1 | /*
|
---|
2 | Unix SMB/CIFS implementation.
|
---|
3 | RPC pipe client
|
---|
4 | Copyright (C) Tim Potter 2000-2001,
|
---|
5 | Copyright (C) Andrew Tridgell 1992-1997,2000,
|
---|
6 | Copyright (C) Rafal Szczesniak 2002
|
---|
7 | Copyright (C) Jeremy Allison 2005.
|
---|
8 | Copyright (C) Michael Adam 2007.
|
---|
9 | Copyright (C) Guenther Deschner 2008.
|
---|
10 |
|
---|
11 | This program is free software; you can redistribute it and/or modify
|
---|
12 | it under the terms of the GNU General Public License as published by
|
---|
13 | the Free Software Foundation; either version 3 of the License, or
|
---|
14 | (at your option) any later version.
|
---|
15 |
|
---|
16 | This program is distributed in the hope that it will be useful,
|
---|
17 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
18 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
19 | GNU General Public License for more details.
|
---|
20 |
|
---|
21 | You should have received a copy of the GNU General Public License
|
---|
22 | along with this program. If not, see <http://www.gnu.org/licenses/>.
|
---|
23 | */
|
---|
24 |
|
---|
25 | #include "includes.h"
|
---|
26 | #include "rpc_client/rpc_client.h"
|
---|
27 | #include "../librpc/gen_ndr/ndr_lsa_c.h"
|
---|
28 | #include "rpc_client/cli_lsarpc.h"
|
---|
29 | #include "rpc_client/init_lsa.h"
|
---|
30 | #include "../libcli/security/security.h"
|
---|
31 |
|
---|
32 | /** @defgroup lsa LSA - Local Security Architecture
|
---|
33 | * @ingroup rpc_client
|
---|
34 | *
|
---|
35 | * @{
|
---|
36 | **/
|
---|
37 |
|
---|
38 | /**
|
---|
39 | * @file cli_lsarpc.c
|
---|
40 | *
|
---|
41 | * RPC client routines for the LSA RPC pipe. LSA means "local
|
---|
42 | * security authority", which is half of a password database.
|
---|
43 | **/
|
---|
44 |
|
---|
45 | NTSTATUS dcerpc_lsa_open_policy(struct dcerpc_binding_handle *h,
|
---|
46 | TALLOC_CTX *mem_ctx,
|
---|
47 | bool sec_qos,
|
---|
48 | uint32_t des_access,
|
---|
49 | struct policy_handle *pol,
|
---|
50 | NTSTATUS *result)
|
---|
51 | {
|
---|
52 | struct lsa_ObjectAttribute attr;
|
---|
53 | struct lsa_QosInfo qos;
|
---|
54 | uint16_t system_name = '\\';
|
---|
55 |
|
---|
56 | ZERO_STRUCT(attr);
|
---|
57 |
|
---|
58 | attr.len = 0x18;
|
---|
59 |
|
---|
60 | if (sec_qos) {
|
---|
61 | qos.len = 0xc;
|
---|
62 | qos.impersonation_level = 2;
|
---|
63 | qos.context_mode = 1;
|
---|
64 | qos.effective_only = 0;
|
---|
65 |
|
---|
66 | attr.sec_qos = &qos;
|
---|
67 | }
|
---|
68 |
|
---|
69 | return dcerpc_lsa_OpenPolicy(h,
|
---|
70 | mem_ctx,
|
---|
71 | &system_name,
|
---|
72 | &attr,
|
---|
73 | des_access,
|
---|
74 | pol,
|
---|
75 | result);
