27371ea8d1d339673dca39be023c0590ecf67234
[ira/wip.git] / source4 / rpc_server / lsa / lsa_lookup.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    endpoint server for the lsarpc pipe
5
6    Copyright (C) Andrew Tridgell 2004
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "rpc_server/lsa/lsa.h"
24
25 static const struct {
26         const char *domain;
27         const char *name;
28         const char *sid;
29         int rtype;
30 } well_known[] = {
31         {
32                 .name = "EVERYONE",
33                 .sid = SID_WORLD,
34                 .rtype = SID_NAME_WKN_GRP,
35         },
36         {
37                 .name = "CREATOR OWNER",
38                 .sid = SID_CREATOR_OWNER,
39                 .rtype = SID_NAME_WKN_GRP,
40         },
41         {
42                 .name = "CREATOR GROUP",
43                 .sid = SID_CREATOR_GROUP,
44                 .rtype = SID_NAME_WKN_GRP,
45         },
46         {
47                 .name = "Owner Rights",
48                 .sid = SID_OWNER_RIGHTS,
49                 .rtype = SID_NAME_WKN_GRP,
50         },
51         {
52                 .domain = "NT AUTHORITY",
53                 .name = "Dialup",
54                 .sid = SID_NT_DIALUP,
55                 .rtype = SID_NAME_WKN_GRP,
56         },
57         {
58                 .domain = "NT AUTHORITY",
59                 .name = "Network",
60                 .sid = SID_NT_NETWORK,
61                 .rtype = SID_NAME_WKN_GRP,
62         },
63         {
64                 .domain = "NT AUTHORITY",
65                 .name = "Batch",
66                 .sid = SID_NT_BATCH,
67                 .rtype = SID_NAME_WKN_GRP,
68         },
69         {
70                 .domain = "NT AUTHORITY",
71                 .name = "Interactive",
72                 .sid = SID_NT_INTERACTIVE,
73                 .rtype = SID_NAME_WKN_GRP,
74         },
75         {
76                 .domain = "NT AUTHORITY",
77                 .name = "Service",
78                 .sid = SID_NT_SERVICE,
79                 .rtype = SID_NAME_WKN_GRP,
80         },
81         {
82                 .domain = "NT AUTHORITY",
83                 .name = "ANONYMOUS LOGON",
84                 .sid = SID_NT_ANONYMOUS,
85                 .rtype = SID_NAME_WKN_GRP,
86         },
87         {
88                 .domain = "NT AUTHORITY",
89                 .name = "Proxy",
90                 .sid = SID_NT_PROXY,
91                 .rtype = SID_NAME_WKN_GRP,
92         },
93         {
94                 .domain = "NT AUTHORITY",
95                 .name = "ServerLogon",
96                 .sid = SID_NT_ENTERPRISE_DCS,
97                 .rtype = SID_NAME_WKN_GRP,
98         },
99         {
100                 .domain = "NT AUTHORITY",
101                 .name = "Self",
102                 .sid = SID_NT_SELF,
103                 .rtype = SID_NAME_WKN_GRP,
104         },
105         {
106                 .domain = "NT AUTHORITY",
107                 .name = "Authenticated Users",
108                 .sid = SID_NT_AUTHENTICATED_USERS,
109                 .rtype = SID_NAME_WKN_GRP,
110         },
111         {
112                 .domain = "NT AUTHORITY",
113                 .name = "Restricted",
114                 .sid = SID_NT_RESTRICTED,
115                 .rtype = SID_NAME_WKN_GRP,
116         },
117         {
118                 .domain = "NT AUTHORITY",
119                 .name = "Terminal Server User",
120                 .sid = SID_NT_TERMINAL_SERVER_USERS,
121                 .rtype = SID_NAME_WKN_GRP,
122         },
123         {
124                 .domain = "NT AUTHORITY",
125                 .name = "Remote Interactive Logon",
126                 .sid = SID_NT_REMOTE_INTERACTIVE,
127                 .rtype = SID_NAME_WKN_GRP,
128         },
129         {
130                 .domain = "NT AUTHORITY",
131                 .name = "This Organization",
132                 .sid = SID_NT_THIS_ORGANISATION,
133                 .rtype = SID_NAME_WKN_GRP,
134         },
135         {
136                 .domain = "NT AUTHORITY",
137                 .name = "SYSTEM",
138                 .sid = SID_NT_SYSTEM,
139                 .rtype = SID_NAME_WKN_GRP,
140         },
141         {
142                 .domain = "NT AUTHORITY",
143                 .name = "Local Service",
144                 .sid = SID_NT_LOCAL_SERVICE,
145                 .rtype = SID_NAME_WKN_GRP,
146         },
147         {
148                 .domain = "NT AUTHORITY",
149                 .name = "Network Service",
150                 .sid = SID_NT_NETWORK_SERVICE,
151                 .rtype = SID_NAME_WKN_GRP,
152         },
153         {
154                 .domain = "NT AUTHORITY",
155                 .name = "Digest Authentication",
156                 .sid = SID_NT_DIGEST_AUTHENTICATION,
157                 .rtype = SID_NAME_WKN_GRP,
