source4/rpc_server/lsa/dcesrv_lsa.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the lsarpc pipe
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/ndr_lsa.h"
  25 #include "librpc/gen_ndr/ndr_samr.h"
  26 #include "rpc_server/dcerpc_server.h"
  27 #include "rpc_server/common/common.h"
  28 #include "lib/ldb/include/ldb.h"
  29 #include "auth/auth.h"
  30
  31 /*
  32   this type allows us to distinguish handle types
  33 */
  34 enum lsa_handle {
  35         LSA_HANDLE_POLICY,
  36         LSA_HANDLE_ACCOUNT,
  37         LSA_HANDLE_SECRET
  38 };
  39
  40 /*
  41   state associated with a lsa_OpenPolicy() operation
  42 */
  43 struct lsa_policy_state {
  44         struct dcesrv_handle *handle;
  45         void *sam_ctx;
  46         struct sidmap_context *sidmap;
  47         uint32_t access_mask;
  48         const char *domain_dn;
  49         const char *builtin_dn;
  50         const char *domain_name;
  51         struct dom_sid *domain_sid;
  52         struct dom_sid *builtin_sid;
  53 };
  54
  55
  56 /*
  57   state associated with a lsa_OpenAccount() operation
  58 */
  59 struct lsa_account_state {
  60         struct lsa_policy_state *policy;
  61         uint32_t access_mask;
  62         struct dom_sid *account_sid;
  63         const char *account_sid_str;
  64         const char *account_dn;
  65 };
  66
  67
  68 /*
  69   destroy an open policy. This closes the database connection
  70 */
  71 static void lsa_Policy_destroy(struct dcesrv_connection *conn, struct dcesrv_handle *h)
  72 {
  73         struct lsa_policy_state *state = h->data;
  74         talloc_free(state);
  75 }
  76
  77 /*
  78   destroy an open account.
  79 */
  80 static void lsa_Account_destroy(struct dcesrv_connection *conn, struct dcesrv_handle *h)
  81 {
  82         struct lsa_account_state *astate = h->data;
  83         talloc_free(astate);
  84 }
  85
  86 /*
  87   lsa_Close
  88 */
  89 static NTSTATUS lsa_Close(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
  90                           struct lsa_Close *r)
  91 {
  92         struct dcesrv_handle *h;
  93
  94         *r->out.handle = *r->in.handle;
  95
  96         DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);
  97
  98         /* this causes the callback samr_XXX_destroy() to be called by
  99            the handle destroy code which destroys the state associated
 100            with the handle */
 101         dcesrv_handle_destroy(dce_call->conn, h);
 102
 103         ZERO_STRUCTP(r->out.handle);
 104
 105         return NT_STATUS_OK;
 106 }
 107
 108
 109 /*
 110   lsa_Delete
 111 */
 112 static NTSTATUS lsa_Delete(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 113                            struct lsa_Delete *r)
 114 {
 115         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 116 }
 117
 118
 119 /*
 120   lsa_EnumPrivs
 121 */
 122 static NTSTATUS lsa_EnumPrivs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 123                               struct lsa_EnumPrivs *r)
 124 {
 125         struct dcesrv_handle *h;
 126         struct lsa_policy_state *state;
 127         int i;
 128         const char *privname;
 129
 130         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
 131
 132         state = h->data;
 133
 134         i = *r->in.resume_handle;
 135         if (i == 0) i = 1;
 136
 137         while ((privname = sec_privilege_name(i)) &&
 138                r->out.privs->count < r->in.max_count) {
 139                 struct lsa_PrivEntry *e;
 140
 141                 r->out.privs->privs = talloc_realloc_p(r->out.privs,
 142                                                        r->out.privs->privs,
 143                                                        struct lsa_PrivEntry,
 144                                                        r->out.privs->count+1);
 145                 if (r->out.privs->privs == NULL) {
 146                         return NT_STATUS_NO_MEMORY;
 147                 }
 148                 e = &r->out.privs->privs[r->out.privs->count];
 149                 e->luid.low = i;
 150                 e->luid.high = 0;
 151                 e->name.string = privname;
 152                 r->out.privs->count++;
 153                 i++;
 154         }
 155
 156         *r->out.resume_handle = i;
 157
 158         return NT_STATUS_OK;
 159 }
 160
 161
 162 /*
 163   lsa_QuerySecObj
 164 */
 165 static NTSTATUS lsa_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 166                                   struct lsa_QuerySecurity *r)
 167 {
 168         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 169 }
 170
 171
 172 /*
 173   lsa_SetSecObj
 174 */
 175 static NTSTATUS lsa_SetSecObj(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 176                               struct lsa_SetSecObj *r)
 177 {
 178         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 179 }
 180
 181
 182 /*
 183   lsa_ChangePassword
 184 */
 185 static NTSTATUS lsa_ChangePassword(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 186                                    struct lsa_ChangePassword *r)
 187 {
 188         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 189 }
 190
 191 static NTSTATUS lsa_get_policy_state(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 192                                      struct lsa_policy_state **_state)
 193 {
 194         struct lsa_policy_state *state;
 195         const char *sid_str;
 196
 197         state = talloc_p(mem_ctx, struct lsa_policy_state);
 198         if (!state) {
 199                 return NT_STATUS_NO_MEMORY;
 200         }
 201
 202         /* make sure the sam database is accessible */
 203         state->sam_ctx = samdb_connect(state);
 204         if (state->sam_ctx == NULL) {
 205                 talloc_free(state);
 206                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 207         }
 208
 209         state->sidmap = sidmap_open(state);
 210         if (state->sidmap == NULL) {
 211                 talloc_free(state);
 212                 return NT_STATUS_INVALID_SYSTEM_SERVICE;
 213         }
 214
 215         /* work out the domain_dn - useful for so many calls its worth
 216            fetching here */
 217         state->domain_dn = samdb_search_string(state->sam_ctx, state, NULL,
 218                                                "dn", "(&(objectClass=domain)(!(objectclass=builtinDomain)))");
 219         if (!state->domain_dn) {
 220                 talloc_free(state);
 221                 return NT_STATUS_NO_SUCH_DOMAIN;
 222         }
 223
 224         /* work out the builtin_dn - useful for so many calls its worth
 225            fetching here */
 226         state->builtin_dn = samdb_search_string(state->sam_ctx, state, NULL,
 227                                                 "dn", "objectClass=builtinDomain");
 228         if (!state->builtin_dn) {
 229                 talloc_free(state);
 230                 return NT_STATUS_NO_SUCH_DOMAIN;
 231         }
 232
 233         sid_str = samdb_search_string(state->sam_ctx, state, NULL,
 234                                       "objectSid", "dn=%s", state->domain_dn);
 235         if (!sid_str) {
 236                 talloc_free(state);
 237                 return NT_STATUS_NO_SUCH_DOMAIN;
 238         }
 239
 240         state->domain_sid = dom_sid_parse_talloc(state, sid_str);
 241         if (!state->domain_sid) {
 242                 talloc_free(state);
 243                 return NT_STATUS_NO_SUCH_DOMAIN;
 244         }
 245
 246         state->builtin_sid = dom_sid_parse_talloc(state, SID_BUILTIN);
 247         if (!state->builtin_sid) {
 248                 talloc_free(state);
 249                 return NT_STATUS_NO_SUCH_DOMAIN;
 250         }
 251
 252         state->domain_name = samdb_search_string(state->sam_ctx, state, NULL,
 253                                                  "name", "dn=%s", state->domain_dn);
 254         if (!state->domain_name) {
 255                 talloc_free(state);
 256                 return NT_STATUS_NO_SUCH_DOMAIN;
 257         }
 258
 259         *_state = state;
 260
 261         return NT_STATUS_OK;
 262 }
 263
 264 /*
 265   lsa_OpenPolicy2
 266 */
 267 static NTSTATUS lsa_OpenPolicy2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 268                                struct lsa_OpenPolicy2 *r)
 269 {
 270         NTSTATUS status;
 271         struct lsa_policy_state *state;
 272         struct dcesrv_handle *handle;
 273
 274         ZERO_STRUCTP(r->out.handle);
 275
 276         status = lsa_get_policy_state(dce_call, mem_ctx, &state);
 277         if (!NT_STATUS_IS_OK(status)) {
 278                 return status;
 279         }
 280
 281         handle = dcesrv_handle_new(dce_call->conn, LSA_HANDLE_POLICY);
 282         if (!handle) {
 283                 return NT_STATUS_NO_MEMORY;
 284         }
 285
 286         handle->data = talloc_reference(handle, state);
 287         handle->destroy = lsa_Policy_destroy;
 288
 289         state->access_mask = r->in.access_mask;
 290         state->handle = handle;
 291         *r->out.handle = handle->wire_handle;
 292
 293         /* note that we have completely ignored the attr element of
 294            the OpenPolicy. As far as I can tell, this is what w2k3
 295            does */
