build: moved libds/common/flag_mapping.c into a common subsystem
[sfrench/samba-autobuild/.git] / source4 / rpc_server / lsa / lsa_lookup.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    endpoint server for the lsarpc pipe
5
6    Copyright (C) Andrew Tridgell 2004
7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "rpc_server/lsa/lsa.h"
24 #include "libds/common/flag_mapping.h"
25
26 static const struct {
27         const char *domain;
28         const char *name;
29         const char *sid;
30         enum lsa_SidType rtype;
31 } well_known[] = {
32         {
33                 .name = "EVERYONE",
34                 .sid = SID_WORLD,
35                 .rtype = SID_NAME_WKN_GRP,
36         },
37         {
38                 .name = "CREATOR OWNER",
39                 .sid = SID_CREATOR_OWNER,
40                 .rtype = SID_NAME_WKN_GRP,
41         },
42         {
43                 .name = "CREATOR GROUP",
44                 .sid = SID_CREATOR_GROUP,
45                 .rtype = SID_NAME_WKN_GRP,
46         },
47         {
48                 .name = "Owner Rights",
49                 .sid = SID_OWNER_RIGHTS,
50                 .rtype = SID_NAME_WKN_GRP,
51         },
52         {
53                 .domain = "NT AUTHORITY",
54                 .name = "Dialup",
55                 .sid = SID_NT_DIALUP,
56                 .rtype = SID_NAME_WKN_GRP,
57         },
58         {
59                 .domain = "NT AUTHORITY",
60                 .name = "Network",
61                 .sid = SID_NT_NETWORK,
62                 .rtype = SID_NAME_WKN_GRP,
63         },
64         {
65                 .domain = "NT AUTHORITY",
66                 .name = "Batch",
67                 .sid = SID_NT_BATCH,
68                 .rtype = SID_NAME_WKN_GRP,
69         },
70         {
71                 .domain = "NT AUTHORITY",
72                 .name = "Interactive",
73                 .sid = SID_NT_INTERACTIVE,
74                 .rtype = SID_NAME_WKN_GRP,
75         },
76         {
77                 .domain = "NT AUTHORITY",
78                 .name = "Service",
79                 .sid = SID_NT_SERVICE,
80                 .rtype = SID_NAME_WKN_GRP,
81         },
82         {
83                 .domain = "NT AUTHORITY",
84                 .name = "ANONYMOUS LOGON",
85                 .sid = SID_NT_ANONYMOUS,
86                 .rtype = SID_NAME_WKN_GRP,
87         },
88         {
89                 .domain = "NT AUTHORITY",
90                 .name = "Proxy",
91                 .sid = SID_NT_PROXY,
92                 .rtype = SID_NAME_WKN_GRP,
93         },
94         {
95                 .domain = "NT AUTHORITY",
96                 .name = "ServerLogon",
97                 .sid = SID_NT_ENTERPRISE_DCS,
98                 .rtype = SID_NAME_WKN_GRP,
99         },
100         {
101                 .domain = "NT AUTHORITY",
102                 .name = "Self",
103                 .sid = SID_NT_SELF,
104                 .rtype = SID_NAME_WKN_GRP,
105         },
106         {
107                 .domain = "NT AUTHORITY",
108                 .name = "Authenticated Users",
109                 .sid = SID_NT_AUTHENTICATED_USERS,
110                 .rtype = SID_NAME_WKN_GRP,
111         },
112         {
113                 .domain = "NT AUTHORITY",
114                 .name = "Restricted",
115                 .sid = SID_NT_RESTRICTED,
116                 .rtype = SID_NAME_WKN_GRP,
117         },
118         {
119                 .domain = "NT AUTHORITY",
120                 .name = "Terminal Server User",
121                 .sid = SID_NT_TERMINAL_SERVER_USERS,
122                 .rtype = SID_NAME_WKN_GRP,
123         },
124         {
125                 .domain = "NT AUTHORITY",
126                 .name = "Remote Interactive Logon",
127                 .sid = SID_NT_REMOTE_INTERACTIVE,
128                 .rtype = SID_NAME_WKN_GRP,
129         },
130         {
131                 .domain = "NT AUTHORITY",
132                 .name = "This Organization",
133                 .sid = SID_NT_THIS_ORGANISATION,
134                 .rtype = SID_NAME_WKN_GRP,
135         },
136         {
137                 .domain = "NT AUTHORITY",
138                 .name = "SYSTEM",
139                 .sid = SID_NT_SYSTEM,
140                 .rtype = SID_NAME_WKN_GRP,
141         },
142         {
143                 .domain = "NT AUTHORITY",
144                 .name = "Local Service",
145                 .sid = SID_NT_LOCAL_SERVICE,
146                 .rtype = SID_NAME_WKN_GRP,
147         },
148         {
149                 .domain = "NT AUTHORITY",
150                 .name = "Network Service",
151                 .sid = SID_NT_NETWORK_SERVICE,
152                 .rtype = SID_NAME_WKN_GRP,
153         },
154         {
155                 .domain = "NT AUTHORITY",
156                 .name = "Digest Authentication",
157                 .sid = SID_NT_DIGEST_AUTHENTICATION,