158         },
159         {
160                 .domain = "NT AUTHORITY",
161                 .name = "Enterprise Domain Controllers",
162                 .sid = SID_NT_ENTERPRISE_DCS,
163                 .rtype = SID_NAME_WKN_GRP,
164         },
165         {
166                 .domain = "NT AUTHORITY",
167                 .name = "NTLM Authentication",
168                 .sid = SID_NT_NTLM_AUTHENTICATION,
169                 .rtype = SID_NAME_WKN_GRP,
170         },
171         {
172                 .domain = "NT AUTHORITY",
173                 .name = "Other Organization",
174                 .sid = SID_NT_OTHER_ORGANISATION,
175                 .rtype = SID_NAME_WKN_GRP,
176         },
177         {
178                 .domain = "NT AUTHORITY",
179                 .name = "SChannel Authentication",
180                 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
181                 .rtype = SID_NAME_WKN_GRP,
182         },
183         {
184                 .domain = "NT AUTHORITY",
185                 .name = "IUSR",
186                 .sid = SID_NT_IUSR,
187                 .rtype = SID_NAME_WKN_GRP,
188         },
189         {
190                 .sid = NULL,
191         }
192 };
193
194 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195                                         const char *name, const char **authority_name, 
196                                         struct dom_sid **sid, uint32_t *rtype) 
197 {
198         int i;
199         for (i=0; well_known[i].sid; i++) {
200                 if (domain) {
201                         if (strcasecmp_m(domain, well_known[i].domain) == 0
202                             && strcasecmp_m(name, well_known[i].name) == 0) {
203                                 *authority_name = well_known[i].domain;
204                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
205                                 *rtype = well_known[i].rtype;
206                                 return NT_STATUS_OK;
207                         }
208                 } else {
209                         if (strcasecmp_m(name, well_known[i].name) == 0) {
210                                 *authority_name = well_known[i].domain;
211                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
212                                 *rtype = well_known[i].rtype;
213                                 return NT_STATUS_OK;
214                         }
215                 }
216         }
217         return NT_STATUS_NOT_FOUND;     
218 }
219
220 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx, 
221                                        const char *sid_str, const char **authority_name, 
222                                        const char **name, uint32_t *rtype) 
223 {
224         int i;
225         for (i=0; well_known[i].sid; i++) {
226                 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227                         *authority_name = well_known[i].domain;
228                         *name = well_known[i].name;
229                         *rtype = well_known[i].rtype;
230                         return NT_STATUS_OK;
231                 }
232         }
233         return NT_STATUS_NOT_FOUND;     
234 }
235
236 /*
237   lookup a SID for 1 name
238 */
239 static NTSTATUS dcesrv_lsa_lookup_name(struct tevent_context *ev_ctx, 
240                                        struct loadparm_context *lp_ctx,
241                                        struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242                                        const char *name, const char **authority_name, 
243                                        struct dom_sid **sid, enum lsa_SidType *rtype,
244                                        uint32_t *rid)
245 {
246         int ret, atype, i;
247         struct ldb_message **res;
248         const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
249         const char *p;
250         const char *domain;
251         const char *username;
252         struct ldb_dn *domain_dn;
253         struct dom_sid *domain_sid;
254         NTSTATUS status;
255
256         p = strchr_m(name, '\\');
257         if (p != NULL) {
258                 domain = talloc_strndup(mem_ctx, name, p-name);
259                 if (!domain) {
260                         return NT_STATUS_NO_MEMORY;
261                 }
262                 username = p + 1;
263         } else if (strchr_m(name, '@')) {
264                 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
265                 if (!NT_STATUS_IS_OK(status)) {
266                         DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
267                         return status;
268                 }
269         } else {
270                 domain = NULL;
271                 username = name;
272         }
273         
274         if (!domain) {
