Merge commit 'master/master'
[ira/wip.git] / source4 / rpc_server / lsa / lsa_lookup.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    endpoint server for the lsarpc pipe
5
6    Copyright (C) Andrew Tridgell 2004
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "rpc_server/lsa/lsa.h"
24
25 static const struct {
26         const char *domain;
27         const char *name;
28         const char *sid;
29         int rtype;
30 } well_known[] = {
31         {
32                 .name = "EVERYONE",
33                 .sid = SID_WORLD,
34                 .rtype = SID_NAME_WKN_GRP,
35         },
36         {
37                 .name = "CREATOR OWNER",
38                 .sid = SID_CREATOR_OWNER,
39                 .rtype = SID_NAME_WKN_GRP,
40         },
41         {
42                 .name = "CREATOR GROUP",
43                 .sid = SID_CREATOR_GROUP,
44                 .rtype = SID_NAME_WKN_GRP,
45         },
46         {
47                 .name = "Owner Rights",
48                 .sid = SID_OWNER_RIGHTS,
49                 .rtype = SID_NAME_WKN_GRP,
50         },
51         {
52                 .domain = "NT AUTHORITY",
53                 .name = "Dialup",
54                 .sid = SID_NT_DIALUP,
55                 .rtype = SID_NAME_WKN_GRP,
56         },
57         {
58                 .domain = "NT AUTHORITY",
59                 .name = "Network",
60                 .sid = SID_NT_NETWORK,
61                 .rtype = SID_NAME_WKN_GRP,
62         },
63         {
64                 .domain = "NT AUTHORITY",
65                 .name = "Batch",
66                 .sid = SID_NT_BATCH,
67                 .rtype = SID_NAME_WKN_GRP,
68         },
69         {
70                 .domain = "NT AUTHORITY",
71                 .name = "Interactive",
72                 .sid = SID_NT_INTERACTIVE,
73                 .rtype = SID_NAME_WKN_GRP,
74         },
75         {
76                 .domain = "NT AUTHORITY",
77                 .name = "Service",
78                 .sid = SID_NT_SERVICE,
79                 .rtype = SID_NAME_WKN_GRP,
80         },
81         {
82                 .domain = "NT AUTHORITY",
83                 .name = "ANONYMOUS LOGON",
84                 .sid = SID_NT_ANONYMOUS,
85                 .rtype = SID_NAME_WKN_GRP,
86         },
87         {
88                 .domain = "NT AUTHORITY",
89                 .name = "Proxy",
90                 .sid = SID_NT_PROXY,
91                 .rtype = SID_NAME_WKN_GRP,
92         },
93         {
94                 .domain = "NT AUTHORITY",
95                 .name = "ServerLogon",
96                 .sid = SID_NT_ENTERPRISE_DCS,
97                 .rtype = SID_NAME_WKN_GRP,
98         },
99         {
100                 .domain = "NT AUTHORITY",
101                 .name = "Self",
102                 .sid = SID_NT_SELF,
103                 .rtype = SID_NAME_WKN_GRP,
104         },
105         {
106                 .domain = "NT AUTHORITY",
107                 .name = "Authenticated Users",
108                 .sid = SID_NT_AUTHENTICATED_USERS,
109                 .rtype = SID_NAME_WKN_GRP,
110         },
111         {
112                 .domain = "NT AUTHORITY",
113                 .name = "Restricted",
114                 .sid = SID_NT_RESTRICTED,
115                 .rtype = SID_NAME_WKN_GRP,
116         },
117         {
118                 .domain = "NT AUTHORITY",
119                 .name = "Terminal Server User",
120                 .sid = SID_NT_TERMINAL_SERVER_USERS,
121                 .rtype = SID_NAME_WKN_GRP,
122         },
123         {
124                 .domain = "NT AUTHORITY",
125                 .name = "Remote Interactive Logon",
126                 .sid = SID_NT_REMOTE_INTERACTIVE,
127                 .rtype = SID_NAME_WKN_GRP,
128         },
129         {
130                 .domain = "NT AUTHORITY",
131                 .name = "This Organization",
132                 .sid = SID_NT_THIS_ORGANISATION,
133                 .rtype = SID_NAME_WKN_GRP,
134         },
135         {
136                 .domain = "NT AUTHORITY",
137                 .name = "SYSTEM",
138                 .sid = SID_NT_SYSTEM,
139                 .rtype = SID_NAME_WKN_GRP,
140         },
141         {
142                 .domain = "NT AUTHORITY",
143                 .name = "Local Service",
144                 .sid = SID_NT_LOCAL_SERVICE,
145                 .rtype = SID_NAME_WKN_GRP,
146         },
147         {
148                 .domain = "NT AUTHORITY",
149                 .name = "Network Service",
150                 .sid = SID_NT_NETWORK_SERVICE,
151                 .rtype = SID_NAME_WKN_GRP,
152         },
153         {
154                 .domain = "NT AUTHORITY",
155                 .name = "Digest Authentication",
156                 .sid = SID_NT_DIGEST_AUTHENTICATION,
157                 .rtype = SID_NAME_WKN_GRP,
158         },
159         {
160                 .domain = "NT AUTHORITY",
161                 .name = "Enterprise Domain Controllers",
162                 .sid = SID_NT_ENTERPRISE_DCS,
163                 .rtype = SID_NAME_WKN_GRP,
164         },
165         {
166                 .domain = "NT AUTHORITY",
167                 .name = "NTLM Authentication",
168                 .sid = SID_NT_NTLM_AUTHENTICATION,