 296
 297         return NT_STATUS_OK;
 298 }
 299
 300 /*
 301   lsa_OpenPolicy
 302   a wrapper around lsa_OpenPolicy2
 303 */
 304 static NTSTATUS lsa_OpenPolicy(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 305                                 struct lsa_OpenPolicy *r)
 306 {
 307         struct lsa_OpenPolicy2 r2;
 308
 309         r2.in.system_name = NULL;
 310         r2.in.attr = r->in.attr;
 311         r2.in.access_mask = r->in.access_mask;
 312         r2.out.handle = r->out.handle;
 313
 314         return lsa_OpenPolicy2(dce_call, mem_ctx, &r2);
 315 }
 316
 317
 318
 319
 320 /*
 321   fill in the AccountDomain info
 322 */
 323 static NTSTATUS lsa_info_AccountDomain(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
 324                                        struct lsa_DomainInfo *info)
 325 {
 326         const char * const attrs[] = { "objectSid", "name", NULL};
 327         int ret;
 328         struct ldb_message **res;
 329
 330         ret = samdb_search(state->sam_ctx, mem_ctx, NULL, &res, attrs,
 331                            "dn=%s", state->domain_dn);
 332         if (ret != 1) {
 333                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 334         }
 335
 336         info->name.string = samdb_result_string(res[0], "name", NULL);
 337         info->sid         = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
 338
 339         return NT_STATUS_OK;
 340 }
 341
 342 /*
 343   fill in the DNS domain info
 344 */
 345 static NTSTATUS lsa_info_DNS(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
 346                              struct lsa_DnsDomainInfo *info)
 347 {
 348         const char * const attrs[] = { "name", "dnsDomain", "objectGUID", "objectSid", NULL };
 349         int ret;
 350         struct ldb_message **res;
 351
 352         ret = samdb_search(state->sam_ctx, mem_ctx, NULL, &res, attrs,
 353                            "dn=%s", state->domain_dn);
 354         if (ret != 1) {
 355                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 356         }
 357
 358         info->name.string       = samdb_result_string(res[0],           "name", NULL);
 359         info->dns_domain.string = samdb_result_string(res[0],           "dnsDomain", NULL);
 360         info->dns_forest.string = samdb_result_string(res[0],           "dnsDomain", NULL);
 361         info->domain_guid       = samdb_result_guid(res[0],             "objectGUID");
 362         info->sid               = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
 363
 364         return NT_STATUS_OK;
 365 }
 366
 367 /*
 368   lsa_QueryInfoPolicy2
 369 */
 370 static NTSTATUS lsa_QueryInfoPolicy2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 371                                      struct lsa_QueryInfoPolicy2 *r)
 372 {
 373         struct lsa_policy_state *state;
 374         struct dcesrv_handle *h;
 375
 376         r->out.info = NULL;
 377
 378         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
 379
 380         state = h->data;
 381
 382         r->out.info = talloc_p(mem_ctx, union lsa_PolicyInformation);
 383         if (!r->out.info) {
 384                 return NT_STATUS_NO_MEMORY;
 385         }
 386
 387         ZERO_STRUCTP(r->out.info);
 388
 389         switch (r->in.level) {
 390         case LSA_POLICY_INFO_DOMAIN:
 391         case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
 392                 return lsa_info_AccountDomain(state, mem_ctx, &r->out.info->account_domain);
 393
 394         case LSA_POLICY_INFO_DNS:
 395                 return lsa_info_DNS(state, mem_ctx, &r->out.info->dns);
 396         }
 397
 398         return NT_STATUS_INVALID_INFO_CLASS;
 399 }
 400
 401 /*
 402   lsa_QueryInfoPolicy
 403 */
 404 static NTSTATUS lsa_QueryInfoPolicy(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 405                                     struct lsa_QueryInfoPolicy *r)
 406 {
 407         struct lsa_QueryInfoPolicy2 r2;
 408         NTSTATUS status;
 409
 410         r2.in.handle = r->in.handle;
 411         r2.in.level = r->in.level;
 412
 413         status = lsa_QueryInfoPolicy2(dce_call, mem_ctx, &r2);
 414
 415         r->out.info = r2.out.info;
 416
 417         return status;
 418 }
 419
 420 /*
 421   lsa_SetInfoPolicy
 422 */
 423 static NTSTATUS lsa_SetInfoPolicy(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 424                                   struct lsa_SetInfoPolicy *r)
 425 {
 426         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 427 }
 428
 429
 430 /*
 431   lsa_ClearAuditLog
 432 */
 433 static NTSTATUS lsa_ClearAuditLog(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 434                                   struct lsa_ClearAuditLog *r)
 435 {
 436         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 437 }
 438
 439
 440 /*
 441   lsa_CreateAccount
 442 */
 443 static NTSTATUS lsa_CreateAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 444                                   struct lsa_CreateAccount *r)
 445 {
 446         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 447 }
 448
 449
 450 /*
 451   lsa_EnumAccounts
 452 */
 453 static NTSTATUS lsa_EnumAccounts(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 454                                  struct lsa_EnumAccounts *r)
 455 {
 456         struct dcesrv_handle *h;
 457         struct lsa_policy_state *state;
 458         int ret, i;
 459         struct ldb_message **res;
 460         const char * const attrs[] = { "objectSid", NULL};
 461         uint32_t count;
 462
 463         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
 464
 465         state = h->data;
 466
 467         ret = samdb_search(state->sam_ctx, mem_ctx, state->builtin_dn, &res, attrs,
 468                            "privilege=*");
 469         if (ret <= 0) {
 470                 return NT_STATUS_NO_SUCH_USER;
 471         }
 472
 473         if (*r->in.resume_handle >= ret) {
 474                 return NT_STATUS_NO_MORE_ENTRIES;
 475         }
 476
 477         count = ret - *r->in.resume_handle;
 478         if (count > r->in.num_entries) {
 479                 count = r->in.num_entries;
 480         }
 481
 482         if (count == 0) {
 483                 return NT_STATUS_NO_MORE_ENTRIES;
 484         }
 485
 486         r->out.sids->sids = talloc_array_p(r->out.sids, struct lsa_SidPtr, count);
 487         if (r->out.sids->sids == NULL) {
 488                 return NT_STATUS_NO_MEMORY;
 489         }
 490
 491         for (i=0;i<count;i++) {
 492                 const char *sidstr;
 493
 494                 sidstr = samdb_result_string(res[i + *r->in.resume_handle], "objectSid", NULL);
 495                 if (sidstr == NULL) {
 496                         return NT_STATUS_NO_MEMORY;
 497                 }
 498                 r->out.sids->sids[i].sid = dom_sid_parse_talloc(r->out.sids->sids, sidstr);
 499                 if (r->out.sids->sids[i].sid == NULL) {
 500                         return NT_STATUS_NO_MEMORY;
 501                 }
 502         }
 503
 504         r->out.sids->num_sids = count;
 505         *r->out.resume_handle = count + *r->in.resume_handle;
 506
 507         return NT_STATUS_OK;
 508
 509 }
 510
 511
 512 /*
 513   lsa_CreateTrustedDomain
 514 */
 515 static NTSTATUS lsa_CreateTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 516                                         struct lsa_CreateTrustedDomain *r)
 517 {
 518         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 519 }
 520
 521
 522 /*
 523   lsa_EnumTrustDom
 524 */
 525 static NTSTATUS lsa_EnumTrustDom(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 526                        struct lsa_EnumTrustDom *r)
 527 {
 528         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 529 }
 530
 531
 532 /*
 533   return the authority name and authority sid, given a sid
 534 */
 535 static NTSTATUS lsa_authority_name(struct lsa_policy_state *state,
 536                                    TALLOC_CTX *mem_ctx, struct dom_sid *sid,
 537                                    const char **authority_name,
 538                                    struct dom_sid **authority_sid)
 539 {
 540         if (dom_sid_in_domain(state->domain_sid, sid)) {
 541                 *authority_name = state->domain_name;
 542                 *authority_sid = state->domain_sid;
 543                 return NT_STATUS_OK;
 544         }
 545
 546         if (dom_sid_in_domain(state->builtin_sid, sid)) {
 547                 *authority_name = "BUILTIN";
 548                 *authority_sid = state->builtin_sid;
 549                 return NT_STATUS_OK;
 550         }
 551
 552         *authority_sid = dom_sid_dup(mem_ctx, sid);
 553         if (*authority_sid == NULL) {
 554                 return NT_STATUS_NO_MEMORY;
 555         }
 556         (*authority_sid)->num_auths = 0;
 557         *authority_name = dom_sid_string(mem_ctx, *authority_sid);
 558         if (*authority_name == NULL) {
 559                 return NT_STATUS_NO_MEMORY;
 560         }
 561
 562         return NT_STATUS_OK;
 563 }
 564
 565 /*
 566   add to the lsa_RefDomainList for LookupSids and LookupNames
 567 */
 568 static NTSTATUS lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
 569                                    struct dom_sid *sid,
