source3/rpc_server/srv_samr_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell                   1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton      1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997,
   7  *  Copyright (C) Marc Jacobsen                     1999,
   8  *  Copyright (C) Jeremy Allison                    2001-2008,
   9  *  Copyright (C) Jean François Micouleau           1998-2001,
  10  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
  11  *  Copyright (C) Gerald (Jerry) Carter             2003-2004,
  12  *  Copyright (C) Simo Sorce                        2003.
  13  *  Copyright (C) Volker Lendecke                   2005.
  14  *  Copyright (C) Guenther Deschner                 2008.
  15  *
  16  *  This program is free software; you can redistribute it and/or modify
  17  *  it under the terms of the GNU General Public License as published by
  18  *  the Free Software Foundation; either version 3 of the License, or
  19  *  (at your option) any later version.
  20  *
  21  *  This program is distributed in the hope that it will be useful,
  22  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  *  GNU General Public License for more details.
  25  *
  26  *  You should have received a copy of the GNU General Public License
  27  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  28  */
  29
  30 /*
  31  * This is the implementation of the SAMR code.
  32  */
  33
  34 #include "includes.h"
  35 #include "smbd/globals.h"
  36 #include "../libcli/auth/libcli_auth.h"
  37
  38 #undef DBGC_CLASS
  39 #define DBGC_CLASS DBGC_RPC_SRV
  40
  41 #define SAMR_USR_RIGHTS_WRITE_PW \
  42                 ( READ_CONTROL_ACCESS           | \
  43                   SAMR_USER_ACCESS_CHANGE_PASSWORD      | \
  44                   SAMR_USER_ACCESS_SET_LOC_COM)
  45 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
  46                 ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
  47
  48 #define DISP_INFO_CACHE_TIMEOUT 10
  49
  50 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
  51 #define MAX_SAM_ENTRIES_W95 50
  52
  53 struct samr_connect_info {
  54         uint8_t dummy;
  55 };
  56
  57 struct samr_domain_info {
  58         struct dom_sid sid;
  59         struct disp_info *disp_info;
  60 };
  61
  62 struct samr_user_info {
  63         struct dom_sid sid;
  64 };
  65
  66 struct samr_group_info {
  67         struct dom_sid sid;
  68 };
  69
  70 struct samr_alias_info {
  71         struct dom_sid sid;
  72 };
  73
  74 typedef struct disp_info {
  75         DOM_SID sid; /* identify which domain this is. */
  76         struct pdb_search *users; /* querydispinfo 1 and 4 */
  77         struct pdb_search *machines; /* querydispinfo 2 */
  78         struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
  79         struct pdb_search *aliases; /* enumaliases */
  80
  81         uint32_t enum_acb_mask;
  82         struct pdb_search *enum_users; /* enumusers with a mask */
  83
  84         struct timed_event *cache_timeout_event; /* cache idle timeout
  85                                                   * handler. */
  86 } DISP_INFO;
  87
  88 static const struct generic_mapping sam_generic_mapping = {
  89         GENERIC_RIGHTS_SAM_READ,
  90         GENERIC_RIGHTS_SAM_WRITE,
  91         GENERIC_RIGHTS_SAM_EXECUTE,
  92         GENERIC_RIGHTS_SAM_ALL_ACCESS};
  93 static const struct generic_mapping dom_generic_mapping = {
  94         GENERIC_RIGHTS_DOMAIN_READ,
  95         GENERIC_RIGHTS_DOMAIN_WRITE,
  96         GENERIC_RIGHTS_DOMAIN_EXECUTE,
  97         GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
  98 static const struct generic_mapping usr_generic_mapping = {
  99         GENERIC_RIGHTS_USER_READ,
 100         GENERIC_RIGHTS_USER_WRITE,
 101         GENERIC_RIGHTS_USER_EXECUTE,
 102         GENERIC_RIGHTS_USER_ALL_ACCESS};
 103 static const struct generic_mapping usr_nopwchange_generic_mapping = {
 104         GENERIC_RIGHTS_USER_READ,
 105         GENERIC_RIGHTS_USER_WRITE,
 106         GENERIC_RIGHTS_USER_EXECUTE & ~SAMR_USER_ACCESS_CHANGE_PASSWORD,
 107         GENERIC_RIGHTS_USER_ALL_ACCESS};
 108 static const struct generic_mapping grp_generic_mapping = {
 109         GENERIC_RIGHTS_GROUP_READ,
 110         GENERIC_RIGHTS_GROUP_WRITE,
 111         GENERIC_RIGHTS_GROUP_EXECUTE,
 112         GENERIC_RIGHTS_GROUP_ALL_ACCESS};
 113 static const struct generic_mapping ali_generic_mapping = {
 114         GENERIC_RIGHTS_ALIAS_READ,
 115         GENERIC_RIGHTS_ALIAS_WRITE,
 116         GENERIC_RIGHTS_ALIAS_EXECUTE,
 117         GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
 118
 119 /*******************************************************************
 120 *******************************************************************/
 121
 122 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
 123                                      const struct generic_mapping *map,
 124                                      DOM_SID *sid, uint32 sid_access )
 125 {
 126         DOM_SID domadmin_sid;
 127         SEC_ACE ace[5];         /* at most 5 entries */
 128         size_t i = 0;
 129
 130         SEC_ACL *psa = NULL;
 131
 132         /* basic access for Everyone */
 133
 134         init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
 135                         map->generic_execute | map->generic_read, 0);
 136
 137         /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 138
 139         init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
 140                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 141         init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
 142                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 143
 144         /* Add Full Access for Domain Admins if we are a DC */
 145
 146         if ( IS_DC ) {
 147                 sid_copy( &domadmin_sid, get_global_sam_sid() );
 148                 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
 149                 init_sec_ace(&ace[i++], &domadmin_sid,
 150                         SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
 151         }
 152
 153         /* if we have a sid, give it some special access */
 154
 155         if ( sid ) {
 156                 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, sid_access, 0);
 157         }
 158
 159         /* create the security descriptor */
 160
 161         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
 162                 return NT_STATUS_NO_MEMORY;
 163
 164         if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
 165                                   SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
 166                                   psa, sd_size)) == NULL)
 167                 return NT_STATUS_NO_MEMORY;
 168
 169         return NT_STATUS_OK;
 170 }
 171
 172 /*******************************************************************
 173  Checks if access to an object should be granted, and returns that
 174  level of access for further checks.
 175 ********************************************************************/
 176
 177 NTSTATUS access_check_object( SEC_DESC *psd, NT_USER_TOKEN *token,
 178                                           SE_PRIV *rights, uint32 rights_mask,
 179                                           uint32 des_access, uint32 *acc_granted,
 180                                           const char *debug )
 181 {
 182         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 183         uint32 saved_mask = 0;
 184
 185         /* check privileges; certain SAM access bits should be overridden
 186            by privileges (mostly having to do with creating/modifying/deleting
 187            users and groups) */
 188
 189         if (rights && !se_priv_equal(rights, &se_priv_none) &&
 190                         user_has_any_privilege(token, rights)) {
 191
 192                 saved_mask = (des_access & rights_mask);
 193                 des_access &= ~saved_mask;
 194
 195                 DEBUG(4,("access_check_object: user rights access mask [0x%x]\n",
 196                         rights_mask));
 197         }
 198
 199
 200         /* check the security descriptor first */
 201
 202         status = se_access_check(psd, token, des_access, acc_granted);
 203         if (NT_STATUS_IS_OK(status)) {
 204                 goto done;
 205         }
 206
 207         /* give root a free pass */
 208
 209         if ( geteuid() == sec_initial_uid() ) {
 210
 211                 DEBUG(4,("%s: ACCESS should be DENIED  (requested: %#010x)\n", debug, des_access));
 212                 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
 213
 214                 *acc_granted = des_access;
 215
 216                 status = NT_STATUS_OK;
 217                 goto done;
 218         }
 219
 220
 221 done:
 222         /* add in any bits saved during the privilege check (only
 223            matters is status is ok) */
 224
 225         *acc_granted |= rights_mask;
 226
 227         DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
 228                 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
 229                 des_access, *acc_granted));
 230
 231         return status;
 232 }
 233
 234
 235 /*******************************************************************
 236  Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
 237 ********************************************************************/
 238
 239 void map_max_allowed_access(const NT_USER_TOKEN *nt_token,
 240                             const struct unix_user_token *unix_token,
 241                             uint32_t *pacc_requested)
 242 {
 243         if (!((*pacc_requested) & MAXIMUM_ALLOWED_ACCESS)) {
 244                 return;
 245         }
 246         *pacc_requested &= ~MAXIMUM_ALLOWED_ACCESS;
 247
 248         /* At least try for generic read|execute - Everyone gets that. */
 249         *pacc_requested = GENERIC_READ_ACCESS|GENERIC_EXECUTE_ACCESS;
 250
 251         /* root gets anything. */
 252         if (unix_token->uid == sec_initial_uid()) {
 253                 *pacc_requested |= GENERIC_ALL_ACCESS;
 254                 return;
 255         }
 256
 257         /* Full Access for 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 258
 259         if (is_sid_in_token(nt_token, &global_sid_Builtin_Administrators) ||
 260                         is_sid_in_token(nt_token, &global_sid_Builtin_Account_Operators)) {
 261                 *pacc_requested |= GENERIC_ALL_ACCESS;
 262                 return;
 263         }
 264
 265         /* Full access for DOMAIN\Domain Admins. */
 266         if ( IS_DC ) {
 267                 DOM_SID domadmin_sid;
 268                 sid_copy( &domadmin_sid, get_global_sam_sid() );
 269                 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
 270                 if (is_sid_in_token(nt_token, &domadmin_sid)) {
 271                         *pacc_requested |= GENERIC_ALL_ACCESS;
 272                         return;
 273                 }
 274         }
 275         /* TODO ! Check privileges. */
 276 }
 277
 278 /*******************************************************************
 279  Fetch or create a dispinfo struct.
 280 ********************************************************************/
 281
 282 static DISP_INFO *get_samr_dispinfo_by_sid(const struct dom_sid *psid)
 283 {
 284         /*
 285          * We do a static cache for DISP_INFO's here. Explanation can be found
 286          * in Jeremy's checkin message to r11793:
 287          *
 288          * Fix the SAMR cache so it works across completely insane
 289          * client behaviour (ie.:
 290          * open pipe/open SAMR handle/enumerate 0 - 1024
 291          * close SAMR handle, close pipe.
 292          * open pipe/open SAMR handle/enumerate 1024 - 2048...
 293          * close SAMR handle, close pipe.
 294          * And on ad-nausium. Amazing.... probably object-oriented
 295          * client side programming in action yet again.
 296          * This change should *massively* improve performance when
 297          * enumerating users from an LDAP database.
 298          * Jeremy.
 299          *
 300          * "Our" and the builtin domain are the only ones where we ever
 301          * enumerate stuff, so just cache 2 entries.
 302          */
 303
 304         static struct disp_info *builtin_dispinfo;
 305         static struct disp_info *domain_dispinfo;
 306
 307         /* There are two cases to consider here:
 308            1) The SID is a domain SID and we look for an equality match, or
 309            2) This is an account SID and so we return the DISP_INFO* for our
 310               domain */
 311
 312         if (psid == NULL) {
 313                 return NULL;
 314         }
 315
 316         if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
 317                 /*
 318                  * Necessary only once, but it does not really hurt.
 319                  */
 320                 if (builtin_dispinfo == NULL) {
 321                         builtin_dispinfo = talloc_zero(
 322                                 talloc_autofree_context(), struct disp_info);
 323                         if (builtin_dispinfo == NULL) {
 324                                 return NULL;
 325                         }
 326                 }
 327                 sid_copy(&builtin_dispinfo->sid, &global_sid_Builtin);
 328
 329                 return builtin_dispinfo;
 330         }
 331
 332         if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
 333                 /*
 334                  * Necessary only once, but it does not really hurt.
 335                  */
 336                 if (domain_dispinfo == NULL) {
 337                         domain_dispinfo = talloc_zero(
 338                                 talloc_autofree_context(), struct disp_info);
 339                         if (domain_dispinfo == NULL) {
 340                                 return NULL;
 341                         }
 342                 }
 343                 sid_copy(&domain_dispinfo->sid, get_global_sam_sid());
 344
 345                 return domain_dispinfo;
 346         }
 347
 348         return NULL;
 349 }
 350
 351 /*******************************************************************
 352  Function to free the per SID data.
 353  ********************************************************************/
 354
 355 static void free_samr_cache(DISP_INFO *disp_info)
 356 {
 357         DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
 358                    sid_string_dbg(&disp_info->sid)));
 359
 360         /* We need to become root here because the paged search might have to
 361          * tell the LDAP server we're not interested in the rest anymore. */
 362
 363         become_root();
 364
 365         TALLOC_FREE(disp_info->users);
 366         TALLOC_FREE(disp_info->machines);
 367         TALLOC_FREE(disp_info->groups);
 368         TALLOC_FREE(disp_info->aliases);
 369         TALLOC_FREE(disp_info->enum_users);
 370
 371         unbecome_root();
 372 }
 373
 374 /*******************************************************************
 375  Idle event handler. Throw away the disp info cache.
 376  ********************************************************************/
 377
 378 static void disp_info_cache_idle_timeout_handler(struct event_context *ev_ctx,
 379                                                  struct timed_event *te,
 380                                                  struct timeval now,
 381                                                  void *private_data)
 382 {
 383         DISP_INFO *disp_info = (DISP_INFO *)private_data;
 384
 385         TALLOC_FREE(disp_info->cache_timeout_event);
 386
 387         DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
 388                    "out\n"));
 389         free_samr_cache(disp_info);
 390 }
 391
 392 /*******************************************************************
 393  Setup cache removal idle event handler.
 394  ********************************************************************/
 395
 396 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
 397 {
 398         /* Remove any pending timeout and update. */
 399
 400         TALLOC_FREE(disp_info->cache_timeout_event);
 401
 402         DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
 403                   "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
 404                   (unsigned int)secs_fromnow ));
 405
 406         disp_info->cache_timeout_event = event_add_timed(
 407                 smbd_event_context(), NULL,
 408                 timeval_current_ofs(secs_fromnow, 0),
 409                 disp_info_cache_idle_timeout_handler, (void *)disp_info);
 410 }
 411
 412 /*******************************************************************
 413  Force flush any cache. We do this on any samr_set_xxx call.
 414  We must also remove the timeout handler.
 415  ********************************************************************/
 416
 417 static void force_flush_samr_cache(const struct dom_sid *sid)
 418 {
 419         struct disp_info *disp_info = get_samr_dispinfo_by_sid(sid);
 420
 421         if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
 422                 return;
 423         }
 424
 425         DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
 426         TALLOC_FREE(disp_info->cache_timeout_event);
 427         free_samr_cache(disp_info);
 428 }
 429
 430 /*******************************************************************
 431  Ensure password info is never given out. Paranioa... JRA.
 432  ********************************************************************/
 433
 434 static void samr_clear_sam_passwd(struct samu *sam_pass)
 435 {
 436
 437         if (!sam_pass)
 438                 return;
 439
 440         /* These now zero out the old password */
 441
 442         pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
 443         pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
 444 }
 445
 446 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
 447 {
 448         struct samr_displayentry *entry;
 449
 450         if (sid_check_is_builtin(&info->sid)) {
 451                 /* No users in builtin. */
 452                 return 0;
 453         }
 454
 455         if (info->users == NULL) {
 456                 info->users = pdb_search_users(info, acct_flags);
 457                 if (info->users == NULL) {
 458                         return 0;
 459                 }
 460         }
 461         /* Fetch the last possible entry, thus trigger an enumeration */
 462         pdb_search_entries(info->users, 0xffffffff, 1, &entry);
 463
 464         /* Ensure we cache this enumeration. */
 465         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 466
 467         return info->users->num_entries;
 468 }
 469
 470 static uint32 count_sam_groups(struct disp_info *info)
 471 {
 472         struct samr_displayentry *entry;
 473
 474         if (sid_check_is_builtin(&info->sid)) {
 475                 /* No groups in builtin. */
 476                 return 0;
 477         }
 478
 479         if (info->groups == NULL) {
 480                 info->groups = pdb_search_groups(info);
 481                 if (info->groups == NULL) {
 482                         return 0;
 483                 }
 484         }
 485         /* Fetch the last possible entry, thus trigger an enumeration */
 486         pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
 487
 488         /* Ensure we cache this enumeration. */
 489         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 490
 491         return info->groups->num_entries;
 492 }
 493
 494 static uint32 count_sam_aliases(struct disp_info *info)
 495 {
 496         struct samr_displayentry *entry;
 497
 498         if (info->aliases == NULL) {
 499                 info->aliases = pdb_search_aliases(info, &info->sid);
 500                 if (info->aliases == NULL) {
 501                         return 0;
 502                 }
 503         }
 504         /* Fetch the last possible entry, thus trigger an enumeration */
 505         pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
 506
 507         /* Ensure we cache this enumeration. */
 508         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 509
 510         return info->aliases->num_entries;
 511 }
 512
 513 /*******************************************************************
 514  _samr_Close
 515  ********************************************************************/
 516
 517 NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
 518 {
 519         if (!close_policy_hnd(p, r->in.handle)) {
 520                 return NT_STATUS_INVALID_HANDLE;
 521         }
 522
 523         ZERO_STRUCTP(r->out.handle);
 524
 525         return NT_STATUS_OK;
 526 }
 527
 528 /*******************************************************************
 529  _samr_OpenDomain
 530  ********************************************************************/
 531
 532 NTSTATUS _samr_OpenDomain(pipes_struct *p,
 533                           struct samr_OpenDomain *r)
 534 {
 535         struct samr_connect_info *cinfo;
 536         struct samr_domain_info *dinfo;
 537         SEC_DESC *psd = NULL;
 538         uint32    acc_granted;
 539         uint32    des_access = r->in.access_mask;
 540         NTSTATUS  status;
 541         size_t    sd_size;
 542         uint32_t extra_access = SAMR_DOMAIN_ACCESS_CREATE_USER;
 543         SE_PRIV se_rights;
 544
 545         /* find the connection policy handle. */
 546
 547         cinfo = policy_handle_find(p, r->in.connect_handle, 0, NULL,
 548                                    struct samr_connect_info, &status);
 549         if (!NT_STATUS_IS_OK(status)) {
 550                 return status;
 551         }
 552
 553         /*check if access can be granted as requested by client. */
 554         map_max_allowed_access(p->server_info->ptok,
 555                                &p->server_info->utok,
 556                                &des_access);
 557
 558         make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
 559         se_map_generic( &des_access, &dom_generic_mapping );
 560
 561         /*
 562          * Users with SeMachineAccount or SeAddUser get additional
 563          * SAMR_DOMAIN_ACCESS_CREATE_USER access.
 564          */
 565         se_priv_copy( &se_rights, &se_machine_account );
 566         se_priv_add( &se_rights, &se_add_users );
 567
 568         /*
 569          * Users with SeAddUser get the ability to manipulate groups
 570          * and aliases.
 571          */
 572         if (user_has_any_privilege(p->server_info->ptok, &se_add_users)) {
 573                 extra_access |= (SAMR_DOMAIN_ACCESS_CREATE_GROUP |
 574                                 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
 575                                 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
 576                                 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS |
 577                                 SAMR_DOMAIN_ACCESS_CREATE_ALIAS);
 578         }
 579
 580         status = access_check_object( psd, p->server_info->ptok,
 581                 &se_rights, extra_access, des_access,
 582                 &acc_granted, "_samr_OpenDomain" );
 583
 584         if ( !NT_STATUS_IS_OK(status) )
 585                 return status;
 586
 587         if (!sid_check_is_domain(r->in.sid) &&
 588             !sid_check_is_builtin(r->in.sid)) {
 589                 return NT_STATUS_NO_SUCH_DOMAIN;
 590         }
 591
 592         dinfo = policy_handle_create(p, r->out.domain_handle, acc_granted,
 593                                      struct samr_domain_info, &status);
 594         if (!NT_STATUS_IS_OK(status)) {
 595                 return status;
 596         }
 597         dinfo->sid = *r->in.sid;
 598         dinfo->disp_info = get_samr_dispinfo_by_sid(r->in.sid);
 599
 600         DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
 601
 602         return NT_STATUS_OK;
 603 }
 604
 605 /*******************************************************************
 606  _samr_GetUserPwInfo
 607  ********************************************************************/
 608
 609 NTSTATUS _samr_GetUserPwInfo(pipes_struct *p,
 610                              struct samr_GetUserPwInfo *r)
 611 {
 612         struct samr_user_info *uinfo;
 613         enum lsa_SidType sid_type;
 614         uint32_t min_password_length = 0;
 615         uint32_t password_properties = 0;
 616         bool ret = false;
 617         NTSTATUS status;
 618
 619         DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
 620
 621         uinfo = policy_handle_find(p, r->in.user_handle,
 622                                    SAMR_USER_ACCESS_GET_ATTRIBUTES, NULL,
 623                                    struct samr_user_info, &status);
 624         if (!NT_STATUS_IS_OK(status)) {
 625                 return status;
 626         }
 627
 628         if (!sid_check_is_in_our_domain(&uinfo->sid)) {
 629                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 630         }
 631
 632         become_root();
 633         ret = lookup_sid(p->mem_ctx, &uinfo->sid, NULL, NULL, &sid_type);
 634         unbecome_root();
 635         if (ret == false) {
 636                 return NT_STATUS_NO_SUCH_USER;
 637         }
 638
 639         switch (sid_type) {
 640                 case SID_NAME_USER:
 641                         become_root();
 642                         pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
 643                                                &min_password_length);
 644                         pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
 645                                                &password_properties);
 646                         unbecome_root();
 647
 648                         if (lp_check_password_script() && *lp_check_password_script()) {
 649                                 password_properties |= DOMAIN_PASSWORD_COMPLEX;
 650                         }
 651
 652                         break;
 653                 default:
 654                         break;
 655         }
 656
 657         r->out.info->min_password_length = min_password_length;
 658         r->out.info->password_properties = password_properties;
 659
 660         DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
 661
 662         return NT_STATUS_OK;
 663 }
 664
 665 /*******************************************************************
 666  _samr_SetSecurity
 667  ********************************************************************/
 668
 669 NTSTATUS _samr_SetSecurity(pipes_struct *p,
 670                            struct samr_SetSecurity *r)
 671 {
 672         struct samr_user_info *uinfo;
 673         uint32 i;
 674         SEC_ACL *dacl;
 675         bool ret;
 676         struct samu *sampass=NULL;
 677         NTSTATUS status;
 678
 679         uinfo = policy_handle_find(p, r->in.handle,
 680                                    SAMR_USER_ACCESS_SET_ATTRIBUTES, NULL,
 681                                    struct samr_user_info, &status);
 682         if (!NT_STATUS_IS_OK(status)) {
 683                 return status;
 684         }
 685
 686         if (!(sampass = samu_new( p->mem_ctx))) {
 687                 DEBUG(0,("No memory!\n"));
 688                 return NT_STATUS_NO_MEMORY;
 689         }
 690
 691         /* get the user record */
 692         become_root();
 693         ret = pdb_getsampwsid(sampass, &uinfo->sid);
 694         unbecome_root();
 695
 696         if (!ret) {
 697                 DEBUG(4, ("User %s not found\n",
 698                           sid_string_dbg(&uinfo->sid)));
 699                 TALLOC_FREE(sampass);
 700                 return NT_STATUS_INVALID_HANDLE;
 701         }
 702
 703         dacl = r->in.sdbuf->sd->dacl;
 704         for (i=0; i < dacl->num_aces; i++) {
 705                 if (sid_equal(&uinfo->sid, &dacl->aces[i].trustee)) {
 706                         ret = pdb_set_pass_can_change(sampass,
 707                                 (dacl->aces[i].access_mask &
 708                                  SAMR_USER_ACCESS_CHANGE_PASSWORD) ?
 709                                                       True: False);
 710                         break;
 711                 }
 712         }
 713
 714         if (!ret) {
 715                 TALLOC_FREE(sampass);
 716                 return NT_STATUS_ACCESS_DENIED;
 717         }
 718
 719         become_root();
 720         status = pdb_update_sam_account(sampass);
 721         unbecome_root();
 722
 723         TALLOC_FREE(sampass);
 724
 725         return status;
 726 }
 727
 728 /*******************************************************************
 729   build correct perms based on policies and password times for _samr_query_sec_obj
 730 *******************************************************************/
 731 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
 732 {
 733         struct samu *sampass=NULL;
 734         bool ret;
 735
 736         if ( !(sampass = samu_new( mem_ctx )) ) {
 737                 DEBUG(0,("No memory!\n"));
 738                 return False;
 739         }
 740
 741         become_root();
 742         ret = pdb_getsampwsid(sampass, user_sid);
 743         unbecome_root();
 744
 745         if (ret == False) {
 746                 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
 747                 TALLOC_FREE(sampass);
 748                 return False;
 749         }
 750
 751         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
 752
 753         if (pdb_get_pass_can_change(sampass)) {
 754                 TALLOC_FREE(sampass);
 755                 return True;
 756         }
 757         TALLOC_FREE(sampass);
 758         return False;
 759 }
 760
 761
 762 /*******************************************************************
 763  _samr_QuerySecurity
 764  ********************************************************************/
 765
 766 NTSTATUS _samr_QuerySecurity(pipes_struct *p,
 767                              struct samr_QuerySecurity *r)
 768 {
 769         struct samr_connect_info *cinfo;
 770         struct samr_domain_info *dinfo;
 771         struct samr_user_info *uinfo;
 772         struct samr_group_info *ginfo;
 773         struct samr_alias_info *ainfo;
 774         NTSTATUS status;
 775         SEC_DESC * psd = NULL;
 776         size_t sd_size = 0;
 777
 778         cinfo = policy_handle_find(p, r->in.handle,
 779                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 780                                    struct samr_connect_info, &status);
 781         if (NT_STATUS_IS_OK(status)) {
 782                 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
 783                 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size,
 784                                              &sam_generic_mapping, NULL, 0);
 785                 goto done;
 786         }
 787
 788         dinfo = policy_handle_find(p, r->in.handle,
 789                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 790                                    struct samr_domain_info, &status);
 791         if (NT_STATUS_IS_OK(status)) {
 792                 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
 793                          "with SID: %s\n", sid_string_dbg(&dinfo->sid)));
 794                 /*
 795                  * TODO: Builtin probably needs a different SD with restricted
 796                  * write access
 797                  */
 798                 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size,
 799                                              &dom_generic_mapping, NULL, 0);
 800                 goto done;
 801         }
 802
 803         uinfo = policy_handle_find(p, r->in.handle,
 804                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 805                                    struct samr_user_info, &status);
 806         if (NT_STATUS_IS_OK(status)) {
 807                 DEBUG(10,("_samr_QuerySecurity: querying security on user "
 808                           "Object with SID: %s\n",
 809                           sid_string_dbg(&uinfo->sid)));
 810                 if (check_change_pw_access(p->mem_ctx, &uinfo->sid)) {
 811                         status = make_samr_object_sd(
 812                                 p->mem_ctx, &psd, &sd_size,
 813                                 &usr_generic_mapping,
 814                                 &uinfo->sid, SAMR_USR_RIGHTS_WRITE_PW);
 815                 } else {
 816                         status = make_samr_object_sd(
 817                                 p->mem_ctx, &psd, &sd_size,
 818                                 &usr_nopwchange_generic_mapping,
 819                                 &uinfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
 820                 }
 821                 goto done;
 822         }
 823
 824         ginfo = policy_handle_find(p, r->in.handle,
 825                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 826                                    struct samr_group_info, &status);
 827         if (NT_STATUS_IS_OK(status)) {
 828                 /*
 829                  * TODO: different SDs have to be generated for aliases groups
 830                  * and users.  Currently all three get a default user SD
 831                  */
 832                 DEBUG(10,("_samr_QuerySecurity: querying security on group "
 833                           "Object with SID: %s\n",
 834                           sid_string_dbg(&ginfo->sid)));
 835                 status = make_samr_object_sd(
 836                         p->mem_ctx, &psd, &sd_size,
 837                         &usr_nopwchange_generic_mapping,
 838                         &ginfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
 839                 goto done;
 840         }
 841
 842         ainfo = policy_handle_find(p, r->in.handle,
 843                                    STD_RIGHT_READ_CONTROL_ACCESS, NULL,
 844                                    struct samr_alias_info, &status);
 845         if (NT_STATUS_IS_OK(status)) {
 846                 /*
 847                  * TODO: different SDs have to be generated for aliases groups
 848                  * and users.  Currently all three get a default user SD
 849                  */
 850                 DEBUG(10,("_samr_QuerySecurity: querying security on alias "
 851                           "Object with SID: %s\n",
 852                           sid_string_dbg(&ainfo->sid)));
 853                 status = make_samr_object_sd(
 854                         p->mem_ctx, &psd, &sd_size,
 855                         &usr_nopwchange_generic_mapping,
 856                         &ainfo->sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
 857                 goto done;
 858         }
 859
 860         return NT_STATUS_OBJECT_TYPE_MISMATCH;
 861 done:
 862         if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
 863                 return NT_STATUS_NO_MEMORY;
 864
 865         return status;
 866 }
 867
 868 /*******************************************************************
 869 makes a SAM_ENTRY / UNISTR2* structure from a user list.
