s3-secdesc: use SEC_FLAG_MAXIMUM_ALLOWED instead of SEC_RIGHTS_MAXIMUM_ALLOWED.

[jra/samba/.git] / source3 / rpcclient / cmd_samr.c

diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c
index 426e7e97448df7bd560989a808dcc5fc10d6c558..96484f09824ff05204108d445f162518de0a5d38 100644 (file)
--- a/source3/rpcclient/cmd_samr.c
+++ b/source3/rpcclient/cmd_samr.c
@@ -24,6 +24,7 @@
 
 #include "includes.h"
 #include "rpcclient.h"
+#include "../libcli/auth/libcli_auth.h"
 
 extern DOM_SID domain_sid;
 
@@ -299,7 +300,7 @@ static NTSTATUS cmd_samr_query_user(struct rpc_pipe_client *cli,
                                     TALLOC_CTX *mem_ctx,
                                     int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, user_pol;
+       struct policy_handle connect_pol, domain_pol, user_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 info_level = 21;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -487,7 +488,7 @@ static NTSTATUS cmd_samr_query_group(struct rpc_pipe_client *cli,
                                      TALLOC_CTX *mem_ctx,
                                      int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, group_pol;
+       struct policy_handle connect_pol, domain_pol, group_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        enum samr_GroupInfoEnum info_level = GROUPINFOALL;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -555,7 +556,7 @@ static NTSTATUS cmd_samr_query_usergroups(struct rpc_pipe_client *cli,
                                           TALLOC_CTX *mem_ctx,
                                           int argc, const char **argv)
 {
-       POLICY_HND              connect_pol,
+       struct policy_handle            connect_pol,
                                domain_pol,
                                user_pol;
        NTSTATUS                result = NT_STATUS_UNSUCCESSFUL;
@@ -624,7 +625,7 @@ static NTSTATUS cmd_samr_query_useraliases(struct rpc_pipe_client *cli,
                                           TALLOC_CTX *mem_ctx,
                                           int argc, const char **argv)
 {
-       POLICY_HND              connect_pol, domain_pol;
+       struct policy_handle            connect_pol, domain_pol;
        NTSTATUS                result = NT_STATUS_UNSUCCESSFUL;
        DOM_SID                *sids;
        size_t                     num_sids;
@@ -709,7 +710,7 @@ static NTSTATUS cmd_samr_query_groupmem(struct rpc_pipe_client *cli,
                                         TALLOC_CTX *mem_ctx,
                                         int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, group_pol;
+       struct policy_handle connect_pol, domain_pol, group_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 group_rid;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -783,13 +784,12 @@ static NTSTATUS cmd_samr_enum_dom_users(struct rpc_pipe_client *cli,
                                        TALLOC_CTX *mem_ctx,
                                        int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 start_idx, size, num_dom_users, i;
        struct samr_SamArray *dom_users = NULL;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
        uint32 acb_mask = ACB_NORMAL;
-       bool got_connect_pol = False, got_domain_pol = False;
 
        if ((argc < 1) || (argc > 3)) {
                printf("Usage: %s [access_mask] [acb_mask]\n", argv[0]);
@@ -811,8 +811,6 @@ static NTSTATUS cmd_samr_enum_dom_users(struct rpc_pipe_client *cli,
        if (!NT_STATUS_IS_OK(result))
                goto done;
 
-       got_connect_pol = True;
-
        /* Get domain policy handle */
 
        result = rpccli_samr_OpenDomain(cli, mem_ctx,
@@ -824,8 +822,6 @@ static NTSTATUS cmd_samr_enum_dom_users(struct rpc_pipe_client *cli,
        if (!NT_STATUS_IS_OK(result))
                goto done;
 