 570                                    struct lsa_RefDomainList *domains,
 571                                    uint32_t *sid_index)
 572 {
 573         NTSTATUS status;
 574         const char *authority_name;
 575         struct dom_sid *authority_sid;
 576         int i;
 577
 578         /* work out the authority name */
 579         status = lsa_authority_name(state, mem_ctx, sid,
 580                                     &authority_name, &authority_sid);
 581         if (!NT_STATUS_IS_OK(status)) {
 582                 return status;
 583         }
 584
 585         /* see if we've already done this authority name */
 586         for (i=0;i<domains->count;i++) {
 587                 if (strcmp(authority_name, domains->domains[i].name.string) == 0) {
 588                         *sid_index = i;
 589                         return NT_STATUS_OK;
 590                 }
 591         }
 592
 593         domains->domains = talloc_realloc_p(domains,
 594                                             domains->domains,
 595                                             struct lsa_TrustInformation,
 596                                             domains->count+1);
 597         if (domains->domains == NULL) {
 598                 return NT_STATUS_NO_MEMORY;
 599         }
 600         domains->domains[i].name.string = authority_name;
 601         domains->domains[i].sid         = authority_sid;
 602         domains->count++;
 603         *sid_index = i;
 604
 605         return NT_STATUS_OK;
 606 }
 607
 608 /*
 609   lookup a name for 1 SID
 610 */
 611 static NTSTATUS lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
 612                                struct dom_sid *sid, const char *sid_str,
 613                                const char **name, uint32_t *atype)
 614 {
 615         int ret;
 616         struct ldb_message **res;
 617         const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "name", NULL};
 618         NTSTATUS status;
 619
 620         ret = samdb_search(state->sam_ctx, mem_ctx, NULL, &res, attrs,
 621                            "objectSid=%s", sid_str);
 622         if (ret == 1) {
 623                 *name = ldb_msg_find_string(res[0], "sAMAccountName", NULL);
 624                 if (!*name) {
 625                         *name = ldb_msg_find_string(res[0], "name", NULL);
 626                         if (!*name) {
 627                                 *name = talloc_strdup(mem_ctx, sid_str);
 628                                 NTSTATUS_TALLOC_CHECK(*name);
 629                         }
 630                 }
 631
 632                 *atype = samdb_result_uint(res[0], "sAMAccountType", 0);
 633
 634                 return NT_STATUS_OK;
 635         }
 636
 637         status = sidmap_allocated_sid_lookup(state->sidmap, mem_ctx, sid, name, atype);
 638
 639         return status;
 640 }
 641
 642
 643 /*
 644   lsa_LookupSids3
 645 */
 646 static NTSTATUS lsa_LookupSids3(struct dcesrv_call_state *dce_call,
 647                                 TALLOC_CTX *mem_ctx,
 648                                 struct lsa_LookupSids3 *r)
 649 {
 650         struct lsa_policy_state *state;
 651         int i;
 652         NTSTATUS status = NT_STATUS_OK;
 653
 654         r->out.domains = NULL;
 655
 656         status = lsa_get_policy_state(dce_call, mem_ctx, &state);
 657         if (!NT_STATUS_IS_OK(status)) {
 658                 return status;
 659         }
 660
 661         r->out.domains = talloc_zero_p(mem_ctx,  struct lsa_RefDomainList);
 662         if (r->out.domains == NULL) {
 663                 return NT_STATUS_NO_MEMORY;
 664         }
 665
 666         r->out.names = talloc_zero_p(mem_ctx,  struct lsa_TransNameArray2);
 667         if (r->out.names == NULL) {
 668                 return NT_STATUS_NO_MEMORY;
 669         }
 670
 671         *r->out.count = 0;
 672
 673         r->out.names->names = talloc_array_p(r->out.names, struct lsa_TranslatedName2,
 674                                              r->in.sids->num_sids);
 675         if (r->out.names->names == NULL) {
 676                 return NT_STATUS_NO_MEMORY;
 677         }
 678
 679         for (i=0;i<r->in.sids->num_sids;i++) {
 680                 struct dom_sid *sid = r->in.sids->sids[i].sid;
 681                 char *sid_str = dom_sid_string(mem_ctx, sid);
 682                 const char *name;
 683                 uint32_t atype, rtype, sid_index;
 684                 NTSTATUS status2;
 685
 686                 r->out.names->count++;
 687                 (*r->out.count)++;
 688
 689                 r->out.names->names[i].sid_type    = SID_NAME_UNKNOWN;
 690                 r->out.names->names[i].name.string = sid_str;
 691                 r->out.names->names[i].sid_index   = 0xFFFFFFFF;
 692                 r->out.names->names[i].unknown     = 0;
 693
 694                 if (sid_str == NULL) {
 695                         r->out.names->names[i].name.string = "(SIDERROR)";
 696                         status = STATUS_SOME_UNMAPPED;
 697                         continue;
 698                 }
 699
 700                 /* work out the authority name */
 701                 status2 = lsa_authority_list(state, mem_ctx, sid, r->out.domains, &sid_index);
 702                 if (!NT_STATUS_IS_OK(status2)) {
 703                         return status2;
 704                 }
 705
 706                 status2 = lsa_lookup_sid(state, mem_ctx, sid, sid_str,
 707                                          &name, &atype);
 708                 if (!NT_STATUS_IS_OK(status2)) {
 709                         status = STATUS_SOME_UNMAPPED;
 710                         continue;
 711                 }
 712
 713                 rtype = samdb_atype_map(atype);
 714                 if (rtype == SID_NAME_UNKNOWN) {
 715                         status = STATUS_SOME_UNMAPPED;
 716                         continue;
 717                 }
 718
 719                 r->out.names->names[i].sid_type    = rtype;
 720                 r->out.names->names[i].name.string = name;
 721                 r->out.names->names[i].sid_index   = sid_index;
 722                 r->out.names->names[i].unknown     = 0;
 723         }
 724
 725         return status;
 726 }
 727
 728
 729 /*
 730   lsa_LookupSids2
 731 */
 732 static NTSTATUS lsa_LookupSids2(struct dcesrv_call_state *dce_call,
 733                                 TALLOC_CTX *mem_ctx,
 734                                 struct lsa_LookupSids2 *r)
 735 {
 736         struct lsa_LookupSids3 r3;
 737         NTSTATUS status;
 738
 739         r3.in.sids     = r->in.sids;
 740         r3.in.names    = r->in.names;
 741         r3.in.level    = r->in.level;
 742         r3.in.count    = r->in.count;
 743         r3.in.unknown1 = r->in.unknown1;
 744         r3.in.unknown2 = r->in.unknown2;
 745         r3.out.count   = r->out.count;
 746         r3.out.names   = r->out.names;
 747
 748         status = lsa_LookupSids3(dce_call, mem_ctx, &r3);
 749         if (dce_call->fault_code != 0) {
 750                 return status;
 751         }
 752
 753         r->out.domains = r3.out.domains;
 754         r->out.names   = r3.out.names;
 755         r->out.count   = r3.out.count;
 756
 757         return status;
 758 }
 759
 760
 761 /*
 762   lsa_LookupSids
 763 */
 764 static NTSTATUS lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 765                                struct lsa_LookupSids *r)
 766 {
 767         struct lsa_LookupSids3 r3;
 768         NTSTATUS status;
 769         int i;
 770
 771         r3.in.sids     = r->in.sids;
 772         r3.in.names    = NULL;
 773         r3.in.level    = r->in.level;
 774         r3.in.count    = r->in.count;
 775         r3.in.unknown1 = 0;
 776         r3.in.unknown2 = 0;
 777         r3.out.count   = r->out.count;
 778
 779         status = lsa_LookupSids3(dce_call, mem_ctx, &r3);
 780         if (dce_call->fault_code != 0) {
 781                 return status;
 782         }
 783
 784         r->out.domains = r3.out.domains;
 785         r->out.names = talloc_p(mem_ctx, struct lsa_TransNameArray);
 786         if (r->out.names == NULL) {
 787                 return NT_STATUS_NO_MEMORY;
 788         }
 789         r->out.names->count = r3.out.names->count;
 790         r->out.names->names = talloc_array_p(r->out.names, struct lsa_TranslatedName,
 791                                              r->out.names->count);
 792         if (r->out.names->names == NULL) {
 793                 return NT_STATUS_NO_MEMORY;
 794         }
 795         for (i=0;i<r->out.names->count;i++) {
 796                 r->out.names->names[i].sid_type    = r3.out.names->names[i].sid_type;
 797                 r->out.names->names[i].name.string = r3.out.names->names[i].name.string;
 798                 r->out.names->names[i].sid_index   = r3.out.names->names[i].sid_index;
 799         }
 800
 801         return status;
 802 }
 803
 804
 805 /*
 806   lsa_CreateSecret
 807 */
 808 static NTSTATUS lsa_CreateSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 809                        struct lsa_CreateSecret *r)
 810 {
 811         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
 812 }
 813
 814
 815 /*
 816   lsa_OpenAccount
 817 */
 818 static NTSTATUS lsa_OpenAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 819                                 struct lsa_OpenAccount *r)
