1237 {
1238         if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
1239                 return NT_STATUS_INVALID_HANDLE;
1240         }
1241
1242         close_policy_hnd(p, r->in.handle);
1243         ZERO_STRUCTP(r->out.handle);
1244         return NT_STATUS_OK;
1245 }
1246
1247 /***************************************************************************
1248  ***************************************************************************/
1249
1250 NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
1251 {
1252         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1253 }
1254
1255 /***************************************************************************
1256  ***************************************************************************/
1257
1258 NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
1259 {
1260         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1261 }
1262
1263 /***************************************************************************
1264  ***************************************************************************/
1265
1266 NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
1267 {
1268         return NT_STATUS_ACCESS_DENIED;
1269 }
1270
1271 /***************************************************************************
1272  ***************************************************************************/
1273
1274 NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
1275 {
1276         return NT_STATUS_ACCESS_DENIED;
1277 }
1278
1279 /***************************************************************************
1280  ***************************************************************************/
1281
1282 NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
1283 {
1284         return NT_STATUS_ACCESS_DENIED;
1285 }
1286
1287 /***************************************************************************
1288  _lsa_DeleteObject
1289  ***************************************************************************/
1290
1291 NTSTATUS _lsa_DeleteObject(pipes_struct *p,
1292                            struct lsa_DeleteObject *r)
1293 {
1294         NTSTATUS status;
1295         struct lsa_info *info = NULL;
1296
1297         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info)) {
1298                 return NT_STATUS_INVALID_HANDLE;
1299         }
1300
1301         if (!(info->access & STD_RIGHT_DELETE_ACCESS)) {
1302                 return NT_STATUS_ACCESS_DENIED;
1303         }
1304
1305         status = privilege_delete_account(&info->sid);
1306         if (!NT_STATUS_IS_OK(status)) {
1307                 DEBUG(10,("_lsa_DeleteObject: privilege_delete_account gave: %s\n",
1308                         nt_errstr(status)));
1309         }
1310
1311         return status;
1312 }
1313
1314 /***************************************************************************
1315  _lsa_EnumPrivs
1316  ***************************************************************************/
1317
1318 NTSTATUS _lsa_EnumPrivs(pipes_struct *p,
1319                         struct lsa_EnumPrivs *r)
1320 {
1321         struct lsa_info *handle;
1322         uint32 i;
1323         uint32 enum_context = *r->in.resume_handle;
1324         int num_privs = count_all_privileges();
1325         struct lsa_PrivEntry *entries = NULL;
1326         LUID_ATTR luid;
1327
1328         /* remember that the enum_context starts at 0 and not 1 */
1329
1330         if ( enum_context >= num_privs )
1331                 return NT_STATUS_NO_MORE_ENTRIES;
1332
1333         DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1334                 enum_context, num_privs));
1335
1336         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1337                 return NT_STATUS_INVALID_HANDLE;
1338
1339         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1340                 return NT_STATUS_INVALID_HANDLE;
1341         }
1342
1343         /* check if the user has enough rights
1344            I don't know if it's the right one. not documented.  */
1345
1346         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1347                 return NT_STATUS_ACCESS_DENIED;
1348
1349         if (num_privs) {
1350                 entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_PrivEntry, num_privs);
1351                 if (!entries) {
1352                         return NT_STATUS_NO_MEMORY;
1353                 }
1354         } else {
1355                 entries = NULL;
1356         }
1357
1358         for (i = 0; i < num_privs; i++) {
1359                 if( i < enum_context) {
1360
1361                         init_lsa_StringLarge(&entries[i].name, NULL);
1362
1363                         entries[i].luid.low = 0;
1364                         entries[i].luid.high = 0;
1365                 } else {
1366
1367                         init_lsa_StringLarge(&entries[i].name, privs[i].name);
1368
1369                         luid = get_privilege_luid( &privs[i].se_priv );
1370
1371                         entries[i].luid.low = luid.luid.low;
1372                         entries[i].luid.high = luid.luid.high;
1373                 }
1374         }
1375
1376         enum_context = num_privs;
1377
1378         *r->out.resume_handle = enum_context;
1379         r->out.privs->count = num_privs;
1380         r->out.privs->privs = entries;
1381
1382         return NT_STATUS_OK;
1383 }
1384
1385 /***************************************************************************
1386  _lsa_LookupPrivDisplayName
1387  ***************************************************************************/
1388
1389 NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p,
1390                                     struct lsa_LookupPrivDisplayName *r)
1391 {
1392         struct lsa_info *handle;
1393         const char *description;
1394         struct lsa_StringLarge *lsa_name;
1395
1396         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1397                 return NT_STATUS_INVALID_HANDLE;
1398
1399         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1400                 return NT_STATUS_INVALID_HANDLE;
1401         }
1402
1403         /* check if the user has enough rights */
1404
1405         /*
1406          * I don't know if it's the right one. not documented.