|
---|
76 | }
|
---|
77 |
|
---|
78 | /** Open a LSA policy handle
|
---|
79 | *
|
---|
80 | * @param cli Handle on an initialised SMB connection */
|
---|
81 |
|
---|
82 | NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
|
---|
83 | TALLOC_CTX *mem_ctx,
|
---|
84 | bool sec_qos, uint32 des_access,
|
---|
85 | struct policy_handle *pol)
|
---|
86 | {
|
---|
87 | NTSTATUS status;
|
---|
88 | NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
|
---|
89 |
|
---|
90 | status = dcerpc_lsa_open_policy(cli->binding_handle,
|
---|
91 | mem_ctx,
|
---|
92 | sec_qos,
|
---|
93 | des_access,
|
---|
94 | pol,
|
---|
95 | &result);
|
---|
96 | if (!NT_STATUS_IS_OK(status)) {
|
---|
97 | return status;
|
---|
98 | }
|
---|
99 |
|
---|
100 | return result;
|
---|
101 | }
|
---|
102 |
|
---|
103 | NTSTATUS dcerpc_lsa_open_policy2(struct dcerpc_binding_handle *h,
|
---|
104 | TALLOC_CTX *mem_ctx,
|
---|
105 | const char *srv_name_slash,
|
---|
106 | bool sec_qos,
|
---|
107 | uint32_t des_access,
|
---|
108 | struct policy_handle *pol,
|
---|
109 | NTSTATUS *result)
|
---|
110 | {
|
---|
111 | struct lsa_ObjectAttribute attr;
|
---|
112 | struct lsa_QosInfo qos;
|
---|
113 |
|
---|
114 | ZERO_STRUCT(attr);
|
---|
115 |
|
---|
116 | attr.len = 0x18;
|
---|
117 |
|
---|
118 | if (sec_qos) {
|
---|
119 | qos.len = 0xc;
|
---|
120 | qos.impersonation_level = 2;
|
---|
121 | qos.context_mode = 1;
|
---|
122 | qos.effective_only = 0;
|
---|
123 |
|
---|
124 | attr.sec_qos = &qos;
|
---|
125 | }
|
---|
126 |
|
---|
127 | return dcerpc_lsa_OpenPolicy2(h,
|
---|
128 | mem_ctx,
|
---|
129 | srv_name_slash,
|
---|
130 | &attr,
|
---|
131 | des_access,
|
---|
132 | pol,
|
---|
133 | result);
|
---|
134 | }
|
---|
135 |
|
---|
136 | /** Open a LSA policy handle
|
---|
137 | *
|
---|
138 | * @param cli Handle on an initialised SMB connection
|
---|
139 | */
|
---|
140 |
|
---|
141 | NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
|
---|
142 | TALLOC_CTX *mem_ctx, bool sec_qos,
|
---|
143 | uint32 des_access, struct policy_handle *pol)
|
---|
144 | {
|
---|
145 | NTSTATUS status;
|
---|
146 | NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
|
---|
147 |
|
---|
148 | status = dcerpc_lsa_open_policy2(cli->binding_handle,
|
---|
149 | mem_ctx,
|
---|
150 | cli->srv_name_slash,
|
---|
151 | sec_qos,
|
---|
152 | des_access,
|
---|
153 | pol,
|
---|
154 | &result);
|
---|
155 | if (!NT_STATUS_IS_OK(status)) {
|
---|
156 | return status;
|
---|
157 | }
|
---|
158 |
|
---|
159 | return result;
|
---|
160 | }
|
---|
161 |
|
---|
162 | /* Lookup a list of sids
|
---|
163 | *
|
---|
164 | * internal version withOUT memory allocation of the target arrays.