169                 .rtype = SID_NAME_WKN_GRP,
170         },
171         {
172                 .domain = "NT AUTHORITY",
173                 .name = "Other Organization",
174                 .sid = SID_NT_OTHER_ORGANISATION,
175                 .rtype = SID_NAME_WKN_GRP,
176         },
177         {
178                 .domain = "NT AUTHORITY",
179                 .name = "SChannel Authentication",
180                 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
181                 .rtype = SID_NAME_WKN_GRP,
182         },
183         {
184                 .domain = "NT AUTHORITY",
185                 .name = "IUSR",
186                 .sid = SID_NT_IUSR,
187                 .rtype = SID_NAME_WKN_GRP,
188         },
189         {
190                 .sid = NULL,
191         }
192 };
193
194 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195                                         const char *name, const char **authority_name, 
196                                         struct dom_sid **sid, uint32_t *rtype) 
197 {
198         int i;
199         for (i=0; well_known[i].sid; i++) {
200                 if (domain) {
201                         if (strcasecmp_m(domain, well_known[i].domain) == 0
202                             && strcasecmp_m(name, well_known[i].name) == 0) {
203                                 *authority_name = well_known[i].domain;
204                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
205                                 *rtype = well_known[i].rtype;
206                                 return NT_STATUS_OK;
207                         }
208                 } else {
209                         if (strcasecmp_m(name, well_known[i].name) == 0) {
210                                 *authority_name = well_known[i].domain;
211                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
212                                 *rtype = well_known[i].rtype;
213                                 return NT_STATUS_OK;
214                         }
215                 }
216         }
217         return NT_STATUS_NOT_FOUND;     
218 }
219
220 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx, 
221                                        const char *sid_str, const char **authority_name, 
222                                        const char **name, uint32_t *rtype) 
223 {
224         int i;
225         for (i=0; well_known[i].sid; i++) {
226                 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227                         *authority_name = well_known[i].domain;
228                         *name = well_known[i].name;
229                         *rtype = well_known[i].rtype;
230                         return NT_STATUS_OK;
231                 }
232         }
233         return NT_STATUS_NOT_FOUND;     
234 }
235
236 /*
237   lookup a SID for 1 name
238 */
239 static NTSTATUS dcesrv_lsa_lookup_name(struct event_context *ev_ctx, 
240                                        struct loadparm_context *lp_ctx,
241                                        struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242                                 const char *name, const char **authority_name, 
243                                 struct dom_sid **sid, enum lsa_SidType *rtype)
244 {
245         int ret, atype, i;
246         struct ldb_message **res;
247         const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
248         const char *p;
249         const char *domain;
250         const char *username;
251         struct ldb_dn *domain_dn;
252         struct dom_sid *domain_sid;
253         NTSTATUS status;
254
255         p = strchr_m(name, '\\');
256         if (p != NULL) {
257                 domain = talloc_strndup(mem_ctx, name, p-name);
258                 if (!domain) {
259                         return NT_STATUS_NO_MEMORY;
260                 }
261                 username = p + 1;
262         } else if (strchr_m(name, '@')) {
263                 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
264                 if (!NT_STATUS_IS_OK(status)) {
265                         DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
266                         return status;
267                 }
268         } else {
269                 domain = NULL;
270                 username = name;
271         }
272         
273         if (!domain) {
274                 /* Look up table of well known names */
275                 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
276                 if (NT_STATUS_IS_OK(status)) {
277                         return NT_STATUS_OK;
278                 }
279
280                 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) { 
281                         *authority_name = NAME_NT_AUTHORITY;
282                         *sid =  dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
283                         *rtype = SID_NAME_DOMAIN;
284                         return NT_STATUS_OK;
285                 }
286                 if (strcasecmp_m(username, NAME_BUILTIN) == 0) { 
287                         *authority_name = NAME_BUILTIN;
288                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
289                         *rtype = SID_NAME_DOMAIN;