275                 /* Look up table of well known names */
276                 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
277                 if (NT_STATUS_IS_OK(status)) {
278                         dom_sid_split_rid(NULL, *sid, NULL, rid);
279                         return NT_STATUS_OK;
280                 }
281
282                 if (username == NULL) {
283                         *authority_name = NAME_BUILTIN;
284                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
285                         *rtype = SID_NAME_DOMAIN;
286                         *rid = 0xFFFFFFFF;
287                         return NT_STATUS_OK;
288                 }
289
290                 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) { 
291                         *authority_name = NAME_NT_AUTHORITY;
292                         *sid =  dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
293                         *rtype = SID_NAME_DOMAIN;
294                         dom_sid_split_rid(NULL, *sid, NULL, rid);
295                         return NT_STATUS_OK;
296                 }
297                 if (strcasecmp_m(username, NAME_BUILTIN) == 0) { 
298                         *authority_name = NAME_BUILTIN;
299                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
300                         *rtype = SID_NAME_DOMAIN;
301                         *rid = 0xFFFFFFFF;
302                         return NT_STATUS_OK;
303                 }
304                 if (strcasecmp_m(username, state->domain_dns) == 0) { 
305                         *authority_name = state->domain_name;
306                         *sid =  state->domain_sid;
307                         *rtype = SID_NAME_DOMAIN;
308                         *rid = 0xFFFFFFFF;
309                         return NT_STATUS_OK;
310                 }
311                 if (strcasecmp_m(username, state->domain_name) == 0) { 
312                         *authority_name = state->domain_name;
313                         *sid =  state->domain_sid;
314                         *rtype = SID_NAME_DOMAIN;
315                         *rid = 0xFFFFFFFF;
316                         return NT_STATUS_OK;
317                 }
318                 
319                 /* Perhaps this is a well known user? */
320                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
321                 if (!name) {
322                         return NT_STATUS_NO_MEMORY;
323                 }
324                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
325                 if (NT_STATUS_IS_OK(status)) {
326                         return status;
327                 }
328
329                 /* Perhaps this is a BUILTIN user? */
330                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
331                 if (!name) {
332                         return NT_STATUS_NO_MEMORY;
333                 }
334                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
335                 if (NT_STATUS_IS_OK(status)) {
336                         return status;
337                 }
338
339                 /* OK, I give up - perhaps we need to assume the user is in our domain? */
340                 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
341                 if (!name) {
342                         return NT_STATUS_NO_MEMORY;
343                 }
344                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
345                 if (NT_STATUS_IS_OK(status)) {
346                         return status;
347                 }
348
349                 return STATUS_SOME_UNMAPPED;
350         } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
351                 if (!*username) {
352                         *authority_name = NAME_NT_AUTHORITY;
353                         *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
354                         *rtype = SID_NAME_DOMAIN;
355                         dom_sid_split_rid(NULL, *sid, NULL, rid);
356                         return NT_STATUS_OK;
357                 }
358
359                 /* Look up table of well known names */
360                 status = lookup_well_known_names(mem_ctx, domain, username, authority_name, 
361                                                  sid, rtype);
362                 if (NT_STATUS_IS_OK(status)) {
363                         dom_sid_split_rid(NULL, *sid, NULL, rid);
364                 }
365                 return status;
366         } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
367                 *authority_name = NAME_BUILTIN;
368                 domain_dn = state->builtin_dn;
369         } else if (strcasecmp_m(domain, state->domain_dns) == 0) { 
370                 *authority_name = state->domain_name;
371                 domain_dn = state->domain_dn;
372         } else if (strcasecmp_m(domain, state->domain_name) == 0) { 