 870 ********************************************************************/
 871
 872 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
 873                                          struct samr_SamEntry **sam_pp,
 874                                          uint32_t num_entries,
 875                                          uint32_t start_idx,
 876                                          struct samr_displayentry *entries)
 877 {
 878         uint32_t i;
 879         struct samr_SamEntry *sam;
 880
 881         *sam_pp = NULL;
 882
 883         if (num_entries == 0) {
 884                 return NT_STATUS_OK;
 885         }
 886
 887         sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_entries);
 888         if (sam == NULL) {
 889                 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
 890                 return NT_STATUS_NO_MEMORY;
 891         }
 892
 893         for (i = 0; i < num_entries; i++) {
 894 #if 0
 895                 /*
 896                  * usrmgr expects a non-NULL terminated string with
 897                  * trust relationships
 898                  */
 899                 if (entries[i].acct_flags & ACB_DOMTRUST) {
 900                         init_unistr2(&uni_temp_name, entries[i].account_name,
 901                                      UNI_FLAGS_NONE);
 902                 } else {
 903                         init_unistr2(&uni_temp_name, entries[i].account_name,
 904                                      UNI_STR_TERMINATE);
 905                 }
 906 #endif
 907                 init_lsa_String(&sam[i].name, entries[i].account_name);
 908                 sam[i].idx = entries[i].rid;
 909         }
 910
 911         *sam_pp = sam;
 912
 913         return NT_STATUS_OK;
 914 }
 915
 916 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
 917
 918 /*******************************************************************
 919  _samr_EnumDomainUsers
 920  ********************************************************************/
 921
 922 NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
 923                                struct samr_EnumDomainUsers *r)
 924 {
 925         NTSTATUS status;
 926         struct samr_domain_info *dinfo;
 927         int num_account;
 928         uint32 enum_context = *r->in.resume_handle;
 929         enum remote_arch_types ra_type = get_remote_arch();
 930         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
 931         uint32 max_entries = max_sam_entries;
 932         struct samr_displayentry *entries = NULL;
 933         struct samr_SamArray *samr_array = NULL;
 934         struct samr_SamEntry *samr_entries = NULL;
 935
 936         DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
 937
 938         dinfo = policy_handle_find(p, r->in.domain_handle,
 939                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
 940                                    struct samr_domain_info, &status);
 941         if (!NT_STATUS_IS_OK(status)) {
 942                 return status;
 943         }
 944
 945         samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
 946         if (!samr_array) {
 947                 return NT_STATUS_NO_MEMORY;
 948         }
 949         *r->out.sam = samr_array;
 950
 951         if (sid_check_is_builtin(&dinfo->sid)) {
 952                 /* No users in builtin. */
 953                 *r->out.resume_handle = *r->in.resume_handle;
 954                 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
 955                 return status;
 956         }
 957
 958         become_root();
 959
 960         /* AS ROOT !!!! */
 961
 962         if ((dinfo->disp_info->enum_users != NULL) &&
 963             (dinfo->disp_info->enum_acb_mask != r->in.acct_flags)) {
 964                 TALLOC_FREE(dinfo->disp_info->enum_users);
 965         }
 966
 967         if (dinfo->disp_info->enum_users == NULL) {
 968                 dinfo->disp_info->enum_users = pdb_search_users(
 969                         dinfo->disp_info, r->in.acct_flags);
 970                 dinfo->disp_info->enum_acb_mask = r->in.acct_flags;
 971         }
 972
 973         if (dinfo->disp_info->enum_users == NULL) {
 974                 /* END AS ROOT !!!! */
 975                 unbecome_root();
 976                 return NT_STATUS_ACCESS_DENIED;
 977         }
 978
 979         num_account = pdb_search_entries(dinfo->disp_info->enum_users,
 980                                          enum_context, max_entries,
 981                                          &entries);
 982
 983         /* END AS ROOT !!!! */
 984
 985         unbecome_root();
 986
 987         if (num_account == 0) {
 988                 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
 989                           "total entries\n"));
 990                 *r->out.resume_handle = *r->in.resume_handle;
 991                 return NT_STATUS_OK;
 992         }
 993
 994         status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
 995                                           num_account, enum_context,
 996                                           entries);
 997         if (!NT_STATUS_IS_OK(status)) {
 998                 return status;
 999         }
1000
1001         if (max_entries <= num_account) {
1002                 status = STATUS_MORE_ENTRIES;
1003         } else {
1004                 status = NT_STATUS_OK;
1005         }
1006
1007         /* Ensure we cache this enumeration. */
1008         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1009
1010         DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
1011
1012         samr_array->count = num_account;
1013         samr_array->entries = samr_entries;
1014
1015         *r->out.resume_handle = *r->in.resume_handle + num_account;
1016         *r->out.num_entries = num_account;
1017
1018         DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1019
1020         return status;
1021 }
1022
1023 /*******************************************************************
1024 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1025 ********************************************************************/
1026
1027 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
1028                                       struct samr_SamEntry **sam_pp,
1029                                       uint32_t num_sam_entries,
1030                                       struct samr_displayentry *entries)
1031 {
1032         struct samr_SamEntry *sam;
1033         uint32_t i;
1034
1035         *sam_pp = NULL;
1036
1037         if (num_sam_entries == 0) {
1038                 return;
1039         }
1040
1041         sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_sam_entries);
1042         if (sam == NULL) {
1043                 return;
1044         }
1045
1046         for (i = 0; i < num_sam_entries; i++) {
1047                 /*
1048                  * JRA. I think this should include the null. TNG does not.
1049                  */
1050                 init_lsa_String(&sam[i].name, entries[i].account_name);
1051                 sam[i].idx = entries[i].rid;
1052         }
1053
1054         *sam_pp = sam;
1055 }
1056
1057 /*******************************************************************
1058  _samr_EnumDomainGroups
1059  ********************************************************************/
1060
1061 NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
1062                                 struct samr_EnumDomainGroups *r)
1063 {
1064         NTSTATUS status;
1065         struct samr_domain_info *dinfo;
1066         struct samr_displayentry *groups;
1067         uint32 num_groups;
1068         struct samr_SamArray *samr_array = NULL;
1069         struct samr_SamEntry *samr_entries = NULL;
1070
1071         dinfo = policy_handle_find(p, r->in.domain_handle,
1072                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1073                                    struct samr_domain_info, &status);
1074         if (!NT_STATUS_IS_OK(status)) {
1075                 return status;
1076         }
1077
1078         DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1079
1080         samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1081         if (!samr_array) {
1082                 return NT_STATUS_NO_MEMORY;
1083         }
1084         *r->out.sam = samr_array;
1085
1086         if (sid_check_is_builtin(&dinfo->sid)) {
1087                 /* No groups in builtin. */
1088                 *r->out.resume_handle = *r->in.resume_handle;
1089                 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1090                 return status;
1091         }
1092
1093         /* the domain group array is being allocated in the function below */
1094
1095         become_root();
1096
1097         if (dinfo->disp_info->groups == NULL) {
1098                 dinfo->disp_info->groups = pdb_search_groups(dinfo->disp_info);
1099
1100                 if (dinfo->disp_info->groups == NULL) {
1101                         unbecome_root();
1102                         return NT_STATUS_ACCESS_DENIED;
1103                 }
1104         }
1105
1106         num_groups = pdb_search_entries(dinfo->disp_info->groups,
1107                                         *r->in.resume_handle,
1108                                         MAX_SAM_ENTRIES, &groups);
1109         unbecome_root();
1110
1111         /* Ensure we cache this enumeration. */
1112         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1113
1114         make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1115                                   num_groups, groups);
1116
1117         if (MAX_SAM_ENTRIES <= num_groups) {
1118                 status = STATUS_MORE_ENTRIES;
1119         } else {
1120                 status = NT_STATUS_OK;
1121         }
1122
1123         samr_array->count = num_groups;
1124         samr_array->entries = samr_entries;
1125
1126         *r->out.num_entries = num_groups;
1127         *r->out.resume_handle = num_groups + *r->in.resume_handle;
1128
1129         DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1130
1131         return status;
1132 }
1133
1134 /*******************************************************************
1135  _samr_EnumDomainAliases
1136  ********************************************************************/
1137
1138 NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
1139                                  struct samr_EnumDomainAliases *r)
1140 {
1141         NTSTATUS status;
1142         struct samr_domain_info *dinfo;
1143         struct samr_displayentry *aliases;
1144         uint32 num_aliases = 0;
1145         struct samr_SamArray *samr_array = NULL;
1146         struct samr_SamEntry *samr_entries = NULL;
1147
1148         dinfo = policy_handle_find(p, r->in.domain_handle,
1149                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1150                                    struct samr_domain_info, &status);
1151         if (!NT_STATUS_IS_OK(status)) {
1152                 return status;
1153         }
1154
1155         DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1156                  sid_string_dbg(&dinfo->sid)));
1157
1158         samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1159         if (!samr_array) {
1160                 return NT_STATUS_NO_MEMORY;
1161         }
1162
1163         become_root();
1164
1165         if (dinfo->disp_info->aliases == NULL) {
1166                 dinfo->disp_info->aliases = pdb_search_aliases(
1167                         dinfo->disp_info, &dinfo->sid);
1168                 if (dinfo->disp_info->aliases == NULL) {
1169                         unbecome_root();
1170                         return NT_STATUS_ACCESS_DENIED;
1171                 }
1172         }
1173
1174         num_aliases = pdb_search_entries(dinfo->disp_info->aliases,
1175                                          *r->in.resume_handle,
1176                                          MAX_SAM_ENTRIES, &aliases);
1177         unbecome_root();
1178
1179         /* Ensure we cache this enumeration. */
1180         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1181
1182         make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1183                                   num_aliases, aliases);
1184
1185         DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1186
1187         if (MAX_SAM_ENTRIES <= num_aliases) {
1188                 status = STATUS_MORE_ENTRIES;
1189         } else {
1190                 status = NT_STATUS_OK;
1191         }
1192
1193         samr_array->count = num_aliases;
1194         samr_array->entries = samr_entries;
1195
1196         *r->out.sam = samr_array;
1197         *r->out.num_entries = num_aliases;
1198         *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1199
1200         return status;
1201 }
1202
1203 /*******************************************************************
1204  inits a samr_DispInfoGeneral structure.
1205 ********************************************************************/
1206
1207 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1208                                      struct samr_DispInfoGeneral *r,
1209                                      uint32_t num_entries,
1210                                      uint32_t start_idx,
1211                                      struct samr_displayentry *entries)
1212 {
1213         uint32 i;
1214
1215         DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1216
1217         if (num_entries == 0) {
1218                 return NT_STATUS_OK;
1219         }
1220
1221         r->count = num_entries;
1222
1223         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryGeneral, num_entries);
1224         if (!r->entries) {
1225                 return NT_STATUS_NO_MEMORY;
1226         }
1227
1228         for (i = 0; i < num_entries ; i++) {
1229
1230                 init_lsa_String(&r->entries[i].account_name,
1231                                 entries[i].account_name);
1232
1233                 init_lsa_String(&r->entries[i].description,
1234                                 entries[i].description);
1235
1236                 init_lsa_String(&r->entries[i].full_name,
1237                                 entries[i].fullname);
1238
1239                 r->entries[i].rid = entries[i].rid;
1240                 r->entries[i].acct_flags = entries[i].acct_flags;
1241                 r->entries[i].idx = start_idx+i+1;
1242         }
1243
1244         return NT_STATUS_OK;
1245 }
1246
1247 /*******************************************************************
1248  inits a samr_DispInfoFull structure.
1249 ********************************************************************/
1250
1251 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1252                                      struct samr_DispInfoFull *r,
1253                                      uint32_t num_entries,
1254                                      uint32_t start_idx,
1255                                      struct samr_displayentry *entries)
1256 {
1257         uint32_t i;
1258
1259         DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1260
1261         if (num_entries == 0) {
1262                 return NT_STATUS_OK;
1263         }
1264
1265         r->count = num_entries;
1266
1267         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFull, num_entries);
1268         if (!r->entries) {
1269                 return NT_STATUS_NO_MEMORY;
1270         }
1271
1272         for (i = 0; i < num_entries ; i++) {
1273
1274                 init_lsa_String(&r->entries[i].account_name,
1275                                 entries[i].account_name);
1276
1277                 init_lsa_String(&r->entries[i].description,
1278                                 entries[i].description);
1279
1280                 r->entries[i].rid = entries[i].rid;
1281                 r->entries[i].acct_flags = entries[i].acct_flags;
1282                 r->entries[i].idx = start_idx+i+1;
1283         }
1284
1285         return NT_STATUS_OK;
1286 }
1287
1288 /*******************************************************************
1289  inits a samr_DispInfoFullGroups structure.
1290 ********************************************************************/
1291
1292 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1293                                      struct samr_DispInfoFullGroups *r,
1294                                      uint32_t num_entries,
1295                                      uint32_t start_idx,
1296                                      struct samr_displayentry *entries)
1297 {
1298         uint32_t i;
1299
1300         DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1301
1302         if (num_entries == 0) {
1303                 return NT_STATUS_OK;
1304         }
1305
1306         r->count = num_entries;
1307
1308         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFullGroup, num_entries);
1309         if (!r->entries) {
1310                 return NT_STATUS_NO_MEMORY;
1311         }
1312
1313         for (i = 0; i < num_entries ; i++) {
1314
1315                 init_lsa_String(&r->entries[i].account_name,
1316                                 entries[i].account_name);
1317
1318                 init_lsa_String(&r->entries[i].description,
1319                                 entries[i].description);
1320
1321                 r->entries[i].rid = entries[i].rid;
1322                 r->entries[i].acct_flags = entries[i].acct_flags;
1323                 r->entries[i].idx = start_idx+i+1;
1324         }
1325
1326         return NT_STATUS_OK;
1327 }
1328
1329 /*******************************************************************
1330  inits a samr_DispInfoAscii structure.
1331 ********************************************************************/
1332
1333 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1334                                      struct samr_DispInfoAscii *r,
1335                                      uint32_t num_entries,
1336                                      uint32_t start_idx,
1337                                      struct samr_displayentry *entries)
1338 {
1339         uint32_t i;
1340
1341         DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1342
1343         if (num_entries == 0) {
1344                 return NT_STATUS_OK;
1345         }
1346
1347         r->count = num_entries;
1348
1349         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1350         if (!r->entries) {
1351                 return NT_STATUS_NO_MEMORY;
1352         }
1353
1354         for (i = 0; i < num_entries ; i++) {
1355
1356                 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1357                                           entries[i].account_name);
1358
1359                 r->entries[i].idx = start_idx+i+1;
1360         }
1361
1362         return NT_STATUS_OK;
1363 }
1364
1365 /*******************************************************************
1366  inits a samr_DispInfoAscii structure.
1367 ********************************************************************/
1368
1369 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1370                                      struct samr_DispInfoAscii *r,
1371                                      uint32_t num_entries,
1372                                      uint32_t start_idx,
1373                                      struct samr_displayentry *entries)
1374 {
1375         uint32_t i;
1376
1377         DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1378
1379         if (num_entries == 0) {
1380                 return NT_STATUS_OK;
1381         }
1382
1383         r->count = num_entries;
1384
1385         r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1386         if (!r->entries) {
1387                 return NT_STATUS_NO_MEMORY;
1388         }
1389
1390         for (i = 0; i < num_entries ; i++) {
1391
1392                 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1393                                           entries[i].account_name);
1394
1395                 r->entries[i].idx = start_idx+i+1;
1396         }
1397
1398         return NT_STATUS_OK;
1399 }
1400
1401 /*******************************************************************
1402  _samr_QueryDisplayInfo
1403  ********************************************************************/
1404
1405 NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
1406                                 struct samr_QueryDisplayInfo *r)
1407 {
1408         NTSTATUS status;
1409         struct samr_domain_info *dinfo;
1410         uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1411
1412         uint32 max_entries = r->in.max_entries;
1413
1414         union samr_DispInfo *disp_info = r->out.info;
1415
1416         uint32 temp_size=0;
1417         NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1418         uint32 num_account = 0;
1419         enum remote_arch_types ra_type = get_remote_arch();
1420         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1421         struct samr_displayentry *entries = NULL;
1422
1423         DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1424
1425         dinfo = policy_handle_find(p, r->in.domain_handle,
1426                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
1427                                    struct samr_domain_info, &status);
1428         if (!NT_STATUS_IS_OK(status)) {
1429                 return status;
1430         }
1431
1432         if (sid_check_is_builtin(&dinfo->sid)) {
1433                 DEBUG(5,("_samr_QueryDisplayInfo: no users in BUILTIN\n"));
1434                 return NT_STATUS_OK;
1435         }
1436
1437         /*
1438          * calculate how many entries we will return.
1439          * based on
1440          * - the number of entries the client asked
1441          * - our limit on that
1442          * - the starting point (enumeration context)
1443          * - the buffer size the client will accept
1444          */
1445
1446         /*
1447          * We are a lot more like W2K. Instead of reading the SAM
1448          * each time to find the records we need to send back,
1449          * we read it once and link that copy to the sam handle.
1450          * For large user list (over the MAX_SAM_ENTRIES)
1451          * it's a definitive win.
1452          * second point to notice: between enumerations
1453          * our sam is now the same as it's a snapshoot.
1454          * third point: got rid of the static SAM_USER_21 struct
1455          * no more intermediate.
1456          * con: it uses much more memory, as a full copy is stored
1457          * in memory.
1458          *
1459          * If you want to change it, think twice and think
1460          * of the second point , that's really important.
1461          *
1462          * JFM, 12/20/2001
1463          */
1464
1465         if ((r->in.level < 1) || (r->in.level > 5)) {
1466                 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1467                          (unsigned int)r->in.level ));
1468                 return NT_STATUS_INVALID_INFO_CLASS;
1469         }
1470
1471         /* first limit the number of entries we will return */
1472         if (r->in.max_entries > max_sam_entries) {
1473                 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1474                           "entries, limiting to %d\n", r->in.max_entries,
1475                           max_sam_entries));
1476                 max_entries = max_sam_entries;
1477         }
1478
1479         /* calculate the size and limit on the number of entries we will
1480          * return */
1481
1482         temp_size=max_entries*struct_size;
1483
1484         if (temp_size > r->in.buf_size) {
1485                 max_entries = MIN((r->in.buf_size / struct_size),max_entries);;
1486                 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1487                           "only %d entries\n", max_entries));
1488         }
1489
1490         become_root();
1491
1492         /* THe following done as ROOT. Don't return without unbecome_root(). */
1493
1494         switch (r->in.level) {
1495         case 1:
1496         case 4:
1497                 if (dinfo->disp_info->users == NULL) {
1498                         dinfo->disp_info->users = pdb_search_users(
1499                                 dinfo->disp_info, ACB_NORMAL);
1500                         if (dinfo->disp_info->users == NULL) {
1501                                 unbecome_root();
1502                                 return NT_STATUS_ACCESS_DENIED;
1503                         }
1504                         DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1505                                 (unsigned  int)r->in.start_idx));
1506                 } else {
1507                         DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1508                                 (unsigned  int)r->in.start_idx));
1509                 }
1510
1511                 num_account = pdb_search_entries(dinfo->disp_info->users,
1512                                                  r->in.start_idx, max_entries,
1513                                                  &entries);
1514                 break;
1515         case 2:
1516                 if (dinfo->disp_info->machines == NULL) {
1517                         dinfo->disp_info->machines = pdb_search_users(
1518                                 dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
1519                         if (dinfo->disp_info->machines == NULL) {
1520                                 unbecome_root();
1521                                 return NT_STATUS_ACCESS_DENIED;
1522                         }
1523                         DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1524                                 (unsigned  int)r->in.start_idx));
1525                 } else {
1526                         DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1527                                 (unsigned  int)r->in.start_idx));
1528                 }
1529
1530                 num_account = pdb_search_entries(dinfo->disp_info->machines,
1531                                                  r->in.start_idx, max_entries,
1532                                                  &entries);
1533                 break;
1534         case 3:
1535         case 5:
1536                 if (dinfo->disp_info->groups == NULL) {
1537                         dinfo->disp_info->groups = pdb_search_groups(
1538                                 dinfo->disp_info);
1539                         if (dinfo->disp_info->groups == NULL) {
1540                                 unbecome_root();
1541                                 return NT_STATUS_ACCESS_DENIED;
1542                         }
1543                         DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1544                                 (unsigned  int)r->in.start_idx));
1545                 } else {
1546                         DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1547                                 (unsigned  int)r->in.start_idx));
1548                 }
1549
1550                 num_account = pdb_search_entries(dinfo->disp_info->groups,
1551                                                  r->in.start_idx, max_entries,
1552                                                  &entries);
1553                 break;
1554         default:
1555                 unbecome_root();
1556                 smb_panic("info class changed");
1557                 break;
1558         }
1559         unbecome_root();
1560
1561
1562         /* Now create reply structure */
1563         switch (r->in.level) {
1564         case 1:
1565                 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1566                                                 num_account, r->in.start_idx,
1567                                                 entries);
1568                 break;
1569         case 2:
1570                 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1571                                                 num_account, r->in.start_idx,
1572                                                 entries);
1573                 break;
1574         case 3:
1575                 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1576                                                 num_account, r->in.start_idx,
1577                                                 entries);
1578                 break;
1579         case 4:
1580                 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1581                                                 num_account, r->in.start_idx,
1582                                                 entries);
1583                 break;
1584         case 5:
1585                 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1586                                                 num_account, r->in.start_idx,
1587                                                 entries);
1588                 break;
1589         default:
1590                 smb_panic("info class changed");
1591                 break;
1592         }
1593
1594         if (!NT_STATUS_IS_OK(disp_ret))
1595                 return disp_ret;
1596
1597         if (max_entries <= num_account) {
1598                 status = STATUS_MORE_ENTRIES;
1599         } else {
1600                 status = NT_STATUS_OK;
1601         }
1602
1603         /* Ensure we cache this enumeration. */
1604         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
1605
1606         DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1607
1608         *r->out.total_size = num_account * struct_size;
1609         *r->out.returned_size = num_account ? temp_size : 0;
1610
1611         return status;
1612 }
1613
1614 /****************************************************************
1615  _samr_QueryDisplayInfo2
1616 ****************************************************************/
1617
1618 NTSTATUS _samr_QueryDisplayInfo2(pipes_struct *p,
1619                                  struct samr_QueryDisplayInfo2 *r)
1620 {
1621         struct samr_QueryDisplayInfo q;
1622
1623         q.in.domain_handle      = r->in.domain_handle;
1624         q.in.level              = r->in.level;
1625         q.in.start_idx          = r->in.start_idx;
1626         q.in.max_entries        = r->in.max_entries;
1627         q.in.buf_size           = r->in.buf_size;
1628
1629         q.out.total_size        = r->out.total_size;
1630         q.out.returned_size     = r->out.returned_size;
1631         q.out.info              = r->out.info;
1632
1633         return _samr_QueryDisplayInfo(p, &q);
1634 }
1635
1636 /****************************************************************
1637  _samr_QueryDisplayInfo3
1638 ****************************************************************/
1639
1640 NTSTATUS _samr_QueryDisplayInfo3(pipes_struct *p,
1641                                  struct samr_QueryDisplayInfo3 *r)
1642 {
1643         struct samr_QueryDisplayInfo q;
1644
1645         q.in.domain_handle      = r->in.domain_handle;
1646         q.in.level              = r->in.level;
1647         q.in.start_idx          = r->in.start_idx;
1648         q.in.max_entries        = r->in.max_entries;
1649         q.in.buf_size           = r->in.buf_size;
1650
1651         q.out.total_size        = r->out.total_size;
1652         q.out.returned_size     = r->out.returned_size;
1653         q.out.info              = r->out.info;
1654
1655         return _samr_QueryDisplayInfo(p, &q);
1656 }
1657
1658 /*******************************************************************
1659  _samr_QueryAliasInfo
1660  ********************************************************************/
1661
1662 NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
1663                               struct samr_QueryAliasInfo *r)
1664 {
1665         struct samr_alias_info *ainfo;
1666         struct acct_info info;
1667         NTSTATUS status;
1668         union samr_AliasInfo *alias_info = NULL;
1669         const char *alias_name = NULL;
1670         const char *alias_description = NULL;
1671
1672         DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1673
1674         ainfo = policy_handle_find(p, r->in.alias_handle,
1675                                    SAMR_ALIAS_ACCESS_LOOKUP_INFO, NULL,
1676                                    struct samr_alias_info, &status);
1677         if (!NT_STATUS_IS_OK(status)) {
1678                 return status;
1679         }
1680
1681         alias_info = TALLOC_ZERO_P(p->mem_ctx, union samr_AliasInfo);
1682         if (!alias_info) {
1683                 return NT_STATUS_NO_MEMORY;
1684         }
1685
1686         become_root();
1687         status = pdb_get_aliasinfo(&ainfo->sid, &info);
1688         unbecome_root();
1689
1690         if ( !NT_STATUS_IS_OK(status))
1691                 return status;
1692
1693         /* FIXME: info contains fstrings */
1694         alias_name = talloc_strdup(r, info.acct_name);
1695         alias_description = talloc_strdup(r, info.acct_desc);
1696
1697         switch (r->in.level) {
1698         case ALIASINFOALL:
1699                 alias_info->all.name.string             = alias_name;
1700                 alias_info->all.num_members             = 1; /* ??? */
1701                 alias_info->all.description.string      = alias_description;
1702                 break;
1703         case ALIASINFONAME:
1704                 alias_info->name.string                 = alias_name;
1705                 break;
1706         case ALIASINFODESCRIPTION:
1707                 alias_info->description.string          = alias_description;
1708                 break;
1709         default:
1710                 return NT_STATUS_INVALID_INFO_CLASS;
1711         }
1712
1713         *r->out.info = alias_info;
1714
1715         DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1716
1717         return NT_STATUS_OK;
1718 }
1719
1720 /*******************************************************************
1721  _samr_LookupNames
1722  ********************************************************************/
1723
1724 NTSTATUS _samr_LookupNames(pipes_struct *p,
1725                            struct samr_LookupNames *r)
1726 {
1727         struct samr_domain_info *dinfo;
1728         NTSTATUS status;
1729         uint32 *rid;
1730         enum lsa_SidType *type;
1731         int i;
1732         int num_rids = r->in.num_names;
1733         struct samr_Ids rids, types;
1734         uint32_t num_mapped = 0;
1735
1736         DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1737
1738         dinfo = policy_handle_find(p, r->in.domain_handle,
1739                                    0 /* Don't know the acc_bits yet */, NULL,
1740                                    struct samr_domain_info, &status);
1741         if (!NT_STATUS_IS_OK(status)) {
1742                 return status;
1743         }
1744
1745         if (num_rids > MAX_SAM_ENTRIES) {
1746                 num_rids = MAX_SAM_ENTRIES;
1747                 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1748         }
1749
1750         rid = talloc_array(p->mem_ctx, uint32, num_rids);
1751         NT_STATUS_HAVE_NO_MEMORY(rid);
1752
1753         type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1754         NT_STATUS_HAVE_NO_MEMORY(type);
1755
1756         DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1757                  sid_string_dbg(&dinfo->sid)));
1758
1759         for (i = 0; i < num_rids; i++) {
1760
1761                 status = NT_STATUS_NONE_MAPPED;
1762                 type[i] = SID_NAME_UNKNOWN;
1763
1764                 rid[i] = 0xffffffff;
1765
1766                 if (sid_check_is_builtin(&dinfo->sid)) {
1767                         if (lookup_builtin_name(r->in.names[i].string,
1768                                                 &rid[i]))
1769                         {
1770                                 type[i] = SID_NAME_ALIAS;
1771                         }
1772                 } else {
1773                         lookup_global_sam_name(r->in.names[i].string, 0,
1774                                                &rid[i], &type[i]);
1775                 }
1776
1777                 if (type[i] != SID_NAME_UNKNOWN) {
1778                         num_mapped++;
1779                 }
1780         }
1781
1782         if (num_mapped == num_rids) {
1783                 status = NT_STATUS_OK;
1784         } else if (num_mapped == 0) {
1785                 status = NT_STATUS_NONE_MAPPED;
1786         } else {
1787                 status = STATUS_SOME_UNMAPPED;
1788         }
1789
1790         rids.count = num_rids;
1791         rids.ids = rid;
1792
1793         types.count = num_rids;
1794         types.ids = type;
1795
1796         *r->out.rids = rids;
1797         *r->out.types = types;
1798
1799         DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1800
1801         return status;
1802 }
1803
1804 /****************************************************************
1805  _samr_ChangePasswordUser
1806 ****************************************************************/
1807
1808 NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
1809                                   struct samr_ChangePasswordUser *r)
1810 {
1811         NTSTATUS status;
1812         bool ret = false;
1813         struct samr_user_info *uinfo;
1814         struct samu *pwd;
1815         struct samr_Password new_lmPwdHash, new_ntPwdHash, checkHash;
1816         struct samr_Password lm_pwd, nt_pwd;
1817
1818         uinfo = policy_handle_find(p, r->in.user_handle,
1819                                    SAMR_USER_ACCESS_SET_PASSWORD, NULL,
1820                                    struct samr_user_info, &status);
1821         if (!NT_STATUS_IS_OK(status)) {
1822                 return status;
1823         }
1824
1825         DEBUG(5,("_samr_ChangePasswordUser: sid:%s\n",
1826                   sid_string_dbg(&uinfo->sid)));
1827
1828         if (!(pwd = samu_new(NULL))) {
1829                 return NT_STATUS_NO_MEMORY;
1830         }
1831
1832         become_root();
1833         ret = pdb_getsampwsid(pwd, &uinfo->sid);
1834         unbecome_root();
1835
1836         if (!ret) {
1837                 TALLOC_FREE(pwd);
1838                 return NT_STATUS_WRONG_PASSWORD;
1839         }
1840
1841         {
1842                 const uint8_t *lm_pass, *nt_pass;
1843
1844                 lm_pass = pdb_get_lanman_passwd(pwd);
1845                 nt_pass = pdb_get_nt_passwd(pwd);
1846
1847                 if (!lm_pass || !nt_pass) {
1848                         status = NT_STATUS_WRONG_PASSWORD;
1849                         goto out;
1850                 }
1851
1852                 memcpy(&lm_pwd.hash, lm_pass, sizeof(lm_pwd.hash));
1853                 memcpy(&nt_pwd.hash, nt_pass, sizeof(nt_pwd.hash));
1854         }
1855
1856         /* basic sanity checking on parameters.  Do this before any database ops */
1857         if (!r->in.lm_present || !r->in.nt_present ||
1858             !r->in.old_lm_crypted || !r->in.new_lm_crypted ||
1859             !r->in.old_nt_crypted || !r->in.new_nt_crypted) {
1860                 /* we should really handle a change with lm not
1861                    present */
1862                 status = NT_STATUS_INVALID_PARAMETER_MIX;
1863                 goto out;
1864         }
1865
1866         /* decrypt and check the new lm hash */
1867         D_P16(lm_pwd.hash, r->in.new_lm_crypted->hash, new_lmPwdHash.hash);
1868         D_P16(new_lmPwdHash.hash, r->in.old_lm_crypted->hash, checkHash.hash);
1869         if (memcmp(checkHash.hash, lm_pwd.hash, 16) != 0) {
1870                 status = NT_STATUS_WRONG_PASSWORD;
1871                 goto out;
1872         }
1873
1874         /* decrypt and check the new nt hash */
1875         D_P16(nt_pwd.hash, r->in.new_nt_crypted->hash, new_ntPwdHash.hash);
1876         D_P16(new_ntPwdHash.hash, r->in.old_nt_crypted->hash, checkHash.hash);
1877         if (memcmp(checkHash.hash, nt_pwd.hash, 16) != 0) {
1878                 status = NT_STATUS_WRONG_PASSWORD;
1879                 goto out;
1880         }
1881
1882         /* The NT Cross is not required by Win2k3 R2, but if present
1883            check the nt cross hash */
1884         if (r->in.cross1_present && r->in.nt_cross) {
1885                 D_P16(lm_pwd.hash, r->in.nt_cross->hash, checkHash.hash);
1886                 if (memcmp(checkHash.hash, new_ntPwdHash.hash, 16) != 0) {
1887                         status = NT_STATUS_WRONG_PASSWORD;
1888                         goto out;
1889                 }
1890         }
1891
1892         /* The LM Cross is not required by Win2k3 R2, but if present
1893            check the lm cross hash */
1894         if (r->in.cross2_present && r->in.lm_cross) {
1895                 D_P16(nt_pwd.hash, r->in.lm_cross->hash, checkHash.hash);
1896                 if (memcmp(checkHash.hash, new_lmPwdHash.hash, 16) != 0) {
1897                         status = NT_STATUS_WRONG_PASSWORD;
1898                         goto out;
1899                 }
1900         }
1901
1902         if (!pdb_set_nt_passwd(pwd, new_ntPwdHash.hash, PDB_CHANGED) ||
1903             !pdb_set_lanman_passwd(pwd, new_lmPwdHash.hash, PDB_CHANGED)) {
1904                 status = NT_STATUS_ACCESS_DENIED;
1905                 goto out;
1906         }
1907
1908         status = pdb_update_sam_account(pwd);
1909  out:
1910         TALLOC_FREE(pwd);
1911
1912         return status;
1913 }
1914
1915 /*******************************************************************
1916  _samr_ChangePasswordUser2
1917  ********************************************************************/
1918
1919 NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
1920                                    struct samr_ChangePasswordUser2 *r)
1921 {
1922         struct smbd_server_connection *sconn = smbd_server_conn;
1923         NTSTATUS status;
1924         fstring user_name;
1925         fstring wks;
1926
1927         DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1928
1929         fstrcpy(user_name, r->in.account->string);
1930         fstrcpy(wks, r->in.server->string);
1931
1932         DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1933
1934         /*
1935          * Pass the user through the NT -> unix user mapping
1936          * function.
