2 * Unix SMB/Netbios implementation.
4 * RPC Pipe client / server routines
5 * Copyright (C) Andrew Tridgell 1992-1998
6 * Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
7 * Copyright (C) Paul Ashton 1997-1998.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 /* this module apparently provides an implementation of DCE/RPC over a
25 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
26 * documentation are available (in on-line form) from the X-Open group.
28 * this module should provide a level of abstraction between SMB
29 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
30 * data copies, and network traffic.
32 * in this version, which takes a "let's learn what's going on and
33 * get something running" approach, there is additional network
34 * traffic generated, but the code should be easier to understand...
36 * ... if you read the docs. or stare at packets for weeks on end.
43 * A list of the rids of well known BUILTIN and Domain users
47 rid_name builtin_alias_rids[] =
49 { BUILTIN_ALIAS_RID_ADMINS , "Administrators" },
50 { BUILTIN_ALIAS_RID_USERS , "Users" },
51 { BUILTIN_ALIAS_RID_GUESTS , "Guests" },
52 { BUILTIN_ALIAS_RID_POWER_USERS , "Power Users" },
54 { BUILTIN_ALIAS_RID_ACCOUNT_OPS , "Account Operators" },
55 { BUILTIN_ALIAS_RID_SYSTEM_OPS , "System Operators" },
56 { BUILTIN_ALIAS_RID_PRINT_OPS , "Print Operators" },
57 { BUILTIN_ALIAS_RID_BACKUP_OPS , "Backup Operators" },
58 { BUILTIN_ALIAS_RID_REPLICATOR , "Replicator" },
62 /* array lookup of well-known Domain RID users. */
63 rid_name domain_user_rids[] =
65 { DOMAIN_USER_RID_ADMIN , "Administrator" },
66 { DOMAIN_USER_RID_GUEST , "Guest" },
70 /* array lookup of well-known Domain RID groups. */
71 rid_name domain_group_rids[] =
73 { DOMAIN_GROUP_RID_ADMINS , "Domain Admins" },
74 { DOMAIN_GROUP_RID_USERS , "Domain Users" },
75 { DOMAIN_GROUP_RID_GUESTS , "Domain Guests" },
79 int make_dom_gids(TALLOC_CTX *ctx, char *gids_str, DOM_GID **ppgids)
88 DEBUG(4,("make_dom_gids: %s\n", gids_str));
90 if (gids_str == NULL || *gids_str == 0)
93 for (count = 0, ptr = gids_str;
94 next_token(&ptr, s2, NULL, sizeof(s2));
98 gids = (DOM_GID *)talloc(ctx, sizeof(DOM_GID) * count );
101 DEBUG(0,("make_dom_gids: talloc fail !\n"));
105 for (count = 0, ptr = gids_str;
106 next_token(&ptr, s2, NULL, sizeof(s2)) &&
107 count < LSA_MAX_GROUPS;
110 /* the entries are of the form GID/ATTR, ATTR being optional.*/
115 attr = strchr_m(s2,'/');
120 attr = "7"; /* default value for attribute is 7 */
122 /* look up the RID string and see if we can turn it into a rid number */
123 for (i = 0; builtin_alias_rids[i].name != NULL; i++)
125 if (strequal(builtin_alias_rids[i].name, s2))
127 rid = builtin_alias_rids[i].rid;
137 DEBUG(1,("make_dom_gids: unknown well-known alias RID %s/%s\n", s2, attr));
142 gids[count].g_rid = rid;
143 gids[count].attr = atoi(attr);
145 DEBUG(5,("group id: %d attr: %d\n", gids[count].g_rid, gids[count].attr));
153 /*******************************************************************
154 gets a domain user's groups
155 ********************************************************************/
156 BOOL new_get_domain_user_groups(TALLOC_CTX *ctx, int *numgroups, DOM_GID **pgids, SAM_ACCOUNT *sam_pass)
159 int i, num, num_entries, cur_gid=0;
166 fstrcpy(user_name, pdb_get_username(sam_pass));
167 grid=pdb_get_group_rid(sam_pass);
169 DEBUG(10,("new_get_domain_user_groups: searching domain groups [%s] is a member of\n", user_name));
171 /* first get the list of the domain groups */
172 if (!enum_group_mapping(SID_NAME_DOM_GRP, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV))
174 DEBUG(10,("new_get_domain_user_groups: there are %d mapped groups\n", num_entries));
178 * alloc memory. In the worse case, we alloc memory for nothing.