290                         return NT_STATUS_OK;
291                 }
292                 if (strcasecmp_m(username, state->domain_dns) == 0) { 
293                         *authority_name = state->domain_name;
294                         *sid =  state->domain_sid;
295                         *rtype = SID_NAME_DOMAIN;
296                         return NT_STATUS_OK;
297                 }
298                 if (strcasecmp_m(username, state->domain_name) == 0) { 
299                         *authority_name = state->domain_name;
300                         *sid =  state->domain_sid;
301                         *rtype = SID_NAME_DOMAIN;
302                         return NT_STATUS_OK;
303                 }
304                 
305                 /* Perhaps this is a well known user? */
306                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
307                 if (!name) {
308                         return NT_STATUS_NO_MEMORY;
309                 }
310                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
311                 if (NT_STATUS_IS_OK(status)) {
312                         return status;
313                 }
314
315                 /* Perhaps this is a BUILTIN user? */
316                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
317                 if (!name) {
318                         return NT_STATUS_NO_MEMORY;
319                 }
320                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
321                 if (NT_STATUS_IS_OK(status)) {
322                         return status;
323                 }
324
325                 /* OK, I give up - perhaps we need to assume the user is in our domain? */
326                 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
327                 if (!name) {
328                         return NT_STATUS_NO_MEMORY;
329                 }
330                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
331                 if (NT_STATUS_IS_OK(status)) {
332                         return status;
333                 }
334
335                 return STATUS_SOME_UNMAPPED;
336         } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
337                 if (!*username) {
338                         *authority_name = NAME_NT_AUTHORITY;
339                         *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
340                         *rtype = SID_NAME_DOMAIN;
341                         return NT_STATUS_OK;
342                 }
343
344                 /* Look up table of well known names */
345                 return lookup_well_known_names(mem_ctx, domain, username, authority_name, 
346                                                sid, rtype);
347         } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
348                 *authority_name = NAME_BUILTIN;
349                 domain_dn = state->builtin_dn;
350         } else if (strcasecmp_m(domain, state->domain_dns) == 0) { 
351                 *authority_name = state->domain_name;
352                 domain_dn = state->domain_dn;
353         } else if (strcasecmp_m(domain, state->domain_name) == 0) { 
354                 *authority_name = state->domain_name;
355                 domain_dn = state->domain_dn;
356         } else {
357                 /* Not local, need to ask winbind in future */
358                 return STATUS_SOME_UNMAPPED;
359         }
360
361         ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
362         if (ret == 1) {
363                 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
364                 if (domain_sid == NULL) {
365                         return NT_STATUS_INVALID_SID;
366                 }
367         } else {
368                 return NT_STATUS_INVALID_SID;
369         }
370
371         if (!*username) {
372                 *sid = domain_sid;
373                 *rtype = SID_NAME_DOMAIN;
374                 return NT_STATUS_OK;
375         }
376         
377         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
378                            "(&(sAMAccountName=%s)(objectSid=*))", 
379                            ldb_binary_encode_string(mem_ctx, username));
380         if (ret == -1) {
381                 return NT_STATUS_INVALID_SID;
382         }
383
384         for (i=0; i < ret; i++) {
385                 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
386                 if (*sid == NULL) {
387                         return NT_STATUS_INVALID_SID;
388                 }
389
390                 /* Check that this is in the domain */
391                 if (!dom_sid_in_domain(domain_sid, *sid)) {
392                         continue;
393                 }
394
395                 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
396                         
397                 *rtype = samdb_atype_map(atype);
398                 if (*rtype == SID_NAME_UNKNOWN) {
399                         return STATUS_SOME_UNMAPPED;
400                 }
401
402                 return NT_STATUS_OK;
403         }
404
405         /* need to check for an allocated sid */
406
407         return NT_STATUS_INVALID_SID;
408 }
409
410
411 /*
412   add to the lsa_RefDomainList for LookupSids and LookupNames