1407          */
1408         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1409                 return NT_STATUS_ACCESS_DENIED;
1410
1411         DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r->in.name->string));
1412
1413         description = get_privilege_dispname(r->in.name->string);
1414         if (!description) {
1415                 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1416                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1417         }
1418
1419         DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description));
1420
1421         lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
1422         if (!lsa_name) {
1423                 return NT_STATUS_NO_MEMORY;
1424         }
1425
1426         init_lsa_StringLarge(lsa_name, description);
1427
1428         *r->out.returned_language_id = r->in.language_id;
1429         *r->out.disp_name = lsa_name;
1430
1431         return NT_STATUS_OK;
1432 }
1433
1434 /***************************************************************************
1435  _lsa_EnumAccounts
1436  ***************************************************************************/
1437
1438 NTSTATUS _lsa_EnumAccounts(pipes_struct *p,
1439                            struct lsa_EnumAccounts *r)
1440 {
1441         struct lsa_info *handle;
1442         DOM_SID *sid_list;
1443         int i, j, num_entries;
1444         NTSTATUS status;
1445         struct lsa_SidPtr *sids = NULL;
1446
1447         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1448                 return NT_STATUS_INVALID_HANDLE;
1449
1450         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1451                 return NT_STATUS_INVALID_HANDLE;
1452         }
1453
1454         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1455                 return NT_STATUS_ACCESS_DENIED;
1456
1457         sid_list = NULL;
1458         num_entries = 0;
1459
1460         /* The only way we can currently find out all the SIDs that have been
1461            privileged is to scan all privileges */
1462
1463         status = privilege_enumerate_accounts(&sid_list, &num_entries);
1464         if (!NT_STATUS_IS_OK(status)) {
1465                 return status;
1466         }
1467
1468         if (*r->in.resume_handle >= num_entries) {
1469                 return NT_STATUS_NO_MORE_ENTRIES;
1470         }
1471
1472         if (num_entries - *r->in.resume_handle) {
1473                 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr,
1474                                          num_entries - *r->in.resume_handle);
1475                 if (!sids) {
1476                         talloc_free(sid_list);
1477                         return NT_STATUS_NO_MEMORY;
1478                 }
1479
1480                 for (i = *r->in.resume_handle, j = 0; i < num_entries; i++, j++) {
1481                         sids[j].sid = sid_dup_talloc(p->mem_ctx, &sid_list[i]);
1482                         if (!sids[j].sid) {
1483                                 talloc_free(sid_list);
1484                                 return NT_STATUS_NO_MEMORY;
1485                         }
1486                 }
1487         }
1488
1489         talloc_free(sid_list);
1490
1491         *r->out.resume_handle = num_entries;
1492         r->out.sids->num_sids = num_entries;
1493         r->out.sids->sids = sids;
1494
1495         return NT_STATUS_OK;
1496 }
1497
1498 /***************************************************************************
1499  _lsa_GetUserName
1500  ***************************************************************************/
1501
1502 NTSTATUS _lsa_GetUserName(pipes_struct *p,
1503                           struct lsa_GetUserName *r)
1504 {
1505         const char *username, *domname;
1506         struct lsa_String *account_name = NULL;
1507         struct lsa_String *authority_name = NULL;
1508
1509         if (r->in.account_name &&
1510            *r->in.account_name) {
1511                 return NT_STATUS_INVALID_PARAMETER;
1512         }
1513
1514         if (r->in.authority_name &&
1515            *r->in.authority_name) {
1516                 return NT_STATUS_INVALID_PARAMETER;
1517         }
1518
1519         if (p->server_info->guest) {
1520                 /*
1521                  * I'm 99% sure this is not the right place to do this,
1522                  * global_sid_Anonymous should probably be put into the token
1523                  * instead of the guest id -- vl
1524                  */
1525                 if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
1526                                 &domname, &username, NULL)) {
1527                         return NT_STATUS_NO_MEMORY;
1528                 }
1529         } else {
1530                 username = p->server_info->sanitized_username;
1531                 domname = pdb_get_domain(p->server_info->sam_account);
1532         }
1533
1534         account_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1535         if (!account_name) {
1536                 return NT_STATUS_NO_MEMORY;
1537         }
1538         init_lsa_String(account_name, username);
1539
1540         if (r->out.authority_name) {
1541                 authority_name = TALLOC_P(p->mem_ctx, struct lsa_String);
1542                 if (!authority_name) {
1543                         return NT_STATUS_NO_MEMORY;
1544                 }
1545                 init_lsa_String(authority_name, domname);
1546         }
1547
1548         *r->out.account_name = account_name;
1549         if (r->out.authority_name) {
1550                 *r->out.authority_name = authority_name;
1551         }
1552
1553         return NT_STATUS_OK;
1554 }
1555
1556 /***************************************************************************
1557  _lsa_CreateAccount
1558  ***************************************************************************/
1559
1560 NTSTATUS _lsa_CreateAccount(pipes_struct *p,
1561                             struct lsa_CreateAccount *r)
1562 {
1563         struct lsa_info *handle;
1564         struct lsa_info *info;
1565
1566         /* find the connection policy handle. */
1567         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1568                 return NT_STATUS_INVALID_HANDLE;
1569
1570         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1571                 return NT_STATUS_INVALID_HANDLE;
1572         }
1573
1574         /* check if the user has enough rights */
1575
1576         /*
1577          * I don't know if it's the right one. not documented.