179 * but I prefer to alloc for nothing
180 * than reallocing everytime.
182 gids = (DOM_GID *)talloc(ctx, sizeof(DOM_GID) * num_entries);
184 /* for each group, check if the user is a member of*/
185 for(i=0; i<num_entries; i++) {
186 if ((grp=getgrgid(map[i].gid)) == NULL) {
188 DEBUG(5,("new_get_domain_user_groups: gid %d doesn't exist anymore !\n", (int)map[i].gid));
192 for(num=0; grp->gr_mem[num]!=NULL; num++) {
193 if(strcmp(grp->gr_mem[num], user_name)==0) {
194 /* we found the user, add the group to the list */
195 sid_peek_rid(&map[i].sid, &(gids[cur_gid].g_rid));
196 gids[cur_gid].attr=map[i].sid_name_use;
197 DEBUG(10,("new_get_domain_user_groups: user found in group %s\n", map[i].nt_name));
204 /* we have checked the groups */
205 /* we must now check the gid of the user or the primary group rid, that's the same */
206 for (i=0; i<cur_gid && grid!=gids[i].g_rid; i++)
209 /* the user's gid is already there */
214 for(i=0; i<num_entries; i++) {
215 sid_peek_rid(&map[i].sid, &tmp_rid);
217 gids[cur_gid].g_rid=tmp_rid;
218 gids[cur_gid].attr=map[i].sid_name_use;
219 DEBUG(10,("new_get_domain_user_groups: primary gid of user found in group %s\n", map[i].nt_name));
221 goto done; /* leave the loop early */
232 /*******************************************************************
233 gets a domain user's groups
234 ********************************************************************/
235 void get_domain_user_groups(char *domain_groups, const char *user)
239 if (domain_groups == NULL || user == NULL) return;
241 /* can only be a user or a guest. cannot be guest _and_ admin */
242 if (user_in_list(user, lp_domain_guest_group()))
244 slprintf(tmp, sizeof(tmp) - 1, " %ld/7 ", DOMAIN_GROUP_RID_GUESTS);
245 pstrcat(domain_groups, tmp);
247 DEBUG(3,("domain guest group access %s granted\n", tmp));
251 slprintf(tmp, sizeof(tmp) -1, " %ld/7 ", DOMAIN_GROUP_RID_USERS);
252 pstrcat(domain_groups, tmp);
254 DEBUG(3,("domain group access %s granted\n", tmp));
256 if (user_in_list(user, lp_domain_admin_group()))
258 slprintf(tmp, sizeof(tmp) - 1, " %ld/7 ", DOMAIN_GROUP_RID_ADMINS);
259 pstrcat(domain_groups, tmp);
261 DEBUG(3,("domain admin group access %s granted\n", tmp));
266 /*******************************************************************
267 Look up a local (domain) rid and return a name and type.
268 ********************************************************************/
269 NTSTATUS local_lookup_group_name(uint32 rid, char *group_name, uint32 *type)
272 (*type) = SID_NAME_DOM_GRP;
274 DEBUG(5,("lookup_group_name: rid: %d", rid));
276 while (domain_group_rids[i].rid != rid && domain_group_rids[i].rid != 0)
281 if (domain_group_rids[i].rid != 0)
283 fstrcpy(group_name, domain_group_rids[i].name);
284 DEBUG(5,(" = %s\n", group_name));
288 DEBUG(5,(" none mapped\n"));
289 return NT_STATUS_NONE_MAPPED;