158                 .rtype = SID_NAME_WKN_GRP,
159         },
160         {
161                 .domain = "NT AUTHORITY",
162                 .name = "Enterprise Domain Controllers",
163                 .sid = SID_NT_ENTERPRISE_DCS,
164                 .rtype = SID_NAME_WKN_GRP,
165         },
166         {
167                 .domain = "NT AUTHORITY",
168                 .name = "NTLM Authentication",
169                 .sid = SID_NT_NTLM_AUTHENTICATION,
170                 .rtype = SID_NAME_WKN_GRP,
171         },
172         {
173                 .domain = "NT AUTHORITY",
174                 .name = "Other Organization",
175                 .sid = SID_NT_OTHER_ORGANISATION,
176                 .rtype = SID_NAME_WKN_GRP,
177         },
178         {
179                 .domain = "NT AUTHORITY",
180                 .name = "SChannel Authentication",
181                 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
182                 .rtype = SID_NAME_WKN_GRP,
183         },
184         {
185                 .domain = "NT AUTHORITY",
186                 .name = "IUSR",
187                 .sid = SID_NT_IUSR,
188                 .rtype = SID_NAME_WKN_GRP,
189         },
190         {
191                 .sid = NULL,
192         }
193 };
194
195 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
196                                         const char *name, const char **authority_name, 
197                                         struct dom_sid **sid, enum lsa_SidType *rtype)
198 {
199         unsigned int i;
200         for (i=0; well_known[i].sid; i++) {
201                 if (domain) {
202                         if (strcasecmp_m(domain, well_known[i].domain) == 0
203                             && strcasecmp_m(name, well_known[i].name) == 0) {
204                                 *authority_name = well_known[i].domain;
205                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
206                                 *rtype = well_known[i].rtype;
207                                 return NT_STATUS_OK;
208                         }
209                 } else {
210                         if (strcasecmp_m(name, well_known[i].name) == 0) {
211                                 *authority_name = well_known[i].domain;
212                                 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
213                                 *rtype = well_known[i].rtype;
214                                 return NT_STATUS_OK;
215                         }
216                 }
217         }
218         return NT_STATUS_NOT_FOUND;     
219 }
220
221 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx, 
222                                        const char *sid_str, const char **authority_name, 
223                                        const char **name, enum lsa_SidType *rtype) 
224 {
225         unsigned int i;
226         for (i=0; well_known[i].sid; i++) {
227                 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
228                         *authority_name = well_known[i].domain;
229                         *name = well_known[i].name;
230                         *rtype = well_known[i].rtype;
231                         return NT_STATUS_OK;
232                 }
233         }
234         return NT_STATUS_NOT_FOUND;     
235 }
236
237 /*
238   lookup a SID for 1 name
239 */
240 static NTSTATUS dcesrv_lsa_lookup_name(struct tevent_context *ev_ctx, 
241                                        struct loadparm_context *lp_ctx,
242                                        struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
243                                        const char *name, const char **authority_name, 
244                                        struct dom_sid **sid, enum lsa_SidType *rtype,
245                                        uint32_t *rid)
246 {
247         int ret, i;
248         uint32_t atype;
249         struct ldb_message **res;
250         const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
251         const char *p;
252         const char *domain;
253         const char *username;
254         struct ldb_dn *domain_dn;
255         struct dom_sid *domain_sid;
256         NTSTATUS status;
257
258         p = strchr_m(name, '\\');
259         if (p != NULL) {
260                 domain = talloc_strndup(mem_ctx, name, p-name);
261                 if (!domain) {
262                         return NT_STATUS_NO_MEMORY;
263                 }
264                 username = p + 1;
265         } else if (strchr_m(name, '@')) {
266                 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
267                 if (!NT_STATUS_IS_OK(status)) {
268                         DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
269                         return status;
270                 }
271         } else {
272                 domain = NULL;
273                 username = name;
274         }
