source3/rpc_server/srv_lsa_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison                    2001.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 /* This is the implementation of the lsa server code. */
  25
  26 #include "includes.h"
  27
  28 extern DOM_SID global_sam_sid;
  29 extern fstring global_myworkgroup;
  30 extern pstring global_myname;
  31 extern PRIVS privs[];
  32
  33 struct lsa_info {
  34     DOM_SID sid;
  35     uint32 access;
  36 };
  37
  38 struct generic_mapping lsa_generic_mapping = {
  39         POLICY_READ,
  40         POLICY_WRITE,
  41         POLICY_EXECUTE,
  42         POLICY_ALL_ACCESS
  43 };
  44
  45 /*******************************************************************
  46  Function to free the per handle data.
  47  ********************************************************************/
  48
  49 static void free_lsa_info(void *ptr)
  50 {
  51         struct lsa_info *lsa = (struct lsa_info *)ptr;
  52
  53         SAFE_FREE(lsa);
  54 }
  55
  56 /***************************************************************************
  57 Init dom_query
  58  ***************************************************************************/
  59
  60 static void init_dom_query(DOM_QUERY *d_q, char *dom_name, DOM_SID *dom_sid)
  61 {
  62         int domlen = (dom_name != NULL) ? strlen(dom_name) : 0;
  63
  64         /*
  65          * I'm not sure why this really odd combination of length
  66          * values works, but it does appear to. I need to look at
  67          * this *much* more closely - but at the moment leave alone
  68          * until it's understood. This allows a W2k client to join
  69          * a domain with both odd and even length names... JRA.
  70          */
  71
  72         d_q->uni_dom_str_len = domlen ? ((domlen + 1) * 2) : 0;
  73         d_q->uni_dom_max_len = domlen * 2;
  74         d_q->buffer_dom_name = domlen != 0 ? 1 : 0; /* domain buffer pointer */
  75         d_q->buffer_dom_sid = dom_sid != NULL ? 1 : 0;  /* domain sid pointer */
  76
  77         /* this string is supposed to be character short */
  78         init_unistr2(&d_q->uni_domain_name, dom_name, domlen);
  79         d_q->uni_domain_name.uni_max_len++;
  80
  81         if (dom_sid != NULL)
  82                 init_dom_sid2(&d_q->dom_sid, dom_sid);
  83 }
  84
  85 /***************************************************************************
  86  init_dom_ref - adds a domain if it's not already in, returns the index.
  87 ***************************************************************************/
  88
  89 static int init_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid)
  90 {
  91         int num = 0;
  92         int len;
  93
  94         if (dom_name != NULL) {
  95                 for (num = 0; num < ref->num_ref_doms_1; num++) {
  96                         fstring domname;
  97                         rpcstr_pull(domname, &ref->ref_dom[num].uni_dom_name, sizeof(domname), -1, 0);
  98                         if (strequal(domname, dom_name))
  99                                 return num;
 100                 }
 101         } else {
 102                 num = ref->num_ref_doms_1;
 103         }
 104
 105         if (num >= MAX_REF_DOMAINS) {
 106                 /* index not found, already at maximum domain limit */
 107                 return -1;
 108         }
 109
 110         ref->num_ref_doms_1 = num+1;
 111         ref->ptr_ref_dom  = 1;
 112         ref->max_entries = MAX_REF_DOMAINS;
 113         ref->num_ref_doms_2 = num+1;
 114
 115         len = (dom_name != NULL) ? strlen(dom_name) : 0;
 116         if(dom_name != NULL && len == 0)
 117                 len = 1;
 118
 119         init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, len);
 120         ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0;
 121
 122         init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, len);
 123         init_dom_sid2(&ref->ref_dom[num].ref_dom, dom_sid );
 124
 125         return num;
 126 }
 127
 128 /***************************************************************************
 129  init_lsa_rid2s
 130  ***************************************************************************/
 131
 132 static void init_lsa_rid2s(DOM_R_REF *ref, DOM_RID2 *rid2,
 133                                 int num_entries, UNISTR2 *name,
 134                                 uint32 *mapped_count, BOOL endian)
 135 {
 136         int i;
 137         int total = 0;
 138         *mapped_count = 0;
 139
 140         SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
 141
 142         become_root(); /* lookup_name can require root privs */
 143
 144         for (i = 0; i < num_entries; i++) {
 145                 BOOL status = False;
 146                 DOM_SID sid;
 147                 uint32 rid = 0xffffffff;
 148                 int dom_idx = -1;
 149                 pstring full_name;
 150                 fstring dom_name, user;
 151                 enum SID_NAME_USE name_type = SID_NAME_UNKNOWN;
 152
 153                 /* Split name into domain and user component */
