s4-lsa: fixed breakage of lsa server
[ira/wip.git] / source4 / rpc_server / lsa / lsa_lookup.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    endpoint server for the lsarpc pipe
5
6    Copyright (C) Andrew Tridgell 2004
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "rpc_server/lsa/lsa.h"
24
25 static const struct {
26         const char *domain;
27         const char *name;
28         const char *sid;
29         int rtype;
30 } well_known[] = {
31         {
32                 .name = "EVERYONE",
33                 .sid = SID_WORLD,
34                 .rtype = SID_NAME_WKN_GRP,
35         },
36         {
37                 .name = "CREATOR OWNER",
38                 .sid = SID_CREATOR_OWNER,
39                 .rtype = SID_NAME_WKN_GRP,
40         },
41         {
42                 .name = "CREATOR GROUP",
43                 .sid = SID_CREATOR_GROUP,
44                 .rtype = SID_NAME_WKN_GRP,
45         },
46         {
47                 .name = "Owner Rights",
48                 .sid = SID_OWNER_RIGHTS,
49                 .rtype = SID_NAME_WKN_GRP,
50         },
51         {
52                 .domain = "NT AUTHORITY",
53                 .name = "Dialup",
54                 .sid = SID_NT_DIALUP,
55                 .rtype = SID_NAME_WKN_GRP,
56         },
57         {
58                 .domain = "NT AUTHORITY",
59                 .name = "Network",
60                 .sid = SID_NT_NETWORK,
61                 .rtype = SID_NAME_WKN_GRP,
62         },
63         {
64                 .domain = "NT AUTHORITY",
65                 .name = "Batch",
66                 .sid = SID_NT_BATCH,
67                 .rtype = SID_NAME_WKN_GRP,
68         },
69         {
70                 .domain = "NT AUTHORITY",
71                 .name = "Interactive",
72                 .sid = SID_NT_INTERACTIVE,
73                 .rtype = SID_NAME_WKN_GRP,
74         },
75         {
76                 .domain = "NT AUTHORITY",
77                 .name = "Service",
78                 .sid = SID_NT_SERVICE,
79                 .rtype = SID_NAME_WKN_GRP,
80         },
81         {
82                 .domain = "NT AUTHORITY",
83                 .name = "ANONYMOUS LOGON",
84                 .sid = SID_NT_ANONYMOUS,
85                 .rtype = SID_NAME_WKN_GRP,
86         },
87         {
88                 .domain = "NT AUTHORITY",
89                 .name = "Proxy",
90                 .sid = SID_NT_PROXY,
91                 .rtype = SID_NAME_WKN_GRP,
92         },
93         {
94                 .domain = "NT AUTHORITY",
95                 .name = "ServerLogon",
96                 .sid = SID_NT_ENTERPRISE_DCS,
97                 .rtype = SID_NAME_WKN_GRP,
98         },
99         {
100                 .domain = "NT AUTHORITY",
101                 .name = "Self",
102                 .sid = SID_NT_SELF,
103                 .rtype = SID_NAME_WKN_GRP,
104         },
105         {
106                 .domain = "NT AUTHORITY",
107                 .name = "Authenticated Users",
108                 .sid = SID_NT_AUTHENTICATED_USERS,
109                 .rtype = SID_NAME_WKN_GRP,
110         },
111         {
112                 .domain = "NT AUTHORITY",
113                 .name = "Restricted",
114                 .sid = SID_NT_RESTRICTED,
115                 .rtype = SID_NAME_WKN_GRP,
116         },
117         {
118                 .domain = "NT AUTHORITY",
119                 .name = "Terminal Server User",
120                 .sid = SID_NT_TERMINAL_SERVER_USERS,
121                 .rtype = SID_NAME_WKN_GRP,
122         },
123         {
124                 .domain = "NT AUTHORITY",
125                 .name = "Remote Interactive Logon",
126                 .sid = SID_NT_REMOTE_INTERACTIVE,
127                 .rtype = SID_NAME_WKN_GRP,
128         },
129         {
130                 .domain = "NT AUTHORITY",
131                 .name = "This Organization",
132                 .sid = SID_NT_THIS_ORGANISATION,
133                 .rtype = SID_NAME_WKN_GRP,
134         },
135         {
136                 .domain = "NT AUTHORITY",
137                 .name = "SYSTEM",
138                 .sid = SID_NT_SYSTEM,
139                 .rtype = SID_NAME_WKN_GRP,
140         },
141         {
142                 .domain = "NT AUTHORITY",
143                 .name = "Local Service",
144                 .sid = SID_NT_LOCAL_SERVICE,
145                 .rtype = SID_NAME_WKN_GRP,
146         },
147         {
148                 .domain = "NT AUTHORITY",
149                 .name = "Network Service",
150                 .sid = SID_NT_NETWORK_SERVICE,
151                 .rtype = SID_NAME_WKN_GRP,
152         },
153         {
154                 .domain = "NT AUTHORITY",
155                 .name = "Digest Authentication",
156                 .sid = SID_NT_DIGEST_AUTHENTICATION,
157                 .rtype = SID_NAME_WKN_GRP,
158         },