1937          */
1938
1939         (void)map_username(sconn, user_name);
1940
1941         /*
1942          * UNIX username case mangling not required, pass_oem_change
1943          * is case insensitive.
1944          */
1945
1946         status = pass_oem_change(user_name,
1947                                  r->in.lm_password->data,
1948                                  r->in.lm_verifier->hash,
1949                                  r->in.nt_password->data,
1950                                  r->in.nt_verifier->hash,
1951                                  NULL);
1952
1953         DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1954
1955         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1956                 return NT_STATUS_WRONG_PASSWORD;
1957         }
1958
1959         return status;
1960 }
1961
1962 /****************************************************************
1963  _samr_OemChangePasswordUser2
1964 ****************************************************************/
1965
1966 NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
1967                                       struct samr_OemChangePasswordUser2 *r)
1968 {
1969         struct smbd_server_connection *sconn = smbd_server_conn;
1970         NTSTATUS status;
1971         fstring user_name;
1972         const char *wks = NULL;
1973
1974         DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__));
1975
1976         fstrcpy(user_name, r->in.account->string);
1977         if (r->in.server && r->in.server->string) {
1978                 wks = r->in.server->string;
1979         }
1980
1981         DEBUG(5,("_samr_OemChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1982
1983         /*
1984          * Pass the user through the NT -> unix user mapping
1985          * function.
1986          */
1987
1988         (void)map_username(sconn, user_name);
1989
1990         /*
1991          * UNIX username case mangling not required, pass_oem_change
1992          * is case insensitive.
1993          */
1994
1995         if (!r->in.hash || !r->in.password) {
1996                 return NT_STATUS_INVALID_PARAMETER;
1997         }
1998
1999         status = pass_oem_change(user_name,
2000                                  r->in.password->data,
2001                                  r->in.hash->hash,
2002                                  0,
2003                                  0,
2004                                  NULL);
2005
2006         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2007                 return NT_STATUS_WRONG_PASSWORD;
2008         }
2009
2010         DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__));
2011
2012         return status;
2013 }
2014
2015 /*******************************************************************
2016  _samr_ChangePasswordUser3
2017  ********************************************************************/
2018
2019 NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
2020                                    struct samr_ChangePasswordUser3 *r)
2021 {
2022         struct smbd_server_connection *sconn = smbd_server_conn;
2023         NTSTATUS status;
2024         fstring user_name;
2025         const char *wks = NULL;
2026         uint32 reject_reason;
2027         struct samr_DomInfo1 *dominfo = NULL;
2028         struct samr_ChangeReject *reject = NULL;
2029         uint32_t tmp;
2030
2031         DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2032
2033         fstrcpy(user_name, r->in.account->string);
2034         if (r->in.server && r->in.server->string) {
2035                 wks = r->in.server->string;
2036         }
2037
2038         DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
2039
2040         /*
2041          * Pass the user through the NT -> unix user mapping
2042          * function.
2043          */
2044
2045         (void)map_username(sconn, user_name);
2046
2047         /*
2048          * UNIX username case mangling not required, pass_oem_change
2049          * is case insensitive.
2050          */
2051
2052         status = pass_oem_change(user_name,
2053                                  r->in.lm_password->data,
2054                                  r->in.lm_verifier->hash,
2055                                  r->in.nt_password->data,
2056                                  r->in.nt_verifier->hash,
2057                                  &reject_reason);
2058         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2059                 return NT_STATUS_WRONG_PASSWORD;
2060         }
2061
2062         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
2063             NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
2064
2065                 time_t u_expire, u_min_age;
2066                 uint32 account_policy_temp;
2067
2068                 dominfo = TALLOC_ZERO_P(p->mem_ctx, struct samr_DomInfo1);
2069                 if (!dominfo) {
2070                         return NT_STATUS_NO_MEMORY;
2071                 }
2072
2073                 reject = TALLOC_ZERO_P(p->mem_ctx, struct samr_ChangeReject);
2074                 if (!reject) {
2075                         return NT_STATUS_NO_MEMORY;
2076                 }
2077
2078                 become_root();
2079
2080                 /* AS ROOT !!! */
2081
2082                 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN, &tmp);
2083                 dominfo->min_password_length = tmp;
2084
2085                 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &tmp);
2086                 dominfo->password_history_length = tmp;
2087
2088                 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
2089                                        &dominfo->password_properties);
2090
2091                 pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &account_policy_temp);
2092                 u_expire = account_policy_temp;
2093
2094                 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &account_policy_temp);
2095                 u_min_age = account_policy_temp;
2096
2097                 /* !AS ROOT */
2098
2099                 unbecome_root();
2100
2101                 unix_to_nt_time_abs((NTTIME *)&dominfo->max_password_age, u_expire);
2102                 unix_to_nt_time_abs((NTTIME *)&dominfo->min_password_age, u_min_age);
2103
2104                 if (lp_check_password_script() && *lp_check_password_script()) {
2105                         dominfo->password_properties |= DOMAIN_PASSWORD_COMPLEX;
2106                 }
2107
2108                 reject->reason = reject_reason;
2109
2110                 *r->out.dominfo = dominfo;
2111                 *r->out.reject = reject;
2112         }
2113
2114         DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2115
2116         return status;
2117 }
2118
2119 /*******************************************************************
2120 makes a SAMR_R_LOOKUP_RIDS structure.
2121 ********************************************************************/
2122
2123 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2124                                   const char **names,
2125                                   struct lsa_String **lsa_name_array_p)
2126 {
2127         struct lsa_String *lsa_name_array = NULL;
2128         uint32_t i;
2129
2130         *lsa_name_array_p = NULL;
2131
2132         if (num_names != 0) {
2133                 lsa_name_array = TALLOC_ZERO_ARRAY(ctx, struct lsa_String, num_names);
2134                 if (!lsa_name_array) {
2135                         return false;
2136                 }
2137         }
2138
2139         for (i = 0; i < num_names; i++) {
2140                 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2141                 init_lsa_String(&lsa_name_array[i], names[i]);
2142         }
2143
2144         *lsa_name_array_p = lsa_name_array;
2145
2146         return true;
2147 }
2148
2149 /*******************************************************************
2150  _samr_LookupRids
2151  ********************************************************************/
2152
2153 NTSTATUS _samr_LookupRids(pipes_struct *p,
2154                           struct samr_LookupRids *r)
2155 {
2156         struct samr_domain_info *dinfo;
2157         NTSTATUS status;
2158         const char **names;
2159         enum lsa_SidType *attrs = NULL;
2160         uint32 *wire_attrs = NULL;
2161         int num_rids = (int)r->in.num_rids;
2162         int i;
2163         struct lsa_Strings names_array;
2164         struct samr_Ids types_array;
2165         struct lsa_String *lsa_names = NULL;
2166
2167         DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2168
2169         dinfo = policy_handle_find(p, r->in.domain_handle,
2170                                    0 /* Don't know the acc_bits yet */, NULL,
2171                                    struct samr_domain_info, &status);
2172         if (!NT_STATUS_IS_OK(status)) {
2173                 return status;
2174         }
2175
2176         if (num_rids > 1000) {
2177                 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2178                           "to samba4 idl this is not possible\n", num_rids));
2179                 return NT_STATUS_UNSUCCESSFUL;
2180         }
2181
2182         if (num_rids) {
2183                 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
2184                 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
2185                 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
2186
2187                 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2188                         return NT_STATUS_NO_MEMORY;
2189         } else {
2190                 names = NULL;
2191                 attrs = NULL;
2192                 wire_attrs = NULL;
2193         }
2194
2195         become_root();  /* lookup_sid can require root privs */
2196         status = pdb_lookup_rids(&dinfo->sid, num_rids, r->in.rids,
2197                                  names, attrs);
2198         unbecome_root();
2199
2200         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2201                 status = NT_STATUS_OK;
2202         }
2203
2204         if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2205                                    &lsa_names)) {
2206                 return NT_STATUS_NO_MEMORY;
2207         }
2208
2209         /* Convert from enum lsa_SidType to uint32 for wire format. */
2210         for (i = 0; i < num_rids; i++) {
2211                 wire_attrs[i] = (uint32)attrs[i];
2212         }
2213
2214         names_array.count = num_rids;
2215         names_array.names = lsa_names;
2216
2217         types_array.count = num_rids;
2218         types_array.ids = wire_attrs;
2219
2220         *r->out.names = names_array;
2221         *r->out.types = types_array;
2222
2223         DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2224
2225         return status;
2226 }
2227
2228 /*******************************************************************
2229  _samr_OpenUser
2230 ********************************************************************/
2231
2232 NTSTATUS _samr_OpenUser(pipes_struct *p,
2233                         struct samr_OpenUser *r)
2234 {
2235         struct samu *sampass=NULL;
2236         DOM_SID sid;
2237         struct samr_domain_info *dinfo;
2238         struct samr_user_info *uinfo;
2239         SEC_DESC *psd = NULL;
2240         uint32    acc_granted;
2241         uint32    des_access = r->in.access_mask;
2242         uint32_t extra_access = 0;
2243         size_t    sd_size;
2244         bool ret;
2245         NTSTATUS nt_status;
2246         SE_PRIV se_rights;
2247         NTSTATUS status;
2248
2249         dinfo = policy_handle_find(p, r->in.domain_handle,
2250                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
2251                                    struct samr_domain_info, &status);
2252         if (!NT_STATUS_IS_OK(status)) {
2253                 return status;
2254         }
2255
2256         if ( !(sampass = samu_new( p->mem_ctx )) ) {
2257                 return NT_STATUS_NO_MEMORY;
2258         }
2259
2260         /* append the user's RID to it */
2261
2262         if (!sid_compose(&sid, &dinfo->sid, r->in.rid))
2263                 return NT_STATUS_NO_SUCH_USER;
2264
2265         /* check if access can be granted as requested by client. */
2266         map_max_allowed_access(p->server_info->ptok,
2267                                &p->server_info->utok,
2268                                &des_access);
2269
2270         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2271         se_map_generic(&des_access, &usr_generic_mapping);
2272
2273         /*
2274          * Get the sampass first as we need to check privilages
2275          * based on what kind of user object this is.
2276          * But don't reveal info too early if it didn't exist.
2277          */
2278
2279         become_root();
2280         ret=pdb_getsampwsid(sampass, &sid);
2281         unbecome_root();
2282
2283         se_priv_copy(&se_rights, &se_priv_none);
2284
2285         /*
2286          * We do the override access checks on *open*, not at
2287          * SetUserInfo time.
2288          */
2289         if (ret) {
2290                 uint32_t acb_info = pdb_get_acct_ctrl(sampass);
2291
2292                 if ((acb_info & ACB_WSTRUST) &&
2293                                 user_has_any_privilege(p->server_info->ptok,
2294                                                 &se_machine_account)) {
2295                         /*
2296                          * SeMachineAccount is needed to add
2297                          * GENERIC_RIGHTS_USER_WRITE to a machine
2298                          * account.
2299                          */
2300                         se_priv_add(&se_rights, &se_machine_account);
2301                         DEBUG(10,("_samr_OpenUser: adding machine account "
2302                                 "rights to handle for user %s\n",
2303                                 pdb_get_username(sampass) ));
2304                 }
2305                 if ((acb_info & ACB_NORMAL) &&
2306                                 user_has_any_privilege(p->server_info->ptok,
2307                                                 &se_add_users)) {
2308                         /*
2309                          * SeAddUsers is needed to add
2310                          * GENERIC_RIGHTS_USER_WRITE to a normal
2311                          * account.
2312                          */
2313                         se_priv_add(&se_rights, &se_add_users);
2314                         DEBUG(10,("_samr_OpenUser: adding add user "
2315                                 "rights to handle for user %s\n",
2316                                 pdb_get_username(sampass) ));
2317                 }
2318                 /*
2319                  * Cheat - allow GENERIC_RIGHTS_USER_WRITE if pipe user is
2320                  * in DOMAIN_GROUP_RID_ADMINS. This is almost certainly not
2321                  * what Windows does but is a hack for people who haven't
2322                  * set up privilages on groups in Samba.
2323                  */
2324                 if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
2325                         if (lp_enable_privileges() && nt_token_check_domain_rid(p->server_info->ptok,
2326                                                         DOMAIN_GROUP_RID_ADMINS)) {
2327                                 des_access &= ~GENERIC_RIGHTS_USER_WRITE;
2328                                 extra_access = GENERIC_RIGHTS_USER_WRITE;
2329                                 DEBUG(4,("_samr_OpenUser: Allowing "
2330                                         "GENERIC_RIGHTS_USER_WRITE for "
2331                                         "rid admins\n"));
2332                         }
2333                 }
2334         }
2335
2336         TALLOC_FREE(sampass);
2337
2338         nt_status = access_check_object(psd, p->server_info->ptok,
2339                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2340                 &acc_granted, "_samr_OpenUser");
2341
2342         if ( !NT_STATUS_IS_OK(nt_status) )
2343                 return nt_status;
2344
2345         /* check that the SID exists in our domain. */
2346         if (ret == False) {
2347                 return NT_STATUS_NO_SUCH_USER;
2348         }
2349
2350         /* If we did the rid admins hack above, allow access. */
2351         acc_granted |= extra_access;
2352
2353         uinfo = policy_handle_create(p, r->out.user_handle, acc_granted,
2354                                      struct samr_user_info, &nt_status);
2355         if (!NT_STATUS_IS_OK(nt_status)) {
2356                 return nt_status;
2357         }
2358         uinfo->sid = sid;
2359
2360         return NT_STATUS_OK;
2361 }
2362
2363 /*************************************************************************
2364  *************************************************************************/
2365
2366 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2367                                             DATA_BLOB *blob,
2368                                             struct lsa_BinaryString **_r)
2369 {
2370         struct lsa_BinaryString *r;
2371
2372         if (!blob || !_r) {
2373                 return NT_STATUS_INVALID_PARAMETER;
2374         }
2375
2376         r = TALLOC_ZERO_P(mem_ctx, struct lsa_BinaryString);
2377         if (!r) {
2378                 return NT_STATUS_NO_MEMORY;
2379         }
2380
2381         r->array = TALLOC_ZERO_ARRAY(mem_ctx, uint16_t, blob->length/2);
2382         if (!r->array) {
2383                 return NT_STATUS_NO_MEMORY;
2384         }
2385         memcpy(r->array, blob->data, blob->length);
2386         r->size = blob->length;
2387         r->length = blob->length;
2388
2389         if (!r->array) {
2390                 return NT_STATUS_NO_MEMORY;
2391         }
2392
2393         *_r = r;
2394
2395         return NT_STATUS_OK;
2396 }
2397
2398 /*************************************************************************
2399  get_user_info_1.
2400  *************************************************************************/
2401
2402 static NTSTATUS get_user_info_1(TALLOC_CTX *mem_ctx,
2403                                 struct samr_UserInfo1 *r,
2404                                 struct samu *pw,
2405                                 DOM_SID *domain_sid)
2406 {
2407         const DOM_SID *sid_group;
2408         uint32_t primary_gid;
2409
2410         become_root();
2411         sid_group = pdb_get_group_sid(pw);
2412         unbecome_root();
2413
2414         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2415                 DEBUG(0, ("get_user_info_1: User %s has Primary Group SID %s, \n"
2416                           "which conflicts with the domain sid %s.  Failing operation.\n",
2417                           pdb_get_username(pw), sid_string_dbg(sid_group),
2418                           sid_string_dbg(domain_sid)));
2419                 return NT_STATUS_UNSUCCESSFUL;
2420         }
2421
2422         r->account_name.string          = talloc_strdup(mem_ctx, pdb_get_username(pw));
2423         r->full_name.string             = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2424         r->primary_gid                  = primary_gid;
2425         r->description.string           = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2426         r->comment.string               = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2427
2428         return NT_STATUS_OK;
2429 }
2430
2431 /*************************************************************************
2432  get_user_info_2.
2433  *************************************************************************/
2434
2435 static NTSTATUS get_user_info_2(TALLOC_CTX *mem_ctx,
2436                                 struct samr_UserInfo2 *r,
2437                                 struct samu *pw)
2438 {
2439         r->comment.string               = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2440         r->unknown.string               = NULL;
2441         r->country_code                 = 0;
2442         r->code_page                    = 0;
2443
2444         return NT_STATUS_OK;
2445 }
2446
2447 /*************************************************************************
2448  get_user_info_3.
2449  *************************************************************************/
2450
2451 static NTSTATUS get_user_info_3(TALLOC_CTX *mem_ctx,
2452                                 struct samr_UserInfo3 *r,
2453                                 struct samu *pw,
2454                                 DOM_SID *domain_sid)
2455 {
2456         const DOM_SID *sid_user, *sid_group;
2457         uint32_t rid, primary_gid;
2458
2459         sid_user = pdb_get_user_sid(pw);
2460
2461         if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2462                 DEBUG(0, ("get_user_info_3: User %s has SID %s, \nwhich conflicts with "
2463                           "the domain sid %s.  Failing operation.\n",
2464                           pdb_get_username(pw), sid_string_dbg(sid_user),
2465                           sid_string_dbg(domain_sid)));
2466                 return NT_STATUS_UNSUCCESSFUL;
2467         }
2468
2469         become_root();
2470         sid_group = pdb_get_group_sid(pw);
2471         unbecome_root();
2472
2473         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2474                 DEBUG(0, ("get_user_info_3: User %s has Primary Group SID %s, \n"
2475                           "which conflicts with the domain sid %s.  Failing operation.\n",
2476                           pdb_get_username(pw), sid_string_dbg(sid_group),
2477                           sid_string_dbg(domain_sid)));
2478                 return NT_STATUS_UNSUCCESSFUL;
2479         }
2480
2481         unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2482         unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2483         unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2484         unix_to_nt_time(&r->allow_password_change, pdb_get_pass_can_change_time(pw));
2485         unix_to_nt_time(&r->force_password_change, pdb_get_pass_must_change_time(pw));
2486
2487         r->account_name.string  = talloc_strdup(mem_ctx, pdb_get_username(pw));
2488         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2489         r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2490         r->home_drive.string    = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2491         r->logon_script.string  = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2492         r->profile_path.string  = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2493         r->workstations.string  = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2494
2495         r->logon_hours          = get_logon_hours_from_pdb(mem_ctx, pw);
2496         r->rid                  = rid;
2497         r->primary_gid          = primary_gid;
2498         r->acct_flags           = pdb_get_acct_ctrl(pw);
2499         r->bad_password_count   = pdb_get_bad_password_count(pw);
2500         r->logon_count          = pdb_get_logon_count(pw);
2501
2502         return NT_STATUS_OK;
2503 }
2504
2505 /*************************************************************************
2506  get_user_info_4.
2507  *************************************************************************/
2508
2509 static NTSTATUS get_user_info_4(TALLOC_CTX *mem_ctx,
2510                                 struct samr_UserInfo4 *r,
2511                                 struct samu *pw)
2512 {
2513         r->logon_hours          = get_logon_hours_from_pdb(mem_ctx, pw);
2514
2515         return NT_STATUS_OK;
2516 }
2517
2518 /*************************************************************************
2519  get_user_info_5.
2520  *************************************************************************/
2521
2522 static NTSTATUS get_user_info_5(TALLOC_CTX *mem_ctx,
2523                                 struct samr_UserInfo5 *r,
2524                                 struct samu *pw,
2525                                 DOM_SID *domain_sid)
2526 {
2527         const DOM_SID *sid_user, *sid_group;
2528         uint32_t rid, primary_gid;
2529
2530         sid_user = pdb_get_user_sid(pw);
2531
2532         if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2533                 DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
2534                           "the domain sid %s.  Failing operation.\n",
2535                           pdb_get_username(pw), sid_string_dbg(sid_user),
2536                           sid_string_dbg(domain_sid)));
2537                 return NT_STATUS_UNSUCCESSFUL;
2538         }
2539
2540         become_root();
2541         sid_group = pdb_get_group_sid(pw);
2542         unbecome_root();
2543
2544         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2545                 DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
2546                           "which conflicts with the domain sid %s.  Failing operation.\n",
2547                           pdb_get_username(pw), sid_string_dbg(sid_group),
2548                           sid_string_dbg(domain_sid)));
2549                 return NT_STATUS_UNSUCCESSFUL;
2550         }
2551
2552         unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2553         unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2554         unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2555         unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2556
2557         r->account_name.string  = talloc_strdup(mem_ctx, pdb_get_username(pw));
2558         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2559         r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2560         r->home_drive.string    = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2561         r->logon_script.string  = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2562         r->profile_path.string  = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2563         r->description.string   = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2564         r->workstations.string  = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2565
2566         r->logon_hours          = get_logon_hours_from_pdb(mem_ctx, pw);
2567         r->rid                  = rid;
2568         r->primary_gid          = primary_gid;
2569         r->acct_flags           = pdb_get_acct_ctrl(pw);
2570         r->bad_password_count   = pdb_get_bad_password_count(pw);
2571         r->logon_count          = pdb_get_logon_count(pw);
2572
2573         return NT_STATUS_OK;
2574 }
2575
2576 /*************************************************************************
2577  get_user_info_6.
