r23784: use the GPLv3 boilerplate as recommended by the FSF and the license text
[tprouty/samba.git] / source / rpc_client / cli_lsarpc.c
1 /* 
2    Unix SMB/CIFS implementation.
3    RPC pipe client
4    Copyright (C) Tim Potter                        2000-2001,
5    Copyright (C) Andrew Tridgell              1992-1997,2000,
6    Copyright (C) Rafal Szczesniak                       2002
7    Copyright (C) Jeremy Allison                         2005.
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24
25 /** @defgroup lsa LSA - Local Security Architecture
26  *  @ingroup rpc_client
27  *
28  * @{
29  **/
30
31 /**
32  * @file cli_lsarpc.c
33  *
34  * RPC client routines for the LSA RPC pipe.  LSA means "local
35  * security authority", which is half of a password database.
36  **/
37
38 /** Open a LSA policy handle
39  *
40  * @param cli Handle on an initialised SMB connection */
41
42 NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
43                                 TALLOC_CTX *mem_ctx,
44                                 BOOL sec_qos, uint32 des_access,
45                                 POLICY_HND *pol)
46 {
47         prs_struct qbuf, rbuf;
48         LSA_Q_OPEN_POL q;
49         LSA_R_OPEN_POL r;
50         LSA_SEC_QOS qos;
51         NTSTATUS result;
52
53         ZERO_STRUCT(q);
54         ZERO_STRUCT(r);
55
56         /* Initialise input parameters */
57
58         if (sec_qos) {
59                 init_lsa_sec_qos(&qos, 2, 1, 0);
60                 init_q_open_pol(&q, '\\', 0, des_access, &qos);
61         } else {
62                 init_q_open_pol(&q, '\\', 0, des_access, NULL);
63         }
64
65         /* Marshall data and send request */
66
67         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY,
68                         q, r,
69                         qbuf, rbuf,
70                         lsa_io_q_open_pol,
71                         lsa_io_r_open_pol,
72                         NT_STATUS_UNSUCCESSFUL );
73
74         /* Return output parameters */
75
76         result = r.status;
77
78         if (NT_STATUS_IS_OK(result)) {
79                 *pol = r.pol;
80         }
81
82         return result;
83 }
84
85 /** Open a LSA policy handle
86   *
87   * @param cli Handle on an initialised SMB connection 
88   */
89
90 NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
91                                  TALLOC_CTX *mem_ctx, BOOL sec_qos,
92                                  uint32 des_access, POLICY_HND *pol)
93 {
94         prs_struct qbuf, rbuf;
95         LSA_Q_OPEN_POL2 q;
96         LSA_R_OPEN_POL2 r;
97         LSA_SEC_QOS qos;
98         NTSTATUS result;
99         char *srv_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", cli->cli->desthost);
100
101         ZERO_STRUCT(q);
102         ZERO_STRUCT(r);
103
104         if (sec_qos) {
105                 init_lsa_sec_qos(&qos, 2, 1, 0);
106                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, &qos);
107         } else {
108                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, NULL);
109         }
110
111         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY2,
112                         q, r,
113                         qbuf, rbuf,
114                         lsa_io_q_open_pol2,
115                         lsa_io_r_open_pol2,
116                         NT_STATUS_UNSUCCESSFUL );
117
118         /* Return output parameters */
119
120         result = r.status;
121
122         if (NT_STATUS_IS_OK(result)) {
123                 *pol = r.pol;
124         }
125
126         return result;
127 }
128
129 /* Lookup a list of sids
130  *
131  * internal version withOUT memory allocation of the target arrays.
132  * this assumes suffciently sized arrays to store domains, names and types. */
133
134 static NTSTATUS rpccli_lsa_lookup_sids_noalloc(struct rpc_pipe_client *cli,
135                                                TALLOC_CTX *mem_ctx,
136                                                POLICY_HND *pol,
137                                                int num_sids,
138                                                const DOM_SID *sids,
139                                                char **domains,
140                                                char **names,
141                                                enum lsa_SidType *types)
142 {
143         prs_struct qbuf, rbuf;
144         LSA_Q_LOOKUP_SIDS q;
145         LSA_R_LOOKUP_SIDS r;
146         DOM_R_REF ref;
147         NTSTATUS result = NT_STATUS_OK;
148         TALLOC_CTX *tmp_ctx = NULL;
149         int i;
150
151         tmp_ctx = talloc_new(mem_ctx);
152         if (!tmp_ctx) {
153                 DEBUG(0, ("rpccli_lsa_lookup_sids_noalloc: out of memory!\n"));
154                 result = NT_STATUS_UNSUCCESSFUL;
155                 goto done;
156         }
157
158         ZERO_STRUCT(q);
159         ZERO_STRUCT(r);
160
161         init_q_lookup_sids(tmp_ctx, &q, pol, num_sids, sids, 1);
162
163         ZERO_STRUCT(ref);
164
165         r.dom_ref = &ref;
166
167         CLI_DO_RPC( cli, tmp_ctx, PI_LSARPC, LSA_LOOKUPSIDS,
168                         q, r,
169                         qbuf, rbuf,
170                         lsa_io_q_lookup_sids,
171                         lsa_io_r_lookup_sids,
172                         NT_STATUS_UNSUCCESSFUL );
173
174         if (!NT_STATUS_IS_OK(r.status) &&
175             !NT_STATUS_EQUAL(r.status, STATUS_SOME_UNMAPPED)) 
176         {
177                 /* An actual error occured */
178                 result = r.status;
179                 goto done;
180         }
181
182         /* Return output parameters */
183
184         if (r.mapped_count == 0) {
185                 result = NT_STATUS_NONE_MAPPED;
186                 goto done;
187         }
188
189         for (i = 0; i < num_sids; i++) {
190                 fstring name, dom_name;
191                 uint32 dom_idx = r.names.name[i].domain_idx;
192
193                 /* Translate optimised name through domain index array */
194
195                 if (dom_idx != 0xffffffff) {
196
197                         rpcstr_pull_unistr2_fstring(
198                                 dom_name, &ref.ref_dom[dom_idx].uni_dom_name);
199                         rpcstr_pull_unistr2_fstring(
200                                 name, &r.names.uni_name[i]);
201
202                         (names)[i] = talloc_strdup(mem_ctx, name);
203                         (domains)[i] = talloc_strdup(mem_ctx, dom_name);
204                         (types)[i] = (enum lsa_SidType)r.names.name[i].sid_name_use;
205                         
206                         if (((names)[i] == NULL) || ((domains)[i] == NULL)) {
207                                 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
208                                 result = NT_STATUS_UNSUCCESSFUL;
209                                 goto done;
210                         }
211
212                 } else {
213                         (names)[i] = NULL;
214                         (domains)[i] = NULL;
215                         (types)[i] = SID_NAME_UNKNOWN;
216                 }
217         }
218
219 done:
220         TALLOC_FREE(tmp_ctx);
221         return result;
222 }
223
224 /* Lookup a list of sids 
225  *
226  * do it the right way: there is a limit (of 20480 for w2k3) entries
227  * returned by this call. when the sids list contains more entries,
228  * empty lists are returned. This version of lsa_lookup_sids passes
229  * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
230
231 /* This constant defines the limit of how many sids to look up
232  * in one call (maximum). the limit from the server side is
233  * at 20480 for win2k3, but we keep it at a save 1000 for now. */
234 #define LOOKUP_SIDS_HUNK_SIZE 1000
235
236 NTSTATUS rpccli_lsa_lookup_sids_all(struct rpc_pipe_client *cli,
237                                     TALLOC_CTX *mem_ctx,
238                                     POLICY_HND *pol, 
239                                     int num_sids,
240                                     const DOM_SID *sids, 
241                                     char ***domains,