1578          * but guessed with rpcclient.
1579          */
1580         if (!(handle->access & LSA_POLICY_CREATE_ACCOUNT))
1581                 return NT_STATUS_ACCESS_DENIED;
1582
1583         if ( is_privileged_sid( r->in.sid ) )
1584                 return NT_STATUS_OBJECT_NAME_COLLISION;
1585
1586         /* associate the user/group SID with the (unique) handle. */
1587
1588         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1589         if (info == NULL) {
1590                 return NT_STATUS_NO_MEMORY;
1591         }
1592
1593         info->sid = *r->in.sid;
1594         info->access = r->in.access_mask;
1595         info->type = LSA_HANDLE_ACCOUNT_TYPE;
1596
1597         /* get a (unique) handle.  open a policy on it. */
1598         if (!create_policy_hnd(p, r->out.acct_handle, info))
1599                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1600
1601         return privilege_create_account( &info->sid );
1602 }
1603
1604 /***************************************************************************
1605  _lsa_OpenAccount
1606  ***************************************************************************/
1607
1608 NTSTATUS _lsa_OpenAccount(pipes_struct *p,
1609                           struct lsa_OpenAccount *r)
1610 {
1611         struct lsa_info *handle;
1612         struct lsa_info *info;
1613         SEC_DESC *psd = NULL;
1614         size_t sd_size;
1615         uint32_t des_access = r->in.access_mask;
1616         uint32_t acc_granted;
1617         NTSTATUS status;
1618
1619         /* find the connection policy handle. */
1620         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1621                 return NT_STATUS_INVALID_HANDLE;
1622
1623         if (handle->type != LSA_HANDLE_POLICY_TYPE) {
1624                 return NT_STATUS_INVALID_HANDLE;
1625         }
1626
1627         /* des_access is for the account here, not the policy
1628          * handle - so don't check against policy handle. */
1629
1630         /* Work out max allowed. */
1631         map_max_allowed_access(p->server_info->ptok, &des_access);
1632
1633         /* map the generic bits to the lsa account ones */
1634         se_map_generic(&des_access, &lsa_account_mapping);
1635
1636         /* get the generic lsa account SD until we store it */
1637         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
1638                                 &lsa_account_mapping,
1639                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
1640         if (!NT_STATUS_IS_OK(status)) {
1641                 return status;
1642         }
1643
1644         status = access_check_object(psd, p->server_info->ptok,
1645                 NULL, 0, des_access,
1646                 &acc_granted, "_lsa_OpenAccount" );
1647
1648         if (!NT_STATUS_IS_OK(status)) {
1649                 return status;
1650         }
1651
1652         /* TODO: Fis the parsing routine before reenabling this check! */
1653         #if 0
1654         if (!lookup_sid(&handle->sid, dom_name, name, &type))
1655                 return NT_STATUS_ACCESS_DENIED;
1656         #endif
1657         /* associate the user/group SID with the (unique) handle. */
1658         info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
1659         if (info == NULL) {
1660                 return NT_STATUS_NO_MEMORY;
1661         }
1662
1663         info->sid = *r->in.sid;
1664         info->access = acc_granted;
1665         info->type = LSA_HANDLE_ACCOUNT_TYPE;
1666
1667         /* get a (unique) handle.  open a policy on it. */
1668         if (!create_policy_hnd(p, r->out.acct_handle, info))
1669                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1670
1671         return NT_STATUS_OK;
1672 }
1673
1674 /***************************************************************************