2578  *************************************************************************/
2579
2580 static NTSTATUS get_user_info_6(TALLOC_CTX *mem_ctx,
2581                                 struct samr_UserInfo6 *r,
2582                                 struct samu *pw)
2583 {
2584         r->account_name.string  = talloc_strdup(mem_ctx, pdb_get_username(pw));
2585         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2586
2587         return NT_STATUS_OK;
2588 }
2589
2590 /*************************************************************************
2591  get_user_info_7. Safe. Only gives out account_name.
2592  *************************************************************************/
2593
2594 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2595                                 struct samr_UserInfo7 *r,
2596                                 struct samu *smbpass)
2597 {
2598         r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2599         if (!r->account_name.string) {
2600                 return NT_STATUS_NO_MEMORY;
2601         }
2602
2603         return NT_STATUS_OK;
2604 }
2605
2606 /*************************************************************************
2607  get_user_info_8.
2608  *************************************************************************/
2609
2610 static NTSTATUS get_user_info_8(TALLOC_CTX *mem_ctx,
2611                                 struct samr_UserInfo8 *r,
2612                                 struct samu *pw)
2613 {
2614         r->full_name.string     = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2615
2616         return NT_STATUS_OK;
2617 }
2618
2619 /*************************************************************************
2620  get_user_info_9. Only gives out primary group SID.
2621  *************************************************************************/
2622
2623 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2624                                 struct samr_UserInfo9 *r,
2625                                 struct samu *smbpass)
2626 {
2627         r->primary_gid = pdb_get_group_rid(smbpass);
2628
2629         return NT_STATUS_OK;
2630 }
2631
2632 /*************************************************************************
2633  get_user_info_10.
2634  *************************************************************************/
2635
2636 static NTSTATUS get_user_info_10(TALLOC_CTX *mem_ctx,
2637                                  struct samr_UserInfo10 *r,
2638                                  struct samu *pw)
2639 {
2640         r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2641         r->home_drive.string    = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2642
2643         return NT_STATUS_OK;
2644 }
2645
2646 /*************************************************************************
2647  get_user_info_11.
2648  *************************************************************************/
2649
2650 static NTSTATUS get_user_info_11(TALLOC_CTX *mem_ctx,
2651                                  struct samr_UserInfo11 *r,
2652                                  struct samu *pw)
2653 {
2654         r->logon_script.string  = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2655
2656         return NT_STATUS_OK;
2657 }
2658
2659 /*************************************************************************
2660  get_user_info_12.
2661  *************************************************************************/
2662
2663 static NTSTATUS get_user_info_12(TALLOC_CTX *mem_ctx,
2664                                  struct samr_UserInfo12 *r,
2665                                  struct samu *pw)
2666 {
2667         r->profile_path.string  = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2668
2669         return NT_STATUS_OK;
2670 }
2671
2672 /*************************************************************************
2673  get_user_info_13.
2674  *************************************************************************/
2675
2676 static NTSTATUS get_user_info_13(TALLOC_CTX *mem_ctx,
2677                                  struct samr_UserInfo13 *r,
2678                                  struct samu *pw)
2679 {
2680         r->description.string   = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2681
2682         return NT_STATUS_OK;
2683 }
2684
2685 /*************************************************************************
2686  get_user_info_14.
2687  *************************************************************************/
2688
2689 static NTSTATUS get_user_info_14(TALLOC_CTX *mem_ctx,
2690                                  struct samr_UserInfo14 *r,
2691                                  struct samu *pw)
2692 {
2693         r->workstations.string  = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2694
2695         return NT_STATUS_OK;
2696 }
2697
2698 /*************************************************************************
2699  get_user_info_16. Safe. Only gives out acb bits.
2700  *************************************************************************/
2701
2702 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2703                                  struct samr_UserInfo16 *r,
2704                                  struct samu *smbpass)
2705 {
2706         r->acct_flags = pdb_get_acct_ctrl(smbpass);
2707
2708         return NT_STATUS_OK;
2709 }
2710
2711 /*************************************************************************
2712  get_user_info_17.
2713  *************************************************************************/
2714
2715 static NTSTATUS get_user_info_17(TALLOC_CTX *mem_ctx,
2716                                  struct samr_UserInfo17 *r,
2717                                  struct samu *pw)
2718 {
2719         unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2720
2721         return NT_STATUS_OK;
2722 }
2723
2724 /*************************************************************************
2725  get_user_info_18. OK - this is the killer as it gives out password info.
2726  Ensure that this is only allowed on an encrypted connection with a root
2727  user. JRA.
2728  *************************************************************************/
2729
2730 static NTSTATUS get_user_info_18(pipes_struct *p,
2731                                  TALLOC_CTX *mem_ctx,
2732                                  struct samr_UserInfo18 *r,
2733                                  DOM_SID *user_sid)
2734 {
2735         struct samu *smbpass=NULL;
2736         bool ret;
2737
2738         ZERO_STRUCTP(r);
2739
2740         if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2741                 return NT_STATUS_ACCESS_DENIED;
2742         }
2743
2744         if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
2745                 return NT_STATUS_ACCESS_DENIED;
2746         }
2747
2748         /*
2749          * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2750          */
2751
2752         if ( !(smbpass = samu_new( mem_ctx )) ) {
2753                 return NT_STATUS_NO_MEMORY;
2754         }
2755
2756         ret = pdb_getsampwsid(smbpass, user_sid);
2757
2758         if (ret == False) {
2759                 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2760                 TALLOC_FREE(smbpass);
2761                 return (geteuid() == sec_initial_uid()) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2762         }
2763
2764         DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2765
2766         if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2767                 TALLOC_FREE(smbpass);
2768                 return NT_STATUS_ACCOUNT_DISABLED;
2769         }
2770
2771         r->lm_pwd_active = true;
2772         r->nt_pwd_active = true;
2773         memcpy(r->lm_pwd.hash, pdb_get_lanman_passwd(smbpass), 16);
2774         memcpy(r->nt_pwd.hash, pdb_get_nt_passwd(smbpass), 16);
2775         r->password_expired = 0; /* FIXME */
2776
2777         TALLOC_FREE(smbpass);
2778
2779         return NT_STATUS_OK;
2780 }
2781
2782 /*************************************************************************
2783  get_user_info_20
2784  *************************************************************************/
2785
2786 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2787                                  struct samr_UserInfo20 *r,
2788                                  struct samu *sampass)
2789 {
2790         const char *munged_dial = NULL;
2791         DATA_BLOB blob;
2792         NTSTATUS status;
2793         struct lsa_BinaryString *parameters = NULL;
2794
2795         ZERO_STRUCTP(r);
2796
2797         munged_dial = pdb_get_munged_dial(sampass);
2798
2799         DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2800                 munged_dial, (int)strlen(munged_dial)));
2801
2802         if (munged_dial) {
2803                 blob = base64_decode_data_blob(munged_dial);
2804         } else {
2805                 blob = data_blob_string_const_null("");
2806         }
2807
2808         status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2809         data_blob_free(&blob);
2810         if (!NT_STATUS_IS_OK(status)) {
2811                 return status;
2812         }
2813
2814         r->parameters = *parameters;
2815
2816         return NT_STATUS_OK;
2817 }
2818
2819
2820 /*************************************************************************
2821  get_user_info_21
2822  *************************************************************************/
2823
2824 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2825                                  struct samr_UserInfo21 *r,
2826                                  struct samu *pw,
2827                                  DOM_SID *domain_sid,
2828                                  uint32_t acc_granted)
2829 {
2830         NTSTATUS status;
2831         const DOM_SID *sid_user, *sid_group;
2832         uint32_t rid, primary_gid;
2833         NTTIME force_password_change;
2834         time_t must_change_time;
2835         struct lsa_BinaryString *parameters = NULL;
2836         const char *munged_dial = NULL;
2837         DATA_BLOB blob;
2838
2839         ZERO_STRUCTP(r);
2840
2841         sid_user = pdb_get_user_sid(pw);
2842
2843         if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2844                 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2845                           "the domain sid %s.  Failing operation.\n",
2846                           pdb_get_username(pw), sid_string_dbg(sid_user),
2847                           sid_string_dbg(domain_sid)));
2848                 return NT_STATUS_UNSUCCESSFUL;
2849         }
2850
2851         become_root();
2852         sid_group = pdb_get_group_sid(pw);
2853         unbecome_root();
2854
2855         if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2856                 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2857                           "which conflicts with the domain sid %s.  Failing operation.\n",
2858                           pdb_get_username(pw), sid_string_dbg(sid_group),
2859                           sid_string_dbg(domain_sid)));
2860                 return NT_STATUS_UNSUCCESSFUL;
2861         }
2862
2863         unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2864         unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2865         unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2866         unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2867         unix_to_nt_time(&r->allow_password_change, pdb_get_pass_can_change_time(pw));
2868
2869         must_change_time = pdb_get_pass_must_change_time(pw);
2870         if (must_change_time == get_time_t_max()) {
2871                 unix_to_nt_time_abs(&force_password_change, must_change_time);
2872         } else {
2873                 unix_to_nt_time(&force_password_change, must_change_time);
2874         }
2875
2876         munged_dial = pdb_get_munged_dial(pw);
2877         if (munged_dial) {
2878                 blob = base64_decode_data_blob(munged_dial);
2879         } else {
2880                 blob = data_blob_string_const_null("");
2881         }
2882
2883         status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2884         data_blob_free(&blob);
2885         if (!NT_STATUS_IS_OK(status)) {
2886                 return status;
2887         }
2888
2889         r->force_password_change        = force_password_change;
2890
2891         r->account_name.string          = talloc_strdup(mem_ctx, pdb_get_username(pw));
2892         r->full_name.string             = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2893         r->home_directory.string        = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2894         r->home_drive.string            = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2895         r->logon_script.string          = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2896         r->profile_path.string          = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2897         r->description.string           = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2898         r->workstations.string          = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2899         r->comment.string               = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2900
2901         r->logon_hours                  = get_logon_hours_from_pdb(mem_ctx, pw);
2902         r->parameters                   = *parameters;
2903         r->rid                          = rid;
2904         r->primary_gid                  = primary_gid;
2905         r->acct_flags                   = pdb_get_acct_ctrl(pw);
2906         r->bad_password_count           = pdb_get_bad_password_count(pw);
2907         r->logon_count                  = pdb_get_logon_count(pw);
2908         r->fields_present               = pdb_build_fields_present(pw);
2909         r->password_expired             = (pdb_get_pass_must_change_time(pw) == 0) ?
2910                                                 PASS_MUST_CHANGE_AT_NEXT_LOGON : 0;
2911         r->country_code                 = 0;
2912         r->code_page                    = 0;
2913         r->lm_password_set              = 0;
2914         r->nt_password_set              = 0;
2915
2916 #if 0
2917
2918         /*
2919           Look at a user on a real NT4 PDC with usrmgr, press
2920           'ok'. Then you will see that fields_present is set to
2921           0x08f827fa. Look at the user immediately after that again,
2922           and you will see that 0x00fffff is returned. This solves
2923           the problem that you get access denied after having looked
2924           at the user.
2925           -- Volker
2926         */
2927
2928 #endif
2929
2930
2931         return NT_STATUS_OK;
2932 }
2933
2934 /*******************************************************************
2935  _samr_QueryUserInfo
2936  ********************************************************************/
2937
2938 NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
2939                              struct samr_QueryUserInfo *r)
2940 {
2941         NTSTATUS status;
2942         union samr_UserInfo *user_info = NULL;
2943         struct samr_user_info *uinfo;
2944         DOM_SID domain_sid;
2945         uint32 rid;
2946         bool ret = false;
2947         struct samu *pwd = NULL;
2948         uint32_t acc_required, acc_granted;
2949
2950         switch (r->in.level) {
2951         case 1: /* UserGeneralInformation */
2952                 /* USER_READ_GENERAL */
2953                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC;
2954                 break;
2955         case 2: /* UserPreferencesInformation */
2956                 /* USER_READ_PREFERENCES | USER_READ_GENERAL */
2957                 acc_required = SAMR_USER_ACCESS_GET_LOCALE |
2958                                SAMR_USER_ACCESS_GET_NAME_ETC;
2959                 break;
2960         case 3: /* UserLogonInformation */
2961                 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
2962                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC |
2963                                SAMR_USER_ACCESS_GET_LOCALE |
2964                                SAMR_USER_ACCESS_GET_LOGONINFO |
2965                                SAMR_USER_ACCESS_GET_ATTRIBUTES;
2966                 break;
2967         case 4: /* UserLogonHoursInformation */
2968                 /* USER_READ_LOGON */
2969                 acc_required = SAMR_USER_ACCESS_GET_LOGONINFO;
2970                 break;
2971         case 5: /* UserAccountInformation */
2972                 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
2973                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC |
2974                                SAMR_USER_ACCESS_GET_LOCALE |
2975                                SAMR_USER_ACCESS_GET_LOGONINFO |
2976                                SAMR_USER_ACCESS_GET_ATTRIBUTES;
2977                 break;
2978         case 6: /* UserNameInformation */
2979         case 7: /* UserAccountNameInformation */
2980         case 8: /* UserFullNameInformation */
2981         case 9: /* UserPrimaryGroupInformation */
2982         case 13: /* UserAdminCommentInformation */
2983                 /* USER_READ_GENERAL */
2984                 acc_required = SAMR_USER_ACCESS_GET_NAME_ETC;
2985                 break;
2986         case 10: /* UserHomeInformation */
2987         case 11: /* UserScriptInformation */
2988         case 12: /* UserProfileInformation */
2989         case 14: /* UserWorkStationsInformation */
2990                 /* USER_READ_LOGON */
2991                 acc_required = SAMR_USER_ACCESS_GET_LOGONINFO;
2992                 break;
2993         case 16: /* UserControlInformation */
2994         case 17: /* UserExpiresInformation */
2995         case 20: /* UserParametersInformation */
2996                 /* USER_READ_ACCOUNT */
2997                 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
2998                 break;
2999         case 21: /* UserAllInformation */
3000                 /* FIXME! - gd */
3001                 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
3002                 break;
3003         case 18: /* UserInternal1Information */
3004                 /* FIXME! - gd */
3005                 acc_required = SAMR_USER_ACCESS_GET_ATTRIBUTES;
3006                 break;
3007         case 23: /* UserInternal4Information */
3008         case 24: /* UserInternal4InformationNew */
3009         case 25: /* UserInternal4InformationNew */
3010         case 26: /* UserInternal5InformationNew */
3011         default:
3012                 return NT_STATUS_INVALID_INFO_CLASS;
3013                 break;
3014         }
3015
3016         uinfo = policy_handle_find(p, r->in.user_handle,
3017                                    acc_required, &acc_granted,
3018                                    struct samr_user_info, &status);
3019         if (!NT_STATUS_IS_OK(status)) {
3020                 return status;
3021         }
3022
3023         domain_sid = uinfo->sid;
3024
3025         sid_split_rid(&domain_sid, &rid);
3026
3027         if (!sid_check_is_in_our_domain(&uinfo->sid))
3028                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3029
3030         DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
3031                  sid_string_dbg(&uinfo->sid)));
3032
3033         user_info = TALLOC_ZERO_P(p->mem_ctx, union samr_UserInfo);
3034         if (!user_info) {
3035                 return NT_STATUS_NO_MEMORY;
3036         }
3037
3038         DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
3039
3040         if (!(pwd = samu_new(p->mem_ctx))) {
3041                 return NT_STATUS_NO_MEMORY;
3042         }
3043
3044         become_root();
3045         ret = pdb_getsampwsid(pwd, &uinfo->sid);
3046         unbecome_root();
3047
3048         if (ret == false) {
3049                 DEBUG(4,("User %s not found\n", sid_string_dbg(&uinfo->sid)));
3050                 TALLOC_FREE(pwd);
3051                 return NT_STATUS_NO_SUCH_USER;
3052         }
3053
3054         DEBUG(3,("User:[%s]\n", pdb_get_username(pwd)));
3055
3056         samr_clear_sam_passwd(pwd);
3057
3058         switch (r->in.level) {
3059         case 1:
3060                 status = get_user_info_1(p->mem_ctx, &user_info->info1, pwd, &domain_sid);
3061                 break;
3062         case 2:
3063                 status = get_user_info_2(p->mem_ctx, &user_info->info2, pwd);
3064                 break;
3065         case 3:
3066                 status = get_user_info_3(p->mem_ctx, &user_info->info3, pwd, &domain_sid);
3067                 break;
3068         case 4:
3069                 status = get_user_info_4(p->mem_ctx, &user_info->info4, pwd);
3070                 break;
3071         case 5:
3072                 status = get_user_info_5(p->mem_ctx, &user_info->info5, pwd, &domain_sid);
3073                 break;
3074         case 6:
3075                 status = get_user_info_6(p->mem_ctx, &user_info->info6, pwd);
3076                 break;
3077         case 7:
3078                 status = get_user_info_7(p->mem_ctx, &user_info->info7, pwd);
3079                 break;
3080         case 8:
3081                 status = get_user_info_8(p->mem_ctx, &user_info->info8, pwd);
3082                 break;
3083         case 9:
3084                 status = get_user_info_9(p->mem_ctx, &user_info->info9, pwd);
3085                 break;
3086         case 10:
3087                 status = get_user_info_10(p->mem_ctx, &user_info->info10, pwd);
3088                 break;
3089         case 11:
3090                 status = get_user_info_11(p->mem_ctx, &user_info->info11, pwd);
3091                 break;
3092         case 12:
3093                 status = get_user_info_12(p->mem_ctx, &user_info->info12, pwd);
3094                 break;
3095         case 13:
3096                 status = get_user_info_13(p->mem_ctx, &user_info->info13, pwd);
3097                 break;
3098         case 14:
3099                 status = get_user_info_14(p->mem_ctx, &user_info->info14, pwd);
3100                 break;
3101         case 16:
3102                 status = get_user_info_16(p->mem_ctx, &user_info->info16, pwd);
3103                 break;
3104         case 17:
3105                 status = get_user_info_17(p->mem_ctx, &user_info->info17, pwd);
3106                 break;
3107         case 18:
3108                 /* level 18 is special */
3109                 status = get_user_info_18(p, p->mem_ctx, &user_info->info18,
3110                                           &uinfo->sid);
3111                 break;
3112         case 20:
3113                 status = get_user_info_20(p->mem_ctx, &user_info->info20, pwd);
3114                 break;
3115         case 21:
3116                 status = get_user_info_21(p->mem_ctx, &user_info->info21, pwd, &domain_sid, acc_granted);
3117                 break;
3118         default:
3119                 status = NT_STATUS_INVALID_INFO_CLASS;
3120                 break;
3121         }
3122
3123         if (!NT_STATUS_IS_OK(status)) {
3124                 goto done;
3125         }
3126
3127         *r->out.info = user_info;
3128
3129  done:
3130         TALLOC_FREE(pwd);
3131
3132         DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
3133
3134         return status;
3135 }
3136
3137 /****************************************************************
3138 ****************************************************************/
3139
3140 NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
3141                               struct samr_QueryUserInfo2 *r)
3142 {
3143         struct samr_QueryUserInfo u;
3144
3145         u.in.user_handle        = r->in.user_handle;
3146         u.in.level              = r->in.level;
3147         u.out.info              = r->out.info;
3148
3149         return _samr_QueryUserInfo(p, &u);
3150 }
3151
3152 /*******************************************************************
3153  _samr_GetGroupsForUser
3154  ********************************************************************/
3155
3156 NTSTATUS _samr_GetGroupsForUser(pipes_struct *p,
3157                                 struct samr_GetGroupsForUser *r)
3158 {
3159         struct samr_user_info *uinfo;
3160         struct samu *sam_pass=NULL;
3161         DOM_SID *sids;
3162         struct samr_RidWithAttribute dom_gid;
3163         struct samr_RidWithAttribute *gids = NULL;
3164         uint32 primary_group_rid;
3165         size_t num_groups = 0;
3166         gid_t *unix_gids;
3167         size_t i, num_gids;
3168         bool ret;
3169         NTSTATUS result;
3170         bool success = False;
3171
3172         struct samr_RidWithAttributeArray *rids = NULL;
3173
3174         /*
3175          * from the SID in the request:
3176          * we should send back the list of DOMAIN GROUPS
3177          * the user is a member of
3178          *
3179          * and only the DOMAIN GROUPS
3180          * no ALIASES !!! neither aliases of the domain
3181          * nor aliases of the builtin SID
3182          *
3183          * JFM, 12/2/2001
3184          */
3185
3186         DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
3187
3188         uinfo = policy_handle_find(p, r->in.user_handle,
3189                                    SAMR_USER_ACCESS_GET_GROUPS, NULL,
3190                                    struct samr_user_info, &result);
3191         if (!NT_STATUS_IS_OK(result)) {
3192                 return result;
3193         }
3194
3195         rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidWithAttributeArray);
3196         if (!rids) {
3197                 return NT_STATUS_NO_MEMORY;
3198         }
3199
3200         if (!sid_check_is_in_our_domain(&uinfo->sid))
3201                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3202
3203         if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
3204                 return NT_STATUS_NO_MEMORY;
3205         }
3206
3207         become_root();
3208         ret = pdb_getsampwsid(sam_pass, &uinfo->sid);
3209         unbecome_root();
3210
3211         if (!ret) {
3212                 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
3213                            sid_string_dbg(&uinfo->sid)));
3214                 return NT_STATUS_NO_SUCH_USER;
3215         }
3216
3217         sids = NULL;
3218
3219         /* make both calls inside the root block */
3220         become_root();
3221         result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
3222                                             &sids, &unix_gids, &num_groups);
3223         if ( NT_STATUS_IS_OK(result) ) {
3224                 success = sid_peek_check_rid(get_global_sam_sid(),
3225                                              pdb_get_group_sid(sam_pass),
3226                                              &primary_group_rid);
3227         }
3228         unbecome_root();
3229
3230         if (!NT_STATUS_IS_OK(result)) {
3231                 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
3232                            sid_string_dbg(&uinfo->sid)));
3233                 return result;
3234         }
3235
3236         if ( !success ) {
3237                 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
3238                           sid_string_dbg(pdb_get_group_sid(sam_pass)),
3239                           pdb_get_username(sam_pass)));
3240                 TALLOC_FREE(sam_pass);
3241                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3242         }
3243
3244         gids = NULL;
3245         num_gids = 0;
3246
3247         dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
3248                               SE_GROUP_ENABLED);
3249         dom_gid.rid = primary_group_rid;
3250         ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
3251
3252         for (i=0; i<num_groups; i++) {
3253
3254                 if (!sid_peek_check_rid(get_global_sam_sid(),
3255                                         &(sids[i]), &dom_gid.rid)) {
3256                         DEBUG(10, ("Found sid %s not in our domain\n",
3257                                    sid_string_dbg(&sids[i])));
3258                         continue;
3259                 }
3260
3261                 if (dom_gid.rid == primary_group_rid) {
3262                         /* We added the primary group directly from the
3263                          * sam_account. The other SIDs are unique from
3264                          * enum_group_memberships */
3265                         continue;
3266                 }
3267
3268                 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
3269         }
3270
3271         rids->count = num_gids;
3272         rids->rids = gids;
3273
3274         *r->out.rids = rids;
3275
3276         DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
3277
3278         return result;
3279 }
3280
3281 /*******************************************************************
3282  ********************************************************************/
3283
3284 static uint32_t samr_get_server_role(void)
3285 {
3286         uint32_t role = ROLE_DOMAIN_PDC;
3287
3288         if (lp_server_role() == ROLE_DOMAIN_BDC) {
3289                 role = ROLE_DOMAIN_BDC;
3290         }
3291
3292         return role;
3293 }
3294
3295 /*******************************************************************
3296  ********************************************************************/
3297
3298 static NTSTATUS query_dom_info_1(TALLOC_CTX *mem_ctx,
3299                                  struct samr_DomInfo1 *r)
3300 {
3301         uint32_t account_policy_temp;
3302         time_t u_expire, u_min_age;
3303
3304         become_root();
3305
3306         /* AS ROOT !!! */
3307
3308         pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN, &account_policy_temp);
3309         r->min_password_length = account_policy_temp;
3310
3311         pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &account_policy_temp);
3312         r->password_history_length = account_policy_temp;
3313
3314         pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
3315                                &r->password_properties);
3316
3317         pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &account_policy_temp);
3318         u_expire = account_policy_temp;
3319
3320         pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &account_policy_temp);
3321         u_min_age = account_policy_temp;
3322
3323         /* !AS ROOT */