159         {
160                 .domain = "NT AUTHORITY",
161                 .name = "Enterprise Domain Controllers",
162                 .sid = SID_NT_ENTERPRISE_DCS,
163                 .rtype = SID_NAME_WKN_GRP,
164         },
165         {
166                 .domain = "NT AUTHORITY",
167                 .name = "NTLM Authentication",
168                 .sid = SID_NT_NTLM_AUTHENTICATION,
169                 .rtype = SID_NAME_WKN_GRP,
170         },
171         {
172                 .domain = "NT AUTHORITY",
173                 .name = "Other Organization",
174                 .sid = SID_NT_OTHER_ORGANISATION,
175                 .rtype = SID_NAME_WKN_GRP,
176         },
177         {
178                 .domain = "NT AUTHORITY",
179                 .name = "SChannel Authentication",
180                 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
181                 .rtype = SID_NAME_WKN_GRP,
182         },
183         {
184                 .domain = "NT AUTHORITY",
185                 .name = "IUSR",
186                 .sid = SID_NT_IUSR,
187                 .rtype = SID_NAME_WKN_GRP,
188         },
189         {
190                 .sid = NULL,
191         }
192 };
193
194 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195                                         const char *name, const char **authority_name, 
196                                         struct dom_sid **sid, uint32_t *rtype) 
197 {
198         int i;
199         for (i=0; well_known[i].sid; i++) {
200                 if (domain) {
201                         if (strcasecmp_m(domain, well_known[i].domain) == 0
202                             && strcasecmp_m(name, well_known[i].name) == 0) {
203                                 *authority_name = well_known[i].domain;
204                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
205                                 *rtype = well_known[i].rtype;
206                                 return NT_STATUS_OK;
207                         }
208                 } else {
209                         if (strcasecmp_m(name, well_known[i].name) == 0) {
210                                 *authority_name = well_known[i].domain;
211                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
212                                 *rtype = well_known[i].rtype;
213                                 return NT_STATUS_OK;
214                         }
215                 }
216         }
217         return NT_STATUS_NOT_FOUND;     
218 }
219
220 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx, 
221                                        const char *sid_str, const char **authority_name, 
222                                        const char **name, uint32_t *rtype) 
223 {
224         int i;
225         for (i=0; well_known[i].sid; i++) {
226                 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227                         *authority_name = well_known[i].domain;
228                         *name = well_known[i].name;
229                         *rtype = well_known[i].rtype;
230                         return NT_STATUS_OK;
231                 }
232         }
233         return NT_STATUS_NOT_FOUND;     
234 }
235
236 /*
237   lookup a SID for 1 name
238 */
239 static NTSTATUS dcesrv_lsa_lookup_name(struct tevent_context *ev_ctx, 
240                                        struct loadparm_context *lp_ctx,
241                                        struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242                                        const char *name, const char **authority_name, 
243                                        struct dom_sid **sid, enum lsa_SidType *rtype,
244                                        uint32_t *rid)
245 {
246         int ret, atype, i;
247         struct ldb_message **res;
248         const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
249         const char *p;
250         const char *domain;
251         const char *username;
252         struct ldb_dn *domain_dn;
253         struct dom_sid *domain_sid;
254         NTSTATUS status;
255
256         p = strchr_m(name, '\\');
257         if (p != NULL) {
258                 domain = talloc_strndup(mem_ctx, name, p-name);
259                 if (!domain) {
260                         return NT_STATUS_NO_MEMORY;
261                 }
262                 username = p + 1;
263         } else if (strchr_m(name, '@')) {
264                 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
265                 if (!NT_STATUS_IS_OK(status)) {
266                         DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
267                         return status;
268                 }
269         } else {
270                 domain = NULL;
271                 username = name;
272         }
273         
274         if (!domain) {
275                 /* Look up table of well known names */