413 */
414 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx, 
415                                           enum lsa_SidType rtype,
416                                           const char *authority_name,
417                                           struct dom_sid *sid, 
418                                           struct lsa_RefDomainList *domains,
419                                           uint32_t *sid_index)
420 {
421         struct dom_sid *authority_sid;
422         int i;
423
424         if (rtype != SID_NAME_DOMAIN) {
425                 authority_sid = dom_sid_dup(mem_ctx, sid);
426                 if (authority_sid == NULL) {
427                         return NT_STATUS_NO_MEMORY;
428                 }
429                 authority_sid->num_auths--;
430         } else {
431                 authority_sid = sid;
432         }
433
434         /* see if we've already done this authority name */
435         for (i=0;i<domains->count;i++) {
436                 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
437                         *sid_index = i;
438                         return NT_STATUS_OK;
439                 }
440         }
441
442         domains->domains = talloc_realloc(domains, 
443                                           domains->domains,
444                                           struct lsa_DomainInfo,
445                                           domains->count+1);
446         if (domains->domains == NULL) {
447                 return NT_STATUS_NO_MEMORY;
448         }
449         domains->domains[i].name.string = authority_name;
450         domains->domains[i].sid         = authority_sid;
451         domains->count++;
452         domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
453         *sid_index = i;
454         
455         return NT_STATUS_OK;
456 }
457
458 /*
459   lookup a name for 1 SID
460 */
461 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
462                                       struct dom_sid *sid, const char *sid_str,
463                                       const char **authority_name, 
464                                       const char **name, enum lsa_SidType *rtype)
465 {
466         NTSTATUS status;
467         int ret;
468         uint32_t atype;
469         struct ldb_message **res;
470         struct ldb_dn *domain_dn;
471         const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
472
473         status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
474         if (NT_STATUS_IS_OK(status)) {
475                 return status;
476         }
477
478         if (dom_sid_in_domain(state->domain_sid, sid)) {
479                 *authority_name = state->domain_name;
480                 domain_dn = state->domain_dn;
481         } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
482                 *authority_name = NAME_BUILTIN;
483                 domain_dn = state->builtin_dn;
484         } else {
485                 /* Not well known, our domain or built in */
486
487                 /* In future, we must look at SID histories, and at trusted domains via winbind */
488
489                 return NT_STATUS_NOT_FOUND;
490         }
491
492         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
493                            "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
494         if (ret == 1) {
495                 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
496                 if (!*name) {
497                         *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
498                         if (!*name) {
499                                 *name = talloc_strdup(mem_ctx, sid_str);
500                                 NT_STATUS_HAVE_NO_MEMORY(*name);
501                         }
502                 }
503
504                 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
505
506                 *rtype = samdb_atype_map(atype);
507
508                 return NT_STATUS_OK;
509         }
510
511         /* need to re-add a check for an allocated sid */
512
513         return NT_STATUS_NOT_FOUND;
514 }
515
516
517 /*
518   lsa_LookupSids2
519 */
520 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
521                                 TALLOC_CTX *mem_ctx,
522                                 struct lsa_LookupSids2 *r)
523 {
524         struct lsa_policy_state *state;
525         int i;
526         NTSTATUS status = NT_STATUS_OK;
527
528         r->out.domains = NULL;
529
530         status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
531         if (!NT_STATUS_IS_OK(status)) {
532                 return status;
533         }
534
535         r->out.domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
536         if (r->out.domains == NULL) {
537                 return NT_STATUS_NO_MEMORY;
538         }
539
540         r->out.names = talloc_zero(mem_ctx,  struct lsa_TransNameArray2);
541         if (r->out.names == NULL) {
542                 return NT_STATUS_NO_MEMORY;
543         }
544
545         *r->out.count = 0;
546
547         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2, 
548                                              r->in.sids->num_sids);
549         if (r->out.names->names == NULL) {