3324
3325         unbecome_root();
3326
3327         unix_to_nt_time_abs((NTTIME *)&r->max_password_age, u_expire);
3328         unix_to_nt_time_abs((NTTIME *)&r->min_password_age, u_min_age);
3329
3330         if (lp_check_password_script() && *lp_check_password_script()) {
3331                 r->password_properties |= DOMAIN_PASSWORD_COMPLEX;
3332         }
3333
3334         return NT_STATUS_OK;
3335 }
3336
3337 /*******************************************************************
3338  ********************************************************************/
3339
3340 static NTSTATUS query_dom_info_2(TALLOC_CTX *mem_ctx,
3341                                  struct samr_DomGeneralInformation *r,
3342                                  struct samr_domain_info *dinfo)
3343 {
3344         uint32_t u_logout;
3345         time_t seq_num;
3346
3347         become_root();
3348
3349         /* AS ROOT !!! */
3350
3351         r->num_users    = count_sam_users(dinfo->disp_info, ACB_NORMAL);
3352         r->num_groups   = count_sam_groups(dinfo->disp_info);
3353         r->num_aliases  = count_sam_aliases(dinfo->disp_info);
3354
3355         pdb_get_account_policy(PDB_POLICY_TIME_TO_LOGOUT, &u_logout);
3356
3357         unix_to_nt_time_abs(&r->force_logoff_time, u_logout);
3358
3359         if (!pdb_get_seq_num(&seq_num)) {
3360                 seq_num = time(NULL);
3361         }
3362
3363         /* !AS ROOT */
3364
3365         unbecome_root();
3366
3367         r->oem_information.string       = lp_serverstring();
3368         r->domain_name.string           = lp_workgroup();
3369         r->primary.string               = global_myname();
3370         r->sequence_num                 = seq_num;
3371         r->domain_server_state          = DOMAIN_SERVER_ENABLED;
3372         r->role                         = samr_get_server_role();
3373         r->unknown3                     = 1;
3374
3375         return NT_STATUS_OK;
3376 }
3377
3378 /*******************************************************************
3379  ********************************************************************/
3380
3381 static NTSTATUS query_dom_info_3(TALLOC_CTX *mem_ctx,
3382                                  struct samr_DomInfo3 *r)
3383 {
3384         uint32_t u_logout;
3385
3386         become_root();
3387
3388         /* AS ROOT !!! */
3389
3390         {
3391                 uint32_t ul;
3392                 pdb_get_account_policy(PDB_POLICY_TIME_TO_LOGOUT, &ul);
3393                 u_logout = (time_t)ul;
3394         }
3395
3396         /* !AS ROOT */
3397
3398         unbecome_root();
3399
3400         unix_to_nt_time_abs(&r->force_logoff_time, u_logout);
3401
3402         return NT_STATUS_OK;
3403 }
3404
3405 /*******************************************************************
3406  ********************************************************************/
3407
3408 static NTSTATUS query_dom_info_4(TALLOC_CTX *mem_ctx,
3409                                  struct samr_DomOEMInformation *r)
3410 {
3411         r->oem_information.string = lp_serverstring();
3412
3413         return NT_STATUS_OK;
3414 }
3415
3416 /*******************************************************************
3417  ********************************************************************/
3418
3419 static NTSTATUS query_dom_info_5(TALLOC_CTX *mem_ctx,
3420                                  struct samr_DomInfo5 *r)
3421 {
3422         r->domain_name.string = get_global_sam_name();
3423
3424         return NT_STATUS_OK;
3425 }
3426
3427 /*******************************************************************
3428  ********************************************************************/
3429
3430 static NTSTATUS query_dom_info_6(TALLOC_CTX *mem_ctx,
3431                                  struct samr_DomInfo6 *r)
3432 {
3433         /* NT returns its own name when a PDC. win2k and later
3434          * only the name of the PDC if itself is a BDC (samba4
3435          * idl) */
3436         r->primary.string = global_myname();
3437
3438         return NT_STATUS_OK;
3439 }
3440
3441 /*******************************************************************
3442  ********************************************************************/
3443
3444 static NTSTATUS query_dom_info_7(TALLOC_CTX *mem_ctx,
3445                                  struct samr_DomInfo7 *r)
3446 {
3447         r->role = samr_get_server_role();
3448
3449         return NT_STATUS_OK;
3450 }
3451
3452 /*******************************************************************
3453  ********************************************************************/
3454
3455 static NTSTATUS query_dom_info_8(TALLOC_CTX *mem_ctx,
3456                                  struct samr_DomInfo8 *r)
3457 {
3458         time_t seq_num;
3459
3460         become_root();
3461
3462         /* AS ROOT !!! */
3463
3464         if (!pdb_get_seq_num(&seq_num)) {
3465                 seq_num = time(NULL);
3466         }
3467
3468         /* !AS ROOT */
3469
3470         unbecome_root();
3471
3472         r->sequence_num = seq_num;
3473         r->domain_create_time = 0;
3474
3475         return NT_STATUS_OK;
3476 }
3477
3478 /*******************************************************************
3479  ********************************************************************/
3480
3481 static NTSTATUS query_dom_info_9(TALLOC_CTX *mem_ctx,
3482                                  struct samr_DomInfo9 *r)
3483 {
3484         r->domain_server_state = DOMAIN_SERVER_ENABLED;
3485
3486         return NT_STATUS_OK;
3487 }
3488
3489 /*******************************************************************
3490  ********************************************************************/
3491
3492 static NTSTATUS query_dom_info_11(TALLOC_CTX *mem_ctx,
3493                                   struct samr_DomGeneralInformation2 *r,
3494                                   struct samr_domain_info *dinfo)
3495 {
3496         NTSTATUS status;
3497         uint32_t account_policy_temp;
3498         time_t u_lock_duration, u_reset_time;
3499
3500         status = query_dom_info_2(mem_ctx, &r->general, dinfo);
3501         if (!NT_STATUS_IS_OK(status)) {
3502                 return status;
3503         }
3504
3505         /* AS ROOT !!! */
3506
3507         become_root();
3508
3509         pdb_get_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3510         u_lock_duration = account_policy_temp;
3511         if (u_lock_duration != -1) {
3512                 u_lock_duration *= 60;
3513         }
3514
3515         pdb_get_account_policy(PDB_POLICY_RESET_COUNT_TIME, &account_policy_temp);
3516         u_reset_time = account_policy_temp * 60;
3517
3518         pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3519         r->lockout_threshold = account_policy_temp;
3520
3521         /* !AS ROOT */
3522
3523         unbecome_root();
3524
3525         unix_to_nt_time_abs(&r->lockout_duration, u_lock_duration);
3526         unix_to_nt_time_abs(&r->lockout_window, u_reset_time);
3527
3528         return NT_STATUS_OK;
3529 }
3530
3531 /*******************************************************************
3532  ********************************************************************/
3533
3534 static NTSTATUS query_dom_info_12(TALLOC_CTX *mem_ctx,
3535                                   struct samr_DomInfo12 *r)
3536 {
3537         uint32_t account_policy_temp;
3538         time_t u_lock_duration, u_reset_time;
3539
3540         become_root();
3541
3542         /* AS ROOT !!! */
3543
3544         pdb_get_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3545         u_lock_duration = account_policy_temp;
3546         if (u_lock_duration != -1) {
3547                 u_lock_duration *= 60;
3548         }
3549
3550         pdb_get_account_policy(PDB_POLICY_RESET_COUNT_TIME, &account_policy_temp);
3551         u_reset_time = account_policy_temp * 60;
3552
3553         pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3554         r->lockout_threshold = account_policy_temp;
3555
3556         /* !AS ROOT */
3557
3558         unbecome_root();
3559
3560         unix_to_nt_time_abs(&r->lockout_duration, u_lock_duration);
3561         unix_to_nt_time_abs(&r->lockout_window, u_reset_time);
3562
3563         return NT_STATUS_OK;
3564 }
3565
3566 /*******************************************************************
3567  ********************************************************************/
3568
3569 static NTSTATUS query_dom_info_13(TALLOC_CTX *mem_ctx,
3570                                   struct samr_DomInfo13 *r)
3571 {
3572         time_t seq_num;
3573
3574         become_root();
3575
3576         /* AS ROOT !!! */
3577
3578         if (!pdb_get_seq_num(&seq_num)) {
3579                 seq_num = time(NULL);
3580         }
3581
3582         /* !AS ROOT */
3583
3584         unbecome_root();
3585
3586         r->sequence_num = seq_num;
3587         r->domain_create_time = 0;
3588         r->modified_count_at_last_promotion = 0;
3589
3590         return NT_STATUS_OK;
3591 }
3592
3593 /*******************************************************************
3594  _samr_QueryDomainInfo
3595  ********************************************************************/
3596
3597 NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
3598                                struct samr_QueryDomainInfo *r)
3599 {
3600         NTSTATUS status = NT_STATUS_OK;
3601         struct samr_domain_info *dinfo;
3602         union samr_DomainInfo *dom_info;
3603
3604         uint32_t acc_required;
3605
3606         DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3607
3608         switch (r->in.level) {
3609         case 1: /* DomainPasswordInformation */
3610         case 12: /* DomainLockoutInformation */
3611                 /* DOMAIN_READ_PASSWORD_PARAMETERS */
3612                 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1;
3613                 break;
3614         case 11: /* DomainGeneralInformation2 */
3615                 /* DOMAIN_READ_PASSWORD_PARAMETERS |
3616                  * DOMAIN_READ_OTHER_PARAMETERS */
3617                 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 |
3618                                SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2;
3619                 break;
3620         case 2: /* DomainGeneralInformation */
3621         case 3: /* DomainLogoffInformation */
3622         case 4: /* DomainOemInformation */
3623         case 5: /* DomainReplicationInformation */
3624         case 6: /* DomainReplicationInformation */
3625         case 7: /* DomainServerRoleInformation */
3626         case 8: /* DomainModifiedInformation */
3627         case 9: /* DomainStateInformation */
3628         case 10: /* DomainUasInformation */
3629         case 13: /* DomainModifiedInformation2 */
3630                 /* DOMAIN_READ_OTHER_PARAMETERS */
3631                 acc_required = SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2;
3632                 break;
3633         default:
3634                 return NT_STATUS_INVALID_INFO_CLASS;
3635         }
3636
3637         dinfo = policy_handle_find(p, r->in.domain_handle,
3638                                    acc_required, NULL,
3639                                    struct samr_domain_info, &status);
3640         if (!NT_STATUS_IS_OK(status)) {
3641                 return status;
3642         }
3643
3644         dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
3645         if (!dom_info) {
3646                 return NT_STATUS_NO_MEMORY;
3647         }
3648
3649         switch (r->in.level) {
3650                 case 1:
3651                         status = query_dom_info_1(p->mem_ctx, &dom_info->info1);
3652                         break;
3653                 case 2:
3654                         status = query_dom_info_2(p->mem_ctx, &dom_info->general, dinfo);
3655                         break;
3656                 case 3:
3657                         status = query_dom_info_3(p->mem_ctx, &dom_info->info3);
3658                         break;
3659                 case 4:
3660                         status = query_dom_info_4(p->mem_ctx, &dom_info->oem);
3661                         break;
3662                 case 5:
3663                         status = query_dom_info_5(p->mem_ctx, &dom_info->info5);
3664                         break;
3665                 case 6:
3666                         status = query_dom_info_6(p->mem_ctx, &dom_info->info6);
3667                         break;
3668                 case 7:
3669                         status = query_dom_info_7(p->mem_ctx, &dom_info->info7);
3670                         break;
3671                 case 8:
3672                         status = query_dom_info_8(p->mem_ctx, &dom_info->info8);
3673                         break;
3674                 case 9:
3675                         status = query_dom_info_9(p->mem_ctx, &dom_info->info9);
3676                         break;
3677                 case 11:
3678                         status = query_dom_info_11(p->mem_ctx, &dom_info->general2, dinfo);
3679                         break;
3680                 case 12:
3681                         status = query_dom_info_12(p->mem_ctx, &dom_info->info12);
3682                         break;
3683                 case 13:
3684                         status = query_dom_info_13(p->mem_ctx, &dom_info->info13);
3685                         break;
3686                 default:
3687                         return NT_STATUS_INVALID_INFO_CLASS;
3688         }
3689
3690         if (!NT_STATUS_IS_OK(status)) {
3691                 return status;
3692         }
3693
3694         *r->out.info = dom_info;
3695
3696         DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3697
3698         return status;
3699 }
3700
3701 /* W2k3 seems to use the same check for all 3 objects that can be created via
3702  * SAMR, if you try to create for example "Dialup" as an alias it says
3703  * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3704  * database. */
3705
3706 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
3707 {
3708         enum lsa_SidType type;
3709         bool result;
3710
3711         DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
3712
3713         become_root();
3714         /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3715          * whether the name already exists */
3716         result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
3717                              NULL, NULL, NULL, &type);
3718         unbecome_root();
3719
3720         if (!result) {
3721                 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3722                 return NT_STATUS_OK;
3723         }
3724
3725         DEBUG(5, ("trying to create %s, exists as %s\n",
3726                   new_name, sid_type_lookup(type)));
3727
3728         if (type == SID_NAME_DOM_GRP) {
3729                 return NT_STATUS_GROUP_EXISTS;
3730         }
3731         if (type == SID_NAME_ALIAS) {
3732                 return NT_STATUS_ALIAS_EXISTS;
3733         }
3734
3735         /* Yes, the default is NT_STATUS_USER_EXISTS */
3736         return NT_STATUS_USER_EXISTS;
3737 }
3738
3739 /*******************************************************************
3740  _samr_CreateUser2
3741  ********************************************************************/
3742
3743 NTSTATUS _samr_CreateUser2(pipes_struct *p,
3744                            struct samr_CreateUser2 *r)
3745 {
3746         const char *account = NULL;
3747         DOM_SID sid;
3748         uint32_t acb_info = r->in.acct_flags;
3749         struct samr_domain_info *dinfo;
3750         struct samr_user_info *uinfo;
3751         NTSTATUS nt_status;
3752         uint32 acc_granted;
3753         SEC_DESC *psd;
3754         size_t    sd_size;
3755         /* check this, when giving away 'add computer to domain' privs */
3756         uint32    des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3757         bool can_add_account = False;
3758         SE_PRIV se_rights;
3759
3760         dinfo = policy_handle_find(p, r->in.domain_handle,
3761                                    SAMR_DOMAIN_ACCESS_CREATE_USER, NULL,
3762                                    struct samr_domain_info, &nt_status);
3763         if (!NT_STATUS_IS_OK(nt_status)) {
3764                 return nt_status;
3765         }
3766
3767         if (sid_check_is_builtin(&dinfo->sid)) {
3768                 DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
3769                 return NT_STATUS_ACCESS_DENIED;
3770         }
3771
3772         if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3773               acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3774                 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3775                    this parameter is not an account type */
3776                 return NT_STATUS_INVALID_PARAMETER;
3777         }
3778
3779         account = r->in.account_name->string;
3780         if (account == NULL) {
3781                 return NT_STATUS_NO_MEMORY;
3782         }
3783
3784         nt_status = can_create(p->mem_ctx, account);
3785         if (!NT_STATUS_IS_OK(nt_status)) {
3786                 return nt_status;
3787         }
3788
3789         /* determine which user right we need to check based on the acb_info */
3790
3791         if (geteuid() == sec_initial_uid()) {
3792                 se_priv_copy(&se_rights, &se_priv_none);
3793                 can_add_account = true;
3794         } else if (acb_info & ACB_WSTRUST) {
3795                 se_priv_copy(&se_rights, &se_machine_account);
3796                 can_add_account = user_has_privileges(
3797                         p->server_info->ptok, &se_rights );
3798         } else if (acb_info & ACB_NORMAL &&
3799                   (account[strlen(account)-1] != '$')) {
3800                 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3801                    account for domain trusts and changes the ACB flags later */
3802                 se_priv_copy(&se_rights, &se_add_users);
3803                 can_add_account = user_has_privileges(
3804                         p->server_info->ptok, &se_rights );
3805         } else if (lp_enable_privileges()) {
3806                 /* implicit assumption of a BDC or domain trust account here
3807                  * (we already check the flags earlier) */
3808                 /* only Domain Admins can add a BDC or domain trust */
3809                 se_priv_copy(&se_rights, &se_priv_none);
3810                 can_add_account = nt_token_check_domain_rid(
3811                         p->server_info->ptok,
3812                         DOMAIN_GROUP_RID_ADMINS );
3813         }
3814
3815         DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3816                   uidtoname(p->server_info->utok.uid),
3817                   can_add_account ? "True":"False" ));
3818
3819         if (!can_add_account) {
3820                 return NT_STATUS_ACCESS_DENIED;
3821         }
3822
3823         /********** BEGIN Admin BLOCK **********/
3824
3825         become_root();
3826         nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3827                                     r->out.rid);
3828         unbecome_root();
3829
3830         /********** END Admin BLOCK **********/
3831
3832         /* now check for failure */
3833
3834         if ( !NT_STATUS_IS_OK(nt_status) )
3835                 return nt_status;
3836
3837         /* Get the user's SID */
3838
3839         sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3840
3841         map_max_allowed_access(p->server_info->ptok,
3842                                &p->server_info->utok,
3843                                &des_access);
3844
3845         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3846                             &sid, SAMR_USR_RIGHTS_WRITE_PW);
3847         se_map_generic(&des_access, &usr_generic_mapping);
3848
3849         /*
3850          * JRA - TESTME. We just created this user so we
3851          * had rights to create them. Do we need to check
3852          * any further access on this object ? Can't we
3853          * just assume we have all the rights we need ?
3854          */
3855
3856         nt_status = access_check_object(psd, p->server_info->ptok,
3857                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
3858                 &acc_granted, "_samr_CreateUser2");
3859
3860         if ( !NT_STATUS_IS_OK(nt_status) ) {
3861                 return nt_status;
3862         }
3863
3864         uinfo = policy_handle_create(p, r->out.user_handle, acc_granted,
3865                                      struct samr_user_info, &nt_status);
3866         if (!NT_STATUS_IS_OK(nt_status)) {
3867                 return nt_status;
3868         }
3869         uinfo->sid = sid;
3870
3871         /* After a "set" ensure we have no cached display info. */
3872         force_flush_samr_cache(&sid);
3873
3874         *r->out.access_granted = acc_granted;
3875
3876         return NT_STATUS_OK;
3877 }
3878
3879 /****************************************************************
3880 ****************************************************************/
3881
3882 NTSTATUS _samr_CreateUser(pipes_struct *p,
3883                           struct samr_CreateUser *r)
3884 {
3885         struct samr_CreateUser2 c;
3886         uint32_t access_granted;
3887
3888         c.in.domain_handle      = r->in.domain_handle;
3889         c.in.account_name       = r->in.account_name;
3890         c.in.acct_flags         = ACB_NORMAL;
3891         c.in.access_mask        = r->in.access_mask;
3892         c.out.user_handle       = r->out.user_handle;
3893         c.out.access_granted    = &access_granted;
3894         c.out.rid               = r->out.rid;
3895
3896         return _samr_CreateUser2(p, &c);
3897 }
3898
3899 /*******************************************************************
3900  _samr_Connect
3901  ********************************************************************/
3902
3903 NTSTATUS _samr_Connect(pipes_struct *p,
3904                        struct samr_Connect *r)
3905 {
3906         struct samr_connect_info *info;
3907         uint32_t acc_granted;
3908         struct policy_handle hnd;
3909         uint32    des_access = r->in.access_mask;
3910         NTSTATUS status;
3911
3912         /* Access check */
3913
3914         if (!pipe_access_check(p)) {
3915                 DEBUG(3, ("access denied to _samr_Connect\n"));
3916                 return NT_STATUS_ACCESS_DENIED;
3917         }
3918
3919         /* don't give away the farm but this is probably ok.  The SAMR_ACCESS_ENUM_DOMAINS
3920            was observed from a win98 client trying to enumerate users (when configured
3921            user level access control on shares)   --jerry */
3922
3923         map_max_allowed_access(p->server_info->ptok,
3924                                &p->server_info->utok,
3925                                &des_access);
3926
3927         se_map_generic( &des_access, &sam_generic_mapping );
3928
3929         acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS
3930                                     |SAMR_ACCESS_LOOKUP_DOMAIN);
3931
3932         /* set up the SAMR connect_anon response */
3933
3934         info = policy_handle_create(p, &hnd, acc_granted,
3935                                     struct samr_connect_info,
3936                                     &status);
3937         if (!NT_STATUS_IS_OK(status)) {
3938                 return status;
3939         }
3940
3941         *r->out.connect_handle = hnd;
3942         return NT_STATUS_OK;
3943 }
3944
3945 /*******************************************************************
3946  _samr_Connect2
3947  ********************************************************************/
3948
3949 NTSTATUS _samr_Connect2(pipes_struct *p,
3950                         struct samr_Connect2 *r)
3951 {
3952         struct samr_connect_info *info = NULL;
3953         struct policy_handle hnd;
3954         SEC_DESC *psd = NULL;
3955         uint32    acc_granted;
3956         uint32    des_access = r->in.access_mask;
3957         NTSTATUS  nt_status;
3958         size_t    sd_size;
3959         const char *fn = "_samr_Connect2";
3960
3961         switch (p->hdr_req.opnum) {
3962         case NDR_SAMR_CONNECT2:
3963                 fn = "_samr_Connect2";
3964                 break;
3965         case NDR_SAMR_CONNECT3:
3966                 fn = "_samr_Connect3";
3967                 break;
3968         case NDR_SAMR_CONNECT4:
3969                 fn = "_samr_Connect4";
3970                 break;
3971         case NDR_SAMR_CONNECT5:
3972                 fn = "_samr_Connect5";
3973                 break;
3974         }
3975
3976         DEBUG(5,("%s: %d\n", fn, __LINE__));
3977
3978         /* Access check */
3979
3980         if (!pipe_access_check(p)) {
3981                 DEBUG(3, ("access denied to %s\n", fn));
3982                 return NT_STATUS_ACCESS_DENIED;
3983         }
3984
3985         map_max_allowed_access(p->server_info->ptok,
3986                                &p->server_info->utok,
3987                                &des_access);
3988
3989         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3990         se_map_generic(&des_access, &sam_generic_mapping);
3991
3992         nt_status = access_check_object(psd, p->server_info->ptok,
3993                 NULL, 0, des_access, &acc_granted, fn);
3994
3995         if ( !NT_STATUS_IS_OK(nt_status) )
3996                 return nt_status;
3997
3998         info = policy_handle_create(p, &hnd, acc_granted,
3999                                     struct samr_connect_info, &nt_status);
4000         if (!NT_STATUS_IS_OK(nt_status)) {
4001                 return nt_status;
4002         }
4003
4004         DEBUG(5,("%s: %d\n", fn, __LINE__));
4005
4006         *r->out.connect_handle = hnd;
4007         return NT_STATUS_OK;
4008 }
4009
4010 /****************************************************************
4011  _samr_Connect3
4012 ****************************************************************/
4013
4014 NTSTATUS _samr_Connect3(pipes_struct *p,
4015                         struct samr_Connect3 *r)
4016 {
4017         struct samr_Connect2 c;
4018
4019         c.in.system_name        = r->in.system_name;
4020         c.in.access_mask        = r->in.access_mask;
4021         c.out.connect_handle    = r->out.connect_handle;
4022
4023         return _samr_Connect2(p, &c);
4024 }
4025
4026 /*******************************************************************
4027  _samr_Connect4
4028  ********************************************************************/
4029
4030 NTSTATUS _samr_Connect4(pipes_struct *p,
4031                         struct samr_Connect4 *r)
4032 {
4033         struct samr_Connect2 c;
4034
4035         c.in.system_name        = r->in.system_name;
4036         c.in.access_mask        = r->in.access_mask;
4037         c.out.connect_handle    = r->out.connect_handle;
4038
4039         return _samr_Connect2(p, &c);
4040 }
4041
4042 /*******************************************************************
4043  _samr_Connect5
4044  ********************************************************************/
4045
4046 NTSTATUS _samr_Connect5(pipes_struct *p,
4047                         struct samr_Connect5 *r)
4048 {
4049         NTSTATUS status;
4050         struct samr_Connect2 c;
4051         struct samr_ConnectInfo1 info1;
4052
4053         info1.client_version = SAMR_CONNECT_AFTER_W2K;
4054         info1.unknown2 = 0;
4055
4056         c.in.system_name        = r->in.system_name;
4057         c.in.access_mask        = r->in.access_mask;
4058         c.out.connect_handle    = r->out.connect_handle;
4059
4060         *r->out.level_out = 1;
4061
4062         status = _samr_Connect2(p, &c);
4063         if (!NT_STATUS_IS_OK(status)) {
4064                 return status;
4065         }
4066
4067         r->out.info_out->info1 = info1;
4068
4069         return NT_STATUS_OK;
4070 }
4071
4072 /**********************************************************************
4073  _samr_LookupDomain
4074  **********************************************************************/
4075
4076 NTSTATUS _samr_LookupDomain(pipes_struct *p,
4077                             struct samr_LookupDomain *r)
4078 {
4079         NTSTATUS status;
4080         struct samr_connect_info *info;
4081         const char *domain_name;
4082         DOM_SID *sid = NULL;
4083
4084         /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
4085            Reverted that change so we will work with RAS servers again */
4086
4087         info = policy_handle_find(p, r->in.connect_handle,
4088                                   SAMR_ACCESS_LOOKUP_DOMAIN, NULL,
4089                                   struct samr_connect_info,
4090                                   &status);
4091         if (!NT_STATUS_IS_OK(status)) {
4092                 return status;
4093         }
4094
4095         domain_name = r->in.domain_name->string;
4096         if (!domain_name) {
4097                 return NT_STATUS_INVALID_PARAMETER;
4098         }
4099
4100         sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
4101         if (!sid) {
4102                 return NT_STATUS_NO_MEMORY;
4103         }
4104
4105         if (strequal(domain_name, builtin_domain_name())) {
4106                 sid_copy(sid, &global_sid_Builtin);
4107         } else {
4108                 if (!secrets_fetch_domain_sid(domain_name, sid)) {
4109                         status = NT_STATUS_NO_SUCH_DOMAIN;
4110                 }
4111         }
4112
4113         DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
4114                  sid_string_dbg(sid)));
4115
4116         *r->out.sid = sid;
4117
4118         return status;
4119 }
4120
4121 /**********************************************************************
4122  _samr_EnumDomains
4123  **********************************************************************/
4124
4125 NTSTATUS _samr_EnumDomains(pipes_struct *p,
4126                            struct samr_EnumDomains *r)
4127 {
4128         NTSTATUS status;
4129         struct samr_connect_info *info;
4130         uint32_t num_entries = 2;
4131         struct samr_SamEntry *entry_array = NULL;
4132         struct samr_SamArray *sam;
4133
4134         info = policy_handle_find(p, r->in.connect_handle,
4135                                   SAMR_ACCESS_ENUM_DOMAINS, NULL,
4136                                   struct samr_connect_info, &status);