276                 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
277                 if (NT_STATUS_IS_OK(status)) {
278                         dom_sid_split_rid(NULL, *sid, NULL, rid);
279                         return NT_STATUS_OK;
280                 }
281
282                 if (username == NULL) {
283                         *authority_name = NAME_BUILTIN;
284                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
285                         *rtype = SID_NAME_DOMAIN;
286                         *rid = 0xFFFFFFFF;
287                         return NT_STATUS_OK;
288                 }
289
290                 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) { 
291                         *authority_name = NAME_NT_AUTHORITY;
292                         *sid =  dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
293                         *rtype = SID_NAME_DOMAIN;
294                         dom_sid_split_rid(NULL, *sid, NULL, rid);
295                         return NT_STATUS_OK;
296                 }
297                 if (strcasecmp_m(username, NAME_BUILTIN) == 0) { 
298                         *authority_name = NAME_BUILTIN;
299                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
300                         *rtype = SID_NAME_DOMAIN;
301                         *rid = 0xFFFFFFFF;
302                         return NT_STATUS_OK;
303                 }
304                 if (strcasecmp_m(username, state->domain_dns) == 0) { 
305                         *authority_name = state->domain_name;
306                         *sid =  state->domain_sid;
307                         *rtype = SID_NAME_DOMAIN;
308                         *rid = 0xFFFFFFFF;
309                         return NT_STATUS_OK;
310                 }
311                 if (strcasecmp_m(username, state->domain_name) == 0) { 
312                         *authority_name = state->domain_name;
313                         *sid =  state->domain_sid;
314                         *rtype = SID_NAME_DOMAIN;
315                         *rid = 0xFFFFFFFF;
316                         return NT_STATUS_OK;
317                 }
318                 
319                 /* Perhaps this is a well known user? */
320                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
321                 if (!name) {
322                         return NT_STATUS_NO_MEMORY;
323                 }
324                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
325                 if (NT_STATUS_IS_OK(status)) {
326                         return status;
327                 }
328
329                 /* Perhaps this is a BUILTIN user? */
330                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
331                 if (!name) {
332                         return NT_STATUS_NO_MEMORY;
333                 }
334                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
335                 if (NT_STATUS_IS_OK(status)) {
336                         return status;
337                 }
338
339                 /* OK, I give up - perhaps we need to assume the user is in our domain? */
340                 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
341                 if (!name) {
342                         return NT_STATUS_NO_MEMORY;
343                 }
344                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
345                 if (NT_STATUS_IS_OK(status)) {
346                         return status;
347                 }
348
349                 return STATUS_SOME_UNMAPPED;
350         } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
351                 if (!*username) {
352                         *authority_name = NAME_NT_AUTHORITY;
353                         *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
354                         *rtype = SID_NAME_DOMAIN;
355                         dom_sid_split_rid(NULL, *sid, NULL, rid);
356                         return NT_STATUS_OK;
357                 }
358
359                 /* Look up table of well known names */
360                 status = lookup_well_known_names(mem_ctx, domain, username, authority_name, 
361                                                  sid, rtype);
362                 if (NT_STATUS_IS_OK(status)) {
363                         dom_sid_split_rid(NULL, *sid, NULL, rid);
364                 }
365                 return status;
366         } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
367                 *authority_name = NAME_BUILTIN;
368                 domain_dn = state->builtin_dn;
369         } else if (strcasecmp_m(domain, state->domain_dns) == 0) { 
370                 *authority_name = state->domain_name;
371                 domain_dn = state->domain_dn;
372         } else if (strcasecmp_m(domain, state->domain_name) == 0) { 