373                 *authority_name = state->domain_name;
374                 domain_dn = state->domain_dn;
375         } else {
376                 /* Not local, need to ask winbind in future */
377                 return STATUS_SOME_UNMAPPED;
378         }
379
380         ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
381         if (ret == 1) {
382                 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
383                 if (domain_sid == NULL) {
384                         return NT_STATUS_INVALID_SID;
385                 }
386         } else {
387                 return NT_STATUS_INVALID_SID;
388         }
389
390         if (!*username) {
391                 *sid = domain_sid;
392                 *rtype = SID_NAME_DOMAIN;
393                 *rid = 0xFFFFFFFF;
394                 return NT_STATUS_OK;
395         }
396         
397         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
398                            "(&(sAMAccountName=%s)(objectSid=*))", 
399                            ldb_binary_encode_string(mem_ctx, username));
400         if (ret == -1) {
401                 return NT_STATUS_INVALID_SID;
402         }
403
404         for (i=0; i < ret; i++) {
405                 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
406                 if (*sid == NULL) {
407                         return NT_STATUS_INVALID_SID;
408                 }
409
410                 /* Check that this is in the domain */
411                 if (!dom_sid_in_domain(domain_sid, *sid)) {
412                         continue;
413                 }
414
415                 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
416                         
417                 *rtype = ds_atype_map(atype);
418                 if (*rtype == SID_NAME_UNKNOWN) {
419                         return STATUS_SOME_UNMAPPED;
420                 }
421
422                 return NT_STATUS_OK;
423         }
424
425         /* need to check for an allocated sid */
426
427         return NT_STATUS_INVALID_SID;
428 }
429
430
431 /*
432   add to the lsa_RefDomainList for LookupSids and LookupNames
433 */
434 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx, 
435                                           enum lsa_SidType rtype,
436                                           const char *authority_name,
437                                           struct dom_sid *sid, 
438                                           struct lsa_RefDomainList *domains,
439                                           uint32_t *sid_index)
440 {
441         struct dom_sid *authority_sid;
442         int i;
443
444         if (rtype != SID_NAME_DOMAIN) {
445                 authority_sid = dom_sid_dup(mem_ctx, sid);
446                 if (authority_sid == NULL) {
447                         return NT_STATUS_NO_MEMORY;
448                 }
449                 authority_sid->num_auths--;
450         } else {
451                 authority_sid = sid;
452         }
453
454         /* see if we've already done this authority name */
455         for (i=0;i<domains->count;i++) {
456                 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
457                         *sid_index = i;
458                         return NT_STATUS_OK;
459                 }
460         }
461
462         domains->domains = talloc_realloc(domains, 
463                                           domains->domains,
464                                           struct lsa_DomainInfo,
465                                           domains->count+1);
466         if (domains->domains == NULL) {
467                 return NT_STATUS_NO_MEMORY;
468         }
469         domains->domains[i].name.string = authority_name;
470         domains->domains[i].sid         = authority_sid;
471         domains->count++;
472         domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
473         *sid_index = i;
474         
475         return NT_STATUS_OK;
476 }
477
478 /*
479   lookup a name for 1 SID
480 */
481 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
482                                       struct dom_sid *sid, const char *sid_str,
483                                       const char **authority_name, 
484                                       const char **name, enum lsa_SidType *rtype)
485 {
486         NTSTATUS status;
487         int ret;
488         uint32_t atype;
489         struct ldb_message **res;
490         struct ldb_dn *domain_dn;
491         const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
492
493         status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
494         if (NT_STATUS_IS_OK(status)) {
495                 return status;
496         }
497
498         if (dom_sid_in_domain(state->domain_sid, sid)) {
499                 *authority_name = state->domain_name;
500                 domain_dn = state->domain_dn;