4137         if (!NT_STATUS_IS_OK(status)) {
4138                 return status;
4139         }
4140
4141         sam = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
4142         if (!sam) {
4143                 return NT_STATUS_NO_MEMORY;
4144         }
4145
4146         entry_array = TALLOC_ZERO_ARRAY(p->mem_ctx,
4147                                         struct samr_SamEntry,
4148                                         num_entries);
4149         if (!entry_array) {
4150                 return NT_STATUS_NO_MEMORY;
4151         }
4152
4153         entry_array[0].idx = 0;
4154         init_lsa_String(&entry_array[0].name, get_global_sam_name());
4155
4156         entry_array[1].idx = 1;
4157         init_lsa_String(&entry_array[1].name, "Builtin");
4158
4159         sam->count = num_entries;
4160         sam->entries = entry_array;
4161
4162         *r->out.sam = sam;
4163         *r->out.num_entries = num_entries;
4164
4165         return status;
4166 }
4167
4168 /*******************************************************************
4169  _samr_OpenAlias
4170  ********************************************************************/
4171
4172 NTSTATUS _samr_OpenAlias(pipes_struct *p,
4173                          struct samr_OpenAlias *r)
4174 {
4175         DOM_SID sid;
4176         uint32 alias_rid = r->in.rid;
4177         struct samr_alias_info *ainfo;
4178         struct samr_domain_info *dinfo;
4179         SEC_DESC *psd = NULL;
4180         uint32    acc_granted;
4181         uint32    des_access = r->in.access_mask;
4182         size_t    sd_size;
4183         NTSTATUS  status;
4184         SE_PRIV se_rights;
4185
4186         dinfo = policy_handle_find(p, r->in.domain_handle,
4187                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
4188                                    struct samr_domain_info, &status);
4189         if (!NT_STATUS_IS_OK(status)) {
4190                 return status;
4191         }
4192
4193         /* append the alias' RID to it */
4194
4195         if (!sid_compose(&sid, &dinfo->sid, alias_rid))
4196                 return NT_STATUS_NO_SUCH_ALIAS;
4197
4198         /*check if access can be granted as requested by client. */
4199
4200         map_max_allowed_access(p->server_info->ptok,
4201                                &p->server_info->utok,
4202                                &des_access);
4203
4204         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
4205         se_map_generic(&des_access,&ali_generic_mapping);
4206
4207         se_priv_copy( &se_rights, &se_add_users );
4208
4209         status = access_check_object(psd, p->server_info->ptok,
4210                 &se_rights, GENERIC_RIGHTS_ALIAS_ALL_ACCESS,
4211                 des_access, &acc_granted, "_samr_OpenAlias");
4212
4213         if ( !NT_STATUS_IS_OK(status) )
4214                 return status;
4215
4216         {
4217                 /* Check we actually have the requested alias */
4218                 enum lsa_SidType type;
4219                 bool result;
4220                 gid_t gid;
4221
4222                 become_root();
4223                 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
4224                 unbecome_root();
4225
4226                 if (!result || (type != SID_NAME_ALIAS)) {
4227                         return NT_STATUS_NO_SUCH_ALIAS;
4228                 }
4229
4230                 /* make sure there is a mapping */
4231
4232                 if ( !sid_to_gid( &sid, &gid ) ) {
4233                         return NT_STATUS_NO_SUCH_ALIAS;
4234                 }
4235
4236         }
4237
4238         ainfo = policy_handle_create(p, r->out.alias_handle, acc_granted,
4239                                      struct samr_alias_info, &status);
4240         if (!NT_STATUS_IS_OK(status)) {
4241                 return status;
4242         }
4243         ainfo->sid = sid;
4244
4245         return NT_STATUS_OK;
4246 }
4247
4248 /*******************************************************************
4249  set_user_info_2
4250  ********************************************************************/
4251
4252 static NTSTATUS set_user_info_2(TALLOC_CTX *mem_ctx,
4253                                 struct samr_UserInfo2 *id2,
4254                                 struct samu *pwd)
4255 {
4256         if (id2 == NULL) {
4257                 DEBUG(5,("set_user_info_2: NULL id2\n"));
4258                 return NT_STATUS_ACCESS_DENIED;
4259         }
4260
4261         copy_id2_to_sam_passwd(pwd, id2);
4262
4263         return pdb_update_sam_account(pwd);
4264 }
4265
4266 /*******************************************************************
4267  set_user_info_4
4268  ********************************************************************/
4269
4270 static NTSTATUS set_user_info_4(TALLOC_CTX *mem_ctx,
4271                                 struct samr_UserInfo4 *id4,
4272                                 struct samu *pwd)
4273 {
4274         if (id4 == NULL) {
4275                 DEBUG(5,("set_user_info_2: NULL id4\n"));
4276                 return NT_STATUS_ACCESS_DENIED;
4277         }
4278
4279         copy_id4_to_sam_passwd(pwd, id4);
4280
4281         return pdb_update_sam_account(pwd);
4282 }
4283
4284 /*******************************************************************
4285  set_user_info_6
4286  ********************************************************************/
4287
4288 static NTSTATUS set_user_info_6(TALLOC_CTX *mem_ctx,
4289                                 struct samr_UserInfo6 *id6,
4290                                 struct samu *pwd)
4291 {
4292         if (id6 == NULL) {
4293                 DEBUG(5,("set_user_info_6: NULL id6\n"));
4294                 return NT_STATUS_ACCESS_DENIED;
4295         }
4296
4297         copy_id6_to_sam_passwd(pwd, id6);
4298
4299         return pdb_update_sam_account(pwd);
4300 }
4301
4302 /*******************************************************************
4303  set_user_info_7
4304  ********************************************************************/
4305
4306 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
4307                                 struct samr_UserInfo7 *id7,
4308                                 struct samu *pwd)
4309 {
4310         NTSTATUS rc;
4311
4312         if (id7 == NULL) {
4313                 DEBUG(5, ("set_user_info_7: NULL id7\n"));
4314                 return NT_STATUS_ACCESS_DENIED;
4315         }
4316
4317         if (!id7->account_name.string) {
4318                 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
4319                 return NT_STATUS_ACCESS_DENIED;
4320         }
4321
4322         /* check to see if the new username already exists.  Note: we can't
4323            reliably lock all backends, so there is potentially the
4324            possibility that a user can be created in between this check and
4325            the rename.  The rename should fail, but may not get the
4326            exact same failure status code.  I think this is small enough
4327            of a window for this type of operation and the results are
4328            simply that the rename fails with a slightly different status
4329            code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4330
4331         rc = can_create(mem_ctx, id7->account_name.string);
4332
4333         /* when there is nothing to change, we're done here */
4334         if (NT_STATUS_EQUAL(rc, NT_STATUS_USER_EXISTS) &&
4335             strequal(id7->account_name.string, pdb_get_username(pwd))) {
4336                 return NT_STATUS_OK;
4337         }
4338         if (!NT_STATUS_IS_OK(rc)) {
4339                 return rc;
4340         }
4341
4342         rc = pdb_rename_sam_account(pwd, id7->account_name.string);
4343
4344         return rc;
4345 }
4346
4347 /*******************************************************************
4348  set_user_info_8
4349  ********************************************************************/
4350
4351 static NTSTATUS set_user_info_8(TALLOC_CTX *mem_ctx,
4352                                 struct samr_UserInfo8 *id8,
4353                                 struct samu *pwd)
4354 {
4355         if (id8 == NULL) {
4356                 DEBUG(5,("set_user_info_8: NULL id8\n"));
4357                 return NT_STATUS_ACCESS_DENIED;
4358         }
4359
4360         copy_id8_to_sam_passwd(pwd, id8);
4361
4362         return pdb_update_sam_account(pwd);
4363 }
4364
4365 /*******************************************************************
4366  set_user_info_10
4367  ********************************************************************/
4368
4369 static NTSTATUS set_user_info_10(TALLOC_CTX *mem_ctx,
4370                                  struct samr_UserInfo10 *id10,
4371                                  struct samu *pwd)
4372 {
4373         if (id10 == NULL) {
4374                 DEBUG(5,("set_user_info_8: NULL id10\n"));
4375                 return NT_STATUS_ACCESS_DENIED;
4376         }
4377
4378         copy_id10_to_sam_passwd(pwd, id10);
4379
4380         return pdb_update_sam_account(pwd);
4381 }
4382
4383 /*******************************************************************
4384  set_user_info_11
4385  ********************************************************************/
4386
4387 static NTSTATUS set_user_info_11(TALLOC_CTX *mem_ctx,
4388                                  struct samr_UserInfo11 *id11,
4389                                  struct samu *pwd)
4390 {
4391         if (id11 == NULL) {
4392                 DEBUG(5,("set_user_info_11: NULL id11\n"));
4393                 return NT_STATUS_ACCESS_DENIED;
4394         }
4395
4396         copy_id11_to_sam_passwd(pwd, id11);
4397
4398         return pdb_update_sam_account(pwd);
4399 }
4400
4401 /*******************************************************************
4402  set_user_info_12
4403  ********************************************************************/
4404
4405 static NTSTATUS set_user_info_12(TALLOC_CTX *mem_ctx,
4406                                  struct samr_UserInfo12 *id12,
4407                                  struct samu *pwd)
4408 {
4409         if (id12 == NULL) {
4410                 DEBUG(5,("set_user_info_12: NULL id12\n"));
4411                 return NT_STATUS_ACCESS_DENIED;
4412         }
4413
4414         copy_id12_to_sam_passwd(pwd, id12);
4415
4416         return pdb_update_sam_account(pwd);
4417 }
4418
4419 /*******************************************************************
4420  set_user_info_13
4421  ********************************************************************/
4422
4423 static NTSTATUS set_user_info_13(TALLOC_CTX *mem_ctx,
4424                                  struct samr_UserInfo13 *id13,
4425                                  struct samu *pwd)
4426 {
4427         if (id13 == NULL) {
4428                 DEBUG(5,("set_user_info_13: NULL id13\n"));
4429                 return NT_STATUS_ACCESS_DENIED;
4430         }
4431
4432         copy_id13_to_sam_passwd(pwd, id13);
4433
4434         return pdb_update_sam_account(pwd);
4435 }
4436
4437 /*******************************************************************
4438  set_user_info_14
4439  ********************************************************************/
4440
4441 static NTSTATUS set_user_info_14(TALLOC_CTX *mem_ctx,
4442                                  struct samr_UserInfo14 *id14,
4443                                  struct samu *pwd)
4444 {
4445         if (id14 == NULL) {
4446                 DEBUG(5,("set_user_info_14: NULL id14\n"));
4447                 return NT_STATUS_ACCESS_DENIED;
4448         }
4449
4450         copy_id14_to_sam_passwd(pwd, id14);
4451
4452         return pdb_update_sam_account(pwd);
4453 }
4454
4455 /*******************************************************************
4456  set_user_info_16
4457  ********************************************************************/
4458
4459 static NTSTATUS set_user_info_16(TALLOC_CTX *mem_ctx,
4460                                  struct samr_UserInfo16 *id16,
4461                                  struct samu *pwd)
4462 {
4463         if (id16 == NULL) {
4464                 DEBUG(5,("set_user_info_16: NULL id16\n"));
4465                 return NT_STATUS_ACCESS_DENIED;
4466         }
4467
4468         copy_id16_to_sam_passwd(pwd, id16);
4469
4470         return pdb_update_sam_account(pwd);
4471 }
4472
4473 /*******************************************************************
4474  set_user_info_17
4475  ********************************************************************/
4476
4477 static NTSTATUS set_user_info_17(TALLOC_CTX *mem_ctx,
4478                                  struct samr_UserInfo17 *id17,
4479                                  struct samu *pwd)
4480 {
4481         if (id17 == NULL) {
4482                 DEBUG(5,("set_user_info_17: NULL id17\n"));
4483                 return NT_STATUS_ACCESS_DENIED;
4484         }
4485
4486         copy_id17_to_sam_passwd(pwd, id17);
4487
4488         return pdb_update_sam_account(pwd);
4489 }
4490
4491 /*******************************************************************
4492  set_user_info_18
4493  ********************************************************************/
4494
4495 static NTSTATUS set_user_info_18(struct samr_UserInfo18 *id18,
4496                                  TALLOC_CTX *mem_ctx,
4497                                  DATA_BLOB *session_key,
4498                                  struct samu *pwd)
4499 {
4500         if (id18 == NULL) {
4501                 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
4502                 return NT_STATUS_INVALID_PARAMETER;
4503         }
4504
4505         if (id18->nt_pwd_active || id18->lm_pwd_active) {
4506                 if (!session_key->length) {
4507                         return NT_STATUS_NO_USER_SESSION_KEY;
4508                 }
4509         }
4510
4511         if (id18->nt_pwd_active) {
4512
4513                 DATA_BLOB in, out;
4514
4515                 in = data_blob_const(id18->nt_pwd.hash, 16);
4516                 out = data_blob_talloc_zero(mem_ctx, 16);
4517
4518                 sess_crypt_blob(&out, &in, session_key, false);
4519
4520                 if (!pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED)) {
4521                         return NT_STATUS_ACCESS_DENIED;
4522                 }
4523
4524                 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4525         }
4526
4527         if (id18->lm_pwd_active) {
4528
4529                 DATA_BLOB in, out;
4530
4531                 in = data_blob_const(id18->lm_pwd.hash, 16);
4532                 out = data_blob_talloc_zero(mem_ctx, 16);
4533
4534                 sess_crypt_blob(&out, &in, session_key, false);
4535
4536                 if (!pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED)) {
4537                         return NT_STATUS_ACCESS_DENIED;
4538                 }
4539
4540                 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4541         }
4542
4543         copy_id18_to_sam_passwd(pwd, id18);
4544
4545         return pdb_update_sam_account(pwd);
4546 }
4547
4548 /*******************************************************************
4549  set_user_info_20
4550  ********************************************************************/
4551
4552 static NTSTATUS set_user_info_20(TALLOC_CTX *mem_ctx,
4553                                  struct samr_UserInfo20 *id20,
4554                                  struct samu *pwd)
4555 {
4556         if (id20 == NULL) {
4557                 DEBUG(5,("set_user_info_20: NULL id20\n"));
4558                 return NT_STATUS_ACCESS_DENIED;
4559         }
4560
4561         copy_id20_to_sam_passwd(pwd, id20);
4562
4563         return pdb_update_sam_account(pwd);
4564 }
4565
4566 /*******************************************************************
4567  set_user_info_21
4568  ********************************************************************/
4569
4570 static NTSTATUS set_user_info_21(struct samr_UserInfo21 *id21,
4571                                  TALLOC_CTX *mem_ctx,
4572                                  DATA_BLOB *session_key,
4573                                  struct samu *pwd)
4574 {
4575         NTSTATUS status;
4576
4577         if (id21 == NULL) {
4578                 DEBUG(5, ("set_user_info_21: NULL id21\n"));
4579                 return NT_STATUS_INVALID_PARAMETER;
4580         }
4581
4582         if (id21->fields_present == 0) {
4583                 return NT_STATUS_INVALID_PARAMETER;
4584         }
4585
4586         if (id21->fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4587                 return NT_STATUS_ACCESS_DENIED;
4588         }
4589
4590         if (id21->fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
4591                 if (id21->nt_password_set) {
4592                         DATA_BLOB in, out;
4593
4594                         if ((id21->nt_owf_password.length != 16) ||
4595                             (id21->nt_owf_password.size != 16)) {
4596                                 return NT_STATUS_INVALID_PARAMETER;
4597                         }
4598
4599                         if (!session_key->length) {
4600                                 return NT_STATUS_NO_USER_SESSION_KEY;
4601                         }
4602
4603                         in = data_blob_const(id21->nt_owf_password.array, 16);
4604                         out = data_blob_talloc_zero(mem_ctx, 16);
4605
4606                         sess_crypt_blob(&out, &in, session_key, false);
4607
4608                         pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED);
4609                         pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4610                 }
4611         }
4612
4613         if (id21->fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
4614                 if (id21->lm_password_set) {
4615                         DATA_BLOB in, out;
4616
4617                         if ((id21->lm_owf_password.length != 16) ||
4618                             (id21->lm_owf_password.size != 16)) {
4619                                 return NT_STATUS_INVALID_PARAMETER;
4620                         }
4621
4622                         if (!session_key->length) {
4623                                 return NT_STATUS_NO_USER_SESSION_KEY;
4624                         }
4625
4626                         in = data_blob_const(id21->lm_owf_password.array, 16);
4627                         out = data_blob_talloc_zero(mem_ctx, 16);
4628
4629                         sess_crypt_blob(&out, &in, session_key, false);
4630
4631                         pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED);
4632                         pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
4633                 }
4634         }
4635
4636         /* we need to separately check for an account rename first */
4637
4638         if (id21->account_name.string &&
4639             (!strequal(id21->account_name.string, pdb_get_username(pwd))))
4640         {
4641
4642                 /* check to see if the new username already exists.  Note: we can't
4643                    reliably lock all backends, so there is potentially the
4644                    possibility that a user can be created in between this check and
4645                    the rename.  The rename should fail, but may not get the
4646                    exact same failure status code.  I think this is small enough
4647                    of a window for this type of operation and the results are
4648                    simply that the rename fails with a slightly different status
4649                    code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4650
4651                 status = can_create(mem_ctx, id21->account_name.string);
4652                 if (!NT_STATUS_IS_OK(status)) {
4653                         return status;
4654                 }
4655
4656                 status = pdb_rename_sam_account(pwd, id21->account_name.string);
4657
4658                 if (!NT_STATUS_IS_OK(status)) {
4659                         DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
4660                                 nt_errstr(status)));
4661                         return status;
4662                 }
4663
4664                 /* set the new username so that later
4665                    functions can work on the new account */
4666                 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
4667         }
4668
4669         copy_id21_to_sam_passwd("INFO_21", pwd, id21);
4670
4671         /*
4672          * The funny part about the previous two calls is
4673          * that pwd still has the password hashes from the
4674          * passdb entry.  These have not been updated from
4675          * id21.  I don't know if they need to be set.    --jerry
4676          */
4677
4678         if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4679                 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4680                 if ( !NT_STATUS_IS_OK(status) ) {
4681                         return status;
4682                 }
4683         }
4684
4685         /* Don't worry about writing out the user account since the
4686            primary group SID is generated solely from the user's Unix
4687            primary group. */
4688
4689         /* write the change out */
4690         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4691                 return status;
4692         }
4693
4694         return NT_STATUS_OK;
4695 }
4696
4697 /*******************************************************************
4698  set_user_info_23
4699  ********************************************************************/
4700
4701 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
4702                                  struct samr_UserInfo23 *id23,
4703                                  struct samu *pwd)
4704 {
4705         char *plaintext_buf = NULL;
4706         size_t len = 0;
4707         uint32_t acct_ctrl;
4708         NTSTATUS status;
4709
4710         if (id23 == NULL) {
4711                 DEBUG(5, ("set_user_info_23: NULL id23\n"));
4712                 return NT_STATUS_INVALID_PARAMETER;
4713         }
4714
4715         if (id23->info.fields_present == 0) {
4716                 return NT_STATUS_INVALID_PARAMETER;
4717         }
4718
4719         if (id23->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4720                 return NT_STATUS_ACCESS_DENIED;
4721         }
4722
4723         if ((id23->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4724             (id23->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4725
4726                 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
4727                           pdb_get_username(pwd)));
4728
4729                 if (!decode_pw_buffer(mem_ctx,
4730                                       id23->password.data,
4731                                       &plaintext_buf,
4732                                       &len,
4733                                       CH_UTF16)) {
4734                         return NT_STATUS_WRONG_PASSWORD;
4735                 }
4736
4737                 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
4738                         return NT_STATUS_ACCESS_DENIED;
4739                 }
4740         }
4741
4742         copy_id23_to_sam_passwd(pwd, id23);
4743
4744         acct_ctrl = pdb_get_acct_ctrl(pwd);
4745
4746         /* if it's a trust account, don't update /etc/passwd */
4747         if (    ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
4748                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
4749                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
4750                 DEBUG(5, ("Changing trust account.  Not updating /etc/passwd\n"));
4751         } else if (plaintext_buf) {
4752                 /* update the UNIX password */
4753                 if (lp_unix_password_sync() ) {
4754                         struct passwd *passwd;
4755                         if (pdb_get_username(pwd) == NULL) {
4756                                 DEBUG(1, ("chgpasswd: User without name???\n"));
4757                                 return NT_STATUS_ACCESS_DENIED;
4758                         }
4759
4760                         passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
4761                         if (passwd == NULL) {
4762                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4763                         }
4764
4765                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
4766                                 return NT_STATUS_ACCESS_DENIED;
4767                         }
4768                         TALLOC_FREE(passwd);
4769                 }
4770         }
4771
4772         if (plaintext_buf) {
4773                 memset(plaintext_buf, '\0', strlen(plaintext_buf));
4774         }
4775
4776         if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
4777             (!NT_STATUS_IS_OK(status =  pdb_set_unix_primary_group(mem_ctx,
4778                                                                    pwd)))) {
4779                 return status;
4780         }
4781
4782         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4783                 return status;
4784         }
4785
4786         return NT_STATUS_OK;
4787 }
4788
4789 /*******************************************************************
4790  set_user_info_pw
4791  ********************************************************************/
4792
4793 static bool set_user_info_pw(uint8 *pass, struct samu *pwd)
4794 {
4795         size_t len = 0;
4796         char *plaintext_buf = NULL;
4797         uint32 acct_ctrl;
4798
4799         DEBUG(5, ("Attempting administrator password change for user %s\n",
4800                   pdb_get_username(pwd)));
4801
4802         acct_ctrl = pdb_get_acct_ctrl(pwd);
4803
4804         if (!decode_pw_buffer(talloc_tos(),
4805                                 pass,
4806                                 &plaintext_buf,
4807                                 &len,
4808                                 CH_UTF16)) {
4809                 return False;
4810         }
4811
4812         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
4813                 return False;
4814         }
4815
4816         /* if it's a trust account, don't update /etc/passwd */
4817         if ( ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
4818                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
4819                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
4820                 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
4821         } else {
4822                 /* update the UNIX password */
4823                 if (lp_unix_password_sync()) {
4824                         struct passwd *passwd;
4825
4826                         if (pdb_get_username(pwd) == NULL) {
4827                                 DEBUG(1, ("chgpasswd: User without name???\n"));
4828                                 return False;
4829                         }
4830
4831                         passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
4832                         if (passwd == NULL) {
4833                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4834                         }
4835
4836                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
4837                                 return False;
4838                         }
4839                         TALLOC_FREE(passwd);
4840                 }
4841         }
4842
4843         memset(plaintext_buf, '\0', strlen(plaintext_buf));
4844
4845         DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4846
4847         return True;
4848 }
4849
4850 /*******************************************************************
4851  set_user_info_24
4852  ********************************************************************/
4853
4854 static NTSTATUS set_user_info_24(TALLOC_CTX *mem_ctx,
4855                                  struct samr_UserInfo24 *id24,
4856                                  struct samu *pwd)
4857 {
4858         NTSTATUS status;
4859
4860         if (id24 == NULL) {
4861                 DEBUG(5, ("set_user_info_24: NULL id24\n"));
4862                 return NT_STATUS_INVALID_PARAMETER;
4863         }
4864
4865         if (!set_user_info_pw(id24->password.data, pwd)) {
4866                 return NT_STATUS_WRONG_PASSWORD;
4867         }
4868
4869         copy_id24_to_sam_passwd(pwd, id24);
4870
4871         status = pdb_update_sam_account(pwd);
4872         if (!NT_STATUS_IS_OK(status)) {
4873                 return status;
4874         }
4875
4876         return NT_STATUS_OK;
4877 }
4878
4879 /*******************************************************************
4880  set_user_info_25
4881  ********************************************************************/
4882
4883 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
4884                                  struct samr_UserInfo25 *id25,
4885                                  struct samu *pwd)
4886 {
4887         NTSTATUS status;
4888
4889         if (id25 == NULL) {
4890                 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4891                 return NT_STATUS_INVALID_PARAMETER;
4892         }
4893
4894         if (id25->info.fields_present == 0) {
4895                 return NT_STATUS_INVALID_PARAMETER;
4896         }
4897
4898         if (id25->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4899                 return NT_STATUS_ACCESS_DENIED;
4900         }
4901
4902         if ((id25->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4903             (id25->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4904
4905                 if (!set_user_info_pw(id25->password.data, pwd)) {
4906                         return NT_STATUS_WRONG_PASSWORD;
4907                 }
4908         }
4909
4910         copy_id25_to_sam_passwd(pwd, id25);
4911
4912         /* write the change out */
4913         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4914                 return status;
4915         }
4916
4917         /*
4918          * We need to "pdb_update_sam_account" before the unix primary group
4919          * is set, because the idealx scripts would also change the
4920          * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4921          * the delete explicit / add explicit, which would then fail to find
4922          * the previous primaryGroupSid value.