 154
 155                 unistr2_to_ascii(full_name, &name[i], sizeof(full_name));
 156                 split_domain_name(full_name, dom_name, user);
 157
 158                 /* Lookup name */
 159
 160                 DEBUG(5, ("init_lsa_rid2s: looking up name %s\n", full_name));
 161
 162                 status = lookup_name(dom_name, user, &sid, &name_type);
 163
 164                 DEBUG(5, ("init_lsa_rid2s: %s\n", status ? "found" :
 165                           "not found"));
 166
 167                 if (status) {
 168                         sid_split_rid(&sid, &rid);
 169                         dom_idx = init_dom_ref(ref, dom_name, &sid);
 170                         (*mapped_count)++;
 171                 } else {
 172                         dom_idx = -1;
 173                         rid = 0xffffffff;
 174                         name_type = SID_NAME_UNKNOWN;
 175                 }
 176
 177                 init_dom_rid2(&rid2[total], rid, name_type, dom_idx);
 178                 total++;
 179         }
 180
 181         unbecome_root();
 182 }
 183
 184 /***************************************************************************
 185  init_reply_lookup_names
 186  ***************************************************************************/
 187
 188 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
 189                 DOM_R_REF *ref, uint32 num_entries,
 190                 DOM_RID2 *rid2, uint32 mapped_count)
 191 {
 192         r_l->ptr_dom_ref  = 1;
 193         r_l->dom_ref      = ref;
 194
 195         r_l->num_entries  = num_entries;
 196         r_l->ptr_entries  = 1;
 197         r_l->num_entries2 = num_entries;
 198         r_l->dom_rid      = rid2;
 199
 200         r_l->mapped_count = mapped_count;
 201
 202         if (mapped_count == 0)
 203                 r_l->status = NT_STATUS_NONE_MAPPED;
 204         else
 205                 r_l->status = NT_STATUS_OK;
 206 }
 207
 208 /***************************************************************************
 209  Init lsa_trans_names.
 210  ***************************************************************************/
 211
 212 static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *trn,
 213                                  int num_entries, DOM_SID2 *sid,
 214                                  uint32 *mapped_count)
 215 {
 216         int i;
 217         int total = 0;
 218         *mapped_count = 0;
 219
 220         /* Allocate memory for list of names */
 221
 222         if (num_entries > 0) {
 223                 if (!(trn->name = (LSA_TRANS_NAME *)talloc(ctx, sizeof(LSA_TRANS_NAME) *
 224                                                           num_entries))) {
 225                         DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
 226                         return;
 227                 }
 228
 229                 if (!(trn->uni_name = (UNISTR2 *)talloc(ctx, sizeof(UNISTR2) *
 230                                                         num_entries))) {
 231                         DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
 232                         return;
 233                 }
 234         }
 235
 236         become_root(); /* Need root to get to passdb to for local sids */
 237
 238         for (i = 0; i < num_entries; i++) {
 239                 BOOL status = False;
 240                 DOM_SID find_sid = sid[i].sid;
 241                 uint32 rid = 0xffffffff;
 242                 int dom_idx = -1;
 243                 fstring name, dom_name;
 244                 enum SID_NAME_USE sid_name_use = (enum SID_NAME_USE)0;
 245
 246                 sid_to_string(name, &find_sid);
 247                 DEBUG(5, ("init_lsa_trans_names: looking up sid %s\n", name));
 248
 249                 /* Lookup sid from winbindd */
 250
 251                 memset(dom_name, '\0', sizeof(dom_name));
 252                 memset(name, '\0', sizeof(name));
 253
 254                 status = lookup_sid(&find_sid, dom_name, name, &sid_name_use);
 255
 256                 DEBUG(5, ("init_lsa_trans_names: %s\n", status ? "found" :
 257                           "not found"));
 258
 259                 if (!status) {
 260                         sid_name_use = SID_NAME_UNKNOWN;
 261                 }
 262
 263                 /* Store domain sid in ref array */
 264
 265                 if (find_sid.num_auths == 5) {
 266                         sid_split_rid(&find_sid, &rid);
 267                 }
 268
 269                 dom_idx = init_dom_ref(ref, dom_name, &find_sid);
 270
 271                 DEBUG(10,("init_lsa_trans_names: added user '%s\\%s' to "
 272                           "referenced list.\n", dom_name, name ));
 273
 274                 (*mapped_count)++;
 275
 276                 init_lsa_trans_name(&trn->name[total], &trn->uni_name[total],
 277                                         sid_name_use, name, dom_idx);
 278                 total++;
 279         }
 280
 281         unbecome_root();
 282
 283         trn->num_entries = total;
 284         trn->ptr_trans_names = 1;
 285         trn->num_entries2 = total;