292 /*******************************************************************
293 Look up a local alias rid and return a name and type.
294 ********************************************************************/
295 NTSTATUS local_lookup_alias_name(uint32 rid, char *alias_name, uint32 *type)
298 (*type) = SID_NAME_WKN_GRP;
300 DEBUG(5,("lookup_alias_name: rid: %d", rid));
302 while (builtin_alias_rids[i].rid != rid && builtin_alias_rids[i].rid != 0)
307 if (builtin_alias_rids[i].rid != 0)
309 fstrcpy(alias_name, builtin_alias_rids[i].name);
310 DEBUG(5,(" = %s\n", alias_name));
314 DEBUG(5,(" none mapped\n"));
315 return NT_STATUS_NONE_MAPPED;
318 /*******************************************************************
319 Look up a local user rid and return a name and type.
320 ********************************************************************/
321 NTSTATUS local_lookup_user_name(uint32 rid, char *user_name, uint32 *type)
323 SAM_ACCOUNT *sampwd=NULL;
327 (*type) = SID_NAME_USER;
329 DEBUG(5,("lookup_user_name: rid: %d", rid));
331 /* look up the well-known domain user rids first */
332 while (domain_user_rids[i].rid != rid && domain_user_rids[i].rid != 0)
337 if (domain_user_rids[i].rid != 0) {
338 fstrcpy(user_name, domain_user_rids[i].name);
339 DEBUG(5,(" = %s\n", user_name));
343 pdb_init_sam(&sampwd);
345 /* ok, it's a user. find the user account */
347 ret = pdb_getsampwrid(sampwd, rid);
351 fstrcpy(user_name, pdb_get_username(sampwd) );
352 DEBUG(5,(" = %s\n", user_name));
353 pdb_free_sam(&sampwd);
357 DEBUG(5,(" none mapped\n"));
358 pdb_free_sam(&sampwd);
359 return NT_STATUS_NONE_MAPPED;
362 /*******************************************************************
363 Look up a local (domain) group name and return a rid
364 ********************************************************************/
365 NTSTATUS local_lookup_group_rid(char *group_name, uint32 *rid)
368 int i = -1; /* start do loop at -1 */
370 do /* find, if it exists, a group rid for the group name*/
373 (*rid) = domain_group_rids[i].rid;
374 grp_name = domain_group_rids[i].name;
376 } while (grp_name != NULL && !strequal(grp_name, group_name));
378 return (grp_name != NULL) ? NT_STATUS_OK : NT_STATUS_NONE_MAPPED;
381 /*******************************************************************
382 Look up a local (BUILTIN) alias name and return a rid
383 ********************************************************************/
384 NTSTATUS local_lookup_alias_rid(char *alias_name, uint32 *rid)
387 int i = -1; /* start do loop at -1 */
389 do /* find, if it exists, a alias rid for the alias name*/
392 (*rid) = builtin_alias_rids[i].rid;
393 als_name = builtin_alias_rids[i].name;
395 } while (als_name != NULL && !strequal(als_name, alias_name));
397 return (als_name != NULL) ? NT_STATUS_OK : NT_STATUS_NONE_MAPPED;
400 /*******************************************************************
401 Look up a local user name and return a rid
402 ********************************************************************/
403 NTSTATUS local_lookup_user_rid(char *user_name, uint32 *rid)
405 SAM_ACCOUNT *sampass=NULL;
410 pdb_init_sam(&sampass);
412 /* find the user account */
414 ret = pdb_getsampwnam(sampass, user_name);
418 (*rid) = pdb_get_user_rid(sampass);
419 pdb_free_sam(&sampass);
423 pdb_free_sam(&sampass);
424 return NT_STATUS_NONE_MAPPED;