source3/rpc_server/srv_samr_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell                   1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton      1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997,
   7  *  Copyright (C) Marc Jacobsen                     1999,
   8  *  Copyright (C) Jeremy Allison                    2001-2008,
   9  *  Copyright (C) Jean François Micouleau           1998-2001,
  10  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
  11  *  Copyright (C) Gerald (Jerry) Carter             2003-2004,
  12  *  Copyright (C) Simo Sorce                        2003.
  13  *  Copyright (C) Volker Lendecke                   2005.
  14  *  Copyright (C) Guenther Deschner                 2008.
  15  *
  16  *  This program is free software; you can redistribute it and/or modify
  17  *  it under the terms of the GNU General Public License as published by
  18  *  the Free Software Foundation; either version 3 of the License, or
  19  *  (at your option) any later version.
  20  *
  21  *  This program is distributed in the hope that it will be useful,
  22  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  *  GNU General Public License for more details.
  25  *
  26  *  You should have received a copy of the GNU General Public License
  27  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  28  */
  29
  30 /*
  31  * This is the implementation of the SAMR code.
  32  */
  33
  34 #include "includes.h"
  35 #include "../libcli/auth/libcli_auth.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 #define SAMR_USR_RIGHTS_WRITE_PW \
  41                 ( READ_CONTROL_ACCESS           | \
  42                   SAMR_USER_ACCESS_CHANGE_PASSWORD      | \
  43                   SAMR_USER_ACCESS_SET_LOC_COM)
  44 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
  45                 ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
  46
  47 #define DISP_INFO_CACHE_TIMEOUT 10
  48
  49 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
  50 #define MAX_SAM_ENTRIES_W95 50
  51
  52 struct samr_connect_info {
  53         uint8_t dummy;
  54 };
  55
  56 struct samr_domain_info {
  57         struct dom_sid sid;
  58         struct disp_info *disp_info;
  59 };
  60
  61 struct samr_user_info {
  62         struct dom_sid sid;
  63 };
  64
  65 struct samr_group_info {
  66         struct dom_sid sid;
  67 };
  68
  69 struct samr_alias_info {
  70         struct dom_sid sid;
  71 };
  72
  73 typedef struct disp_info {
  74         DOM_SID sid; /* identify which domain this is. */
  75         struct pdb_search *users; /* querydispinfo 1 and 4 */
  76         struct pdb_search *machines; /* querydispinfo 2 */
  77         struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
  78         struct pdb_search *aliases; /* enumaliases */
  79
  80         uint16 enum_acb_mask;
  81         struct pdb_search *enum_users; /* enumusers with a mask */
  82
  83         struct timed_event *cache_timeout_event; /* cache idle timeout
  84                                                   * handler. */
  85 } DISP_INFO;
  86
  87 static const struct generic_mapping sam_generic_mapping = {
  88         GENERIC_RIGHTS_SAM_READ,
  89         GENERIC_RIGHTS_SAM_WRITE,
  90         GENERIC_RIGHTS_SAM_EXECUTE,
  91         GENERIC_RIGHTS_SAM_ALL_ACCESS};
  92 static const struct generic_mapping dom_generic_mapping = {
  93         GENERIC_RIGHTS_DOMAIN_READ,
  94         GENERIC_RIGHTS_DOMAIN_WRITE,
  95         GENERIC_RIGHTS_DOMAIN_EXECUTE,
  96         GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
  97 static const struct generic_mapping usr_generic_mapping = {
  98         GENERIC_RIGHTS_USER_READ,
  99         GENERIC_RIGHTS_USER_WRITE,
 100         GENERIC_RIGHTS_USER_EXECUTE,
 101         GENERIC_RIGHTS_USER_ALL_ACCESS};
 102 static const struct generic_mapping usr_nopwchange_generic_mapping = {
 103         GENERIC_RIGHTS_USER_READ,
 104         GENERIC_RIGHTS_USER_WRITE,
 105         GENERIC_RIGHTS_USER_EXECUTE & ~SAMR_USER_ACCESS_CHANGE_PASSWORD,
 106         GENERIC_RIGHTS_USER_ALL_ACCESS};
 107 static const struct generic_mapping grp_generic_mapping = {
 108         GENERIC_RIGHTS_GROUP_READ,
 109         GENERIC_RIGHTS_GROUP_WRITE,
 110         GENERIC_RIGHTS_GROUP_EXECUTE,
 111         GENERIC_RIGHTS_GROUP_ALL_ACCESS};
 112 static const struct generic_mapping ali_generic_mapping = {
 113         GENERIC_RIGHTS_ALIAS_READ,
 114         GENERIC_RIGHTS_ALIAS_WRITE,
 115         GENERIC_RIGHTS_ALIAS_EXECUTE,
 116         GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
 117
 118 /*******************************************************************
 119 *******************************************************************/
 120
 121 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
 122                                      const struct generic_mapping *map,
 123                                      DOM_SID *sid, uint32 sid_access )
 124 {
 125         DOM_SID domadmin_sid;
 126         SEC_ACE ace[5];         /* at most 5 entries */
 127         size_t i = 0;
 128
 129         SEC_ACL *psa = NULL;
 130
 131         /* basic access for Everyone */
 132
 133         init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
 134                         map->generic_execute | map->generic_read, 0);
 135
 136         /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 137
 138         init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
 139                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 140         init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
 141                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 142
 143         /* Add Full Access for Domain Admins if we are a DC */
 144
 145         if ( IS_DC ) {
 146                 sid_copy( &domadmin_sid, get_global_sam_sid() );
 147                 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
 148                 init_sec_ace(&ace[i++], &domadmin_sid,
 149                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 150         }
 151
 152         /* if we have a sid, give it some special access */
 153
 154         if ( sid ) {
 155                 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, sid_access, 0);
 156         }
 157
 158         /* create the security descriptor */
 159
 160         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
 161                 return NT_STATUS_NO_MEMORY;
 162
 163         if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
 164                                   SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
 165                                   psa, sd_size)) == NULL)
 166                 return NT_STATUS_NO_MEMORY;
 167
 168         return NT_STATUS_OK;
 169 }
 170
 171 /*******************************************************************
 172  Checks if access to an object should be granted, and returns that
 173  level of access for further checks.
 174 ********************************************************************/
 175
 176 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
 177                                           SE_PRIV *rights, uint32 rights_mask,
 178                                           uint32 des_access, uint32 *acc_granted,
 179                                           const char *debug )
 180 {
 181         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 182         uint32 saved_mask = 0;
 183
 184         /* check privileges; certain SAM access bits should be overridden
 185            by privileges (mostly having to do with creating/modifying/deleting
 186            users and groups) */
 187
 188         if (rights && !se_priv_equal(rights, &se_priv_none) &&
 189                         user_has_any_privilege(token, rights)) {
 190
 191                 saved_mask = (des_access & rights_mask);
 192                 des_access &= ~saved_mask;
 193
 194                 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
 195                         rights_mask));
 196         }
 197
 198
 199         /* check the security descriptor first */
 200
 201         status = se_access_check(psd, token, des_access, acc_granted);
 202         if (NT_STATUS_IS_OK(status)) {
 203                 goto done;
 204         }
 205
 206         /* give root a free pass */
 207
 208         if ( geteuid() == sec_initial_uid() ) {
 209
 210                 DEBUG(4,("%s: ACCESS should be DENIED  (requested: %#010x)\n", debug, des_access));
 211                 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
 212
 213                 *acc_granted = des_access;
 214
 215                 status = NT_STATUS_OK;
 216                 goto done;
 217         }
 218
 219
 220 done:
 221         /* add in any bits saved during the privilege check (only
 222            matters is status is ok) */
 223
 224         *acc_granted |= rights_mask;
 225
 226         DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
 227                 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
 228                 des_access, *acc_granted));
 229
 230         return status;
 231 }
 232
 233
 234 /*******************************************************************
 235  Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
 236 ********************************************************************/
 237
 238 static void map_max_allowed_access(const NT_USER_TOKEN *token,
 239                                         uint32_t *pacc_requested)
 240 {
 241         if (!((*pacc_requested) & MAXIMUM_ALLOWED_ACCESS)) {
 242                 return;
 243         }
 244         *pacc_requested &= ~MAXIMUM_ALLOWED_ACCESS;
 245
 246         /* At least try for generic read. */
 247         *pacc_requested = GENERIC_READ_ACCESS;
 248
 249         /* root gets anything. */
 250         if (geteuid() == sec_initial_uid()) {
 251                 *pacc_requested |= GENERIC_ALL_ACCESS;
 252                 return;
 253         }
 254
 255         /* Full Access for 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 256
 257         if (is_sid_in_token(token, &global_sid_Builtin_Administrators) ||
 258                         is_sid_in_token(token, &global_sid_Builtin_Account_Operators)) {
 259                 *pacc_requested |= GENERIC_ALL_ACCESS;
 260                 return;
 261         }
 262
 263         /* Full access for DOMAIN\Domain Admins. */
 264         if ( IS_DC ) {
 265                 DOM_SID domadmin_sid;
 266                 sid_copy( &domadmin_sid, get_global_sam_sid() );
 267                 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
 268                 if (is_sid_in_token(token, &domadmin_sid)) {
 269                         *pacc_requested |= GENERIC_ALL_ACCESS;
 270                         return;
 271                 }
 272         }
 273         /* TODO ! Check privileges. */
 274 }
 275
 276 /*******************************************************************
 277  Fetch or create a dispinfo struct.
 278 ********************************************************************/
 279
 280 static DISP_INFO *get_samr_dispinfo_by_sid(const struct dom_sid *psid)
 281 {
 282         /*
 283          * We do a static cache for DISP_INFO's here. Explanation can be found
 284          * in Jeremy's checkin message to r11793:
 285          *
 286          * Fix the SAMR cache so it works across completely insane
 287          * client behaviour (ie.:
 288          * open pipe/open SAMR handle/enumerate 0 - 1024
 289          * close SAMR handle, close pipe.
 290          * open pipe/open SAMR handle/enumerate 1024 - 2048...
 291          * close SAMR handle, close pipe.
 292          * And on ad-nausium. Amazing.... probably object-oriented
 293          * client side programming in action yet again.
 294          * This change should *massively* improve performance when
 295          * enumerating users from an LDAP database.
 296          * Jeremy.
 297          *
 298          * "Our" and the builtin domain are the only ones where we ever
 299          * enumerate stuff, so just cache 2 entries.
 300          */
 301
 302         static struct disp_info *builtin_dispinfo;
 303         static struct disp_info *domain_dispinfo;
 304
 305         /* There are two cases to consider here:
 306            1) The SID is a domain SID and we look for an equality match, or
 307            2) This is an account SID and so we return the DISP_INFO* for our
 308               domain */
 309
 310         if (psid == NULL) {
 311                 return NULL;
 312         }
 313
 314         if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
 315                 /*
 316                  * Necessary only once, but it does not really hurt.
 317                  */
 318                 if (builtin_dispinfo == NULL) {
 319                         builtin_dispinfo = talloc_zero(
 320                                 talloc_autofree_context(), struct disp_info);
 321                         if (builtin_dispinfo == NULL) {
 322                                 return NULL;
 323                         }
 324                 }
 325                 sid_copy(&builtin_dispinfo->sid, &global_sid_Builtin);
 326
 327                 return builtin_dispinfo;
 328         }
 329
 330         if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
 331                 /*
 332                  * Necessary only once, but it does not really hurt.
 333                  */
 334                 if (domain_dispinfo == NULL) {
 335                         domain_dispinfo = talloc_zero(
 336                                 talloc_autofree_context(), struct disp_info);
 337                         if (domain_dispinfo == NULL) {
 338                                 return NULL;
 339                         }
 340                 }
 341                 sid_copy(&domain_dispinfo->sid, get_global_sam_sid());
 342
 343                 return domain_dispinfo;
 344         }
 345
 346         return NULL;
 347 }
 348
 349 /*******************************************************************
 350  Function to free the per SID data.
 351  ********************************************************************/
 352
 353 static void free_samr_cache(DISP_INFO *disp_info)
 354 {
 355         DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
 356                    sid_string_dbg(&disp_info->sid)));
 357
 358         /* We need to become root here because the paged search might have to
 359          * tell the LDAP server we're not interested in the rest anymore. */
 360
 361         become_root();
 362
 363         TALLOC_FREE(disp_info->users);
 364         TALLOC_FREE(disp_info->machines);
 365         TALLOC_FREE(disp_info->groups);
 366         TALLOC_FREE(disp_info->aliases);
 367         TALLOC_FREE(disp_info->enum_users);
 368
 369         unbecome_root();
 370 }
 371
 372 /*******************************************************************
 373  Idle event handler. Throw away the disp info cache.
 374  ********************************************************************/
 375
 376 static void disp_info_cache_idle_timeout_handler(struct event_context *ev_ctx,
 377                                                  struct timed_event *te,
 378                                                  struct timeval now,
 379                                                  void *private_data)
 380 {
 381         DISP_INFO *disp_info = (DISP_INFO *)private_data;
 382
 383         TALLOC_FREE(disp_info->cache_timeout_event);
 384
 385         DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
 386                    "out\n"));
 387         free_samr_cache(disp_info);
 388 }
 389
 390 /*******************************************************************
 391  Setup cache removal idle event handler.
 392  ********************************************************************/
 393
 394 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
 395 {
 396         /* Remove any pending timeout and update. */
 397
 398         TALLOC_FREE(disp_info->cache_timeout_event);
 399
 400         DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
 401                   "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
 402                   (unsigned int)secs_fromnow ));
 403
 404         disp_info->cache_timeout_event = event_add_timed(
 405                 smbd_event_context(), NULL,
 406                 timeval_current_ofs(secs_fromnow, 0),
 407                 disp_info_cache_idle_timeout_handler, (void *)disp_info);
 408 }
 409
 410 /*******************************************************************
 411  Force flush any cache. We do this on any samr_set_xxx call.
 412  We must also remove the timeout handler.
 413  ********************************************************************/
 414
 415 static void force_flush_samr_cache(const struct dom_sid *sid)
 416 {
 417         struct disp_info *disp_info = get_samr_dispinfo_by_sid(sid);
 418
 419         if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
 420                 return;
 421         }
 422
 423         DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
 424         TALLOC_FREE(disp_info->cache_timeout_event);
 425         free_samr_cache(disp_info);
 426 }
 427
 428 /*******************************************************************
 429  Ensure password info is never given out. Paranioa... JRA.
 430  ********************************************************************/
 431
 432 static void samr_clear_sam_passwd(struct samu *sam_pass)
 433 {
 434
 435         if (!sam_pass)
 436                 return;
 437
 438         /* These now zero out the old password */
 439
 440         pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
 441         pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
 442 }
 443
 444 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
 445 {
 446         struct samr_displayentry *entry;
 447
 448         if (sid_check_is_builtin(&info->sid)) {
 449                 /* No users in builtin. */
 450                 return 0;
 451         }
 452
 453         if (info->users == NULL) {
 454                 info->users = pdb_search_users(info, acct_flags);
 455                 if (info->users == NULL) {
 456                         return 0;
 457                 }
 458         }
 459         /* Fetch the last possible entry, thus trigger an enumeration */
 460         pdb_search_entries(info->users, 0xffffffff, 1, &entry);
 461
 462         /* Ensure we cache this enumeration. */
 463         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 464
 465         return info->users->num_entries;
 466 }
 467
 468 static uint32 count_sam_groups(struct disp_info *info)
 469 {
 470         struct samr_displayentry *entry;
 471
 472         if (sid_check_is_builtin(&info->sid)) {
 473                 /* No groups in builtin. */
 474                 return 0;
 475         }
 476
 477         if (info->groups == NULL) {
 478                 info->groups = pdb_search_groups(info);
 479                 if (info->groups == NULL) {
 480                         return 0;
 481                 }
 482         }
 483         /* Fetch the last possible entry, thus trigger an enumeration */
 484         pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
 485
 486         /* Ensure we cache this enumeration. */
 487         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 488
 489         return info->groups->num_entries;
 490 }
 491
 492 static uint32 count_sam_aliases(struct disp_info *info)
 493 {
 494         struct samr_displayentry *entry;
 495
 496         if (info->aliases == NULL) {
 497                 info->aliases = pdb_search_aliases(info, &info->sid);
 498                 if (info->aliases == NULL) {
 499                         return 0;
 500                 }
 501         }
 502         /* Fetch the last possible entry, thus trigger an enumeration */
 503         pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
 504
 505         /* Ensure we cache this enumeration. */
 506         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 507
 508         return info->aliases->num_entries;
 509 }
 510
 511 /*******************************************************************
 512  _samr_Close
 513  ********************************************************************/
 514
 515 NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
 516 {
 517         if (!close_policy_hnd(p, r->in.handle)) {
 518                 return NT_STATUS_INVALID_HANDLE;
 519         }
 520
 521         ZERO_STRUCTP(r->out.handle);
 522
 523         return NT_STATUS_OK;
 524 }
 525
 526 /*******************************************************************
 527  _samr_OpenDomain
 528  ********************************************************************/
 529
 530 NTSTATUS _samr_OpenDomain(pipes_struct *p,
 531                           struct samr_OpenDomain *r)
 532 {
 533         struct samr_connect_info *cinfo;
 534         struct samr_domain_info *dinfo;
 535         SEC_DESC *psd = NULL;
 536         uint32    acc_granted;
 537         uint32    des_access = r->in.access_mask;
 538         NTSTATUS  status;
 539         size_t    sd_size;
 540         uint32_t extra_access = SAMR_DOMAIN_ACCESS_CREATE_USER;
 541         SE_PRIV se_rights;
 542
 543         /* find the connection policy handle. */
 544
 545         cinfo = policy_handle_find(p, r->in.connect_handle, 0, NULL,
 546                                    struct samr_connect_info, &status);
 547         if (!NT_STATUS_IS_OK(status)) {
 548                 return status;
 549         }
 550
 551         /*check if access can be granted as requested by client. */
 552         map_max_allowed_access(p->server_info->ptok, &des_access);
 553
 554         make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
 555         se_map_generic( &des_access, &dom_generic_mapping );
 556
 557         /*
 558          * Users with SeMachineAccount or SeAddUser get additional
 559          * SAMR_DOMAIN_ACCESS_CREATE_USER access.
 560          */
 561         se_priv_copy( &se_rights, &se_machine_account );
 562         se_priv_add( &se_rights, &se_add_users );
 563
 564         /*
 565          * Users with SeAddUser get the ability to manipulate groups
 566          * and aliases.
 567          */
 568         if (user_has_any_privilege(p->server_info->ptok, &se_add_users)) {
 569                 extra_access |= (SAMR_DOMAIN_ACCESS_CREATE_GROUP |
 570                                 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
 571                                 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
 572                                 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS |
 573                                 SAMR_DOMAIN_ACCESS_CREATE_ALIAS);
 574         }
 575
 576         status = access_check_samr_object( psd, p->server_info->ptok,
 577                 &se_rights, extra_access, des_access,
 578                 &acc_granted, "_samr_OpenDomain" );
 579
 580         if ( !NT_STATUS_IS_OK(status) )
 581                 return status;
 582
 583         if (!sid_check_is_domain(r->in.sid) &&
 584             !sid_check_is_builtin(r->in.sid)) {
 585                 return NT_STATUS_NO_SUCH_DOMAIN;
 586         }
 587
 588         dinfo = policy_handle_create(p, r->out.domain_handle, acc_granted,
 589                                      struct samr_domain_info, &status);
 590         if (!NT_STATUS_IS_OK(status)) {
 591                 return status;
 592         }
 593         dinfo->sid = *r->in.sid;
 594         dinfo->disp_info = get_samr_dispinfo_by_sid(r->in.sid);
 595
 596         DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
 597
 598         return NT_STATUS_OK;
 599 }
 600
 601 /*******************************************************************
 602  _samr_GetUserPwInfo
 603  ********************************************************************/
 604
 605 NTSTATUS _samr_GetUserPwInfo(pipes_struct *p,
 606                              struct samr_GetUserPwInfo *r)
 607 {
 608         struct samr_user_info *uinfo;
 609         enum lsa_SidType sid_type;
 610         uint32_t min_password_length = 0;
 611         uint32_t password_properties = 0;
 612         bool ret = false;
 613         NTSTATUS status;
 614
 615         DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
 616
 617         uinfo = policy_handle_find(p, r->in.user_handle,
 618                                    SAMR_USER_ACCESS_GET_ATTRIBUTES, NULL,
 619                                    struct samr_user_info, &status);
 620         if (!NT_STATUS_IS_OK(status)) {
 621                 return status;
 622         }
 623
 624         if (!sid_check_is_in_our_domain(&uinfo->sid)) {
 625                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 626         }
 627
 628         become_root();
 629         ret = lookup_sid(p->mem_ctx, &uinfo->sid, NULL, NULL, &sid_type);
 630         unbecome_root();
 631         if (ret == false) {
 632                 return NT_STATUS_NO_SUCH_USER;
 633         }
 634
 635         switch (sid_type) {
 636                 case SID_NAME_USER:
 637                         become_root();
 638                         pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
 639                                                &min_password_length);
 640                         pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
 641                                                &password_properties);
 642                         unbecome_root();
 643
 644                         if (lp_check_password_script() && *lp_check_password_script()) {
 645                                 password_properties |= DOMAIN_PASSWORD_COMPLEX;
 646                         }
 647
 648                         break;
 649                 default:
 650                         break;
 651         }
 652
 653         r->out.info->min_password_length = min_password_length;
 654         r->out.info->password_properties = password_properties;
 655
 656         DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
 657
 658         return NT_STATUS_OK;
 659 }
 660
 661 /*******************************************************************
 662  _samr_SetSecurity
 663  ********************************************************************/
 664
 665 NTSTATUS _samr_SetSecurity(pipes_struct *p,
 666                            struct samr_SetSecurity *r)
 667 {
 668         struct samr_user_info *uinfo;
 669         uint32 i;
 670         SEC_ACL *dacl;
 671         bool ret;
 672         struct samu *sampass=NULL;
 673         NTSTATUS status;
 674
 675         uinfo = policy_handle_find(p, r->in.handle,
 676                                    SAMR_USER_ACCESS_SET_ATTRIBUTES, NULL,
 677                                    struct samr_user_info, &status);
 678         if (!NT_STATUS_IS_OK(status)) {
 679                 return status;
 680         }
 681
 682         if (!(sampass = samu_new( p->mem_ctx))) {
 683                 DEBUG(0,("No memory!\n"));
 684                 return NT_STATUS_NO_MEMORY;
 685         }
 686
 687         /* get the user record */
 688         become_root();
 689         ret = pdb_getsampwsid(sampass, &uinfo->sid);
 690         unbecome_root();
 691
 692         if (!ret) {
 693                 DEBUG(4, ("User %s not found\n",
 694                           sid_string_dbg(&uinfo->sid)));
 695                 TALLOC_FREE(sampass);
 696                 return NT_STATUS_INVALID_HANDLE;
 697         }
 698
 699         dacl = r->in.sdbuf->sd->dacl;
 700         for (i=0; i < dacl->num_aces; i++) {
 701                 if (sid_equal(&uinfo->sid, &dacl->aces[i].trustee)) {
 702                         ret = pdb_set_pass_can_change(sampass,
 703                                 (dacl->aces[i].access_mask &
 704                                  SAMR_USER_ACCESS_CHANGE_PASSWORD) ?
 705                                                       True: False);
 706                         break;
 707                 }
 708         }
 709
 710         if (!ret) {
 711                 TALLOC_FREE(sampass);
 712                 return NT_STATUS_ACCESS_DENIED;
 713         }
 714
 715         become_root();
 716         status = pdb_update_sam_account(sampass);
 717         unbecome_root();
 718
 719         TALLOC_FREE(sampass);
 720
 721         return status;
 722 }
 723
 724 /*******************************************************************
 725   build correct perms based on policies and password times for _samr_query_sec_obj
 726 *******************************************************************/
 727 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
 728 {
 729         struct samu *sampass=NULL;
 730         bool ret;
 731
 732         if ( !(sampass = samu_new( mem_ctx )) ) {
 733                 DEBUG(0,("No memory!\n"));
 734                 return False;
 735         }
 736
 737         become_root();
 738         ret = pdb_getsampwsid(sampass, user_sid);
 739         unbecome_root();
 740
 741         if (ret == False) {
 742                 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 743                 TALLOC_FREE(sampass);
 744                 return False;
 745         }
 746
 747         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
 748
 749         if (pdb_get_pass_can_change(sampass)) {
 750                 TALLOC_FREE(sampass);
 751                 return True;
 752         }
 753         TALLOC_FREE(sampass);
 754         return False;
 755 }
 756
 757
 758 /*******************************************************************
 759  _samr_QuerySecurity
 760  ********************************************************************/
 761
 762 NTSTATUS _samr_QuerySecurity(pipes_struct *p,
 763                              struct samr_QuerySecurity *r)
 764 {
 765         struct samr_connect_info *cinfo;
 766         struct samr_domain_info *dinfo;
 767         struct samr_user_info *uinfo;
 768         struct samr_group_info *ginfo;
 769         struct samr_alias_info *ainfo;
 770         NTSTATUS status;
 771         SEC_DESC * psd = NULL;
 772         size_t sd_size;
 773
 774         cinfo = policy_handle_find(p, r->in.handle,
 775                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 776                                    struct samr_connect_info, &status);
 777         if (NT_STATUS_IS_OK(status)) {
 778                 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
 779                 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size,
 780                                              &sam_generic_mapping, NULL, 0);
 781                 goto done;
 782         }
 783
 784         dinfo = policy_handle_find(p, r->in.handle,
 785                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 786                                    struct samr_domain_info, &status);
 787         if (NT_STATUS_IS_OK(status)) {
 788                 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
 789                          "with SID: %s\n", sid_string_dbg(&dinfo->sid)));
 790                 /*
 791                  * TODO: Builtin probably needs a different SD with restricted
 792                  * write access
 793                  */
 794                 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size,
 795                                              &dom_generic_mapping, NULL, 0);
 796                 goto done;
 797         }
 798
 799         uinfo = policy_handle_find(p, r->in.handle,
 800                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 801                                    struct samr_user_info, &status);
 802         if (NT_STATUS_IS_OK(status)) {
 803                 DEBUG(10,("_samr_QuerySecurity: querying security on user "
 804                           "Object with SID: %s\n",
 805                           sid_string_dbg(&uinfo->sid)));
 806                 if (check_change_pw_access(p->mem_ctx, &uinfo->sid)) {
 807                         status = make_samr_object_sd(
 808                                 p->mem_ctx, &psd, &sd_size,
 809                                 &usr_generic_mapping,
 810                                 &uinfo->sid, SAMR_USR_RIGHTS_WRITE_PW);
 811                 } else {
 812                         status = make_samr_object_sd(
 813                                 p->mem_ctx, &psd, &sd_size,
 814                                 &usr_nopwchange_generic_mapping,
 815                                 &uinfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
 816                 }
 817                 goto done;
 818         }
 819
 820         ginfo = policy_handle_find(p, r->in.handle,
 821                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 822                                    struct samr_group_info, &status);
 823         if (NT_STATUS_IS_OK(status)) {
 824                 /*
 825                  * TODO: different SDs have to be generated for aliases groups
 826                  * and users.  Currently all three get a default user SD
 827                  */
 828                 DEBUG(10,("_samr_QuerySecurity: querying security on group "
 829                           "Object with SID: %s\n",
 830                           sid_string_dbg(&ginfo->sid)));
 831                 status = make_samr_object_sd(
 832                         p->mem_ctx, &psd, &sd_size,
 833                         &usr_nopwchange_generic_mapping,
 834                         &ginfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
 835                 goto done;
 836         }
 837
 838         ainfo = policy_handle_find(p, r->in.handle,
 839                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 840                                    struct samr_alias_info, &status);
 841         if (NT_STATUS_IS_OK(status)) {
 842                 /*
 843                  * TODO: different SDs have to be generated for aliases groups
 844                  * and users.  Currently all three get a default user SD
 845                  */
 846                 DEBUG(10,("_samr_QuerySecurity: querying security on alias "
 847                           "Object with SID: %s\n",
 848                           sid_string_dbg(&ainfo->sid)));
 849                 status = make_samr_object_sd(
 850                         p->mem_ctx, &psd, &sd_size,
 851                         &usr_nopwchange_generic_mapping,
 852                         &ainfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
 853                 goto done;
 854         }
 855
 856         return NT_STATUS_OBJECT_TYPE_MISMATCH;
 857 done:
 858         if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
 859                 return NT_STATUS_NO_MEMORY;
 860
 861         return status;
 862 }
 863
 864 /*******************************************************************
 865 makes a SAM_ENTRY / UNISTR2* structure from a user list.