 286 }
 287
 288 /***************************************************************************
 289  Init_reply_lookup_sids.
 290  ***************************************************************************/
 291
 292 static void init_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
 293                 DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *names,
 294                 uint32 mapped_count)
 295 {
 296         r_l->ptr_dom_ref  = 1;
 297         r_l->dom_ref      = ref;
 298         r_l->names        = names;
 299         r_l->mapped_count = mapped_count;
 300
 301         if (mapped_count == 0)
 302                 r_l->status = NT_STATUS_NONE_MAPPED;
 303         else
 304                 r_l->status = NT_STATUS_OK;
 305 }
 306
 307 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
 308 {
 309         extern DOM_SID global_sid_World;
 310         extern DOM_SID global_sid_Builtin;
 311         DOM_SID local_adm_sid;
 312         DOM_SID adm_sid;
 313
 314         SEC_ACE ace[3];
 315         SEC_ACCESS mask;
 316
 317         SEC_ACL *psa = NULL;
 318
 319         init_sec_access(&mask, POLICY_EXECUTE);
 320         init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 321
 322         sid_copy(&adm_sid, &global_sam_sid);
 323         sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
 324         init_sec_access(&mask, POLICY_ALL_ACCESS);
 325         init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 326
 327         sid_copy(&local_adm_sid, &global_sid_Builtin);
 328         sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
 329         init_sec_access(&mask, POLICY_ALL_ACCESS);
 330         init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 331
 332         if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
 333                 return NT_STATUS_NO_MEMORY;
 334
 335         if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, &adm_sid, NULL, NULL, psa, sd_size)) == NULL)
 336                 return NT_STATUS_NO_MEMORY;
 337
 338         return NT_STATUS_OK;
 339 }
 340
 341 /***************************************************************************
 342  _lsa_open_policy2.
 343  ***************************************************************************/
 344
 345 NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL2 *r_u)
 346 {
 347         struct lsa_info *info;
 348         SEC_DESC *psd = NULL;
 349         size_t sd_size;
 350         uint32 des_access=q_u->des_access;
 351         uint32 acc_granted;
 352         NTSTATUS status;
 353
 354
 355         /* map the generic bits to the lsa policy ones */
 356         se_map_generic(&des_access, &lsa_generic_mapping);
 357
 358         /* get the generic lsa policy SD until we store it */
 359         lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
 360
 361         if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status))
 362                 return status;
 363
 364         /* associate the domain SID with the (unique) handle. */
 365         if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
 366                 return NT_STATUS_NO_MEMORY;
 367
 368         ZERO_STRUCTP(info);
 369         info->sid = global_sam_sid;
 370         info->access = acc_granted;
 371
 372         /* set up the LSA QUERY INFO response */
 373         if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
 374                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 375
 376         return NT_STATUS_OK;
 377 }
 378
 379 /***************************************************************************
 380  _lsa_open_policy
 381  ***************************************************************************/
 382
 383 NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *r_u)
 384 {
 385         struct lsa_info *info;
 386         SEC_DESC *psd = NULL;
 387         size_t sd_size;
 388         uint32 des_access=q_u->des_access;
 389         uint32 acc_granted;
 390         NTSTATUS status;
 391
 392
 393         /* map the generic bits to the lsa policy ones */
 394         se_map_generic(&des_access, &lsa_generic_mapping);
 395
 396         /* get the generic lsa policy SD until we store it */
 397         lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
 398
 399         if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status))
 400                 return status;
 401
 402         /* associate the domain SID with the (unique) handle. */
 403         if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
 404                 return NT_STATUS_NO_MEMORY;
 405
 406         ZERO_STRUCTP(info);
 407         info->sid = global_sam_sid;
 408         info->access = acc_granted;
 409
 410         /* set up the LSA QUERY INFO response */
 411         if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
 412                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 413
 414         return NT_STATUS_OK;
 415 }
 416
 417 /***************************************************************************
 418  _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
 419  ***************************************************************************/
 420
 421 NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_ENUM_TRUST_DOM *r_u)
 422 {
 423         struct lsa_info *info;
 424         uint32 enum_context = 0;
 425         char *dom_name = NULL;
 426         DOM_SID *dom_sid = NULL;
 427
 428         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 429                 return NT_STATUS_INVALID_HANDLE;
 430
 431         /* check if the user have enough rights */
 432         if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