-       got_domain_pol = True;
-
        /* Enumerate domain users */
 
        start_idx = 0;
@@ -852,10 +848,10 @@ static NTSTATUS cmd_samr_enum_dom_users(struct rpc_pipe_client *cli,
        } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
 
  done:
-       if (got_domain_pol)
+       if (is_valid_policy_hnd(&domain_pol))
                rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 
-       if (got_connect_pol)
+       if (is_valid_policy_hnd(&connect_pol))
                rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 
        return result;
@@ -867,12 +863,11 @@ static NTSTATUS cmd_samr_enum_dom_groups(struct rpc_pipe_client *cli,
                                          TALLOC_CTX *mem_ctx,
                                          int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 start_idx, size, num_dom_groups, i;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
        struct samr_SamArray *dom_groups = NULL;
-       bool got_connect_pol = False, got_domain_pol = False;
 
        if ((argc < 1) || (argc > 2)) {
                printf("Usage: %s [access_mask]\n", argv[0]);
@@ -891,8 +886,6 @@ static NTSTATUS cmd_samr_enum_dom_groups(struct rpc_pipe_client *cli,
        if (!NT_STATUS_IS_OK(result))
                goto done;
 
-       got_connect_pol = True;
-
        /* Get domain policy handle */
 
        result = rpccli_samr_OpenDomain(cli, mem_ctx,
@@ -904,8 +897,6 @@ static NTSTATUS cmd_samr_enum_dom_groups(struct rpc_pipe_client *cli,
        if (!NT_STATUS_IS_OK(result))
                goto done;
 
-       got_domain_pol = True;
-
        /* Enumerate domain groups */
 
        start_idx = 0;
@@ -930,10 +921,10 @@ static NTSTATUS cmd_samr_enum_dom_groups(struct rpc_pipe_client *cli,
        } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
 
  done:
-       if (got_domain_pol)
+       if (is_valid_policy_hnd(&domain_pol))
                rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 
-       if (got_connect_pol)
+       if (is_valid_policy_hnd(&connect_pol))
                rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 
        return result;
@@ -945,12 +936,11 @@ static NTSTATUS cmd_samr_enum_als_groups(struct rpc_pipe_client *cli,
                                          TALLOC_CTX *mem_ctx,
                                          int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 start_idx, size, num_als_groups, i;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
        struct samr_SamArray *als_groups = NULL;
-       bool got_connect_pol = False, got_domain_pol = False;
 
        if ((argc < 2) || (argc > 3)) {
                printf("Usage: %s builtin|domain [access mask]\n", argv[0]);
@@ -969,8 +959,6 @@ static NTSTATUS cmd_samr_enum_als_groups(struct rpc_pipe_client *cli,
        if (!NT_STATUS_IS_OK(result))
                goto done;
 
-       got_connect_pol = True;
-
        /* Get domain policy handle */
 
        result = get_domain_handle(cli, mem_ctx, argv[1],
@@ -982,8 +970,6 @@ static NTSTATUS cmd_samr_enum_als_groups(struct rpc_pipe_client *cli,
        if (!NT_STATUS_IS_OK(result))
                goto done;
 
-       got_domain_pol = True;
-
        /* Enumerate alias groups */
 
        start_idx = 0;
@@ -1008,10 +994,10 @@ static NTSTATUS cmd_samr_enum_als_groups(struct rpc_pipe_client *cli,
        } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
 
  done:
-       if (got_domain_pol)
+       if (is_valid_policy_hnd(&domain_pol))
                rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 
-       if (got_connect_pol)
+       if (is_valid_policy_hnd(&connect_pol))
                rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 
        return result;
@@ -1023,11 +1009,10 @@ static NTSTATUS cmd_samr_enum_domains(struct rpc_pipe_client *cli,
                                      TALLOC_CTX *mem_ctx,
                                      int argc, const char **argv)
 {
-       POLICY_HND connect_pol;
+       struct policy_handle connect_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 start_idx, size, num_entries, i;
        uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
-       bool got_connect_pol = false;
        struct samr_SamArray *sam = NULL;
 
        if ((argc < 1) || (argc > 2)) {
@@ -1049,8 +1034,6 @@ static NTSTATUS cmd_samr_enum_domains(struct rpc_pipe_client *cli,
                goto done;
        }
 
-       got_connect_pol = true;
-
        /* Enumerate alias groups */
 
        start_idx = 0;
@@ -1075,7 +1058,7 @@ static NTSTATUS cmd_samr_enum_domains(struct rpc_pipe_client *cli,
        } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
 
  done:
-       if (got_connect_pol) {
+       if (is_valid_policy_hnd(&connect_pol)) {
                rpccli_samr_Close(cli, mem_ctx, &connect_pol);
        }
 