501         } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
502                 *authority_name = NAME_BUILTIN;
503                 domain_dn = state->builtin_dn;
504         } else {
505                 /* Not well known, our domain or built in */
506
507                 /* In future, we must look at SID histories, and at trusted domains via winbind */
508
509                 return NT_STATUS_NOT_FOUND;
510         }
511
512         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
513                            "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
514         if (ret == 1) {
515                 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
516                 if (!*name) {
517                         *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
518                         if (!*name) {
519                                 *name = talloc_strdup(mem_ctx, sid_str);
520                                 NT_STATUS_HAVE_NO_MEMORY(*name);
521                         }
522                 }
523
524                 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
525
526                 *rtype = ds_atype_map(atype);
527
528                 return NT_STATUS_OK;
529         }
530
531         /* need to re-add a check for an allocated sid */
532
533         return NT_STATUS_NOT_FOUND;
534 }
535
536
537 /*
538   lsa_LookupSids2
539 */
540 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
541                                 TALLOC_CTX *mem_ctx,
542                                 struct lsa_LookupSids2 *r)
543 {
544         struct lsa_policy_state *state;
545         struct lsa_RefDomainList *domains = NULL;
546         int i;
547         NTSTATUS status = NT_STATUS_OK;
548
549         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
550             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
551                 return NT_STATUS_INVALID_PARAMETER;
552         }
553
554         *r->out.domains = NULL;
555
556         /* NOTE: the WSPP test suite tries SIDs with invalid revision numbers,
557            and expects NT_STATUS_INVALID_PARAMETER back - we just treat it as 
558            an unknown SID. We could add a SID validator here. (tridge) 
559            MS-DTYP 2.4.2
560         */
561
562         status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
563         if (!NT_STATUS_IS_OK(status)) {
564                 return status;
565         }
566
567         domains = talloc_zero(r->out.domains,  struct lsa_RefDomainList);
568         if (domains == NULL) {
569                 return NT_STATUS_NO_MEMORY;
570         }
571         *r->out.domains = domains;
572
573         r->out.names = talloc_zero(mem_ctx,  struct lsa_TransNameArray2);
574         if (r->out.names == NULL) {
575                 return NT_STATUS_NO_MEMORY;
576         }
577
578         *r->out.count = 0;
579
580         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2, 
581                                              r->in.sids->num_sids);
582         if (r->out.names->names == NULL) {
583                 return NT_STATUS_NO_MEMORY;
584         }
585
586         for (i=0;i<r->in.sids->num_sids;i++) {
587                 struct dom_sid *sid = r->in.sids->sids[i].sid;
588                 char *sid_str = dom_sid_string(mem_ctx, sid);
589                 const char *name, *authority_name;
590                 enum lsa_SidType rtype;
591                 uint32_t sid_index;
592                 NTSTATUS status2;
593
594                 r->out.names->count++;
595
596                 r->out.names->names[i].sid_type    = SID_NAME_UNKNOWN;
597                 r->out.names->names[i].name.string = sid_str;
598                 r->out.names->names[i].sid_index   = 0xFFFFFFFF;
599                 r->out.names->names[i].unknown     = 0;
600
601                 if (sid_str == NULL) {
602                         r->out.names->names[i].name.string = "(SIDERROR)";
603                         status = STATUS_SOME_UNMAPPED;
604                         continue;
605                 }
606
607                 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str, 
608                                                 &authority_name, &name, &rtype);
609                 if (!NT_STATUS_IS_OK(status2)) {
610                         status = STATUS_SOME_UNMAPPED;
611                         continue;
612                 }
613
614                 /* set up the authority table */
615                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, 
616                                                     authority_name, sid, 
617                                                     domains, &sid_index);
618                 if (!NT_STATUS_IS_OK(status2)) {
619                         continue;
620                 }
621
622                 r->out.names->names[i].sid_type    = rtype;