 820 {
 821         struct dcesrv_handle *h, *ah;
 822         struct lsa_policy_state *state;
 823         struct lsa_account_state *astate;
 824
 825         ZERO_STRUCTP(r->out.acct_handle);
 826
 827         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
 828
 829         state = h->data;
 830
 831         astate = talloc_p(dce_call->conn, struct lsa_account_state);
 832         if (astate == NULL) {
 833                 return NT_STATUS_NO_MEMORY;
 834         }
 835
 836         astate->account_sid = dom_sid_dup(astate, r->in.sid);
 837         if (astate->account_sid == NULL) {
 838                 talloc_free(astate);
 839                 return NT_STATUS_NO_MEMORY;
 840         }
 841
 842         astate->account_sid_str = dom_sid_string(astate, astate->account_sid);
 843         if (astate->account_sid_str == NULL) {
 844                 talloc_free(astate);
 845                 return NT_STATUS_NO_MEMORY;
 846         }
 847
 848         /* check it really exists */
 849         astate->account_dn = samdb_search_string(state->sam_ctx, astate,
 850                                                  NULL, "dn",
 851                                                  "(&(objectSid=%s)(objectClass=group))",
 852                                                  astate->account_sid_str);
 853         if (astate->account_dn == NULL) {
 854                 talloc_free(astate);
 855                 return NT_STATUS_NO_SUCH_USER;
 856         }
 857
 858         astate->policy = talloc_reference(astate, state);
 859         astate->access_mask = r->in.access_mask;
 860
 861         ah = dcesrv_handle_new(dce_call->conn, LSA_HANDLE_ACCOUNT);
 862         if (!ah) {
 863                 talloc_free(astate);
 864                 return NT_STATUS_NO_MEMORY;
 865         }
 866
 867         ah->data = astate;
 868         ah->destroy = lsa_Account_destroy;
 869
 870         *r->out.acct_handle = ah->wire_handle;
 871
 872         return NT_STATUS_OK;
 873 }
 874
 875
 876 /*
 877   lsa_EnumPrivsAccount
 878 */
 879 static NTSTATUS lsa_EnumPrivsAccount(struct dcesrv_call_state *dce_call,
 880                                      TALLOC_CTX *mem_ctx,
 881                                      struct lsa_EnumPrivsAccount *r)
 882 {
 883         struct dcesrv_handle *h;
 884         struct lsa_account_state *astate;
 885         int ret, i;
 886         struct ldb_message **res;
 887         const char * const attrs[] = { "privilege", NULL};
 888         struct ldb_message_element *el;
 889
 890         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
 891
 892         astate = h->data;
 893
 894         r->out.privs = talloc_p(mem_ctx, struct lsa_PrivilegeSet);
 895         r->out.privs->count = 0;
 896         r->out.privs->unknown = 0;
 897         r->out.privs->set = NULL;
 898
 899         ret = samdb_search(astate->policy->sam_ctx, mem_ctx, NULL, &res, attrs,
 900                            "dn=%s", astate->account_dn);
 901         if (ret != 1) {
 902                 return NT_STATUS_OK;
 903         }
 904
 905         el = ldb_msg_find_element(res[0], "privilege");
 906         if (el == NULL || el->num_values == 0) {
 907                 return NT_STATUS_OK;
 908         }
 909
 910         r->out.privs->set = talloc_array_p(r->out.privs,
 911                                            struct lsa_LUIDAttribute, el->num_values);
 912         if (r->out.privs->set == NULL) {
 913                 return NT_STATUS_NO_MEMORY;
 914         }
 915
 916         for (i=0;i<el->num_values;i++) {
 917                 int id = sec_privilege_id(el->values[i].data);
 918                 if (id == -1) {
 919                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 920                 }
 921                 r->out.privs->set[i].attribute = 0;
 922                 r->out.privs->set[i].luid.low = id;
 923                 r->out.privs->set[i].luid.high = 0;
 924         }
 925
 926         r->out.privs->count = el->num_values;
 927
 928         return NT_STATUS_OK;
 929 }
 930
 931 /*
 932   lsa_EnumAccountRights
 933 */
 934 static NTSTATUS lsa_EnumAccountRights(struct dcesrv_call_state *dce_call,
 935                                       TALLOC_CTX *mem_ctx,
 936                                       struct lsa_EnumAccountRights *r)
 937 {
 938         struct dcesrv_handle *h;
 939         struct lsa_policy_state *state;
 940         int ret, i;
 941         struct ldb_message **res;
 942         const char * const attrs[] = { "privilege", NULL};
 943         const char *sidstr;
 944         struct ldb_message_element *el;
 945
 946         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
 947
 948         state = h->data;
 949
 950         sidstr = dom_sid_string(mem_ctx, r->in.sid);
 951         if (sidstr == NULL) {
 952                 return NT_STATUS_NO_MEMORY;
 953         }
 954
 955         ret = samdb_search(state->sam_ctx, mem_ctx, NULL, &res, attrs,
 956                            "objectSid=%s", sidstr);
 957         if (ret != 1) {
 958                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 959         }
 960
 961         el = ldb_msg_find_element(res[0], "privilege");
 962         if (el == NULL || el->num_values == 0) {
 963                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 964         }
 965
 966         r->out.rights->count = el->num_values;
 967         r->out.rights->names = talloc_array_p(r->out.rights,
 968                                               struct lsa_String, r->out.rights->count);
 969         if (r->out.rights->names == NULL) {
 970                 return NT_STATUS_NO_MEMORY;
 971         }
 972
 973         for (i=0;i<el->num_values;i++) {
 974                 r->out.rights->names[i].string = el->values[i].data;
 975         }
 976
 977         return NT_STATUS_OK;
 978 }
 979
 980
 981
 982 /*
 983   helper for lsa_AddAccountRights and lsa_RemoveAccountRights
 984 */
 985 static NTSTATUS lsa_AddRemoveAccountRights(struct dcesrv_call_state *dce_call,
 986                                            TALLOC_CTX *mem_ctx,
 987                                            struct lsa_policy_state *state,
 988                                            int ldb_flag,
 989                                            struct dom_sid *sid,
 990                                            const struct lsa_RightSet *rights)
 991 {
 992         const char *sidstr;
 993         struct ldb_message msg;
 994         struct ldb_message_element el;
 995         int i, ret;
 996         const char *dn;
 997         struct lsa_EnumAccountRights r2;
 998
 999         sidstr = dom_sid_string(mem_ctx, sid);
1000         if (sidstr == NULL) {
1001                 return NT_STATUS_NO_MEMORY;
1002         }
1003
1004         dn = samdb_search_string(state->sam_ctx, mem_ctx, NULL, "dn",
1005                                  "objectSid=%s", sidstr);
1006         if (dn == NULL) {
1007                 return NT_STATUS_NO_SUCH_USER;
1008         }
1009
1010         msg.dn = talloc_strdup(mem_ctx, dn);
1011         if (msg.dn == NULL) {
1012                 return NT_STATUS_NO_MEMORY;
1013         }
1014         msg.num_elements = 1;
1015         msg.elements = &el;
1016         el.flags = ldb_flag;
1017         el.name = talloc_strdup(mem_ctx, "privilege");
1018         if (el.name == NULL) {
1019                 return NT_STATUS_NO_MEMORY;
1020         }
1021
1022         if (ldb_flag == LDB_FLAG_MOD_ADD) {
1023                 NTSTATUS status;
1024
1025                 r2.in.handle = &state->handle->wire_handle;
1026                 r2.in.sid = sid;
1027                 r2.out.rights = talloc_p(mem_ctx, struct lsa_RightSet);
1028
1029                 status = lsa_EnumAccountRights(dce_call, mem_ctx, &r2);
1030                 if (!NT_STATUS_IS_OK(status)) {
1031                         ZERO_STRUCTP(r2.out.rights);
1032                 }
1033         }
1034
1035         el.num_values = 0;
1036         el.values = talloc_array_p(mem_ctx, struct ldb_val, rights->count);
1037         if (el.values == NULL) {
1038                 return NT_STATUS_NO_MEMORY;
1039         }
1040         for (i=0;i<rights->count;i++) {
1041                 if (sec_privilege_id(rights->names[i].string) == -1) {
1042                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1043                 }
1044
1045                 if (ldb_flag == LDB_FLAG_MOD_ADD) {
1046                         int j;
1047                         for (j=0;j<r2.out.rights->count;j++) {
1048                                 if (StrCaseCmp(r2.out.rights->names[j].string,
1049                                                rights->names[i].string) == 0) {
1050                                         break;
1051                                 }
1052                         }
1053                         if (j != r2.out.rights->count) continue;
1054                 }
1055
1056
1057                 el.values[el.num_values].length = strlen(rights->names[i].string);
1058                 el.values[el.num_values].data = talloc_strdup(mem_ctx, rights->names[i].string);
1059                 if (el.values[el.num_values].data == NULL) {
1060                         return NT_STATUS_NO_MEMORY;
1061                 }