275         
276         if (!domain) {
277                 /* Look up table of well known names */
278                 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
279                 if (NT_STATUS_IS_OK(status)) {
280                         dom_sid_split_rid(NULL, *sid, NULL, rid);
281                         return NT_STATUS_OK;
282                 }
283
284                 if (username == NULL) {
285                         *authority_name = NAME_BUILTIN;
286                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
287                         *rtype = SID_NAME_DOMAIN;
288                         *rid = 0xFFFFFFFF;
289                         return NT_STATUS_OK;
290                 }
291
292                 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) { 
293                         *authority_name = NAME_NT_AUTHORITY;
294                         *sid =  dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
295                         *rtype = SID_NAME_DOMAIN;
296                         dom_sid_split_rid(NULL, *sid, NULL, rid);
297                         return NT_STATUS_OK;
298                 }
299                 if (strcasecmp_m(username, NAME_BUILTIN) == 0) { 
300                         *authority_name = NAME_BUILTIN;
301                         *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
302                         *rtype = SID_NAME_DOMAIN;
303                         *rid = 0xFFFFFFFF;
304                         return NT_STATUS_OK;
305                 }
306                 if (strcasecmp_m(username, state->domain_dns) == 0) { 
307                         *authority_name = state->domain_name;
308                         *sid =  state->domain_sid;
309                         *rtype = SID_NAME_DOMAIN;
310                         *rid = 0xFFFFFFFF;
311                         return NT_STATUS_OK;
312                 }
313                 if (strcasecmp_m(username, state->domain_name) == 0) { 
314                         *authority_name = state->domain_name;
315                         *sid =  state->domain_sid;
316                         *rtype = SID_NAME_DOMAIN;
317                         *rid = 0xFFFFFFFF;
318                         return NT_STATUS_OK;
319                 }
320                 
321                 /* Perhaps this is a well known user? */
322                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
323                 if (!name) {
324                         return NT_STATUS_NO_MEMORY;
325                 }
326                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
327                 if (NT_STATUS_IS_OK(status)) {
328                         return status;
329                 }
330
331                 /* Perhaps this is a BUILTIN user? */
332                 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
333                 if (!name) {
334                         return NT_STATUS_NO_MEMORY;
335                 }
336                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
337                 if (NT_STATUS_IS_OK(status)) {
338                         return status;
339                 }
340
341                 /* OK, I give up - perhaps we need to assume the user is in our domain? */
342                 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
343                 if (!name) {
344                         return NT_STATUS_NO_MEMORY;
345                 }
346                 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
347                 if (NT_STATUS_IS_OK(status)) {
348                         return status;
349                 }
350
351                 return STATUS_SOME_UNMAPPED;
352         } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
353                 if (!*username) {
354                         *authority_name = NAME_NT_AUTHORITY;
355                         *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
356                         *rtype = SID_NAME_DOMAIN;
357                         dom_sid_split_rid(NULL, *sid, NULL, rid);
358                         return NT_STATUS_OK;
359                 }
360
361                 /* Look up table of well known names */
362                 status = lookup_well_known_names(mem_ctx, domain, username, authority_name, 
363                                                  sid, rtype);
364                 if (NT_STATUS_IS_OK(status)) {
365                         dom_sid_split_rid(NULL, *sid, NULL, rid);
366                 }
367                 return status;
368         } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
369                 *authority_name = NAME_BUILTIN;
370                 domain_dn = state->builtin_dn;
371         } else if (strcasecmp_m(domain, state->domain_dns) == 0) { 
372                 *authority_name = state->domain_name;
373                 domain_dn = state->domain_dn;
374         } else if (strcasecmp_m(domain, state->domain_name) == 0) { 