550                 return NT_STATUS_NO_MEMORY;
551         }
552
553         for (i=0;i<r->in.sids->num_sids;i++) {
554                 struct dom_sid *sid = r->in.sids->sids[i].sid;
555                 char *sid_str = dom_sid_string(mem_ctx, sid);
556                 const char *name, *authority_name;
557                 enum lsa_SidType rtype;
558                 uint32_t sid_index;
559                 NTSTATUS status2;
560
561                 r->out.names->count++;
562
563                 r->out.names->names[i].sid_type    = SID_NAME_UNKNOWN;
564                 r->out.names->names[i].name.string = sid_str;
565                 r->out.names->names[i].sid_index   = 0xFFFFFFFF;
566                 r->out.names->names[i].unknown     = 0;
567
568                 if (sid_str == NULL) {
569                         r->out.names->names[i].name.string = "(SIDERROR)";
570                         status = STATUS_SOME_UNMAPPED;
571                         continue;
572                 }
573
574                 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str, 
575                                                 &authority_name, &name, &rtype);
576                 if (!NT_STATUS_IS_OK(status2)) {
577                         status = STATUS_SOME_UNMAPPED;
578                         continue;
579                 }
580
581                 /* set up the authority table */
582                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, 
583                                                     authority_name, sid, 
584                                                     r->out.domains, &sid_index);
585                 if (!NT_STATUS_IS_OK(status2)) {
586                         return status2;
587                 }
588
589                 r->out.names->names[i].sid_type    = rtype;
590                 r->out.names->names[i].name.string = name;
591                 r->out.names->names[i].sid_index   = sid_index;
592                 r->out.names->names[i].unknown     = 0;
593
594                 (*r->out.count)++;
595         }
596         
597         if (*r->out.count == 0) {
598                 return NT_STATUS_NONE_MAPPED;
599         }
600         if (*r->out.count != r->in.sids->num_sids) {
601                 return STATUS_SOME_UNMAPPED;
602         }
603
604         return NT_STATUS_OK;
605 }
606
607
608 /*
609   lsa_LookupSids3
610
611   Identical to LookupSids2, but doesn't take a policy handle
612   
613 */
614 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
615                                 TALLOC_CTX *mem_ctx,
616                                 struct lsa_LookupSids3 *r)
617 {
618         struct lsa_LookupSids2 r2;
619         struct lsa_OpenPolicy2 pol;
620         NTSTATUS status;
621         struct dcesrv_handle *h;
622
623         ZERO_STRUCT(r2);
624         
625         /* No policy handle on the wire, so make one up here */
626         r2.in.handle = talloc(mem_ctx, struct policy_handle);
627         if (!r2.in.handle) {
628                 return NT_STATUS_NO_MEMORY;
629         }
630
631         pol.out.handle = r2.in.handle;
632         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
633         pol.in.attr = NULL;
634         pol.in.system_name = NULL;
635         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
636         if (!NT_STATUS_IS_OK(status)) {
637                 return status;
638         }
639
640         /* ensure this handle goes away at the end of this call */
641         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
642         talloc_steal(mem_ctx, h);
643
644         r2.in.sids     = r->in.sids;
645         r2.in.names    = r->in.names;
646         r2.in.level    = r->in.level;
647         r2.in.count    = r->in.count;
648         r2.in.unknown1 = r->in.unknown1;
649         r2.in.unknown2 = r->in.unknown2;
650         r2.out.count   = r->out.count;
651         r2.out.names   = r->out.names;
652
653         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
654
655         r->out.domains = r2.out.domains;
656         r->out.names   = r2.out.names;
657         r->out.count   = r2.out.count;
658
659         return status;
660 }
661
662
663 /* 
664   lsa_LookupSids 
665 */
666 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
667                                struct lsa_LookupSids *r)
668 {
669         struct lsa_LookupSids2 r2;
670         NTSTATUS status;
671         int i;
672
673         ZERO_STRUCT(r2);
674
675         r2.in.handle   = r->in.handle;
676         r2.in.sids     = r->in.sids;
677         r2.in.names    = NULL;
678         r2.in.level    = r->in.level;
679         r2.in.count    = r->in.count;
680         r2.in.unknown1 = 0;
681         r2.in.unknown2 = 0;
682         r2.out.count   = r->out.count;
683         r2.out.names   = NULL;
684
685         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
686         if (NT_STATUS_IS_ERR(status)) {
687                 return status;
688         }
689
690         r->out.domains = r2.out.domains;
691         if (!r2.out.names) {
692                 r->out.names = NULL;
693                 return status;
694         }
695
696         r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
697         if (r->out.names == NULL) {