242                                     char ***names,
243                                     enum lsa_SidType **types)
244 {
245         NTSTATUS result = NT_STATUS_OK;
246         int sids_left = 0;
247         int sids_processed = 0;
248         const DOM_SID *hunk_sids = sids;
249         char **hunk_domains = NULL;
250         char **hunk_names = NULL;
251         enum lsa_SidType *hunk_types = NULL;
252
253         if (num_sids) {
254                 if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
255                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
256                         result = NT_STATUS_NO_MEMORY;
257                         goto done;
258                 }
259
260                 if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
261                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
262                         result = NT_STATUS_NO_MEMORY;
263                         goto done;
264                 }
265
266                 if (!((*types) = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
267                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
268                         result = NT_STATUS_NO_MEMORY;
269                         goto done;
270                 }
271         } else {
272                 (*domains) = NULL;
273                 (*names) = NULL;
274                 (*types) = NULL;
275         }
276         
277         sids_left = num_sids;
278         hunk_domains = *domains;
279         hunk_names = *names;
280         hunk_types = *types;
281
282         while (sids_left > 0) {
283                 int hunk_num_sids;
284                 NTSTATUS hunk_result = NT_STATUS_OK;
285
286                 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE) 
287                                 ? LOOKUP_SIDS_HUNK_SIZE 
288                                 : sids_left);
289
290                 DEBUG(10, ("rpccli_lsa_lookup_sids_all: processing items "
291                            "%d -- %d of %d.\n", 
292                            sids_processed, 
293                            sids_processed + hunk_num_sids - 1,
294                            num_sids));
295
296                 hunk_result = rpccli_lsa_lookup_sids_noalloc(cli,
297                                                              mem_ctx,
298                                                              pol,
299                                                              hunk_num_sids, 
300                                                              hunk_sids,
301                                                              hunk_domains,
302                                                              hunk_names,
303                                                              hunk_types);
304
305                 if (!NT_STATUS_IS_OK(hunk_result) &&
306                     !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
307                     !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)) 
308                 {
309                         /* An actual error occured */
310                         goto done;
311                 }
312
313                 /* adapt overall result */
314                 if (( NT_STATUS_IS_OK(result) && 
315                      !NT_STATUS_IS_OK(hunk_result)) 
316                     ||
317                     ( NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
318                      !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)))
319                 {
320                         result = STATUS_SOME_UNMAPPED;
321                 }
322
323                 sids_left -= hunk_num_sids;
324                 sids_processed += hunk_num_sids; /* only used in DEBUG */
325                 hunk_sids += hunk_num_sids;
326                 hunk_domains += hunk_num_sids;
327                 hunk_names += hunk_num_sids;
328                 hunk_types += hunk_num_sids;
329         }
330
331 done:
332         return result;
333 }
334
335 /** Lookup a list of sids */
336
337 NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
338                                 TALLOC_CTX *mem_ctx,
339                                 POLICY_HND *pol, int num_sids,
340                                 const DOM_SID *sids, 
341                                 char ***domains,
342                                 char ***names,
343                                 enum lsa_SidType **types)
344 {
345         prs_struct qbuf, rbuf;
346         LSA_Q_LOOKUP_SIDS q;
347         LSA_R_LOOKUP_SIDS r;
348         DOM_R_REF ref;
349         NTSTATUS result = NT_STATUS_OK;
350         int i;
351
352         ZERO_STRUCT(q);
353         ZERO_STRUCT(r);
354
355         init_q_lookup_sids(mem_ctx, &q, pol, num_sids, sids, 1);
356
357         ZERO_STRUCT(ref);
358
359         r.dom_ref = &ref;
360
361         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPSIDS,
362                         q, r,
363                         qbuf, rbuf,
364                         lsa_io_q_lookup_sids,
365                         lsa_io_r_lookup_sids,
366                         NT_STATUS_UNSUCCESSFUL );
367
368         if (!NT_STATUS_IS_OK(r.status) &&
369             !NT_STATUS_EQUAL(r.status, STATUS_SOME_UNMAPPED)) {
370           
371                 /* An actual error occured */
372                 result = r.status;
373
374                 goto done;
375         }
376
377         /* Return output parameters */
378
379         if (r.mapped_count == 0) {
380                 result = NT_STATUS_NONE_MAPPED;
381                 goto done;
382         }
383
384         if (num_sids) {
385                 if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
386                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
387                         result = NT_STATUS_NO_MEMORY;
388                         goto done;
389                 }
390
391                 if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
392                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
393                         result = NT_STATUS_NO_MEMORY;
394                         goto done;
395                 }
396
397                 if (!((*types) = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
398                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
399                         result = NT_STATUS_NO_MEMORY;
400                         goto done;
401                 }
402         } else {
403                 (*domains) = NULL;
404                 (*names) = NULL;
405                 (*types) = NULL;
406         }
407                 
408         for (i = 0; i < num_sids; i++) {
409                 fstring name, dom_name;
410                 uint32 dom_idx = r.names.name[i].domain_idx;
411
412                 /* Translate optimised name through domain index array */
413
414                 if (dom_idx != 0xffffffff) {
415
416                         rpcstr_pull_unistr2_fstring(
417                                 dom_name, &ref.ref_dom[dom_idx].uni_dom_name);
418                         rpcstr_pull_unistr2_fstring(
419                                 name, &r.names.uni_name[i]);
420
421                         (*names)[i] = talloc_strdup(mem_ctx, name);
422                         (*domains)[i] = talloc_strdup(mem_ctx, dom_name);
423                         (*types)[i] = (enum lsa_SidType)r.names.name[i].sid_name_use;
424                         
425                         if (((*names)[i] == NULL) || ((*domains)[i] == NULL)) {
426                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
427                                 result = NT_STATUS_UNSUCCESSFUL;
428                                 goto done;
429                         }
430
431                 } else {
432                         (*names)[i] = NULL;
433                         (*domains)[i] = NULL;
434                         (*types)[i] = SID_NAME_UNKNOWN;
435                 }
436         }
437
438  done:
439
440         return result;
441 }
442
443 /** Lookup a list of names */
444
445 NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
446                                  TALLOC_CTX *mem_ctx,