1675  _lsa_EnumPrivsAccount
1676  For a given SID, enumerate all the privilege this account has.
1677  ***************************************************************************/
1678
1679 NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
1680                                struct lsa_EnumPrivsAccount *r)
1681 {
1682         NTSTATUS status = NT_STATUS_OK;
1683         struct lsa_info *info=NULL;
1684         SE_PRIV mask;
1685         PRIVILEGE_SET privileges;
1686         struct lsa_PrivilegeSet *priv_set = NULL;
1687         struct lsa_LUIDAttribute *luid_attrs = NULL;
1688         int i;
1689
1690         /* find the connection policy handle. */
1691         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1692                 return NT_STATUS_INVALID_HANDLE;
1693
1694         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1695                 return NT_STATUS_INVALID_HANDLE;
1696         }
1697
1698         if (!(info->access & LSA_ACCOUNT_VIEW))
1699                 return NT_STATUS_ACCESS_DENIED;
1700
1701         get_privileges_for_sids(&mask, &info->sid, 1);
1702
1703         privilege_set_init( &privileges );
1704
1705         priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
1706         if (!priv_set) {
1707                 status = NT_STATUS_NO_MEMORY;
1708                 goto done;
1709         }
1710
1711         if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1712
1713                 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1714                           sid_string_dbg(&info->sid),
1715                           privileges.count));
1716
1717                 luid_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx,
1718                                                struct lsa_LUIDAttribute,
1719                                                privileges.count);
1720                 if (!luid_attrs) {
1721                         status = NT_STATUS_NO_MEMORY;
1722                         goto done;
1723                 }
1724
1725                 for (i=0; i<privileges.count; i++) {
1726                         luid_attrs[i].luid.low = privileges.set[i].luid.low;
1727                         luid_attrs[i].luid.high = privileges.set[i].luid.high;
1728                         luid_attrs[i].attribute = privileges.set[i].attr;
1729                 }
1730
1731                 priv_set->count = privileges.count;
1732                 priv_set->unknown = 0;
1733                 priv_set->set = luid_attrs;
1734
1735         } else {
1736                 priv_set->count = 0;
1737                 priv_set->unknown = 0;
1738                 priv_set->set = NULL;
1739         }
1740
1741         *r->out.privs = priv_set;
1742
1743  done:
1744         privilege_set_free( &privileges );
1745
1746         return status;
1747 }
1748
1749 /***************************************************************************
1750  _lsa_GetSystemAccessAccount
1751  ***************************************************************************/
1752
1753 NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p,
1754                                      struct lsa_GetSystemAccessAccount *r)
1755 {
1756         NTSTATUS status;
1757         struct lsa_info *info = NULL;
1758         struct lsa_EnumPrivsAccount e;
1759         struct lsa_PrivilegeSet *privset;
1760
1761         /* find the connection policy handle. */
1762
1763         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1764                 return NT_STATUS_INVALID_HANDLE;
1765
1766         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1767                 return NT_STATUS_INVALID_HANDLE;
1768         }
1769
1770         if (!(info->access & LSA_ACCOUNT_VIEW))
1771                 return NT_STATUS_ACCESS_DENIED;
1772
1773         privset = talloc_zero(p->mem_ctx, struct lsa_PrivilegeSet);
1774         if (!privset) {
1775                 return NT_STATUS_NO_MEMORY;
1776         }
1777
1778         e.in.handle = r->in.handle;
1779         e.out.privs = &privset;
1780
1781         status = _lsa_EnumPrivsAccount(p, &e);
1782         if (!NT_STATUS_IS_OK(status)) {
1783                 DEBUG(10,("_lsa_GetSystemAccessAccount: "
1784                         "failed to call _lsa_EnumPrivsAccount(): %s\n",
1785                         nt_errstr(status)));
1786                 return status;
1787         }
1788
1789         /* Samba4 would iterate over the privset to merge the policy mode bits,
1790          * not sure samba3 can do the same here, so just return what we did in
1791          * the past - gd */
1792
1793         /*
1794           0x01 -> Log on locally
1795           0x02 -> Access this computer from network
1796           0x04 -> Log on as a batch job
1797           0x10 -> Log on as a service
1798
1799           they can be ORed together
1800         */
1801
1802         *r->out.access_mask = LSA_POLICY_MODE_INTERACTIVE |
1803                               LSA_POLICY_MODE_NETWORK;
1804
1805         return NT_STATUS_OK;
1806 }
1807
1808 /***************************************************************************
1809   update the systemaccount information
1810  ***************************************************************************/
1811
1812 NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p,
1813                                      struct lsa_SetSystemAccessAccount *r)
1814 {
1815         struct lsa_info *info=NULL;
1816         GROUP_MAP map;
1817
1818         /* find the connection policy handle. */
1819         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1820                 return NT_STATUS_INVALID_HANDLE;
1821
1822         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1823                 return NT_STATUS_INVALID_HANDLE;
1824         }
1825
1826         if (!(info->access & LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS)) {
1827                 return NT_STATUS_ACCESS_DENIED;
1828         }
1829
1830         if (!pdb_getgrsid(&map, info->sid))
1831                 return NT_STATUS_NO_SUCH_GROUP;
1832
1833         return pdb_update_group_mapping_entry(&map);
1834 }
1835
1836 /***************************************************************************
1837  _lsa_AddPrivilegesToAccount
1838  For a given SID, add some privileges.
1839  ***************************************************************************/
1840
1841 NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p,
1842                                      struct lsa_AddPrivilegesToAccount *r)
1843 {
1844         struct lsa_info *info = NULL;
1845         SE_PRIV mask;
1846         struct lsa_PrivilegeSet *set = NULL;
1847
1848         /* find the connection policy handle. */
1849         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1850                 return NT_STATUS_INVALID_HANDLE;
1851
1852         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1853                 return NT_STATUS_INVALID_HANDLE;
1854         }
1855
1856         if (!(info->access & LSA_ACCOUNT_ADJUST_PRIVILEGES)) {
1857                 return NT_STATUS_ACCESS_DENIED;
1858         }
1859
1860         set = r->in.privs;
1861         if ( !privilege_set_to_se_priv( &mask, set ) )
1862                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1863
1864         if ( !grant_privilege( &info->sid, &mask ) ) {
1865                 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1866                          sid_string_dbg(&info->sid) ));
1867                 DEBUG(3,("Privilege mask:\n"));
1868                 dump_se_priv( DBGC_ALL, 3, &mask );
1869                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1870         }
1871
1872         return NT_STATUS_OK;
1873 }
1874
1875 /***************************************************************************