1062                 el.num_values++;
1063         }
1064
1065         if (el.num_values == 0) {
1066                 return NT_STATUS_OK;
1067         }
1068
1069         ret = samdb_modify(state->sam_ctx, mem_ctx, &msg);
1070         if (ret != 0) {
1071                 if (ldb_flag == LDB_FLAG_MOD_DELETE) {
1072                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1073                 }
1074                 return NT_STATUS_UNEXPECTED_IO_ERROR;
1075         }
1076
1077         return NT_STATUS_OK;
1078 }
1079
1080 /*
1081   lsa_AddPrivilegesToAccount
1082 */
1083 static NTSTATUS lsa_AddPrivilegesToAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1084                                            struct lsa_AddPrivilegesToAccount *r)
1085 {
1086         struct lsa_RightSet rights;
1087         struct dcesrv_handle *h;
1088         struct lsa_account_state *astate;
1089         int i;
1090
1091         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
1092
1093         astate = h->data;
1094
1095         rights.count = r->in.privs->count;
1096         rights.names = talloc_array_p(mem_ctx, struct lsa_String, rights.count);
1097         if (rights.names == NULL) {
1098                 return NT_STATUS_NO_MEMORY;
1099         }
1100         for (i=0;i<rights.count;i++) {
1101                 int id = r->in.privs->set[i].luid.low;
1102                 if (r->in.privs->set[i].luid.high) {
1103                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1104                 }
1105                 rights.names[i].string = sec_privilege_name(id);
1106                 if (rights.names[i].string == NULL) {
1107                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1108                 }
1109         }
1110
1111         return lsa_AddRemoveAccountRights(dce_call, mem_ctx, astate->policy,
1112                                           LDB_FLAG_MOD_ADD, astate->account_sid,
1113                                           &rights);
1114 }
1115
1116
1117 /*
1118   lsa_RemovePrivilegesFromAccount
1119 */
1120 static NTSTATUS lsa_RemovePrivilegesFromAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1121                                                 struct lsa_RemovePrivilegesFromAccount *r)
1122 {
1123         struct lsa_RightSet *rights;
1124         struct dcesrv_handle *h;
1125         struct lsa_account_state *astate;
1126         int i;
1127
1128         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_ACCOUNT);
1129
1130         astate = h->data;
1131
1132         rights = talloc_p(mem_ctx, struct lsa_RightSet);
1133
1134         if (r->in.remove_all == 1 &&
1135             r->in.privs == NULL) {
1136                 struct lsa_EnumAccountRights r2;
1137                 NTSTATUS status;
1138
1139                 r2.in.handle = &astate->policy->handle->wire_handle;
1140                 r2.in.sid = astate->account_sid;
1141                 r2.out.rights = rights;
1142
1143                 status = lsa_EnumAccountRights(dce_call, mem_ctx, &r2);
1144                 if (!NT_STATUS_IS_OK(status)) {
1145                         return status;
1146                 }
1147
1148                 return lsa_AddRemoveAccountRights(dce_call, mem_ctx, astate->policy,
1149                                                   LDB_FLAG_MOD_DELETE, astate->account_sid,
1150                                                   r2.out.rights);
1151         }
1152
1153         if (r->in.remove_all != 0) {
1154                 return NT_STATUS_INVALID_PARAMETER;
1155         }
1156
1157         rights->count = r->in.privs->count;
1158         rights->names = talloc_array_p(mem_ctx, struct lsa_String, rights->count);
1159         if (rights->names == NULL) {
1160                 return NT_STATUS_NO_MEMORY;
1161         }
1162         for (i=0;i<rights->count;i++) {
1163                 int id = r->in.privs->set[i].luid.low;
1164                 if (r->in.privs->set[i].luid.high) {
1165                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1166                 }
1167                 rights->names[i].string = sec_privilege_name(id);
1168                 if (rights->names[i].string == NULL) {
1169                         return NT_STATUS_NO_SUCH_PRIVILEGE;
1170                 }
1171         }
1172
1173         return lsa_AddRemoveAccountRights(dce_call, mem_ctx, astate->policy,
1174                                           LDB_FLAG_MOD_DELETE, astate->account_sid,
1175                                           rights);
1176 }
1177
1178
1179 /*
1180   lsa_GetQuotasForAccount
1181 */
1182 static NTSTATUS lsa_GetQuotasForAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1183                        struct lsa_GetQuotasForAccount *r)
1184 {
1185         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1186 }
1187
1188
1189 /*
1190   lsa_SetQuotasForAccount
1191 */
1192 static NTSTATUS lsa_SetQuotasForAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1193                        struct lsa_SetQuotasForAccount *r)
1194 {
1195         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1196 }
1197
1198
1199 /*
1200   lsa_GetSystemAccessAccount
1201 */
1202 static NTSTATUS lsa_GetSystemAccessAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1203                        struct lsa_GetSystemAccessAccount *r)
1204 {
1205         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1206 }
1207
1208
1209 /*
1210   lsa_SetSystemAccessAccount
1211 */
1212 static NTSTATUS lsa_SetSystemAccessAccount(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1213                        struct lsa_SetSystemAccessAccount *r)
1214 {
1215         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1216 }
1217
1218
1219 /*
1220   lsa_OpenTrustedDomain
1221 */
1222 static NTSTATUS lsa_OpenTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1223                        struct lsa_OpenTrustedDomain *r)
1224 {
1225         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1226 }
1227
1228
1229 /*
1230   lsa_QueryTrustedDomainInfo
1231 */
1232 static NTSTATUS lsa_QueryTrustedDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1233                        struct lsa_QueryTrustedDomainInfo *r)
1234 {
1235         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1236 }
1237
1238
1239 /*
1240   lsa_SetInformationTrustedDomain
1241 */
1242 static NTSTATUS lsa_SetInformationTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1243                        struct lsa_SetInformationTrustedDomain *r)
1244 {
1245         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1246 }
1247
1248
1249 /*
1250   lsa_OpenSecret
1251 */
1252 static NTSTATUS lsa_OpenSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1253                        struct lsa_OpenSecret *r)
1254 {
1255         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1256 }
1257
1258
1259 /*
1260   lsa_SetSecret
1261 */
1262 static NTSTATUS lsa_SetSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1263                        struct lsa_SetSecret *r)
1264 {
1265         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1266 }
1267
1268
1269 /*
1270   lsa_QuerySecret
1271 */
1272 static NTSTATUS lsa_QuerySecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1273                        struct lsa_QuerySecret *r)
1274 {
1275         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1276 }
1277
1278
1279 /*
1280   lsa_LookupPrivValue
1281 */
1282 static NTSTATUS lsa_LookupPrivValue(struct dcesrv_call_state *dce_call,
1283                                     TALLOC_CTX *mem_ctx,
1284                                     struct lsa_LookupPrivValue *r)
1285 {
1286         struct dcesrv_handle *h;
1287         struct lsa_policy_state *state;
1288         int id;
1289
1290         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1291
1292         state = h->data;
1293
1294         id = sec_privilege_id(r->in.name->string);
1295         if (id == -1) {
1296                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1297         }
1298
1299         r->out.luid->low = id;
1300         r->out.luid->high = 0;
1301
1302         return NT_STATUS_OK;
1303 }
1304
1305
1306 /*
1307   lsa_LookupPrivName
1308 */
1309 static NTSTATUS lsa_LookupPrivName(struct dcesrv_call_state *dce_call,
1310                                    TALLOC_CTX *mem_ctx,
1311                                    struct lsa_LookupPrivName *r)
1312 {
1313         struct dcesrv_handle *h;
1314         struct lsa_policy_state *state;
1315         const char *privname;
1316
1317         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1318
1319         state = h->data;
1320
1321         if (r->in.luid->high != 0) {
1322                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1323         }
1324
1325         privname = sec_privilege_name(r->in.luid->low);
1326         if (privname == NULL) {
1327                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1328         }
1329
1330         r->out.name = talloc_p(mem_ctx, struct lsa_String);
1331         if (r->out.name == NULL) {
1332                 return NT_STATUS_NO_MEMORY;
1333         }
1334         r->out.name->string = privname;
1335
1336         return NT_STATUS_OK;
1337 }
1338
1339
1340 /*
1341   lsa_LookupPrivDisplayName
1342 */