447                                  POLICY_HND *pol, int num_names, 
448                                  const char **names,
449                                  const char ***dom_names,
450                                  int level,
451                                  DOM_SID **sids,
452                                  enum lsa_SidType **types)
453 {
454         prs_struct qbuf, rbuf;
455         LSA_Q_LOOKUP_NAMES q;
456         LSA_R_LOOKUP_NAMES r;
457         DOM_R_REF ref;
458         NTSTATUS result;
459         int i;
460         
461         ZERO_STRUCT(q);
462         ZERO_STRUCT(r);
463
464         ZERO_STRUCT(ref);
465         r.dom_ref = &ref;
466
467         init_q_lookup_names(mem_ctx, &q, pol, num_names, names, level);
468
469         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPNAMES,
470                         q, r,
471                         qbuf, rbuf,
472                         lsa_io_q_lookup_names,
473                         lsa_io_r_lookup_names,
474                         NT_STATUS_UNSUCCESSFUL);
475
476         result = r.status;
477
478         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
479             NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
480
481                 /* An actual error occured */
482
483                 goto done;
484         }
485
486         /* Return output parameters */
487
488         if (r.mapped_count == 0) {
489                 result = NT_STATUS_NONE_MAPPED;
490                 goto done;
491         }
492
493         if (num_names) {
494                 if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
495                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
496                         result = NT_STATUS_NO_MEMORY;
497                         goto done;
498                 }
499
500                 if (!((*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_names)))) {
501                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
502                         result = NT_STATUS_NO_MEMORY;
503                         goto done;
504                 }
505
506                 if (dom_names != NULL) {
507                         *dom_names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
508                         if (*dom_names == NULL) {
509                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
510                                 result = NT_STATUS_NO_MEMORY;
511                                 goto done;
512                         }
513                 }
514         } else {
515                 *sids = NULL;
516                 *types = NULL;
517                 if (dom_names != NULL) {
518                         *dom_names = NULL;
519                 }
520         }
521
522         for (i = 0; i < num_names; i++) {
523                 DOM_RID *t_rids = r.dom_rid;
524                 uint32 dom_idx = t_rids[i].rid_idx;
525                 uint32 dom_rid = t_rids[i].rid;
526                 DOM_SID *sid = &(*sids)[i];
527
528                 /* Translate optimised sid through domain index array */
529
530                 if (dom_idx == 0xffffffff) {
531                         /* Nothing to do, this is unknown */
532                         ZERO_STRUCTP(sid);
533                         (*types)[i] = SID_NAME_UNKNOWN;
534                         continue;
535                 }
536
537                 sid_copy(sid, &ref.ref_dom[dom_idx].ref_dom.sid);
538
539                 if (dom_rid != 0xffffffff) {
540                         sid_append_rid(sid, dom_rid);
541                 }
542
543                 (*types)[i] = (enum lsa_SidType)t_rids[i].type;
544
545                 if (dom_names == NULL) {
546                         continue;
547                 }
548
549                 (*dom_names)[i] = rpcstr_pull_unistr2_talloc(
550                         *dom_names, &ref.ref_dom[dom_idx].uni_dom_name);
551         }
552
553  done:
554
555         return result;
556 }
557
558 NTSTATUS rpccli_lsa_query_info_policy_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
559                                           POLICY_HND *pol, uint16 info_class,
560                                           LSA_INFO_CTR *ctr) 
561 {
562         prs_struct qbuf, rbuf;
563         LSA_Q_QUERY_INFO q;
564         LSA_R_QUERY_INFO r;
565         NTSTATUS result;
566
567         ZERO_STRUCT(q);
568         ZERO_STRUCT(r);
569
570         init_q_query(&q, pol, info_class);
571
572         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
573                 q, r,
574                 qbuf, rbuf,
575                 lsa_io_q_query,
576                 lsa_io_r_query,
577                 NT_STATUS_UNSUCCESSFUL);
578
579         result = r.status;
580
581         if (!NT_STATUS_IS_OK(result)) {
582                 goto done;
583         }
584
585  done:
586
587         *ctr = r.ctr;
588         
589         return result;
590 }
591
592 NTSTATUS rpccli_lsa_query_info_policy2_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
593                                           POLICY_HND *pol, uint16 info_class,
594                                           LSA_INFO_CTR2 *ctr) 
595 {
596         prs_struct qbuf, rbuf;
597         LSA_Q_QUERY_INFO2 q;
598         LSA_R_QUERY_INFO2 r;
599         NTSTATUS result;
600
601         ZERO_STRUCT(q);
602         ZERO_STRUCT(r);
603
604         init_q_query2(&q, pol, info_class);
605
606         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
607                 q, r,
608                 qbuf, rbuf,
609                 lsa_io_q_query_info2,
610                 lsa_io_r_query_info2,
611                 NT_STATUS_UNSUCCESSFUL);
612
613         result = r.status;
614
615         if (!NT_STATUS_IS_OK(result)) {
616                 goto done;
617         }
618
619  done:
620
621         *ctr = r.ctr;
622         
623         return result;
624 }
625
626
627
628 /** Query info policy
629  *
630  *  @param domain_sid - returned remote server's domain sid */
631
632 NTSTATUS rpccli_lsa_query_info_policy(struct rpc_pipe_client *cli,
633                                       TALLOC_CTX *mem_ctx,
634                                       POLICY_HND *pol, uint16 info_class, 
635                                       char **domain_name, DOM_SID **domain_sid)
636 {
637         prs_struct qbuf, rbuf;
638         LSA_Q_QUERY_INFO q;
639         LSA_R_QUERY_INFO r;
640         NTSTATUS result;
641
642         ZERO_STRUCT(q);
643         ZERO_STRUCT(r);
644
645         init_q_query(&q, pol, info_class);
646
647         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
648                 q, r,
649                 qbuf, rbuf,
650                 lsa_io_q_query,
651                 lsa_io_r_query,
652                 NT_STATUS_UNSUCCESSFUL);
653
654         result = r.status;
655
656         if (!NT_STATUS_IS_OK(result)) {
657                 goto done;
658         }
659
660         /* Return output parameters */
661
662         switch (info_class) {
663
664         case 3:
665                 if (domain_name && (r.ctr.info.id3.buffer_dom_name != 0)) {
666                         *domain_name = unistr2_tdup(mem_ctx, 
667                                                    &r.ctr.info.id3.
668                                                    uni_domain_name);
669                         if (!*domain_name) {
670                                 return NT_STATUS_NO_MEMORY;
671                         }
672                 }
673
674                 if (domain_sid && (r.ctr.info.id3.buffer_dom_sid != 0)) {
675                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
676                         if (!*domain_sid) {
677                                 return NT_STATUS_NO_MEMORY;
678                         }
679                         sid_copy(*domain_sid, &r.ctr.info.id3.dom_sid.sid);
680                 }
681
682                 break;
683
684         case 5:
685                 
686                 if (domain_name && (r.ctr.info.id5.buffer_dom_name != 0)) {
687                         *domain_name = unistr2_tdup(mem_ctx, 
688                                                    &r.ctr.info.id5.