 433                 return NT_STATUS_ACCESS_DENIED;
 434
 435         /* set up the LSA QUERY INFO response */
 436         init_r_enum_trust_dom(p->mem_ctx, r_u, enum_context, dom_name, dom_sid,
 437               dom_name != NULL ? NT_STATUS_OK : NT_STATUS_NO_MORE_ENTRIES);
 438
 439         return r_u->status;
 440 }
 441
 442 /***************************************************************************
 443  _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
 444  ***************************************************************************/
 445
 446 NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INFO *r_u)
 447 {
 448         struct lsa_info *handle;
 449         LSA_INFO_UNION *info = &r_u->dom;
 450         DOM_SID domain_sid;
 451         char *name = NULL;
 452         DOM_SID *sid = NULL;
 453
 454         r_u->status = NT_STATUS_OK;
 455
 456         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
 457                 return NT_STATUS_INVALID_HANDLE;
 458
 459         switch (q_u->info_class) {
 460         case 0x02:
 461                 {
 462                 unsigned int i;
 463                 /* check if the user have enough rights */
 464                 if (!(handle->access & POLICY_VIEW_AUDIT_INFORMATION))
 465                         return NT_STATUS_ACCESS_DENIED;
 466
 467                 /* fake info: We audit everything. ;) */
 468                 info->id2.auditing_enabled = 1;
 469                 info->id2.count1 = 7;
 470                 info->id2.count2 = 7;
 471                 if ((info->id2.auditsettings = (uint32 *)talloc(p->mem_ctx,7*sizeof(uint32))) == NULL)
 472                         return NT_STATUS_NO_MEMORY;
 473                 for (i = 0; i < 7; i++)
 474                         info->id2.auditsettings[i] = 3;
 475                 break;
 476                 }
 477         case 0x03:
 478                 /* check if the user have enough rights */
 479                 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
 480                         return NT_STATUS_ACCESS_DENIED;
 481
 482                 /* Request PolicyPrimaryDomainInformation. */
 483                 switch (lp_server_role()) {
 484                         case ROLE_DOMAIN_PDC:
 485                         case ROLE_DOMAIN_BDC:
 486                                 name = global_myworkgroup;
 487                                 sid = &global_sam_sid;
 488                                 break;
 489                         case ROLE_DOMAIN_MEMBER:
 490                                 name = global_myworkgroup;
 491                                 /* We need to return the Domain SID here. */
 492                                 if (secrets_fetch_domain_sid(global_myworkgroup,
 493                                                              &domain_sid))
 494                                         sid = &domain_sid;
 495                                 else
 496                                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 497                                 break;
 498                         case ROLE_STANDALONE:
 499                                 name = global_myworkgroup;
 500                                 sid = NULL;
 501                                 break;
 502                         default:
 503                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 504                 }
 505                 init_dom_query(&r_u->dom.id3, name, sid);
 506                 break;
 507         case 0x05:
 508                 /* check if the user have enough rights */
 509                 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
 510                         return NT_STATUS_ACCESS_DENIED;
 511
 512                 /* Request PolicyAccountDomainInformation. */
 513                 switch (lp_server_role()) {
 514                         case ROLE_DOMAIN_PDC:
 515                         case ROLE_DOMAIN_BDC:
 516                                 name = global_myworkgroup;
 517                                 sid = &global_sam_sid;
 518                                 break;
 519                         case ROLE_DOMAIN_MEMBER:
 520                                 name = global_myname;
 521                                 sid = &global_sam_sid;
 522                                 break;
 523                         case ROLE_STANDALONE:
 524                                 name = global_myname;
 525                                 sid = &global_sam_sid;
 526                                 break;
 527                         default:
 528                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 529                 }
 530                 init_dom_query(&r_u->dom.id5, name, sid);
 531                 break;
 532         case 0x06:
 533                 /* check if the user have enough rights */
 534                 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
 535                         return NT_STATUS_ACCESS_DENIED;
 536
 537                 switch (lp_server_role()) {
 538                         case ROLE_DOMAIN_BDC:
 539                                 /*
 540                                  * only a BDC is a backup controller
 541                                  * of the domain, it controls.
 542                                  */
 543                                 info->id6.server_role = 2;
 544                                 break;
 545                         default:
 546                                 /*
 547                                  * any other role is a primary
 548                                  * of the domain, it controls.