375                 *authority_name = state->domain_name;
376                 domain_dn = state->domain_dn;
377         } else {
378                 /* Not local, need to ask winbind in future */
379                 return STATUS_SOME_UNMAPPED;
380         }
381
382         ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
383         if (ret != 1) {
384                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
385         }
386         domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
387         if (domain_sid == NULL) {
388                 return NT_STATUS_INVALID_SID;
389         }
390
391         if (!*username) {
392                 *sid = domain_sid;
393                 *rtype = SID_NAME_DOMAIN;
394                 *rid = 0xFFFFFFFF;
395                 return NT_STATUS_OK;
396         }
397         
398         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
399                            "(&(sAMAccountName=%s)(objectSid=*))", 
400                            ldb_binary_encode_string(mem_ctx, username));
401         if (ret < 0) {
402                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
403         }
404
405         for (i=0; i < ret; i++) {
406                 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
407                 if (*sid == NULL) {
408                         return NT_STATUS_INVALID_SID;
409                 }
410
411                 /* Check that this is in the domain */
412                 if (!dom_sid_in_domain(domain_sid, *sid)) {
413                         continue;
414                 }
415
416                 atype = ldb_msg_find_attr_as_uint(res[i], "sAMAccountType", 0);
417                         
418                 *rtype = ds_atype_map(atype);
419                 if (*rtype == SID_NAME_UNKNOWN) {
420                         return STATUS_SOME_UNMAPPED;
421                 }
422
423                 dom_sid_split_rid(NULL, *sid, NULL, rid);
424                 return NT_STATUS_OK;
425         }
426
427         /* need to check for an allocated sid */
428
429         return NT_STATUS_INVALID_SID;
430 }
431
432
433 /*
434   add to the lsa_RefDomainList for LookupSids and LookupNames
435 */
436 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx, 
437                                           enum lsa_SidType rtype,
438                                           const char *authority_name,
439                                           struct dom_sid *sid, 
440                                           struct lsa_RefDomainList *domains,
441                                           uint32_t *sid_index)
442 {
443         struct dom_sid *authority_sid;
444         uint32_t i;
445
446         if (rtype != SID_NAME_DOMAIN) {
447                 authority_sid = dom_sid_dup(mem_ctx, sid);
448                 if (authority_sid == NULL) {
449                         return NT_STATUS_NO_MEMORY;
450                 }
451                 authority_sid->num_auths--;
452         } else {
453                 authority_sid = sid;
454         }
455
456         /* see if we've already done this authority name */
457         for (i=0;i<domains->count;i++) {
458                 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
459                         *sid_index = i;
460                         return NT_STATUS_OK;
461                 }
462         }
463
464         domains->domains = talloc_realloc(domains, 
465                                           domains->domains,
466                                           struct lsa_DomainInfo,
467                                           domains->count+1);
468         if (domains->domains == NULL) {
469                 return NT_STATUS_NO_MEMORY;
470         }
471         domains->domains[i].name.string = authority_name;
472         domains->domains[i].sid         = authority_sid;
473         domains->count++;
474         domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
475         *sid_index = i;
476         
477         return NT_STATUS_OK;
478 }
479
480 /*
481   lookup a name for 1 SID
482 */
483 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
484                                       struct dom_sid *sid, const char *sid_str,
485                                       const char **authority_name, 
486                                       const char **name, enum lsa_SidType *rtype)
487 {
488         NTSTATUS status;
489         int ret;
490         uint32_t atype;
491         struct ldb_message **res;
492         struct ldb_dn *domain_dn;
493         const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
494
495         status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
496         if (NT_STATUS_IS_OK(status)) {
497                 return status;
498         }
499
500         if (dom_sid_in_domain(state->domain_sid, sid)) {
501                 *authority_name = state->domain_name;