4923          */
4924
4925         if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4926                 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4927                 if ( !NT_STATUS_IS_OK(status) ) {
4928                         return status;
4929                 }
4930         }
4931
4932         return NT_STATUS_OK;
4933 }
4934
4935 /*******************************************************************
4936  set_user_info_26
4937  ********************************************************************/
4938
4939 static NTSTATUS set_user_info_26(TALLOC_CTX *mem_ctx,
4940                                  struct samr_UserInfo26 *id26,
4941                                  struct samu *pwd)
4942 {
4943         NTSTATUS status;
4944
4945         if (id26 == NULL) {
4946                 DEBUG(5, ("set_user_info_26: NULL id26\n"));
4947                 return NT_STATUS_INVALID_PARAMETER;
4948         }
4949
4950         if (!set_user_info_pw(id26->password.data, pwd)) {
4951                 return NT_STATUS_WRONG_PASSWORD;
4952         }
4953
4954         copy_id26_to_sam_passwd(pwd, id26);
4955
4956         status = pdb_update_sam_account(pwd);
4957         if (!NT_STATUS_IS_OK(status)) {
4958                 return status;
4959         }
4960
4961         return NT_STATUS_OK;
4962 }
4963
4964 /*************************************************************
4965 **************************************************************/
4966
4967 static uint32_t samr_set_user_info_map_fields_to_access_mask(uint32_t fields)
4968 {
4969         uint32_t acc_required = 0;
4970
4971         /* USER_ALL_USERNAME */
4972         if (fields & SAMR_FIELD_ACCOUNT_NAME)
4973                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4974         /* USER_ALL_FULLNAME */
4975         if (fields & SAMR_FIELD_FULL_NAME)
4976                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4977         /* USER_ALL_PRIMARYGROUPID */
4978         if (fields & SAMR_FIELD_PRIMARY_GID)
4979                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4980         /* USER_ALL_HOMEDIRECTORY */
4981         if (fields & SAMR_FIELD_HOME_DIRECTORY)
4982                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4983         /* USER_ALL_HOMEDIRECTORYDRIVE */
4984         if (fields & SAMR_FIELD_HOME_DRIVE)
4985                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4986         /* USER_ALL_SCRIPTPATH */
4987         if (fields & SAMR_FIELD_LOGON_SCRIPT)
4988                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4989         /* USER_ALL_PROFILEPATH */
4990         if (fields & SAMR_FIELD_PROFILE_PATH)
4991                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4992         /* USER_ALL_ADMINCOMMENT */
4993         if (fields & SAMR_FIELD_COMMENT)
4994                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4995         /* USER_ALL_WORKSTATIONS */
4996         if (fields & SAMR_FIELD_WORKSTATIONS)
4997                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
4998         /* USER_ALL_LOGONHOURS */
4999         if (fields & SAMR_FIELD_LOGON_HOURS)
5000                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
5001         /* USER_ALL_ACCOUNTEXPIRES */
5002         if (fields & SAMR_FIELD_ACCT_EXPIRY)
5003                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
5004         /* USER_ALL_USERACCOUNTCONTROL */
5005         if (fields & SAMR_FIELD_ACCT_FLAGS)
5006                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
5007         /* USER_ALL_PARAMETERS */
5008         if (fields & SAMR_FIELD_PARAMETERS)
5009                 acc_required |= SAMR_USER_ACCESS_SET_ATTRIBUTES;
5010         /* USER_ALL_USERCOMMENT */
5011         if (fields & SAMR_FIELD_COMMENT)
5012                 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
5013         /* USER_ALL_COUNTRYCODE */
5014         if (fields & SAMR_FIELD_COUNTRY_CODE)
5015                 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
5016         /* USER_ALL_CODEPAGE */
5017         if (fields & SAMR_FIELD_CODE_PAGE)
5018                 acc_required |= SAMR_USER_ACCESS_SET_LOC_COM;
5019         /* USER_ALL_NTPASSWORDPRESENT */
5020         if (fields & SAMR_FIELD_NT_PASSWORD_PRESENT)
5021                 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
5022         /* USER_ALL_LMPASSWORDPRESENT */
5023         if (fields & SAMR_FIELD_LM_PASSWORD_PRESENT)
5024                 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
5025         /* USER_ALL_PASSWORDEXPIRED */
5026         if (fields & SAMR_FIELD_EXPIRED_FLAG)
5027                 acc_required |= SAMR_USER_ACCESS_SET_PASSWORD;
5028
5029         return acc_required;
5030 }
5031
5032 /*******************************************************************
5033  samr_SetUserInfo
5034  ********************************************************************/
5035
5036 NTSTATUS _samr_SetUserInfo(pipes_struct *p,
5037                            struct samr_SetUserInfo *r)
5038 {
5039         struct samr_user_info *uinfo;
5040         NTSTATUS status;
5041         struct samu *pwd = NULL;
5042         union samr_UserInfo *info = r->in.info;
5043         uint32_t acc_required = 0;
5044         uint32_t fields = 0;
5045         bool ret;
5046
5047         DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
5048
5049         /* This is tricky.  A WinXP domain join sets
5050           (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
5051           The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser().  But the
5052           standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
5053           This should be enough for levels 18, 24, 25,& 26.  Info level 23 can set more so
5054           we'll use the set from the WinXP join as the basis. */
5055
5056         switch (r->in.level) {
5057         case 2: /* UserPreferencesInformation */
5058                 /* USER_WRITE_ACCOUNT | USER_WRITE_PREFERENCES */
5059                 acc_required = SAMR_USER_ACCESS_SET_ATTRIBUTES | SAMR_USER_ACCESS_SET_LOC_COM;
5060                 break;
5061         case 4: /* UserLogonHoursInformation */
5062         case 6: /* UserNameInformation */
5063         case 7: /* UserAccountNameInformation */
5064         case 8: /* UserFullNameInformation */
5065         case 9: /* UserPrimaryGroupInformation */
5066         case 10: /* UserHomeInformation */
5067         case 11: /* UserScriptInformation */
5068         case 12: /* UserProfileInformation */
5069         case 13: /* UserAdminCommentInformation */
5070         case 14: /* UserWorkStationsInformation */
5071         case 16: /* UserControlInformation */
5072         case 17: /* UserExpiresInformation */
5073         case 20: /* UserParametersInformation */
5074                 /* USER_WRITE_ACCOUNT */
5075                 acc_required = SAMR_USER_ACCESS_SET_ATTRIBUTES;
5076                 break;
5077         case 18: /* UserInternal1Information */
5078                 /* FIXME: gd, this is a guess */
5079                 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
5080                 break;
5081         case 21: /* UserAllInformation */
5082                 fields = info->info21.fields_present;
5083                 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
5084                 break;
5085         case 23: /* UserInternal4Information */
5086                 fields = info->info23.info.fields_present;
5087                 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
5088                 break;
5089         case 25: /* UserInternal4InformationNew */
5090                 fields = info->info25.info.fields_present;
5091                 acc_required = samr_set_user_info_map_fields_to_access_mask(fields);
5092                 break;
5093         case 24: /* UserInternal5Information */
5094         case 26: /* UserInternal5InformationNew */
5095                 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
5096                 break;
5097         default:
5098                 return NT_STATUS_INVALID_INFO_CLASS;
5099         }
5100
5101         uinfo = policy_handle_find(p, r->in.user_handle, acc_required, NULL,
5102                                    struct samr_user_info, &status);
5103         if (!NT_STATUS_IS_OK(status)) {
5104                 return status;
5105         }
5106
5107         DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
5108                   sid_string_dbg(&uinfo->sid), r->in.level));
5109
5110         if (info == NULL) {
5111                 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
5112                 return NT_STATUS_INVALID_INFO_CLASS;
5113         }
5114
5115         if (!(pwd = samu_new(NULL))) {
5116                 return NT_STATUS_NO_MEMORY;
5117         }
5118
5119         become_root();
5120         ret = pdb_getsampwsid(pwd, &uinfo->sid);
5121         unbecome_root();
5122
5123         if (!ret) {
5124                 TALLOC_FREE(pwd);
5125                 return NT_STATUS_NO_SUCH_USER;
5126         }
5127
5128         /* ================ BEGIN Privilege BLOCK ================ */
5129
5130         become_root();
5131
5132         /* ok!  user info levels (lots: see MSDEV help), off we go... */
5133
5134         switch (r->in.level) {
5135
5136                 case 2:
5137                         status = set_user_info_2(p->mem_ctx,
5138                                                  &info->info2, pwd);
5139                         break;
5140
5141                 case 4:
5142                         status = set_user_info_4(p->mem_ctx,
5143                                                  &info->info4, pwd);
5144                         break;
5145
5146                 case 6:
5147                         status = set_user_info_6(p->mem_ctx,
5148                                                  &info->info6, pwd);
5149                         break;
5150
5151                 case 7:
5152                         status = set_user_info_7(p->mem_ctx,
5153                                                  &info->info7, pwd);
5154                         break;
5155
5156                 case 8:
5157                         status = set_user_info_8(p->mem_ctx,
5158                                                  &info->info8, pwd);
5159                         break;
5160
5161                 case 10:
5162                         status = set_user_info_10(p->mem_ctx,
5163                                                   &info->info10, pwd);
5164                         break;
5165
5166                 case 11:
5167                         status = set_user_info_11(p->mem_ctx,
5168                                                   &info->info11, pwd);
5169                         break;
5170
5171                 case 12:
5172                         status = set_user_info_12(p->mem_ctx,
5173                                                   &info->info12, pwd);
5174                         break;
5175
5176                 case 13:
5177                         status = set_user_info_13(p->mem_ctx,
5178                                                   &info->info13, pwd);
5179                         break;
5180
5181                 case 14:
5182                         status = set_user_info_14(p->mem_ctx,
5183                                                   &info->info14, pwd);
5184                         break;
5185
5186                 case 16:
5187                         status = set_user_info_16(p->mem_ctx,
5188                                                   &info->info16, pwd);
5189                         break;
5190
5191                 case 17:
5192                         status = set_user_info_17(p->mem_ctx,
5193                                                   &info->info17, pwd);
5194                         break;
5195
5196                 case 18:
5197                         /* Used by AS/U JRA. */
5198                         status = set_user_info_18(&info->info18,
5199                                                   p->mem_ctx,
5200                                                   &p->server_info->user_session_key,
5201                                                   pwd);
5202                         break;
5203
5204                 case 20:
5205                         status = set_user_info_20(p->mem_ctx,
5206                                                   &info->info20, pwd);
5207                         break;
5208
5209                 case 21:
5210                         status = set_user_info_21(&info->info21,
5211                                                   p->mem_ctx,
5212                                                   &p->server_info->user_session_key,
5213                                                   pwd);
5214                         break;
5215
5216                 case 23:
5217                         if (!p->server_info->user_session_key.length) {
5218                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5219                         }
5220                         arcfour_crypt_blob(info->info23.password.data, 516,
5221                                            &p->server_info->user_session_key);
5222
5223                         dump_data(100, info->info23.password.data, 516);
5224
5225                         status = set_user_info_23(p->mem_ctx,
5226                                                   &info->info23, pwd);
5227                         break;
5228
5229                 case 24:
5230                         if (!p->server_info->user_session_key.length) {
5231                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5232                         }
5233                         arcfour_crypt_blob(info->info24.password.data,
5234                                            516,
5235                                            &p->server_info->user_session_key);
5236
5237                         dump_data(100, info->info24.password.data, 516);
5238
5239                         status = set_user_info_24(p->mem_ctx,
5240                                                   &info->info24, pwd);
5241                         break;
5242
5243                 case 25:
5244                         if (!p->server_info->user_session_key.length) {
5245                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5246                         }
5247                         encode_or_decode_arc4_passwd_buffer(
5248                                 info->info25.password.data,
5249                                 &p->server_info->user_session_key);
5250
5251                         dump_data(100, info->info25.password.data, 532);
5252
5253                         status = set_user_info_25(p->mem_ctx,
5254                                                   &info->info25, pwd);
5255                         break;
5256
5257                 case 26:
5258                         if (!p->server_info->user_session_key.length) {
5259                                 status = NT_STATUS_NO_USER_SESSION_KEY;
5260                         }
5261                         encode_or_decode_arc4_passwd_buffer(
5262                                 info->info26.password.data,
5263                                 &p->server_info->user_session_key);
5264
5265                         dump_data(100, info->info26.password.data, 516);
5266
5267                         status = set_user_info_26(p->mem_ctx,
5268                                                   &info->info26, pwd);
5269                         break;
5270
5271                 default:
5272                         status = NT_STATUS_INVALID_INFO_CLASS;
5273         }
5274
5275         TALLOC_FREE(pwd);
5276
5277         unbecome_root();
5278
5279         /* ================ END Privilege BLOCK ================ */
5280
5281         if (NT_STATUS_IS_OK(status)) {
5282                 force_flush_samr_cache(&uinfo->sid);
5283         }
5284
5285         return status;
5286 }
5287
5288 /*******************************************************************
5289  _samr_SetUserInfo2
5290  ********************************************************************/
5291
5292 NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
5293                             struct samr_SetUserInfo2 *r)
5294 {
5295         struct samr_SetUserInfo q;
5296
5297         q.in.user_handle        = r->in.user_handle;
5298         q.in.level              = r->in.level;
5299         q.in.info               = r->in.info;
5300
5301         return _samr_SetUserInfo(p, &q);
5302 }
5303
5304 /*********************************************************************
5305  _samr_GetAliasMembership
5306 *********************************************************************/
5307
5308 NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
5309                                   struct samr_GetAliasMembership *r)
5310 {
5311         size_t num_alias_rids;
5312         uint32 *alias_rids;
5313         struct samr_domain_info *dinfo;
5314         size_t i;
5315
5316         NTSTATUS status;
5317
5318         DOM_SID *members;
5319
5320         DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
5321
5322         dinfo = policy_handle_find(p, r->in.domain_handle,
5323                                    SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
5324                                    | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
5325                                    struct samr_domain_info, &status);
5326         if (!NT_STATUS_IS_OK(status)) {
5327                 return status;
5328         }
5329
5330         if (!sid_check_is_domain(&dinfo->sid) &&
5331             !sid_check_is_builtin(&dinfo->sid))
5332                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
5333
5334         if (r->in.sids->num_sids) {
5335                 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, r->in.sids->num_sids);
5336
5337                 if (members == NULL)
5338                         return NT_STATUS_NO_MEMORY;
5339         } else {
5340                 members = NULL;
5341         }
5342
5343         for (i=0; i<r->in.sids->num_sids; i++)
5344                 sid_copy(&members[i], r->in.sids->sids[i].sid);
5345
5346         alias_rids = NULL;
5347         num_alias_rids = 0;
5348
5349         become_root();
5350         status = pdb_enum_alias_memberships(p->mem_ctx, &dinfo->sid, members,
5351                                             r->in.sids->num_sids,
5352                                             &alias_rids, &num_alias_rids);
5353         unbecome_root();
5354
5355         if (!NT_STATUS_IS_OK(status)) {
5356                 return status;
5357         }
5358
5359         r->out.rids->count = num_alias_rids;
5360         r->out.rids->ids = alias_rids;
5361
5362         return NT_STATUS_OK;
5363 }
5364
5365 /*********************************************************************
5366  _samr_GetMembersInAlias
5367 *********************************************************************/
5368
5369 NTSTATUS _samr_GetMembersInAlias(pipes_struct *p,
5370                                  struct samr_GetMembersInAlias *r)
5371 {
5372         struct samr_alias_info *ainfo;
5373         NTSTATUS status;
5374         size_t i;
5375         size_t num_sids = 0;
5376         struct lsa_SidPtr *sids = NULL;
5377         DOM_SID *pdb_sids = NULL;
5378
5379         ainfo = policy_handle_find(p, r->in.alias_handle,
5380                                    SAMR_ALIAS_ACCESS_GET_MEMBERS, NULL,
5381                                    struct samr_alias_info, &status);
5382         if (!NT_STATUS_IS_OK(status)) {
5383                 return status;
5384         }
5385
5386         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5387
5388         become_root();
5389         status = pdb_enum_aliasmem(&ainfo->sid, talloc_tos(), &pdb_sids,
5390                                    &num_sids);
5391         unbecome_root();
5392
5393         if (!NT_STATUS_IS_OK(status)) {
5394                 return status;
5395         }
5396
5397         if (num_sids) {
5398                 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr, num_sids);
5399                 if (sids == NULL) {
5400                         TALLOC_FREE(pdb_sids);
5401                         return NT_STATUS_NO_MEMORY;
5402                 }
5403         }
5404
5405         for (i = 0; i < num_sids; i++) {
5406                 sids[i].sid = sid_dup_talloc(p->mem_ctx, &pdb_sids[i]);
5407                 if (!sids[i].sid) {
5408                         TALLOC_FREE(pdb_sids);
5409                         return NT_STATUS_NO_MEMORY;
5410                 }
5411         }
5412
5413         r->out.sids->num_sids = num_sids;
5414         r->out.sids->sids = sids;
5415
5416         TALLOC_FREE(pdb_sids);
5417
5418         return NT_STATUS_OK;
5419 }
5420
5421 /*********************************************************************
5422  _samr_QueryGroupMember
5423 *********************************************************************/
5424
5425 NTSTATUS _samr_QueryGroupMember(pipes_struct *p,
5426                                 struct samr_QueryGroupMember *r)
5427 {
5428         struct samr_group_info *ginfo;
5429         size_t i, num_members;
5430
5431         uint32 *rid=NULL;
5432         uint32 *attr=NULL;
5433
5434         NTSTATUS status;
5435         struct samr_RidTypeArray *rids = NULL;
5436
5437         ginfo = policy_handle_find(p, r->in.group_handle,
5438                                    SAMR_GROUP_ACCESS_GET_MEMBERS, NULL,
5439                                    struct samr_group_info, &status);
5440         if (!NT_STATUS_IS_OK(status)) {
5441                 return status;
5442         }
5443
5444         rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidTypeArray);
5445         if (!rids) {
5446                 return NT_STATUS_NO_MEMORY;
5447         }
5448
5449         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5450
5451         if (!sid_check_is_in_our_domain(&ginfo->sid)) {
5452                 DEBUG(3, ("sid %s is not in our domain\n",
5453                           sid_string_dbg(&ginfo->sid)));
5454                 return NT_STATUS_NO_SUCH_GROUP;
5455         }
5456
5457         DEBUG(10, ("lookup on Domain SID\n"));
5458
5459         become_root();
5460         status = pdb_enum_group_members(p->mem_ctx, &ginfo->sid,
5461                                         &rid, &num_members);
5462         unbecome_root();
5463
5464         if (!NT_STATUS_IS_OK(status))
5465                 return status;
5466
5467         if (num_members) {
5468                 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
5469                 if (attr == NULL) {
5470                         return NT_STATUS_NO_MEMORY;
5471                 }
5472         } else {
5473                 attr = NULL;
5474         }
5475
5476         for (i=0; i<num_members; i++)
5477                 attr[i] = SID_NAME_USER;
5478
5479         rids->count = num_members;
5480         rids->types = attr;
5481         rids->rids = rid;
5482
5483         *r->out.rids = rids;
5484
5485         return NT_STATUS_OK;
5486 }
5487
5488 /*********************************************************************
5489  _samr_AddAliasMember
5490 *********************************************************************/
5491
5492 NTSTATUS _samr_AddAliasMember(pipes_struct *p,
5493                               struct samr_AddAliasMember *r)
5494 {
5495         struct samr_alias_info *ainfo;
5496         NTSTATUS status;
5497
5498         ainfo = policy_handle_find(p, r->in.alias_handle,
5499                                    SAMR_ALIAS_ACCESS_ADD_MEMBER, NULL,
5500                                    struct samr_alias_info, &status);
5501         if (!NT_STATUS_IS_OK(status)) {
5502                 return status;
5503         }
5504
5505         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5506
5507         /******** BEGIN SeAddUsers BLOCK *********/
5508
5509         become_root();
5510         status = pdb_add_aliasmem(&ainfo->sid, r->in.sid);
5511         unbecome_root();
5512
5513         /******** END SeAddUsers BLOCK *********/
5514
5515         if (NT_STATUS_IS_OK(status)) {
5516                 force_flush_samr_cache(&ainfo->sid);
5517         }
5518
5519         return status;
5520 }
5521
5522 /*********************************************************************
5523  _samr_DeleteAliasMember
5524 *********************************************************************/
5525
5526 NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
5527                                  struct samr_DeleteAliasMember *r)
5528 {
5529         struct samr_alias_info *ainfo;
5530         NTSTATUS status;
5531
5532         ainfo = policy_handle_find(p, r->in.alias_handle,
5533                                    SAMR_ALIAS_ACCESS_REMOVE_MEMBER, NULL,
5534                                    struct samr_alias_info, &status);
5535         if (!NT_STATUS_IS_OK(status)) {
5536                 return status;
5537         }
5538
5539         DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
5540                    sid_string_dbg(&ainfo->sid)));
5541
5542         /******** BEGIN SeAddUsers BLOCK *********/
5543
5544         become_root();
5545         status = pdb_del_aliasmem(&ainfo->sid, r->in.sid);
5546         unbecome_root();
5547
5548         /******** END SeAddUsers BLOCK *********/
5549
5550         if (NT_STATUS_IS_OK(status)) {
5551                 force_flush_samr_cache(&ainfo->sid);
5552         }
5553
5554         return status;
5555 }
5556
5557 /*********************************************************************
5558  _samr_AddGroupMember
5559 *********************************************************************/
5560
5561 NTSTATUS _samr_AddGroupMember(pipes_struct *p,
5562                               struct samr_AddGroupMember *r)
5563 {
5564         struct samr_group_info *ginfo;
5565         NTSTATUS status;
5566         uint32 group_rid;
5567
5568         ginfo = policy_handle_find(p, r->in.group_handle,
5569                                    SAMR_GROUP_ACCESS_ADD_MEMBER, NULL,
5570                                    struct samr_group_info, &status);
5571         if (!NT_STATUS_IS_OK(status)) {
5572                 return status;
5573         }
5574
5575         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5576
5577         if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5578                                 &group_rid)) {
5579                 return NT_STATUS_INVALID_HANDLE;
5580         }
5581
5582         /******** BEGIN SeAddUsers BLOCK *********/
5583
5584         become_root();
5585         status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
5586         unbecome_root();
5587
5588         /******** END SeAddUsers BLOCK *********/
5589
5590         force_flush_samr_cache(&ginfo->sid);
5591
5592         return status;
5593 }
5594
5595 /*********************************************************************
5596  _samr_DeleteGroupMember
5597 *********************************************************************/
5598
5599 NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
5600                                  struct samr_DeleteGroupMember *r)
5601
5602 {
5603         struct samr_group_info *ginfo;
5604         NTSTATUS status;
5605         uint32 group_rid;
5606
5607         /*
5608          * delete the group member named r->in.rid
5609          * who is a member of the sid associated with the handle
5610          * the rid is a user's rid as the group is a domain group.
5611          */
5612
5613         ginfo = policy_handle_find(p, r->in.group_handle,
5614                                    SAMR_GROUP_ACCESS_REMOVE_MEMBER, NULL,
5615                                    struct samr_group_info, &status);
5616         if (!NT_STATUS_IS_OK(status)) {
5617                 return status;
5618         }
5619
5620         if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5621                                 &group_rid)) {
5622                 return NT_STATUS_INVALID_HANDLE;
5623         }
5624
5625         /******** BEGIN SeAddUsers BLOCK *********/
5626
5627         become_root();
5628         status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
5629         unbecome_root();
5630
5631         /******** END SeAddUsers BLOCK *********/
5632
5633         force_flush_samr_cache(&ginfo->sid);
5634
5635         return status;
5636 }
5637
5638 /*********************************************************************
5639  _samr_DeleteUser
5640 *********************************************************************/
5641
5642 NTSTATUS _samr_DeleteUser(pipes_struct *p,
5643                           struct samr_DeleteUser *r)
5644 {
5645         struct samr_user_info *uinfo;
5646         NTSTATUS status;
5647         struct samu *sam_pass=NULL;
5648         bool ret;
5649
5650         DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
5651
5652         uinfo = policy_handle_find(p, r->in.user_handle,
5653                                    STD_RIGHT_DELETE_ACCESS, NULL,
5654                                    struct samr_user_info, &status);
5655         if (!NT_STATUS_IS_OK(status)) {
5656                 return status;
5657         }
5658
5659         if (!sid_check_is_in_our_domain(&uinfo->sid))
5660                 return NT_STATUS_CANNOT_DELETE;
5661
5662         /* check if the user exists before trying to delete */
5663         if ( !(sam_pass = samu_new( NULL )) ) {
5664                 return NT_STATUS_NO_MEMORY;
5665         }
5666
5667         become_root();
5668         ret = pdb_getsampwsid(sam_pass, &uinfo->sid);
5669         unbecome_root();
5670
5671         if(!ret) {
5672                 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
5673                         sid_string_dbg(&uinfo->sid)));
5674                 TALLOC_FREE(sam_pass);
5675                 return NT_STATUS_NO_SUCH_USER;
5676         }
5677
5678         /******** BEGIN SeAddUsers BLOCK *********/
5679
5680         become_root();
5681         status = pdb_delete_user(p->mem_ctx, sam_pass);
5682         unbecome_root();
5683
5684         /******** END SeAddUsers BLOCK *********/
5685
5686         if ( !NT_STATUS_IS_OK(status) ) {
5687                 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
5688                          "user %s: %s.\n", pdb_get_username(sam_pass),
5689                          nt_errstr(status)));
5690                 TALLOC_FREE(sam_pass);
5691                 return status;
5692         }
5693
5694
5695         TALLOC_FREE(sam_pass);
5696
5697         force_flush_samr_cache(&uinfo->sid);
5698
5699         if (!close_policy_hnd(p, r->in.user_handle))
5700                 return NT_STATUS_OBJECT_NAME_INVALID;
5701
5702         ZERO_STRUCTP(r->out.user_handle);
5703
5704         return NT_STATUS_OK;
5705 }
5706
5707 /*********************************************************************
5708  _samr_DeleteDomainGroup
5709 *********************************************************************/
5710
5711 NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
5712                                  struct samr_DeleteDomainGroup *r)
5713 {
5714         struct samr_group_info *ginfo;
5715         NTSTATUS status;
5716         uint32 group_rid;
5717
5718         DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
5719
5720         ginfo = policy_handle_find(p, r->in.group_handle,
5721                                    STD_RIGHT_DELETE_ACCESS, NULL,
5722                                    struct samr_group_info, &status);
5723         if (!NT_STATUS_IS_OK(status)) {
5724                 return status;
5725         }
5726
5727         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo->sid)));
5728
5729         if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo->sid,
5730                                 &group_rid)) {
5731                 return NT_STATUS_NO_SUCH_GROUP;
5732         }
5733
5734         /******** BEGIN SeAddUsers BLOCK *********/
5735
5736         become_root();
5737         status = pdb_delete_dom_group(p->mem_ctx, group_rid);
5738         unbecome_root();
5739
5740         /******** END SeAddUsers BLOCK *********/
5741
5742         if ( !NT_STATUS_IS_OK(status) ) {
5743                 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
5744                          "entry for group %s: %s\n",
5745                          sid_string_dbg(&ginfo->sid),
5746                          nt_errstr(status)));
5747                 return status;
5748         }
5749
5750         force_flush_samr_cache(&ginfo->sid);
5751
5752         if (!close_policy_hnd(p, r->in.group_handle))
5753                 return NT_STATUS_OBJECT_NAME_INVALID;
5754
5755         return NT_STATUS_OK;
5756 }
5757
5758 /*********************************************************************
5759  _samr_DeleteDomAlias
5760 *********************************************************************/
5761
5762 NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
5763                               struct samr_DeleteDomAlias *r)
5764 {
5765         struct samr_alias_info *ainfo;
5766         NTSTATUS status;
5767
5768         DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
5769
5770         ainfo = policy_handle_find(p, r->in.alias_handle,
5771                                    STD_RIGHT_DELETE_ACCESS, NULL,
5772                                    struct samr_alias_info, &status);
5773         if (!NT_STATUS_IS_OK(status)) {
5774                 return status;
5775         }
5776
5777         DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo->sid)));
5778
5779         /* Don't let Windows delete builtin groups */
5780
5781         if ( sid_check_is_in_builtin( &ainfo->sid ) ) {
5782                 return NT_STATUS_SPECIAL_ACCOUNT;
5783         }
5784
5785         if (!sid_check_is_in_our_domain(&ainfo->sid))
5786                 return NT_STATUS_NO_SUCH_ALIAS;
5787
5788         DEBUG(10, ("lookup on Local SID\n"));
5789
5790         /******** BEGIN SeAddUsers BLOCK *********/
5791
5792         become_root();
5793         /* Have passdb delete the alias */
5794         status = pdb_delete_alias(&ainfo->sid);
5795         unbecome_root();
5796
5797         /******** END SeAddUsers BLOCK *********/
5798
5799         if ( !NT_STATUS_IS_OK(status))
5800                 return status;
5801
5802         force_flush_samr_cache(&ainfo->sid);
5803
5804         if (!close_policy_hnd(p, r->in.alias_handle))
5805                 return NT_STATUS_OBJECT_NAME_INVALID;
5806
5807         return NT_STATUS_OK;
5808 }
5809
5810 /*********************************************************************
5811  _samr_CreateDomainGroup
5812 *********************************************************************/
5813
5814 NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
5815                                  struct samr_CreateDomainGroup *r)
5816
5817 {
5818         NTSTATUS status;
5819         const char *name;
5820         struct samr_domain_info *dinfo;
5821         struct samr_group_info *ginfo;
5822
5823         dinfo = policy_handle_find(p, r->in.domain_handle,
5824                                    SAMR_DOMAIN_ACCESS_CREATE_GROUP, NULL,
5825                                    struct samr_domain_info, &status);
5826         if (!NT_STATUS_IS_OK(status)) {
5827                 return status;
5828         }
5829
5830         if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
5831                 return NT_STATUS_ACCESS_DENIED;
5832
5833         name = r->in.name->string;
5834         if (name == NULL) {
5835                 return NT_STATUS_NO_MEMORY;
5836         }
5837
5838         status = can_create(p->mem_ctx, name);
5839         if (!NT_STATUS_IS_OK(status)) {
5840                 return status;
5841         }
5842
5843         /******** BEGIN SeAddUsers BLOCK *********/
5844
5845         become_root();
5846         /* check that we successfully create the UNIX group */
5847         status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
5848         unbecome_root();
5849
5850         /******** END SeAddUsers BLOCK *********/
5851
5852         /* check if we should bail out here */
5853
5854         if ( !NT_STATUS_IS_OK(status) )
5855                 return status;
5856
5857         ginfo = policy_handle_create(p, r->out.group_handle,
5858                                      GENERIC_RIGHTS_GROUP_ALL_ACCESS,
5859                                      struct samr_group_info, &status);
5860         if (!NT_STATUS_IS_OK(status)) {
5861                 return status;
5862         }
5863         sid_compose(&ginfo->sid, &dinfo->sid, *r->out.rid);
5864
5865         force_flush_samr_cache(&dinfo->sid);
5866
5867         return NT_STATUS_OK;
5868 }
5869
5870 /*********************************************************************
5871  _samr_CreateDomAlias
5872 *********************************************************************/
5873