 549                                  */
 550                                 info->id6.server_role = 3;
 551                                 break;
 552                 }
 553                 break;
 554         default:
 555                 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u->info_class));
 556                 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
 557                 break;
 558         }
 559
 560         if (NT_STATUS_IS_OK(r_u->status)) {
 561                 r_u->undoc_buffer = 0x22000000; /* bizarre */
 562                 r_u->info_class = q_u->info_class;
 563         }
 564
 565         return r_u->status;
 566 }
 567
 568 /***************************************************************************
 569  _lsa_lookup_sids
 570  ***************************************************************************/
 571
 572 NTSTATUS _lsa_lookup_sids(pipes_struct *p, LSA_Q_LOOKUP_SIDS *q_u, LSA_R_LOOKUP_SIDS *r_u)
 573 {
 574         struct lsa_info *handle;
 575         DOM_SID2 *sid = q_u->sids.sid;
 576         int num_entries = q_u->sids.num_entries;
 577         DOM_R_REF *ref = NULL;
 578         LSA_TRANS_NAME_ENUM *names = NULL;
 579         uint32 mapped_count = 0;
 580
 581         ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
 582         names = (LSA_TRANS_NAME_ENUM *)talloc_zero(p->mem_ctx, sizeof(LSA_TRANS_NAME_ENUM));
 583
 584         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
 585                 r_u->status = NT_STATUS_INVALID_HANDLE;
 586                 goto done;
 587         }
 588
 589         /* check if the user have enough rights */
 590         if (!(handle->access & POLICY_LOOKUP_NAMES)) {
 591                 r_u->status = NT_STATUS_ACCESS_DENIED;
 592                 goto done;
 593         }
 594         if (!ref || !names)
 595                 return NT_STATUS_NO_MEMORY;
 596
 597 done:
 598
 599         /* set up the LSA Lookup SIDs response */
 600         init_lsa_trans_names(p->mem_ctx, ref, names, num_entries, sid, &mapped_count);
 601         init_reply_lookup_sids(r_u, ref, names, mapped_count);
 602
 603         return r_u->status;
 604 }
 605
 606 /***************************************************************************
 607 lsa_reply_lookup_names
 608  ***************************************************************************/
 609
 610 NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP_NAMES *r_u)
 611 {
 612         struct lsa_info *handle;
 613         UNISTR2 *names = q_u->uni_name;
 614         int num_entries = q_u->num_entries;
 615         DOM_R_REF *ref;
 616         DOM_RID2 *rids;
 617         uint32 mapped_count = 0;
 618
 619         if (num_entries >  MAX_LOOKUP_SIDS) {
 620                 num_entries = MAX_LOOKUP_SIDS;
 621                 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
 622         }
 623
 624         ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF));
 625         rids = (DOM_RID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_RID2)*num_entries);
 626
 627         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
 628                 r_u->status = NT_STATUS_INVALID_HANDLE;
 629                 goto done;
 630         }
 631
 632         /* check if the user have enough rights */
 633         if (!(handle->access & POLICY_LOOKUP_NAMES)) {
 634                 r_u->status = NT_STATUS_ACCESS_DENIED;
 635                 goto done;
 636         }
 637
 638         if (!ref || !rids)
 639                 return NT_STATUS_NO_MEMORY;
 640
 641 done:
 642
 643         /* set up the LSA Lookup RIDs response */
 644         init_lsa_rid2s(ref, rids, num_entries, names, &mapped_count, p->endian);
 645         init_reply_lookup_names(r_u, ref, num_entries, rids, mapped_count);
 646
 647         return r_u->status;
 648 }
 649
 650 /***************************************************************************
 651  _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
 652  ***************************************************************************/
 653
 654 NTSTATUS _lsa_close(pipes_struct *p, LSA_Q_CLOSE *q_u, LSA_R_CLOSE *r_u)
 655 {
 656         if (!find_policy_by_hnd(p, &q_u->pol, NULL))
 657                 return NT_STATUS_INVALID_HANDLE;
 658
 659         close_policy_hnd(p, &q_u->pol);
 660         return NT_STATUS_OK;
 661 }
 662
 663 /***************************************************************************
 664   "No more secrets Marty...." :-).
 665  ***************************************************************************/
 666
 667 NTSTATUS _lsa_open_secret(pipes_struct *p, LSA_Q_OPEN_SECRET *q_u, LSA_R_OPEN_SECRET *r_u)
 668 {
 669         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 670 }
 671
 672 /***************************************************************************
 673 _lsa_enum_privs.
 674  ***************************************************************************/
 675
 676 NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIVS *r_u)
 677 {
 678         struct lsa_info *handle;
 679         uint32 i;
 680
 681         uint32 enum_context=q_u->enum_context;
 682         LSA_PRIV_ENTRY *entry;
 683         LSA_PRIV_ENTRY *entries=NULL;
 684
 685         if (enum_context >= PRIV_ALL_INDEX)
 686                 return NT_STATUS_NO_MORE_ENTRIES;
 687
 688         entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX));
 689         if (entries==NULL)
 690                 return NT_STATUS_NO_MEMORY;
 691
 692         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
 693                 return NT_STATUS_INVALID_HANDLE;
 694
 695         /* check if the user have enough rights */
 696
 697         /*
 698          * I don't know if it's the right one. not documented.
 699          */
 700         if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
 701                 return NT_STATUS_ACCESS_DENIED;
 702
 703         entry = entries;
 704
 705         DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n", enum_context, PRIV_ALL_INDEX));
 706
 707         for (i = 0; i < PRIV_ALL_INDEX; i++, entry++) {
 708                 if( i<enum_context) {
 709                         init_uni_hdr(&entry->hdr_name, 0);
 710                         init_unistr2(&entry->name, NULL, 0 );
 711                         entry->luid_low = 0;
 712                         entry->luid_high = 0;
 713                 } else {
 714                         init_uni_hdr(&entry->hdr_name, strlen(privs[i+1].priv));
 715                         init_unistr2(&entry->name, privs[i+1].priv, strlen(privs[i+1].priv) );
 716                         entry->luid_low = privs[i+1].se_priv;
 717                         entry->luid_high = 0;
 718                 }
 719         }
 720
 721         enum_context = PRIV_ALL_INDEX;
 722         init_lsa_r_enum_privs(r_u, enum_context, PRIV_ALL_INDEX, entries);
 723
 724         return NT_STATUS_OK;
 725 }
 726
 727 /***************************************************************************
 728 _lsa_priv_get_dispname.