502                 domain_dn = state->domain_dn;
503         } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
504                 *authority_name = NAME_BUILTIN;
505                 domain_dn = state->builtin_dn;
506         } else {
507                 /* Not well known, our domain or built in */
508
509                 /* In future, we must look at SID histories, and at trusted domains via winbind */
510
511                 return NT_STATUS_NOT_FOUND;
512         }
513
514         /* need to re-add a check for an allocated sid */
515
516         ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
517                            "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
518         if ((ret < 0) || (ret > 1)) {
519                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
520         }
521         if (ret == 0) {
522                 return NT_STATUS_NOT_FOUND;
523         }
524
525         *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
526         if (!*name) {
527                 *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
528                 if (!*name) {
529                         *name = talloc_strdup(mem_ctx, sid_str);
530                         NT_STATUS_HAVE_NO_MEMORY(*name);
531                 }
532         }
533
534         atype = ldb_msg_find_attr_as_uint(res[0], "sAMAccountType", 0);
535         *rtype = ds_atype_map(atype);
536
537         return NT_STATUS_OK;
538 }
539
540
541 /*
542   lsa_LookupSids2
543 */
544 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
545                                 TALLOC_CTX *mem_ctx,
546                                 struct lsa_LookupSids2 *r)
547 {
548         struct lsa_policy_state *state;
549         struct lsa_RefDomainList *domains = NULL;
550         uint32_t i;
551         NTSTATUS status = NT_STATUS_OK;
552
553         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
554             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
555                 return NT_STATUS_INVALID_PARAMETER;
556         }
557
558         *r->out.domains = NULL;
559
560         /* NOTE: the WSPP test suite tries SIDs with invalid revision numbers,
561            and expects NT_STATUS_INVALID_PARAMETER back - we just treat it as 
562            an unknown SID. We could add a SID validator here. (tridge) 
563            MS-DTYP 2.4.2
564         */
565
566         status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
567         if (!NT_STATUS_IS_OK(status)) {
568                 return status;
569         }
570
571         domains = talloc_zero(r->out.domains,  struct lsa_RefDomainList);
572         if (domains == NULL) {
573                 return NT_STATUS_NO_MEMORY;
574         }
575         *r->out.domains = domains;
576
577         r->out.names = talloc_zero(mem_ctx,  struct lsa_TransNameArray2);
578         if (r->out.names == NULL) {
579                 return NT_STATUS_NO_MEMORY;
580         }
581
582         *r->out.count = 0;
583
584         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2, 
585                                              r->in.sids->num_sids);
586         if (r->out.names->names == NULL) {
587                 return NT_STATUS_NO_MEMORY;
588         }
589
590         for (i=0;i<r->in.sids->num_sids;i++) {
591                 struct dom_sid *sid = r->in.sids->sids[i].sid;
592                 char *sid_str = dom_sid_string(mem_ctx, sid);
593                 const char *name, *authority_name;
594                 enum lsa_SidType rtype;
595                 uint32_t sid_index;
596                 NTSTATUS status2;
597
598                 r->out.names->count++;
599
600                 r->out.names->names[i].sid_type    = SID_NAME_UNKNOWN;
601                 r->out.names->names[i].name.string = sid_str;
602                 r->out.names->names[i].sid_index   = 0xFFFFFFFF;
603                 r->out.names->names[i].unknown     = 0;
604
605                 if (sid_str == NULL) {
606                         r->out.names->names[i].name.string = "(SIDERROR)";
607                         status = STATUS_SOME_UNMAPPED;
608                         continue;
609                 }
610
611                 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str, 
612                                                 &authority_name, &name, &rtype);
613                 if (!NT_STATUS_IS_OK(status2)) {
614                         status = STATUS_SOME_UNMAPPED;
615                         continue;
616                 }
617
618                 /* set up the authority table */
619                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, 
620                                                     authority_name, sid, 
621                                                     domains, &sid_index);
622                 if (!NT_STATUS_IS_OK(status2)) {
623                         continue;
624                 }
625