|
---|
165 | * this assumes sufficiently sized arrays to store domains, names and types. */
|
---|
166 |
|
---|
167 | static NTSTATUS dcerpc_lsa_lookup_sids_noalloc(struct dcerpc_binding_handle *h,
|
---|
168 | TALLOC_CTX *mem_ctx,
|
---|
169 | TALLOC_CTX *domains_ctx,
|
---|
170 | TALLOC_CTX *names_ctx,
|
---|
171 | struct policy_handle *pol,
|
---|
172 | int num_sids,
|
---|
173 | const struct dom_sid *sids,
|
---|
174 | char **domains,
|
---|
175 | char **names,
|
---|
176 | enum lsa_SidType *types,
|
---|
177 | bool use_lookupsids3,
|
---|
178 | NTSTATUS *presult)
|
---|
179 | {
|
---|
180 | NTSTATUS status = NT_STATUS_OK;
|
---|
181 | NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
|
---|
182 | struct lsa_SidArray sid_array;
|
---|
183 | struct lsa_RefDomainList *ref_domains = NULL;
|
---|
184 | struct lsa_TransNameArray lsa_names;
|
---|
185 | enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
|
---|
186 | uint32_t count = 0;
|
---|
187 | int i;
|
---|
188 |
|
---|
189 | ZERO_STRUCT(lsa_names);
|
---|
190 |
|
---|
191 | sid_array.num_sids = num_sids;
|
---|
192 | sid_array.sids = TALLOC_ARRAY(mem_ctx, struct lsa_SidPtr, num_sids);
|
---|
193 | if (sid_array.sids == NULL) {
|
---|
194 | return NT_STATUS_NO_MEMORY;
|
---|
195 | }
|
---|
196 |
|
---|
197 | for (i = 0; i<num_sids; i++) {
|
---|
198 | sid_array.sids[i].sid = dom_sid_dup(mem_ctx, &sids[i]);
|
---|
199 | if (!sid_array.sids[i].sid) {
|
---|
200 | return NT_STATUS_NO_MEMORY;
|
---|
201 | }
|
---|
202 | }
|
---|
203 |
|
---|
204 | if (use_lookupsids3) {
|
---|
205 | struct lsa_TransNameArray2 lsa_names2;
|
---|
206 | uint32_t n;
|
---|
207 |
|
---|
208 | ZERO_STRUCT(lsa_names2);
|
---|
209 |
|
---|
210 | status = dcerpc_lsa_LookupSids3(h,
|
---|
211 | mem_ctx,
|
---|
212 | &sid_array,
|
---|
213 | &ref_domains,
|
---|
214 | &lsa_names2,
|
---|
215 | level,
|
---|
216 | &count,
|
---|
217 | LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
|
---|
218 | LSA_CLIENT_REVISION_2,
|
---|
219 | &result);
|
---|
220 | if (!NT_STATUS_IS_OK(status)) {
|
---|
221 | return status;
|
---|
222 | }
|
---|
223 |
|
---|
224 | if(!NT_STATUS_IS_ERR(result)) {
|
---|
225 | lsa_names.count = lsa_names2.count;
|
---|
226 | lsa_names.names = talloc_array(mem_ctx,
|
---|
227 | struct lsa_TranslatedName,
|
---|
228 | lsa_names.count);
|
---|
229 | if (lsa_names.names == NULL) {
|
---|
230 | return NT_STATUS_NO_MEMORY;
|
---|
231 | }
|
---|
232 | for (n=0; n < lsa_names.count; n++) {
|
---|
233 | lsa_names.names[n].sid_type = lsa_names2.names[n].sid_type;
|
---|
234 | lsa_names.names[n].name = lsa_names2.names[n].name;
|
---|
235 | lsa_names.names[n].sid_index = lsa_names2.names[n].sid_index;
|
---|
236 | }
|
---|
237 | }
|
---|
238 |
|
---|
239 | } else {
|
---|
240 | status = dcerpc_lsa_LookupSids(h,
|
---|
241 | mem_ctx,
|
---|
242 | pol,
|
---|
243 | &sid_array,
|
---|
244 | &ref_domains,
|
---|
245 | &lsa_names,
|
---|
246 | level,
|
---|
247 | &count,
|
---|
248 | &result);
|
---|
249 | }
|
---|
250 |
|
---|
251 | DEBUG(10, ("LSA_LOOKUPSIDS returned status: '%s', result: '%s', "
|
---|
252 | "mapped count = %d'\n",
|
---|
253 | nt_errstr(status), nt_errstr(result), count));