 729  ***************************************************************************/
 730
 731 NTSTATUS _lsa_priv_get_dispname(pipes_struct *p, LSA_Q_PRIV_GET_DISPNAME *q_u, LSA_R_PRIV_GET_DISPNAME *r_u)
 732 {
 733         struct lsa_info *handle;
 734         fstring name_asc;
 735         int i=1;
 736
 737         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
 738                 return NT_STATUS_INVALID_HANDLE;
 739
 740         /* check if the user have enough rights */
 741
 742         /*
 743          * I don't know if it's the right one. not documented.
 744          */
 745         if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
 746                 return NT_STATUS_ACCESS_DENIED;
 747
 748         unistr2_to_ascii(name_asc, &q_u->name, sizeof(name_asc));
 749
 750         DEBUG(10,("_lsa_priv_get_dispname: %s", name_asc));
 751
 752         while (privs[i].se_priv!=SE_PRIV_ALL && strcmp(name_asc, privs[i].priv))
 753                 i++;
 754
 755         if (privs[i].se_priv!=SE_PRIV_ALL) {
 756                 DEBUG(10,(": %s\n", privs[i].description));
 757                 init_uni_hdr(&r_u->hdr_desc, strlen(privs[i].description));
 758                 init_unistr2(&r_u->desc, privs[i].description, strlen(privs[i].description) );
 759
 760                 r_u->ptr_info=0xdeadbeef;
 761                 r_u->lang_id=q_u->lang_id;
 762                 return NT_STATUS_OK;
 763         } else {
 764                 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
 765                 r_u->ptr_info=0;
 766                 return NT_STATUS_NO_SUCH_PRIVILEGE;
 767         }
 768 }
 769
 770 /***************************************************************************
 771 _lsa_enum_accounts.
 772  ***************************************************************************/
 773
 774 NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENUM_ACCOUNTS *r_u)
 775 {
 776         struct lsa_info *handle;
 777         GROUP_MAP *map=NULL;
 778         int num_entries=0;
 779         LSA_SID_ENUM *sids=&r_u->sids;
 780         int i=0,j=0;
 781
 782         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
 783                 return NT_STATUS_INVALID_HANDLE;
 784
 785         /* check if the user have enough rights */
 786
 787         /*
 788          * I don't know if it's the right one. not documented.
 789          */
 790         if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
 791                 return NT_STATUS_ACCESS_DENIED;
 792
 793         /* get the list of mapped groups (domain, local, builtin) */
 794         if(!enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV))
 795                 return NT_STATUS_OK;
 796
 797         if (q_u->enum_context >= num_entries)
 798                 return NT_STATUS_NO_MORE_ENTRIES;
 799
 800         sids->ptr_sid = (uint32 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(uint32));
 801         sids->sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(DOM_SID2));
 802
 803         if (sids->ptr_sid==NULL || sids->sid==NULL) {
 804                 SAFE_FREE(map);
 805                 return NT_STATUS_NO_MEMORY;
 806         }
 807
 808         for (i=q_u->enum_context, j=0; i<num_entries; i++) {
 809                 init_dom_sid2( &(*sids).sid[j],  &map[i].sid);
 810                 (*sids).ptr_sid[j]=1;
 811                 j++;
 812         }
 813
 814         SAFE_FREE(map);
 815
 816         init_lsa_r_enum_accounts(r_u, j);
 817
 818         return NT_STATUS_OK;
 819 }
 820
 821
 822 NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u)
 823 {
 824         fstring username, domname;
 825         int ulen, dlen;
 826         user_struct *vuser = get_valid_user_struct(p->vuid);
 827
 828         if (vuser == NULL)
 829                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 830
 831         fstrcpy(username, vuser->user.smb_name);
 832         fstrcpy(domname, vuser->user.domain);
 833
 834         ulen = strlen(username) + 1;
 835         dlen = strlen(domname) + 1;
 836
 837         init_uni_hdr(&r_u->hdr_user_name, ulen);
 838         r_u->ptr_user_name = 1;
 839         init_unistr2(&r_u->uni2_user_name, username, ulen);
 840
 841         r_u->unk1 = 1;
 842
 843         init_uni_hdr(&r_u->hdr_dom_name, dlen);
 844         r_u->ptr_dom_name = 1;
 845         init_unistr2(&r_u->uni2_dom_name, domname, dlen);
 846
 847         r_u->status = NT_STATUS_OK;
 848
 849         return r_u->status;
 850 }
 851
 852 /***************************************************************************
 853
 854  ***************************************************************************/
 855
 856 NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENACCOUNT *r_u)
 857 {
 858         struct lsa_info *handle;
 859         struct lsa_info *info;
 860
 861         r_u->status = NT_STATUS_OK;
 862
 863         /* find the connection policy handle. */
 864         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
 865                 return NT_STATUS_INVALID_HANDLE;
 866
 867         /* check if the user have enough rights */
 868
 869         /*
 870          * I don't know if it's the right one. not documented.