373                 *authority_name = state->domain_name;
374                 domain_dn = state->domain_dn;
375         } else {
376                 /* Not local, need to ask winbind in future */
377                 return STATUS_SOME_UNMAPPED;
378         }
379
380         ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
381         if (ret == 1) {
382                 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
383                 if (domain_sid == NULL) {
384                         return NT_STATUS_INVALID_SID;
385                 }
386         } else {
387                 return NT_STATUS_INVALID_SID;
388         }
389
390         if (!*username) {
391                 *sid = domain_sid;
392                 *rtype = SID_NAME_DOMAIN;
393                 *rid = 0xFFFFFFFF;
394                 return NT_STATUS_OK;
395         }
396         
397         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
398                            "(&(sAMAccountName=%s)(objectSid=*))", 
399                            ldb_binary_encode_string(mem_ctx, username));
400         if (ret == -1) {
401                 return NT_STATUS_INVALID_SID;
402         }
403
404         for (i=0; i < ret; i++) {
405                 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
406                 if (*sid == NULL) {
407                         return NT_STATUS_INVALID_SID;
408                 }
409
410                 /* Check that this is in the domain */
411                 if (!dom_sid_in_domain(domain_sid, *sid)) {
412                         continue;
413                 }
414
415                 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
416                         
417                 *rtype = ds_atype_map(atype);
418                 if (*rtype == SID_NAME_UNKNOWN) {
419                         return STATUS_SOME_UNMAPPED;
420                 }
421
422                 dom_sid_split_rid(NULL, *sid, NULL, rid);
423                 return NT_STATUS_OK;
424         }
425
426         /* need to check for an allocated sid */
427
428         return NT_STATUS_INVALID_SID;
429 }
430
431
432 /*
433   add to the lsa_RefDomainList for LookupSids and LookupNames
434 */
435 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx, 
436                                           enum lsa_SidType rtype,
437                                           const char *authority_name,
438                                           struct dom_sid *sid, 
439                                           struct lsa_RefDomainList *domains,
440                                           uint32_t *sid_index)
441 {
442         struct dom_sid *authority_sid;
443         int i;
444
445         if (rtype != SID_NAME_DOMAIN) {
446                 authority_sid = dom_sid_dup(mem_ctx, sid);
447                 if (authority_sid == NULL) {
448                         return NT_STATUS_NO_MEMORY;
449                 }
450                 authority_sid->num_auths--;
451         } else {
452                 authority_sid = sid;
453         }
454
455         /* see if we've already done this authority name */
456         for (i=0;i<domains->count;i++) {
457                 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
458                         *sid_index = i;
459                         return NT_STATUS_OK;
460                 }
461         }
462
463         domains->domains = talloc_realloc(domains, 
464                                           domains->domains,
465                                           struct lsa_DomainInfo,
466                                           domains->count+1);
467         if (domains->domains == NULL) {
468                 return NT_STATUS_NO_MEMORY;
469         }
470         domains->domains[i].name.string = authority_name;
471         domains->domains[i].sid         = authority_sid;
472         domains->count++;
473         domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
474         *sid_index = i;
475         
476         return NT_STATUS_OK;
477 }
478
479 /*
480   lookup a name for 1 SID
481 */
482 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
483                                       struct dom_sid *sid, const char *sid_str,
484                                       const char **authority_name, 
485                                       const char **name, enum lsa_SidType *rtype)
486 {
487         NTSTATUS status;
488         int ret;
489         uint32_t atype;
490         struct ldb_message **res;
491         struct ldb_dn *domain_dn;
492         const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
493
494         status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
495         if (NT_STATUS_IS_OK(status)) {
496                 return status;
497         }
498
499         if (dom_sid_in_domain(state->domain_sid, sid)) {
500                 *authority_name = state->domain_name;