 866 ********************************************************************/
 867
 868 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
 869                                          struct samr_SamEntry **sam_pp,
 870                                          uint32_t num_entries,
 871                                          uint32_t start_idx,
 872                                          struct samr_displayentry *entries)
 873 {
 874         uint32_t i;
 875         struct samr_SamEntry *sam;
 876
 877         *sam_pp = NULL;
 878
 879         if (num_entries == 0) {
 880                 return NT_STATUS_OK;
 881         }
 882
 883         sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_entries);
 884         if (sam == NULL) {
 885                 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
 886                 return NT_STATUS_NO_MEMORY;
 887         }
 888
 889         for (i = 0; i < num_entries; i++) {
 890 #if 0
 891                 /*
 892                  * usrmgr expects a non-NULL terminated string with
 893                  * trust relationships
 894                  */
 895                 if (entries[i].acct_flags & ACB_DOMTRUST) {
 896                         init_unistr2(&uni_temp_name, entries[i].account_name,
 897                                      UNI_FLAGS_NONE);
 898                 } else {
 899                         init_unistr2(&uni_temp_name, entries[i].account_name,
 900                                      UNI_STR_TERMINATE);
 901                 }
 902 #endif
 903                 init_lsa_String(&sam[i].name, entries[i].account_name);
 904                 sam[i].idx = entries[i].rid;
 905         }
 906
 907         *sam_pp = sam;
 908
 909         return NT_STATUS_OK;
 910 }
 911
 912 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
 913
 914 /*******************************************************************
 915  _samr_EnumDomainUsers
 916  ********************************************************************/
 917
 918 NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 919                                struct samr_EnumDomainUsers *r)
 920 {
 921         NTSTATUS status;
 922         struct samr_domain_info *dinfo;
 923         int num_account;
 924         uint32 enum_context = *r->in.resume_handle;
 925         enum remote_arch_types ra_type = get_remote_arch();
 926         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
 927         uint32 max_entries = max_sam_entries;
 928         struct samr_displayentry *entries = NULL;
 929         struct samr_SamArray *samr_array = NULL;
 930         struct samr_SamEntry *samr_entries = NULL;
 931
 932         DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
 933
 934         dinfo = policy_handle_find(p, r->in.domain_handle,
 935                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
 936                                    struct samr_domain_info, &status);
 937         if (!NT_STATUS_IS_OK(status)) {
 938                 return status;
 939         }
 940
 941         if (sid_check_is_builtin(&dinfo->sid)) {
 942                 /* No users in builtin. */
 943                 *r->out.resume_handle = *r->in.resume_handle;
 944                 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
 945                 return status;
 946         }
 947
 948         samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
 949         if (!samr_array) {
 950                 return NT_STATUS_NO_MEMORY;
 951         }
 952         *r->out.sam = samr_array;
 953
 954         become_root();
 955
 956         /* AS ROOT !!!! */
 957
 958         if ((dinfo->disp_info->enum_users != NULL) &&
 959             (dinfo->disp_info->enum_acb_mask != r->in.acct_flags)) {
 960                 TALLOC_FREE(dinfo->disp_info->enum_users);
 961         }
 962
 963         if (dinfo->disp_info->enum_users == NULL) {
 964                 dinfo->disp_info->enum_users = pdb_search_users(
 965                         dinfo->disp_info, r->in.acct_flags);
 966                 dinfo->disp_info->enum_acb_mask = r->in.acct_flags;
 967         }
 968
 969         if (dinfo->disp_info->enum_users == NULL) {
 970                 /* END AS ROOT !!!! */
 971                 unbecome_root();
 972                 return NT_STATUS_ACCESS_DENIED;
 973         }
 974
 975         num_account = pdb_search_entries(dinfo->disp_info->enum_users,
 976                                          enum_context, max_entries,
 977                                          &entries);
 978
 979         /* END AS ROOT !!!! */
 980
 981         unbecome_root();
 982
 983         if (num_account == 0) {
 984                 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
 985                           "total entries\n"));
 986                 *r->out.resume_handle = *r->in.resume_handle;
 987                 return NT_STATUS_OK;
 988         }
 989
 990         status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
 991                                           num_account, enum_context,
 992                                           entries);
 993         if (!NT_STATUS_IS_OK(status)) {
 994                 return status;
 995         }
 996
 997         if (max_entries <= num_account) {
 998                 status = STATUS_MORE_ENTRIES;
 999         } else {
1000                 status = NT_STATUS_OK;
1001         }
1002
1003         /* Ensure we cache this enumeration. */
1004         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1005
1006         DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
1007
1008         samr_array->count = num_account;
1009         samr_array->entries = samr_entries;
1010
1011         *r->out.resume_handle = *r->in.resume_handle + num_account;
1012         *r->out.num_entries = num_account;
1013
1014         DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1015
1016         return status;
1017 }
1018
1019 /*******************************************************************
1020 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1021 ********************************************************************/
1022
1023 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
1024                                       struct samr_SamEntry **sam_pp,
1025                                       uint32_t num_sam_entries,
1026                                       struct samr_displayentry *entries)
1027 {
1028         struct samr_SamEntry *sam;
1029         uint32_t i;
1030
1031         *sam_pp = NULL;
1032
1033         if (num_sam_entries == 0) {
1034                 return;
1035         }
1036
1037         sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_sam_entries);
1038         if (sam == NULL) {
1039                 return;
1040         }
1041
1042         for (i = 0; i < num_sam_entries; i++) {
1043                 /*
1044                  * JRA. I think this should include the null. TNG does not.
1045                  */
1046                 init_lsa_String(&sam[i].name, entries[i].account_name);
1047                 sam[i].idx = entries[i].rid;
1048         }
1049
1050         *sam_pp = sam;
1051 }
1052
1053 /*******************************************************************
1054  _samr_EnumDomainGroups
1055  ********************************************************************/
1056
1057 NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
1058                                 struct samr_EnumDomainGroups *r)
1059 {
1060         NTSTATUS status;
1061         struct samr_domain_info *dinfo;
1062         struct samr_displayentry *groups;
1063         uint32 num_groups;
1064         struct samr_SamArray *samr_array = NULL;
1065         struct samr_SamEntry *samr_entries = NULL;
1066
1067         dinfo = policy_handle_find(p, r->in.domain_handle,
1068                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1069                                    struct samr_domain_info, &status);
1070         if (!NT_STATUS_IS_OK(status)) {
1071                 return status;
1072         }
1073
1074         DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1075
1076         if (sid_check_is_builtin(&dinfo->sid)) {
1077                 /* No groups in builtin. */
1078                 *r->out.resume_handle = *r->in.resume_handle;
1079                 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1080                 return status;
1081         }
1082
1083         samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1084         if (!samr_array) {
1085                 return NT_STATUS_NO_MEMORY;
1086         }
1087
1088         /* the domain group array is being allocated in the function below */
1089
1090         become_root();
1091
1092         if (dinfo->disp_info->groups == NULL) {
1093                 dinfo->disp_info->groups = pdb_search_groups(dinfo->disp_info);
1094
1095                 if (dinfo->disp_info->groups == NULL) {
1096                         unbecome_root();
1097                         return NT_STATUS_ACCESS_DENIED;
1098                 }
1099         }
1100
1101         num_groups = pdb_search_entries(dinfo->disp_info->groups,
1102                                         *r->in.resume_handle,
1103                                         MAX_SAM_ENTRIES, &groups);
1104         unbecome_root();
1105
1106         /* Ensure we cache this enumeration. */
1107         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1108
1109         make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1110                                   num_groups, groups);
1111
1112         samr_array->count = num_groups;
1113         samr_array->entries = samr_entries;
1114
1115         *r->out.sam = samr_array;
1116         *r->out.num_entries = num_groups;
1117         *r->out.resume_handle = num_groups + *r->in.resume_handle;
1118
1119         DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1120
1121         return status;
1122 }
1123
1124 /*******************************************************************
1125  _samr_EnumDomainAliases
1126  ********************************************************************/
1127
1128 NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
1129                                  struct samr_EnumDomainAliases *r)
1130 {
1131         NTSTATUS status;
1132         struct samr_domain_info *dinfo;
1133         struct samr_displayentry *aliases;
1134         uint32 num_aliases = 0;
1135         struct samr_SamArray *samr_array = NULL;
1136         struct samr_SamEntry *samr_entries = NULL;
1137
1138         dinfo = policy_handle_find(p, r->in.domain_handle,
1139                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1140                                    struct samr_domain_info, &status);
1141         if (!NT_STATUS_IS_OK(status)) {
1142                 return status;
1143         }
1144
1145         DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1146                  sid_string_dbg(&dinfo->sid)));
1147
1148         samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1149         if (!samr_array) {
1150                 return NT_STATUS_NO_MEMORY;
1151         }
1152
1153         become_root();
1154
1155         if (dinfo->disp_info->aliases == NULL) {
1156                 dinfo->disp_info->aliases = pdb_search_aliases(
1157                         dinfo->disp_info, &dinfo->sid);
1158                 if (dinfo->disp_info->aliases == NULL) {
1159                         unbecome_root();
1160                         return NT_STATUS_ACCESS_DENIED;
1161                 }
1162         }
1163
1164         num_aliases = pdb_search_entries(dinfo->disp_info->aliases,
1165                                          *r->in.resume_handle,
1166                                          MAX_SAM_ENTRIES, &aliases);
1167         unbecome_root();
1168
1169         /* Ensure we cache this enumeration. */
1170         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1171
1172         make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1173                                   num_aliases, aliases);
1174
1175         DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1176
1177         samr_array->count = num_aliases;
1178         samr_array->entries = samr_entries;
1179
1180         *r->out.sam = samr_array;
1181         *r->out.num_entries = num_aliases;
1182         *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1183
1184         return status;
1185 }
1186
1187 /*******************************************************************
1188  inits a samr_DispInfoGeneral structure.
1189 ********************************************************************/
1190
1191 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1192                                      struct samr_DispInfoGeneral *r,
1193                                      uint32_t num_entries,
1194                                      uint32_t start_idx,
1195                                      struct samr_displayentry *entries)
1196 {
1197         uint32 i;
1198
1199         DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1200
1201         if (num_entries == 0) {
1202                 return NT_STATUS_OK;
1203         }
1204
1205         r->count = num_entries;
1206
1207         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryGeneral, num_entries);
1208         if (!r->entries) {
1209                 return NT_STATUS_NO_MEMORY;
1210         }
1211
1212         for (i = 0; i < num_entries ; i++) {
1213
1214                 init_lsa_String(&r->entries[i].account_name,
1215                                 entries[i].account_name);
1216
1217                 init_lsa_String(&r->entries[i].description,
1218                                 entries[i].description);
1219
1220                 init_lsa_String(&r->entries[i].full_name,
1221                                 entries[i].fullname);
1222
1223                 r->entries[i].rid = entries[i].rid;
1224                 r->entries[i].acct_flags = entries[i].acct_flags;
1225                 r->entries[i].idx = start_idx+i+1;
1226         }
1227
1228         return NT_STATUS_OK;
1229 }
1230
1231 /*******************************************************************
1232  inits a samr_DispInfoFull structure.
1233 ********************************************************************/
1234
1235 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1236                                      struct samr_DispInfoFull *r,
1237                                      uint32_t num_entries,
1238                                      uint32_t start_idx,
1239                                      struct samr_displayentry *entries)
1240 {
1241         uint32_t i;
1242
1243         DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1244
1245         if (num_entries == 0) {
1246                 return NT_STATUS_OK;
1247         }
1248
1249         r->count = num_entries;
1250
1251         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFull, num_entries);
1252         if (!r->entries) {
1253                 return NT_STATUS_NO_MEMORY;
1254         }
1255
1256         for (i = 0; i < num_entries ; i++) {
1257
1258                 init_lsa_String(&r->entries[i].account_name,
1259                                 entries[i].account_name);
1260
1261                 init_lsa_String(&r->entries[i].description,
1262                                 entries[i].description);
1263
1264                 r->entries[i].rid = entries[i].rid;
1265                 r->entries[i].acct_flags = entries[i].acct_flags;
1266                 r->entries[i].idx = start_idx+i+1;
1267         }
1268
1269         return NT_STATUS_OK;
1270 }
1271
1272 /*******************************************************************
1273  inits a samr_DispInfoFullGroups structure.
1274 ********************************************************************/
1275
1276 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1277                                      struct samr_DispInfoFullGroups *r,
1278                                      uint32_t num_entries,
1279                                      uint32_t start_idx,
1280                                      struct samr_displayentry *entries)
1281 {
1282         uint32_t i;
1283
1284         DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1285
1286         if (num_entries == 0) {
1287                 return NT_STATUS_OK;
1288         }
1289
1290         r->count = num_entries;
1291
1292         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFullGroup, num_entries);
1293         if (!r->entries) {
1294                 return NT_STATUS_NO_MEMORY;
1295         }
1296
1297         for (i = 0; i < num_entries ; i++) {
1298
1299                 init_lsa_String(&r->entries[i].account_name,
1300                                 entries[i].account_name);
1301
1302                 init_lsa_String(&r->entries[i].description,
1303                                 entries[i].description);
1304
1305                 r->entries[i].rid = entries[i].rid;
1306                 r->entries[i].acct_flags = entries[i].acct_flags;
1307                 r->entries[i].idx = start_idx+i+1;
1308         }
1309
1310         return NT_STATUS_OK;
1311 }
1312
1313 /*******************************************************************
1314  inits a samr_DispInfoAscii structure.
1315 ********************************************************************/
1316
1317 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1318                                      struct samr_DispInfoAscii *r,
1319                                      uint32_t num_entries,
1320                                      uint32_t start_idx,
1321                                      struct samr_displayentry *entries)
1322 {
1323         uint32_t i;
1324
1325         DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1326
1327         if (num_entries == 0) {
1328                 return NT_STATUS_OK;
1329         }
1330
1331         r->count = num_entries;
1332
1333         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1334         if (!r->entries) {
1335                 return NT_STATUS_NO_MEMORY;
1336         }
1337
1338         for (i = 0; i < num_entries ; i++) {
1339
1340                 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1341                                           entries[i].account_name);
1342
1343                 r->entries[i].idx = start_idx+i+1;
1344         }
1345
1346         return NT_STATUS_OK;
1347 }
1348
1349 /*******************************************************************
1350  inits a samr_DispInfoAscii structure.
1351 ********************************************************************/
1352
1353 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1354                                      struct samr_DispInfoAscii *r,
1355                                      uint32_t num_entries,
1356                                      uint32_t start_idx,
1357                                      struct samr_displayentry *entries)
1358 {
1359         uint32_t i;
1360
1361         DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1362
1363         if (num_entries == 0) {
1364                 return NT_STATUS_OK;
1365         }
1366
1367         r->count = num_entries;
1368
1369         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1370         if (!r->entries) {
1371                 return NT_STATUS_NO_MEMORY;
1372         }
1373
1374         for (i = 0; i < num_entries ; i++) {
1375
1376                 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1377                                           entries[i].account_name);
1378
1379                 r->entries[i].idx = start_idx+i+1;
1380         }
1381
1382         return NT_STATUS_OK;
1383 }
1384
1385 /*******************************************************************
1386  _samr_QueryDisplayInfo
1387  ********************************************************************/
1388
1389 NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
1390                                 struct samr_QueryDisplayInfo *r)
1391 {
1392         NTSTATUS status;
1393         struct samr_domain_info *dinfo;
1394         uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1395
1396         uint32 max_entries = r->in.max_entries;
1397         uint32 enum_context = r->in.start_idx;
1398         uint32 max_size = r->in.buf_size;
1399
1400         union samr_DispInfo *disp_info = r->out.info;
1401
1402         uint32 temp_size=0, total_data_size=0;
1403         NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1404         uint32 num_account = 0;
1405         enum remote_arch_types ra_type = get_remote_arch();
1406         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1407         struct samr_displayentry *entries = NULL;
1408
1409         DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1410
1411         dinfo = policy_handle_find(p, r->in.domain_handle,
1412                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1413                                    struct samr_domain_info, &status);
1414         if (!NT_STATUS_IS_OK(status)) {
1415                 return status;
1416         }
1417
1418         if (sid_check_is_builtin(&dinfo->sid)) {
1419                 DEBUG(5,("_samr_QueryDisplayInfo: no users in BUILTIN\n"));
1420                 return NT_STATUS_OK;
1421         }
1422
1423         /*
1424          * calculate how many entries we will return.
1425          * based on
1426          * - the number of entries the client asked
1427          * - our limit on that
1428          * - the starting point (enumeration context)
1429          * - the buffer size the client will accept
1430          */
1431
1432         /*
1433          * We are a lot more like W2K. Instead of reading the SAM
1434          * each time to find the records we need to send back,
1435          * we read it once and link that copy to the sam handle.
1436          * For large user list (over the MAX_SAM_ENTRIES)
1437          * it's a definitive win.
1438          * second point to notice: between enumerations
1439          * our sam is now the same as it's a snapshoot.
1440          * third point: got rid of the static SAM_USER_21 struct
1441          * no more intermediate.
1442          * con: it uses much more memory, as a full copy is stored
1443          * in memory.
1444          *
1445          * If you want to change it, think twice and think
1446          * of the second point , that's really important.
