source: branches/samba-3.2.x/source/rpc_client/cli_lsarpc.c

Last change on this file was 133, checked in by Paul Smedley, 17 years ago

Update trunk to 3.2.0pre3
File size: 13.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 RPC pipe client
4 Copyright (C) Tim Potter 2000-2001,
5 Copyright (C) Andrew Tridgell 1992-1997,2000,
6 Copyright (C) Rafal Szczesniak 2002
7 Copyright (C) Jeremy Allison 2005.
8 Copyright (C) Michael Adam 2007.
9 Copyright (C) Guenther Deschner 2008.
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23*/
24
25#include "includes.h"
26
27/** @defgroup lsa LSA - Local Security Architecture
28 * @ingroup rpc_client
29 *
30 * @{
31 **/
32
33/**
34 * @file cli_lsarpc.c
35 *
36 * RPC client routines for the LSA RPC pipe. LSA means "local
37 * security authority", which is half of a password database.
38 **/
39
40/** Open a LSA policy handle
41 *
42 * @param cli Handle on an initialised SMB connection */
43
44NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
45 TALLOC_CTX *mem_ctx,
46 bool sec_qos, uint32 des_access,
47 POLICY_HND *pol)
48{
49 struct lsa_ObjectAttribute attr;
50 struct lsa_QosInfo qos;
51 uint16_t system_name = '\\';
52
53 if (sec_qos) {
54 init_lsa_sec_qos(&qos, 0xc, 2, 1, 0);
55 init_lsa_obj_attr(&attr,
56 0x18,
57 NULL,
58 NULL,
59 0,
60 NULL,
61 &qos);
62 } else {
63 init_lsa_obj_attr(&attr,
64 0x18,
65 NULL,
66 NULL,
67 0,
68 NULL,
69 NULL);
70 }
71
72 return rpccli_lsa_OpenPolicy(cli, mem_ctx,
73 &system_name,
74 &attr,
75 des_access,
76 pol);
77}
78
79/** Open a LSA policy handle
80 *
81 * @param cli Handle on an initialised SMB connection
82 */
83
84NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
85 TALLOC_CTX *mem_ctx, bool sec_qos,
86 uint32 des_access, POLICY_HND *pol)
87{
88 struct lsa_ObjectAttribute attr;
89 struct lsa_QosInfo qos;
90
91 if (sec_qos) {
92 init_lsa_sec_qos(&qos, 0xc, 2, 1, 0);
93 init_lsa_obj_attr(&attr,
94 0x18,
95 NULL,
96 NULL,
97 0,
98 NULL,
99 &qos);
100 } else {
101 init_lsa_obj_attr(&attr,
102 0x18,
103 NULL,
104 NULL,
105 0,
106 NULL,
107 NULL);
108 }
109
110 return rpccli_lsa_OpenPolicy2(cli, mem_ctx,
111 cli->cli->srv_name_slash,
112 &attr,
113 des_access,
114 pol);
115}
116
117/* Lookup a list of sids
118 *
119 * internal version withOUT memory allocation of the target arrays.