501                 domain_dn = state->domain_dn;
502         } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
503                 *authority_name = NAME_BUILTIN;
504                 domain_dn = state->builtin_dn;
505         } else {
506                 /* Not well known, our domain or built in */
507
508                 /* In future, we must look at SID histories, and at trusted domains via winbind */
509
510                 return NT_STATUS_NOT_FOUND;
511         }
512
513         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
514                            "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
515         if (ret == 1) {
516                 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
517                 if (!*name) {
518                         *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
519                         if (!*name) {
520                                 *name = talloc_strdup(mem_ctx, sid_str);
521                                 NT_STATUS_HAVE_NO_MEMORY(*name);
522                         }
523                 }
524
525                 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
526
527                 *rtype = ds_atype_map(atype);
528
529                 return NT_STATUS_OK;
530         }
531
532         /* need to re-add a check for an allocated sid */
533
534         return NT_STATUS_NOT_FOUND;
535 }
536
537
538 /*
539   lsa_LookupSids2
540 */
541 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
542                                 TALLOC_CTX *mem_ctx,
543                                 struct lsa_LookupSids2 *r)
544 {
545         struct lsa_policy_state *state;
546         struct lsa_RefDomainList *domains = NULL;
547         int i;
548         NTSTATUS status = NT_STATUS_OK;
549
550         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
551             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
552                 return NT_STATUS_INVALID_PARAMETER;
553         }
554
555         *r->out.domains = NULL;
556
557         /* NOTE: the WSPP test suite tries SIDs with invalid revision numbers,
558            and expects NT_STATUS_INVALID_PARAMETER back - we just treat it as 
559            an unknown SID. We could add a SID validator here. (tridge) 
560            MS-DTYP 2.4.2
561         */
562
563         status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
564         if (!NT_STATUS_IS_OK(status)) {
565                 return status;
566         }
567
568         domains = talloc_zero(r->out.domains,  struct lsa_RefDomainList);
569         if (domains == NULL) {
570                 return NT_STATUS_NO_MEMORY;
571         }
572         *r->out.domains = domains;
573
574         r->out.names = talloc_zero(mem_ctx,  struct lsa_TransNameArray2);
575         if (r->out.names == NULL) {
576                 return NT_STATUS_NO_MEMORY;
577         }
578
579         *r->out.count = 0;
580
581         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2, 
582                                              r->in.sids->num_sids);
583         if (r->out.names->names == NULL) {
584                 return NT_STATUS_NO_MEMORY;
585         }
586
587         for (i=0;i<r->in.sids->num_sids;i++) {
588                 struct dom_sid *sid = r->in.sids->sids[i].sid;
589                 char *sid_str = dom_sid_string(mem_ctx, sid);
590                 const char *name, *authority_name;
591                 enum lsa_SidType rtype;
592                 uint32_t sid_index;
593                 NTSTATUS status2;
594
595                 r->out.names->count++;
596
597                 r->out.names->names[i].sid_type    = SID_NAME_UNKNOWN;
598                 r->out.names->names[i].name.string = sid_str;
599                 r->out.names->names[i].sid_index   = 0xFFFFFFFF;
600                 r->out.names->names[i].unknown     = 0;
601
602                 if (sid_str == NULL) {
603                         r->out.names->names[i].name.string = "(SIDERROR)";
604                         status = STATUS_SOME_UNMAPPED;
605                         continue;
606                 }
607
608                 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str, 
609                                                 &authority_name, &name, &rtype);
610                 if (!NT_STATUS_IS_OK(status2)) {
611                         status = STATUS_SOME_UNMAPPED;
612                         continue;
613                 }
614
615                 /* set up the authority table */
616                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, 
617                                                     authority_name, sid, 
618                                                     domains, &sid_index);
619                 if (!NT_STATUS_IS_OK(status2)) {
620                         continue;
621                 }
622
623                 r->out.names->names[i].sid_type    = rtype;