689                                                    uni_domain_name);
690                         if (!*domain_name) {
691                                 return NT_STATUS_NO_MEMORY;
692                         }
693                 }
694                         
695                 if (domain_sid && (r.ctr.info.id5.buffer_dom_sid != 0)) {
696                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
697                         if (!*domain_sid) {
698                                 return NT_STATUS_NO_MEMORY;
699                         }
700                         sid_copy(*domain_sid, &r.ctr.info.id5.dom_sid.sid);
701                 }
702                 break;
703                         
704         default:
705                 DEBUG(3, ("unknown info class %d\n", info_class));
706                 break;                
707         }
708         
709  done:
710
711         return result;
712 }
713
714 /** Query info policy2
715  *
716  *  @param domain_name - returned remote server's domain name
717  *  @param dns_name - returned remote server's dns domain name
718  *  @param forest_name - returned remote server's forest name
719  *  @param domain_guid - returned remote server's domain guid
720  *  @param domain_sid - returned remote server's domain sid */
721
722 NTSTATUS rpccli_lsa_query_info_policy2(struct rpc_pipe_client *cli,
723                                        TALLOC_CTX *mem_ctx,
724                                        POLICY_HND *pol, uint16 info_class, 
725                                        char **domain_name, char **dns_name,
726                                        char **forest_name,
727                                        struct GUID **domain_guid,
728                                        DOM_SID **domain_sid)
729 {
730         prs_struct qbuf, rbuf;
731         LSA_Q_QUERY_INFO2 q;
732         LSA_R_QUERY_INFO2 r;
733         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
734
735         if (info_class != 12)
736                 goto done;
737
738         ZERO_STRUCT(q);
739         ZERO_STRUCT(r);
740
741         init_q_query2(&q, pol, info_class);
742
743         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
744                 q, r,
745                 qbuf, rbuf,
746                 lsa_io_q_query_info2,
747                 lsa_io_r_query_info2,
748                 NT_STATUS_UNSUCCESSFUL);
749
750         result = r.status;
751
752         if (!NT_STATUS_IS_OK(result)) {
753                 goto done;
754         }
755
756         /* Return output parameters */
757
758         ZERO_STRUCTP(domain_guid);
759
760         if (domain_name && r.ctr.info.id12.hdr_nb_dom_name.buffer) {
761                 *domain_name = unistr2_tdup(mem_ctx, 
762                                             &r.ctr.info.id12
763                                             .uni_nb_dom_name);
764                 if (!*domain_name) {
765                         return NT_STATUS_NO_MEMORY;
766                 }
767         }
768         if (dns_name && r.ctr.info.id12.hdr_dns_dom_name.buffer) {
769                 *dns_name = unistr2_tdup(mem_ctx, 
770                                          &r.ctr.info.id12
771                                          .uni_dns_dom_name);
772                 if (!*dns_name) {
773                         return NT_STATUS_NO_MEMORY;
774                 }
775         }
776         if (forest_name && r.ctr.info.id12.hdr_forest_name.buffer) {
777                 *forest_name = unistr2_tdup(mem_ctx, 
778                                             &r.ctr.info.id12
779                                             .uni_forest_name);
780                 if (!*forest_name) {
781                         return NT_STATUS_NO_MEMORY;
782                 }
783         }
784         
785         if (domain_guid) {
786                 *domain_guid = TALLOC_P(mem_ctx, struct GUID);
787                 if (!*domain_guid) {
788                         return NT_STATUS_NO_MEMORY;
789                 }
790                 memcpy(*domain_guid, 
791                        &r.ctr.info.id12.dom_guid, 
792                        sizeof(struct GUID));
793         }
794
795         if (domain_sid && r.ctr.info.id12.ptr_dom_sid != 0) {
796                 *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
797                 if (!*domain_sid) {
798                         return NT_STATUS_NO_MEMORY;
799                 }
800                 sid_copy(*domain_sid, 
801                          &r.ctr.info.id12.dom_sid.sid);
802         }
803         
804  done:
805
806         return result;
807 }
808
809 NTSTATUS rpccli_lsa_set_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
810                                     POLICY_HND *pol, uint16 info_class,
811                                     LSA_INFO_CTR ctr) 
812 {
813         prs_struct qbuf, rbuf;
814         LSA_Q_SET_INFO q;
815         LSA_R_SET_INFO r;
816         NTSTATUS result;
817
818         ZERO_STRUCT(q);
819         ZERO_STRUCT(r);
820
821         init_q_set(&q, pol, info_class, ctr);
822
823         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_SETINFOPOLICY,
824                 q, r,
825                 qbuf, rbuf,
826                 lsa_io_q_set,
827                 lsa_io_r_set,
828                 NT_STATUS_UNSUCCESSFUL);
829
830         result = r.status;
831
832         if (!NT_STATUS_IS_OK(result)) {
833                 goto done;
834         }
835
836         /* Return output parameters */
837
838  done:
839
840         return result;
841 }
842
843
844 /**
845  * Enumerate list of trusted domains
846  *
847  * @param cli client state (cli_state) structure of the connection
848  * @param mem_ctx memory context
849  * @param pol opened lsa policy handle
850  * @param enum_ctx enumeration context ie. index of first returned domain entry
851  * @param pref_num_domains preferred max number of entries returned in one response
852  * @param num_domains total number of trusted domains returned by response
853  * @param domain_names returned trusted domain names
854  * @param domain_sids returned trusted domain sids
855  *
856  * @return nt status code of response
857  **/
858
859 NTSTATUS rpccli_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
860                                    TALLOC_CTX *mem_ctx,
861                                    POLICY_HND *pol, uint32 *enum_ctx, 
862                                    uint32 *num_domains,
863                                    char ***domain_names, DOM_SID **domain_sids)
864 {
865         prs_struct qbuf, rbuf;
866         LSA_Q_ENUM_TRUST_DOM in;
867         LSA_R_ENUM_TRUST_DOM out;
868         int i;
869         fstring tmp;
870
871         ZERO_STRUCT(in);
872         ZERO_STRUCT(out);
873
874         /* 64k is enough for about 2000 trusted domains */
875         
876         init_q_enum_trust_dom(&in, pol, *enum_ctx, 0x10000);
877
878         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMTRUSTDOM, 
879                     in, out, 
880                     qbuf, rbuf,
881                     lsa_io_q_enum_trust_dom,