623                 r->out.names->names[i].name.string = name;
624                 r->out.names->names[i].sid_index   = sid_index;
625                 r->out.names->names[i].unknown     = 0;
626
627                 (*r->out.count)++;
628         }
629
630         if (*r->out.count == 0) {
631                 return NT_STATUS_NONE_MAPPED;
632         }
633         if (*r->out.count != r->in.sids->num_sids) {
634                 return STATUS_SOME_UNMAPPED;
635         }
636
637         return NT_STATUS_OK;
638 }
639
640
641 /*
642   lsa_LookupSids3
643
644   Identical to LookupSids2, but doesn't take a policy handle
645   
646 */
647 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
648                                 TALLOC_CTX *mem_ctx,
649                                 struct lsa_LookupSids3 *r)
650 {
651         struct lsa_LookupSids2 r2;
652         struct lsa_OpenPolicy2 pol;
653         NTSTATUS status;
654         struct dcesrv_handle *h;
655
656         ZERO_STRUCT(r2);
657         
658         /* No policy handle on the wire, so make one up here */
659         r2.in.handle = talloc(mem_ctx, struct policy_handle);
660         if (!r2.in.handle) {
661                 return NT_STATUS_NO_MEMORY;
662         }
663
664         pol.out.handle = r2.in.handle;
665         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
666         pol.in.attr = NULL;
667         pol.in.system_name = NULL;
668         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
669         if (!NT_STATUS_IS_OK(status)) {
670                 return status;
671         }
672
673         /* ensure this handle goes away at the end of this call */
674         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
675         talloc_steal(mem_ctx, h);
676
677         r2.in.sids     = r->in.sids;
678         r2.in.names    = r->in.names;
679         r2.in.level    = r->in.level;
680         r2.in.count    = r->in.count;
681         r2.in.lookup_options = r->in.lookup_options;
682         r2.in.client_revision = r->in.client_revision;
683         r2.out.count   = r->out.count;
684         r2.out.names   = r->out.names;
685         r2.out.domains = r->out.domains;
686
687         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
688
689         r->out.domains = r2.out.domains;
690         r->out.names   = r2.out.names;
691         r->out.count   = r2.out.count;
692
693         return status;
694 }
695
696
697 /* 
698   lsa_LookupSids 
699 */
700 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
701                                struct lsa_LookupSids *r)
702 {
703         struct lsa_LookupSids2 r2;
704         NTSTATUS status;
705         int i;
706
707         ZERO_STRUCT(r2);
708
709         r2.in.handle   = r->in.handle;
710         r2.in.sids     = r->in.sids;
711         r2.in.names    = NULL;
712         r2.in.level    = r->in.level;
713         r2.in.count    = r->in.count;
714         r2.in.lookup_options = 0;
715         r2.in.client_revision = 0;
716         r2.out.count   = r->out.count;
717         r2.out.names   = NULL;
718         r2.out.domains = r->out.domains;
719
720         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
721         /* we deliberately don't check for error from the above,
722            as even on error we are supposed to return the names  */
723
724         r->out.domains = r2.out.domains;
725         if (!r2.out.names) {
726                 r->out.names = NULL;
727                 return status;
728         }
729
730         r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
731         if (r->out.names == NULL) {
732                 return NT_STATUS_NO_MEMORY;
733         }
734         r->out.names->count = r2.out.names->count;
735         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName, 
736                                              r->out.names->count);
737         if (r->out.names->names == NULL) {
738                 return NT_STATUS_NO_MEMORY;
739         }
740         for (i=0;i<r->out.names->count;i++) {
741                 r->out.names->names[i].sid_type    = r2.out.names->names[i].sid_type;
742                 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
743                 r->out.names->names[i].sid_index   = r2.out.names->names[i].sid_index;
744         }
745
746         return status;
747 }
748
749
750 /*
751   lsa_LookupNames3
752 */
753 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
754                                  TALLOC_CTX *mem_ctx,
755                                  struct lsa_LookupNames3 *r)
756 {
757         struct lsa_policy_state *policy_state;
758         struct dcesrv_handle *policy_handle;
759         int i;
760         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
761         struct lsa_RefDomainList *domains;
762
763         DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
764