 871          * but guessed with rpcclient.
 872          */
 873         if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
 874                 return NT_STATUS_ACCESS_DENIED;
 875
 876         /* associate the user/group SID with the (unique) handle. */
 877         if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL)
 878                 return NT_STATUS_NO_MEMORY;
 879
 880         ZERO_STRUCTP(info);
 881         info->sid = q_u->sid.sid;
 882         info->access = q_u->access;
 883
 884         /* get a (unique) handle.  open a policy on it. */
 885         if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
 886                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 887
 888         return r_u->status;
 889 }
 890
 891 /***************************************************************************
 892  For a given SID, enumerate all the privilege this account has.
 893  ***************************************************************************/
 894
 895 NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u)
 896 {
 897         struct lsa_info *info=NULL;
 898         GROUP_MAP map;
 899         int i=0;
 900
 901         LUID_ATTR *set=NULL;
 902
 903         r_u->status = NT_STATUS_OK;
 904
 905         /* find the connection policy handle. */
 906         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 907                 return NT_STATUS_INVALID_HANDLE;
 908
 909         if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
 910                 return NT_STATUS_NO_SUCH_GROUP;
 911
 912         DEBUG(10,("_lsa_enum_privsaccount: %d privileges\n", map.priv_set.count));
 913         if (map.priv_set.count!=0) {
 914
 915                 set=(LUID_ATTR *)talloc(p->mem_ctx, map.priv_set.count*sizeof(LUID_ATTR));
 916                 if (set == NULL) {
 917                         free_privilege(&map.priv_set);
 918                         return NT_STATUS_NO_MEMORY;
 919                 }
 920
 921                 for (i=0; i<map.priv_set.count; i++) {
 922                         set[i].luid.low=map.priv_set.set[i].luid.low;
 923                         set[i].luid.high=map.priv_set.set[i].luid.high;
 924                         set[i].attr=map.priv_set.set[i].attr;
 925                         DEBUG(10,("_lsa_enum_privsaccount: priv %d: %d:%d:%d\n", i,
 926                                    set[i].luid.high, set[i].luid.low, set[i].attr));
 927                 }
 928         }
 929
 930         init_lsa_r_enum_privsaccount(r_u, set, map.priv_set.count, 0);
 931         free_privilege(&map.priv_set);
 932
 933         return r_u->status;
 934 }
 935
 936 /***************************************************************************
 937
 938  ***************************************************************************/
 939
 940 NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA_R_GETSYSTEMACCOUNT *r_u)
 941 {
 942         struct lsa_info *info=NULL;
 943         GROUP_MAP map;
 944         r_u->status = NT_STATUS_OK;
 945
 946         /* find the connection policy handle. */
 947         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 948                 return NT_STATUS_INVALID_HANDLE;
 949
 950         if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITHOUT_PRIV))
 951                 return NT_STATUS_NO_SUCH_GROUP;
 952
 953         /*
 954           0x01 -> Log on locally
 955           0x02 -> Access this computer from network
 956           0x04 -> Log on as a batch job
 957           0x10 -> Log on as a service
 958
 959           they can be ORed together
 960         */
 961
 962         r_u->access=map.systemaccount;
 963
 964         return r_u->status;
 965 }
 966
 967 /***************************************************************************
 968   update the systemaccount information
 969  ***************************************************************************/
 970
 971 NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA_R_SETSYSTEMACCOUNT *r_u)
 972 {
 973         struct lsa_info *info=NULL;
 974         GROUP_MAP map;
 975         r_u->status = NT_STATUS_OK;
 976
 977         /* find the connection policy handle. */
 978         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 979                 return NT_STATUS_INVALID_HANDLE;
 980
 981         if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
 982                 return NT_STATUS_NO_SUCH_GROUP;
 983
 984         map.systemaccount=q_u->access;
 985
 986         if(!add_mapping_entry(&map, TDB_REPLACE))
 987                 return NT_STATUS_NO_SUCH_GROUP;
 988
 989         free_privilege(&map.priv_set);
 990
 991         return r_u->status;