626                 r->out.names->names[i].sid_type    = rtype;
627                 r->out.names->names[i].name.string = name;
628                 r->out.names->names[i].sid_index   = sid_index;
629                 r->out.names->names[i].unknown     = 0;
630
631                 (*r->out.count)++;
632         }
633
634         if (*r->out.count == 0) {
635                 return NT_STATUS_NONE_MAPPED;
636         }
637         if (*r->out.count != r->in.sids->num_sids) {
638                 return STATUS_SOME_UNMAPPED;
639         }
640
641         return NT_STATUS_OK;
642 }
643
644
645 /*
646   lsa_LookupSids3
647
648   Identical to LookupSids2, but doesn't take a policy handle
649   
650 */
651 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
652                                 TALLOC_CTX *mem_ctx,
653                                 struct lsa_LookupSids3 *r)
654 {
655         struct lsa_LookupSids2 r2;
656         struct lsa_OpenPolicy2 pol;
657         NTSTATUS status;
658         struct dcesrv_handle *h;
659
660         ZERO_STRUCT(r2);
661         
662         /* No policy handle on the wire, so make one up here */
663         r2.in.handle = talloc(mem_ctx, struct policy_handle);
664         if (!r2.in.handle) {
665                 return NT_STATUS_NO_MEMORY;
666         }
667
668         pol.out.handle = r2.in.handle;
669         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
670         pol.in.attr = NULL;
671         pol.in.system_name = NULL;
672         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
673         if (!NT_STATUS_IS_OK(status)) {
674                 return status;
675         }
676
677         /* ensure this handle goes away at the end of this call */
678         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
679         talloc_steal(mem_ctx, h);
680
681         r2.in.sids     = r->in.sids;
682         r2.in.names    = r->in.names;
683         r2.in.level    = r->in.level;
684         r2.in.count    = r->in.count;
685         r2.in.lookup_options = r->in.lookup_options;
686         r2.in.client_revision = r->in.client_revision;
687         r2.out.count   = r->out.count;
688         r2.out.names   = r->out.names;
689         r2.out.domains = r->out.domains;
690
691         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
692
693         r->out.domains = r2.out.domains;
694         r->out.names   = r2.out.names;
695         r->out.count   = r2.out.count;
696
697         return status;
698 }
699
700
701 /* 
702   lsa_LookupSids 
703 */
704 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
705                                struct lsa_LookupSids *r)
706 {
707         struct lsa_LookupSids2 r2;
708         NTSTATUS status;
709         uint32_t i;
710
711         ZERO_STRUCT(r2);
712
713         r2.in.handle   = r->in.handle;
714         r2.in.sids     = r->in.sids;
715         r2.in.names    = NULL;
716         r2.in.level    = r->in.level;
717         r2.in.count    = r->in.count;
718         r2.in.lookup_options = 0;
719         r2.in.client_revision = 0;
720         r2.out.count   = r->out.count;
721         r2.out.names   = NULL;
722         r2.out.domains = r->out.domains;
723
724         status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
725         /* we deliberately don't check for error from the above,
726            as even on error we are supposed to return the names  */
727
728         r->out.domains = r2.out.domains;
729         if (!r2.out.names) {
730                 r->out.names = NULL;
731                 return status;
732         }
733
734         r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
735         if (r->out.names == NULL) {
736                 return NT_STATUS_NO_MEMORY;
737         }
738         r->out.names->count = r2.out.names->count;
739         r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName, 
740                                              r->out.names->count);
741         if (r->out.names->names == NULL) {
742                 return NT_STATUS_NO_MEMORY;
743         }
744         for (i=0;i<r->out.names->count;i++) {
745                 r->out.names->names[i].sid_type    = r2.out.names->names[i].sid_type;
746                 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
747                 r->out.names->names[i].sid_index   = r2.out.names->names[i].sid_index;
748         }
749
750         return status;
751 }
752
753
754 /*
755   lsa_LookupNames3
756 */
757 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
758                                  TALLOC_CTX *mem_ctx,
759                                  struct lsa_LookupNames3 *r)
760 {
761         struct lsa_policy_state *policy_state;
762         struct dcesrv_handle *policy_handle;
763         uint32_t i;
764         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
765         struct lsa_RefDomainList *domains;
766
767         DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