765         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
766             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
767                 return NT_STATUS_INVALID_PARAMETER;
768         }
769
770         policy_state = policy_handle->data;
771
772         *r->out.domains = NULL;
773
774         domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
775         if (domains == NULL) {
776                 return NT_STATUS_NO_MEMORY;
777         }
778         *r->out.domains = domains;
779
780         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray3);
781         if (r->out.sids == NULL) {
782                 return NT_STATUS_NO_MEMORY;
783         }
784
785         *r->out.count = 0;
786
787         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3, 
788                                            r->in.num_names);
789         if (r->out.sids->sids == NULL) {
790                 return NT_STATUS_NO_MEMORY;
791         }
792
793         for (i=0;i<r->in.num_names;i++) {
794                 const char *name = r->in.names[i].string;
795                 const char *authority_name;
796                 struct dom_sid *sid;
797                 uint32_t sid_index, rid;
798                 enum lsa_SidType rtype;
799                 NTSTATUS status2;
800
801                 r->out.sids->count++;
802
803                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
804                 r->out.sids->sids[i].sid         = NULL;
805                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
806                 r->out.sids->sids[i].flags       = 0;
807
808                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name, 
809                                                  &authority_name, &sid, &rtype, &rid);
810                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
811                         continue;
812                 }
813
814                 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name, 
815                                                     sid, domains, &sid_index);
816                 if (!NT_STATUS_IS_OK(status2)) {
817                         continue;
818                 }
819
820                 r->out.sids->sids[i].sid_type    = rtype;
821                 r->out.sids->sids[i].sid         = sid;
822                 r->out.sids->sids[i].sid_index   = sid_index;
823                 r->out.sids->sids[i].flags       = 0;
824
825                 (*r->out.count)++;
826         }
827         
828         if (*r->out.count == 0) {
829                 return NT_STATUS_NONE_MAPPED;
830         }
831         if (*r->out.count != r->in.num_names) {
832                 return STATUS_SOME_UNMAPPED;
833         }
834
835         return NT_STATUS_OK;
836 }
837
838 /* 
839   lsa_LookupNames4
840
841   Identical to LookupNames3, but doesn't take a policy handle
842   
843 */
844 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
845                                  struct lsa_LookupNames4 *r)
846 {
847         struct lsa_LookupNames3 r2;
848         struct lsa_OpenPolicy2 pol;
849         NTSTATUS status;
850         struct dcesrv_handle *h;
851
852         ZERO_STRUCT(r2);
853
854         /* No policy handle on the wire, so make one up here */
855         r2.in.handle = talloc(mem_ctx, struct policy_handle);
856         if (!r2.in.handle) {
857                 return NT_STATUS_NO_MEMORY;
858         }
859
860         pol.out.handle = r2.in.handle;
861         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
862         pol.in.attr = NULL;
863         pol.in.system_name = NULL;
864         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
865         if (!NT_STATUS_IS_OK(status)) {
866                 return status;
867         }
868
869         /* ensure this handle goes away at the end of this call */
870         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
871         talloc_steal(mem_ctx, h);
872
873         r2.in.num_names = r->in.num_names;
874         r2.in.names = r->in.names;
875         r2.in.level = r->in.level;
876         r2.in.sids = r->in.sids;
877         r2.in.count = r->in.count;
878         r2.in.lookup_options = r->in.lookup_options;
879         r2.in.client_revision = r->in.client_revision;
880         r2.out.domains = r->out.domains;
881         r2.out.sids = r->out.sids;
882         r2.out.count = r->out.count;
883         
884         status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
885         
886         r->out.domains = r2.out.domains;
887         r->out.sids = r2.out.sids;
888         r->out.count = r2.out.count;
889         return status;
890 }
891
892 /*
893   lsa_LookupNames2
894 */
895 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
896                                  TALLOC_CTX *mem_ctx,
897                                  struct lsa_LookupNames2 *r)
898 {