1447          *
1448          * JFM, 12/20/2001
1449          */
1450
1451         if ((r->in.level < 1) || (r->in.level > 5)) {
1452                 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1453                          (unsigned int)r->in.level ));
1454                 return NT_STATUS_INVALID_INFO_CLASS;
1455         }
1456
1457         /* first limit the number of entries we will return */
1458         if(max_entries > max_sam_entries) {
1459                 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1460                           "entries, limiting to %d\n", max_entries,
1461                           max_sam_entries));
1462                 max_entries = max_sam_entries;
1463         }
1464
1465         /* calculate the size and limit on the number of entries we will
1466          * return */
1467
1468         temp_size=max_entries*struct_size;
1469
1470         if (temp_size>max_size) {
1471                 max_entries=MIN((max_size/struct_size),max_entries);;
1472                 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1473                           "only %d entries\n", max_entries));
1474         }
1475
1476         become_root();
1477
1478         /* THe following done as ROOT. Don't return without unbecome_root(). */
1479
1480         switch (r->in.level) {
1481         case 1:
1482         case 4:
1483                 if (dinfo->disp_info->users == NULL) {
1484                         dinfo->disp_info->users = pdb_search_users(
1485                                 dinfo->disp_info, ACB_NORMAL);
1486                         if (dinfo->disp_info->users == NULL) {
1487                                 unbecome_root();
1488                                 return NT_STATUS_ACCESS_DENIED;
1489                         }
1490                         DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1491                                 (unsigned  int)enum_context ));
1492                 } else {
1493                         DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1494                                 (unsigned  int)enum_context ));
1495                 }
1496
1497                 num_account = pdb_search_entries(dinfo->disp_info->users,
1498                                                  enum_context, max_entries,
1499                                                  &entries);
1500                 break;
1501         case 2:
1502                 if (dinfo->disp_info->machines == NULL) {
1503                         dinfo->disp_info->machines = pdb_search_users(
1504                                 dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
1505                         if (dinfo->disp_info->machines == NULL) {
1506                                 unbecome_root();
1507                                 return NT_STATUS_ACCESS_DENIED;
1508                         }
1509                         DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1510                                 (unsigned  int)enum_context ));
1511                 } else {
1512                         DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1513                                 (unsigned  int)enum_context ));
1514                 }
1515
1516                 num_account = pdb_search_entries(dinfo->disp_info->machines,
1517                                                  enum_context, max_entries,
1518                                                  &entries);
1519                 break;
1520         case 3:
1521         case 5:
1522                 if (dinfo->disp_info->groups == NULL) {
1523                         dinfo->disp_info->groups = pdb_search_groups(
1524                                 dinfo->disp_info);
1525                         if (dinfo->disp_info->groups == NULL) {
1526                                 unbecome_root();
1527                                 return NT_STATUS_ACCESS_DENIED;
1528                         }
1529                         DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1530                                 (unsigned  int)enum_context ));
1531                 } else {
1532                         DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1533                                 (unsigned  int)enum_context ));
1534                 }
1535
1536                 num_account = pdb_search_entries(dinfo->disp_info->groups,
1537                                                  enum_context, max_entries,
1538                                                  &entries);
1539                 break;
1540         default:
1541                 unbecome_root();
1542                 smb_panic("info class changed");
1543                 break;
1544         }
1545         unbecome_root();
1546
1547
1548         /* Now create reply structure */
1549         switch (r->in.level) {
1550         case 1:
1551                 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1552                                                 num_account, enum_context,
1553                                                 entries);
1554                 break;
1555         case 2:
1556                 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1557                                                 num_account, enum_context,
1558                                                 entries);
1559                 break;
1560         case 3:
1561                 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1562                                                 num_account, enum_context,
1563                                                 entries);
1564                 break;
1565         case 4:
1566                 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1567                                                 num_account, enum_context,
1568                                                 entries);
1569                 break;
1570         case 5:
1571                 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1572                                                 num_account, enum_context,
1573                                                 entries);
1574                 break;
1575         default:
1576                 smb_panic("info class changed");
1577                 break;
1578         }
1579
1580         if (!NT_STATUS_IS_OK(disp_ret))
1581                 return disp_ret;
1582
1583         /* calculate the total size */
1584         total_data_size=num_account*struct_size;
1585
1586         if (max_entries <= num_account) {
1587                 status = STATUS_MORE_ENTRIES;
1588         } else {
1589                 status = NT_STATUS_OK;
1590         }
1591
1592         /* Ensure we cache this enumeration. */
1593         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1594
1595         DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1596
1597         *r->out.total_size = total_data_size;
1598         *r->out.returned_size = temp_size;
1599
1600         return status;
1601 }
1602
1603 /****************************************************************
1604  _samr_QueryDisplayInfo2
1605 ****************************************************************/
1606
1607 NTSTATUS _samr_QueryDisplayInfo2(pipes_struct *p,
1608                                  struct samr_QueryDisplayInfo2 *r)
1609 {
1610         struct samr_QueryDisplayInfo q;
1611
1612         q.in.domain_handle      = r->in.domain_handle;
1613         q.in.level              = r->in.level;
1614         q.in.start_idx          = r->in.start_idx;
1615         q.in.max_entries        = r->in.max_entries;
1616         q.in.buf_size           = r->in.buf_size;
1617
1618         q.out.total_size        = r->out.total_size;
1619         q.out.returned_size     = r->out.returned_size;
1620         q.out.info              = r->out.info;
1621
1622         return _samr_QueryDisplayInfo(p, &q);
1623 }
1624
1625 /****************************************************************
1626  _samr_QueryDisplayInfo3
1627 ****************************************************************/
1628
1629 NTSTATUS _samr_QueryDisplayInfo3(pipes_struct *p,
1630                                  struct samr_QueryDisplayInfo3 *r)
1631 {
1632         struct samr_QueryDisplayInfo q;
1633
1634         q.in.domain_handle      = r->in.domain_handle;
1635         q.in.level              = r->in.level;
1636         q.in.start_idx          = r->in.start_idx;
1637         q.in.max_entries        = r->in.max_entries;
1638         q.in.buf_size           = r->in.buf_size;
1639
1640         q.out.total_size        = r->out.total_size;
1641         q.out.returned_size     = r->out.returned_size;
1642         q.out.info              = r->out.info;
1643
1644         return _samr_QueryDisplayInfo(p, &q);
1645 }
1646
1647 /*******************************************************************
1648  _samr_QueryAliasInfo
1649  ********************************************************************/
1650
1651 NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
1652                               struct samr_QueryAliasInfo *r)
1653 {
1654         struct samr_alias_info *ainfo;
1655         struct acct_info info;
1656         NTSTATUS status;
1657         union samr_AliasInfo *alias_info = NULL;
1658         const char *alias_name = NULL;
1659         const char *alias_description = NULL;
1660
1661         DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1662
1663         ainfo = policy_handle_find(p, r->in.alias_handle,
1664                                    SAMR_ALIAS_ACCESS_LOOKUP_INFO, NULL,
1665                                    struct samr_alias_info, &status);
1666         if (!NT_STATUS_IS_OK(status)) {
1667                 return status;
1668         }
1669
1670         alias_info = TALLOC_ZERO_P(p->mem_ctx, union samr_AliasInfo);
1671         if (!alias_info) {
1672                 return NT_STATUS_NO_MEMORY;
1673         }
1674
1675         become_root();
1676         status = pdb_get_aliasinfo(&ainfo->sid, &info);
1677         unbecome_root();
1678
1679         if ( !NT_STATUS_IS_OK(status))
1680                 return status;
1681
1682         /* FIXME: info contains fstrings */
1683         alias_name = talloc_strdup(r, info.acct_name);
1684         alias_description = talloc_strdup(r, info.acct_desc);
1685
1686         switch (r->in.level) {
1687         case ALIASINFOALL:
1688                 alias_info->all.name.string             = alias_name;
1689                 alias_info->all.num_members             = 1; /* ??? */
1690                 alias_info->all.description.string      = alias_description;
1691                 break;
1692         case ALIASINFONAME:
1693                 alias_info->name.string                 = alias_name;
1694                 break;
1695         case ALIASINFODESCRIPTION:
1696                 alias_info->description.string          = alias_description;
1697                 break;
1698         default:
1699                 return NT_STATUS_INVALID_INFO_CLASS;
1700         }
1701
1702         *r->out.info = alias_info;
1703
1704         DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1705
1706         return NT_STATUS_OK;
1707 }
1708
1709 /*******************************************************************
1710  _samr_LookupNames
1711  ********************************************************************/
1712
1713 NTSTATUS _samr_LookupNames(pipes_struct *p,
1714                            struct samr_LookupNames *r)
1715 {
1716         struct samr_domain_info *dinfo;
1717         NTSTATUS status;
1718         uint32 *rid;
1719         enum lsa_SidType *type;
1720         int i;
1721         int num_rids = r->in.num_names;
1722         struct samr_Ids rids, types;
1723         uint32_t num_mapped = 0;
1724
1725         DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1726
1727         dinfo = policy_handle_find(p, r->in.domain_handle,
1728                                    0 /* Don't know the acc_bits yet */, NULL,
1729                                    struct samr_domain_info, &status);
1730         if (!NT_STATUS_IS_OK(status)) {
1731                 return status;
1732         }
1733
1734         if (num_rids > MAX_SAM_ENTRIES) {
1735                 num_rids = MAX_SAM_ENTRIES;
1736                 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1737         }
1738
1739         rid = talloc_array(p->mem_ctx, uint32, num_rids);
1740         NT_STATUS_HAVE_NO_MEMORY(rid);
1741
1742         type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1743         NT_STATUS_HAVE_NO_MEMORY(type);
1744
1745         DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1746                  sid_string_dbg(&dinfo->sid)));
1747
1748         for (i = 0; i < num_rids; i++) {
1749
1750                 status = NT_STATUS_NONE_MAPPED;
1751                 type[i] = SID_NAME_UNKNOWN;
1752
1753                 rid[i] = 0xffffffff;
1754
1755                 if (sid_check_is_builtin(&dinfo->sid)) {
1756                         if (lookup_builtin_name(r->in.names[i].string,
1757                                                 &rid[i]))
1758                         {
1759                                 type[i] = SID_NAME_ALIAS;
1760                         }
1761                 } else {
1762                         lookup_global_sam_name(r->in.names[i].string, 0,
1763                                                &rid[i], &type[i]);
1764                 }
1765
1766                 if (type[i] != SID_NAME_UNKNOWN) {
1767                         num_mapped++;
1768                 }
1769         }
1770
1771         if (num_mapped == num_rids) {
1772                 status = NT_STATUS_OK;
1773         } else if (num_mapped == 0) {
1774                 status = NT_STATUS_NONE_MAPPED;
1775         } else {
1776                 status = STATUS_SOME_UNMAPPED;
1777         }
1778
1779         rids.count = num_rids;
1780         rids.ids = rid;
1781
1782         types.count = num_rids;
1783         types.ids = type;
1784
1785         *r->out.rids = rids;
1786         *r->out.types = types;
1787
1788         DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1789
1790         return status;
1791 }
1792
1793 /****************************************************************
1794  _samr_ChangePasswordUser
1795 ****************************************************************/
1796
1797 NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
1798                                   struct samr_ChangePasswordUser *r)
1799 {
1800         NTSTATUS status;
1801         bool ret = false;
1802         struct samr_user_info *uinfo;
1803         struct samu *pwd;
1804         struct samr_Password new_lmPwdHash, new_ntPwdHash, checkHash;
1805         struct samr_Password lm_pwd, nt_pwd;
1806
1807         uinfo = policy_handle_find(p, r->in.user_handle,
1808                                    SAMR_USER_ACCESS_SET_PASSWORD, NULL,
1809                                    struct samr_user_info, &status);
1810         if (!NT_STATUS_IS_OK(status)) {
1811                 return status;
1812         }
1813
1814         DEBUG(5,("_samr_ChangePasswordUser: sid:%s\n",
1815                   sid_string_dbg(&uinfo->sid)));
1816
1817         if (!(pwd = samu_new(NULL))) {
1818                 return NT_STATUS_NO_MEMORY;
1819         }
1820
1821         become_root();
1822         ret = pdb_getsampwsid(pwd, &uinfo->sid);
1823         unbecome_root();
1824
1825         if (!ret) {
1826                 TALLOC_FREE(pwd);
1827                 return NT_STATUS_WRONG_PASSWORD;
1828         }
1829
1830         {
1831                 const uint8_t *lm_pass, *nt_pass;
1832
1833                 lm_pass = pdb_get_lanman_passwd(pwd);
1834                 nt_pass = pdb_get_nt_passwd(pwd);
1835
1836                 if (!lm_pass || !nt_pass) {
1837                         status = NT_STATUS_WRONG_PASSWORD;
1838                         goto out;
1839                 }
1840
1841                 memcpy(&lm_pwd.hash, lm_pass, sizeof(lm_pwd.hash));
1842                 memcpy(&nt_pwd.hash, nt_pass, sizeof(nt_pwd.hash));
1843         }
1844
1845         /* basic sanity checking on parameters.  Do this before any database ops */
1846         if (!r->in.lm_present || !r->in.nt_present ||
1847             !r->in.old_lm_crypted || !r->in.new_lm_crypted ||
1848             !r->in.old_nt_crypted || !r->in.new_nt_crypted) {
1849                 /* we should really handle a change with lm not
1850                    present */
1851                 status = NT_STATUS_INVALID_PARAMETER_MIX;
1852                 goto out;
1853         }
1854
1855         /* decrypt and check the new lm hash */
1856         D_P16(lm_pwd.hash, r->in.new_lm_crypted->hash, new_lmPwdHash.hash);
1857         D_P16(new_lmPwdHash.hash, r->in.old_lm_crypted->hash, checkHash.hash);
1858         if (memcmp(checkHash.hash, lm_pwd.hash, 16) != 0) {
1859                 status = NT_STATUS_WRONG_PASSWORD;
1860                 goto out;
1861         }
1862
1863         /* decrypt and check the new nt hash */
1864         D_P16(nt_pwd.hash, r->in.new_nt_crypted->hash, new_ntPwdHash.hash);
1865         D_P16(new_ntPwdHash.hash, r->in.old_nt_crypted->hash, checkHash.hash);
1866         if (memcmp(checkHash.hash, nt_pwd.hash, 16) != 0) {
1867                 status = NT_STATUS_WRONG_PASSWORD;
1868                 goto out;
1869         }
1870
1871         /* The NT Cross is not required by Win2k3 R2, but if present
1872            check the nt cross hash */
1873         if (r->in.cross1_present && r->in.nt_cross) {
1874                 D_P16(lm_pwd.hash, r->in.nt_cross->hash, checkHash.hash);
1875                 if (memcmp(checkHash.hash, new_ntPwdHash.hash, 16) != 0) {
1876                         status = NT_STATUS_WRONG_PASSWORD;
1877                         goto out;
1878                 }
1879         }
1880
1881         /* The LM Cross is not required by Win2k3 R2, but if present
1882            check the lm cross hash */
1883         if (r->in.cross2_present && r->in.lm_cross) {
1884                 D_P16(nt_pwd.hash, r->in.lm_cross->hash, checkHash.hash);
1885                 if (memcmp(checkHash.hash, new_lmPwdHash.hash, 16) != 0) {
1886                         status = NT_STATUS_WRONG_PASSWORD;
1887                         goto out;
1888                 }
1889         }
1890
1891         if (!pdb_set_nt_passwd(pwd, new_ntPwdHash.hash, PDB_CHANGED) ||
1892             !pdb_set_lanman_passwd(pwd, new_lmPwdHash.hash, PDB_CHANGED)) {
1893                 status = NT_STATUS_ACCESS_DENIED;
1894                 goto out;
1895         }
1896
1897         status = pdb_update_sam_account(pwd);
1898  out:
1899         TALLOC_FREE(pwd);
1900
1901         return status;
1902 }
1903
1904 /*******************************************************************
1905  _samr_ChangePasswordUser2
1906  ********************************************************************/
1907
1908 NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
1909                                    struct samr_ChangePasswordUser2 *r)
1910 {
1911         NTSTATUS status;
1912         fstring user_name;
1913         fstring wks;
1914
1915         DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1916
1917         fstrcpy(user_name, r->in.account->string);
1918         fstrcpy(wks, r->in.server->string);
1919
1920         DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1921
1922         /*
1923          * Pass the user through the NT -> unix user mapping
1924          * function.
1925          */
1926
1927         (void)map_username(user_name);
1928
1929         /*
1930          * UNIX username case mangling not required, pass_oem_change
1931          * is case insensitive.
1932          */
1933
1934         status = pass_oem_change(user_name,
1935                                  r->in.lm_password->data,
1936                                  r->in.lm_verifier->hash,
1937                                  r->in.nt_password->data,
1938                                  r->in.nt_verifier->hash,
1939                                  NULL);
1940
1941         DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1942
1943         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1944                 return NT_STATUS_WRONG_PASSWORD;
1945         }
1946
1947         return status;
1948 }
1949
1950 /****************************************************************
1951  _samr_OemChangePasswordUser2
1952 ****************************************************************/
1953
1954 NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
1955                                       struct samr_OemChangePasswordUser2 *r)
1956 {
1957         NTSTATUS status;
1958         fstring user_name;
1959         const char *wks = NULL;
1960
1961         DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__));
1962
1963         fstrcpy(user_name, r->in.account->string);
1964         if (r->in.server && r->in.server->string) {
1965                 wks = r->in.server->string;
1966         }
1967
1968         DEBUG(5,("_samr_OemChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1969
1970         /*
1971          * Pass the user through the NT -> unix user mapping
1972          * function.
1973          */
1974
1975         (void)map_username(user_name);
1976
1977         /*
1978          * UNIX username case mangling not required, pass_oem_change
1979          * is case insensitive.
1980          */
1981
1982         if (!r->in.hash || !r->in.password) {
1983                 return NT_STATUS_INVALID_PARAMETER;
1984         }
1985
1986         status = pass_oem_change(user_name,
1987                                  r->in.password->data,
1988                                  r->in.hash->hash,
1989                                  0,
1990                                  0,
1991                                  NULL);
1992
1993         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1994                 return NT_STATUS_WRONG_PASSWORD;
1995         }
1996
1997         DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__));
1998
1999         return status;
2000 }
2001
2002 /*******************************************************************
2003  _samr_ChangePasswordUser3
2004  ********************************************************************/
2005
2006 NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
2007                                    struct samr_ChangePasswordUser3 *r)
2008 {
2009         NTSTATUS status;
2010         fstring user_name;
2011         const char *wks = NULL;
2012         uint32 reject_reason;
2013         struct samr_DomInfo1 *dominfo = NULL;
2014         struct samr_ChangeReject *reject = NULL;
2015         uint32_t tmp;
2016
2017         DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2018
2019         fstrcpy(user_name, r->in.account->string);
2020         if (r->in.server && r->in.server->string) {
2021                 wks = r->in.server->string;
2022         }
2023
2024         DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
2025
2026         /*
2027          * Pass the user through the NT -> unix user mapping
2028          * function.
2029          */
2030
2031         (void)map_username(user_name);
2032
2033         /*
2034          * UNIX username case mangling not required, pass_oem_change
2035          * is case insensitive.
2036          */
2037
2038         status = pass_oem_change(user_name,
2039                                  r->in.lm_password->data,
2040                                  r->in.lm_verifier->hash,
2041                                  r->in.nt_password->data,
2042                                  r->in.nt_verifier->hash,
2043                                  &reject_reason);
2044         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2045                 return NT_STATUS_WRONG_PASSWORD;
2046         }
2047
2048         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
2049             NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
2050
2051                 time_t u_expire, u_min_age;
2052                 uint32 account_policy_temp;
2053
2054                 dominfo = TALLOC_ZERO_P(p->mem_ctx, struct samr_DomInfo1);
2055                 if (!dominfo) {
2056                         return NT_STATUS_NO_MEMORY;
2057                 }
2058
2059                 reject = TALLOC_ZERO_P(p->mem_ctx, struct samr_ChangeReject);
2060                 if (!reject) {
2061                         return NT_STATUS_NO_MEMORY;
2062                 }
2063
2064                 become_root();
2065
2066                 /* AS ROOT !!! */
2067
2068                 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &tmp);
2069                 dominfo->min_password_length = tmp;
2070
2071                 pdb_get_account_policy(AP_PASSWORD_HISTORY, &tmp);
2072                 dominfo->password_history_length = tmp;
2073
2074                 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
2075                                        &dominfo->password_properties);
2076
2077                 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2078                 u_expire = account_policy_temp;
2079
2080                 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2081                 u_min_age = account_policy_temp;
2082
2083                 /* !AS ROOT */
2084
2085                 unbecome_root();
2086
2087                 unix_to_nt_time_abs((NTTIME *)&dominfo->max_password_age, u_expire);
2088                 unix_to_nt_time_abs((NTTIME *)&dominfo->min_password_age, u_min_age);
2089
2090                 if (lp_check_password_script() && *lp_check_password_script()) {
2091                         dominfo->password_properties |= DOMAIN_PASSWORD_COMPLEX;
2092                 }
2093
2094                 reject->reason = reject_reason;
2095
2096                 *r->out.dominfo = dominfo;
2097                 *r->out.reject = reject;
2098         }
2099
2100         DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2101
2102         return status;
2103 }
2104
2105 /*******************************************************************
2106 makes a SAMR_R_LOOKUP_RIDS structure.
2107 ********************************************************************/
2108
2109 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2110                                   const char **names,
2111                                   struct lsa_String **lsa_name_array_p)
2112 {
2113         struct lsa_String *lsa_name_array = NULL;
2114         uint32_t i;
2115
2116         *lsa_name_array_p = NULL;
2117
2118         if (num_names != 0) {
2119                 lsa_name_array = TALLOC_ZERO_ARRAY(ctx, struct lsa_String, num_names);
2120                 if (!lsa_name_array) {
2121                         return false;
2122                 }
2123         }
2124
2125         for (i = 0; i < num_names; i++) {
2126                 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2127                 init_lsa_String(&lsa_name_array[i], names[i]);
2128         }
2129
2130         *lsa_name_array_p = lsa_name_array;
2131
2132         return true;
2133 }
2134
2135 /*******************************************************************
2136  _samr_LookupRids
2137  ********************************************************************/
2138
2139 NTSTATUS _samr_LookupRids(pipes_struct *p,
2140                           struct samr_LookupRids *r)
2141 {
2142         struct samr_domain_info *dinfo;
2143         NTSTATUS status;
2144         const char **names;
2145         enum lsa_SidType *attrs = NULL;
2146         uint32 *wire_attrs = NULL;
2147         int num_rids = (int)r->in.num_rids;
2148         int i;
2149         struct lsa_Strings names_array;
2150         struct samr_Ids types_array;
2151         struct lsa_String *lsa_names = NULL;
2152
2153         DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2154
2155         dinfo = policy_handle_find(p, r->in.domain_handle,
2156                                    0 /* Don't know the acc_bits yet */, NULL,
2157                                    struct samr_domain_info, &status);
2158         if (!NT_STATUS_IS_OK(status)) {
2159                 return status;
2160         }
2161
2162         if (num_rids > 1000) {
2163                 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2164                           "to samba4 idl this is not possible\n", num_rids));
2165                 return NT_STATUS_UNSUCCESSFUL;
2166         }
2167
2168         if (num_rids) {
2169                 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
2170                 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
2171                 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
2172
2173                 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2174                         return NT_STATUS_NO_MEMORY;
2175         } else {
2176                 names = NULL;
2177                 attrs = NULL;
2178                 wire_attrs = NULL;
2179         }
2180
2181         become_root();  /* lookup_sid can require root privs */
2182         status = pdb_lookup_rids(&dinfo->sid, num_rids, r->in.rids,
2183                                  names, attrs);
2184         unbecome_root();
2185
2186         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2187                 status = NT_STATUS_OK;
2188         }
2189
2190         if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2191                                    &lsa_names)) {
2192                 return NT_STATUS_NO_MEMORY;
2193         }
2194
2195         /* Convert from enum lsa_SidType to uint32 for wire format. */
2196         for (i = 0; i < num_rids; i++) {
2197                 wire_attrs[i] = (uint32)attrs[i];
2198         }
2199
2200         names_array.count = num_rids;
2201         names_array.names = lsa_names;
2202
2203         types_array.count = num_rids;
2204         types_array.ids = wire_attrs;
2205
2206         *r->out.names = names_array;
2207         *r->out.types = types_array;
2208
2209         DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2210
2211         return status;
2212 }
2213
2214 /*******************************************************************
2215  _samr_OpenUser
2216 ********************************************************************/
2217
2218 NTSTATUS _samr_OpenUser(pipes_struct *p,
2219                         struct samr_OpenUser *r)
2220 {
2221         struct samu *sampass=NULL;
2222         DOM_SID sid;
2223         struct samr_domain_info *dinfo;
2224         struct samr_user_info *uinfo;
2225         SEC_DESC *psd = NULL;
2226         uint32    acc_granted;
2227         uint32    des_access = r->in.access_mask;
2228         uint32_t extra_access = 0;
2229         size_t    sd_size;
2230         bool ret;
2231         NTSTATUS nt_status;
2232         SE_PRIV se_rights;
2233         NTSTATUS status;
2234
2235         dinfo = policy_handle_find(p, r->in.domain_handle,
2236                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
2237                                    struct samr_domain_info, &status);
2238         if (!NT_STATUS_IS_OK(status)) {
2239                 return status;
2240         }
2241
2242         if ( !(sampass = samu_new( p->mem_ctx )) ) {
2243                 return NT_STATUS_NO_MEMORY;
2244         }
2245
2246         /* append the user's RID to it */
2247
2248         if (!sid_compose(&sid, &dinfo->sid, r->in.rid))
2249                 return NT_STATUS_NO_SUCH_USER;
2250
2251         /* check if access can be granted as requested by client. */
2252
2253         map_max_allowed_access(p->server_info->ptok, &des_access);
2254
2255         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2256         se_map_generic(&des_access, &usr_generic_mapping);
2257
2258         /*
2259          * Get the sampass first as we need to check privilages
2260          * based on what kind of user object this is.
2261          * But don't reveal info too early if it didn't exist.
2262          */
2263
2264         become_root();
2265         ret=pdb_getsampwsid(sampass, &sid);
2266         unbecome_root();
2267
2268         se_priv_copy(&se_rights, &se_priv_none);
2269
2270         /*
2271          * We do the override access checks on *open*, not at
2272          * SetUserInfo time.
2273          */
2274         if (ret) {
2275                 uint32_t acb_info = pdb_get_acct_ctrl(sampass);
2276
2277                 if ((acb_info & ACB_WSTRUST) &&
2278                                 user_has_any_privilege(p->server_info->ptok,
2279                                                 &se_machine_account)) {
2280                         /*
2281                          * SeMachineAccount is needed to add
2282                          * GENERIC_RIGHTS_USER_WRITE to a machine
2283                          * account.
2284                          */
2285                         se_priv_add(&se_rights, &se_machine_account);
2286                         DEBUG(10,("_samr_OpenUser: adding machine account "
2287                                 "rights to handle for user %s\n",
2288                                 pdb_get_username(sampass) ));
2289                 }
2290                 if ((acb_info & ACB_NORMAL) &&
2291                                 user_has_any_privilege(p->server_info->ptok,
2292                                                 &se_add_users)) {
2293                         /*
2294                          * SeAddUsers is needed to add
2295                          * GENERIC_RIGHTS_USER_WRITE to a normal
2296                          * account.
2297                          */
2298                         se_priv_add(&se_rights, &se_add_users);
2299                         DEBUG(10,("_samr_OpenUser: adding add user "
2300                                 "rights to handle for user %s\n",
2301                                 pdb_get_username(sampass) ));
2302                 }
2303                 /*
2304                  * Cheat - allow GENERIC_RIGHTS_USER_WRITE if pipe user is
2305                  * in DOMAIN_GROUP_RID_ADMINS. This is almost certainly not
2306                  * what Windows does but is a hack for people who haven't
2307                  * set up privilages on groups in Samba.
2308                  */
2309                 if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
2310                         if (lp_enable_privileges() && nt_token_check_domain_rid(p->server_info->ptok,
2311                                                         DOMAIN_GROUP_RID_ADMINS)) {
2312                                 des_access &= ~GENERIC_RIGHTS_USER_WRITE;
2313                                 extra_access = GENERIC_RIGHTS_USER_WRITE;
2314                                 DEBUG(4,("_samr_OpenUser: Allowing "
2315                                         "GENERIC_RIGHTS_USER_WRITE for "
2316                                         "rid admins\n"));
2317                         }
2318                 }
2319         }
2320
2321         TALLOC_FREE(sampass);
2322
2323         nt_status = access_check_samr_object(psd, p->server_info->ptok,
2324                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2325                 &acc_granted, "_samr_OpenUser");
2326
2327         if ( !NT_STATUS_IS_OK(nt_status) )
2328                 return nt_status;
2329
2330         /* check that the SID exists in our domain. */
2331         if (ret == False) {
2332                 return NT_STATUS_NO_SUCH_USER;
2333         }
2334
2335         /* If we did the rid admins hack above, allow access. */
2336         acc_granted |= extra_access;
2337
2338         uinfo = policy_handle_create(p, r->out.user_handle, acc_granted,
2339                                      struct samr_user_info, &nt_status);
2340         if (!NT_STATUS_IS_OK(nt_status)) {
2341                 return nt_status;
2342         }
2343         uinfo->sid = sid;
2344
2345         return NT_STATUS_OK;
2346 }
2347
2348 /*************************************************************************
2349  *************************************************************************/
2350
2351 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2352                                             DATA_BLOB *blob,
2353                                             struct lsa_BinaryString **_r)
2354 {
2355         struct lsa_BinaryString *r;
2356
2357         if (!blob || !_r) {
2358                 return NT_STATUS_INVALID_PARAMETER;
2359         }
2360
2361         r = TALLOC_ZERO_P(mem_ctx, struct lsa_BinaryString);
2362         if (!r) {
2363                 return NT_STATUS_NO_MEMORY;
2364         }
2365
2366         r->array = TALLOC_ZERO_ARRAY(mem_ctx, uint16_t, blob->length/2);
2367         if (!r->array) {
2368                 return NT_STATUS_NO_MEMORY;
2369         }
2370         memcpy(r->array, blob->data, blob->length);
2371         r->size = blob->length;
2372         r->length = blob->length;
2373
2374         if (!r->array) {
2375                 return NT_STATUS_NO_MEMORY;
2376         }
2377
2378         *_r = r;
2379
2380         return NT_STATUS_OK;
2381 }
2382
2383 /*************************************************************************
2384  get_user_info_1.
2385  *************************************************************************/
2386
2387 static NTSTATUS get_user_info_1(TALLOC_CTX *mem_ctx,
2388                                 struct samr_UserInfo1 *r,
2389                                 struct samu *pw,
2390                                 DOM_SID *domain_sid)
2391 {
2392         const DOM_SID *sid_group;
2393         uint32_t primary_gid;
2394
2395         become_root();
2396         sid_group = pdb_get_group_sid(pw);
2397         unbecome_root();
2398
2399         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2400                 DEBUG(0, ("get_user_info_1: User %s has Primary Group SID %s, \n"
2401                           "which conflicts with the domain sid %s.  Failing operation.\n",
2402                           pdb_get_username(pw), sid_string_dbg(sid_group),
2403                           sid_string_dbg(domain_sid)));
2404                 return NT_STATUS_UNSUCCESSFUL;
2405         }
2406
2407         r->account_name.string          = talloc_strdup(mem_ctx, pdb_get_username(pw));
2408         r->full_name.string             = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2409         r->primary_gid                  = primary_gid;
2410         r->description.string           = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2411         r->comment.string               = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2412
2413         return NT_STATUS_OK;
2414 }
2415
2416 /*************************************************************************
2417  get_user_info_2.
2418  *************************************************************************/
2419
2420 static NTSTATUS get_user_info_2(TALLOC_CTX *mem_ctx,
2421                                 struct samr_UserInfo2 *r,
2422                                 struct samu *pw)
2423 {
2424         r->comment.string               = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2425         r->unknown.string               = NULL;
2426         r->country_code                 = 0;
2427         r->code_page                    = 0;
2428
2429         return NT_STATUS_OK;
2430 }
2431
2432 /*************************************************************************
2433  get_user_info_3.
2434  *************************************************************************/
2435
2436 static NTSTATUS get_user_info_3(TALLOC_CTX *mem_ctx,
2437                                 struct samr_UserInfo3 *r,
2438                                 struct samu *pw,
2439                                 DOM_SID *domain_sid)
2440 {
2441         const DOM_SID *sid_user, *sid_group;
2442         uint32_t rid, primary_gid;
2443
2444         sid_user = pdb_get_user_sid(pw);
2445
2446         if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2447                 DEBUG(0, ("get_user_info_3: User %s has SID %s, \nwhich conflicts with "
2448                           "the domain sid %s.  Failing operation.\n",
2449                           pdb_get_username(pw), sid_string_dbg(sid_user),
2450                           sid_string_dbg(domain_sid)));
2451                 return NT_STATUS_UNSUCCESSFUL;
2452         }
2453
2454         become_root();
2455         sid_group = pdb_get_group_sid(pw);
2456         unbecome_root();
2457
2458         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2459                 DEBUG(0, ("get_user_info_3: User %s has Primary Group SID %s, \n"
2460                           "which conflicts with the domain sid %s.  Failing operation.\n",
2461                           pdb_get_username(pw), sid_string_dbg(sid_group),
2462                           sid_string_dbg(domain_sid)));
2463                 return NT_STATUS_UNSUCCESSFUL;
2464         }
2465
2466         unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2467         unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2468         unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2469         unix_to_nt_time(&r->allow_password_change, pdb_get_pass_can_change_time(pw));
2470         unix_to_nt_time(&r->force_password_change, pdb_get_pass_must_change_time(pw));
2471
2472         r->account_name.string  = talloc_strdup(mem_ctx, pdb_get_username(pw));
2473         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2474         r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2475         r->home_drive.string    = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2476         r->logon_script.string  = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2477         r->profile_path.string  = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2478         r->workstations.string  = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2479
2480         r->logon_hours          = get_logon_hours_from_pdb(mem_ctx, pw);
2481         r->rid                  = rid;
2482         r->primary_gid          = primary_gid;
2483         r->acct_flags           = pdb_get_acct_ctrl(pw);
2484         r->bad_password_count   = pdb_get_bad_password_count(pw);
2485         r->logon_count          = pdb_get_logon_count(pw);
2486
2487         return NT_STATUS_OK;
2488 }
2489
2490 /*************************************************************************
2491  get_user_info_4.