882                     lsa_io_r_enum_trust_dom, 
883                     NT_STATUS_UNSUCCESSFUL );
884
885
886         /* check for an actual error */
887
888         if ( !NT_STATUS_IS_OK(out.status) 
889                 && !NT_STATUS_EQUAL(out.status, NT_STATUS_NO_MORE_ENTRIES) 
890                 && !NT_STATUS_EQUAL(out.status, STATUS_MORE_ENTRIES) )
891         {
892                 return out.status;
893         }
894                 
895         /* Return output parameters */
896
897         *num_domains  = out.count;
898         *enum_ctx     = out.enum_context;
899         
900         if ( out.count ) {
901
902                 /* Allocate memory for trusted domain names and sids */
903
904                 if ( !(*domain_names = TALLOC_ARRAY(mem_ctx, char *, out.count)) ) {
905                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
906                         return NT_STATUS_NO_MEMORY;
907                 }
908
909                 if ( !(*domain_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, out.count)) ) {
910                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
911                         return NT_STATUS_NO_MEMORY;
912                 }
913
914                 /* Copy across names and sids */
915
916                 for (i = 0; i < out.count; i++) {
917
918                         rpcstr_pull( tmp, out.domlist->domains[i].name.string->buffer, 
919                                 sizeof(tmp), out.domlist->domains[i].name.length, 0);
920                         (*domain_names)[i] = talloc_strdup(mem_ctx, tmp);
921
922                         sid_copy(&(*domain_sids)[i], &out.domlist->domains[i].sid->sid );
923                 }
924         }
925
926         return out.status;
927 }
928
929 /** Enumerate privileges*/
930
931 NTSTATUS rpccli_lsa_enum_privilege(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
932                                 POLICY_HND *pol, uint32 *enum_context, uint32 pref_max_length,
933                                 uint32 *count, char ***privs_name, uint32 **privs_high, uint32 **privs_low)
934 {
935         prs_struct qbuf, rbuf;
936         LSA_Q_ENUM_PRIVS q;
937         LSA_R_ENUM_PRIVS r;
938         NTSTATUS result;
939         int i;
940
941         ZERO_STRUCT(q);
942         ZERO_STRUCT(r);
943
944         init_q_enum_privs(&q, pol, *enum_context, pref_max_length);
945
946         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_PRIVS,
947                 q, r,
948                 qbuf, rbuf,
949                 lsa_io_q_enum_privs,
950                 lsa_io_r_enum_privs,
951                 NT_STATUS_UNSUCCESSFUL);
952
953         result = r.status;
954
955         if (!NT_STATUS_IS_OK(result)) {
956                 goto done;
957         }
958
959         /* Return output parameters */
960
961         *enum_context = r.enum_context;
962         *count = r.count;
963
964         if (r.count) {
965                 if (!((*privs_name = TALLOC_ARRAY(mem_ctx, char *, r.count)))) {
966                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
967                         result = NT_STATUS_UNSUCCESSFUL;
968                         goto done;
969                 }
970
971                 if (!((*privs_high = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
972                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
973                         result = NT_STATUS_UNSUCCESSFUL;
974                         goto done;
975                 }
976
977                 if (!((*privs_low = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
978                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
979                         result = NT_STATUS_UNSUCCESSFUL;
980                         goto done;
981                 }
982         } else {
983                 *privs_name = NULL;
984                 *privs_high = NULL;
985                 *privs_low = NULL;
986         }
987
988         for (i = 0; i < r.count; i++) {
989                 fstring name;
990
991                 rpcstr_pull_unistr2_fstring( name, &r.privs[i].name);
992
993                 (*privs_name)[i] = talloc_strdup(mem_ctx, name);
994
995                 (*privs_high)[i] = r.privs[i].luid_high;
996                 (*privs_low)[i] = r.privs[i].luid_low;
997         }
998
999  done:
1000
1001         return result;
1002 }
1003
1004 /** Get privilege name */
1005
1006 NTSTATUS rpccli_lsa_get_dispname(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1007                               POLICY_HND *pol, const char *name, 
1008                               uint16 lang_id, uint16 lang_id_sys,
1009                               fstring description, uint16 *lang_id_desc)
1010 {
1011         prs_struct qbuf, rbuf;
1012         LSA_Q_PRIV_GET_DISPNAME q;
1013         LSA_R_PRIV_GET_DISPNAME r;
1014         NTSTATUS result;
1015
1016         ZERO_STRUCT(q);
1017         ZERO_STRUCT(r);
1018
1019         init_lsa_priv_get_dispname(&q, pol, name, lang_id, lang_id_sys);
1020
1021         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_PRIV_GET_DISPNAME,
1022                 q, r,
1023                 qbuf, rbuf,
1024                 lsa_io_q_priv_get_dispname,
1025                 lsa_io_r_priv_get_dispname,
1026                 NT_STATUS_UNSUCCESSFUL);
1027
1028         result = r.status;
1029
1030         if (!NT_STATUS_IS_OK(result)) {
1031                 goto done;
1032         }
1033
1034         /* Return output parameters */
1035         
1036         rpcstr_pull_unistr2_fstring(description , &r.desc);
1037         *lang_id_desc = r.lang_id;
1038
1039  done:
1040
1041         return result;
1042 }
1043
1044 /** Enumerate list of SIDs  */
1045
1046 NTSTATUS rpccli_lsa_enum_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1047                                 POLICY_HND *pol, uint32 *enum_ctx, uint32 pref_max_length, 
1048                                 uint32 *num_sids, DOM_SID **sids)
1049 {
1050         prs_struct qbuf, rbuf;
1051         LSA_Q_ENUM_ACCOUNTS q;
1052         LSA_R_ENUM_ACCOUNTS r;
1053         NTSTATUS result;
1054         int i;
1055
1056         ZERO_STRUCT(q);
1057         ZERO_STRUCT(r);
1058
1059         init_lsa_q_enum_accounts(&q, pol, *enum_ctx, pref_max_length);
1060
1061         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_ACCOUNTS,
1062                 q, r,
1063                 qbuf, rbuf,
1064                 lsa_io_q_enum_accounts,
1065                 lsa_io_r_enum_accounts,
1066                 NT_STATUS_UNSUCCESSFUL);
1067
1068         result = r.status;
1069
1070         if (!NT_STATUS_IS_OK(result)) {
1071                 goto done;
1072         }
1073
1074         if (r.sids.num_entries==0)
1075                 goto done;
1076
1077         /* Return output parameters */
1078
1079         *sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.sids.num_entries);
1080         if (!*sids) {
1081                 DEBUG(0, ("(cli_lsa_enum_sids): out of memory\n"));
1082                 result = NT_STATUS_UNSUCCESSFUL;
1083                 goto done;
1084         }