624                 r->out.names->names[i].name.string = name;
625                 r->out.names->names[i].sid_index   = sid_index;
626                 r->out.names->names[i].unknown     = 0;
627
628                 (*r->out.count)++;
629         }
630
631         if (*r->out.count == 0) {
632                 return NT_STATUS_NONE_MAPPED;
633         }
634         if (*r->out.count != r->in.sids->num_sids) {
635                 return STATUS_SOME_UNMAPPED;
636         }
637
638         return NT_STATUS_OK;
639 }
640
641
642 /*
643   lsa_LookupSids3
644
645   Identical to LookupSids2, but doesn't take a policy handle
646   
647 */
648 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
649                                 TALLOC_CTX *mem_ctx,
650                                 struct lsa_LookupSids3 *r)
651 {
652         struct lsa_LookupSids2 r2;
653         struct lsa_OpenPolicy2 pol;
654         NTSTATUS status;
655         struct dcesrv_handle *h;
656
657         ZERO_STRUCT(r2);
658         
659         /* No policy handle on the wire, so make one up here */
660         r2.in.handle = talloc(mem_ctx, struct policy_handle);
661         if (!r2.in.handle) {
662                 return NT_STATUS_NO_MEMORY;
663         }
664
665         pol.out.handle = r2.in.handle;
666         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
667         pol.in.attr = NULL;
668         pol.in.system_name = NULL;
669         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
670         if (!NT_STATUS_IS_OK(status)) {
671                 return status;
672         }
673
674         /* ensure this handle goes away at the end of this call */
675         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
676         talloc_steal(mem_ctx, h);
677
678         r2.in.sids     = r->in.sids;
679         r2.in.names    = r->in.names;
680         r2.in.level    = r->in.level;
681         r2.in.count    = r->in.count;
682         r2.in.lookup_options = r->in.lookup_options;
683         r2.in.client_revision = r->in.client_revision;
684         r2.out.count   = r->out.count;
685         r2.out.names   = r->out.names;
686         r2.out.domains = r->out.domains;
687
688         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
689
690         r->out.domains = r2.out.domains;
691         r->out.names   = r2.out.names;
692         r->out.count   = r2.out.count;
693
694         return status;
695 }
696
697
698 /* 
699   lsa_LookupSids 
700 */
701 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
702                                struct lsa_LookupSids *r)
703 {
704         struct lsa_LookupSids2 r2;
705         NTSTATUS status;
706         int i;
707
708         ZERO_STRUCT(r2);
709
710         r2.in.handle   = r->in.handle;
711         r2.in.sids     = r->in.sids;
712         r2.in.names    = NULL;
713         r2.in.level    = r->in.level;
714         r2.in.count    = r->in.count;
715         r2.in.lookup_options = 0;
716         r2.in.client_revision = 0;
717         r2.out.count   = r->out.count;
718         r2.out.names   = NULL;
719         r2.out.domains = r->out.domains;
720
721         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
722         /* we deliberately don't check for error from the above,
723            as even on error we are supposed to return the names  */
724
725         r->out.domains = r2.out.domains;
726         if (!r2.out.names) {
727                 r->out.names = NULL;
728                 return status;
729         }
730
731         r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
732         if (r->out.names == NULL) {
733                 return NT_STATUS_NO_MEMORY;
734         }
735         r->out.names->count = r2.out.names->count;
736         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName, 
737                                              r->out.names->count);
738         if (r->out.names->names == NULL) {
739                 return NT_STATUS_NO_MEMORY;
740         }
741         for (i=0;i<r->out.names->count;i++) {
742                 r->out.names->names[i].sid_type    = r2.out.names->names[i].sid_type;
743                 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
744                 r->out.names->names[i].sid_index   = r2.out.names->names[i].sid_index;
745         }
746
747         return status;
748 }
749
750
751 /*
752   lsa_LookupNames3
753 */
754 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
755                                  TALLOC_CTX *mem_ctx,
756                                  struct lsa_LookupNames3 *r)
757 {
758         struct lsa_policy_state *policy_state;
759         struct dcesrv_handle *policy_handle;
760         int i;
761         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
762         struct lsa_RefDomainList *domains;
763
764         DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