768
769         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
770             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
771                 return NT_STATUS_INVALID_PARAMETER;
772         }
773
774         policy_state = policy_handle->data;
775
776         *r->out.domains = NULL;
777
778         domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
779         if (domains == NULL) {
780                 return NT_STATUS_NO_MEMORY;
781         }
782         *r->out.domains = domains;
783
784         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray3);
785         if (r->out.sids == NULL) {
786                 return NT_STATUS_NO_MEMORY;
787         }
788
789         *r->out.count = 0;
790
791         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3, 
792                                            r->in.num_names);
793         if (r->out.sids->sids == NULL) {
794                 return NT_STATUS_NO_MEMORY;
795         }
796
797         for (i=0;i<r->in.num_names;i++) {
798                 const char *name = r->in.names[i].string;
799                 const char *authority_name;
800                 struct dom_sid *sid;
801                 uint32_t sid_index, rid;
802                 enum lsa_SidType rtype;
803                 NTSTATUS status2;
804
805                 r->out.sids->count++;
806
807                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
808                 r->out.sids->sids[i].sid         = NULL;
809                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
810                 r->out.sids->sids[i].flags       = 0;
811
812                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name,
813                                                  &authority_name, &sid, &rtype, &rid);
814                 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
815                         continue;
816                 }
817
818                 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name, 
819                                                     sid, domains, &sid_index);
820                 if (!NT_STATUS_IS_OK(status2)) {
821                         continue;
822                 }
823
824                 r->out.sids->sids[i].sid_type    = rtype;
825                 r->out.sids->sids[i].sid         = sid;
826                 r->out.sids->sids[i].sid_index   = sid_index;
827                 r->out.sids->sids[i].flags       = 0;
828
829                 (*r->out.count)++;
830         }
831         
832         if (*r->out.count == 0) {
833                 return NT_STATUS_NONE_MAPPED;
834         }
835         if (*r->out.count != r->in.num_names) {
836                 return STATUS_SOME_UNMAPPED;
837         }
838
839         return NT_STATUS_OK;
840 }
841
842 /* 
843   lsa_LookupNames4
844
845   Identical to LookupNames3, but doesn't take a policy handle
846   
847 */
848 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
849                                  struct lsa_LookupNames4 *r)
850 {
851         struct lsa_LookupNames3 r2;
852         struct lsa_OpenPolicy2 pol;
853         NTSTATUS status;
854         struct dcesrv_handle *h;
855
856         ZERO_STRUCT(r2);
857
858         /* No policy handle on the wire, so make one up here */
859         r2.in.handle = talloc(mem_ctx, struct policy_handle);
860         if (!r2.in.handle) {
861                 return NT_STATUS_NO_MEMORY;
862         }
863
864         pol.out.handle = r2.in.handle;
865         pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
866         pol.in.attr = NULL;
867         pol.in.system_name = NULL;
868         status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
869         if (!NT_STATUS_IS_OK(status)) {
870                 return status;
871         }
872
873         /* ensure this handle goes away at the end of this call */
874         DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
875         talloc_steal(mem_ctx, h);
876
877         r2.in.num_names = r->in.num_names;
878         r2.in.names = r->in.names;
879         r2.in.level = r->in.level;
880         r2.in.sids = r->in.sids;
881         r2.in.count = r->in.count;
882         r2.in.lookup_options = r->in.lookup_options;
883         r2.in.client_revision = r->in.client_revision;
884         r2.out.domains = r->out.domains;
885         r2.out.sids = r->out.sids;
886         r2.out.count = r->out.count;
887         
888         status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
889         
890         r->out.domains = r2.out.domains;
891         r->out.sids = r2.out.sids;
892         r->out.count = r2.out.count;
893         return status;
894 }
895
896 /*
897   lsa_LookupNames2
898 */
899 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
900                                  TALLOC_CTX *mem_ctx,
901                                  struct lsa_LookupNames2 *r)
902 {
903         struct lsa_policy_state *state;