@@ -1089,7 +1072,7 @@ static NTSTATUS cmd_samr_query_aliasmem(struct rpc_pipe_client *cli,
                                         TALLOC_CTX *mem_ctx,
                                         int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, alias_pol;
+       struct policy_handle connect_pol, domain_pol, alias_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 alias_rid, i;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -1162,7 +1145,7 @@ static NTSTATUS cmd_samr_query_aliasinfo(struct rpc_pipe_client *cli,
                                         TALLOC_CTX *mem_ctx,
                                         int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, alias_pol;
+       struct policy_handle connect_pol, domain_pol, alias_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32_t alias_rid;
        uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
@@ -1257,7 +1240,7 @@ static NTSTATUS cmd_samr_delete_alias(struct rpc_pipe_client *cli,
                                      TALLOC_CTX *mem_ctx,
                                      int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, alias_pol;
+       struct policy_handle connect_pol, domain_pol, alias_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 alias_rid;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -1338,7 +1321,7 @@ static NTSTATUS cmd_samr_query_dispinfo_internal(struct rpc_pipe_client *cli,
                                                 int argc, const char **argv,
                                                 uint32_t opcode)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 start_idx=0, max_entries=250, max_size = 0xffff, num_entries = 0, i;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -1530,7 +1513,7 @@ static NTSTATUS cmd_samr_query_dominfo(struct rpc_pipe_client *cli,
                                        TALLOC_CTX *mem_ctx,
                                        int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 switch_level = 2;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -1633,7 +1616,7 @@ static NTSTATUS cmd_samr_create_dom_user(struct rpc_pipe_client *cli,
                                          TALLOC_CTX *mem_ctx,
                                          int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, user_pol;
+       struct policy_handle connect_pol, domain_pol, user_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        struct lsa_String acct_name;
        uint32 acb_info;
@@ -1711,7 +1694,7 @@ static NTSTATUS cmd_samr_create_dom_group(struct rpc_pipe_client *cli,
                                           TALLOC_CTX *mem_ctx,
                                           int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, group_pol;
+       struct policy_handle connect_pol, domain_pol, group_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        struct lsa_String grp_name;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -1777,7 +1760,7 @@ static NTSTATUS cmd_samr_create_dom_alias(struct rpc_pipe_client *cli,
                                           TALLOC_CTX *mem_ctx,
                                           int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, alias_pol;
+       struct policy_handle connect_pol, domain_pol, alias_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        struct lsa_String alias_name;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -1845,7 +1828,7 @@ static NTSTATUS cmd_samr_lookup_names(struct rpc_pipe_client *cli,
                                       int argc, const char **argv)
 {
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        uint32 num_names;
        struct samr_Ids rids, name_types;
        int i;
@@ -1920,7 +1903,7 @@ static NTSTATUS cmd_samr_lookup_rids(struct rpc_pipe_client *cli,
                                      int argc, const char **argv)
 {
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        uint32_t num_rids, *rids;
        struct lsa_Strings names;
        struct samr_Ids types;
@@ -1995,7 +1978,7 @@ static NTSTATUS cmd_samr_delete_dom_group(struct rpc_pipe_client *cli,
                                          int argc, const char **argv)
 {
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-       POLICY_HND connect_pol, domain_pol, group_pol;
+       struct policy_handle connect_pol, domain_pol, group_pol;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 
        if ((argc < 2) || (argc > 3)) {
@@ -2076,7 +2059,7 @@ static NTSTATUS cmd_samr_delete_dom_user(struct rpc_pipe_client *cli,
                                          int argc, const char **argv)
 {
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-       POLICY_HND connect_pol, domain_pol, user_pol;
+       struct policy_handle connect_pol, domain_pol, user_pol;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 
        if ((argc < 2) || (argc > 3)) {
@@ -2158,7 +2141,7 @@ static NTSTATUS cmd_samr_query_sec_obj(struct rpc_pipe_client *cli,
                                     TALLOC_CTX *mem_ctx,
                                     int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, user_pol, *pol;
+       struct policy_handle connect_pol, domain_pol, user_pol, *pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 sec_info = DACL_SECURITY_INFORMATION;
        uint32 user_rid = 0;
@@ -2248,7 +2231,7 @@ static NTSTATUS cmd_samr_get_usrdom_pwinfo(struct rpc_pipe_client *cli,
                                           int argc, const char **argv)
 {
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
-       POLICY_HND connect_pol, domain_pol, user_pol;
+       struct policy_handle connect_pol, domain_pol, user_pol;
        struct samr_PwInfo info;
        uint32_t rid;
 