1876  _lsa_RemovePrivilegesFromAccount
1877  For a given SID, remove some privileges.
1878  ***************************************************************************/
1879
1880 NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p,
1881                                           struct lsa_RemovePrivilegesFromAccount *r)
1882 {
1883         struct lsa_info *info = NULL;
1884         SE_PRIV mask;
1885         struct lsa_PrivilegeSet *set = NULL;
1886
1887         /* find the connection policy handle. */
1888         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1889                 return NT_STATUS_INVALID_HANDLE;
1890
1891         if (info->type != LSA_HANDLE_ACCOUNT_TYPE) {
1892                 return NT_STATUS_INVALID_HANDLE;
1893         }
1894
1895         if (!(info->access & LSA_ACCOUNT_ADJUST_PRIVILEGES)) {
1896                 return NT_STATUS_ACCESS_DENIED;
1897         }
1898
1899         set = r->in.privs;
1900
1901         if ( !privilege_set_to_se_priv( &mask, set ) )
1902                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1903
1904         if ( !revoke_privilege( &info->sid, &mask ) ) {
1905                 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1906                          sid_string_dbg(&info->sid) ));
1907                 DEBUG(3,("Privilege mask:\n"));
1908                 dump_se_priv( DBGC_ALL, 3, &mask );
1909                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1910         }
1911
1912         return NT_STATUS_OK;
1913 }
1914
1915 /***************************************************************************
1916  _lsa_QuerySecurity
1917  ***************************************************************************/
1918
1919 NTSTATUS _lsa_QuerySecurity(pipes_struct *p,
1920                             struct lsa_QuerySecurity *r)
1921 {
1922         struct lsa_info *handle=NULL;
1923         SEC_DESC *psd = NULL;
1924         size_t sd_size;
1925         NTSTATUS status;
1926
1927         /* find the connection policy handle. */
1928         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1929                 return NT_STATUS_INVALID_HANDLE;
1930
1931         if (handle->type == LSA_HANDLE_POLICY_TYPE) {
1932                 status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
1933                                 &lsa_policy_mapping, NULL, 0);
1934         } else if (handle->type == LSA_HANDLE_ACCOUNT_TYPE) {
1935                 status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
1936                                 &lsa_account_mapping,
1937                                 &handle->sid, LSA_ACCOUNT_ALL_ACCESS);
1938         } else {
1939                 status = NT_STATUS_INVALID_HANDLE;
1940         }
1941
1942         if (!NT_STATUS_IS_OK(status)) {
1943                 return status;
1944         }
1945
1946         switch (r->in.sec_info) {
1947         case 1:
1948                 /* SD contains only the owner */
1949                 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1950                         return NT_STATUS_NO_MEMORY;
1951                 break;
1952         case 4:
1953                 /* SD contains only the ACL */
1954                 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1955                         return NT_STATUS_NO_MEMORY;
1956                 break;
1957         default:
1958                 return NT_STATUS_INVALID_LEVEL;
1959         }
1960
1961         return status;
1962 }
1963
1964 /***************************************************************************
1965  _lsa_AddAccountRights
1966  ***************************************************************************/
1967
1968 NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
1969                                struct lsa_AddAccountRights *r)
1970 {
1971         struct lsa_info *info = NULL;
1972         int i = 0;
1973         uint32_t acc_granted = 0;
1974         SEC_DESC *psd = NULL;
1975         size_t sd_size;
1976         DOM_SID sid;
1977         NTSTATUS status;
1978
1979         /* find the connection policy handle. */
1980         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1981                 return NT_STATUS_INVALID_HANDLE;
1982
1983         if (info->type != LSA_HANDLE_POLICY_TYPE) {
1984                 return NT_STATUS_INVALID_HANDLE;
1985         }
1986
1987         /* get the generic lsa account SD for this SID until we store it */
1988         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
1989                                 &lsa_account_mapping,
1990                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
1991         if (!NT_STATUS_IS_OK(status)) {
1992                 return status;
1993         }
1994
1995         /*
1996          * From the MS DOCs. If the sid doesn't exist, ask for LSA_POLICY_CREATE_ACCOUNT
1997          * on the policy handle. If it does, ask for
1998          * LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
1999          * on the account sid. We don't check here so just use the latter. JRA.