2492  *************************************************************************/
2493
2494 static NTSTATUS get_user_info_4(TALLOC_CTX *mem_ctx,
2495                                 struct samr_UserInfo4 *r,
2496                                 struct samu *pw)
2497 {
2498         r->logon_hours          = get_logon_hours_from_pdb(mem_ctx, pw);
2499
2500         return NT_STATUS_OK;
2501 }
2502
2503 /*************************************************************************
2504  get_user_info_5.
2505  *************************************************************************/
2506
2507 static NTSTATUS get_user_info_5(TALLOC_CTX *mem_ctx,
2508                                 struct samr_UserInfo5 *r,
2509                                 struct samu *pw,
2510                                 DOM_SID *domain_sid)
2511 {
2512         const DOM_SID *sid_user, *sid_group;
2513         uint32_t rid, primary_gid;
2514
2515         sid_user = pdb_get_user_sid(pw);
2516
2517         if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2518                 DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
2519                           "the domain sid %s.  Failing operation.\n",
2520                           pdb_get_username(pw), sid_string_dbg(sid_user),
2521                           sid_string_dbg(domain_sid)));
2522                 return NT_STATUS_UNSUCCESSFUL;
2523         }
2524
2525         become_root();
2526         sid_group = pdb_get_group_sid(pw);
2527         unbecome_root();
2528
2529         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2530                 DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
2531                           "which conflicts with the domain sid %s.  Failing operation.\n",
2532                           pdb_get_username(pw), sid_string_dbg(sid_group),
2533                           sid_string_dbg(domain_sid)));
2534                 return NT_STATUS_UNSUCCESSFUL;
2535         }
2536
2537         unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2538         unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2539         unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2540         unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2541
2542         r->account_name.string  = talloc_strdup(mem_ctx, pdb_get_username(pw));
2543         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2544         r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2545         r->home_drive.string    = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2546         r->logon_script.string  = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2547         r->profile_path.string  = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2548         r->description.string   = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2549         r->workstations.string  = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2550
2551         r->logon_hours          = get_logon_hours_from_pdb(mem_ctx, pw);
2552         r->rid                  = rid;
2553         r->primary_gid          = primary_gid;
2554         r->acct_flags           = pdb_get_acct_ctrl(pw);
2555         r->bad_password_count   = pdb_get_bad_password_count(pw);
2556         r->logon_count          = pdb_get_logon_count(pw);
2557
2558         return NT_STATUS_OK;
2559 }
2560
2561 /*************************************************************************
2562  get_user_info_6.
2563  *************************************************************************/
2564
2565 static NTSTATUS get_user_info_6(TALLOC_CTX *mem_ctx,
2566                                 struct samr_UserInfo6 *r,
2567                                 struct samu *pw)
2568 {
2569         r->account_name.string  = talloc_strdup(mem_ctx, pdb_get_username(pw));
2570         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2571
2572         return NT_STATUS_OK;
2573 }
2574
2575 /*************************************************************************
2576  get_user_info_7. Safe. Only gives out account_name.
2577  *************************************************************************/
2578
2579 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2580                                 struct samr_UserInfo7 *r,
2581                                 struct samu *smbpass)
2582 {
2583         r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2584         if (!r->account_name.string) {
2585                 return NT_STATUS_NO_MEMORY;
2586         }
2587
2588         return NT_STATUS_OK;
2589 }
2590
2591 /*************************************************************************
2592  get_user_info_8.
2593  *************************************************************************/
2594
2595 static NTSTATUS get_user_info_8(TALLOC_CTX *mem_ctx,
2596                                 struct samr_UserInfo8 *r,
2597                                 struct samu *pw)
2598 {
2599         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2600
2601         return NT_STATUS_OK;
2602 }
2603
2604 /*************************************************************************
2605  get_user_info_9. Only gives out primary group SID.
2606  *************************************************************************/
2607
2608 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2609                                 struct samr_UserInfo9 *r,
2610                                 struct samu *smbpass)
2611 {
2612         r->primary_gid = pdb_get_group_rid(smbpass);
2613
2614         return NT_STATUS_OK;
2615 }
2616
2617 /*************************************************************************
2618  get_user_info_10.
2619  *************************************************************************/
2620
2621 static NTSTATUS get_user_info_10(TALLOC_CTX *mem_ctx,
2622                                  struct samr_UserInfo10 *r,
2623                                  struct samu *pw)
2624 {
2625         r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2626         r->home_drive.string    = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2627
2628         return NT_STATUS_OK;
2629 }
2630
2631 /*************************************************************************
2632  get_user_info_11.
2633  *************************************************************************/
2634
2635 static NTSTATUS get_user_info_11(TALLOC_CTX *mem_ctx,
2636                                  struct samr_UserInfo11 *r,
2637                                  struct samu *pw)
2638 {
2639         r->logon_script.string  = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2640
2641         return NT_STATUS_OK;
2642 }
2643
2644 /*************************************************************************
2645  get_user_info_12.
2646  *************************************************************************/
2647
2648 static NTSTATUS get_user_info_12(TALLOC_CTX *mem_ctx,
2649                                  struct samr_UserInfo12 *r,
2650                                  struct samu *pw)
2651 {
2652         r->profile_path.string  = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2653
2654         return NT_STATUS_OK;
2655 }
2656
2657 /*************************************************************************
2658  get_user_info_13.
2659  *************************************************************************/
2660
2661 static NTSTATUS get_user_info_13(TALLOC_CTX *mem_ctx,
2662                                  struct samr_UserInfo13 *r,
2663                                  struct samu *pw)
2664 {
2665         r->description.string   = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2666
2667         return NT_STATUS_OK;
2668 }
2669
2670 /*************************************************************************
2671  get_user_info_14.
2672  *************************************************************************/
2673
2674 static NTSTATUS get_user_info_14(TALLOC_CTX *mem_ctx,
2675                                  struct samr_UserInfo14 *r,
2676                                  struct samu *pw)
2677 {
2678         r->workstations.string  = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2679
2680         return NT_STATUS_OK;
2681 }
2682
2683 /*************************************************************************
2684  get_user_info_16. Safe. Only gives out acb bits.
2685  *************************************************************************/
2686
2687 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2688                                  struct samr_UserInfo16 *r,
2689                                  struct samu *smbpass)
2690 {
2691         r->acct_flags = pdb_get_acct_ctrl(smbpass);
2692
2693         return NT_STATUS_OK;
2694 }
2695
2696 /*************************************************************************
2697  get_user_info_17.
2698  *************************************************************************/
2699
2700 static NTSTATUS get_user_info_17(TALLOC_CTX *mem_ctx,
2701                                  struct samr_UserInfo17 *r,
2702                                  struct samu *pw)
2703 {
2704         unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2705
2706         return NT_STATUS_OK;
2707 }
2708
2709 /*************************************************************************
2710  get_user_info_18. OK - this is the killer as it gives out password info.
2711  Ensure that this is only allowed on an encrypted connection with a root
2712  user. JRA.
2713  *************************************************************************/
2714
2715 static NTSTATUS get_user_info_18(pipes_struct *p,
2716                                  TALLOC_CTX *mem_ctx,
2717                                  struct samr_UserInfo18 *r,
2718                                  DOM_SID *user_sid)
2719 {
2720         struct samu *smbpass=NULL;
2721         bool ret;
2722
2723         ZERO_STRUCTP(r);
2724
2725         if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2726                 return NT_STATUS_ACCESS_DENIED;
2727         }
2728
2729         if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
2730                 return NT_STATUS_ACCESS_DENIED;
2731         }
2732
2733         /*
2734          * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2735          */
2736
2737         if ( !(smbpass = samu_new( mem_ctx )) ) {
2738                 return NT_STATUS_NO_MEMORY;
2739         }
2740
2741         ret = pdb_getsampwsid(smbpass, user_sid);
2742
2743         if (ret == False) {
2744                 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2745                 TALLOC_FREE(smbpass);
2746                 return (geteuid() == sec_initial_uid()) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2747         }
2748
2749         DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2750
2751         if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2752                 TALLOC_FREE(smbpass);
2753                 return NT_STATUS_ACCOUNT_DISABLED;
2754         }
2755
2756         r->lm_pwd_active = true;
2757         r->nt_pwd_active = true;
2758         memcpy(r->lm_pwd.hash, pdb_get_lanman_passwd(smbpass), 16);
2759         memcpy(r->nt_pwd.hash, pdb_get_nt_passwd(smbpass), 16);
2760         r->password_expired = 0; /* FIXME */
2761
2762         TALLOC_FREE(smbpass);
2763
2764         return NT_STATUS_OK;
2765 }
2766
2767 /*************************************************************************
2768  get_user_info_20
2769  *************************************************************************/
2770
2771 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2772                                  struct samr_UserInfo20 *r,
2773                                  struct samu *sampass)
2774 {
2775         const char *munged_dial = NULL;
2776         DATA_BLOB blob;
2777         NTSTATUS status;
2778         struct lsa_BinaryString *parameters = NULL;
2779
2780         ZERO_STRUCTP(r);
2781
2782         munged_dial = pdb_get_munged_dial(sampass);
2783
2784         DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2785                 munged_dial, (int)strlen(munged_dial)));
2786
2787         if (munged_dial) {
2788                 blob = base64_decode_data_blob(munged_dial);
2789         } else {
2790                 blob = data_blob_string_const_null("");
2791         }
2792
2793         status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2794         data_blob_free(&blob);
2795         if (!NT_STATUS_IS_OK(status)) {
2796                 return status;
2797         }
2798
2799         r->parameters = *parameters;
2800
2801         return NT_STATUS_OK;
2802 }
2803
2804
2805 /*************************************************************************
2806  get_user_info_21
2807  *************************************************************************/
2808
2809 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2810                                  struct samr_UserInfo21 *r,
2811                                  struct samu *pw,
2812                                  DOM_SID *domain_sid,
2813                                  uint32_t acc_granted)
2814 {
2815         NTSTATUS status;
2816         const DOM_SID *sid_user, *sid_group;
2817         uint32_t rid, primary_gid;
2818         NTTIME force_password_change;
2819         time_t must_change_time;
2820         struct lsa_BinaryString *parameters = NULL;
2821         const char *munged_dial = NULL;
2822         DATA_BLOB blob;
2823
2824         ZERO_STRUCTP(r);
2825
2826         sid_user = pdb_get_user_sid(pw);
2827
2828         if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2829                 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2830                           "the domain sid %s.  Failing operation.\n",
2831                           pdb_get_username(pw), sid_string_dbg(sid_user),
2832                           sid_string_dbg(domain_sid)));
2833                 return NT_STATUS_UNSUCCESSFUL;
2834         }
2835
2836         become_root();
2837         sid_group = pdb_get_group_sid(pw);
2838         unbecome_root();
2839
2840         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2841                 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2842                           "which conflicts with the domain sid %s.  Failing operation.\n",
2843                           pdb_get_username(pw), sid_string_dbg(sid_group),
2844                           sid_string_dbg(domain_sid)));
2845                 return NT_STATUS_UNSUCCESSFUL;
2846         }
2847
2848         unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2849         unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2850         unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2851         unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2852         unix_to_nt_time(&r->allow_password_change, pdb_get_pass_can_change_time(pw));
2853
2854         must_change_time = pdb_get_pass_must_change_time(pw);
2855         if (must_change_time == get_time_t_max()) {
2856                 unix_to_nt_time_abs(&force_password_change, must_change_time);
2857         } else {
2858                 unix_to_nt_time(&force_password_change, must_change_time);
2859         }
2860
2861         munged_dial = pdb_get_munged_dial(pw);
2862         if (munged_dial) {
2863                 blob = base64_decode_data_blob(munged_dial);
2864         } else {
2865                 blob = data_blob_string_const_null("");
2866         }
2867
2868         status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2869         data_blob_free(&blob);
2870         if (!NT_STATUS_IS_OK(status)) {
2871                 return status;
2872         }
2873
2874         r->force_password_change        = force_password_change;
2875
2876         r->account_name.string          = talloc_strdup(mem_ctx, pdb_get_username(pw));
2877         r->full_name.string             = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2878         r->home_directory.string        = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2879         r->home_drive.string            = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2880         r->logon_script.string          = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2881         r->profile_path.string          = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2882         r->description.string           = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2883         r->workstations.string          = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2884         r->comment.string               = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2885
2886         r->logon_hours                  = get_logon_hours_from_pdb(mem_ctx, pw);
2887         r->parameters                   = *parameters;
2888         r->rid                          = rid;
2889         r->primary_gid                  = primary_gid;
2890         r->acct_flags                   = pdb_get_acct_ctrl(pw);
2891         r->bad_password_count           = pdb_get_bad_password_count(pw);
2892         r->logon_count                  = pdb_get_logon_count(pw);
2893         r->fields_present               = pdb_build_fields_present(pw);
2894         r->password_expired             = (pdb_get_pass_must_change_time(pw) == 0) ?
2895                                                 PASS_MUST_CHANGE_AT_NEXT_LOGON : 0;
2896         r->country_code                 = 0;
2897         r->code_page                    = 0;
2898         r->lm_password_set              = 0;
2899         r->nt_password_set              = 0;
2900
2901 #if 0
2902
2903         /*
2904           Look at a user on a real NT4 PDC with usrmgr, press
2905           'ok'. Then you will see that fields_present is set to
2906           0x08f827fa. Look at the user immediately after that again,
2907           and you will see that 0x00fffff is returned. This solves
2908           the problem that you get access denied after having looked
2909           at the user.
2910           -- Volker
2911         */
2912
2913 #endif
2914
2915
2916         return NT_STATUS_OK;
2917 }
2918
2919 /*******************************************************************
2920  _samr_QueryUserInfo
2921  ********************************************************************/
2922
2923 NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
2924                              struct samr_QueryUserInfo *r)
2925 {
2926         NTSTATUS status;
2927         union samr_UserInfo *user_info = NULL;
2928         struct samr_user_info *uinfo;
2929         DOM_SID domain_sid;
2930         uint32 rid;
2931         bool ret = false;
2932         struct samu *pwd = NULL;
2933         uint32_t acc_required, acc_granted;
2934
2935         switch (r->in.level) {
2936         case 1: /* UserGeneralInformation */
2937                 /* USER_READ_GENERAL */
2938                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC;
2939                 break;
2940         case 2: /* UserPreferencesInformation */
2941                 /* USER_READ_PREFERENCES | USER_READ_GENERAL */
2942                 acc_required = SAMR_USER_ACCESS_GET_LOCALE |
2943                                SAMR_USER_ACCESS_GET_NAME_ETC;
2944                 break;
2945         case 3: /* UserLogonInformation */
2946                 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
2947                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC |
2948                                SAMR_USER_ACCESS_GET_LOCALE |
2949                                SAMR_USER_ACCESS_GET_LOGONINFO |
2950                                SAMR_USER_ACCESS_GET_ATTRIBUTES;
2951                 break;
2952         case 4: /* UserLogonHoursInformation */
2953                 /* USER_READ_LOGON */
2954                 acc_required = SAMR_USER_ACCESS_GET_LOGONINFO;
2955                 break;
2956         case 5: /* UserAccountInformation */
2957                 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
2958                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC |
2959                                SAMR_USER_ACCESS_GET_LOCALE |
2960                                SAMR_USER_ACCESS_GET_LOGONINFO |
2961                                SAMR_USER_ACCESS_GET_ATTRIBUTES;
2962                 break;
2963         case 6: /* UserNameInformation */
2964         case 7: /* UserAccountNameInformation */
2965         case 8: /* UserFullNameInformation */
2966         case 9: /* UserPrimaryGroupInformation */
2967         case 13: /* UserAdminCommentInformation */
2968                 /* USER_READ_GENERAL */
2969                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC;
2970                 break;
2971         case 10: /* UserHomeInformation */
2972         case 11: /* UserScriptInformation */
2973         case 12: /* UserProfileInformation */
2974         case 14: /* UserWorkStationsInformation */
2975                 /* USER_READ_LOGON */
2976                 acc_required = SAMR_USER_ACCESS_GET_LOGONINFO;
2977                 break;
2978         case 16: /* UserControlInformation */
2979         case 17: /* UserExpiresInformation */
2980         case 20: /* UserParametersInformation */
2981                 /* USER_READ_ACCOUNT */
2982                 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
2983                 break;
2984         case 21: /* UserAllInformation */
2985                 /* FIXME! - gd */
2986                 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
2987                 break;
2988         case 18: /* UserInternal1Information */
2989                 /* FIXME! - gd */
2990                 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
2991                 break;
2992         case 23: /* UserInternal4Information */
2993         case 24: /* UserInternal4InformationNew */
2994         case 25: /* UserInternal4InformationNew */
2995         case 26: /* UserInternal5InformationNew */
2996         default:
2997                 return NT_STATUS_INVALID_INFO_CLASS;
2998                 break;
2999         }
3000
3001         uinfo = policy_handle_find(p, r->in.user_handle,
3002                                    acc_required, &acc_granted,
3003                                    struct samr_user_info, &status);
3004         if (!NT_STATUS_IS_OK(status)) {
3005                 return status;
3006         }
3007
3008         domain_sid = uinfo->sid;
3009
3010         sid_split_rid(&domain_sid, &rid);
3011
3012         if (!sid_check_is_in_our_domain(&uinfo->sid))
3013                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3014
3015         DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
3016                  sid_string_dbg(&uinfo->sid)));
3017
3018         user_info = TALLOC_ZERO_P(p->mem_ctx, union samr_UserInfo);
3019         if (!user_info) {
3020                 return NT_STATUS_NO_MEMORY;
3021         }
3022
3023         DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
3024
3025         if (!(pwd = samu_new(p->mem_ctx))) {
3026                 return NT_STATUS_NO_MEMORY;
3027         }
3028
3029         become_root();
3030         ret = pdb_getsampwsid(pwd, &uinfo->sid);
3031         unbecome_root();
3032
3033         if (ret == false) {
3034                 DEBUG(4,("User %s not found\n", sid_string_dbg(&uinfo->sid)));
3035                 TALLOC_FREE(pwd);
3036                 return NT_STATUS_NO_SUCH_USER;
3037         }
3038
3039         DEBUG(3,("User:[%s]\n", pdb_get_username(pwd)));
3040
3041         samr_clear_sam_passwd(pwd);
3042
3043         switch (r->in.level) {
3044         case 1:
3045                 status = get_user_info_1(p->mem_ctx, &user_info->info1, pwd, &domain_sid);
3046                 break;
3047         case 2:
3048                 status = get_user_info_2(p->mem_ctx, &user_info->info2, pwd);
3049                 break;
3050         case 3:
3051                 status = get_user_info_3(p->mem_ctx, &user_info->info3, pwd, &domain_sid);
3052                 break;
3053         case 4:
3054                 status = get_user_info_4(p->mem_ctx, &user_info->info4, pwd);
3055                 break;
3056         case 5:
3057                 status = get_user_info_5(p->mem_ctx, &user_info->info5, pwd, &domain_sid);
3058                 break;
3059         case 6:
3060                 status = get_user_info_6(p->mem_ctx, &user_info->info6, pwd);
3061                 break;
3062         case 7:
3063                 status = get_user_info_7(p->mem_ctx, &user_info->info7, pwd);
3064                 break;
3065         case 8:
3066                 status = get_user_info_8(p->mem_ctx, &user_info->info8, pwd);
3067                 break;
3068         case 9:
3069                 status = get_user_info_9(p->mem_ctx, &user_info->info9, pwd);
3070                 break;
3071         case 10:
3072                 status = get_user_info_10(p->mem_ctx, &user_info->info10, pwd);
3073                 break;
3074         case 11:
3075                 status = get_user_info_11(p->mem_ctx, &user_info->info11, pwd);
3076                 break;
3077         case 12:
3078                 status = get_user_info_12(p->mem_ctx, &user_info->info12, pwd);
3079                 break;
3080         case 13:
3081                 status = get_user_info_13(p->mem_ctx, &user_info->info13, pwd);
3082                 break;
3083         case 14:
3084                 status = get_user_info_14(p->mem_ctx, &user_info->info14, pwd);
3085                 break;
3086         case 16:
3087                 status = get_user_info_16(p->mem_ctx, &user_info->info16, pwd);
3088                 break;
3089         case 17:
3090                 status = get_user_info_17(p->mem_ctx, &user_info->info17, pwd);
3091                 break;
3092         case 18:
3093                 /* level 18 is special */
3094                 status = get_user_info_18(p, p->mem_ctx, &user_info->info18,
3095                                           &uinfo->sid);
3096                 break;
3097         case 20:
3098                 status = get_user_info_20(p->mem_ctx, &user_info->info20, pwd);
3099                 break;
3100         case 21:
3101                 status = get_user_info_21(p->mem_ctx, &user_info->info21, pwd, &domain_sid, acc_granted);
3102                 break;
3103         default:
3104                 status = NT_STATUS_INVALID_INFO_CLASS;
3105                 break;
3106         }
3107
3108         if (!NT_STATUS_IS_OK(status)) {
3109                 goto done;
3110         }
3111
3112         *r->out.info = user_info;
3113
3114  done:
3115         TALLOC_FREE(pwd);
3116
3117         DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
3118
3119         return status;
3120 }
3121
3122 /****************************************************************
3123 ****************************************************************/
3124
3125 NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
3126                               struct samr_QueryUserInfo2 *r)
3127 {
3128         struct samr_QueryUserInfo u;
3129
3130         u.in.user_handle        = r->in.user_handle;
3131         u.in.level              = r->in.level;
3132         u.out.info              = r->out.info;
3133
3134         return _samr_QueryUserInfo(p, &u);
3135 }
3136
3137 /*******************************************************************
3138  _samr_GetGroupsForUser
3139  ********************************************************************/
3140
3141 NTSTATUS _samr_GetGroupsForUser(pipes_struct *p,
3142                                 struct samr_GetGroupsForUser *r)
3143 {
3144         struct samr_user_info *uinfo;
3145         struct samu *sam_pass=NULL;
3146         DOM_SID *sids;
3147         struct samr_RidWithAttribute dom_gid;
3148         struct samr_RidWithAttribute *gids = NULL;
3149         uint32 primary_group_rid;
3150         size_t num_groups = 0;
3151         gid_t *unix_gids;
3152         size_t i, num_gids;
3153         bool ret;
3154         NTSTATUS result;
3155         bool success = False;
3156
3157         struct samr_RidWithAttributeArray *rids = NULL;
3158
3159         /*
3160          * from the SID in the request:
3161          * we should send back the list of DOMAIN GROUPS
3162          * the user is a member of
3163          *
3164          * and only the DOMAIN GROUPS
3165          * no ALIASES !!! neither aliases of the domain
3166          * nor aliases of the builtin SID
3167          *
3168          * JFM, 12/2/2001
3169          */
3170
3171         DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
3172
3173         uinfo = policy_handle_find(p, r->in.user_handle,
3174                                    SAMR_USER_ACCESS_GET_GROUPS, NULL,
3175                                    struct samr_user_info, &result);
3176         if (!NT_STATUS_IS_OK(result)) {
3177                 return result;
3178         }
3179
3180         rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidWithAttributeArray);
3181         if (!rids) {
3182                 return NT_STATUS_NO_MEMORY;
3183         }
3184
3185         if (!sid_check_is_in_our_domain(&uinfo->sid))
3186                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3187
3188         if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
3189                 return NT_STATUS_NO_MEMORY;
3190         }
3191
3192         become_root();
3193         ret = pdb_getsampwsid(sam_pass, &uinfo->sid);
3194         unbecome_root();
3195
3196         if (!ret) {
3197                 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
3198                            sid_string_dbg(&uinfo->sid)));
3199                 return NT_STATUS_NO_SUCH_USER;
3200         }
3201
3202         sids = NULL;
3203
3204         /* make both calls inside the root block */
3205         become_root();
3206         result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
3207                                             &sids, &unix_gids, &num_groups);
3208         if ( NT_STATUS_IS_OK(result) ) {
3209                 success = sid_peek_check_rid(get_global_sam_sid(),
3210                                              pdb_get_group_sid(sam_pass),
3211                                              &primary_group_rid);
3212         }
3213         unbecome_root();
3214
3215         if (!NT_STATUS_IS_OK(result)) {
3216                 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
3217                            sid_string_dbg(&uinfo->sid)));
3218                 return result;
3219         }
3220
3221         if ( !success ) {
3222                 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
3223                           sid_string_dbg(pdb_get_group_sid(sam_pass)),
3224                           pdb_get_username(sam_pass)));
3225                 TALLOC_FREE(sam_pass);
3226                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3227         }
3228
3229         gids = NULL;
3230         num_gids = 0;