1085
1086         /* Copy across names and sids */
1087
1088         for (i = 0; i < r.sids.num_entries; i++) {
1089                 sid_copy(&(*sids)[i], &r.sids.sid[i].sid);
1090         }
1091
1092         *num_sids= r.sids.num_entries;
1093         *enum_ctx = r.enum_context;
1094
1095  done:
1096
1097         return result;
1098 }
1099
1100 /** Create a LSA user handle
1101  *
1102  * @param cli Handle on an initialised SMB connection
1103  *
1104  * FIXME: The code is actually identical to open account
1105  * TODO: Check and code what the function should exactly do
1106  *
1107  * */
1108
1109 NTSTATUS rpccli_lsa_create_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1110                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 desired_access, 
1111                              POLICY_HND *user_pol)
1112 {
1113         prs_struct qbuf, rbuf;
1114         LSA_Q_CREATEACCOUNT q;
1115         LSA_R_CREATEACCOUNT r;
1116         NTSTATUS result;
1117
1118         ZERO_STRUCT(q);
1119         ZERO_STRUCT(r);
1120
1121         /* Initialise input parameters */
1122
1123         init_lsa_q_create_account(&q, dom_pol, sid, desired_access);
1124
1125         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_CREATEACCOUNT,
1126                 q, r,
1127                 qbuf, rbuf,
1128                 lsa_io_q_create_account,
1129                 lsa_io_r_create_account,
1130                 NT_STATUS_UNSUCCESSFUL);
1131
1132         /* Return output parameters */
1133
1134         result = r.status;
1135
1136         if (NT_STATUS_IS_OK(result)) {
1137                 *user_pol = r.pol;
1138         }
1139
1140         return result;
1141 }
1142
1143 /** Open a LSA user handle
1144  *
1145  * @param cli Handle on an initialised SMB connection */
1146
1147 NTSTATUS rpccli_lsa_open_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1148                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 des_access, 
1149                              POLICY_HND *user_pol)
1150 {
1151         prs_struct qbuf, rbuf;
1152         LSA_Q_OPENACCOUNT q;
1153         LSA_R_OPENACCOUNT r;
1154         NTSTATUS result;
1155
1156         ZERO_STRUCT(q);
1157         ZERO_STRUCT(r);
1158
1159         /* Initialise input parameters */
1160
1161         init_lsa_q_open_account(&q, dom_pol, sid, des_access);
1162
1163         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENACCOUNT,
1164                 q, r,
1165                 qbuf, rbuf,
1166                 lsa_io_q_open_account,
1167                 lsa_io_r_open_account,
1168                 NT_STATUS_UNSUCCESSFUL);
1169
1170         /* Return output parameters */
1171
1172         result = r.status;
1173
1174         if (NT_STATUS_IS_OK(result)) {
1175                 *user_pol = r.pol;
1176         }
1177
1178         return result;
1179 }
1180
1181 /** Enumerate user privileges
1182  *
1183  * @param cli Handle on an initialised SMB connection */
1184
1185 NTSTATUS rpccli_lsa_enum_privsaccount(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1186                              POLICY_HND *pol, uint32 *count, LUID_ATTR **set)
1187 {
1188         prs_struct qbuf, rbuf;
1189         LSA_Q_ENUMPRIVSACCOUNT q;
1190         LSA_R_ENUMPRIVSACCOUNT r;
1191         NTSTATUS result;
1192         int i;
1193
1194         ZERO_STRUCT(q);
1195         ZERO_STRUCT(r);
1196
1197         /* Initialise input parameters */
1198
1199         init_lsa_q_enum_privsaccount(&q, pol);
1200
1201         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMPRIVSACCOUNT,
1202                 q, r,
1203                 qbuf, rbuf,
1204                 lsa_io_q_enum_privsaccount,
1205                 lsa_io_r_enum_privsaccount,
1206                 NT_STATUS_UNSUCCESSFUL);
1207
1208         /* Return output parameters */
1209
1210         result = r.status;
1211
1212         if (!NT_STATUS_IS_OK(result)) {
1213                 goto done;
1214         }
1215
1216         if (r.count == 0)
1217                 goto done;
1218
1219         if (!((*set = TALLOC_ARRAY(mem_ctx, LUID_ATTR, r.count)))) {
1220                 DEBUG(0, ("(cli_lsa_enum_privsaccount): out of memory\n"));
1221                 result = NT_STATUS_UNSUCCESSFUL;
1222                 goto done;
1223         }
1224
1225         for (i=0; i<r.count; i++) {
1226                 (*set)[i].luid.low = r.set.set[i].luid.low;
1227                 (*set)[i].luid.high = r.set.set[i].luid.high;
1228                 (*set)[i].attr = r.set.set[i].attr;
1229         }
1230
1231         *count=r.count;
1232  done:
1233
1234         return result;
1235 }
1236
1237 /** Get a privilege value given its name */
1238
1239 NTSTATUS rpccli_lsa_lookup_priv_value(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1240                                  POLICY_HND *pol, const char *name, LUID *luid)
1241 {
1242         prs_struct qbuf, rbuf;
1243         LSA_Q_LOOKUP_PRIV_VALUE q;
1244         LSA_R_LOOKUP_PRIV_VALUE r;
1245         NTSTATUS result;
1246
1247         ZERO_STRUCT(q);
1248         ZERO_STRUCT(r);
1249
1250         /* Marshall data and send request */
1251
1252         init_lsa_q_lookup_priv_value(&q, pol, name);
1253
1254         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPPRIVVALUE,
1255                 q, r,
1256                 qbuf, rbuf,
1257                 lsa_io_q_lookup_priv_value,
1258                 lsa_io_r_lookup_priv_value,
1259                 NT_STATUS_UNSUCCESSFUL);
1260
1261         result = r.status;
1262
1263         if (!NT_STATUS_IS_OK(result)) {
1264                 goto done;
1265         }
1266
1267         /* Return output parameters */
1268
1269         (*luid).low=r.luid.low;
1270         (*luid).high=r.luid.high;
1271
1272  done:
1273
1274         return result;
1275 }
1276
1277 /** Query LSA security object */
1278
1279 NTSTATUS rpccli_lsa_query_secobj(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1280                               POLICY_HND *pol, uint32 sec_info, 
1281                               SEC_DESC_BUF **psdb)
1282 {
1283         prs_struct qbuf, rbuf;
1284         LSA_Q_QUERY_SEC_OBJ q;
1285         LSA_R_QUERY_SEC_OBJ r;
1286         NTSTATUS result;
1287
1288         ZERO_STRUCT(q);
1289         ZERO_STRUCT(r);
1290
1291         /* Marshall data and send request */
1292
1293         init_q_query_sec_obj(&q, pol, sec_info);
1294
1295         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYSECOBJ,
1296                 q, r,
1297                 qbuf, rbuf,
1298                 lsa_io_q_query_sec_obj,
1299                 lsa_io_r_query_sec_obj,
1300                 NT_STATUS_UNSUCCESSFUL);
1301
1302         result = r.status;
1303
1304         if (!NT_STATUS_IS_OK(result)) {
1305                 goto done;
1306         }
1307
1308         /* Return output parameters */
1309
1310         if (psdb)
1311                 *psdb = r.buf;
1312
1313  done:
1314
1315         return result;
1316 }
1317
1318
1319 /* Enumerate account rights This is similar to enum_privileges but
1320    takes a SID directly, avoiding the open_account call.