|
---|
254 |
|
---|
255 | if (!NT_STATUS_IS_OK(status)) {
|
---|
256 | return status;
|
---|
257 | }
|
---|
258 |
|
---|
259 | if (!NT_STATUS_IS_OK(result) &&
|
---|
260 | !NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
|
---|
261 | !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
|
---|
262 | {
|
---|
263 | *presult = result;
|
---|
264 | return status;
|
---|
265 | }
|
---|
266 |
|
---|
267 | /* Return output parameters */
|
---|
268 | if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) ||
|
---|
269 | (count == 0))
|
---|
270 | {
|
---|
271 | for (i = 0; i < num_sids; i++) {
|
---|
272 | (names)[i] = NULL;
|
---|
273 | (domains)[i] = NULL;
|
---|
274 | (types)[i] = SID_NAME_UNKNOWN;
|
---|
275 | }
|
---|
276 | *presult = NT_STATUS_NONE_MAPPED;
|
---|
277 | return status;
|
---|
278 | }
|
---|
279 |
|
---|
280 | for (i = 0; i < num_sids; i++) {
|
---|
281 | const char *name, *dom_name;
|
---|
282 | uint32_t dom_idx;
|
---|
283 |
|
---|
284 | if (i >= lsa_names.count) {
|
---|
285 | *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
286 | return status;
|
---|
287 | }
|
---|
288 |
|
---|
289 | dom_idx = lsa_names.names[i].sid_index;
|
---|
290 |
|
---|
291 | /* Translate optimised name through domain index array */
|
---|
292 |
|
---|
293 | if (dom_idx != 0xffffffff) {
|
---|
294 | if (ref_domains == NULL) {
|
---|
295 | *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
296 | return status;
|
---|
297 | }
|
---|
298 | if (dom_idx >= ref_domains->count) {
|
---|
299 | *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
300 | return status;
|
---|
301 | }
|
---|
302 |
|
---|
303 | dom_name = ref_domains->domains[dom_idx].name.string;
|
---|
304 | name = lsa_names.names[i].name.string;
|
---|
305 |
|
---|
306 | if (name) {
|
---|
307 | (names)[i] = talloc_strdup(names_ctx, name);
|
---|
308 | if ((names)[i] == NULL) {
|
---|
309 | DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
|
---|
310 | *presult = NT_STATUS_UNSUCCESSFUL;
|
---|
311 | return status;
|
---|
312 | }
|
---|
313 | } else {
|
---|
314 | (names)[i] = NULL;
|
---|
315 | }
|
---|
316 | domains[i] = talloc_strdup(domains_ctx,
|
---|
317 | dom_name ? dom_name : "");
|
---|
318 | (types)[i] = lsa_names.names[i].sid_type;
|
---|
319 | if (((domains)[i] == NULL)) {
|
---|
320 | DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
|
---|
321 | *presult = NT_STATUS_UNSUCCESSFUL;
|
---|
322 | return status;
|
---|
323 | }
|
---|
324 |
|
---|
325 | } else {
|
---|
326 | (names)[i] = NULL;
|
---|
327 | (domains)[i] = NULL;
|
---|
328 | (types)[i] = SID_NAME_UNKNOWN;
|
---|
329 | }
|
---|
330 | }
|
---|
331 |
|
---|
332 | *presult = NT_STATUS_OK;
|
---|
333 | return status;
|
---|
334 | }
|
---|
335 |
|
---|
336 | /* Lookup a list of sids
|
---|
337 | *
|
---|
338 | * do it the right way: there is a limit (of 20480 for w2k3) entries
|
---|
339 | * returned by this call. when the sids list contains more entries,
|
---|
340 | * empty lists are returned. This version of lsa_lookup_sids passes
|
---|
341 | * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
|
---|
342 |
|
---|
343 | /* This constant defines the limit of how many sids to look up