904         struct dcesrv_handle *h;
905         uint32_t i;
906         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
907         struct lsa_RefDomainList *domains;
908
909         *r->out.domains = NULL;
910
911         DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
912
913         if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
914             r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
915                 return NT_STATUS_INVALID_PARAMETER;
916         }
917
918         state = h->data;
919
920         domains = talloc_zero(mem_ctx,  struct lsa_RefDomainList);
921         if (domains == NULL) {
922                 return NT_STATUS_NO_MEMORY;
923         }
924         *r->out.domains = domains;
925
926         r->out.sids = talloc_zero(mem_ctx,  struct lsa_TransSidArray2);
927         if (r->out.sids == NULL) {
928                 return NT_STATUS_NO_MEMORY;
929         }
930
931         *r->out.count = 0;
932
933         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2, 
934                                            r->in.num_names);
935         if (r->out.sids->sids == NULL) {
936                 return NT_STATUS_NO_MEMORY;
937         }
938
939         for (i=0;i<r->in.num_names;i++) {
940                 const char *name = r->in.names[i].string;
941                 const char *authority_name;
942                 struct dom_sid *sid;
943                 uint32_t sid_index, rid=0;
944                 enum lsa_SidType rtype;
945                 NTSTATUS status2;
946
947                 r->out.sids->count++;
948
949                 r->out.sids->sids[i].sid_type    = SID_NAME_UNKNOWN;
950                 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
951                    to sid NULL - so we should return 0 rid for
952                    unmapped entries */
953                 r->out.sids->sids[i].rid         = 0;
954                 r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
955                 r->out.sids->sids[i].unknown     = 0;
956
957                 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name,
958                                                  &authority_name, &sid, &rtype, &rid);
959                 if (!NT_STATUS_IS_OK(status2)) {
960                         continue;
961                 }
962
963                 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name, 
964                                                     sid, domains, &sid_index);
965                 if (!NT_STATUS_IS_OK(status2)) {
966                         continue;
967                 }
968
969                 r->out.sids->sids[i].sid_type    = rtype;
970                 r->out.sids->sids[i].rid         = rid;
971                 r->out.sids->sids[i].sid_index   = sid_index;
972                 r->out.sids->sids[i].unknown     = 0;
973
974                 (*r->out.count)++;
975         }
976         
977         if (*r->out.count == 0) {
978                 return NT_STATUS_NONE_MAPPED;
979         }
980         if (*r->out.count != r->in.num_names) {
981                 return STATUS_SOME_UNMAPPED;
982         }
983
984         return NT_STATUS_OK;
985 }
986
987 /* 
988   lsa_LookupNames 
989 */
990 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
991                        struct lsa_LookupNames *r)
992 {
993         struct lsa_LookupNames2 r2;
994         NTSTATUS status;
995         uint32_t i;
996
997         ZERO_STRUCT(r2);
998
999         r2.in.handle    = r->in.handle;
1000         r2.in.num_names = r->in.num_names;
1001         r2.in.names     = r->in.names;
1002         r2.in.sids      = NULL;
1003         r2.in.level     = r->in.level;
1004         r2.in.count     = r->in.count;
1005         r2.in.lookup_options = 0;
1006         r2.in.client_revision = 0;
1007         r2.out.count    = r->out.count;
1008         r2.out.domains  = r->out.domains;
1009
1010         status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
1011         if (r2.out.sids == NULL) {
1012                 return status;
1013         }
1014
1015         r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
1016         if (r->out.sids == NULL) {
1017                 return NT_STATUS_NO_MEMORY;
1018         }
1019         r->out.sids->count = r2.out.sids->count;
1020         r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid, 
1021                                            r->out.sids->count);
1022         if (r->out.sids->sids == NULL) {
1023                 return NT_STATUS_NO_MEMORY;
1024         }
1025         for (i=0;i<r->out.sids->count;i++) {
1026                 r->out.sids->sids[i].sid_type    = r2.out.sids->sids[i].sid_type;
1027                 r->out.sids->sids[i].rid         = r2.out.sids->sids[i].rid;
1028                 r->out.sids->sids[i].sid_index   = r2.out.sids->sids[i].sid_index;
1029         }
1030
1031         return status;
1032 }
1033