765
766         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
767             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
768                 return NT_STATUS_INVALID_PARAMETER;
769         }
770
771         policy_state = policy_handle->data;
772
773         *r->out.domains = NULL;
774
775         domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
776         if (domains == NULL) {
777                 return NT_STATUS_NO_MEMORY;
778         }
779         *r->out.domains = domains;
780
781         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray3);
782         if (r->out.sids == NULL) {
783                 return NT_STATUS_NO_MEMORY;
784         }
785
786         *r->out.count = 0;
787
788         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3, 
789                                            r->in.num_names);
790         if (r->out.sids->sids == NULL) {
791                 return NT_STATUS_NO_MEMORY;
792         }
793
794         for (i=0;i<r->in.num_names;i++) {
795                 const char *name = r->in.names[i].string;
796                 const char *authority_name;
797                 struct dom_sid *sid;
798                 uint32_t sid_index, rid;
799                 enum lsa_SidType rtype;
800                 NTSTATUS status2;
801
802                 r->out.sids->count++;
803
804                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
805                 r->out.sids->sids[i].sid         = NULL;
806                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
807                 r->out.sids->sids[i].flags       = 0;
808
809                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name, 
810                                                  &authority_name, &sid, &rtype, &rid);
811                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
812                         continue;
813                 }
814
815                 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name, 
816                                                     sid, domains, &sid_index);
817                 if (!NT_STATUS_IS_OK(status2)) {
818                         continue;
819                 }
820
821                 r->out.sids->sids[i].sid_type    = rtype;
822                 r->out.sids->sids[i].sid         = sid;
823                 r->out.sids->sids[i].sid_index   = sid_index;
824                 r->out.sids->sids[i].flags       = 0;
825
826                 (*r->out.count)++;
827         }
828         
829         if (*r->out.count == 0) {
830                 return NT_STATUS_NONE_MAPPED;
831         }
832         if (*r->out.count != r->in.num_names) {
833                 return STATUS_SOME_UNMAPPED;
834         }
835
836         return NT_STATUS_OK;
837 }
838
839 /* 
840   lsa_LookupNames4
841
842   Identical to LookupNames3, but doesn't take a policy handle
843   
844 */
845 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
846                                  struct lsa_LookupNames4 *r)
847 {
848         struct lsa_LookupNames3 r2;
849         struct lsa_OpenPolicy2 pol;
850         NTSTATUS status;
851         struct dcesrv_handle *h;
852
853         ZERO_STRUCT(r2);
854
855         /* No policy handle on the wire, so make one up here */
856         r2.in.handle = talloc(mem_ctx, struct policy_handle);
857         if (!r2.in.handle) {
858                 return NT_STATUS_NO_MEMORY;
859         }
860
861         pol.out.handle = r2.in.handle;
862         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
863         pol.in.attr = NULL;
864         pol.in.system_name = NULL;
865         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
866         if (!NT_STATUS_IS_OK(status)) {
867                 return status;
868         }
869
870         /* ensure this handle goes away at the end of this call */
871         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
872         talloc_steal(mem_ctx, h);
873
874         r2.in.num_names = r->in.num_names;
875         r2.in.names = r->in.names;
876         r2.in.level = r->in.level;
877         r2.in.sids = r->in.sids;
878         r2.in.count = r->in.count;
879         r2.in.lookup_options = r->in.lookup_options;
880         r2.in.client_revision = r->in.client_revision;
881         r2.out.domains = r->out.domains;
882         r2.out.sids = r->out.sids;
883         r2.out.count = r->out.count;
884         
885         status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
886         
887         r->out.domains = r2.out.domains;
888         r->out.sids = r2.out.sids;
889         r->out.count = r2.out.count;
890         return status;
891 }
892
893 /*
894   lsa_LookupNames2
895 */
896 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
897                                  TALLOC_CTX *mem_ctx,
898                                  struct lsa_LookupNames2 *r)
899 {