|
---|
344 | * in one call (maximum). the limit from the server side is
|
---|
345 | * at 20480 for win2k3, but we keep it at a save 1000 for now. */
|
---|
346 | #define LOOKUP_SIDS_HUNK_SIZE 1000
|
---|
347 |
|
---|
348 | NTSTATUS dcerpc_lsa_lookup_sids_generic(struct dcerpc_binding_handle *h,
|
---|
349 | TALLOC_CTX *mem_ctx,
|
---|
350 | struct policy_handle *pol,
|
---|
351 | int num_sids,
|
---|
352 | const struct dom_sid *sids,
|
---|
353 | char ***pdomains,
|
---|
354 | char ***pnames,
|
---|
355 | enum lsa_SidType **ptypes,
|
---|
356 | bool use_lookupsids3,
|
---|
357 | NTSTATUS *presult)
|
---|
358 | {
|
---|
359 | NTSTATUS status = NT_STATUS_OK;
|
---|
360 | NTSTATUS result = NT_STATUS_OK;
|
---|
361 | int sids_left = 0;
|
---|
362 | int sids_processed = 0;
|
---|
363 | const struct dom_sid *hunk_sids = sids;
|
---|
364 | char **hunk_domains;
|
---|
365 | char **hunk_names;
|
---|
366 | enum lsa_SidType *hunk_types;
|
---|
367 | char **domains = NULL;
|
---|
368 | char **names = NULL;
|
---|
369 | enum lsa_SidType *types = NULL;
|
---|
370 | bool have_mapped = false;
|
---|
371 | bool have_unmapped = false;
|
---|
372 |
|
---|
373 | if (num_sids) {
|
---|
374 | if (!(domains = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
|
---|
375 | DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
|
---|
376 | status = NT_STATUS_NO_MEMORY;
|
---|
377 | goto fail;
|
---|
378 | }
|
---|
379 |
|
---|
380 | if (!(names = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
|
---|
381 | DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
|
---|
382 | status = NT_STATUS_NO_MEMORY;
|
---|
383 | goto fail;
|
---|
384 | }
|
---|
385 |
|
---|
386 | if (!(types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
|
---|
387 | DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
|
---|
388 | status = NT_STATUS_NO_MEMORY;
|
---|
389 | goto fail;
|
---|
390 | }
|
---|
391 | }
|
---|
392 |
|
---|
393 | sids_left = num_sids;
|
---|
394 | hunk_domains = domains;
|
---|
395 | hunk_names = names;
|
---|
396 | hunk_types = types;
|
---|
397 |
|
---|
398 | while (sids_left > 0) {
|
---|
399 | int hunk_num_sids;
|
---|
400 | NTSTATUS hunk_result = NT_STATUS_UNSUCCESSFUL;
|
---|
401 |
|
---|
402 | hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
|
---|
403 | ? LOOKUP_SIDS_HUNK_SIZE
|
---|
404 | : sids_left);
|
---|
405 |
|
---|
406 | DEBUG(10, ("rpccli_lsa_lookup_sids: processing items "
|
---|
407 | "%d -- %d of %d.\n",
|
---|
408 | sids_processed,
|
---|
409 | sids_processed + hunk_num_sids - 1,
|
---|
410 | num_sids));
|
---|
411 |
|
---|
412 | status = dcerpc_lsa_lookup_sids_noalloc(h,
|
---|
413 | mem_ctx,
|
---|
414 | (TALLOC_CTX *)domains,
|
---|
415 | (TALLOC_CTX *)names,
|
---|
416 | pol,
|
---|
417 | hunk_num_sids,
|
---|
418 | hunk_sids,
|
---|
419 | hunk_domains,
|
---|
420 | hunk_names,
|
---|
421 | hunk_types,
|
---|
422 | use_lookupsids3,
|
---|
423 | &hunk_result);
|
---|
424 | if (!NT_STATUS_IS_OK(status)) {
|
---|
425 | goto fail;
|
---|
426 | }
|
---|
427 |
|
---|
428 | if (!NT_STATUS_IS_OK(hunk_result) &&
|
---|
429 | !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
|
---|