1321 */
1322
1323 NTSTATUS rpccli_lsa_enum_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1324                                      POLICY_HND *pol, DOM_SID *sid,
1325                                      uint32 *count, char ***priv_names)
1326 {
1327         prs_struct qbuf, rbuf;
1328         LSA_Q_ENUM_ACCT_RIGHTS q;
1329         LSA_R_ENUM_ACCT_RIGHTS r;
1330         NTSTATUS result;
1331         int i;
1332         fstring *privileges;
1333         char **names;
1334
1335         ZERO_STRUCT(q);
1336         ZERO_STRUCT(r);
1337
1338         /* Marshall data and send request */
1339         init_q_enum_acct_rights(&q, pol, 2, sid);
1340
1341         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMACCTRIGHTS,
1342                 q, r,
1343                 qbuf, rbuf,
1344                 lsa_io_q_enum_acct_rights,
1345                 lsa_io_r_enum_acct_rights,
1346                 NT_STATUS_UNSUCCESSFUL);
1347
1348         result = r.status;
1349
1350         if (!NT_STATUS_IS_OK(result)) {
1351                 goto done;
1352         }
1353
1354         *count = r.count;
1355         if (! *count) {
1356                 goto done;
1357         }
1358
1359         
1360         privileges = TALLOC_ARRAY( mem_ctx, fstring, *count );
1361         names      = TALLOC_ARRAY( mem_ctx, char *, *count );
1362
1363         if ((privileges == NULL) || (names == NULL)) {
1364                 TALLOC_FREE(privileges);
1365                 TALLOC_FREE(names);
1366                 return NT_STATUS_NO_MEMORY;
1367         }
1368
1369         for ( i=0; i<*count; i++ ) {
1370                 UNISTR4 *uni_string = &r.rights->strings[i];
1371
1372                 if ( !uni_string->string )
1373                         continue;
1374
1375                 rpcstr_pull( privileges[i], uni_string->string->buffer, sizeof(privileges[i]), -1, STR_TERMINATE );
1376                         
1377                 /* now copy to the return array */
1378                 names[i] = talloc_strdup( mem_ctx, privileges[i] );
1379         }
1380         
1381         *priv_names = names;
1382
1383 done:
1384
1385         return result;
1386 }
1387
1388
1389
1390 /* add account rights to an account. */
1391
1392 NTSTATUS rpccli_lsa_add_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1393                                     POLICY_HND *pol, DOM_SID sid,
1394                                         uint32 count, const char **privs_name)
1395 {
1396         prs_struct qbuf, rbuf;
1397         LSA_Q_ADD_ACCT_RIGHTS q;
1398         LSA_R_ADD_ACCT_RIGHTS r;
1399         NTSTATUS result;
1400
1401         ZERO_STRUCT(q);
1402         ZERO_STRUCT(r);
1403
1404         /* Marshall data and send request */
1405         init_q_add_acct_rights(&q, pol, &sid, count, privs_name);
1406
1407         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ADDACCTRIGHTS,
1408                 q, r,
1409                 qbuf, rbuf,
1410                 lsa_io_q_add_acct_rights,
1411                 lsa_io_r_add_acct_rights,
1412                 NT_STATUS_UNSUCCESSFUL);
1413
1414         result = r.status;
1415
1416         if (!NT_STATUS_IS_OK(result)) {
1417                 goto done;
1418         }
1419 done:
1420
1421         return result;
1422 }
1423
1424
1425 /* remove account rights for an account. */
1426
1427 NTSTATUS rpccli_lsa_remove_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1428                                        POLICY_HND *pol, DOM_SID sid, BOOL removeall,
1429                                        uint32 count, const char **privs_name)
1430 {
1431         prs_struct qbuf, rbuf;
1432         LSA_Q_REMOVE_ACCT_RIGHTS q;
1433         LSA_R_REMOVE_ACCT_RIGHTS r;
1434         NTSTATUS result;
1435
1436         ZERO_STRUCT(q);
1437         ZERO_STRUCT(r);
1438
1439         /* Marshall data and send request */
1440         init_q_remove_acct_rights(&q, pol, &sid, removeall?1:0, count, privs_name);
1441
1442         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_REMOVEACCTRIGHTS,
1443                 q, r,
1444                 qbuf, rbuf,
1445                 lsa_io_q_remove_acct_rights,
1446                 lsa_io_r_remove_acct_rights,
1447                 NT_STATUS_UNSUCCESSFUL);
1448
1449         result = r.status;
1450
1451         if (!NT_STATUS_IS_OK(result)) {
1452                 goto done;
1453         }
1454 done:
1455
1456         return result;
1457 }
1458
1459
1460 #if 0
1461
1462 /** An example of how to use the routines in this file.  Fetch a DOMAIN
1463     sid. Does complete cli setup / teardown anonymously. */
1464
1465 BOOL fetch_domain_sid( char *domain, char *remote_machine, DOM_SID *psid)
1466 {
1467         extern pstring global_myname;
1468         struct cli_state *cli;
1469         NTSTATUS result;
1470         POLICY_HND lsa_pol;
1471         BOOL ret = False;
1472  
1473         ZERO_STRUCT(cli);
1474         if((cli = cli_initialise()) == NULL) {
1475                 DEBUG(0,("fetch_domain_sid: unable to initialize client connection.\n"));
1476                 return False;
1477         }
1478  
1479         if(!resolve_name( remote_machine, &cli->dest_ip, 0x20)) {
1480                 DEBUG(0,("fetch_domain_sid: Can't resolve address for %s\n", remote_machine));
1481                 goto done;
1482         }
1483  
1484         if (!cli_connect(cli, remote_machine, &cli->dest_ip)) {
1485                 DEBUG(0,("fetch_domain_sid: unable to connect to SMB server on \
1486 machine %s. Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1487                 goto done;
1488         }
1489
1490         if (!attempt_netbios_session_request(cli, global_myname, remote_machine, &cli->dest_ip)) {
1491                 DEBUG(0,("fetch_domain_sid: machine %s rejected the NetBIOS session request.\n", 
1492                         remote_machine));
1493                 goto done;
1494         }
1495  
1496         cli->protocol = PROTOCOL_NT1;
1497  
1498         if (!cli_negprot(cli)) {
1499                 DEBUG(0,("fetch_domain_sid: machine %s rejected the negotiate protocol. \
1500 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1501                 goto done;
1502         }
1503  
1504         if (cli->protocol != PROTOCOL_NT1) {
1505                 DEBUG(0,("fetch_domain_sid: machine %s didn't negotiate NT protocol.\n",
1506                         remote_machine));
1507                 goto done;
1508         }
1509  
1510         /*
1511          * Do an anonymous session setup.