899         struct lsa_policy_state *state;
900         struct dcesrv_handle *h;
901         int i;
902         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
903         struct lsa_RefDomainList *domains;
904
905         *r->out.domains = NULL;
906
907         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
908
909         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
910             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
911                 return NT_STATUS_INVALID_PARAMETER;
912         }
913
914         state = h->data;
915
916         domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
917         if (domains == NULL) {
918                 return NT_STATUS_NO_MEMORY;
919         }
920         *r->out.domains = domains;
921
922         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray2);
923         if (r->out.sids == NULL) {
924                 return NT_STATUS_NO_MEMORY;
925         }
926
927         *r->out.count = 0;
928
929         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2, 
930                                            r->in.num_names);
931         if (r->out.sids->sids == NULL) {
932                 return NT_STATUS_NO_MEMORY;
933         }
934
935         for (i=0;i<r->in.num_names;i++) {
936                 const char *name = r->in.names[i].string;
937                 const char *authority_name;
938                 struct dom_sid *sid;
939                 uint32_t rtype, sid_index, rid=0;
940                 NTSTATUS status2;
941
942                 r->out.sids->count++;
943
944                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
945                 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
946                    to sid NULL - so we should return 0 rid for
947                    unmapped entries */
948                 r->out.sids->sids[i].rid         = 0;
949                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
950                 r->out.sids->sids[i].unknown     = 0;
951
952                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name, 
953                                                  &authority_name, &sid, &rtype, &rid);
954                 if (!NT_STATUS_IS_OK(status2)) {
955                         continue;
956                 }
957
958                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name, 
959                                                     sid, domains, &sid_index);
960                 if (!NT_STATUS_IS_OK(status2)) {
961                         continue;
962                 }
963
964                 r->out.sids->sids[i].sid_type    = rtype;
965                 r->out.sids->sids[i].rid         = rid;
966                 r->out.sids->sids[i].sid_index   = sid_index;
967                 r->out.sids->sids[i].unknown     = 0;
968
969                 (*r->out.count)++;
970         }
971         
972         if (*r->out.count == 0) {
973                 return NT_STATUS_NONE_MAPPED;
974         }
975         if (*r->out.count != r->in.num_names) {
976                 return STATUS_SOME_UNMAPPED;
977         }
978
979         return NT_STATUS_OK;
980 }
981
982 /* 
983   lsa_LookupNames 
984 */
985 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
986                        struct lsa_LookupNames *r)
987 {
988         struct lsa_LookupNames2 r2;
989         NTSTATUS status;
990         int i;
991
992         ZERO_STRUCT(r2);
993
994         r2.in.handle    = r->in.handle;
995         r2.in.num_names = r->in.num_names;
996         r2.in.names     = r->in.names;
997         r2.in.sids      = NULL;
998         r2.in.level     = r->in.level;
999         r2.in.count     = r->in.count;
1000         r2.in.lookup_options = 0;
1001         r2.in.client_revision = 0;
1002         r2.out.count    = r->out.count;
1003         r2.out.domains  = r->out.domains;
1004
1005         status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
1006         if (r2.out.sids == NULL) {
1007                 return status;
1008         }
1009
1010         r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
1011         if (r->out.sids == NULL) {
1012                 return NT_STATUS_NO_MEMORY;
1013         }
1014         r->out.sids->count = r2.out.sids->count;
1015         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid, 
1016                                            r->out.sids->count);
1017         if (r->out.sids->sids == NULL) {
1018                 return NT_STATUS_NO_MEMORY;
1019         }
1020         for (i=0;i<r->out.sids->count;i++) {
1021                 r->out.sids->sids[i].sid_type    = r2.out.sids->sids[i].sid_type;
1022                 r->out.sids->sids[i].rid         = r2.out.sids->sids[i].rid;
1023                 r->out.sids->sids[i].sid_index   = r2.out.sids->sids[i].sid_index;
1024         }
1025
1026         return status;
1027 }
1028