1343 static NTSTATUS lsa_LookupPrivDisplayName(struct dcesrv_call_state *dce_call,
1344                                           TALLOC_CTX *mem_ctx,
1345                                           struct lsa_LookupPrivDisplayName *r)
1346 {
1347         struct dcesrv_handle *h;
1348         struct lsa_policy_state *state;
1349         int id;
1350
1351         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1352
1353         state = h->data;
1354
1355         id = sec_privilege_id(r->in.name->string);
1356         if (id == -1) {
1357                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1358         }
1359
1360         r->out.disp_name = talloc_p(mem_ctx, struct lsa_String);
1361         if (r->out.disp_name == NULL) {
1362                 return NT_STATUS_NO_MEMORY;
1363         }
1364
1365         r->out.disp_name->string = sec_privilege_display_name(id, r->in.language_id);
1366         if (r->out.disp_name->string == NULL) {
1367                 return NT_STATUS_INTERNAL_ERROR;
1368         }
1369
1370         return NT_STATUS_OK;
1371 }
1372
1373
1374 /*
1375   lsa_DeleteObject
1376 */
1377 static NTSTATUS lsa_DeleteObject(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1378                        struct lsa_DeleteObject *r)
1379 {
1380         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1381 }
1382
1383
1384 /*
1385   lsa_EnumAccountsWithUserRight
1386 */
1387 static NTSTATUS lsa_EnumAccountsWithUserRight(struct dcesrv_call_state *dce_call,
1388                                               TALLOC_CTX *mem_ctx,
1389                                               struct lsa_EnumAccountsWithUserRight *r)
1390 {
1391         struct dcesrv_handle *h;
1392         struct lsa_policy_state *state;
1393         int ret, i;
1394         struct ldb_message **res;
1395         const char * const attrs[] = { "objectSid", NULL};
1396         const char *privname;
1397
1398         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1399
1400         state = h->data;
1401
1402         if (r->in.name == NULL) {
1403                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1404         }
1405
1406         privname = r->in.name->string;
1407         if (sec_privilege_id(privname) == -1) {
1408                 return NT_STATUS_NO_SUCH_PRIVILEGE;
1409         }
1410
1411         ret = samdb_search(state->sam_ctx, mem_ctx, NULL, &res, attrs,
1412                            "privilege=%s", privname);
1413         if (ret <= 0) {
1414                 return NT_STATUS_NO_SUCH_USER;
1415         }
1416
1417         r->out.sids->sids = talloc_array_p(r->out.sids, struct lsa_SidPtr, ret);
1418         if (r->out.sids->sids == NULL) {
1419                 return NT_STATUS_NO_MEMORY;
1420         }
1421         for (i=0;i<ret;i++) {
1422                 const char *sidstr;
1423                 sidstr = samdb_result_string(res[i], "objectSid", NULL);
1424                 if (sidstr == NULL) {
1425                         return NT_STATUS_NO_MEMORY;
1426                 }
1427                 r->out.sids->sids[i].sid = dom_sid_parse_talloc(r->out.sids->sids,
1428                                                                 sidstr);
1429                 if (r->out.sids->sids[i].sid == NULL) {
1430                         return NT_STATUS_NO_MEMORY;
1431                 }
1432         }
1433         r->out.sids->num_sids = ret;
1434
1435         return NT_STATUS_OK;
1436 }
1437
1438
1439 /*
1440   lsa_AddAccountRights
1441 */
1442 static NTSTATUS lsa_AddAccountRights(struct dcesrv_call_state *dce_call,
1443                                      TALLOC_CTX *mem_ctx,
1444                                      struct lsa_AddAccountRights *r)
1445 {
1446         struct dcesrv_handle *h;
1447         struct lsa_policy_state *state;
1448
1449         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1450
1451         state = h->data;
1452
1453         return lsa_AddRemoveAccountRights(dce_call, mem_ctx, state,
1454                                           LDB_FLAG_MOD_ADD,
1455                                           r->in.sid, r->in.rights);
1456 }
1457
1458
1459 /*
1460   lsa_RemoveAccountRights
1461 */
1462 static NTSTATUS lsa_RemoveAccountRights(struct dcesrv_call_state *dce_call,
1463                                         TALLOC_CTX *mem_ctx,
1464                                         struct lsa_RemoveAccountRights *r)
1465 {
1466         struct dcesrv_handle *h;
1467         struct lsa_policy_state *state;
1468
1469         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1470
1471         state = h->data;
1472
1473         return lsa_AddRemoveAccountRights(dce_call, mem_ctx, state,
1474                                           LDB_FLAG_MOD_DELETE,
1475                                           r->in.sid, r->in.rights);
1476 }
1477
1478
1479 /*
1480   lsa_QueryTrustedDomainInfoBySid
1481 */
1482 static NTSTATUS lsa_QueryTrustedDomainInfoBySid(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1483                                                 struct lsa_QueryTrustedDomainInfoBySid *r)
1484 {
1485         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1486 }
1487
1488
1489 /*
1490   lsa_SetTrustDomainInfo
1491 */
1492 static NTSTATUS lsa_SetTrustDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1493                        struct lsa_SetTrustDomainInfo *r)
1494 {
1495         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1496 }
1497
1498
1499 /*
1500   lsa_DeleteTrustDomain
1501 */
1502 static NTSTATUS lsa_DeleteTrustDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1503                        struct lsa_DeleteTrustDomain *r)
1504 {
1505         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1506 }
1507
1508
1509 /*
1510   lsa_StorePrivateData
1511 */
1512 static NTSTATUS lsa_StorePrivateData(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1513                        struct lsa_StorePrivateData *r)
1514 {
1515         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1516 }
1517
1518
1519 /*
1520   lsa_RetrievePrivateData
1521 */
1522 static NTSTATUS lsa_RetrievePrivateData(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1523                        struct lsa_RetrievePrivateData *r)
1524 {
1525         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1526 }
1527
1528
1529 /*
1530   lsa_GetUserName
1531 */
1532 static NTSTATUS lsa_GetUserName(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1533                        struct lsa_GetUserName *r)
1534 {
1535         NTSTATUS status = NT_STATUS_OK;
1536         const char *account_name;
1537         const char *authority_name;
1538         struct lsa_String *_account_name;
1539         struct lsa_StringPointer *_authority_name = NULL;
1540
1541         /* this is what w2k3 does */
1542         r->out.account_name = r->in.account_name;
1543         r->out.authority_name = r->in.authority_name;
1544
1545         if (r->in.account_name && r->in.account_name->string) {
1546                 return NT_STATUS_INVALID_PARAMETER;
1547         }
1548
1549         if (r->in.authority_name &&
1550             r->in.authority_name->string &&
1551             r->in.authority_name->string->string) {
1552                 return NT_STATUS_INVALID_PARAMETER;
1553         }
1554
1555         /* TODO: this check should go and we should rely on the calling code that this is valid */
1556         if (!dce_call->conn->auth_state.session_info ||
1557             !dce_call->conn->auth_state.session_info->server_info ||
1558             !dce_call->conn->auth_state.session_info->server_info->account_name ||
1559             !dce_call->conn->auth_state.session_info->server_info->domain_name) {
1560                 return NT_STATUS_INTERNAL_ERROR;
1561         }
1562
1563         account_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->server_info->account_name);
1564         authority_name = talloc_reference(mem_ctx, dce_call->conn->auth_state.session_info->server_info->domain_name);
1565
1566         _account_name = talloc_p(mem_ctx, struct lsa_String);
1567         NTSTATUS_TALLOC_CHECK(_account_name);
1568         _account_name->string = account_name;
1569
1570         if (r->in.authority_name) {
1571                 _authority_name = talloc_p(mem_ctx, struct lsa_StringPointer);
1572                 NTSTATUS_TALLOC_CHECK(_authority_name);
1573                 _authority_name->string = talloc_p(mem_ctx, struct lsa_String);
1574                 NTSTATUS_TALLOC_CHECK(_authority_name->string);
1575                 _authority_name->string->string = authority_name;
1576         }
1577
1578         r->out.account_name = _account_name;
1579         r->out.authority_name = _authority_name;
1580
1581         return status;
1582 }
1583
1584 /*
1585   lsa_SetInfoPolicy2
1586 */
1587 static NTSTATUS lsa_SetInfoPolicy2(struct dcesrv_call_state *dce_call,
1588                                    TALLOC_CTX *mem_ctx,
1589                                    struct lsa_SetInfoPolicy2 *r)
1590 {
1591         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1592 }
1593
1594 /*
1595   lsa_QueryTrustedDomainInfoByName
1596 */
1597 static NTSTATUS lsa_QueryTrustedDomainInfoByName(struct dcesrv_call_state *dce_call,
1598                                                  TALLOC_CTX *mem_ctx,