3231
3232         dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
3233                               SE_GROUP_ENABLED);
3234         dom_gid.rid = primary_group_rid;
3235         ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
3236
3237         for (i=0; i<num_groups; i++) {
3238
3239                 if (!sid_peek_check_rid(get_global_sam_sid(),
3240                                         &(sids[i]), &dom_gid.rid)) {
3241                         DEBUG(10, ("Found sid %s not in our domain\n",
3242                                    sid_string_dbg(&sids[i])));
3243                         continue;
3244                 }
3245
3246                 if (dom_gid.rid == primary_group_rid) {
3247                         /* We added the primary group directly from the
3248                          * sam_account. The other SIDs are unique from
3249                          * enum_group_memberships */
3250                         continue;
3251                 }
3252
3253                 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
3254         }
3255
3256         rids->count = num_gids;
3257         rids->rids = gids;
3258
3259         *r->out.rids = rids;
3260
3261         DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
3262
3263         return result;
3264 }
3265
3266 /*******************************************************************
3267  _samr_QueryDomainInfo
3268  ********************************************************************/
3269
3270 NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
3271                                struct samr_QueryDomainInfo *r)
3272 {
3273         NTSTATUS status = NT_STATUS_OK;
3274         struct samr_domain_info *dinfo;
3275         union samr_DomainInfo *dom_info;
3276         time_t u_expire, u_min_age;
3277
3278         time_t u_lock_duration, u_reset_time;
3279         uint32_t u_logout;
3280
3281         uint32 account_policy_temp;
3282
3283         time_t seq_num;
3284         uint32 server_role;
3285         uint32_t acc_required;
3286
3287         DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3288
3289         switch (r->in.level) {
3290         case 1: /* DomainPasswordInformation */
3291         case 12: /* DomainLockoutInformation */
3292                 /* DOMAIN_READ_PASSWORD_PARAMETERS */
3293                 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1;
3294                 break;
3295         case 11: /* DomainGeneralInformation2 */
3296                 /* DOMAIN_READ_PASSWORD_PARAMETERS |
3297                  * DOMAIN_READ_OTHER_PARAMETERS */
3298                 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 |
3299                                SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2;
3300                 break;
3301         case 2: /* DomainGeneralInformation */
3302         case 3: /* DomainLogoffInformation */
3303         case 4: /* DomainOemInformation */
3304         case 5: /* DomainReplicationInformation */
3305         case 6: /* DomainReplicationInformation */
3306         case 7: /* DomainServerRoleInformation */
3307         case 8: /* DomainModifiedInformation */
3308         case 9: /* DomainStateInformation */
3309         case 10: /* DomainUasInformation */
3310         case 13: /* DomainModifiedInformation2 */
3311                 /* DOMAIN_READ_OTHER_PARAMETERS */
3312                 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2;
3313                 break;
3314         default:
3315                 return NT_STATUS_INVALID_INFO_CLASS;
3316         }
3317
3318         dinfo = policy_handle_find(p, r->in.domain_handle,
3319                                    acc_required, NULL,
3320                                    struct samr_domain_info, &status);
3321         if (!NT_STATUS_IS_OK(status)) {
3322                 return status;
3323         }
3324
3325         dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
3326         if (!dom_info) {
3327                 return NT_STATUS_NO_MEMORY;
3328         }
3329
3330         switch (r->in.level) {
3331                 case 1:
3332
3333                         become_root();
3334
3335                         /* AS ROOT !!! */
3336
3337                         pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
3338                                                &account_policy_temp);
3339                         dom_info->info1.min_password_length = account_policy_temp;
3340
3341                         pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
3342                         dom_info->info1.password_history_length = account_policy_temp;
3343
3344                         pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
3345                                 &dom_info->info1.password_properties);
3346
3347                         pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
3348                         u_expire = account_policy_temp;
3349
3350                         pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
3351                         u_min_age = account_policy_temp;
3352
3353                         /* !AS ROOT */
3354
3355                         unbecome_root();
3356
3357                         unix_to_nt_time_abs((NTTIME *)&dom_info->info1.max_password_age, u_expire);
3358                         unix_to_nt_time_abs((NTTIME *)&dom_info->info1.min_password_age, u_min_age);
3359
3360                         if (lp_check_password_script() && *lp_check_password_script()) {
3361                                 dom_info->info1.password_properties |= DOMAIN_PASSWORD_COMPLEX;
3362                         }
3363
3364                         break;
3365                 case 2:
3366
3367                         become_root();
3368
3369                         /* AS ROOT !!! */
3370
3371                         dom_info->general.num_users     = count_sam_users(
3372                                 dinfo->disp_info, ACB_NORMAL);
3373                         dom_info->general.num_groups    = count_sam_groups(
3374                                 dinfo->disp_info);
3375                         dom_info->general.num_aliases   = count_sam_aliases(
3376                                 dinfo->disp_info);
3377
3378                         pdb_get_account_policy(AP_TIME_TO_LOGOUT, &u_logout);
3379
3380                         unix_to_nt_time_abs(&dom_info->general.force_logoff_time, u_logout);
3381
3382                         if (!pdb_get_seq_num(&seq_num))
3383                                 seq_num = time(NULL);
3384
3385                         /* !AS ROOT */
3386
3387                         unbecome_root();
3388
3389                         server_role = ROLE_DOMAIN_PDC;
3390                         if (lp_server_role() == ROLE_DOMAIN_BDC)
3391                                 server_role = ROLE_DOMAIN_BDC;
3392
3393                         dom_info->general.oem_information.string        = lp_serverstring();
3394                         dom_info->general.domain_name.string            = lp_workgroup();
3395                         dom_info->general.primary.string                = global_myname();
3396                         dom_info->general.sequence_num                  = seq_num;
3397                         dom_info->general.domain_server_state           = DOMAIN_SERVER_ENABLED;
3398                         dom_info->general.role                          = server_role;
3399                         dom_info->general.unknown3                      = 1;
3400
3401                         break;
3402                 case 3:
3403
3404                         become_root();
3405
3406                         /* AS ROOT !!! */
3407
3408                         {
3409                                 uint32 ul;
3410                                 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &ul);
3411                                 u_logout = (time_t)ul;
3412                         }
3413
3414                         /* !AS ROOT */
3415
3416                         unbecome_root();
3417
3418                         unix_to_nt_time_abs(&dom_info->info3.force_logoff_time, u_logout);
3419
3420                         break;
3421                 case 4:
3422                         dom_info->oem.oem_information.string = lp_serverstring();
3423                         break;
3424                 case 5:
3425                         dom_info->info5.domain_name.string = get_global_sam_name();
3426                         break;
3427                 case 6:
3428                         /* NT returns its own name when a PDC. win2k and later
3429                          * only the name of the PDC if itself is a BDC (samba4
3430                          * idl) */
3431                         dom_info->info6.primary.string = global_myname();
3432                         break;
3433                 case 7:
3434                         server_role = ROLE_DOMAIN_PDC;
3435                         if (lp_server_role() == ROLE_DOMAIN_BDC)
3436                                 server_role = ROLE_DOMAIN_BDC;
3437
3438                         dom_info->info7.role = server_role;
3439                         break;
3440                 case 8:
3441
3442                         become_root();
3443
3444                         /* AS ROOT !!! */
3445
3446                         if (!pdb_get_seq_num(&seq_num)) {
3447                                 seq_num = time(NULL);
3448                         }
3449
3450                         /* !AS ROOT */
3451
3452                         unbecome_root();
3453
3454                         dom_info->info8.sequence_num = seq_num;
3455                         dom_info->info8.domain_create_time = 0;
3456
3457                         break;
3458                 case 9:
3459
3460                         dom_info->info9.domain_server_state             = DOMAIN_SERVER_ENABLED;
3461
3462                         break;
3463                 case 11:
3464
3465                         /* AS ROOT !!! */
3466
3467                         become_root();
3468
3469                         dom_info->general2.general.num_users    = count_sam_users(
3470                                 dinfo->disp_info, ACB_NORMAL);
3471                         dom_info->general2.general.num_groups   = count_sam_groups(
3472                                 dinfo->disp_info);
3473                         dom_info->general2.general.num_aliases  = count_sam_aliases(
3474                                 dinfo->disp_info);
3475
3476                         pdb_get_account_policy(AP_TIME_TO_LOGOUT, &u_logout);
3477
3478                         unix_to_nt_time_abs(&dom_info->general2.general.force_logoff_time, u_logout);
3479
3480                         if (!pdb_get_seq_num(&seq_num))
3481                                 seq_num = time(NULL);
3482
3483                         pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3484                         u_lock_duration = account_policy_temp;
3485                         if (u_lock_duration != -1) {
3486                                 u_lock_duration *= 60;
3487                         }
3488
3489                         pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
3490                         u_reset_time = account_policy_temp * 60;
3491
3492                         pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT,
3493                                                &account_policy_temp);
3494                         dom_info->general2.lockout_threshold = account_policy_temp;
3495
3496                         /* !AS ROOT */
3497
3498                         unbecome_root();
3499
3500                         server_role = ROLE_DOMAIN_PDC;
3501                         if (lp_server_role() == ROLE_DOMAIN_BDC)
3502                                 server_role = ROLE_DOMAIN_BDC;
3503
3504                         dom_info->general2.general.oem_information.string       = lp_serverstring();
3505                         dom_info->general2.general.domain_name.string           = lp_workgroup();
3506                         dom_info->general2.general.primary.string               = global_myname();
3507                         dom_info->general2.general.sequence_num                 = seq_num;
3508                         dom_info->general2.general.domain_server_state          = DOMAIN_SERVER_ENABLED;
3509                         dom_info->general2.general.role                         = server_role;
3510                         dom_info->general2.general.unknown3                     = 1;
3511
3512                         unix_to_nt_time_abs(&dom_info->general2.lockout_duration,
3513                                             u_lock_duration);
3514                         unix_to_nt_time_abs(&dom_info->general2.lockout_window,
3515                                             u_reset_time);
3516
3517                         break;
3518                 case 12:
3519
3520                         become_root();
3521
3522                         /* AS ROOT !!! */
3523
3524                         pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3525                         u_lock_duration = account_policy_temp;
3526                         if (u_lock_duration != -1) {
3527                                 u_lock_duration *= 60;
3528                         }
3529
3530                         pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
3531                         u_reset_time = account_policy_temp * 60;
3532
3533                         pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT,
3534                                                &account_policy_temp);
3535                         dom_info->info12.lockout_threshold = account_policy_temp;
3536
3537                         /* !AS ROOT */
3538
3539                         unbecome_root();
3540
3541                         unix_to_nt_time_abs(&dom_info->info12.lockout_duration,
3542                                             u_lock_duration);
3543                         unix_to_nt_time_abs(&dom_info->info12.lockout_window,
3544                                             u_reset_time);
3545
3546                         break;
3547                 case 13:
3548
3549                         become_root();
3550
3551                         /* AS ROOT !!! */
3552
3553                         if (!pdb_get_seq_num(&seq_num)) {
3554                                 seq_num = time(NULL);
3555                         }
3556
3557                         /* !AS ROOT */
3558
3559                         unbecome_root();
3560
3561                         dom_info->info13.sequence_num = seq_num;
3562                         dom_info->info13.domain_create_time = 0;
3563                         dom_info->info13.modified_count_at_last_promotion = 0;
3564
3565                         break;
3566                 default:
3567                         return NT_STATUS_INVALID_INFO_CLASS;
3568         }
3569
3570         *r->out.info = dom_info;
3571
3572         DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3573
3574         return status;
3575 }
3576
3577 /* W2k3 seems to use the same check for all 3 objects that can be created via
3578  * SAMR, if you try to create for example "Dialup" as an alias it says
3579  * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3580  * database. */
3581
3582 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
3583 {
3584         enum lsa_SidType type;
3585         bool result;
3586
3587         DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
3588
3589         become_root();
3590         /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3591          * whether the name already exists */
3592         result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
3593                              NULL, NULL, NULL, &type);
3594         unbecome_root();
3595
3596         if (!result) {
3597                 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3598                 return NT_STATUS_OK;
3599         }
3600
3601         DEBUG(5, ("trying to create %s, exists as %s\n",
3602                   new_name, sid_type_lookup(type)));
3603
3604         if (type == SID_NAME_DOM_GRP) {
3605                 return NT_STATUS_GROUP_EXISTS;
3606         }
3607         if (type == SID_NAME_ALIAS) {
3608                 return NT_STATUS_ALIAS_EXISTS;
3609         }
3610
3611         /* Yes, the default is NT_STATUS_USER_EXISTS */
3612         return NT_STATUS_USER_EXISTS;
3613 }
3614
3615 /*******************************************************************
3616  _samr_CreateUser2
3617  ********************************************************************/
3618
3619 NTSTATUS _samr_CreateUser2(pipes_struct *p,
3620                            struct samr_CreateUser2 *r)
3621 {
3622         const char *account = NULL;
3623         DOM_SID sid;
3624         uint32_t acb_info = r->in.acct_flags;
3625         struct samr_domain_info *dinfo;
3626         struct samr_user_info *uinfo;
3627         NTSTATUS nt_status;
3628         uint32 acc_granted;
3629         SEC_DESC *psd;
3630         size_t    sd_size;
3631         /* check this, when giving away 'add computer to domain' privs */
3632         uint32    des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3633         bool can_add_account = False;
3634         SE_PRIV se_rights;
3635
3636         dinfo = policy_handle_find(p, r->in.domain_handle,
3637                                    SAMR_DOMAIN_ACCESS_CREATE_USER, NULL,
3638                                    struct samr_domain_info, &nt_status);
3639         if (!NT_STATUS_IS_OK(nt_status)) {
3640                 return nt_status;
3641         }
3642
3643         if (sid_check_is_builtin(&dinfo->sid)) {
3644                 DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
3645                 return NT_STATUS_ACCESS_DENIED;
3646         }
3647
3648         if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3649               acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3650                 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3651                    this parameter is not an account type */
3652                 return NT_STATUS_INVALID_PARAMETER;
3653         }
3654
3655         account = r->in.account_name->string;
3656         if (account == NULL) {
3657                 return NT_STATUS_NO_MEMORY;
3658         }
3659
3660         nt_status = can_create(p->mem_ctx, account);
3661         if (!NT_STATUS_IS_OK(nt_status)) {
3662                 return nt_status;
3663         }
3664
3665         /* determine which user right we need to check based on the acb_info */
3666
3667         if (geteuid() == sec_initial_uid()) {
3668                 se_priv_copy(&se_rights, &se_priv_none);
3669                 can_add_account = true;
3670         } else if (acb_info & ACB_WSTRUST) {
3671                 se_priv_copy(&se_rights, &se_machine_account);
3672                 can_add_account = user_has_privileges(
3673                         p->server_info->ptok, &se_rights );
3674         } else if (acb_info & ACB_NORMAL &&
3675                   (account[strlen(account)-1] != '$')) {
3676                 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3677                    account for domain trusts and changes the ACB flags later */
3678                 se_priv_copy(&se_rights, &se_add_users);
3679                 can_add_account = user_has_privileges(
3680                         p->server_info->ptok, &se_rights );
3681         } else if (lp_enable_privileges()) {
3682                 /* implicit assumption of a BDC or domain trust account here
3683                  * (we already check the flags earlier) */
3684                 /* only Domain Admins can add a BDC or domain trust */
3685                 se_priv_copy(&se_rights, &se_priv_none);
3686                 can_add_account = nt_token_check_domain_rid(
3687                         p->server_info->ptok,
3688                         DOMAIN_GROUP_RID_ADMINS );
3689         }
3690
3691         DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3692                   uidtoname(p->server_info->utok.uid),
3693                   can_add_account ? "True":"False" ));
3694
3695         if (!can_add_account) {
3696                 return NT_STATUS_ACCESS_DENIED;
3697         }
3698
3699         /********** BEGIN Admin BLOCK **********/
3700
3701         become_root();
3702         nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3703                                     r->out.rid);
3704         unbecome_root();
3705
3706         /********** END Admin BLOCK **********/
3707
3708         /* now check for failure */
3709
3710         if ( !NT_STATUS_IS_OK(nt_status) )
3711                 return nt_status;
3712
3713         /* Get the user's SID */
3714
3715         sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3716
3717         map_max_allowed_access(p->server_info->ptok, &des_access);
3718
3719         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3720                             &sid, SAMR_USR_RIGHTS_WRITE_PW);
3721         se_map_generic(&des_access, &usr_generic_mapping);
3722
3723         /*
3724          * JRA - TESTME. We just created this user so we
3725          * had rights to create them. Do we need to check
3726          * any further access on this object ? Can't we
3727          * just assume we have all the rights we need ?
3728          */
3729
3730         nt_status = access_check_samr_object(psd, p->server_info->ptok,
3731                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
3732                 &acc_granted, "_samr_CreateUser2");
3733
3734         if ( !NT_STATUS_IS_OK(nt_status) ) {
3735                 return nt_status;
3736         }
3737
3738         uinfo = policy_handle_create(p, r->out.user_handle, acc_granted,
3739                                      struct samr_user_info, &nt_status);
3740         if (!NT_STATUS_IS_OK(nt_status)) {
3741                 return nt_status;
3742         }
3743         uinfo->sid = sid;
3744
3745         /* After a "set" ensure we have no cached display info. */
3746         force_flush_samr_cache(&sid);
3747
3748         *r->out.access_granted = acc_granted;
3749
3750         return NT_STATUS_OK;
3751 }
3752
3753 /****************************************************************
3754 ****************************************************************/
3755
3756 NTSTATUS _samr_CreateUser(pipes_struct *p,
3757                           struct samr_CreateUser *r)
3758 {
3759         struct samr_CreateUser2 c;
3760         uint32_t access_granted;
3761
3762         c.in.domain_handle      = r->in.domain_handle;
3763         c.in.account_name       = r->in.account_name;
3764         c.in.acct_flags         = ACB_NORMAL;
3765         c.in.access_mask        = r->in.access_mask;
3766         c.out.user_handle       = r->out.user_handle;
3767         c.out.access_granted    = &access_granted;
3768         c.out.rid               = r->out.rid;
3769
3770         return _samr_CreateUser2(p, &c);
3771 }
3772
3773 /*******************************************************************
3774  _samr_Connect
3775  ********************************************************************/
3776
3777 NTSTATUS _samr_Connect(pipes_struct *p,
3778                        struct samr_Connect *r)
3779 {
3780         struct samr_connect_info *info;
3781         uint32_t acc_granted;
3782         struct policy_handle hnd;
3783         uint32    des_access = r->in.access_mask;
3784         NTSTATUS status;
3785
3786         /* Access check */
3787
3788         if (!pipe_access_check(p)) {
3789                 DEBUG(3, ("access denied to _samr_Connect\n"));
3790                 return NT_STATUS_ACCESS_DENIED;
3791         }
3792
3793         /* don't give away the farm but this is probably ok.  The SAMR_ACCESS_ENUM_DOMAINS
3794            was observed from a win98 client trying to enumerate users (when configured
3795            user level access control on shares)   --jerry */
3796
3797         map_max_allowed_access(p->server_info->ptok, &des_access);
3798
3799         se_map_generic( &des_access, &sam_generic_mapping );
3800
3801         acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS
3802                                     |SAMR_ACCESS_LOOKUP_DOMAIN);
3803
3804         /* set up the SAMR connect_anon response */
3805
3806         info = policy_handle_create(p, &hnd, acc_granted,
3807                                     struct samr_connect_info,
3808                                     &status);
3809         if (!NT_STATUS_IS_OK(status)) {
3810                 return status;
3811         }
3812
3813         *r->out.connect_handle = hnd;
3814         return NT_STATUS_OK;
3815 }
3816
3817 /*******************************************************************
3818  _samr_Connect2
3819  ********************************************************************/
3820
3821 NTSTATUS _samr_Connect2(pipes_struct *p,
3822                         struct samr_Connect2 *r)
3823 {
3824         struct samr_connect_info *info = NULL;
3825         struct policy_handle hnd;
3826         SEC_DESC *psd = NULL;
3827         uint32    acc_granted;
3828         uint32    des_access = r->in.access_mask;
3829         NTSTATUS  nt_status;
3830         size_t    sd_size;
3831         const char *fn = "_samr_Connect2";
3832
3833         switch (p->hdr_req.opnum) {
3834         case NDR_SAMR_CONNECT2:
3835                 fn = "_samr_Connect2";
3836                 break;
3837         case NDR_SAMR_CONNECT3:
3838                 fn = "_samr_Connect3";
3839                 break;
3840         case NDR_SAMR_CONNECT4:
3841                 fn = "_samr_Connect4";
3842                 break;
3843         case NDR_SAMR_CONNECT5:
3844                 fn = "_samr_Connect5";
3845                 break;
3846         }
3847
3848         DEBUG(5,("%s: %d\n", fn, __LINE__));
3849
3850         /* Access check */
3851
3852         if (!pipe_access_check(p)) {
3853                 DEBUG(3, ("access denied to %s\n", fn));
3854                 return NT_STATUS_ACCESS_DENIED;
3855         }
3856
3857         map_max_allowed_access(p->server_info->ptok, &des_access);
3858
3859         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3860         se_map_generic(&des_access, &sam_generic_mapping);
3861
3862         nt_status = access_check_samr_object(psd, p->server_info->ptok,
3863                 NULL, 0, des_access, &acc_granted, fn);
3864
3865         if ( !NT_STATUS_IS_OK(nt_status) )
3866                 return nt_status;
3867
3868         info = policy_handle_create(p, &hnd, acc_granted,
3869                                     struct samr_connect_info, &nt_status);
3870         if (!NT_STATUS_IS_OK(nt_status)) {
3871                 return nt_status;
3872         }
3873
3874         DEBUG(5,("%s: %d\n", fn, __LINE__));
3875
3876         *r->out.connect_handle = hnd;
3877         return NT_STATUS_OK;
3878 }
3879
3880 /****************************************************************
3881  _samr_Connect3
3882 ****************************************************************/
3883
3884 NTSTATUS _samr_Connect3(pipes_struct *p,
3885                         struct samr_Connect3 *r)
3886 {
3887         struct samr_Connect2 c;
3888
3889         c.in.system_name        = r->in.system_name;
3890         c.in.access_mask        = r->in.access_mask;
3891         c.out.connect_handle    = r->out.connect_handle;
3892
3893         return _samr_Connect2(p, &c);
3894 }
3895
3896 /*******************************************************************
3897  _samr_Connect4
3898  ********************************************************************/
3899
3900 NTSTATUS _samr_Connect4(pipes_struct *p,
3901                         struct samr_Connect4 *r)
3902 {
3903         struct samr_Connect2 c;
3904
3905         c.in.system_name        = r->in.system_name;
3906         c.in.access_mask        = r->in.access_mask;
3907         c.out.connect_handle    = r->out.connect_handle;
3908
3909         return _samr_Connect2(p, &c);
3910 }
3911
3912 /*******************************************************************
3913  _samr_Connect5
3914  ********************************************************************/
3915
3916 NTSTATUS _samr_Connect5(pipes_struct *p,
3917                         struct samr_Connect5 *r)
3918 {
3919         NTSTATUS status;
3920         struct samr_Connect2 c;
3921         struct samr_ConnectInfo1 info1;
3922
3923         info1.client_version = SAMR_CONNECT_AFTER_W2K;
3924         info1.unknown2 = 0;
3925
3926         c.in.system_name        = r->in.system_name;
3927         c.in.access_mask        = r->in.access_mask;
3928         c.out.connect_handle    = r->out.connect_handle;
3929
3930         *r->out.level_out = 1;
3931
3932         status = _samr_Connect2(p, &c);
3933         if (!NT_STATUS_IS_OK(status)) {
3934                 return status;
3935         }
3936
3937         r->out.info_out->info1 = info1;
3938
3939         return NT_STATUS_OK;
3940 }
3941
3942 /**********************************************************************
3943  _samr_LookupDomain
3944  **********************************************************************/
3945
3946 NTSTATUS _samr_LookupDomain(pipes_struct *p,
3947                             struct samr_LookupDomain *r)
3948 {
3949         NTSTATUS status;
3950         struct samr_connect_info *info;
3951         const char *domain_name;
3952         DOM_SID *sid = NULL;
3953
3954         /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
3955            Reverted that change so we will work with RAS servers again */
3956
3957         info = policy_handle_find(p, r->in.connect_handle,
3958                                   SAMR_ACCESS_LOOKUP_DOMAIN, NULL,
3959                                   struct samr_connect_info,
3960                                   &status);
3961         if (!NT_STATUS_IS_OK(status)) {
3962                 return status;
3963         }
3964
3965         domain_name = r->in.domain_name->string;
3966         if (!domain_name) {
3967                 return NT_STATUS_INVALID_PARAMETER;
3968         }
3969
3970         sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
3971         if (!sid) {
3972                 return NT_STATUS_NO_MEMORY;
3973         }
3974
3975         if (strequal(domain_name, builtin_domain_name())) {
3976                 sid_copy(sid, &global_sid_Builtin);
3977         } else {
3978                 if (!secrets_fetch_domain_sid(domain_name, sid)) {
3979                         status = NT_STATUS_NO_SUCH_DOMAIN;
3980                 }
3981         }
3982
3983         DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
3984                  sid_string_dbg(sid)));
3985
3986         *r->out.sid = sid;
3987
3988         return status;
3989 }
3990
3991 /**********************************************************************
3992  _samr_EnumDomains