120 * this assumes suffciently sized arrays to store domains, names and types. */
121
122static NTSTATUS rpccli_lsa_lookup_sids_noalloc(struct rpc_pipe_client *cli,
123 TALLOC_CTX *mem_ctx,
124 POLICY_HND *pol,
125 int num_sids,
126 const DOM_SID *sids,
127 char **domains,
128 char **names,
129 enum lsa_SidType *types)
130{
131 NTSTATUS result = NT_STATUS_OK;
132 TALLOC_CTX *tmp_ctx = NULL;
133 int i;
134 struct lsa_SidArray sid_array;
135 struct lsa_RefDomainList *ref_domains = NULL;
136 struct lsa_TransNameArray lsa_names;
137 uint32_t count = 0;
138 uint16_t level = 1;
139
140 ZERO_STRUCT(lsa_names);
141
142 tmp_ctx = talloc_new(mem_ctx);
143 if (!tmp_ctx) {
144 DEBUG(0, ("rpccli_lsa_lookup_sids_noalloc: out of memory!\n"));
145 result = NT_STATUS_UNSUCCESSFUL;
146 goto done;
147 }
148
149 sid_array.num_sids = num_sids;
150 sid_array.sids = TALLOC_ARRAY(mem_ctx, struct lsa_SidPtr, num_sids);
151 if (!sid_array.sids) {
152 return NT_STATUS_NO_MEMORY;
153 }
154
155 for (i = 0; i<num_sids; i++) {
156 sid_array.sids[i].sid = sid_dup_talloc(mem_ctx, &sids[i]);
157 if (!sid_array.sids[i].sid) {
158 return NT_STATUS_NO_MEMORY;
159 }
160 }
161
162 result = rpccli_lsa_LookupSids(cli, mem_ctx,
163 pol,
164 &sid_array,
165 &ref_domains,
166 &lsa_names,
167 level,
168 &count);
169
170 DEBUG(10, ("LSA_LOOKUPSIDS returned '%s', mapped count = %d'\n",
171 nt_errstr(result), count));
172
173 if (!NT_STATUS_IS_OK(result) &&
174 !NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
175 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
176 {
177 /* An actual error occured */
178 goto done;
179 }
180
181 /* Return output parameters */
182
183 if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) ||
184 (count == 0))
185 {
186 for (i = 0; i < num_sids; i++) {
187 (names)[i] = NULL;
188 (domains)[i] = NULL;
189 (types)[i] = SID_NAME_UNKNOWN;
190 }
191 result = NT_STATUS_NONE_MAPPED;
192 goto done;
193 }
194
195 for (i = 0; i < num_sids; i++) {
196 const char *name, *dom_name;
197 uint32_t dom_idx = lsa_names.names[i].sid_index;
198
199 /* Translate optimised name through domain index array */
200
201 if (dom_idx != 0xffffffff) {
202
203 dom_name = ref_domains->domains[dom_idx].name.string;
204 name = lsa_names.names[i].name.string;
205
206 if (name) {
207 (names)[i] = talloc_strdup(mem_ctx, name);
208 if ((names)[i] == NULL) {
209 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
210 result = NT_STATUS_UNSUCCESSFUL;
211 goto done;
212 }
213 } else {
214 (names)[i] = NULL;
215 }
216 (domains)[i] = talloc_strdup(mem_ctx, dom_name);
217 (types)[i] = lsa_names.names[i].sid_type;
218 if (((domains)[i] == NULL)) {
219 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
220 result = NT_STATUS_UNSUCCESSFUL;
221 goto done;
222 }
223
224 } else {
225 (names)[i] = NULL;
226 (domains)[i] = NULL;
227 (types)[i] = SID_NAME_UNKNOWN;
228 }
229 }
230
231done:
232 TALLOC_FREE(tmp_ctx);
233 return result;
234}
235
236/* Lookup a list of sids
237 *
238 * do it the right way: there is a limit (of 20480 for w2k3) entries
239 * returned by this call. when the sids list contains more entries,
240 * empty lists are returned. This version of lsa_lookup_sids passes
241 * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
242
243/* This constant defines the limit of how many sids to look up
244 * in one call (maximum). the limit from the server side is
245 * at 20480 for win2k3, but we keep it at a save 1000 for now. */
246#define LOOKUP_SIDS_HUNK_SIZE 1000
247
248NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
249 TALLOC_CTX *mem_ctx,
250 POLICY_HND *pol,
251 int num_sids,
252 const DOM_SID *sids,
253 char ***pdomains,
254 char ***pnames,
255 enum lsa_SidType **ptypes)
256{
257 NTSTATUS result = NT_STATUS_OK;
258 int sids_left = 0;
259 int sids_processed = 0;
260 const DOM_SID *hunk_sids = sids;
261 char **hunk_domains;
262 char **hunk_names;
263 enum lsa_SidType *hunk_types;
264 char **domains = NULL;
265 char **names = NULL;