430 | !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED))
|
---|
431 | {
|
---|
432 | /* An actual error occured */
|
---|
433 | *presult = hunk_result;
|
---|
434 | goto fail;
|
---|
435 | }
|
---|
436 |
|
---|
437 | if (NT_STATUS_IS_OK(hunk_result)) {
|
---|
438 | have_mapped = true;
|
---|
439 | }
|
---|
440 | if (NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)) {
|
---|
441 | have_unmapped = true;
|
---|
442 | }
|
---|
443 | if (NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED)) {
|
---|
444 | int i;
|
---|
445 | for (i=0; i<hunk_num_sids; i++) {
|
---|
446 | if (hunk_types[i] == SID_NAME_UNKNOWN) {
|
---|
447 | have_unmapped = true;
|
---|
448 | } else {
|
---|
449 | have_mapped = true;
|
---|
450 | }
|
---|
451 | }
|
---|
452 | }
|
---|
453 |
|
---|
454 | sids_left -= hunk_num_sids;
|
---|
455 | sids_processed += hunk_num_sids;
|
---|
456 | hunk_sids += hunk_num_sids;
|
---|
457 | hunk_domains += hunk_num_sids;
|
---|
458 | hunk_names += hunk_num_sids;
|
---|
459 | hunk_types += hunk_num_sids;
|
---|
460 | }
|
---|
461 |
|
---|
462 | *pdomains = domains;
|
---|
463 | *pnames = names;
|
---|
464 | *ptypes = types;
|
---|
465 |
|
---|
466 | if (!have_mapped) {
|
---|
467 | result = NT_STATUS_NONE_MAPPED;
|
---|
468 | }
|
---|
469 | if (have_unmapped) {
|
---|
470 | result = STATUS_SOME_UNMAPPED;
|
---|
471 | }
|
---|
472 | *presult = result;
|
---|
473 |
|
---|
474 | return status;
|
---|
475 |
|
---|
476 | fail:
|
---|
477 | TALLOC_FREE(domains);
|
---|
478 | TALLOC_FREE(names);
|
---|
479 | TALLOC_FREE(types);
|
---|
480 |
|
---|
481 | return status;
|
---|
482 | }
|
---|
483 |
|
---|
484 | NTSTATUS dcerpc_lsa_lookup_sids(struct dcerpc_binding_handle *h,
|
---|
485 | TALLOC_CTX *mem_ctx,
|
---|
486 | struct policy_handle *pol,
|
---|
487 | int num_sids,
|
---|
488 | const struct dom_sid *sids,
|
---|
489 | char ***pdomains,
|
---|
490 | char ***pnames,
|
---|
491 | enum lsa_SidType **ptypes,
|
---|
492 | NTSTATUS *result)
|
---|
493 | {
|
---|
494 | return dcerpc_lsa_lookup_sids_generic(h,
|
---|
495 | mem_ctx,
|
---|
496 | pol,
|
---|
497 | num_sids,
|
---|
498 | sids,
|
---|
499 | pdomains,
|
---|
500 | pnames,
|
---|
501 | ptypes,
|
---|
502 | false,
|
---|
503 | result);
|
---|
504 | }
|
---|
505 |
|
---|
506 | NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
|
---|
507 | TALLOC_CTX *mem_ctx,
|
---|
508 | struct policy_handle *pol,
|
---|
509 | int num_sids,
|
---|
510 | const struct dom_sid *sids,
|
---|
511 | char ***pdomains,
|
---|
512 | char ***pnames,
|
---|
513 | enum lsa_SidType **ptypes)
|
---|
514 | {
|
---|
515 | NTSTATUS status;
|
---|
516 | NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
|
---|
517 |
|
---|
518 | status = dcerpc_lsa_lookup_sids_generic(cli->binding_handle,
|
---|
519 | mem_ctx,
|
---|
520 | pol,
|
---|
521 | num_sids,
|
---|
522 | sids,
|
---|
523 | pdomains,
|
---|
524 | pnames,
|
---|
525 | ptypes,
|
---|
526 | false,
|
---|
527 | &result);
|
---|
528 | if (!NT_STATUS_IS_OK(status)) {
|
---|
529 | return status;
|
---|
530 | }
|
---|
531 |
|
---|
532 | return result;
|
---|
533 | }
|
---|
534 |
|
---|
535 | NTSTATUS dcerpc_lsa_lookup_sids3(struct dcerpc_binding_handle *h,