 992 }
 993
 994 /***************************************************************************
 995  For a given SID, add some privileges.
 996  ***************************************************************************/
 997
 998 NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u)
 999 {
1000         struct lsa_info *info=NULL;
1001         GROUP_MAP map;
1002         int i=0;
1003
1004         LUID_ATTR *luid_attr=NULL;
1005         PRIVILEGE_SET *set=NULL;
1006
1007         r_u->status = NT_STATUS_OK;
1008
1009         /* find the connection policy handle. */
1010         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1011                 return NT_STATUS_INVALID_HANDLE;
1012
1013         if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
1014                 return NT_STATUS_NO_SUCH_GROUP;
1015
1016         set=&q_u->set;
1017
1018         for (i=0; i<set->count; i++) {
1019                 luid_attr=&set->set[i];
1020
1021                 /* check if the privilege is already there */
1022                 if (check_priv_in_privilege(&map.priv_set, *luid_attr)){
1023                         free_privilege(&map.priv_set);
1024                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1025                 }
1026
1027                 add_privilege(&map.priv_set, *luid_attr);
1028         }
1029
1030         if(!add_mapping_entry(&map, TDB_REPLACE))
1031                 return NT_STATUS_NO_SUCH_GROUP;
1032
1033         free_privilege(&map.priv_set);
1034
1035         return r_u->status;
1036 }
1037
1038 /***************************************************************************
1039  For a given SID, remove some privileges.
1040  ***************************************************************************/
1041
1042 NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u)
1043 {
1044         struct lsa_info *info=NULL;
1045         GROUP_MAP map;
1046         int i=0;
1047
1048         LUID_ATTR *luid_attr=NULL;
1049         PRIVILEGE_SET *set=NULL;
1050
1051         r_u->status = NT_STATUS_OK;
1052
1053         /* find the connection policy handle. */
1054         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1055                 return NT_STATUS_INVALID_HANDLE;
1056
1057         if (!get_group_map_from_sid(info->sid, &map, MAPPING_WITH_PRIV))
1058                 return NT_STATUS_NO_SUCH_GROUP;
1059
1060         if (q_u->allrights!=0) {
1061                 /* log it and return, until I see one myself don't do anything */
1062                 DEBUG(5,("_lsa_removeprivs: trying to remove all privileges ?\n"));
1063                 return NT_STATUS_OK;
1064         }
1065
1066         if (q_u->ptr==0) {
1067                 /* log it and return, until I see one myself don't do anything */
1068                 DEBUG(5,("_lsa_removeprivs: no privileges to remove ?\n"));
1069                 return NT_STATUS_OK;
1070         }
1071
1072         set=&q_u->set;
1073
1074         for (i=0; i<set->count; i++) {
1075                 luid_attr=&set->set[i];
1076
1077                 /* if we don't have the privilege, we're trying to remove, give up */
1078                 /* what else can we do ??? JFM. */
1079                 if (!check_priv_in_privilege(&map.priv_set, *luid_attr)){
1080                         free_privilege(&map.priv_set);
1081                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1082                 }
1083
1084                 remove_privilege(&map.priv_set, *luid_attr);
1085         }
1086
1087         if(!add_mapping_entry(&map, TDB_REPLACE))
1088                 return NT_STATUS_NO_SUCH_GROUP;
1089
1090         free_privilege(&map.priv_set);
1091
1092         return r_u->status;
1093 }
1094
1095 /***************************************************************************
1096  For a given SID, remove some privileges.
1097  ***************************************************************************/
1098
1099 NTSTATUS _lsa_query_secobj(pipes_struct *p, LSA_Q_QUERY_SEC_OBJ *q_u, LSA_R_QUERY_SEC_OBJ *r_u)
1100 {
1101         struct lsa_info *handle=NULL;
1102         SEC_DESC *psd = NULL;
1103         size_t sd_size;
1104         NTSTATUS status;
1105
1106         r_u->status = NT_STATUS_OK;
1107
1108         /* find the connection policy handle. */
1109         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1110                 return NT_STATUS_INVALID_HANDLE;
1111
1112         /* check if the user have enough rights */
1113         if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1114                 return NT_STATUS_ACCESS_DENIED;
1115
1116
1117         switch (q_u->sec_info) {
1118         case 1:
1119                 /* SD contains only the owner */
1120
1121                 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1122                 if(!NT_STATUS_IS_OK(status))
1123                         return NT_STATUS_NO_MEMORY;
1124
1125
1126                 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1127                         return NT_STATUS_NO_MEMORY;
1128                 break;
1129         case 4:
1130                 /* SD contains only the ACL */
1131
1132                 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1133                 if(!NT_STATUS_IS_OK(status))
1134                         return NT_STATUS_NO_MEMORY;
1135
1136                 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1137                         return NT_STATUS_NO_MEMORY;
1138                 break;
1139         default:
1140                 return NT_STATUS_INVALID_LEVEL;
1141         }
1142
1143         r_u->ptr=1;
1144
1145         return r_u->status;
1146 }
1147
1148