266 enum lsa_SidType *types = NULL;
267
268 if (num_sids) {
269 if (!(domains = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
270 DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
271 result = NT_STATUS_NO_MEMORY;
272 goto fail;
273 }
274
275 if (!(names = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
276 DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
277 result = NT_STATUS_NO_MEMORY;
278 goto fail;
279 }
280
281 if (!(types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
282 DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
283 result = NT_STATUS_NO_MEMORY;
284 goto fail;
285 }
286 }
287
288 sids_left = num_sids;
289 hunk_domains = domains;
290 hunk_names = names;
291 hunk_types = types;
292
293 while (sids_left > 0) {
294 int hunk_num_sids;
295 NTSTATUS hunk_result = NT_STATUS_OK;
296
297 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
298 ? LOOKUP_SIDS_HUNK_SIZE
299 : sids_left);
300
301 DEBUG(10, ("rpccli_lsa_lookup_sids: processing items "
302 "%d -- %d of %d.\n",
303 sids_processed,
304 sids_processed + hunk_num_sids - 1,
305 num_sids));
306
307 hunk_result = rpccli_lsa_lookup_sids_noalloc(cli,
308 mem_ctx,
309 pol,
310 hunk_num_sids,
311 hunk_sids,
312 hunk_domains,
313 hunk_names,
314 hunk_types);
315
316 if (!NT_STATUS_IS_OK(hunk_result) &&
317 !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
318 !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED))
319 {
320 /* An actual error occured */
321 result = hunk_result;
322 goto fail;
323 }
324
325 /* adapt overall result */
326 if (( NT_STATUS_IS_OK(result) &&
327 !NT_STATUS_IS_OK(hunk_result))
328 ||
329 ( NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
330 !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)))
331 {
332 result = STATUS_SOME_UNMAPPED;
333 }
334
335 sids_left -= hunk_num_sids;
336 sids_processed += hunk_num_sids; /* only used in DEBUG */
337 hunk_sids += hunk_num_sids;
338 hunk_domains += hunk_num_sids;
339 hunk_names += hunk_num_sids;
340 hunk_types += hunk_num_sids;
341 }
342
343 *pdomains = domains;
344 *pnames = names;
345 *ptypes = types;
346 return result;
347
348fail:
349 TALLOC_FREE(domains);
350 TALLOC_FREE(names);
351 TALLOC_FREE(types);
352 return result;
353}
354
355/** Lookup a list of names */
356
357NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
358 TALLOC_CTX *mem_ctx,
359 POLICY_HND *pol, int num_names,
360 const char **names,
361 const char ***dom_names,
362 int level,
363 DOM_SID **sids,
364 enum lsa_SidType **types)
365{
366 NTSTATUS result;
367 int i;
368 struct lsa_String *lsa_names = NULL;
369 struct lsa_RefDomainList *domains = NULL;
370 struct lsa_TransSidArray sid_array;
371 uint32_t count = 0;
372
373 ZERO_STRUCT(sid_array);
374
375 lsa_names = TALLOC_ARRAY(mem_ctx, struct lsa_String, num_names);
376 if (!lsa_names) {
377 return NT_STATUS_NO_MEMORY;
378 }
379
380 for (i=0; i<num_names; i++) {
381 init_lsa_String(&lsa_names[i], names[i]);
382 }
383
384 result = rpccli_lsa_LookupNames(cli, mem_ctx,
385 pol,
386 num_names,
387 lsa_names,
388 &domains,
389 &sid_array,
390 level,
391 &count);
392
393 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
394 NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
395
396 /* An actual error occured */
397
398 goto done;
399 }
400
401 /* Return output parameters */
402
403 if (count == 0) {
404 result = NT_STATUS_NONE_MAPPED;
405 goto done;
406 }
407
408 if (num_names) {
409 if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
410 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
411 result = NT_STATUS_NO_MEMORY;
412 goto done;
413 }
414
415 if (!((*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_names)))) {
416 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
417 result = NT_STATUS_NO_MEMORY;
418 goto done;
419 }
420
421 if (dom_names != NULL) {
422 *dom_names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
423 if (*dom_names == NULL) {