698                 return NT_STATUS_NO_MEMORY;
699         }
700         r->out.names->count = r2.out.names->count;
701         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName, 
702                                              r->out.names->count);
703         if (r->out.names->names == NULL) {
704                 return NT_STATUS_NO_MEMORY;
705         }
706         for (i=0;i<r->out.names->count;i++) {
707                 r->out.names->names[i].sid_type    = r2.out.names->names[i].sid_type;
708                 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
709                 r->out.names->names[i].sid_index   = r2.out.names->names[i].sid_index;
710         }
711
712         return status;
713 }
714
715
716 /*
717   lsa_LookupNames3
718 */
719 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
720                                  TALLOC_CTX *mem_ctx,
721                                  struct lsa_LookupNames3 *r)
722 {
723         struct lsa_policy_state *policy_state;
724         struct dcesrv_handle *policy_handle;
725         int i;
726         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
727
728         DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
729
730         policy_state = policy_handle->data;
731
732         r->out.domains = NULL;
733
734         r->out.domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
735         if (r->out.domains == NULL) {
736                 return NT_STATUS_NO_MEMORY;
737         }
738
739         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray3);
740         if (r->out.sids == NULL) {
741                 return NT_STATUS_NO_MEMORY;
742         }
743
744         *r->out.count = 0;
745
746         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3, 
747                                            r->in.num_names);
748         if (r->out.sids->sids == NULL) {
749                 return NT_STATUS_NO_MEMORY;
750         }
751
752         for (i=0;i<r->in.num_names;i++) {
753                 const char *name = r->in.names[i].string;
754                 const char *authority_name;
755                 struct dom_sid *sid;
756                 uint32_t sid_index;
757                 enum lsa_SidType rtype;
758                 NTSTATUS status2;
759
760                 r->out.sids->count++;
761
762                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
763                 r->out.sids->sids[i].sid         = NULL;
764                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
765                 r->out.sids->sids[i].flags       = 0;
766
767                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name, &authority_name, &sid, &rtype);
768                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
769                         continue;
770                 }
771
772                 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name, 
773                                                     sid, r->out.domains, &sid_index);
774                 if (!NT_STATUS_IS_OK(status2)) {
775                         continue;
776                 }
777
778                 r->out.sids->sids[i].sid_type    = rtype;
779                 r->out.sids->sids[i].sid         = sid;
780                 r->out.sids->sids[i].sid_index   = sid_index;
781                 r->out.sids->sids[i].flags       = 0;
782
783                 (*r->out.count)++;
784         }
785         
786         if (*r->out.count == 0) {
787                 return NT_STATUS_NONE_MAPPED;
788         }
789         if (*r->out.count != r->in.num_names) {
790                 return STATUS_SOME_UNMAPPED;
791         }
792
793         return NT_STATUS_OK;
794 }
795
796 /* 
797   lsa_LookupNames4
798
799   Identical to LookupNames3, but doesn't take a policy handle
800   
801 */
802 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
803                                  struct lsa_LookupNames4 *r)
804 {
805         struct lsa_LookupNames3 r2;
806         struct lsa_OpenPolicy2 pol;
807         NTSTATUS status;
808         struct dcesrv_handle *h;
809
810         ZERO_STRUCT(r2);
811
812         /* No policy handle on the wire, so make one up here */
813         r2.in.handle = talloc(mem_ctx, struct policy_handle);
814         if (!r2.in.handle) {
815                 return NT_STATUS_NO_MEMORY;
816         }
817
818         pol.out.handle = r2.in.handle;
819         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
820         pol.in.attr = NULL;
821         pol.in.system_name = NULL;
822         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
823         if (!NT_STATUS_IS_OK(status)) {
824                 return status;
825         }
826
827         /* ensure this handle goes away at the end of this call */
828         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
829         talloc_steal(mem_ctx, h);
830
831         r2.in.num_names = r->in.num_names;
832         r2.in.names = r->in.names;
833         r2.in.sids = r->in.sids;
834         r2.in.count = r->in.count;
835         r2.in.unknown1 = r->in.unknown1;
836         r2.in.unknown2 = r->in.unknown2;
837         r2.out.domains = r->out.domains;
838         r2.out.sids = r->out.sids;
839         r2.out.count = r->out.count;
840         