1512          */
1513  
1514         if (!cli_session_setup(cli, "", "", 0, "", 0, "")) {
1515                 DEBUG(0,("fetch_domain_sid: machine %s rejected the session setup. \
1516 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1517                 goto done;
1518         }
1519  
1520         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
1521                 DEBUG(0,("fetch_domain_sid: machine %s isn't in user level security mode\n",
1522                         remote_machine));
1523                 goto done;
1524         }
1525
1526         if (!cli_send_tconX(cli, "IPC$", "IPC", "", 1)) {
1527                 DEBUG(0,("fetch_domain_sid: machine %s rejected the tconX on the IPC$ share. \
1528 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1529                 goto done;
1530         }
1531
1532         /* Fetch domain sid */
1533  
1534         if (!cli_nt_session_open(cli, PI_LSARPC)) {
1535                 DEBUG(0, ("fetch_domain_sid: Error connecting to SAM pipe\n"));
1536                 goto done;
1537         }
1538  
1539         result = cli_lsa_open_policy(cli, cli->mem_ctx, True, SEC_RIGHTS_QUERY_VALUE, &lsa_pol);
1540         if (!NT_STATUS_IS_OK(result)) {
1541                 DEBUG(0, ("fetch_domain_sid: Error opening lsa policy handle. %s\n",
1542                         nt_errstr(result) ));
1543                 goto done;
1544         }
1545  
1546         result = cli_lsa_query_info_policy(cli, cli->mem_ctx, &lsa_pol, 5, domain, psid);
1547         if (!NT_STATUS_IS_OK(result)) {
1548                 DEBUG(0, ("fetch_domain_sid: Error querying lsa policy handle. %s\n",
1549                         nt_errstr(result) ));
1550                 goto done;
1551         }
1552  
1553         ret = True;
1554
1555   done:
1556
1557         cli_shutdown(cli);
1558         return ret;
1559 }
1560
1561 #endif
1562
1563 NTSTATUS rpccli_lsa_open_trusted_domain(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1564                                      POLICY_HND *pol, DOM_SID *dom_sid, uint32 access_mask,
1565                                      POLICY_HND *trustdom_pol)
1566 {
1567         prs_struct qbuf, rbuf;
1568         LSA_Q_OPEN_TRUSTED_DOMAIN q;
1569         LSA_R_OPEN_TRUSTED_DOMAIN r;
1570         NTSTATUS result;
1571
1572         ZERO_STRUCT(q);
1573         ZERO_STRUCT(r);
1574
1575         /* Initialise input parameters */
1576
1577         init_lsa_q_open_trusted_domain(&q, pol, dom_sid, access_mask);
1578
1579         /* Marshall data and send request */
1580
1581         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOM,
1582                 q, r,
1583                 qbuf, rbuf,
1584                 lsa_io_q_open_trusted_domain,
1585                 lsa_io_r_open_trusted_domain,
1586                 NT_STATUS_UNSUCCESSFUL);
1587
1588         /* Return output parameters */
1589         
1590         result = r.status;
1591
1592         if (NT_STATUS_IS_OK(result)) {
1593                 *trustdom_pol = r.handle;
1594         }
1595
1596         return result;
1597 }
1598
1599 NTSTATUS rpccli_lsa_query_trusted_domain_info(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1600                                            POLICY_HND *pol, 
1601                                            uint16 info_class,  
1602                                            LSA_TRUSTED_DOMAIN_INFO **info)
1603 {
1604         prs_struct qbuf, rbuf;
1605         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO q;
1606         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1607         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1608
1609         ZERO_STRUCT(q);
1610         ZERO_STRUCT(r);
1611
1612         /* Marshall data and send request */
1613
1614         init_q_query_trusted_domain_info(&q, pol, info_class); 
1615
1616         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFO,
1617                 q, r,
1618                 qbuf, rbuf,
1619                 lsa_io_q_query_trusted_domain_info,
1620                 lsa_io_r_query_trusted_domain_info,
1621                 NT_STATUS_UNSUCCESSFUL);
1622
1623         result = r.status;
1624
1625         if (!NT_STATUS_IS_OK(result)) {
1626                 goto done;
1627         }
1628
1629         *info = r.info;
1630                 
1631 done:
1632         return result;
1633 }
1634
1635 NTSTATUS rpccli_lsa_open_trusted_domain_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1636                                                 POLICY_HND *pol, const char *name, uint32 access_mask,
1637                                                 POLICY_HND *trustdom_pol)
1638 {
1639         prs_struct qbuf, rbuf;
1640         LSA_Q_OPEN_TRUSTED_DOMAIN_BY_NAME q;
1641         LSA_R_OPEN_TRUSTED_DOMAIN_BY_NAME r;
1642         NTSTATUS result;
1643
1644         ZERO_STRUCT(q);
1645         ZERO_STRUCT(r);
1646
1647         /* Initialise input parameters */
1648
1649         init_lsa_q_open_trusted_domain_by_name(&q, pol, name, access_mask);
1650
1651         /* Marshall data and send request */
1652
1653         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOMBYNAME,
1654                 q, r,
1655                 qbuf, rbuf,
1656                 lsa_io_q_open_trusted_domain_by_name,
1657                 lsa_io_r_open_trusted_domain_by_name,
1658                 NT_STATUS_UNSUCCESSFUL);
1659
1660         /* Return output parameters */
1661         
1662         result = r.status;
1663
1664         if (NT_STATUS_IS_OK(result)) {
1665                 *trustdom_pol = r.handle;
1666         }
1667
1668         return result;
1669 }
1670
1671
1672 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_sid(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1673                                                   POLICY_HND *pol, 
1674                                                   uint16 info_class, DOM_SID *dom_sid, 
1675                                                   LSA_TRUSTED_DOMAIN_INFO **info)
1676 {
1677         prs_struct qbuf, rbuf;
1678         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_SID q;
1679         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1680         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1681
1682         ZERO_STRUCT(q);
1683         ZERO_STRUCT(r);
1684
1685         /* Marshall data and send request */
1686
1687         init_q_query_trusted_domain_info_by_sid(&q, pol, info_class, dom_sid); 
1688
1689         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYSID,
1690                 q, r,
1691                 qbuf, rbuf,
1692                 lsa_io_q_query_trusted_domain_info_by_sid,
1693                 lsa_io_r_query_trusted_domain_info,
1694                 NT_STATUS_UNSUCCESSFUL);
1695
1696         result = r.status;
1697
1698         if (!NT_STATUS_IS_OK(result)) {
1699                 goto done;
1700         }
1701
1702         *info = r.info;
1703
1704 done:
1705
1706         return result;
1707 }
1708
1709 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1710                                                    POLICY_HND *pol, 
1711                                                    uint16 info_class, const char *domain_name, 
1712                                                    LSA_TRUSTED_DOMAIN_INFO **info)
1713 {
1714         prs_struct qbuf, rbuf;
1715         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_NAME q;
1716         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1717         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1718
1719         ZERO_STRUCT(q);
1720         ZERO_STRUCT(r);
1721
1722         /* Marshall data and send request */
1723
1724         init_q_query_trusted_domain_info_by_name(&q, pol, info_class, domain_name); 
1725
1726         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYNAME,
1727                 q, r,
1728                 qbuf, rbuf,
1729                 lsa_io_q_query_trusted_domain_info_by_name,
1730                 lsa_io_r_query_trusted_domain_info,
1731                 NT_STATUS_UNSUCCESSFUL);
1732
1733         result = r.status;
1734
1735         if (!NT_STATUS_IS_OK(result)) {
1736                 goto done;
1737         }
1738
1739         *info = r.info;
1740
1741 done:
1742         
1743         return result;
1744 }
1745
1746 NTSTATUS cli_lsa_query_domain_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1747                                           POLICY_HND *pol, 
1748                                           uint16 info_class, LSA_DOM_INFO_UNION **info)
1749 {
1750         prs_struct qbuf, rbuf;
1751         LSA_Q_QUERY_DOM_INFO_POLICY q;
1752         LSA_R_QUERY_DOM_INFO_POLICY r;
1753         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1754
1755         ZERO_STRUCT(q);
1756         ZERO_STRUCT(r);
1757
1758         /* Marshall data and send request */
1759
1760         init_q_query_dom_info(&q, pol, info_class); 
1761
1762         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYDOMINFOPOL, 
1763                 q, r,
1764                 qbuf, rbuf,
1765                 lsa_io_q_query_dom_info,
1766                 lsa_io_r_query_dom_info,
1767                 NT_STATUS_UNSUCCESSFUL);
1768
1769         result = r.status;
1770
1771         if (!NT_STATUS_IS_OK(result)) {
1772                 goto done;
1773         }
1774
1775         *info = r.info;
1776
1777 done:
1778         return result;
1779 }
1780