@@ -2334,7 +2317,7 @@ static NTSTATUS cmd_samr_lookup_domain(struct rpc_pipe_client *cli,
                                       TALLOC_CTX *mem_ctx,
                                       int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
        fstring sid_string;
@@ -2387,7 +2370,7 @@ static NTSTATUS cmd_samr_chgpasswd(struct rpc_pipe_client *cli,
                                   TALLOC_CTX *mem_ctx,
                                   int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol, user_pol;
+       struct policy_handle connect_pol, domain_pol, user_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        const char *user, *oldpass, *newpass;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -2479,7 +2462,7 @@ static NTSTATUS cmd_samr_chgpasswd2(struct rpc_pipe_client *cli,
                                    TALLOC_CTX *mem_ctx,
                                    int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        const char *user, *oldpass, *newpass;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -2536,7 +2519,7 @@ static NTSTATUS cmd_samr_chgpasswd3(struct rpc_pipe_client *cli,
                                    TALLOC_CTX *mem_ctx,
                                    int argc, const char **argv)
 {
-       POLICY_HND connect_pol, domain_pol;
+       struct policy_handle connect_pol, domain_pol;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        const char *user, *oldpass, *newpass;
        uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -2622,7 +2605,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
                                         int argc, const char **argv,
                                         int opcode)
 {
-       POLICY_HND connect_pol, domain_pol, user_pol;
+       struct policy_handle connect_pol, domain_pol, user_pol;
        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
        const char *user, *param;
        uint32_t access_mask = MAXIMUM_ALLOWED_ACCESS;
@@ -2676,10 +2659,12 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
                        memcpy(lm_hash, out.data, out.length);
                }
 
-               init_samr_user_info18(&info.info18,
-                                     lm_hash,
-                                     nt_hash,
-                                     password_expired);
+               memcpy(info.info18.nt_pwd.hash, nt_hash, 16);
+               memcpy(info.info18.lm_pwd.hash, lm_hash, 16);
+               info.info18.nt_pwd_active       = true;
+               info.info18.lm_pwd_active       = true;
+               info.info18.password_expired    = password_expired;
+
                break;
        case 21:
                ZERO_STRUCT(info.info21);
@@ -2731,9 +2716,9 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
 
                break;
        case 24:
-               init_samr_user_info24(&info.info24,
-                                     &pwd_buf,
-                                     password_expired);
+               info.info24.password            = pwd_buf;
+               info.info24.password_expired    = password_expired;
+
                break;
        case 25:
                ZERO_STRUCT(info.info25);
@@ -2749,9 +2734,9 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli,
 
                break;
        case 26:
-               init_samr_user_info26(&info.info26,
-                                     &pwd_buf_ex,
-                                     password_expired);
+               info.info26.password            = pwd_buf_ex;
+               info.info26.password_expired    = password_expired;
+
                break;
        default:
                return NT_STATUS_INVALID_INFO_CLASS;
@@ -2875,7 +2860,7 @@ static NTSTATUS cmd_samr_get_dispinfo_idx(struct rpc_pipe_client *cli,
        }
 
        status = rpccli_try_samr_connects(cli, mem_ctx,
-                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
+                                         SEC_FLAG_MAXIMUM_ALLOWED,
                                          &connect_handle);
 
        if (!NT_STATUS_IS_OK(status)) {
@@ -2884,7 +2869,7 @@ static NTSTATUS cmd_samr_get_dispinfo_idx(struct rpc_pipe_client *cli,
 
        status = rpccli_samr_OpenDomain(cli, mem_ctx,
                                        &connect_handle,
-                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
+                                       SEC_FLAG_MAXIMUM_ALLOWED,
                                        &domain_sid,
                                        &domain_handle);