2000          */
2001
2002         status = access_check_object(psd, p->server_info->ptok,
2003                 NULL, 0, LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW,
2004                 &acc_granted, "_lsa_AddAccountRights" );
2005
2006         if (!NT_STATUS_IS_OK(status)) {
2007                 return status;
2008         }
2009
2010         /* according to an NT4 PDC, you can add privileges to SIDs even without
2011            call_lsa_create_account() first.  And you can use any arbitrary SID. */
2012
2013         sid_copy( &sid, r->in.sid );
2014
2015         for ( i=0; i < r->in.rights->count; i++ ) {
2016
2017                 const char *privname = r->in.rights->names[i].string;
2018
2019                 /* only try to add non-null strings */
2020
2021                 if ( !privname )
2022                         continue;
2023
2024                 if ( !grant_privilege_by_name( &sid, privname ) ) {
2025                         DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
2026                                 privname ));
2027                         return NT_STATUS_NO_SUCH_PRIVILEGE;
2028                 }
2029         }
2030
2031         return NT_STATUS_OK;
2032 }
2033
2034 /***************************************************************************
2035  _lsa_RemoveAccountRights
2036  ***************************************************************************/
2037
2038 NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
2039                                   struct lsa_RemoveAccountRights *r)
2040 {
2041         struct lsa_info *info = NULL;
2042         int i = 0;
2043         SEC_DESC *psd = NULL;
2044         size_t sd_size;
2045         DOM_SID sid;
2046         const char *privname = NULL;
2047         uint32_t acc_granted = 0;
2048         NTSTATUS status;
2049
2050         /* find the connection policy handle. */
2051         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2052                 return NT_STATUS_INVALID_HANDLE;
2053
2054         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2055                 return NT_STATUS_INVALID_HANDLE;
2056         }
2057
2058         /* get the generic lsa account SD for this SID until we store it */
2059         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
2060                                 &lsa_account_mapping,
2061                                 r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
2062         if (!NT_STATUS_IS_OK(status)) {
2063                 return status;
2064         }
2065
2066         /*
2067          * From the MS DOCs. We need
2068          * LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|LSA_ACCOUNT_VIEW
2069          * and DELETE on the account sid.
2070          */
2071
2072         status = access_check_object(psd, p->server_info->ptok,
2073                 NULL, 0, LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
2074                         LSA_ACCOUNT_VIEW|STD_RIGHT_DELETE_ACCESS,
2075                 &acc_granted, "_lsa_AddAccountRights" );
2076
2077         if (!NT_STATUS_IS_OK(status)) {
2078                 return status;
2079         }
2080
2081         sid_copy( &sid, r->in.sid );
2082
2083         if ( r->in.remove_all ) {
2084                 if ( !revoke_all_privileges( &sid ) )
2085                         return NT_STATUS_ACCESS_DENIED;
2086
2087                 return NT_STATUS_OK;
2088         }
2089
2090         for ( i=0; i < r->in.rights->count; i++ ) {
2091
2092                 privname = r->in.rights->names[i].string;
2093
2094                 /* only try to add non-null strings */
2095
2096                 if ( !privname )
2097                         continue;
2098
2099                 if ( !revoke_privilege_by_name( &sid, privname ) ) {
2100                         DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2101                                 privname ));
2102                         return NT_STATUS_NO_SUCH_PRIVILEGE;
2103                 }
2104         }
2105
2106         return NT_STATUS_OK;
2107 }
2108
2109 /*******************************************************************
2110 ********************************************************************/
2111
2112 static NTSTATUS init_lsa_right_set(TALLOC_CTX *mem_ctx,
2113                                    struct lsa_RightSet *r,
2114                                    PRIVILEGE_SET *privileges)
2115 {
2116         uint32 i;
2117         const char *privname;
2118         const char **privname_array = NULL;
2119         int num_priv = 0;
2120
2121         for (i=0; i<privileges->count; i++) {
2122
2123                 privname = luid_to_privilege_name(&privileges->set[i].luid);
2124                 if (privname) {
2125                         if (!add_string_to_array(mem_ctx, privname,
2126                                                  &privname_array, &num_priv)) {
2127                                 return NT_STATUS_NO_MEMORY;
2128                         }
2129                 }
2130         }
2131
2132         if (num_priv) {
2133
2134                 r->names = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_StringLarge,
2135                                              num_priv);
2136                 if (!r->names) {
2137                         return NT_STATUS_NO_MEMORY;
2138                 }
2139
2140                 for (i=0; i<num_priv; i++) {
2141                         init_lsa_StringLarge(&r->names[i], privname_array[i]);
2142                 }
2143
2144                 r->count = num_priv;
2145         }
2146
2147         return NT_STATUS_OK;
2148 }
2149
2150 /***************************************************************************
2151  _lsa_EnumAccountRights
2152  ***************************************************************************/
2153
2154 NTSTATUS _lsa_EnumAccountRights(pipes_struct *p,
2155                                 struct lsa_EnumAccountRights *r)