841         status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
842         
843         r->out.domains = r2.out.domains;
844         r->out.sids = r2.out.sids;
845         r->out.count = r2.out.count;
846         return status;
847 }
848
849 /*
850   lsa_LookupNames2
851 */
852 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
853                                  TALLOC_CTX *mem_ctx,
854                                  struct lsa_LookupNames2 *r)
855 {
856         struct lsa_policy_state *state;
857         struct dcesrv_handle *h;
858         int i;
859         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
860
861         r->out.domains = NULL;
862
863         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
864
865         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
866             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
867                 return NT_STATUS_INVALID_PARAMETER;
868         }
869
870         state = h->data;
871
872         r->out.domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
873         if (r->out.domains == NULL) {
874                 return NT_STATUS_NO_MEMORY;
875         }
876
877         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray2);
878         if (r->out.sids == NULL) {
879                 return NT_STATUS_NO_MEMORY;
880         }
881
882         *r->out.count = 0;
883
884         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2, 
885                                            r->in.num_names);
886         if (r->out.sids->sids == NULL) {
887                 return NT_STATUS_NO_MEMORY;
888         }
889
890         for (i=0;i<r->in.num_names;i++) {
891                 const char *name = r->in.names[i].string;
892                 const char *authority_name;
893                 struct dom_sid *sid;
894                 uint32_t rtype, sid_index;
895                 NTSTATUS status2;
896
897                 r->out.sids->count++;
898
899                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
900                 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
901                    to sid NULL - so we should return 0 rid for
902                    unmapped entries */
903                 r->out.sids->sids[i].rid         = 0;
904                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
905                 r->out.sids->sids[i].unknown     = 0;
906
907                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name, 
908                                                  &authority_name, &sid, &rtype);
909                 if (!NT_STATUS_IS_OK(status2)) {
910                         continue;
911                 }
912
913                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name, 
914                                                     sid, r->out.domains, &sid_index);
915                 if (!NT_STATUS_IS_OK(status2)) {
916                         continue;
917                 }
918
919                 r->out.sids->sids[i].sid_type    = rtype;
920                 r->out.sids->sids[i].rid         = sid->sub_auths[sid->num_auths-1];
921                 r->out.sids->sids[i].sid_index   = sid_index;
922                 r->out.sids->sids[i].unknown     = 0;
923
924                 (*r->out.count)++;
925         }
926         
927         if (*r->out.count == 0) {
928                 return NT_STATUS_NONE_MAPPED;
929         }
930         if (*r->out.count != r->in.num_names) {
931                 return STATUS_SOME_UNMAPPED;
932         }
933
934         return NT_STATUS_OK;
935 }
936
937 /* 
938   lsa_LookupNames 
939 */
940 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
941                        struct lsa_LookupNames *r)
942 {
943         struct lsa_LookupNames2 r2;
944         NTSTATUS status;
945         int i;
946
947         ZERO_STRUCT(r2);
948
949         r2.in.handle    = r->in.handle;
950         r2.in.num_names = r->in.num_names;
951         r2.in.names     = r->in.names;
952         r2.in.sids      = NULL;
953         r2.in.level     = r->in.level;
954         r2.in.count     = r->in.count;
955         r2.in.unknown1  = 0;
956         r2.in.unknown2  = 0;
957         r2.out.count    = r->out.count;
958
959         status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
960         if (r2.out.sids == NULL) {
961                 return status;
962         }
963
964         r->out.domains = r2.out.domains;
965         r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
966         if (r->out.sids == NULL) {
967                 return NT_STATUS_NO_MEMORY;
968         }
969         r->out.sids->count = r2.out.sids->count;
970         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid, 
971                                            r->out.sids->count);
972         if (r->out.sids->sids == NULL) {
973                 return NT_STATUS_NO_MEMORY;
974         }
975         for (i=0;i<r->out.sids->count;i++) {
976                 r->out.sids->sids[i].sid_type    = r2.out.sids->sids[i].sid_type;
977                 r->out.sids->sids[i].rid         = r2.out.sids->sids[i].rid;
978                 r->out.sids->sids[i].sid_index   = r2.out.sids->sids[i].sid_index;
979         }
980
981         return status;
982 }
983