3993  **********************************************************************/
3994
3995 NTSTATUS _samr_EnumDomains(pipes_struct *p,
3996                            struct samr_EnumDomains *r)
3997 {
3998         NTSTATUS status;
3999         struct samr_connect_info *info;
4000         uint32_t num_entries = 2;
4001         struct samr_SamEntry *entry_array = NULL;
4002         struct samr_SamArray *sam;
4003
4004         info = policy_handle_find(p, r->in.connect_handle,
4005                                   SAMR_ACCESS_ENUM_DOMAINS, NULL,
4006                                   struct samr_connect_info, &status);
4007         if (!NT_STATUS_IS_OK(status)) {
4008                 return status;
4009         }
4010
4011         sam = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
4012         if (!sam) {
4013                 return NT_STATUS_NO_MEMORY;
4014         }
4015
4016         entry_array = TALLOC_ZERO_ARRAY(p->mem_ctx,
4017                                         struct samr_SamEntry,
4018                                         num_entries);
4019         if (!entry_array) {
4020                 return NT_STATUS_NO_MEMORY;
4021         }
4022
4023         entry_array[0].idx = 0;
4024         init_lsa_String(&entry_array[0].name, get_global_sam_name());
4025
4026         entry_array[1].idx = 1;
4027         init_lsa_String(&entry_array[1].name, "Builtin");
4028
4029         sam->count = num_entries;
4030         sam->entries = entry_array;
4031
4032         *r->out.sam = sam;
4033         *r->out.num_entries = num_entries;
4034
4035         return status;
4036 }
4037
4038 /*******************************************************************
4039  _samr_OpenAlias
4040  ********************************************************************/
4041
4042 NTSTATUS _samr_OpenAlias(pipes_struct *p,
4043                          struct samr_OpenAlias *r)
4044 {
4045         DOM_SID sid;
4046         uint32 alias_rid = r->in.rid;
4047         struct samr_alias_info *ainfo;
4048         struct samr_domain_info *dinfo;
4049         SEC_DESC *psd = NULL;
4050         uint32    acc_granted;
4051         uint32    des_access = r->in.access_mask;
4052         size_t    sd_size;
4053         NTSTATUS  status;
4054         SE_PRIV se_rights;
4055
4056         dinfo = policy_handle_find(p, r->in.domain_handle,
4057                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
4058                                    struct samr_domain_info, &status);
4059         if (!NT_STATUS_IS_OK(status)) {
4060                 return status;
4061         }
4062
4063         /* append the alias' RID to it */
4064
4065         if (!sid_compose(&sid, &dinfo->sid, alias_rid))
4066                 return NT_STATUS_NO_SUCH_ALIAS;
4067
4068         /*check if access can be granted as requested by client. */
4069
4070         map_max_allowed_access(p->server_info->ptok, &des_access);
4071
4072         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
4073         se_map_generic(&des_access,&ali_generic_mapping);
4074
4075         se_priv_copy( &se_rights, &se_add_users );
4076
4077         status = access_check_samr_object(psd, p->server_info->ptok,
4078                 &se_rights, SAMR_ALIAS_ACCESS_ADD_MEMBER,
4079                 des_access, &acc_granted, "_samr_OpenAlias");
4080
4081         if ( !NT_STATUS_IS_OK(status) )
4082                 return status;
4083
4084         {
4085                 /* Check we actually have the requested alias */
4086                 enum lsa_SidType type;
4087                 bool result;
4088                 gid_t gid;
4089
4090                 become_root();
4091                 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
4092                 unbecome_root();
4093
4094                 if (!result || (type != SID_NAME_ALIAS)) {
4095                         return NT_STATUS_NO_SUCH_ALIAS;
4096                 }
4097
4098                 /* make sure there is a mapping */
4099
4100                 if ( !sid_to_gid( &sid, &gid ) ) {
4101                         return NT_STATUS_NO_SUCH_ALIAS;
4102                 }
4103
4104         }
4105
4106         ainfo = policy_handle_create(p, r->out.alias_handle, acc_granted,
4107                                      struct samr_alias_info, &status);
4108         if (!NT_STATUS_IS_OK(status)) {
4109                 return status;
4110         }
4111         ainfo->sid = sid;
4112
4113         return NT_STATUS_OK;
4114 }
4115
4116 /*******************************************************************
4117  set_user_info_2
4118  ********************************************************************/
4119
4120 static NTSTATUS set_user_info_2(TALLOC_CTX *mem_ctx,
4121                                 struct samr_UserInfo2 *id2,
4122                                 struct samu *pwd)
4123 {
4124         if (id2 == NULL) {
4125                 DEBUG(5,("set_user_info_2: NULL id2\n"));
4126                 return NT_STATUS_ACCESS_DENIED;
4127         }
4128
4129         copy_id2_to_sam_passwd(pwd, id2);
4130
4131         return pdb_update_sam_account(pwd);
4132 }
4133
4134 /*******************************************************************
4135  set_user_info_4
4136  ********************************************************************/
4137
4138 static NTSTATUS set_user_info_4(TALLOC_CTX *mem_ctx,
4139                                 struct samr_UserInfo4 *id4,
4140                                 struct samu *pwd)
4141 {
4142         if (id4 == NULL) {
4143                 DEBUG(5,("set_user_info_2: NULL id4\n"));
4144                 return NT_STATUS_ACCESS_DENIED;
4145         }
4146
4147         copy_id4_to_sam_passwd(pwd, id4);
4148
4149         return pdb_update_sam_account(pwd);
4150 }
4151
4152 /*******************************************************************
4153  set_user_info_6
4154  ********************************************************************/
4155
4156 static NTSTATUS set_user_info_6(TALLOC_CTX *mem_ctx,
4157                                 struct samr_UserInfo6 *id6,
4158                                 struct samu *pwd)
4159 {
4160         if (id6 == NULL) {
4161                 DEBUG(5,("set_user_info_6: NULL id6\n"));
4162                 return NT_STATUS_ACCESS_DENIED;
4163         }
4164
4165         copy_id6_to_sam_passwd(pwd, id6);
4166
4167         return pdb_update_sam_account(pwd);
4168 }
4169
4170 /*******************************************************************
4171  set_user_info_7
4172  ********************************************************************/
4173
4174 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
4175                                 struct samr_UserInfo7 *id7,
4176                                 struct samu *pwd)
4177 {
4178         NTSTATUS rc;
4179
4180         if (id7 == NULL) {
4181                 DEBUG(5, ("set_user_info_7: NULL id7\n"));
4182                 return NT_STATUS_ACCESS_DENIED;
4183         }
4184
4185         if (!id7->account_name.string) {
4186                 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
4187                 return NT_STATUS_ACCESS_DENIED;
4188         }
4189
4190         /* check to see if the new username already exists.  Note: we can't
4191            reliably lock all backends, so there is potentially the
4192            possibility that a user can be created in between this check and
4193            the rename.  The rename should fail, but may not get the
4194            exact same failure status code.  I think this is small enough
4195            of a window for this type of operation and the results are
4196            simply that the rename fails with a slightly different status
4197            code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4198
4199         rc = can_create(mem_ctx, id7->account_name.string);
4200
4201         /* when there is nothing to change, we're done here */
4202         if (NT_STATUS_EQUAL(rc, NT_STATUS_USER_EXISTS) &&
4203             strequal(id7->account_name.string, pdb_get_username(pwd))) {
4204                 return NT_STATUS_OK;
4205         }
4206         if (!NT_STATUS_IS_OK(rc)) {
4207                 return rc;
4208         }
4209
4210         rc = pdb_rename_sam_account(pwd, id7->account_name.string);
4211
4212         return rc;
4213 }
4214
4215 /*******************************************************************
4216  set_user_info_8
4217  ********************************************************************/
4218
4219 static NTSTATUS set_user_info_8(TALLOC_CTX *mem_ctx,
4220                                 struct samr_UserInfo8 *id8,
4221                                 struct samu *pwd)
4222 {
4223         if (id8 == NULL) {
4224                 DEBUG(5,("set_user_info_8: NULL id8\n"));
4225                 return NT_STATUS_ACCESS_DENIED;
4226         }
4227
4228         copy_id8_to_sam_passwd(pwd, id8);
4229
4230         return pdb_update_sam_account(pwd);
4231 }
4232
4233 /*******************************************************************
4234  set_user_info_10
4235  ********************************************************************/
4236
4237 static NTSTATUS set_user_info_10(TALLOC_CTX *mem_ctx,
4238                                  struct samr_UserInfo10 *id10,
4239                                  struct samu *pwd)
4240 {
4241         if (id10 == NULL) {
4242                 DEBUG(5,("set_user_info_8: NULL id10\n"));
4243                 return NT_STATUS_ACCESS_DENIED;
4244         }
4245
4246         copy_id10_to_sam_passwd(pwd, id10);
4247
4248         return pdb_update_sam_account(pwd);
4249 }
4250
4251 /*******************************************************************
4252  set_user_info_11
4253  ********************************************************************/
4254
4255 static NTSTATUS set_user_info_11(TALLOC_CTX *mem_ctx,
4256                                  struct samr_UserInfo11 *id11,
4257                                  struct samu *pwd)
4258 {
4259         if (id11 == NULL) {
4260                 DEBUG(5,("set_user_info_11: NULL id11\n"));
4261                 return NT_STATUS_ACCESS_DENIED;
4262         }
4263
4264         copy_id11_to_sam_passwd(pwd, id11);
4265
4266         return pdb_update_sam_account(pwd);
4267 }
4268
4269 /*******************************************************************
4270  set_user_info_12
4271  ********************************************************************/
4272
4273 static NTSTATUS set_user_info_12(TALLOC_CTX *mem_ctx,
4274                                  struct samr_UserInfo12 *id12,
4275                                  struct samu *pwd)
4276 {
4277         if (id12 == NULL) {
4278                 DEBUG(5,("set_user_info_12: NULL id12\n"));
4279                 return NT_STATUS_ACCESS_DENIED;
4280         }
4281
4282         copy_id12_to_sam_passwd(pwd, id12);
4283
4284         return pdb_update_sam_account(pwd);
4285 }
4286
4287 /*******************************************************************
4288  set_user_info_13
4289  ********************************************************************/
4290
4291 static NTSTATUS set_user_info_13(TALLOC_CTX *mem_ctx,
4292                                  struct samr_UserInfo13 *id13,
4293                                  struct samu *pwd)
4294 {
4295         if (id13 == NULL) {
4296                 DEBUG(5,("set_user_info_13: NULL id13\n"));
4297                 return NT_STATUS_ACCESS_DENIED;
4298         }
4299
4300         copy_id13_to_sam_passwd(pwd, id13);
4301
4302         return pdb_update_sam_account(pwd);
4303 }
4304
4305 /*******************************************************************
4306  set_user_info_14
4307  ********************************************************************/
4308
4309 static NTSTATUS set_user_info_14(TALLOC_CTX *mem_ctx,
4310                                  struct samr_UserInfo14 *id14,
4311                                  struct samu *pwd)
4312 {
4313         if (id14 == NULL) {
4314                 DEBUG(5,("set_user_info_14: NULL id14\n"));
4315                 return NT_STATUS_ACCESS_DENIED;
4316         }
4317
4318         copy_id14_to_sam_passwd(pwd, id14);
4319
4320         return pdb_update_sam_account(pwd);
4321 }
4322
4323 /*******************************************************************
4324  set_user_info_16
4325  ********************************************************************/
4326
4327 static NTSTATUS set_user_info_16(TALLOC_CTX *mem_ctx,
4328                                  struct samr_UserInfo16 *id16,
4329                                  struct samu *pwd)
4330 {
4331         if (id16 == NULL) {
4332                 DEBUG(5,("set_user_info_16: NULL id16\n"));
4333                 return NT_STATUS_ACCESS_DENIED;
4334         }
4335
4336         copy_id16_to_sam_passwd(pwd, id16);
4337
4338         return pdb_update_sam_account(pwd);
4339 }
4340
4341 /*******************************************************************
4342  set_user_info_17
4343  ********************************************************************/
4344
4345 static NTSTATUS set_user_info_17(TALLOC_CTX *mem_ctx,
4346                                  struct samr_UserInfo17 *id17,
4347                                  struct samu *pwd)
4348 {
4349         if (id17 == NULL) {
4350                 DEBUG(5,("set_user_info_17: NULL id17\n"));
4351                 return NT_STATUS_ACCESS_DENIED;
4352         }
4353
4354         copy_id17_to_sam_passwd(pwd, id17);
4355
4356         return pdb_update_sam_account(pwd);
4357 }
4358
4359 /*******************************************************************
4360  set_user_info_18
4361  ********************************************************************/
4362
4363 static NTSTATUS set_user_info_18(struct samr_UserInfo18 *id18,
4364                                  TALLOC_CTX *mem_ctx,
4365                                  DATA_BLOB *session_key,
4366                                  struct samu *pwd)
4367 {
4368         if (id18 == NULL) {
4369                 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
4370                 return NT_STATUS_INVALID_PARAMETER;
4371         }
4372
4373         if (id18->nt_pwd_active || id18->lm_pwd_active) {
4374                 if (!session_key->length) {
4375                         return NT_STATUS_NO_USER_SESSION_KEY;
4376                 }
4377         }
4378
4379         if (id18->nt_pwd_active) {
4380
4381                 DATA_BLOB in, out;
4382
4383                 in = data_blob_const(id18->nt_pwd.hash, 16);
4384                 out = data_blob_talloc_zero(mem_ctx, 16);
4385
4386                 sess_crypt_blob(&out, &in, session_key, false);
4387
4388                 if (!pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED)) {
4389                         return NT_STATUS_ACCESS_DENIED;
4390                 }
4391
4392                 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4393         }
4394
4395         if (id18->lm_pwd_active) {
4396
4397                 DATA_BLOB in, out;
4398
4399                 in = data_blob_const(id18->lm_pwd.hash, 16);
4400                 out = data_blob_talloc_zero(mem_ctx, 16);
4401
4402                 sess_crypt_blob(&out, &in, session_key, false);
4403
4404                 if (!pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED)) {
4405                         return NT_STATUS_ACCESS_DENIED;
4406                 }
4407
4408                 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4409         }
4410
4411         copy_id18_to_sam_passwd(pwd, id18);
4412
4413         return pdb_update_sam_account(pwd);
4414 }
4415
4416 /*******************************************************************
4417  set_user_info_20
4418  ********************************************************************/
4419
4420 static NTSTATUS set_user_info_20(TALLOC_CTX *mem_ctx,
4421                                  struct samr_UserInfo20 *id20,
4422                                  struct samu *pwd)
4423 {
4424         if (id20 == NULL) {
4425                 DEBUG(5,("set_user_info_20: NULL id20\n"));
4426                 return NT_STATUS_ACCESS_DENIED;
4427         }
4428
4429         copy_id20_to_sam_passwd(pwd, id20);
4430
4431         return pdb_update_sam_account(pwd);
4432 }
4433
4434 /*******************************************************************
4435  set_user_info_21
4436  ********************************************************************/
4437
4438 static NTSTATUS set_user_info_21(struct samr_UserInfo21 *id21,
4439                                  TALLOC_CTX *mem_ctx,
4440                                  DATA_BLOB *session_key,
4441                                  struct samu *pwd)
4442 {
4443         NTSTATUS status;
4444
4445         if (id21 == NULL) {
4446                 DEBUG(5, ("set_user_info_21: NULL id21\n"));
4447                 return NT_STATUS_INVALID_PARAMETER;
4448         }
4449
4450         if (id21->fields_present == 0) {
4451                 return NT_STATUS_INVALID_PARAMETER;
4452         }
4453
4454         if (id21->fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4455                 return NT_STATUS_ACCESS_DENIED;
4456         }
4457
4458         if (id21->fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
4459                 if (id21->nt_password_set) {
4460                         DATA_BLOB in, out;
4461
4462                         if ((id21->nt_owf_password.length != 16) ||
4463                             (id21->nt_owf_password.size != 16)) {
4464                                 return NT_STATUS_INVALID_PARAMETER;
4465                         }
4466
4467                         if (!session_key->length) {
4468                                 return NT_STATUS_NO_USER_SESSION_KEY;
4469                         }
4470
4471                         in = data_blob_const(id21->nt_owf_password.array, 16);
4472                         out = data_blob_talloc_zero(mem_ctx, 16);
4473
4474                         sess_crypt_blob(&out, &in, session_key, false);
4475
4476                         pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED);
4477                         pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4478                 }
4479         }
4480
4481         if (id21->fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
4482                 if (id21->lm_password_set) {
4483                         DATA_BLOB in, out;
4484
4485                         if ((id21->lm_owf_password.length != 16) ||
4486                             (id21->lm_owf_password.size != 16)) {
4487                                 return NT_STATUS_INVALID_PARAMETER;
4488                         }
4489
4490                         if (!session_key->length) {
4491                                 return NT_STATUS_NO_USER_SESSION_KEY;
4492                         }
4493
4494                         in = data_blob_const(id21->lm_owf_password.array, 16);
4495                         out = data_blob_talloc_zero(mem_ctx, 16);
4496
4497                         sess_crypt_blob(&out, &in, session_key, false);
4498
4499                         pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED);
4500                         pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4501                 }
4502         }
4503
4504         /* we need to separately check for an account rename first */
4505
4506         if (id21->account_name.string &&
4507             (!strequal(id21->account_name.string, pdb_get_username(pwd))))
4508         {
4509
4510                 /* check to see if the new username already exists.  Note: we can't
4511                    reliably lock all backends, so there is potentially the
4512                    possibility that a user can be created in between this check and
4513                    the rename.  The rename should fail, but may not get the
4514                    exact same failure status code.  I think this is small enough
4515                    of a window for this type of operation and the results are
4516                    simply that the rename fails with a slightly different status
4517                    code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4518
4519                 status = can_create(mem_ctx, id21->account_name.string);
4520                 if (!NT_STATUS_IS_OK(status)) {
4521                         return status;
4522                 }
4523
4524                 status = pdb_rename_sam_account(pwd, id21->account_name.string);
4525
4526                 if (!NT_STATUS_IS_OK(status)) {
4527                         DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
4528                                 nt_errstr(status)));
4529                         return status;
4530                 }
4531
4532                 /* set the new username so that later
4533                    functions can work on the new account */
4534                 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
4535         }
4536
4537         copy_id21_to_sam_passwd("INFO_21", pwd, id21);
4538
4539         /*
4540          * The funny part about the previous two calls is
4541          * that pwd still has the password hashes from the
4542          * passdb entry.  These have not been updated from
4543          * id21.  I don't know if they need to be set.    --jerry
4544          */
4545
4546         if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4547                 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4548                 if ( !NT_STATUS_IS_OK(status) ) {
4549                         return status;
4550                 }
4551         }
4552
4553         /* Don't worry about writing out the user account since the
4554            primary group SID is generated solely from the user's Unix
4555            primary group. */
4556
4557         /* write the change out */
4558         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4559                 return status;
4560         }
4561
4562         return NT_STATUS_OK;
4563 }
4564
4565 /*******************************************************************
4566  set_user_info_23
4567  ********************************************************************/
4568
4569 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
4570                                  struct samr_UserInfo23 *id23,
4571                                  struct samu *pwd)
4572 {
4573         char *plaintext_buf = NULL;
4574         size_t len = 0;
4575         uint32_t acct_ctrl;
4576         NTSTATUS status;
4577
4578         if (id23 == NULL) {
4579                 DEBUG(5, ("set_user_info_23: NULL id23\n"));
4580                 return NT_STATUS_INVALID_PARAMETER;
4581         }
4582
4583         if (id23->info.fields_present == 0) {
4584                 return NT_STATUS_INVALID_PARAMETER;
4585         }
4586
4587         if (id23->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4588                 return NT_STATUS_ACCESS_DENIED;
4589         }
4590
4591         if ((id23->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4592             (id23->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4593
4594                 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
4595                           pdb_get_username(pwd)));
4596
4597                 if (!decode_pw_buffer(mem_ctx,
4598                                       id23->password.data,
4599                                       &plaintext_buf,
4600                                       &len,
4601                                       CH_UTF16)) {
4602                         return NT_STATUS_WRONG_PASSWORD;
4603                 }
4604
4605                 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
4606                         return NT_STATUS_ACCESS_DENIED;
4607                 }
4608         }
4609
4610         copy_id23_to_sam_passwd(pwd, id23);
4611
4612         acct_ctrl = pdb_get_acct_ctrl(pwd);
4613
4614         /* if it's a trust account, don't update /etc/passwd */
4615         if (    ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
4616                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
4617                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
4618                 DEBUG(5, ("Changing trust account.  Not updating /etc/passwd\n"));
4619         } else if (plaintext_buf) {
4620                 /* update the UNIX password */
4621                 if (lp_unix_password_sync() ) {
4622                         struct passwd *passwd;
4623                         if (pdb_get_username(pwd) == NULL) {
4624                                 DEBUG(1, ("chgpasswd: User without name???\n"));
4625                                 return NT_STATUS_ACCESS_DENIED;
4626                         }
4627
4628                         passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
4629                         if (passwd == NULL) {
4630                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4631                         }
4632
4633                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
4634                                 return NT_STATUS_ACCESS_DENIED;
4635                         }
4636                         TALLOC_FREE(passwd);
4637                 }
4638         }
4639
4640         if (plaintext_buf) {
4641                 memset(plaintext_buf, '\0', strlen(plaintext_buf));
4642         }
4643
4644         if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
4645             (!NT_STATUS_IS_OK(status =  pdb_set_unix_primary_group(mem_ctx,
4646                                                                    pwd)))) {
4647                 return status;
4648         }
4649
4650         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4651                 return status;
4652         }
4653
4654         return NT_STATUS_OK;
4655 }
4656
4657 /*******************************************************************
4658  set_user_info_pw
4659  ********************************************************************/
4660
4661 static bool set_user_info_pw(uint8 *pass, struct samu *pwd)
4662 {
4663         size_t len = 0;
4664         char *plaintext_buf = NULL;
4665         uint32 acct_ctrl;
4666
4667         DEBUG(5, ("Attempting administrator password change for user %s\n",
4668                   pdb_get_username(pwd)));
4669
4670         acct_ctrl = pdb_get_acct_ctrl(pwd);
4671
4672         if (!decode_pw_buffer(talloc_tos(),
4673                                 pass,
4674                                 &plaintext_buf,
4675                                 &len,
4676                                 CH_UTF16)) {
4677                 return False;
4678         }
4679
4680         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
4681                 return False;
4682         }
4683
4684         /* if it's a trust account, don't update /etc/passwd */
4685         if ( ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
4686                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
4687                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
4688                 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
4689         } else {
4690                 /* update the UNIX password */
4691                 if (lp_unix_password_sync()) {
4692                         struct passwd *passwd;
4693
4694                         if (pdb_get_username(pwd) == NULL) {
4695                                 DEBUG(1, ("chgpasswd: User without name???\n"));
4696                                 return False;
4697                         }
4698
4699                         passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
4700                         if (passwd == NULL) {
4701                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4702                         }
4703
4704                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
4705                                 return False;
4706                         }
4707                         TALLOC_FREE(passwd);
4708                 }
4709         }
4710
4711         memset(plaintext_buf, '\0', strlen(plaintext_buf));
4712
4713         DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4714
4715         return True;
4716 }
4717
4718 /*******************************************************************
4719  set_user_info_24
4720  ********************************************************************/
4721
4722 static NTSTATUS set_user_info_24(TALLOC_CTX *mem_ctx,
4723                                  struct samr_UserInfo24 *id24,
4724                                  struct samu *pwd)
4725 {
4726         NTSTATUS status;
4727
4728         if (id24 == NULL) {
4729                 DEBUG(5, ("set_user_info_24: NULL id24\n"));
4730                 return NT_STATUS_INVALID_PARAMETER;
4731         }
4732
4733         if (!set_user_info_pw(id24->password.data, pwd)) {
4734                 return NT_STATUS_WRONG_PASSWORD;
4735         }
4736
4737         copy_id24_to_sam_passwd(pwd, id24);
4738
4739         status = pdb_update_sam_account(pwd);
4740         if (!NT_STATUS_IS_OK(status)) {
4741                 return status;
4742         }
4743
4744         return NT_STATUS_OK;
4745 }
4746
4747 /*******************************************************************
4748  set_user_info_25
4749  ********************************************************************/
4750
4751 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
4752                                  struct samr_UserInfo25 *id25,
4753                                  struct samu *pwd)
4754 {
4755         NTSTATUS status;
4756
4757         if (id25 == NULL) {
4758                 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4759                 return NT_STATUS_INVALID_PARAMETER;
4760         }
4761
4762         if (id25->info.fields_present == 0) {
4763                 return NT_STATUS_INVALID_PARAMETER;
4764         }
4765
4766         if (id25->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4767                 return NT_STATUS_ACCESS_DENIED;
4768         }
4769
4770         if ((id25->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4771             (id25->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4772
4773                 if (!set_user_info_pw(id25->password.data, pwd)) {
4774                         return NT_STATUS_WRONG_PASSWORD;
4775                 }
4776         }
4777
4778         copy_id25_to_sam_passwd(pwd, id25);
4779
4780         /* write the change out */
4781         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4782                 return status;
4783         }
4784
4785         /*
4786          * We need to "pdb_update_sam_account" before the unix primary group
4787          * is set, because the idealx scripts would also change the
4788          * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4789          * the delete explicit / add explicit, which would then fail to find
4790          * the previous primaryGroupSid value.