424 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
425 result = NT_STATUS_NO_MEMORY;
426 goto done;
427 }
428 }
429 } else {
430 *sids = NULL;
431 *types = NULL;
432 if (dom_names != NULL) {
433 *dom_names = NULL;
434 }
435 }
436
437 for (i = 0; i < num_names; i++) {
438 uint32_t dom_idx = sid_array.sids[i].sid_index;
439 uint32_t dom_rid = sid_array.sids[i].rid;
440 DOM_SID *sid = &(*sids)[i];
441
442 /* Translate optimised sid through domain index array */
443
444 if (dom_idx == 0xffffffff) {
445 /* Nothing to do, this is unknown */
446 ZERO_STRUCTP(sid);
447 (*types)[i] = SID_NAME_UNKNOWN;
448 continue;
449 }
450
451 sid_copy(sid, domains->domains[dom_idx].sid);
452
453 if (dom_rid != 0xffffffff) {
454 sid_append_rid(sid, dom_rid);
455 }
456
457 (*types)[i] = sid_array.sids[i].sid_type;
458
459 if (dom_names == NULL) {
460 continue;
461 }
462
463 (*dom_names)[i] = domains->domains[dom_idx].name.string;
464 }
465
466 done:
467
468 return result;
469}
470
471#if 0
472
473/** An example of how to use the routines in this file. Fetch a DOMAIN
474 sid. Does complete cli setup / teardown anonymously. */
475
476bool fetch_domain_sid( char *domain, char *remote_machine, DOM_SID *psid)
477{
478 struct cli_state cli;
479 NTSTATUS result;
480 POLICY_HND lsa_pol;
481 bool ret = False;
482
483 ZERO_STRUCT(cli);
484 if(cli_initialise(&cli) == False) {
485 DEBUG(0,("fetch_domain_sid: unable to initialize client connection.\n"));
486 return False;
487 }
488
489 if(!resolve_name( remote_machine, &cli.dest_ip, 0x20)) {
490 DEBUG(0,("fetch_domain_sid: Can't resolve address for %s\n", remote_machine));
491 goto done;
492 }
493
494 if (!cli_connect(&cli, remote_machine, &cli.dest_ip)) {
495 DEBUG(0,("fetch_domain_sid: unable to connect to SMB server on \
496machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
497 goto done;
498 }
499
500 if (!attempt_netbios_session_request(&cli, global_myname(), remote_machine, &cli.dest_ip)) {
501 DEBUG(0,("fetch_domain_sid: machine %s rejected the NetBIOS session request.\n",
502 remote_machine));
503 goto done;
504 }
505
506 cli.protocol = PROTOCOL_NT1;
507
508 if (!cli_negprot(&cli)) {
509 DEBUG(0,("fetch_domain_sid: machine %s rejected the negotiate protocol. \
510Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
511 goto done;
512 }
513
514 if (cli.protocol != PROTOCOL_NT1) {
515 DEBUG(0,("fetch_domain_sid: machine %s didn't negotiate NT protocol.\n",
516 remote_machine));
517 goto done;
518 }
519
520 /*
521 * Do an anonymous session setup.
522 */
523
524 if (!cli_session_setup(&cli, "", "", 0, "", 0, "")) {
525 DEBUG(0,("fetch_domain_sid: machine %s rejected the session setup. \
526Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
527 goto done;
528 }
529
530 if (!(cli.sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
531 DEBUG(0,("fetch_domain_sid: machine %s isn't in user level security mode\n",
532 remote_machine));
533 goto done;
534 }
535
536 if (!cli_send_tconX(&cli, "IPC$", "IPC", "", 1)) {
537 DEBUG(0,("fetch_domain_sid: machine %s rejected the tconX on the IPC$ share. \
538Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
539 goto done;
540 }
541
542 /* Fetch domain sid */
543
544 if (!cli_nt_session_open(&cli, PI_LSARPC)) {
545 DEBUG(0, ("fetch_domain_sid: Error connecting to SAM pipe\n"));
546 goto done;
547 }
548
549 result = cli_lsa_open_policy(&cli, cli.mem_ctx, True, SEC_RIGHTS_QUERY_VALUE, &lsa_pol);
550 if (!NT_STATUS_IS_OK(result)) {
551 DEBUG(0, ("fetch_domain_sid: Error opening lsa policy handle. %s\n",
552 nt_errstr(result) ));
553 goto done;
554 }
555
556 result = cli_lsa_query_info_policy(&cli, cli.mem_ctx, &lsa_pol, 5, domain, psid);
557 if (!NT_STATUS_IS_OK(result)) {
558 DEBUG(0, ("fetch_domain_sid: Error querying lsa policy handle. %s\n",
559 nt_errstr(result) ));
560 goto done;
561 }
562
563 ret = True;
564
565 done:
566
567 cli_shutdown(&cli);
568 return ret;
569}
570
571#endif
Note: See TracBrowser for help on using the repository browser.