2156 {
2157         NTSTATUS status;
2158         struct lsa_info *info = NULL;
2159         DOM_SID sid;
2160         PRIVILEGE_SET privileges;
2161         SE_PRIV mask;
2162
2163         /* find the connection policy handle. */
2164
2165         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2166                 return NT_STATUS_INVALID_HANDLE;
2167
2168         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2169                 return NT_STATUS_INVALID_HANDLE;
2170         }
2171
2172         if (!(info->access & LSA_ACCOUNT_VIEW)) {
2173                 return NT_STATUS_ACCESS_DENIED;
2174         }
2175
2176         /* according to an NT4 PDC, you can add privileges to SIDs even without
2177            call_lsa_create_account() first.  And you can use any arbitrary SID. */
2178
2179         sid_copy( &sid, r->in.sid );
2180
2181         /* according to MS-LSAD 3.1.4.5.10 it is required to return
2182          * NT_STATUS_OBJECT_NAME_NOT_FOUND if the account sid was not found in
2183          * the lsa database */
2184
2185         if (!get_privileges_for_sids(&mask, &sid, 1)) {
2186                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2187         }
2188
2189         status = privilege_set_init(&privileges);
2190         if (!NT_STATUS_IS_OK(status)) {
2191                 return status;
2192         }
2193
2194         se_priv_to_privilege_set(&privileges, &mask);
2195
2196         DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2197                   sid_string_dbg(&sid), privileges.count));
2198
2199         status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
2200
2201         privilege_set_free( &privileges );
2202
2203         return status;
2204 }
2205
2206 /***************************************************************************
2207  _lsa_LookupPrivValue
2208  ***************************************************************************/
2209
2210 NTSTATUS _lsa_LookupPrivValue(pipes_struct *p,
2211                               struct lsa_LookupPrivValue *r)
2212 {
2213         struct lsa_info *info = NULL;
2214         const char *name = NULL;
2215         LUID_ATTR priv_luid;
2216         SE_PRIV mask;
2217
2218         /* find the connection policy handle. */
2219
2220         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2221                 return NT_STATUS_INVALID_HANDLE;
2222
2223         if (info->type != LSA_HANDLE_POLICY_TYPE) {
2224                 return NT_STATUS_INVALID_HANDLE;
2225         }
2226
2227         if (!(info->access & LSA_POLICY_LOOKUP_NAMES))
2228                 return NT_STATUS_ACCESS_DENIED;
2229
2230         name = r->in.name->string;
2231
2232         DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
2233
2234         if ( !se_priv_from_name( name, &mask ) )
2235                 return NT_STATUS_NO_SUCH_PRIVILEGE;
2236
2237         priv_luid = get_privilege_luid( &mask );
2238
2239         r->out.luid->low = priv_luid.luid.low;
2240         r->out.luid->high = priv_luid.luid.high;
2241
2242         return NT_STATUS_OK;
2243 }
2244
2245 /*
2246  * From here on the server routines are just dummy ones to make smbd link with
2247  * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2248  * pulling the server stubs across one by one.
2249  */
2250
2251 NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
2252 {
2253         p->rng_fault_state = True;
2254         return NT_STATUS_NOT_IMPLEMENTED;
2255 }
2256
2257 NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
2258 {
2259         p->rng_fault_state = True;
2260         return NT_STATUS_NOT_IMPLEMENTED;
2261 }
2262
2263 NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
2264 {
2265         p->rng_fault_state = True;
2266         return NT_STATUS_NOT_IMPLEMENTED;
2267 }
2268
2269 NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
2270 {
2271         p->rng_fault_state = True;
2272         return NT_STATUS_NOT_IMPLEMENTED;
2273 }
2274
2275 NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
2276 {
2277         p->rng_fault_state = True;
2278         return NT_STATUS_NOT_IMPLEMENTED;
2279 }
2280
2281 NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
2282 {
2283         p->rng_fault_state = True;
2284         return NT_STATUS_NOT_IMPLEMENTED;
2285 }
2286
2287 NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
2288 {
2289         p->rng_fault_state = True;
2290         return NT_STATUS_NOT_IMPLEMENTED;
2291 }
2292
2293 NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
2294 {
2295         p->rng_fault_state = True;
2296         return NT_STATUS_NOT_IMPLEMENTED;
2297 }
2298
2299 NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
2300 {
2301         p->rng_fault_state = True;
2302         return NT_STATUS_NOT_IMPLEMENTED;
2303 }
2304
2305 NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
2306 {
2307         p->rng_fault_state = True;
2308         return NT_STATUS_NOT_IMPLEMENTED;
2309 }
2310
2311 NTSTATUS _lsa_LookupPrivName(pipes_struct *p, struct lsa_LookupPrivName *r)
2312 {
2313         p->rng_fault_state = True;
2314         return NT_STATUS_NOT_IMPLEMENTED;
2315 }
2316
2317 NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p, struct lsa_EnumAccountsWithUserRight *r)
2318 {
2319         p->rng_fault_state = True;
2320         return NT_STATUS_NOT_IMPLEMENTED;
2321 }
2322
2323 NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
2324 {
2325         p->rng_fault_state = True;
2326         return NT_STATUS_NOT_IMPLEMENTED;
2327 }
2328
2329 NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
2330 {
2331         p->rng_fault_state = True;
2332         return NT_STATUS_NOT_IMPLEMENTED;
2333 }
2334
2335 NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
2336 {
2337         p->rng_fault_state = True;
2338         return NT_STATUS_NOT_IMPLEMENTED;
2339 }
2340
2341 NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