5874 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
5875                               struct samr_CreateDomAlias *r)
5876 {
5877         DOM_SID info_sid;
5878         const char *name = NULL;
5879         struct samr_domain_info *dinfo;
5880         struct samr_alias_info *ainfo;
5881         gid_t gid;
5882         NTSTATUS result;
5883
5884         dinfo = policy_handle_find(p, r->in.domain_handle,
5885                                    SAMR_DOMAIN_ACCESS_CREATE_ALIAS, NULL,
5886                                    struct samr_domain_info, &result);
5887         if (!NT_STATUS_IS_OK(result)) {
5888                 return result;
5889         }
5890
5891         if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
5892                 return NT_STATUS_ACCESS_DENIED;
5893
5894         name = r->in.alias_name->string;
5895
5896         result = can_create(p->mem_ctx, name);
5897         if (!NT_STATUS_IS_OK(result)) {
5898                 return result;
5899         }
5900
5901         /******** BEGIN SeAddUsers BLOCK *********/
5902
5903         become_root();
5904         /* Have passdb create the alias */
5905         result = pdb_create_alias(name, r->out.rid);
5906         unbecome_root();
5907
5908         /******** END SeAddUsers BLOCK *********/
5909
5910         if (!NT_STATUS_IS_OK(result)) {
5911                 DEBUG(10, ("pdb_create_alias failed: %s\n",
5912                            nt_errstr(result)));
5913                 return result;
5914         }
5915
5916         sid_compose(&info_sid, &dinfo->sid, *r->out.rid);
5917
5918         if (!sid_to_gid(&info_sid, &gid)) {
5919                 DEBUG(10, ("Could not find alias just created\n"));
5920                 return NT_STATUS_ACCESS_DENIED;
5921         }
5922
5923         /* check if the group has been successfully created */
5924         if ( getgrgid(gid) == NULL ) {
5925                 DEBUG(10, ("getgrgid(%u) of just created alias failed\n",
5926                            (unsigned int)gid));
5927                 return NT_STATUS_ACCESS_DENIED;
5928         }
5929
5930         ainfo = policy_handle_create(p, r->out.alias_handle,
5931                                      GENERIC_RIGHTS_ALIAS_ALL_ACCESS,
5932                                      struct samr_alias_info, &result);
5933         if (!NT_STATUS_IS_OK(result)) {
5934                 return result;
5935         }
5936         ainfo->sid = info_sid;
5937
5938         force_flush_samr_cache(&info_sid);
5939
5940         return NT_STATUS_OK;
5941 }
5942
5943 /*********************************************************************
5944  _samr_QueryGroupInfo
5945 *********************************************************************/
5946
5947 NTSTATUS _samr_QueryGroupInfo(pipes_struct *p,
5948                               struct samr_QueryGroupInfo *r)
5949 {
5950         struct samr_group_info *ginfo;
5951         NTSTATUS status;
5952         GROUP_MAP map;
5953         union samr_GroupInfo *info = NULL;
5954         bool ret;
5955         uint32_t attributes = SE_GROUP_MANDATORY |
5956                               SE_GROUP_ENABLED_BY_DEFAULT |
5957                               SE_GROUP_ENABLED;
5958         const char *group_name = NULL;
5959         const char *group_description = NULL;
5960
5961         ginfo = policy_handle_find(p, r->in.group_handle,
5962                                    SAMR_GROUP_ACCESS_LOOKUP_INFO, NULL,
5963                                    struct samr_group_info, &status);
5964         if (!NT_STATUS_IS_OK(status)) {
5965                 return status;
5966         }
5967
5968         become_root();
5969         ret = get_domain_group_from_sid(ginfo->sid, &map);
5970         unbecome_root();
5971         if (!ret)
5972                 return NT_STATUS_INVALID_HANDLE;
5973
5974         /* FIXME: map contains fstrings */
5975         group_name = talloc_strdup(r, map.nt_name);
5976         group_description = talloc_strdup(r, map.comment);
5977
5978         info = TALLOC_ZERO_P(p->mem_ctx, union samr_GroupInfo);
5979         if (!info) {
5980                 return NT_STATUS_NO_MEMORY;
5981         }
5982
5983         switch (r->in.level) {
5984                 case 1: {
5985                         uint32 *members;
5986                         size_t num_members;
5987
5988                         become_root();
5989                         status = pdb_enum_group_members(
5990                                 p->mem_ctx, &ginfo->sid, &members,
5991                                 &num_members);
5992                         unbecome_root();
5993
5994                         if (!NT_STATUS_IS_OK(status)) {
5995                                 return status;
5996                         }
5997
5998                         info->all.name.string           = group_name;
5999                         info->all.attributes            = attributes;
6000                         info->all.num_members           = num_members;
6001                         info->all.description.string    = group_description;
6002                         break;
6003                 }
6004                 case 2:
6005                         info->name.string = group_name;
6006                         break;
6007                 case 3:
6008                         info->attributes.attributes = attributes;
6009                         break;
6010                 case 4:
6011                         info->description.string = group_description;
6012                         break;
6013                 case 5: {
6014                         /*
6015                         uint32 *members;
6016                         size_t num_members;
6017                         */
6018
6019                         /*
6020                         become_root();
6021                         status = pdb_enum_group_members(
6022                                 p->mem_ctx, &ginfo->sid, &members,
6023                                 &num_members);
6024                         unbecome_root();
6025
6026                         if (!NT_STATUS_IS_OK(status)) {
6027                                 return status;
6028                         }
6029                         */
6030                         info->all2.name.string          = group_name;
6031                         info->all2.attributes           = attributes;
6032                         info->all2.num_members          = 0; /* num_members - in w2k3 this is always 0 */
6033                         info->all2.description.string   = group_description;
6034
6035                         break;
6036                 }
6037                 default:
6038                         return NT_STATUS_INVALID_INFO_CLASS;
6039         }
6040
6041         *r->out.info = info;
6042
6043         return NT_STATUS_OK;
6044 }
6045
6046 /*********************************************************************
6047  _samr_SetGroupInfo
6048 *********************************************************************/
6049
6050 NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
6051                             struct samr_SetGroupInfo *r)
6052 {
6053         struct samr_group_info *ginfo;
6054         GROUP_MAP map;
6055         NTSTATUS status;
6056         bool ret;
6057
6058         ginfo = policy_handle_find(p, r->in.group_handle,
6059                                    SAMR_GROUP_ACCESS_SET_INFO, NULL,
6060                                    struct samr_group_info, &status);
6061         if (!NT_STATUS_IS_OK(status)) {
6062                 return status;
6063         }
6064
6065         become_root();
6066         ret = get_domain_group_from_sid(ginfo->sid, &map);
6067         unbecome_root();
6068         if (!ret)
6069                 return NT_STATUS_NO_SUCH_GROUP;
6070
6071         switch (r->in.level) {
6072                 case 2:
6073                         fstrcpy(map.nt_name, r->in.info->name.string);
6074                         break;
6075                 case 3:
6076                         break;
6077                 case 4:
6078                         fstrcpy(map.comment, r->in.info->description.string);
6079                         break;
6080                 default:
6081                         return NT_STATUS_INVALID_INFO_CLASS;
6082         }
6083
6084         /******** BEGIN SeAddUsers BLOCK *********/
6085
6086         become_root();
6087         status = pdb_update_group_mapping_entry(&map);
6088         unbecome_root();
6089
6090         /******** End SeAddUsers BLOCK *********/
6091
6092         if (NT_STATUS_IS_OK(status)) {
6093                 force_flush_samr_cache(&ginfo->sid);
6094         }
6095
6096         return status;
6097 }
6098
6099 /*********************************************************************
6100  _samr_SetAliasInfo
6101 *********************************************************************/
6102
6103 NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
6104                             struct samr_SetAliasInfo *r)
6105 {
6106         struct samr_alias_info *ainfo;
6107         struct acct_info info;
6108         NTSTATUS status;
6109
6110         ainfo = policy_handle_find(p, r->in.alias_handle,
6111                                    SAMR_ALIAS_ACCESS_SET_INFO, NULL,
6112                                    struct samr_alias_info, &status);
6113         if (!NT_STATUS_IS_OK(status)) {
6114                 return status;
6115         }
6116
6117         /* get the current group information */
6118
6119         become_root();
6120         status = pdb_get_aliasinfo( &ainfo->sid, &info );
6121         unbecome_root();
6122
6123         if ( !NT_STATUS_IS_OK(status))
6124                 return status;
6125
6126         switch (r->in.level) {
6127                 case ALIASINFONAME:
6128                 {
6129                         fstring group_name;
6130
6131                         /* We currently do not support renaming groups in the
6132                            the BUILTIN domain.  Refer to util_builtin.c to understand
6133                            why.  The eventually needs to be fixed to be like Windows
6134                            where you can rename builtin groups, just not delete them */
6135
6136                         if ( sid_check_is_in_builtin( &ainfo->sid ) ) {
6137                                 return NT_STATUS_SPECIAL_ACCOUNT;
6138                         }
6139
6140                         /* There has to be a valid name (and it has to be different) */
6141
6142                         if ( !r->in.info->name.string )
6143                                 return NT_STATUS_INVALID_PARAMETER;
6144
6145                         /* If the name is the same just reply "ok".  Yes this
6146                            doesn't allow you to change the case of a group name. */
6147
6148                         if ( strequal( r->in.info->name.string, info.acct_name ) )
6149                                 return NT_STATUS_OK;
6150
6151                         fstrcpy( info.acct_name, r->in.info->name.string);
6152
6153                         /* make sure the name doesn't already exist as a user
6154                            or local group */
6155
6156                         fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
6157                         status = can_create( p->mem_ctx, group_name );
6158                         if ( !NT_STATUS_IS_OK( status ) )
6159                                 return status;
6160                         break;
6161                 }
6162                 case ALIASINFODESCRIPTION:
6163                         if (r->in.info->description.string) {
6164                                 fstrcpy(info.acct_desc,
6165                                         r->in.info->description.string);
6166                         } else {
6167                                 fstrcpy( info.acct_desc, "" );
6168                         }
6169                         break;
6170                 default:
6171                         return NT_STATUS_INVALID_INFO_CLASS;
6172         }
6173
6174         /******** BEGIN SeAddUsers BLOCK *********/
6175
6176         become_root();
6177         status = pdb_set_aliasinfo( &ainfo->sid, &info );
6178         unbecome_root();
6179
6180         /******** End SeAddUsers BLOCK *********/
6181
6182         if (NT_STATUS_IS_OK(status))
6183                 force_flush_samr_cache(&ainfo->sid);
6184
6185         return status;
6186 }
6187
6188 /****************************************************************
6189  _samr_GetDomPwInfo
6190 ****************************************************************/
6191
6192 NTSTATUS _samr_GetDomPwInfo(pipes_struct *p,
6193                             struct samr_GetDomPwInfo *r)
6194 {
6195         uint32_t min_password_length = 0;
6196         uint32_t password_properties = 0;
6197
6198         /* Perform access check.  Since this rpc does not require a
6199            policy handle it will not be caught by the access checks on
6200            SAMR_CONNECT or SAMR_CONNECT_ANON. */
6201
6202         if (!pipe_access_check(p)) {
6203                 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
6204                 return NT_STATUS_ACCESS_DENIED;
6205         }
6206
6207         become_root();
6208         pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
6209                                &min_password_length);
6210         pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
6211                                &password_properties);
6212         unbecome_root();
6213
6214         if (lp_check_password_script() && *lp_check_password_script()) {
6215                 password_properties |= DOMAIN_PASSWORD_COMPLEX;
6216         }
6217
6218         r->out.info->min_password_length = min_password_length;
6219         r->out.info->password_properties = password_properties;
6220
6221         return NT_STATUS_OK;
6222 }
6223
6224 /*********************************************************************
6225  _samr_OpenGroup
6226 *********************************************************************/
6227
6228 NTSTATUS _samr_OpenGroup(pipes_struct *p,
6229                          struct samr_OpenGroup *r)
6230
6231 {
6232         DOM_SID info_sid;
6233         GROUP_MAP map;
6234         struct samr_domain_info *dinfo;
6235         struct samr_group_info *ginfo;
6236         SEC_DESC         *psd = NULL;
6237         uint32            acc_granted;
6238         uint32            des_access = r->in.access_mask;
6239         size_t            sd_size;
6240         NTSTATUS          status;
6241         bool ret;
6242         SE_PRIV se_rights;
6243
6244         dinfo = policy_handle_find(p, r->in.domain_handle,
6245                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
6246                                    struct samr_domain_info, &status);
6247         if (!NT_STATUS_IS_OK(status)) {
6248                 return status;
6249         }
6250
6251         /*check if access can be granted as requested by client. */
6252         map_max_allowed_access(p->server_info->ptok,
6253                                &p->server_info->utok,
6254                                &des_access);
6255
6256         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
6257         se_map_generic(&des_access,&grp_generic_mapping);
6258
6259         se_priv_copy( &se_rights, &se_add_users );
6260
6261         status = access_check_object(psd, p->server_info->ptok,
6262                 &se_rights, GENERIC_RIGHTS_GROUP_ALL_ACCESS,
6263                 des_access, &acc_granted, "_samr_OpenGroup");
6264
6265         if ( !NT_STATUS_IS_OK(status) )
6266                 return status;
6267
6268         /* this should not be hard-coded like this */
6269
6270         if (!sid_equal(&dinfo->sid, get_global_sam_sid()))
6271                 return NT_STATUS_ACCESS_DENIED;
6272
6273         sid_compose(&info_sid, &dinfo->sid, r->in.rid);
6274
6275         DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n",
6276                    sid_string_dbg(&info_sid)));
6277
6278         /* check if that group really exists */
6279         become_root();
6280         ret = get_domain_group_from_sid(info_sid, &map);
6281         unbecome_root();
6282         if (!ret)
6283                 return NT_STATUS_NO_SUCH_GROUP;
6284
6285         ginfo = policy_handle_create(p, r->out.group_handle,
6286                                      acc_granted,
6287                                      struct samr_group_info, &status);
6288         if (!NT_STATUS_IS_OK(status)) {
6289                 return status;
6290         }
6291         ginfo->sid = info_sid;
6292
6293         return NT_STATUS_OK;
6294 }
6295
6296 /*********************************************************************
6297  _samr_RemoveMemberFromForeignDomain
6298 *********************************************************************/
6299
6300 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
6301                                              struct samr_RemoveMemberFromForeignDomain *r)
6302 {
6303         struct samr_domain_info *dinfo;
6304         NTSTATUS                result;
6305
6306         DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
6307                  sid_string_dbg(r->in.sid)));
6308
6309         /* Find the policy handle. Open a policy on it. */
6310
6311         dinfo = policy_handle_find(p, r->in.domain_handle,
6312                                    SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, NULL,
6313                                    struct samr_domain_info, &result);
6314         if (!NT_STATUS_IS_OK(result)) {
6315                 return result;
6316         }
6317
6318         DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
6319                   sid_string_dbg(&dinfo->sid)));
6320
6321         /* we can only delete a user from a group since we don't have
6322            nested groups anyways.  So in the latter case, just say OK */
6323
6324         /* TODO: The above comment nowadays is bogus. Since we have nested
6325          * groups now, and aliases members are never reported out of the unix
6326          * group membership, the "just say OK" makes this call a no-op. For
6327          * us. This needs fixing however. */
6328
6329         /* I've only ever seen this in the wild when deleting a user from
6330          * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
6331          * is the user about to be deleted. I very much suspect this is the
6332          * only application of this call. To verify this, let people report
6333          * other cases. */
6334
6335         if (!sid_check_is_builtin(&dinfo->sid)) {
6336                 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
6337                          "global_sam_sid() = %s\n",
6338                          sid_string_dbg(&dinfo->sid),
6339                          sid_string_dbg(get_global_sam_sid())));
6340                 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
6341                 return NT_STATUS_OK;
6342         }
6343
6344         force_flush_samr_cache(&dinfo->sid);
6345
6346         result = NT_STATUS_OK;
6347
6348         return result;
6349 }
6350
6351 /*******************************************************************
6352  _samr_QueryDomainInfo2
6353  ********************************************************************/
6354
6355 NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
6356                                 struct samr_QueryDomainInfo2 *r)
6357 {
6358         struct samr_QueryDomainInfo q;
6359
6360         q.in.domain_handle      = r->in.domain_handle;
6361         q.in.level              = r->in.level;
6362
6363         q.out.info              = r->out.info;
6364
6365         return _samr_QueryDomainInfo(p, &q);
6366 }
6367
6368 /*******************************************************************
6369  ********************************************************************/
6370
6371 static NTSTATUS set_dom_info_1(TALLOC_CTX *mem_ctx,
6372                                struct samr_DomInfo1 *r)
6373 {
6374         time_t u_expire, u_min_age;
6375
6376         u_expire = nt_time_to_unix_abs((NTTIME *)&r->max_password_age);
6377         u_min_age = nt_time_to_unix_abs((NTTIME *)&r->min_password_age);
6378
6379         pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
6380                                (uint32_t)r->min_password_length);
6381         pdb_set_account_policy(PDB_POLICY_PASSWORD_HISTORY,
6382                                (uint32_t)r->password_history_length);
6383         pdb_set_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
6384                                (uint32_t)r->password_properties);
6385         pdb_set_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, (int)u_expire);
6386         pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, (int)u_min_age);
6387
6388         return NT_STATUS_OK;
6389 }
6390
6391 /*******************************************************************
6392  ********************************************************************/
6393
6394 static NTSTATUS set_dom_info_3(TALLOC_CTX *mem_ctx,
6395                                struct samr_DomInfo3 *r)
6396 {
6397         time_t u_logout;
6398
6399         u_logout = nt_time_to_unix_abs((NTTIME *)&r->force_logoff_time);
6400
6401         pdb_set_account_policy(PDB_POLICY_TIME_TO_LOGOUT, (int)u_logout);
6402
6403         return NT_STATUS_OK;
6404 }
6405
6406 /*******************************************************************
6407  ********************************************************************/
6408
6409 static NTSTATUS set_dom_info_12(TALLOC_CTX *mem_ctx,
6410                                 struct samr_DomInfo12 *r)
6411 {
6412         time_t u_lock_duration, u_reset_time;
6413
6414         u_lock_duration = nt_time_to_unix_abs((NTTIME *)&r->lockout_duration);
6415         if (u_lock_duration != -1) {
6416                 u_lock_duration /= 60;
6417         }
6418
6419         u_reset_time = nt_time_to_unix_abs((NTTIME *)&r->lockout_window)/60;
6420
6421         pdb_set_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
6422         pdb_set_account_policy(PDB_POLICY_RESET_COUNT_TIME, (int)u_reset_time);
6423         pdb_set_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT,
6424                                (uint32_t)r->lockout_threshold);
6425
6426         return NT_STATUS_OK;
6427 }
6428
6429 /*******************************************************************
6430  _samr_SetDomainInfo
6431  ********************************************************************/
6432
6433 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
6434                              struct samr_SetDomainInfo *r)
6435 {
6436         struct samr_domain_info *dinfo;
6437         NTSTATUS status;
6438         uint32_t acc_required = 0;
6439
6440         DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
6441
6442         switch (r->in.level) {
6443         case 1: /* DomainPasswordInformation */
6444         case 12: /* DomainLockoutInformation */
6445                 /* DOMAIN_WRITE_PASSWORD_PARAMETERS */
6446                 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_1;
6447                 break;
6448         case 3: /* DomainLogoffInformation */
6449         case 4: /* DomainOemInformation */
6450                 /* DOMAIN_WRITE_OTHER_PARAMETERS */
6451                 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_2;
6452                 break;
6453         case 6: /* DomainReplicationInformation */
6454         case 9: /* DomainStateInformation */
6455         case 7: /* DomainServerRoleInformation */
6456                 /* DOMAIN_ADMINISTER_SERVER */
6457                 acc_required = SAMR_DOMAIN_ACCESS_SET_INFO_3;
6458                 break;
6459         default:
6460                 return NT_STATUS_INVALID_INFO_CLASS;
6461         }
6462
6463         dinfo = policy_handle_find(p, r->in.domain_handle,
6464                                    acc_required, NULL,
6465                                    struct samr_domain_info, &status);
6466         if (!NT_STATUS_IS_OK(status)) {
6467                 return status;
6468         }
6469
6470         DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
6471
6472         switch (r->in.level) {
6473                 case 1:
6474                         status = set_dom_info_1(p->mem_ctx, &r->in.info->info1);
6475                         break;
6476                 case 3:
6477                         status = set_dom_info_3(p->mem_ctx, &r->in.info->info3);
6478                         break;
6479                 case 4:
6480                         break;
6481                 case 6:
6482                         break;
6483                 case 7:
6484                         break;
6485                 case 9:
6486                         break;
6487                 case 12:
6488                         status = set_dom_info_12(p->mem_ctx, &r->in.info->info12);
6489                         break;
6490                 default:
6491                         return NT_STATUS_INVALID_INFO_CLASS;
6492         }
6493
6494         if (!NT_STATUS_IS_OK(status)) {
6495                 return status;
6496         }
6497
6498         DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
6499
6500         return NT_STATUS_OK;
6501 }
6502
6503 /****************************************************************
6504  _samr_GetDisplayEnumerationIndex
6505 ****************************************************************/
6506
6507 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
6508                                           struct samr_GetDisplayEnumerationIndex *r)
6509 {
6510         struct samr_domain_info *dinfo;
6511         uint32_t max_entries = (uint32_t) -1;
6512         uint32_t enum_context = 0;
6513         int i;
6514         uint32_t num_account = 0;
6515         struct samr_displayentry *entries = NULL;
6516         NTSTATUS status;
6517
6518         DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
6519
6520         dinfo = policy_handle_find(p, r->in.domain_handle,
6521                                    SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS, NULL,
6522                                    struct samr_domain_info, &status);
6523         if (!NT_STATUS_IS_OK(status)) {
6524                 return status;
6525         }
6526
6527         if ((r->in.level < 1) || (r->in.level > 3)) {
6528                 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
6529                         "Unknown info level (%u)\n",
6530                         r->in.level));
6531                 return NT_STATUS_INVALID_INFO_CLASS;
6532         }
6533
6534         become_root();
6535
6536         /* The following done as ROOT. Don't return without unbecome_root(). */
6537
6538         switch (r->in.level) {
6539         case 1:
6540                 if (dinfo->disp_info->users == NULL) {
6541                         dinfo->disp_info->users = pdb_search_users(
6542                                 dinfo->disp_info, ACB_NORMAL);
6543                         if (dinfo->disp_info->users == NULL) {
6544                                 unbecome_root();
6545                                 return NT_STATUS_ACCESS_DENIED;
6546                         }
6547                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6548                                 "starting user enumeration at index %u\n",
6549                                 (unsigned int)enum_context));
6550                 } else {
6551                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6552                                 "using cached user enumeration at index %u\n",
6553                                 (unsigned int)enum_context));
6554                 }
6555                 num_account = pdb_search_entries(dinfo->disp_info->users,
6556                                                  enum_context, max_entries,
6557                                                  &entries);
6558                 break;
6559         case 2:
6560                 if (dinfo->disp_info->machines == NULL) {
6561                         dinfo->disp_info->machines = pdb_search_users(
6562                                 dinfo->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
6563                         if (dinfo->disp_info->machines == NULL) {
6564                                 unbecome_root();
6565                                 return NT_STATUS_ACCESS_DENIED;
6566                         }
6567                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6568                                 "starting machine enumeration at index %u\n",
6569                                 (unsigned int)enum_context));
6570                 } else {
6571                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6572                                 "using cached machine enumeration at index %u\n",
6573                                 (unsigned int)enum_context));
6574                 }
6575                 num_account = pdb_search_entries(dinfo->disp_info->machines,
6576                                                  enum_context, max_entries,
6577                                                  &entries);
6578                 break;
6579         case 3:
6580                 if (dinfo->disp_info->groups == NULL) {
6581                         dinfo->disp_info->groups = pdb_search_groups(
6582                                 dinfo->disp_info);
6583                         if (dinfo->disp_info->groups == NULL) {
6584                                 unbecome_root();
6585                                 return NT_STATUS_ACCESS_DENIED;
6586                         }
6587                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6588                                 "starting group enumeration at index %u\n",
6589                                 (unsigned int)enum_context));
6590                 } else {
6591                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6592                                 "using cached group enumeration at index %u\n",
6593                                 (unsigned int)enum_context));
6594                 }
6595                 num_account = pdb_search_entries(dinfo->disp_info->groups,
6596                                                  enum_context, max_entries,
6597                                                  &entries);
6598                 break;
6599         default:
6600                 unbecome_root();
6601                 smb_panic("info class changed");
6602                 break;
6603         }
6604
6605         unbecome_root();
6606
6607         /* Ensure we cache this enumeration. */
6608         set_disp_info_cache_timeout(dinfo->disp_info, DISP_INFO_CACHE_TIMEOUT);
6609
6610         DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
6611                 r->in.name->string));
6612
6613         for (i=0; i<num_account; i++) {
6614                 if (strequal(entries[i].account_name, r->in.name->string)) {
6615                         DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6616                                 "found %s at idx %d\n",
6617                                 r->in.name->string, i));
6618                         *r->out.idx = i;
6619                         return NT_STATUS_OK;
6620                 }
6621         }
6622
6623         /* assuming account_name lives at the very end */
6624         *r->out.idx = num_account;
6625
6626         return NT_STATUS_NO_MORE_ENTRIES;
6627 }
6628
6629 /****************************************************************
6630  _samr_GetDisplayEnumerationIndex2
6631 ****************************************************************/
6632
6633 NTSTATUS _samr_GetDisplayEnumerationIndex2(pipes_struct *p,
6634                                            struct samr_GetDisplayEnumerationIndex2 *r)
6635 {
6636         struct samr_GetDisplayEnumerationIndex q;
6637
6638         q.in.domain_handle      = r->in.domain_handle;
6639         q.in.level              = r->in.level;
6640         q.in.name               = r->in.name;
6641
6642         q.out.idx               = r->out.idx;
6643
6644         return _samr_GetDisplayEnumerationIndex(p, &q);
6645 }
6646
6647 /****************************************************************
6648  _samr_RidToSid
6649 ****************************************************************/
6650
6651 NTSTATUS _samr_RidToSid(pipes_struct *p,
6652                         struct samr_RidToSid *r)
6653 {
6654         struct samr_domain_info *dinfo;
6655         NTSTATUS status;
6656         struct dom_sid sid;
6657
6658         dinfo = policy_handle_find(p, r->in.domain_handle,
6659                                    0, NULL,
6660                                    struct samr_domain_info, &status);
6661         if (!NT_STATUS_IS_OK(status)) {
6662                 return status;
6663         }
6664
6665         if (!sid_compose(&sid, &dinfo->sid, r->in.rid)) {
6666                 return NT_STATUS_NO_MEMORY;
6667         }
6668
6669         *r->out.sid = sid_dup_talloc(p->mem_ctx, &sid);
6670         if (!*r->out.sid) {
6671                 return NT_STATUS_NO_MEMORY;
6672         }
6673
6674         return NT_STATUS_OK;
6675 }
6676
6677 /****************************************************************
6678 ****************************************************************/
6679
6680 NTSTATUS _samr_Shutdown(pipes_struct *p,
6681                         struct samr_Shutdown *r)
6682 {
6683         p->rng_fault_state = true;
6684         return NT_STATUS_NOT_IMPLEMENTED;
6685 }
6686
6687 /****************************************************************
6688 ****************************************************************/
6689
6690 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
6691                                           struct samr_SetMemberAttributesOfGroup *r)
6692 {
6693         p->rng_fault_state = true;
6694         return NT_STATUS_NOT_IMPLEMENTED;
6695 }
6696
6697 /****************************************************************
6698 ****************************************************************/
6699
6700 NTSTATUS _samr_TestPrivateFunctionsDomain(pipes_struct *p,
6701                                           struct samr_TestPrivateFunctionsDomain *r)
6702 {
6703         return NT_STATUS_NOT_IMPLEMENTED;
6704 }
6705
6706 /****************************************************************
6707 ****************************************************************/
6708
6709 NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
6710                                         struct samr_TestPrivateFunctionsUser *r)
6711 {
6712         return NT_STATUS_NOT_IMPLEMENTED;
6713 }
6714
6715 /****************************************************************
6716 ****************************************************************/
6717
6718 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
6719                                          struct samr_AddMultipleMembersToAlias *r)
6720 {
6721         p->rng_fault_state = true;
6722         return NT_STATUS_NOT_IMPLEMENTED;
6723 }
6724
6725 /****************************************************************
6726 ****************************************************************/
6727
6728 NTSTATUS _samr_RemoveMultipleMembersFromAlias(pipes_struct *p,
6729                                               struct samr_RemoveMultipleMembersFromAlias *r)
6730 {
6731         p->rng_fault_state = true;
6732         return NT_STATUS_NOT_IMPLEMENTED;
6733 }
6734
6735 /****************************************************************
6736 ****************************************************************/
6737
6738 NTSTATUS _samr_SetBootKeyInformation(pipes_struct *p,
6739                                      struct samr_SetBootKeyInformation *r)
6740 {
6741         p->rng_fault_state = true;
6742         return NT_STATUS_NOT_IMPLEMENTED;
6743 }
6744
6745 /****************************************************************
6746 ****************************************************************/
6747
6748 NTSTATUS _samr_GetBootKeyInformation(pipes_struct *p,
6749                                      struct samr_GetBootKeyInformation *r)
6750 {
6751         p->rng_fault_state = true;
6752         return NT_STATUS_NOT_IMPLEMENTED;
6753 }
6754
6755 /****************************************************************
6756 ****************************************************************/
6757
6758 NTSTATUS _samr_SetDsrmPassword(pipes_struct *p,
6759                                struct samr_SetDsrmPassword *r)
6760 {
6761         p->rng_fault_state = true;
6762         return NT_STATUS_NOT_IMPLEMENTED;
6763 }
6764
6765 /****************************************************************
6766 ****************************************************************/
6767
6768 NTSTATUS _samr_ValidatePassword(pipes_struct *p,
6769                                 struct samr_ValidatePassword *r)
6770 {
6771         p->rng_fault_state = true;
6772         return NT_STATUS_NOT_IMPLEMENTED;
6773 }