1599                                                  struct lsa_QueryTrustedDomainInfoByName *r)
1600 {
1601         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1602 }
1603
1604 /*
1605   lsa_SetTrustedDomainInfoByName
1606 */
1607 static NTSTATUS lsa_SetTrustedDomainInfoByName(struct dcesrv_call_state *dce_call,
1608                                                TALLOC_CTX *mem_ctx,
1609                                                struct lsa_SetTrustedDomainInfoByName *r)
1610 {
1611         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1612 }
1613
1614 /*
1615   lsa_EnumTrustedDomainsEx
1616 */
1617 static NTSTATUS lsa_EnumTrustedDomainsEx(struct dcesrv_call_state *dce_call,
1618                                          TALLOC_CTX *mem_ctx,
1619                                          struct lsa_EnumTrustedDomainsEx *r)
1620 {
1621         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1622 }
1623
1624 /*
1625   lsa_CreateTrustedDomainEx
1626 */
1627 static NTSTATUS lsa_CreateTrustedDomainEx(struct dcesrv_call_state *dce_call,
1628                                           TALLOC_CTX *mem_ctx,
1629                                           struct lsa_CreateTrustedDomainEx *r)
1630 {
1631         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1632 }
1633
1634 /*
1635   lsa_CloseTrustedDomainEx
1636 */
1637 static NTSTATUS lsa_CloseTrustedDomainEx(struct dcesrv_call_state *dce_call,
1638                                          TALLOC_CTX *mem_ctx,
1639                                          struct lsa_CloseTrustedDomainEx *r)
1640 {
1641         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1642 }
1643
1644 /*
1645   lsa_QueryDomainInformationPolicy
1646 */
1647 static NTSTATUS lsa_QueryDomainInformationPolicy(struct dcesrv_call_state *dce_call,
1648                                                  TALLOC_CTX *mem_ctx,
1649                                                  struct lsa_QueryDomainInformationPolicy *r)
1650 {
1651         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1652 }
1653
1654 /*
1655   lsa_SetDomInfoPolicy
1656 */
1657 static NTSTATUS lsa_SetDomInfoPolicy(struct dcesrv_call_state *dce_call,
1658                                      TALLOC_CTX *mem_ctx,
1659                                      struct lsa_SetDomInfoPolicy *r)
1660 {
1661         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1662 }
1663
1664 /*
1665   lsa_OpenTrustedDomainByName
1666 */
1667 static NTSTATUS lsa_OpenTrustedDomainByName(struct dcesrv_call_state *dce_call,
1668                                             TALLOC_CTX *mem_ctx,
1669                                             struct lsa_OpenTrustedDomainByName *r)
1670 {
1671         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1672 }
1673
1674 /*
1675   lsa_TestCall
1676 */
1677 static NTSTATUS lsa_TestCall(struct dcesrv_call_state *dce_call,
1678                              TALLOC_CTX *mem_ctx,
1679                              struct lsa_TestCall *r)
1680 {
1681         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1682 }
1683
1684 /*
1685   lookup a SID for 1 name
1686 */
1687 static NTSTATUS lsa_lookup_name(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
1688                                 const char *name, struct dom_sid **sid, uint32_t *atype)
1689 {
1690         int ret;
1691         struct ldb_message **res;
1692         const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
1693         const char *p;
1694
1695         p = strchr_m(name, '\\');
1696         if (p != NULL) {
1697                 /* TODO: properly parse the domain prefix here, and use it to
1698                    limit the search */
1699                 name = p + 1;
1700         }
1701
1702         ret = samdb_search(state->sam_ctx, mem_ctx, NULL, &res, attrs, "sAMAccountName=%s", name);
1703         if (ret == 1) {
1704                 const char *sid_str = ldb_msg_find_string(res[0], "objectSid", NULL);
1705                 if (sid_str == NULL) {
1706                         return NT_STATUS_INVALID_SID;
1707                 }
1708
1709                 *sid = dom_sid_parse_talloc(mem_ctx, sid_str);
1710                 if (*sid == NULL) {
1711                         return NT_STATUS_INVALID_SID;
1712                 }
1713
1714                 *atype = samdb_result_uint(res[0], "sAMAccountType", 0);
1715
1716                 return NT_STATUS_OK;
1717         }
1718
1719         /* need to add a call into sidmap to check for a allocated sid */
1720
1721         return NT_STATUS_INVALID_SID;
1722 }
1723
1724
1725 /*
1726   lsa_LookupNames3
1727 */
1728 static NTSTATUS lsa_LookupNames3(struct dcesrv_call_state *dce_call,
1729                                  TALLOC_CTX *mem_ctx,
1730                                  struct lsa_LookupNames3 *r)
1731 {
1732         struct lsa_policy_state *state;
1733         struct dcesrv_handle *h;
1734         int i;
1735         NTSTATUS status = NT_STATUS_OK;
1736
1737         r->out.domains = NULL;
1738
1739         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1740
1741         state = h->data;
1742
1743         r->out.domains = talloc_zero_p(mem_ctx,  struct lsa_RefDomainList);
1744         if (r->out.domains == NULL) {
1745                 return NT_STATUS_NO_MEMORY;
1746         }
1747
1748         r->out.sids = talloc_zero_p(mem_ctx,  struct lsa_TransSidArray3);
1749         if (r->out.sids == NULL) {
1750                 return NT_STATUS_NO_MEMORY;
1751         }
1752
1753         *r->out.count = 0;
1754
1755         r->out.sids->sids = talloc_array_p(r->out.sids, struct lsa_TranslatedSid3,
1756                                            r->in.num_names);
1757         if (r->out.sids->sids == NULL) {
1758                 return NT_STATUS_NO_MEMORY;
1759         }
1760
1761         for (i=0;i<r->in.num_names;i++) {
1762                 const char *name = r->in.names[i].string;
1763                 struct dom_sid *sid;
1764                 uint32_t atype, rtype, sid_index;
1765                 NTSTATUS status2;
1766
1767                 r->out.sids->count++;
1768                 (*r->out.count)++;
1769
1770                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
1771                 r->out.sids->sids[i].sid         = NULL;
1772                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
1773                 r->out.sids->sids[i].unknown     = 0;
1774
1775                 status2 = lsa_lookup_name(state, mem_ctx, name, &sid, &atype);
1776                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
1777                         status = STATUS_SOME_UNMAPPED;
1778                         continue;
1779                 }
1780
1781                 rtype = samdb_atype_map(atype);
1782                 if (rtype == SID_NAME_UNKNOWN) {
1783                         status = STATUS_SOME_UNMAPPED;
1784                         continue;
1785                 }
1786
1787                 status2 = lsa_authority_list(state, mem_ctx, sid, r->out.domains, &sid_index);
1788                 if (!NT_STATUS_IS_OK(status2)) {
1789                         return status2;
1790                 }
1791
1792                 r->out.sids->sids[i].sid_type    = rtype;
1793                 r->out.sids->sids[i].sid         = sid;
1794                 r->out.sids->sids[i].sid_index   = sid_index;
1795                 r->out.sids->sids[i].unknown     = 0;
1796         }
1797
1798         return status;
1799 }
1800
1801 /*
1802   lsa_LookupNames2
1803 */
1804 static NTSTATUS lsa_LookupNames2(struct dcesrv_call_state *dce_call,
1805                                  TALLOC_CTX *mem_ctx,
1806                                  struct lsa_LookupNames2 *r)
1807 {
1808         struct lsa_policy_state *state;
1809         struct dcesrv_handle *h;
1810         int i;
1811         NTSTATUS status = NT_STATUS_OK;
1812
1813         r->out.domains = NULL;
1814
1815         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
1816
1817         state = h->data;
1818
1819         r->out.domains = talloc_zero_p(mem_ctx,  struct lsa_RefDomainList);
1820         if (r->out.domains == NULL) {
1821                 return NT_STATUS_NO_MEMORY;
1822         }
1823
1824         r->out.sids = talloc_zero_p(mem_ctx,  struct lsa_TransSidArray2);
1825         if (r->out.sids == NULL) {
1826                 return NT_STATUS_NO_MEMORY;
1827         }
1828
1829         *r->out.count = 0;
1830
1831         r->out.sids->sids = talloc_array_p(r->out.sids, struct lsa_TranslatedSid2,
1832                                            r->in.num_names);
1833         if (r->out.sids->sids == NULL) {
1834                 return NT_STATUS_NO_MEMORY;
1835         }
1836
1837         for (i=0;i<r->in.num_names;i++) {
1838                 const char *name = r->in.names[i].string;
1839                 struct dom_sid *sid;
1840                 uint32_t atype, rtype, sid_index;
1841                 NTSTATUS status2;
1842
1843                 r->out.sids->count++;
1844                 (*r->out.count)++;
1845
1846                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
1847                 r->out.sids->sids[i].rid         = 0xFFFFFFFF;
1848                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
1849                 r->out.sids->sids[i].unknown     = 0;