4791          */
4792
4793         if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4794                 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4795                 if ( !NT_STATUS_IS_OK(status) ) {
4796                         return status;
4797                 }
4798         }
4799
4800         return NT_STATUS_OK;
4801 }
4802
4803 /*******************************************************************
4804  set_user_info_26
4805  ********************************************************************/
4806
4807 static NTSTATUS set_user_info_26(TALLOC_CTX *mem_ctx,
4808                                  struct samr_UserInfo26 *id26,
4809                                  struct samu *pwd)
4810 {
4811         NTSTATUS status;
4812
4813         if (id26 == NULL) {
4814                 DEBUG(5, ("set_user_info_26: NULL id26\n"));
4815                 return NT_STATUS_INVALID_PARAMETER;
4816         }
4817
4818         if (!set_user_info_pw(id26->password.data, pwd)) {
4819                 return NT_STATUS_WRONG_PASSWORD;
4820         }
4821
4822         copy_id26_to_sam_passwd(pwd, id26);
4823
4824         status = pdb_update_sam_account(pwd);
4825         if (!NT_STATUS_IS_OK(status)) {
4826                 return status;
4827         }
4828
4829         return NT_STATUS_OK;
4830 }
4831
4832 /*************************************************************
4833 **************************************************************/
4834
4835 static uint32_t samr_set_user_info_map_fields_to_access_mask(uint32_t fields)
4836 {
4837         uint32_t acc_required = 0;
4838
4839         /* USER_ALL_USERNAME */
4840         if (fields & SAMR_FIELD_ACCOUNT_NAME)
4841                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4842         /* USER_ALL_FULLNAME */
4843         if (fields & SAMR_FIELD_FULL_NAME)
4844                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4845         /* USER_ALL_PRIMARYGROUPID */
4846         if (fields & SAMR_FIELD_PRIMARY_GID)
4847                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4848         /* USER_ALL_HOMEDIRECTORY */
4849         if (fields & SAMR_FIELD_HOME_DIRECTORY)
4850                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4851         /* USER_ALL_HOMEDIRECTORYDRIVE */
4852         if (fields & SAMR_FIELD_HOME_DRIVE)
4853                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4854         /* USER_ALL_SCRIPTPATH */
4855         if (fields & SAMR_FIELD_LOGON_SCRIPT)
4856                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4857         /* USER_ALL_PROFILEPATH */
4858         if (fields & SAMR_FIELD_PROFILE_PATH)
4859                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4860         /* USER_ALL_ADMINCOMMENT */
4861         if (fields & SAMR_FIELD_COMMENT)
4862                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4863         /* USER_ALL_WORKSTATIONS */
4864         if (fields & SAMR_FIELD_WORKSTATIONS)
4865                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4866         /* USER_ALL_LOGONHOURS */
4867         if (fields & SAMR_FIELD_LOGON_HOURS)
4868                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4869         /* USER_ALL_ACCOUNTEXPIRES */
4870         if (fields & SAMR_FIELD_ACCT_EXPIRY)
4871                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4872         /* USER_ALL_USERACCOUNTCONTROL */
4873         if (fields & SAMR_FIELD_ACCT_FLAGS)
4874                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4875         /* USER_ALL_PARAMETERS */
4876         if (fields & SAMR_FIELD_PARAMETERS)
4877                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4878         /* USER_ALL_USERCOMMENT */
4879         if (fields & SAMR_FIELD_COMMENT)
4880                 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
4881         /* USER_ALL_COUNTRYCODE */
4882         if (fields & SAMR_FIELD_COUNTRY_CODE)
4883                 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
4884         /* USER_ALL_CODEPAGE */
4885         if (fields & SAMR_FIELD_CODE_PAGE)
4886                 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
4887         /* USER_ALL_NTPASSWORDPRESENT */
4888         if (fields & SAMR_FIELD_NT_PASSWORD_PRESENT)
4889                 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
4890         /* USER_ALL_LMPASSWORDPRESENT */
4891         if (fields & SAMR_FIELD_LM_PASSWORD_PRESENT)
4892                 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
4893         /* USER_ALL_PASSWORDEXPIRED */
4894         if (fields & SAMR_FIELD_EXPIRED_FLAG)
4895                 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
4896
4897         return acc_required;
4898 }
4899
4900 /*******************************************************************
4901  samr_SetUserInfo
4902  ********************************************************************/
4903
4904 NTSTATUS _samr_SetUserInfo(pipes_struct *p,
4905                            struct samr_SetUserInfo *r)
4906 {
4907         struct samr_user_info *uinfo;
4908         NTSTATUS status;
4909         struct samu *pwd = NULL;
4910         union samr_UserInfo *info = r->in.info;
4911         uint32_t acc_required = 0;
4912         uint32_t fields = 0;
4913         bool ret;
4914
4915         DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
4916
4917         /* This is tricky.  A WinXP domain join sets
4918           (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
4919           The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser().  But the
4920           standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
4921           This should be enough for levels 18, 24, 25,& 26.  Info level 23 can set more so
4922           we'll use the set from the WinXP join as the basis. */
4923
4924         switch (r->in.level) {
4925         case 2: /* UserPreferencesInformation */
4926                 /* USER_WRITE_ACCOUNT | USER_WRITE_PREFERENCES */
4927                 acc_required = SAMR_USER_ACCESS_SET_ATTRIBUTES | SAMR_USER_ACCESS_SET_LOC_COM;
4928                 break;
4929         case 4: /* UserLogonHoursInformation */
4930         case 6: /* UserNameInformation */
4931         case 7: /* UserAccountNameInformation */
4932         case 8: /* UserFullNameInformation */
4933         case 9: /* UserPrimaryGroupInformation */
4934         case 10: /* UserHomeInformation */
4935         case 11: /* UserScriptInformation */
4936         case 12: /* UserProfileInformation */
4937         case 13: /* UserAdminCommentInformation */
4938         case 14: /* UserWorkStationsInformation */
4939         case 16: /* UserControlInformation */
4940         case 17: /* UserExpiresInformation */
4941         case 20: /* UserParametersInformation */
4942                 /* USER_WRITE_ACCOUNT */
4943                 acc_required = SAMR_USER_ACCESS_SET_ATTRIBUTES;
4944                 break;
4945         case 18: /* UserInternal1Information */
4946                 /* FIXME: gd, this is a guess */
4947                 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
4948                 break;
4949         case 21: /* UserAllInformation */
4950                 fields = info->info21.fields_present;
4951                 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
4952                 break;
4953         case 23: /* UserInternal4Information */
4954                 fields = info->info23.info.fields_present;
4955                 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
4956                 break;
4957         case 25: /* UserInternal4InformationNew */
4958                 fields = info->info25.info.fields_present;
4959                 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
4960                 break;
4961         case 24: /* UserInternal5Information */
4962         case 26: /* UserInternal5InformationNew */
4963                 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
4964                 break;
4965         default:
4966                 return NT_STATUS_INVALID_INFO_CLASS;
4967         }
4968
4969         uinfo = policy_handle_find(p, r->in.user_handle, acc_required, NULL,
4970                                    struct samr_user_info, &status);
4971         if (!NT_STATUS_IS_OK(status)) {
4972                 return status;
4973         }
4974
4975         DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
4976                   sid_string_dbg(&uinfo->sid), r->in.level));
4977
4978         if (info == NULL) {
4979                 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
4980                 return NT_STATUS_INVALID_INFO_CLASS;
4981         }
4982
4983         if (!(pwd = samu_new(NULL))) {
4984                 return NT_STATUS_NO_MEMORY;
4985         }
4986
4987         become_root();
4988         ret = pdb_getsampwsid(pwd, &uinfo->sid);
4989         unbecome_root();
4990
4991         if (!ret) {
4992                 TALLOC_FREE(pwd);
4993                 return NT_STATUS_NO_SUCH_USER;
4994         }
4995
4996         /* ================ BEGIN Privilege BLOCK ================ */
4997
4998         become_root();
4999
5000         /* ok!  user info levels (lots: see MSDEV help), off we go... */
5001
5002         switch (r->in.level) {
5003
5004                 case 2:
5005                         status = set_user_info_2(p->mem_ctx,
5006                                                  &info->info2, pwd);
5007                         break;
5008
5009                 case 4:
5010                         status = set_user_info_4(p->mem_ctx,
5011                                                  &info->info4, pwd);
5012                         break;
5013
5014                 case 6:
5015                         status = set_user_info_6(p->mem_ctx,
5016                                                  &info->info6, pwd);
5017                         break;
5018
5019                 case 7:
5020                         status = set_user_info_7(p->mem_ctx,
5021                                                  &info->info7, pwd);
5022                         break;
5023
5024                 case 8:
5025                         status = set_user_info_8(p->mem_ctx,
5026                                                  &info->info8, pwd);
5027                         break;
5028
5029                 case 10:
5030                         status = set_user_info_10(p->mem_ctx,
5031                                                   &info->info10, pwd);
5032                         break;
5033
5034                 case 11:
5035                         status = set_user_info_11(p->mem_ctx,
5036                                                   &info->info11, pwd);
5037                         break;
5038
5039                 case 12:
5040                         status = set_user_info_12(p->mem_ctx,
5041                                                   &info->info12, pwd);
5042                         break;
5043
5044                 case 13:
5045                         status = set_user_info_13(p->mem_ctx,
5046                                                   &info->info13, pwd);
5047                         break;
5048
5049                 case 14:
5050                         status = set_user_info_14(p->mem_ctx,
5051                                                   &info->info14, pwd);
5052                         break;
5053
5054                 case 16:
5055                         status = set_user_info_16(p->mem_ctx,
5056                                                   &info->info16, pwd);
5057                         break;
5058
5059                 case 17:
5060                         status = set_user_info_17(p->mem_ctx,
5061                                                   &info->info17, pwd);
5062                         break;
5063
5064                 case 18:
5065                         /* Used by AS/U JRA. */
5066                         status = set_user_info_18(&info->info18,
5067                                                   p->mem_ctx,
5068                                                   &p->server_info->user_session_key,
5069                                                   pwd);
5070                         break;
5071
5072                 case 20:
5073                         status = set_user_info_20(p->mem_ctx,
5074                                                   &info->info20, pwd);
5075                         break;
5076
5077                 case 21:
5078                         status = set_user_info_21(&info->info21,
5079                                                   p->mem_ctx,
5080                                                   &p->server_info->user_session_key,
5081                                                   pwd);
5082                         break;
5083
5084                 case 23:
5085                         if (!p->server_info->user_session_key.length) {
5086                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5087                         }
5088                         arcfour_crypt_blob(info->info23.password.data, 516,
5089                                            &p->server_info->user_session_key);
5090
5091                         dump_data(100, info->info23.password.data, 516);
5092
5093                         status = set_user_info_23(p->mem_ctx,
5094                                                   &info->info23, pwd);
5095                         break;
5096
5097                 case 24:
5098                         if (!p->server_info->user_session_key.length) {
5099                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5100                         }
5101                         arcfour_crypt_blob(info->info24.password.data,
5102                                            516,
5103                                            &p->server_info->user_session_key);
5104
5105                         dump_data(100, info->info24.password.data, 516);
5106
5107                         status = set_user_info_24(p->mem_ctx,
5108                                                   &info->info24, pwd);
5109                         break;
5110
5111                 case 25:
5112                         if (!p->server_info->user_session_key.length) {
5113                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5114                         }
5115                         encode_or_decode_arc4_passwd_buffer(
5116                                 info->info25.password.data,
5117                                 &p->server_info->user_session_key);
5118
5119                         dump_data(100, info->info25.password.data, 532);
5120
5121                         status = set_user_info_25(p->mem_ctx,
5122                                                   &info->info25, pwd);
5123                         break;
5124
5125                 case 26:
5126                         if (!p->server_info->user_session_key.length) {
5127                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5128                         }
5129                         encode_or_decode_arc4_passwd_buffer(
5130                                 info->info26.password.data,
5131                                 &p->server_info->user_session_key);
5132
5133                         dump_data(100, info->info26.password.data, 516);
5134
5135                         status = set_user_info_26(p->mem_ctx,
5136                                                   &info->info26, pwd);
5137                         break;
5138
5139                 default:
5140                         status = NT_STATUS_INVALID_INFO_CLASS;
5141         }
5142
5143         TALLOC_FREE(pwd);
5144
5145         unbecome_root();
5146
5147         /* ================ END Privilege BLOCK ================ */
5148
5149         if (NT_STATUS_IS_OK(status)) {
5150                 force_flush_samr_cache(&uinfo->sid);
5151         }
5152
5153         return status;
5154 }
5155
5156 /*******************************************************************
5157  _samr_SetUserInfo2
5158  ********************************************************************/
5159
5160 NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
5161                             struct samr_SetUserInfo2 *r)
5162 {
5163         struct samr_SetUserInfo q;
5164
5165         q.in.user_handle        = r->in.user_handle;
5166         q.in.level              = r->in.level;
5167         q.in.info               = r->in.info;
5168
5169         return _samr_SetUserInfo(p, &q);
5170 }
5171
5172 /*********************************************************************
5173  _samr_GetAliasMembership
5174 *********************************************************************/
5175
5176 NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
5177                                   struct samr_GetAliasMembership *r)
5178 {
5179         size_t num_alias_rids;
5180         uint32 *alias_rids;
5181         struct samr_domain_info *dinfo;
5182         size_t i;
5183
5184         NTSTATUS status;
5185
5186         DOM_SID *members;
5187
5188         DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
5189
5190         dinfo = policy_handle_find(p, r->in.domain_handle,
5191                                    SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
5192                                    | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
5193                                    struct samr_domain_info, &status);
5194         if (!NT_STATUS_IS_OK(status)) {
5195                 return status;
5196         }
5197
5198         if (!sid_check_is_domain(&dinfo->sid) &&
5199             !sid_check_is_builtin(&dinfo->sid))
5200                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
5201
5202         if (r->in.sids->num_sids) {
5203                 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, r->in.sids->num_sids);
5204
5205                 if (members == NULL)
5206                         return NT_STATUS_NO_MEMORY;
5207         } else {
5208                 members = NULL;
5209         }
5210
5211         for (i=0; i<r->in.sids->num_sids; i++)
5212                 sid_copy(&members[i], r->in.sids->sids[i].sid);
5213
5214         alias_rids = NULL;
5215         num_alias_rids = 0;
5216
5217         become_root();
5218         status = pdb_enum_alias_memberships(p->mem_ctx, &dinfo->sid, members,
5219                                             r->in.sids->num_sids,
5220                                             &alias_rids, &num_alias_rids);
5221         unbecome_root();
5222
5223         if (!NT_STATUS_IS_OK(status)) {
5224                 return status;
5225         }
5226
5227         r->out.rids->count = num_alias_rids;
5228         r->out.rids->ids = alias_rids;
5229
5230         return NT_STATUS_OK;
5231 }
5232
5233 /*********************************************************************
5234  _samr_GetMembersInAlias
5235 *********************************************************************/
5236
5237 NTSTATUS _samr_GetMembersInAlias(pipes_struct *p,
5238                                  struct samr_GetMembersInAlias *r)
5239 {
5240         struct samr_alias_info *ainfo;
5241         NTSTATUS status;
5242         size_t i;
5243         size_t num_sids = 0;
5244         struct lsa_SidPtr *sids = NULL;
5245         DOM_SID *pdb_sids = NULL;
5246
5247         ainfo = policy_handle_find(p, r->in.alias_handle,
5248                                    SAMR_ALIAS_ACCESS_GET_MEMBERS, NULL,
5249                                    struct samr_alias_info, &status);
5250         if (!NT_STATUS_IS_OK(status)) {
5251                 return status;
5252         }
5253
5254         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5255
5256         become_root();
5257         status = pdb_enum_aliasmem(&ainfo->sid, &pdb_sids, &num_sids);
5258         unbecome_root();
5259
5260         if (!NT_STATUS_IS_OK(status)) {
5261                 return status;
5262         }
5263
5264         if (num_sids) {
5265                 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr, num_sids);
5266                 if (sids == NULL) {
5267                         TALLOC_FREE(pdb_sids);
5268                         return NT_STATUS_NO_MEMORY;
5269                 }
5270         }
5271
5272         for (i = 0; i < num_sids; i++) {
5273                 sids[i].sid = sid_dup_talloc(p->mem_ctx, &pdb_sids[i]);
5274                 if (!sids[i].sid) {
5275                         TALLOC_FREE(pdb_sids);
5276                         return NT_STATUS_NO_MEMORY;
5277                 }
5278         }
5279
5280         r->out.sids->num_sids = num_sids;
5281         r->out.sids->sids = sids;
5282
5283         TALLOC_FREE(pdb_sids);
5284
5285         return NT_STATUS_OK;
5286 }
5287
5288 /*********************************************************************
5289  _samr_QueryGroupMember
5290 *********************************************************************/
5291
5292 NTSTATUS _samr_QueryGroupMember(pipes_struct *p,
5293                                 struct samr_QueryGroupMember *r)
5294 {
5295         struct samr_group_info *ginfo;
5296         size_t i, num_members;
5297
5298         uint32 *rid=NULL;
5299         uint32 *attr=NULL;
5300
5301         NTSTATUS status;
5302         struct samr_RidTypeArray *rids = NULL;
5303
5304         ginfo = policy_handle_find(p, r->in.group_handle,
5305                                    SAMR_GROUP_ACCESS_GET_MEMBERS, NULL,
5306                                    struct samr_group_info, &status);
5307         if (!NT_STATUS_IS_OK(status)) {
5308                 return status;
5309         }
5310
5311         rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidTypeArray);
5312         if (!rids) {
5313                 return NT_STATUS_NO_MEMORY;
5314         }
5315
5316         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5317
5318         if (!sid_check_is_in_our_domain(&ginfo->sid)) {
5319                 DEBUG(3, ("sid %s is not in our domain\n",
5320                           sid_string_dbg(&ginfo->sid)));
5321                 return NT_STATUS_NO_SUCH_GROUP;
5322         }
5323
5324         DEBUG(10, ("lookup on Domain SID\n"));
5325
5326         become_root();
5327         status = pdb_enum_group_members(p->mem_ctx, &ginfo->sid,
5328                                         &rid, &num_members);
5329         unbecome_root();
5330
5331         if (!NT_STATUS_IS_OK(status))
5332                 return status;
5333
5334         if (num_members) {
5335                 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
5336                 if (attr == NULL) {
5337                         return NT_STATUS_NO_MEMORY;
5338                 }
5339         } else {
5340                 attr = NULL;
5341         }
5342
5343         for (i=0; i<num_members; i++)
5344                 attr[i] = SID_NAME_USER;
5345
5346         rids->count = num_members;
5347         rids->types = attr;
5348         rids->rids = rid;
5349
5350         *r->out.rids = rids;
5351
5352         return NT_STATUS_OK;
5353 }
5354
5355 /*********************************************************************
5356  _samr_AddAliasMember
5357 *********************************************************************/
5358
5359 NTSTATUS _samr_AddAliasMember(pipes_struct *p,
5360                               struct samr_AddAliasMember *r)
5361 {
5362         struct samr_alias_info *ainfo;
5363         NTSTATUS status;
5364
5365         ainfo = policy_handle_find(p, r->in.alias_handle,
5366                                    SAMR_ALIAS_ACCESS_ADD_MEMBER, NULL,
5367                                    struct samr_alias_info, &status);
5368         if (!NT_STATUS_IS_OK(status)) {
5369                 return status;
5370         }
5371
5372         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5373
5374         /******** BEGIN SeAddUsers BLOCK *********/
5375
5376         become_root();
5377         status = pdb_add_aliasmem(&ainfo->sid, r->in.sid);
5378         unbecome_root();
5379
5380         /******** END SeAddUsers BLOCK *********/
5381
5382         if (NT_STATUS_IS_OK(status)) {
5383                 force_flush_samr_cache(&ainfo->sid);
5384         }
5385
5386         return status;
5387 }
5388
5389 /*********************************************************************
5390  _samr_DeleteAliasMember
5391 *********************************************************************/
5392
5393 NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
5394                                  struct samr_DeleteAliasMember *r)
5395 {
5396         struct samr_alias_info *ainfo;
5397         NTSTATUS status;
5398
5399         ainfo = policy_handle_find(p, r->in.alias_handle,
5400                                    SAMR_ALIAS_ACCESS_REMOVE_MEMBER, NULL,
5401                                    struct samr_alias_info, &status);
5402         if (!NT_STATUS_IS_OK(status)) {
5403                 return status;
5404         }
5405
5406         DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
5407                    sid_string_dbg(&ainfo->sid)));
5408
5409         /******** BEGIN SeAddUsers BLOCK *********/
5410
5411         become_root();
5412         status = pdb_del_aliasmem(&ainfo->sid, r->in.sid);
5413         unbecome_root();
5414
5415         /******** END SeAddUsers BLOCK *********/
5416
5417         if (NT_STATUS_IS_OK(status)) {
5418                 force_flush_samr_cache(&ainfo->sid);
5419         }
5420
5421         return status;
5422 }
5423
5424 /*********************************************************************
5425  _samr_AddGroupMember
5426 *********************************************************************/
5427
5428 NTSTATUS _samr_AddGroupMember(pipes_struct *p,
5429                               struct samr_AddGroupMember *r)
5430 {
5431         struct samr_group_info *ginfo;
5432         NTSTATUS status;
5433         uint32 group_rid;
5434
5435         ginfo = policy_handle_find(p, r->in.group_handle,
5436                                    SAMR_GROUP_ACCESS_ADD_MEMBER, NULL,
5437                                    struct samr_group_info, &status);
5438         if (!NT_STATUS_IS_OK(status)) {
5439                 return status;
5440         }
5441
5442         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5443
5444         if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5445                                 &group_rid)) {
5446                 return NT_STATUS_INVALID_HANDLE;
5447         }
5448
5449         /******** BEGIN SeAddUsers BLOCK *********/
5450
5451         become_root();
5452         status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
5453         unbecome_root();
5454
5455         /******** END SeAddUsers BLOCK *********/
5456
5457         force_flush_samr_cache(&ginfo->sid);
5458
5459         return status;
5460 }
5461
5462 /*********************************************************************
5463  _samr_DeleteGroupMember
5464 *********************************************************************/
5465
5466 NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
5467                                  struct samr_DeleteGroupMember *r)
5468
5469 {
5470         struct samr_group_info *ginfo;
5471         NTSTATUS status;
5472         uint32 group_rid;
5473
5474         /*
5475          * delete the group member named r->in.rid
5476          * who is a member of the sid associated with the handle
5477          * the rid is a user's rid as the group is a domain group.
5478          */
5479
5480         ginfo = policy_handle_find(p, r->in.group_handle,
5481                                    SAMR_GROUP_ACCESS_REMOVE_MEMBER, NULL,
5482                                    struct samr_group_info, &status);
5483         if (!NT_STATUS_IS_OK(status)) {
5484                 return status;
5485         }
5486
5487         if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5488                                 &group_rid)) {
5489                 return NT_STATUS_INVALID_HANDLE;
5490         }
5491
5492         /******** BEGIN SeAddUsers BLOCK *********/
5493
5494         become_root();
5495         status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
5496         unbecome_root();
5497
5498         /******** END SeAddUsers BLOCK *********/
5499
5500         force_flush_samr_cache(&ginfo->sid);
5501
5502         return status;
5503 }
5504
5505 /*********************************************************************
5506  _samr_DeleteUser
5507 *********************************************************************/
5508
5509 NTSTATUS _samr_DeleteUser(pipes_struct *p,
5510                           struct samr_DeleteUser *r)
5511 {
5512         struct samr_user_info *uinfo;
5513         NTSTATUS status;
5514         struct samu *sam_pass=NULL;
5515         bool ret;
5516
5517         DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
5518
5519         uinfo = policy_handle_find(p, r->in.user_handle,
5520                                    STD_RIGHT_DELETE_ACCESS, NULL,
5521                                    struct samr_user_info, &status);
5522         if (!NT_STATUS_IS_OK(status)) {
5523                 return status;
5524         }
5525
5526         if (!sid_check_is_in_our_domain(&uinfo->sid))
5527                 return NT_STATUS_CANNOT_DELETE;
5528
5529         /* check if the user exists before trying to delete */
5530         if ( !(sam_pass = samu_new( NULL )) ) {
5531                 return NT_STATUS_NO_MEMORY;
5532         }
5533
5534         become_root();
5535         ret = pdb_getsampwsid(sam_pass, &uinfo->sid);
5536         unbecome_root();
5537
5538         if(!ret) {
5539                 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
5540                         sid_string_dbg(&uinfo->sid)));
5541                 TALLOC_FREE(sam_pass);
5542                 return NT_STATUS_NO_SUCH_USER;
5543         }
5544
5545         /******** BEGIN SeAddUsers BLOCK *********/
5546
5547         become_root();
5548         status = pdb_delete_user(p->mem_ctx, sam_pass);
5549         unbecome_root();
5550
5551         /******** END SeAddUsers BLOCK *********/
5552
5553         if ( !NT_STATUS_IS_OK(status) ) {
5554                 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
5555                          "user %s: %s.\n", pdb_get_username(sam_pass),
5556                          nt_errstr(status)));
5557                 TALLOC_FREE(sam_pass);
5558                 return status;
5559         }
5560
5561
5562         TALLOC_FREE(sam_pass);
5563
5564         if (!close_policy_hnd(p, r->in.user_handle))
5565                 return NT_STATUS_OBJECT_NAME_INVALID;
5566
5567         ZERO_STRUCTP(r->out.user_handle);
5568
5569         force_flush_samr_cache(&uinfo->sid);
5570
5571         return NT_STATUS_OK;
5572 }
5573
5574 /*********************************************************************
5575  _samr_DeleteDomainGroup
5576 *********************************************************************/
5577
5578 NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
5579                                  struct samr_DeleteDomainGroup *r)
5580 {
5581         struct samr_group_info *ginfo;
5582         NTSTATUS status;
5583         uint32 group_rid;
5584
5585         DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
5586
5587         ginfo = policy_handle_find(p, r->in.group_handle,
5588                                    STD_RIGHT_DELETE_ACCESS, NULL,
5589                                    struct samr_group_info, &status);
5590         if (!NT_STATUS_IS_OK(status)) {
5591                 return status;
5592         }
5593
5594         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5595
5596         if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5597                                 &group_rid)) {
5598                 return NT_STATUS_NO_SUCH_GROUP;
5599         }
5600
5601         /******** BEGIN SeAddUsers BLOCK *********/
5602
5603         become_root();
5604         status = pdb_delete_dom_group(p->mem_ctx, group_rid);
5605         unbecome_root();
5606
5607         /******** END SeAddUsers BLOCK *********/
5608
5609         if ( !NT_STATUS_IS_OK(status) ) {
5610                 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
5611                          "entry for group %s: %s\n",
5612                          sid_string_dbg(&ginfo->sid),
5613                          nt_errstr(status)));
5614                 return status;
5615         }
5616
5617         if (!close_policy_hnd(p, r->in.group_handle))
5618                 return NT_STATUS_OBJECT_NAME_INVALID;
5619
5620         force_flush_samr_cache(&ginfo->sid);
5621
5622         return NT_STATUS_OK;
5623 }
5624
5625 /*********************************************************************
5626  _samr_DeleteDomAlias
5627 *********************************************************************/
5628
5629 NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
5630                               struct samr_DeleteDomAlias *r)
5631 {
5632         struct samr_alias_info *ainfo;
5633         NTSTATUS status;
5634
5635         DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
5636
5637         ainfo = policy_handle_find(p, r->in.alias_handle,
5638                                    STD_RIGHT_DELETE_ACCESS, NULL,
5639                                    struct samr_alias_info, &status);
5640         if (!NT_STATUS_IS_OK(status)) {
5641                 return status;
5642         }
5643
5644         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5645
5646         /* Don't let Windows delete builtin groups */
5647
5648         if ( sid_check_is_in_builtin( &ainfo->sid ) ) {
5649                 return NT_STATUS_SPECIAL_ACCOUNT;
5650         }
5651
5652         if (!sid_check_is_in_our_domain(&ainfo->sid))
5653                 return NT_STATUS_NO_SUCH_ALIAS;
5654
5655         DEBUG(10, ("lookup on Local SID\n"));
5656
5657         /******** BEGIN SeAddUsers BLOCK *********/
5658
5659         become_root();
5660         /* Have passdb delete the alias */
5661         status = pdb_delete_alias(&ainfo->sid);
5662         unbecome_root();
5663
5664         /******** END SeAddUsers BLOCK *********/
5665
5666         if ( !NT_STATUS_IS_OK(status))
5667                 return status;
5668
5669         if (!close_policy_hnd(p, r->in.alias_handle))
5670                 return NT_STATUS_OBJECT_NAME_INVALID;
5671
5672         force_flush_samr_cache(&ainfo->sid);
5673
5674         return NT_STATUS_OK;
5675 }
5676
5677 /*********************************************************************
5678  _samr_CreateDomainGroup
5679 *********************************************************************/
5680
5681 NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
5682                                  struct samr_CreateDomainGroup *r)
5683
5684 {
5685         NTSTATUS status;
5686         const char *name;
5687         struct samr_domain_info *dinfo;
5688         struct samr_group_info *ginfo;
5689
5690         dinfo = policy_handle_find(p, r->in.domain_handle,
5691                                    SAMR_DOMAIN_ACCESS_CREATE_GROUP, NULL,
5692                                    struct samr_domain_info, &status);
5693         if (!NT_STATUS_IS_OK(status)) {
5694                 return status;
5695         }
5696
5697         if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
5698                 return NT_STATUS_ACCESS_DENIED;
5699
5700         name = r->in.name->string;
5701         if (name == NULL) {
5702                 return NT_STATUS_NO_MEMORY;
5703         }
5704
5705         status = can_create(p->mem_ctx, name);
5706         if (!NT_STATUS_IS_OK(status)) {
5707                 return status;
5708         }
5709
5710         /******** BEGIN SeAddUsers BLOCK *********/
5711
5712         become_root();
5713         /* check that we successfully create the UNIX group */
5714         status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
5715         unbecome_root();
5716
5717         /******** END SeAddUsers BLOCK *********/
5718
5719         /* check if we should bail out here */
5720
5721         if ( !NT_STATUS_IS_OK(status) )
5722                 return status;
5723
5724         ginfo = policy_handle_create(p, r->out.group_handle,