2342 {
2343         p->rng_fault_state = True;
2344         return NT_STATUS_NOT_IMPLEMENTED;
2345 }
2346
2347 NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
2348 {
2349         p->rng_fault_state = True;
2350         return NT_STATUS_NOT_IMPLEMENTED;
2351 }
2352
2353 NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p,
2354                                struct lsa_QueryInfoPolicy2 *r2)
2355 {
2356         struct lsa_QueryInfoPolicy r;
2357
2358         if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
2359                 p->rng_fault_state = True;
2360                 return NT_STATUS_NOT_IMPLEMENTED;
2361         }
2362
2363         ZERO_STRUCT(r);
2364         r.in.handle = r2->in.handle;
2365         r.in.level = r2->in.level;
2366         r.out.info = r2->out.info;
2367
2368         return _lsa_QueryInfoPolicy(p, &r);
2369 }
2370
2371 NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
2372 {
2373         p->rng_fault_state = True;
2374         return NT_STATUS_NOT_IMPLEMENTED;
2375 }
2376
2377 NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
2378 {
2379         p->rng_fault_state = True;
2380         return NT_STATUS_NOT_IMPLEMENTED;
2381 }
2382
2383 NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
2384 {
2385         p->rng_fault_state = True;
2386         return NT_STATUS_NOT_IMPLEMENTED;
2387 }
2388
2389 NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
2390 {
2391         p->rng_fault_state = True;
2392         return NT_STATUS_NOT_IMPLEMENTED;
2393 }
2394
2395 NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
2396 {
2397         p->rng_fault_state = True;
2398         return NT_STATUS_NOT_IMPLEMENTED;
2399 }
2400
2401 NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
2402 {
2403         p->rng_fault_state = True;
2404         return NT_STATUS_NOT_IMPLEMENTED;
2405 }
2406
2407 NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
2408 {
2409         p->rng_fault_state = True;
2410         return NT_STATUS_NOT_IMPLEMENTED;
2411 }
2412
2413 NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
2414 {
2415         p->rng_fault_state = True;
2416         return NT_STATUS_NOT_IMPLEMENTED;
2417 }
2418
2419 NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
2420 {
2421         p->rng_fault_state = True;
2422         return NT_STATUS_NOT_IMPLEMENTED;
2423 }
2424
2425 NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
2426 {
2427         p->rng_fault_state = True;
2428         return NT_STATUS_NOT_IMPLEMENTED;
2429 }
2430
2431 NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
2432 {
2433         p->rng_fault_state = True;
2434         return NT_STATUS_NOT_IMPLEMENTED;
2435 }
2436
2437 NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
2438 {
2439         p->rng_fault_state = True;
2440         return NT_STATUS_NOT_IMPLEMENTED;
2441 }
2442
2443 NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
2444 {
2445         p->rng_fault_state = True;
2446         return NT_STATUS_NOT_IMPLEMENTED;
2447 }
2448
2449 NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
2450 {
2451         p->rng_fault_state = True;
2452         return NT_STATUS_NOT_IMPLEMENTED;
2453 }
2454
2455 NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
2456 {
2457         p->rng_fault_state = True;
2458         return NT_STATUS_NOT_IMPLEMENTED;
2459 }
2460
2461 NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
2462 {
2463         p->rng_fault_state = True;
2464         return NT_STATUS_NOT_IMPLEMENTED;
2465 }
2466
2467 NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
2468 {
2469         p->rng_fault_state = True;
2470         return NT_STATUS_NOT_IMPLEMENTED;
2471 }
2472
2473 NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
2474 {
2475         p->rng_fault_state = True;
2476         return NT_STATUS_NOT_IMPLEMENTED;
2477 }
2478
2479 NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
2480 {
2481         p->rng_fault_state = True;
2482         return NT_STATUS_NOT_IMPLEMENTED;
2483 }
2484
2485 NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
2486 {
2487         p->rng_fault_state = True;
2488         return NT_STATUS_NOT_IMPLEMENTED;
2489 }
2490
2491 NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
2492 {
2493         p->rng_fault_state = True;
2494         return NT_STATUS_NOT_IMPLEMENTED;
2495 }
2496
2497 NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
2498 {
2499         p->rng_fault_state = True;
2500         return NT_STATUS_NOT_IMPLEMENTED;
2501 }
2502
2503 NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
2504 {
2505         p->rng_fault_state = True;
2506         return NT_STATUS_NOT_IMPLEMENTED;
2507 }
2508
2509 NTSTATUS _lsa_lsaRQueryForestTrustInformation(pipes_struct *p, struct lsa_lsaRQueryForestTrustInformation *r)
2510 {
2511         p->rng_fault_state = True;
2512         return NT_STATUS_NOT_IMPLEMENTED;
2513 }
2514
2515 NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2516 {
2517         p->rng_fault_state = True;
2518         return NT_STATUS_NOT_IMPLEMENTED;
2519 }
2520
2521 NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
2522 {
2523         p->rng_fault_state = True;
2524         return NT_STATUS_NOT_IMPLEMENTED;
2525 }
2526
2527 NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
2528 {
2529         p->rng_fault_state = True;
2530         return NT_STATUS_NOT_IMPLEMENTED;
2531 }
2532
2533 NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2534 {
2535         p->rng_fault_state = True;
2536         return NT_STATUS_NOT_IMPLEMENTED;
2537 }
2538
2539 NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2540 {
2541         p->rng_fault_state = True;
2542         return NT_STATUS_NOT_IMPLEMENTED;
2543 }
2544
2545 NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
2546 {
2547         p->rng_fault_state = True;
2548         return NT_STATUS_NOT_IMPLEMENTED;
2549 }