1850
1851                 status2 = lsa_lookup_name(state, mem_ctx, name, &sid, &atype);
1852                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
1853                         status = STATUS_SOME_UNMAPPED;
1854                         continue;
1855                 }
1856
1857                 rtype = samdb_atype_map(atype);
1858                 if (rtype == SID_NAME_UNKNOWN) {
1859                         status = STATUS_SOME_UNMAPPED;
1860                         continue;
1861                 }
1862
1863                 status2 = lsa_authority_list(state, mem_ctx, sid, r->out.domains, &sid_index);
1864                 if (!NT_STATUS_IS_OK(status2)) {
1865                         return status2;
1866                 }
1867
1868                 r->out.sids->sids[i].sid_type    = rtype;
1869                 r->out.sids->sids[i].rid         = sid->sub_auths[sid->num_auths-1];
1870                 r->out.sids->sids[i].sid_index   = sid_index;
1871                 r->out.sids->sids[i].unknown     = 0;
1872         }
1873
1874         return status;
1875 }
1876
1877 /*
1878   lsa_LookupNames
1879 */
1880 static NTSTATUS lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1881                        struct lsa_LookupNames *r)
1882 {
1883         struct lsa_LookupNames2 r2;
1884         NTSTATUS status;
1885         int i;
1886
1887         r2.in.handle    = r->in.handle;
1888         r2.in.num_names = r->in.num_names;
1889         r2.in.names     = r->in.names;
1890         r2.in.sids      = NULL;
1891         r2.in.level     = r->in.level;
1892         r2.in.count     = r->in.count;
1893         r2.in.unknown1  = 0;
1894         r2.in.unknown2  = 0;
1895         r2.out.count    = r->out.count;
1896
1897         status = lsa_LookupNames2(dce_call, mem_ctx, &r2);
1898         if (dce_call->fault_code != 0) {
1899                 return status;
1900         }
1901
1902         r->out.domains = r2.out.domains;
1903         r->out.sids = talloc_p(mem_ctx, struct lsa_TransSidArray);
1904         if (r->out.sids == NULL) {
1905                 return NT_STATUS_NO_MEMORY;
1906         }
1907         r->out.sids->count = r2.out.sids->count;
1908         r->out.sids->sids = talloc_array_p(r->out.sids, struct lsa_TranslatedSid,
1909                                            r->out.sids->count);
1910         if (r->out.sids->sids == NULL) {
1911                 return NT_STATUS_NO_MEMORY;
1912         }
1913         for (i=0;i<r->out.sids->count;i++) {
1914                 r->out.sids->sids[i].sid_type    = r2.out.sids->sids[i].sid_type;
1915                 r->out.sids->sids[i].rid         = r2.out.sids->sids[i].rid;
1916                 r->out.sids->sids[i].sid_index   = r2.out.sids->sids[i].sid_index;
1917         }
1918
1919         return status;
1920 }
1921
1922
1923
1924 /*
1925   lsa_CreateTrustedDomainEx2
1926 */
1927 static NTSTATUS lsa_CreateTrustedDomainEx2(struct dcesrv_call_state *dce_call,
1928                                            TALLOC_CTX *mem_ctx,
1929                                            struct lsa_CreateTrustedDomainEx2 *r)
1930 {
1931         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1932 }
1933
1934 /*
1935   lsa_CREDRWRITE
1936 */
1937 static NTSTATUS lsa_CREDRWRITE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1938                        struct lsa_CREDRWRITE *r)
1939 {
1940         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1941 }
1942
1943
1944 /*
1945   lsa_CREDRREAD
1946 */
1947 static NTSTATUS lsa_CREDRREAD(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1948                        struct lsa_CREDRREAD *r)
1949 {
1950         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1951 }
1952
1953
1954 /*
1955   lsa_CREDRENUMERATE
1956 */
1957 static NTSTATUS lsa_CREDRENUMERATE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1958                        struct lsa_CREDRENUMERATE *r)
1959 {
1960         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1961 }
1962
1963
1964 /*
1965   lsa_CREDRWRITEDOMAINCREDENTIALS
1966 */
1967 static NTSTATUS lsa_CREDRWRITEDOMAINCREDENTIALS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1968                        struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
1969 {
1970         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1971 }
1972
1973
1974 /*
1975   lsa_CREDRREADDOMAINCREDENTIALS
1976 */
1977 static NTSTATUS lsa_CREDRREADDOMAINCREDENTIALS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1978                        struct lsa_CREDRREADDOMAINCREDENTIALS *r)
1979 {
1980         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1981 }
1982
1983
1984 /*
1985   lsa_CREDRDELETE
1986 */
1987 static NTSTATUS lsa_CREDRDELETE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1988                        struct lsa_CREDRDELETE *r)
1989 {
1990         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
1991 }
1992
1993
1994 /*
1995   lsa_CREDRGETTARGETINFO
1996 */
1997 static NTSTATUS lsa_CREDRGETTARGETINFO(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1998                        struct lsa_CREDRGETTARGETINFO *r)
1999 {
2000         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2001 }
2002
2003
2004 /*
2005   lsa_CREDRPROFILELOADED
2006 */
2007 static NTSTATUS lsa_CREDRPROFILELOADED(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2008                        struct lsa_CREDRPROFILELOADED *r)
2009 {
2010         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2011 }
2012
2013
2014 /*
2015   lsa_CREDRGETSESSIONTYPES
2016 */
2017 static NTSTATUS lsa_CREDRGETSESSIONTYPES(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2018                        struct lsa_CREDRGETSESSIONTYPES *r)
2019 {
2020         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2021 }
2022
2023
2024 /*
2025   lsa_LSARREGISTERAUDITEVENT
2026 */
2027 static NTSTATUS lsa_LSARREGISTERAUDITEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2028                        struct lsa_LSARREGISTERAUDITEVENT *r)
2029 {
2030         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2031 }
2032
2033
2034 /*
2035   lsa_LSARGENAUDITEVENT
2036 */
2037 static NTSTATUS lsa_LSARGENAUDITEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2038                        struct lsa_LSARGENAUDITEVENT *r)
2039 {
2040         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2041 }
2042
2043
2044 /*
2045   lsa_LSARUNREGISTERAUDITEVENT
2046 */
2047 static NTSTATUS lsa_LSARUNREGISTERAUDITEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2048                        struct lsa_LSARUNREGISTERAUDITEVENT *r)
2049 {
2050         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2051 }
2052
2053
2054 /*
2055   lsa_LSARQUERYFORESTTRUSTINFORMATION
2056 */
2057 static NTSTATUS lsa_LSARQUERYFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2058                        struct lsa_LSARQUERYFORESTTRUSTINFORMATION *r)
2059 {
2060         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2061 }
2062
2063
2064 /*
2065   lsa_LSARSETFORESTTRUSTINFORMATION
2066 */
2067 static NTSTATUS lsa_LSARSETFORESTTRUSTINFORMATION(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2068                        struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2069 {
2070         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2071 }
2072
2073
2074 /*
2075   lsa_CREDRRENAME
2076 */
2077 static NTSTATUS lsa_CREDRRENAME(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2078                        struct lsa_CREDRRENAME *r)
2079 {
2080         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2081 }
2082
2083
2084 /*
2085   lsa_LSARLOOKUPNAMES4
2086 */
2087 static NTSTATUS lsa_LSARLOOKUPNAMES4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2088                        struct lsa_LSARLOOKUPNAMES4 *r)
2089 {
2090         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2091 }
2092
2093
2094 /*
2095   lsa_LSAROPENPOLICYSCE
2096 */
2097 static NTSTATUS lsa_LSAROPENPOLICYSCE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2098                        struct lsa_LSAROPENPOLICYSCE *r)
2099 {
2100         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2101 }
2102
2103
2104 /*
2105   lsa_LSARADTREGISTERSECURITYEVENTSOURCE
2106 */
2107 static NTSTATUS lsa_LSARADTREGISTERSECURITYEVENTSOURCE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2108                        struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2109 {
2110         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2111 }
2112
2113
2114 /*
2115   lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE
2116 */
2117 static NTSTATUS lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2118                        struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2119 {
2120         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2121 }
2122
2123
2124 /*
2125   lsa_LSARADTREPORTSECURITYEVENT
2126 */
2127 static NTSTATUS lsa_LSARADTREPORTSECURITYEVENT(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
2128                        struct lsa_LSARADTREPORTSECURITYEVENT *r)
2129 {
2130         DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
2131 }
2132
2133
2134 /* include the generated boilerplate */
2135 #include "librpc/gen_ndr/ndr_lsa_s.c"