5725                                      GENERIC_RIGHTS_GROUP_ALL_ACCESS,
5726                                      struct samr_group_info, &status);
5727         if (!NT_STATUS_IS_OK(status)) {
5728                 return status;
5729         }
5730         sid_compose(&ginfo->sid, &dinfo->sid, *r->out.rid);
5731
5732         force_flush_samr_cache(&dinfo->sid);
5733
5734         return NT_STATUS_OK;
5735 }
5736
5737 /*********************************************************************
5738  _samr_CreateDomAlias
5739 *********************************************************************/
5740
5741 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
5742                               struct samr_CreateDomAlias *r)
5743 {
5744         DOM_SID info_sid;
5745         const char *name = NULL;
5746         struct samr_domain_info *dinfo;
5747         struct samr_alias_info *ainfo;
5748         gid_t gid;
5749         NTSTATUS result;
5750
5751         dinfo = policy_handle_find(p, r->in.domain_handle,
5752                                    SAMR_DOMAIN_ACCESS_CREATE_ALIAS, NULL,
5753                                    struct samr_domain_info, &result);
5754         if (!NT_STATUS_IS_OK(result)) {
5755                 return result;
5756         }
5757
5758         if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
5759                 return NT_STATUS_ACCESS_DENIED;
5760
5761         name = r->in.alias_name->string;
5762
5763         result = can_create(p->mem_ctx, name);
5764         if (!NT_STATUS_IS_OK(result)) {
5765                 return result;
5766         }
5767
5768         /******** BEGIN SeAddUsers BLOCK *********/
5769
5770         become_root();
5771         /* Have passdb create the alias */
5772         result = pdb_create_alias(name, r->out.rid);
5773         unbecome_root();
5774
5775         /******** END SeAddUsers BLOCK *********/
5776
5777         if (!NT_STATUS_IS_OK(result)) {
5778                 DEBUG(10, ("pdb_create_alias failed: %s\n",
5779                            nt_errstr(result)));
5780                 return result;
5781         }
5782
5783         sid_compose(&info_sid, &dinfo->sid, *r->out.rid);
5784
5785         if (!sid_to_gid(&info_sid, &gid)) {
5786                 DEBUG(10, ("Could not find alias just created\n"));
5787                 return NT_STATUS_ACCESS_DENIED;
5788         }
5789
5790         /* check if the group has been successfully created */
5791         if ( getgrgid(gid) == NULL ) {
5792                 DEBUG(10, ("getgrgid(%u) of just created alias failed\n",
5793                            (unsigned int)gid));
5794                 return NT_STATUS_ACCESS_DENIED;
5795         }
5796
5797         ainfo = policy_handle_create(p, r->out.alias_handle,
5798                                      GENERIC_RIGHTS_ALIAS_ALL_ACCESS,
5799                                      struct samr_alias_info, &result);
5800         if (!NT_STATUS_IS_OK(result)) {
5801                 return result;
5802         }
5803         ainfo->sid = info_sid;
5804
5805         force_flush_samr_cache(&info_sid);
5806
5807         return NT_STATUS_OK;
5808 }
5809
5810 /*********************************************************************
5811  _samr_QueryGroupInfo
5812 *********************************************************************/
5813
5814 NTSTATUS _samr_QueryGroupInfo(pipes_struct *p,
5815                               struct samr_QueryGroupInfo *r)
5816 {
5817         struct samr_group_info *ginfo;
5818         NTSTATUS status;
5819         GROUP_MAP map;
5820         union samr_GroupInfo *info = NULL;
5821         bool ret;
5822         uint32_t attributes = SE_GROUP_MANDATORY |
5823                               SE_GROUP_ENABLED_BY_DEFAULT |
5824                               SE_GROUP_ENABLED;
5825         const char *group_name = NULL;
5826         const char *group_description = NULL;
5827
5828         ginfo = policy_handle_find(p, r->in.group_handle,
5829                                    SAMR_GROUP_ACCESS_LOOKUP_INFO, NULL,
5830                                    struct samr_group_info, &status);
5831         if (!NT_STATUS_IS_OK(status)) {
5832                 return status;
5833         }
5834
5835         become_root();
5836         ret = get_domain_group_from_sid(ginfo->sid, &map);
5837         unbecome_root();
5838         if (!ret)
5839                 return NT_STATUS_INVALID_HANDLE;
5840
5841         /* FIXME: map contains fstrings */
5842         group_name = talloc_strdup(r, map.nt_name);
5843         group_description = talloc_strdup(r, map.comment);
5844
5845         info = TALLOC_ZERO_P(p->mem_ctx, union samr_GroupInfo);
5846         if (!info) {
5847                 return NT_STATUS_NO_MEMORY;
5848         }
5849
5850         switch (r->in.level) {
5851                 case 1: {
5852                         uint32 *members;
5853                         size_t num_members;
5854
5855                         become_root();
5856                         status = pdb_enum_group_members(
5857                                 p->mem_ctx, &ginfo->sid, &members,
5858                                 &num_members);
5859                         unbecome_root();
5860
5861                         if (!NT_STATUS_IS_OK(status)) {
5862                                 return status;
5863                         }
5864
5865                         info->all.name.string           = group_name;
5866                         info->all.attributes            = attributes;
5867                         info->all.num_members           = num_members;
5868                         info->all.description.string    = group_description;
5869                         break;
5870                 }
5871                 case 2:
5872                         info->name.string = group_name;
5873                         break;
5874                 case 3:
5875                         info->attributes.attributes = attributes;
5876                         break;
5877                 case 4:
5878                         info->description.string = group_description;
5879                         break;
5880                 case 5: {
5881                         /*
5882                         uint32 *members;
5883                         size_t num_members;
5884                         */
5885
5886                         /*
5887                         become_root();
5888                         status = pdb_enum_group_members(
5889                                 p->mem_ctx, &ginfo->sid, &members,
5890                                 &num_members);
5891                         unbecome_root();
5892
5893                         if (!NT_STATUS_IS_OK(status)) {
5894                                 return status;
5895                         }
5896                         */
5897                         info->all2.name.string          = group_name;
5898                         info->all2.attributes           = attributes;
5899                         info->all2.num_members          = 0; /* num_members - in w2k3 this is always 0 */
5900                         info->all2.description.string   = group_description;
5901
5902                         break;
5903                 }
5904                 default:
5905                         return NT_STATUS_INVALID_INFO_CLASS;
5906         }
5907
5908         *r->out.info = info;
5909
5910         return NT_STATUS_OK;
5911 }
5912
5913 /*********************************************************************
5914  _samr_SetGroupInfo
5915 *********************************************************************/
5916
5917 NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
5918                             struct samr_SetGroupInfo *r)
5919 {
5920         struct samr_group_info *ginfo;
5921         GROUP_MAP map;
5922         NTSTATUS status;
5923         bool ret;
5924
5925         ginfo = policy_handle_find(p, r->in.group_handle,
5926                                    SAMR_GROUP_ACCESS_SET_INFO, NULL,
5927                                    struct samr_group_info, &status);
5928         if (!NT_STATUS_IS_OK(status)) {
5929                 return status;
5930         }
5931
5932         become_root();
5933         ret = get_domain_group_from_sid(ginfo->sid, &map);
5934         unbecome_root();
5935         if (!ret)
5936                 return NT_STATUS_NO_SUCH_GROUP;
5937
5938         switch (r->in.level) {
5939                 case 1:
5940                         fstrcpy(map.comment, r->in.info->all.description.string);
5941                         break;
5942                 case 2:
5943                         /* group rename is not supported yet */
5944                         return NT_STATUS_NOT_SUPPORTED;
5945                 case 4:
5946                         fstrcpy(map.comment, r->in.info->description.string);
5947                         break;
5948                 default:
5949                         return NT_STATUS_INVALID_INFO_CLASS;
5950         }
5951
5952         /******** BEGIN SeAddUsers BLOCK *********/
5953
5954         become_root();
5955         status = pdb_update_group_mapping_entry(&map);
5956         unbecome_root();
5957
5958         /******** End SeAddUsers BLOCK *********/
5959
5960         if (NT_STATUS_IS_OK(status)) {
5961                 force_flush_samr_cache(&ginfo->sid);
5962         }
5963
5964         return status;
5965 }
5966
5967 /*********************************************************************
5968  _samr_SetAliasInfo
5969 *********************************************************************/
5970
5971 NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
5972                             struct samr_SetAliasInfo *r)
5973 {
5974         struct samr_alias_info *ainfo;
5975         struct acct_info info;
5976         NTSTATUS status;
5977
5978         ainfo = policy_handle_find(p, r->in.alias_handle,
5979                                    SAMR_ALIAS_ACCESS_SET_INFO, NULL,
5980                                    struct samr_alias_info, &status);
5981         if (!NT_STATUS_IS_OK(status)) {
5982                 return status;
5983         }
5984
5985         /* get the current group information */
5986
5987         become_root();
5988         status = pdb_get_aliasinfo( &ainfo->sid, &info );
5989         unbecome_root();
5990
5991         if ( !NT_STATUS_IS_OK(status))
5992                 return status;
5993
5994         switch (r->in.level) {
5995                 case ALIASINFONAME:
5996                 {
5997                         fstring group_name;
5998
5999                         /* We currently do not support renaming groups in the
6000                            the BUILTIN domain.  Refer to util_builtin.c to understand
6001                            why.  The eventually needs to be fixed to be like Windows
6002                            where you can rename builtin groups, just not delete them */
6003
6004                         if ( sid_check_is_in_builtin( &ainfo->sid ) ) {
6005                                 return NT_STATUS_SPECIAL_ACCOUNT;
6006                         }
6007
6008                         /* There has to be a valid name (and it has to be different) */
6009
6010                         if ( !r->in.info->name.string )
6011                                 return NT_STATUS_INVALID_PARAMETER;
6012
6013                         /* If the name is the same just reply "ok".  Yes this
6014                            doesn't allow you to change the case of a group name. */
6015
6016                         if ( strequal( r->in.info->name.string, info.acct_name ) )
6017                                 return NT_STATUS_OK;
6018
6019                         fstrcpy( info.acct_name, r->in.info->name.string);
6020
6021                         /* make sure the name doesn't already exist as a user
6022                            or local group */
6023
6024                         fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
6025                         status = can_create( p->mem_ctx, group_name );
6026                         if ( !NT_STATUS_IS_OK( status ) )
6027                                 return status;
6028                         break;
6029                 }
6030                 case ALIASINFODESCRIPTION:
6031                         if (r->in.info->description.string) {
6032                                 fstrcpy(info.acct_desc,
6033                                         r->in.info->description.string);
6034                         } else {
6035                                 fstrcpy( info.acct_desc, "" );
6036                         }
6037                         break;
6038                 default:
6039                         return NT_STATUS_INVALID_INFO_CLASS;
6040         }
6041
6042         /******** BEGIN SeAddUsers BLOCK *********/
6043
6044         become_root();
6045         status = pdb_set_aliasinfo( &ainfo->sid, &info );
6046         unbecome_root();
6047
6048         /******** End SeAddUsers BLOCK *********/
6049
6050         if (NT_STATUS_IS_OK(status))
6051                 force_flush_samr_cache(&ainfo->sid);
6052
6053         return status;
6054 }
6055
6056 /****************************************************************
6057  _samr_GetDomPwInfo
6058 ****************************************************************/
6059
6060 NTSTATUS _samr_GetDomPwInfo(pipes_struct *p,
6061                             struct samr_GetDomPwInfo *r)
6062 {
6063         uint32_t min_password_length = 0;
6064         uint32_t password_properties = 0;
6065
6066         /* Perform access check.  Since this rpc does not require a
6067            policy handle it will not be caught by the access checks on
6068            SAMR_CONNECT or SAMR_CONNECT_ANON. */
6069
6070         if (!pipe_access_check(p)) {
6071                 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
6072                 return NT_STATUS_ACCESS_DENIED;
6073         }
6074
6075         become_root();
6076         pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
6077                                &min_password_length);
6078         pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
6079                                &password_properties);
6080         unbecome_root();
6081
6082         if (lp_check_password_script() && *lp_check_password_script()) {
6083                 password_properties |= DOMAIN_PASSWORD_COMPLEX;
6084         }
6085
6086         r->out.info->min_password_length = min_password_length;
6087         r->out.info->password_properties = password_properties;
6088
6089         return NT_STATUS_OK;
6090 }
6091
6092 /*********************************************************************
6093  _samr_OpenGroup
6094 *********************************************************************/
6095
6096 NTSTATUS _samr_OpenGroup(pipes_struct *p,
6097                          struct samr_OpenGroup *r)
6098
6099 {
6100         DOM_SID info_sid;
6101         GROUP_MAP map;
6102         struct samr_domain_info *dinfo;
6103         struct samr_group_info *ginfo;
6104         SEC_DESC         *psd = NULL;
6105         uint32            acc_granted;
6106         uint32            des_access = r->in.access_mask;
6107         size_t            sd_size;
6108         NTSTATUS          status;
6109         bool ret;
6110         SE_PRIV se_rights;
6111
6112         dinfo = policy_handle_find(p, r->in.domain_handle,
6113                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
6114                                    struct samr_domain_info, &status);
6115         if (!NT_STATUS_IS_OK(status)) {
6116                 return status;
6117         }
6118
6119         /*check if access can be granted as requested by client. */
6120         map_max_allowed_access(p->server_info->ptok, &des_access);
6121
6122         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
6123         se_map_generic(&des_access,&grp_generic_mapping);
6124
6125         se_priv_copy( &se_rights, &se_add_users );
6126
6127         status = access_check_samr_object(psd, p->server_info->ptok,
6128                 &se_rights, SAMR_GROUP_ACCESS_ADD_MEMBER,
6129                 des_access, &acc_granted, "_samr_OpenGroup");
6130
6131         if ( !NT_STATUS_IS_OK(status) )
6132                 return status;
6133
6134         /* this should not be hard-coded like this */
6135
6136         if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
6137                 return NT_STATUS_ACCESS_DENIED;
6138
6139         sid_compose(&info_sid, &dinfo->sid, r->in.rid);
6140
6141         DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n",
6142                    sid_string_dbg(&info_sid)));
6143
6144         /* check if that group really exists */
6145         become_root();
6146         ret = get_domain_group_from_sid(info_sid, &map);
6147         unbecome_root();
6148         if (!ret)
6149                 return NT_STATUS_NO_SUCH_GROUP;
6150
6151         ginfo = policy_handle_create(p, r->out.group_handle,
6152                                      GENERIC_RIGHTS_GROUP_ALL_ACCESS,
6153                                      struct samr_group_info, &status);
6154         if (!NT_STATUS_IS_OK(status)) {
6155                 return status;
6156         }
6157         ginfo->sid = info_sid;
6158
6159         return NT_STATUS_OK;
6160 }
6161
6162 /*********************************************************************
6163  _samr_RemoveMemberFromForeignDomain
6164 *********************************************************************/
6165
6166 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
6167                                              struct samr_RemoveMemberFromForeignDomain *r)
6168 {
6169         struct samr_domain_info *dinfo;
6170         NTSTATUS                result;
6171
6172         DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
6173                  sid_string_dbg(r->in.sid)));
6174
6175         /* Find the policy handle. Open a policy on it. */
6176
6177         dinfo = policy_handle_find(p, r->in.domain_handle,
6178                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
6179                                    struct samr_domain_info, &result);
6180         if (!NT_STATUS_IS_OK(result)) {
6181                 return result;
6182         }
6183
6184         DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
6185                   sid_string_dbg(&dinfo->sid)));
6186
6187         /* we can only delete a user from a group since we don't have
6188            nested groups anyways.  So in the latter case, just say OK */
6189
6190         /* TODO: The above comment nowadays is bogus. Since we have nested
6191          * groups now, and aliases members are never reported out of the unix
6192          * group membership, the "just say OK" makes this call a no-op. For
6193          * us. This needs fixing however. */
6194
6195         /* I've only ever seen this in the wild when deleting a user from
6196          * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
6197          * is the user about to be deleted. I very much suspect this is the
6198          * only application of this call. To verify this, let people report
6199          * other cases. */
6200
6201         if (!sid_check_is_builtin(&dinfo->sid)) {
6202                 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
6203                          "global_sam_sid() = %s\n",
6204                          sid_string_dbg(&dinfo->sid),
6205                          sid_string_dbg(get_global_sam_sid())));
6206                 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
6207                 return NT_STATUS_OK;
6208         }
6209
6210         force_flush_samr_cache(&dinfo->sid);
6211
6212         result = NT_STATUS_OK;
6213
6214         return result;
6215 }
6216
6217 /*******************************************************************
6218  _samr_QueryDomainInfo2
6219  ********************************************************************/
6220
6221 NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
6222                                 struct samr_QueryDomainInfo2 *r)
6223 {
6224         struct samr_QueryDomainInfo q;
6225
6226         q.in.domain_handle      = r->in.domain_handle;
6227         q.in.level              = r->in.level;
6228
6229         q.out.info              = r->out.info;
6230
6231         return _samr_QueryDomainInfo(p, &q);
6232 }
6233
6234 /*******************************************************************
6235  _samr_SetDomainInfo
6236  ********************************************************************/
6237
6238 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
6239                              struct samr_SetDomainInfo *r)
6240 {
6241         struct samr_domain_info *dinfo;
6242         time_t u_expire, u_min_age;
6243         time_t u_logout;
6244         time_t u_lock_duration, u_reset_time;
6245         NTSTATUS result;
6246         uint32_t acc_required = 0;
6247
6248         DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
6249
6250         switch (r->in.level) {
6251         case 1: /* DomainPasswordInformation */
6252         case 12: /* DomainLockoutInformation */
6253                 /* DOMAIN_WRITE_PASSWORD_PARAMETERS */
6254                 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_1;
6255                 break;
6256         case 3: /* DomainLogoffInformation */
6257         case 4: /* DomainOemInformation */
6258                 /* DOMAIN_WRITE_OTHER_PARAMETERS */
6259                 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_2;
6260                 break;
6261         case 6: /* DomainReplicationInformation */
6262         case 9: /* DomainStateInformation */
6263         case 7: /* DomainServerRoleInformation */
6264                 /* DOMAIN_ADMINISTER_SERVER */
6265                 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_3;
6266                 break;
6267         default:
6268                 return NT_STATUS_INVALID_INFO_CLASS;
6269         }
6270
6271         dinfo = policy_handle_find(p, r->in.domain_handle,
6272                                    acc_required, NULL,
6273                                    struct samr_domain_info, &result);
6274         if (!NT_STATUS_IS_OK(result)) {
6275                 return result;
6276         }
6277
6278         DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
6279
6280         switch (r->in.level) {
6281                 case 1:
6282                         u_expire=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.max_password_age);
6283                         u_min_age=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.min_password_age);
6284                         pdb_set_account_policy(AP_MIN_PASSWORD_LEN, (uint32)r->in.info->info1.min_password_length);
6285                         pdb_set_account_policy(AP_PASSWORD_HISTORY, (uint32)r->in.info->info1.password_history_length);
6286                         pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)r->in.info->info1.password_properties);
6287                         pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
6288                         pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
6289                         break;
6290                 case 3:
6291                         u_logout=nt_time_to_unix_abs((NTTIME *)&r->in.info->info3.force_logoff_time);
6292                         pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
6293                         break;
6294                 case 4:
6295                         break;
6296                 case 6:
6297                         break;
6298                 case 7:
6299                         break;
6300                 case 9:
6301                         break;
6302                 case 12:
6303                         u_lock_duration=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_duration);
6304                         if (u_lock_duration != -1)
6305                                 u_lock_duration /= 60;
6306
6307                         u_reset_time=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_window)/60;
6308
6309                         pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
6310                         pdb_set_account_policy(AP_RESET_COUNT_TIME, (int)u_reset_time);
6311                         pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT, (uint32)r->in.info->info12.lockout_threshold);
6312                         break;
6313                 default:
6314                         return NT_STATUS_INVALID_INFO_CLASS;
6315         }
6316
6317         DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
6318
6319         return NT_STATUS_OK;
6320 }
6321
6322 /****************************************************************
6323  _samr_GetDisplayEnumerationIndex
6324 ****************************************************************/
6325
6326 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
6327                                           struct samr_GetDisplayEnumerationIndex *r)
6328 {
6329         struct samr_domain_info *dinfo;
6330         uint32_t max_entries = (uint32_t) -1;
6331         uint32_t enum_context = 0;
6332         int i;
6333         uint32_t num_account = 0;
6334         struct samr_displayentry *entries = NULL;
6335         NTSTATUS status;
6336
6337         DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
6338
6339         dinfo = policy_handle_find(p, r->in.domain_handle,
6340                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
6341                                    struct samr_domain_info, &status);
6342         if (!NT_STATUS_IS_OK(status)) {
6343                 return status;
6344         }
6345
6346         if ((r->in.level < 1) || (r->in.level > 3)) {
6347                 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
6348                         "Unknown info level (%u)\n",
6349                         r->in.level));
6350                 return NT_STATUS_INVALID_INFO_CLASS;
6351         }
6352
6353         become_root();
6354
6355         /* The following done as ROOT. Don't return without unbecome_root(). */
6356
6357         switch (r->in.level) {
6358         case 1:
6359                 if (dinfo->disp_info->users == NULL) {
6360                         dinfo->disp_info->users = pdb_search_users(
6361                                 dinfo->disp_info, ACB_NORMAL);
6362                         if (dinfo->disp_info->users == NULL) {
6363                                 unbecome_root();
6364                                 return NT_STATUS_ACCESS_DENIED;
6365                         }
6366                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6367                                 "starting user enumeration at index %u\n",
6368                                 (unsigned int)enum_context));
6369                 } else {
6370                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6371                                 "using cached user enumeration at index %u\n",
6372                                 (unsigned int)enum_context));
6373                 }
6374                 num_account = pdb_search_entries(dinfo->disp_info->users,
6375                                                  enum_context, max_entries,
6376                                                  &entries);
6377                 break;
6378         case 2:
6379                 if (dinfo->disp_info->machines == NULL) {
6380                         dinfo->disp_info->machines = pdb_search_users(
6381                                 dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
6382                         if (dinfo->disp_info->machines == NULL) {
6383                                 unbecome_root();
6384                                 return NT_STATUS_ACCESS_DENIED;
6385                         }
6386                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6387                                 "starting machine enumeration at index %u\n",
6388                                 (unsigned int)enum_context));
6389                 } else {
6390                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6391                                 "using cached machine enumeration at index %u\n",
6392                                 (unsigned int)enum_context));
6393                 }
6394                 num_account = pdb_search_entries(dinfo->disp_info->machines,
6395                                                  enum_context, max_entries,
6396                                                  &entries);
6397                 break;
6398         case 3:
6399                 if (dinfo->disp_info->groups == NULL) {
6400                         dinfo->disp_info->groups = pdb_search_groups(
6401                                 dinfo->disp_info);
6402                         if (dinfo->disp_info->groups == NULL) {
6403                                 unbecome_root();
6404                                 return NT_STATUS_ACCESS_DENIED;
6405                         }
6406                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6407                                 "starting group enumeration at index %u\n",
6408                                 (unsigned int)enum_context));
6409                 } else {
6410                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6411                                 "using cached group enumeration at index %u\n",
6412                                 (unsigned int)enum_context));
6413                 }
6414                 num_account = pdb_search_entries(dinfo->disp_info->groups,
6415                                                  enum_context, max_entries,
6416                                                  &entries);
6417                 break;
6418         default:
6419                 unbecome_root();
6420                 smb_panic("info class changed");
6421                 break;
6422         }
6423
6424         unbecome_root();
6425
6426         /* Ensure we cache this enumeration. */
6427         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
6428
6429         DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
6430                 r->in.name->string));
6431
6432         for (i=0; i<num_account; i++) {
6433                 if (strequal(entries[i].account_name, r->in.name->string)) {
6434                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6435                                 "found %s at idx %d\n",
6436                                 r->in.name->string, i));
6437                         *r->out.idx = i;
6438                         return NT_STATUS_OK;
6439                 }
6440         }
6441
6442         /* assuming account_name lives at the very end */
6443         *r->out.idx = num_account;
6444
6445         return NT_STATUS_NO_MORE_ENTRIES;
6446 }
6447
6448 /****************************************************************
6449  _samr_GetDisplayEnumerationIndex2
6450 ****************************************************************/
6451
6452 NTSTATUS _samr_GetDisplayEnumerationIndex2(pipes_struct *p,
6453                                            struct samr_GetDisplayEnumerationIndex2 *r)
6454 {
6455         struct samr_GetDisplayEnumerationIndex q;
6456
6457         q.in.domain_handle      = r->in.domain_handle;
6458         q.in.level              = r->in.level;
6459         q.in.name               = r->in.name;
6460
6461         q.out.idx               = r->out.idx;
6462
6463         return _samr_GetDisplayEnumerationIndex(p, &q);
6464 }
6465
6466 /****************************************************************
6467  _samr_RidToSid
6468 ****************************************************************/
6469
6470 NTSTATUS _samr_RidToSid(pipes_struct *p,
6471                         struct samr_RidToSid *r)
6472 {
6473         struct samr_domain_info *dinfo;
6474         NTSTATUS status;
6475         struct dom_sid sid;
6476
6477         dinfo = policy_handle_find(p, r->in.domain_handle,
6478                                    0, NULL,
6479                                    struct samr_domain_info, &status);
6480         if (!NT_STATUS_IS_OK(status)) {
6481                 return status;
6482         }
6483
6484         if (!sid_compose(&sid, &dinfo->sid, r->in.rid)) {
6485                 return NT_STATUS_NO_MEMORY;
6486         }
6487
6488         *r->out.sid = sid_dup_talloc(p->mem_ctx, &sid);
6489         if (!*r->out.sid) {
6490                 return NT_STATUS_NO_MEMORY;
6491         }
6492
6493         return NT_STATUS_OK;
6494 }
6495
6496 /****************************************************************
6497 ****************************************************************/
6498
6499 NTSTATUS _samr_Shutdown(pipes_struct *p,
6500                         struct samr_Shutdown *r)
6501 {
6502         p->rng_fault_state = true;
6503         return NT_STATUS_NOT_IMPLEMENTED;
6504 }
6505
6506 /****************************************************************
6507 ****************************************************************/
6508
6509 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
6510                                           struct samr_SetMemberAttributesOfGroup *r)
6511 {
6512         p->rng_fault_state = true;
6513         return NT_STATUS_NOT_IMPLEMENTED;
6514 }
6515
6516 /****************************************************************
6517 ****************************************************************/
6518
6519 NTSTATUS _samr_TestPrivateFunctionsDomain(pipes_struct *p,
6520                                           struct samr_TestPrivateFunctionsDomain *r)
6521 {
6522         return NT_STATUS_NOT_IMPLEMENTED;
6523 }
6524
6525 /****************************************************************
6526 ****************************************************************/
6527
6528 NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
6529                                         struct samr_TestPrivateFunctionsUser *r)
6530 {
6531         return NT_STATUS_NOT_IMPLEMENTED;
6532 }
6533
6534 /****************************************************************
6535 ****************************************************************/
6536
6537 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
6538                                          struct samr_AddMultipleMembersToAlias *r)
6539 {
6540         p->rng_fault_state = true;
6541         return NT_STATUS_NOT_IMPLEMENTED;
6542 }
6543
6544 /****************************************************************
6545 ****************************************************************/
6546
6547 NTSTATUS _samr_RemoveMultipleMembersFromAlias(pipes_struct *p,
6548                                               struct samr_RemoveMultipleMembersFromAlias *r)
6549 {
6550         p->rng_fault_state = true;
6551         return NT_STATUS_NOT_IMPLEMENTED;
6552 }
6553
6554 /****************************************************************
6555 ****************************************************************/
6556
6557 NTSTATUS _samr_SetBootKeyInformation(pipes_struct *p,
6558                                      struct samr_SetBootKeyInformation *r)
6559 {
6560         p->rng_fault_state = true;
6561         return NT_STATUS_NOT_IMPLEMENTED;
6562 }
6563
6564 /****************************************************************
6565 ****************************************************************/
6566
6567 NTSTATUS _samr_GetBootKeyInformation(pipes_struct *p,
6568                                      struct samr_GetBootKeyInformation *r)
6569 {
6570         p->rng_fault_state = true;
6571         return NT_STATUS_NOT_IMPLEMENTED;
6572 }
6573
6574 /****************************************************************
6575 ****************************************************************/
6576
6577 NTSTATUS _samr_SetDsrmPassword(pipes_struct *p,
6578                                struct samr_SetDsrmPassword *r)
6579 {
6580         p->rng_fault_state = true;
6581         return NT_STATUS_NOT_IMPLEMENTED;
6582 }
6583
6584 /****************************************************************
6585 ****************************************************************/
6586
6587 NTSTATUS _samr_ValidatePassword(pipes_struct *p,
6588                                 struct samr_ValidatePassword *r)
6589 {
6590         p->rng_fault_state = true;
6591         return NT_STATUS_NOT_IMPLEMENTED;
6592 }