900         struct lsa_policy_state *state;
901         struct dcesrv_handle *h;
902         int i;
903         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
904         struct lsa_RefDomainList *domains;
905
906         *r->out.domains = NULL;
907
908         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
909
910         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
911             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
912                 return NT_STATUS_INVALID_PARAMETER;
913         }
914
915         state = h->data;
916
917         domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
918         if (domains == NULL) {
919                 return NT_STATUS_NO_MEMORY;
920         }
921         *r->out.domains = domains;
922
923         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray2);
924         if (r->out.sids == NULL) {
925                 return NT_STATUS_NO_MEMORY;
926         }
927
928         *r->out.count = 0;
929
930         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2, 
931                                            r->in.num_names);
932         if (r->out.sids->sids == NULL) {
933                 return NT_STATUS_NO_MEMORY;
934         }
935
936         for (i=0;i<r->in.num_names;i++) {
937                 const char *name = r->in.names[i].string;
938                 const char *authority_name;
939                 struct dom_sid *sid;
940                 uint32_t rtype, sid_index, rid=0;
941                 NTSTATUS status2;
942
943                 r->out.sids->count++;
944
945                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
946                 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
947                    to sid NULL - so we should return 0 rid for
948                    unmapped entries */
949                 r->out.sids->sids[i].rid         = 0;
950                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
951                 r->out.sids->sids[i].unknown     = 0;
952
953                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name, 
954                                                  &authority_name, &sid, &rtype, &rid);
955                 if (!NT_STATUS_IS_OK(status2)) {
956                         continue;
957                 }
958
959                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name, 
960                                                     sid, domains, &sid_index);
961                 if (!NT_STATUS_IS_OK(status2)) {
962                         continue;
963                 }
964
965                 r->out.sids->sids[i].sid_type    = rtype;
966                 r->out.sids->sids[i].rid         = rid;
967                 r->out.sids->sids[i].sid_index   = sid_index;
968                 r->out.sids->sids[i].unknown     = 0;
969
970                 (*r->out.count)++;
971         }
972         
973         if (*r->out.count == 0) {
974                 return NT_STATUS_NONE_MAPPED;
975         }
976         if (*r->out.count != r->in.num_names) {
977                 return STATUS_SOME_UNMAPPED;
978         }
979
980         return NT_STATUS_OK;
981 }
982
983 /* 
984   lsa_LookupNames 
985 */
986 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
987                        struct lsa_LookupNames *r)
988 {
989         struct lsa_LookupNames2 r2;
990         NTSTATUS status;
991         int i;
992
993         ZERO_STRUCT(r2);
994
995         r2.in.handle    = r->in.handle;
996         r2.in.num_names = r->in.num_names;
997         r2.in.names     = r->in.names;
998         r2.in.sids      = NULL;
999         r2.in.level     = r->in.level;
1000         r2.in.count     = r->in.count;
1001         r2.in.lookup_options = 0;
1002         r2.in.client_revision = 0;
1003         r2.out.count    = r->out.count;
1004         r2.out.domains  = r->out.domains;
1005
1006         status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
1007         if (r2.out.sids == NULL) {
1008                 return status;
1009         }
1010
1011         r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
1012         if (r->out.sids == NULL) {
1013                 return NT_STATUS_NO_MEMORY;
1014         }
1015         r->out.sids->count = r2.out.sids->count;
1016         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid, 
1017                                            r->out.sids->count);
1018         if (r->out.sids->sids == NULL) {
1019                 return NT_STATUS_NO_MEMORY;
1020         }
1021         for (i=0;i<r->out.sids->count;i++) {
1022                 r->out.sids->sids[i].sid_type    = r2.out.sids->sids[i].sid_type;
1023                 r->out.sids->sids[i].rid         = r2.out.sids->sids[i].rid;
1024                 r->out.sids->sids[i].sid_index   = r2.out.sids->sids[i].sid_index;
1025         }
1026
1027         return status;
1028 }
1029