|
---|
536 | TALLOC_CTX *mem_ctx,
|
---|
537 | struct policy_handle *pol,
|
---|
538 | int num_sids,
|
---|
539 | const struct dom_sid *sids,
|
---|
540 | char ***pdomains,
|
---|
541 | char ***pnames,
|
---|
542 | enum lsa_SidType **ptypes,
|
---|
543 | NTSTATUS *result)
|
---|
544 | {
|
---|
545 | return dcerpc_lsa_lookup_sids_generic(h,
|
---|
546 | mem_ctx,
|
---|
547 | pol,
|
---|
548 | num_sids,
|
---|
549 | sids,
|
---|
550 | pdomains,
|
---|
551 | pnames,
|
---|
552 | ptypes,
|
---|
553 | true,
|
---|
554 | result);
|
---|
555 | }
|
---|
556 |
|
---|
557 | /** Lookup a list of names */
|
---|
558 |
|
---|
559 | NTSTATUS dcerpc_lsa_lookup_names_generic(struct dcerpc_binding_handle *h,
|
---|
560 | TALLOC_CTX *mem_ctx,
|
---|
561 | struct policy_handle *pol,
|
---|
562 | uint32_t num_names,
|
---|
563 | const char **names,
|
---|
564 | const char ***dom_names,
|
---|
565 | enum lsa_LookupNamesLevel level,
|
---|
566 | struct dom_sid **sids,
|
---|
567 | enum lsa_SidType **types,
|
---|
568 | bool use_lookupnames4,
|
---|
569 | NTSTATUS *presult)
|
---|
570 | {
|
---|
571 | NTSTATUS status;
|
---|
572 | struct lsa_String *lsa_names = NULL;
|
---|
573 | struct lsa_RefDomainList *domains = NULL;
|
---|
574 | struct lsa_TransSidArray sid_array;
|
---|
575 | struct lsa_TransSidArray3 sid_array3;
|
---|
576 | uint32_t count = 0;
|
---|
577 | uint32_t i;
|
---|
578 |
|
---|
579 | ZERO_STRUCT(sid_array);
|
---|
580 | ZERO_STRUCT(sid_array3);
|
---|
581 |
|
---|
582 | lsa_names = TALLOC_ARRAY(mem_ctx, struct lsa_String, num_names);
|
---|
583 | if (lsa_names == NULL) {
|
---|
584 | return NT_STATUS_NO_MEMORY;
|
---|
585 | }
|
---|
586 |
|
---|
587 | for (i = 0; i < num_names; i++) {
|
---|
588 | init_lsa_String(&lsa_names[i], names[i]);
|
---|
589 | }
|
---|
590 |
|
---|
591 | if (use_lookupnames4) {
|
---|
592 | status = dcerpc_lsa_LookupNames4(h,
|
---|
593 | mem_ctx,
|
---|
594 | num_names,
|
---|
595 | lsa_names,
|
---|
596 | &domains,
|
---|
597 | &sid_array3,
|
---|
598 | level,
|
---|
599 | &count,
|
---|
600 | LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
|
---|
601 | LSA_CLIENT_REVISION_2,
|
---|
602 | presult);
|
---|
603 | } else {
|
---|
604 | status = dcerpc_lsa_LookupNames(h,
|
---|
605 | mem_ctx,
|
---|
606 | pol,
|
---|
607 | num_names,
|
---|
608 | lsa_names,
|
---|
609 | &domains,
|
---|
610 | &sid_array,
|
---|
611 | level,
|
---|
612 | &count,
|
---|
613 | presult);
|
---|
614 | }
|
---|
615 | if (!NT_STATUS_IS_OK(status)) {
|
---|
616 | goto done;
|
---|
617 | }
|
---|
618 |
|
---|
619 | if (!NT_STATUS_IS_OK(*presult) &&
|
---|
620 | !NT_STATUS_EQUAL(*presult, STATUS_SOME_UNMAPPED)) {
|
---|
621 | /* An actual error occured */
|
---|
622 | goto done;
|
---|
623 | }
|
---|
624 |
|
---|
625 | /* Return output parameters */
|
---|
626 | if (count == 0) {
|
---|
627 | *presult = NT_STATUS_NONE_MAPPED;
|
---|
628 | goto done;
|
---|
629 | }
|
---|
630 |
|
---|
631 | if (num_names) {
|
---|
632 | if (!((*sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_names)))) {
|
---|
633 | DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
|
---|
634 | *presult = NT_STATUS_NO_MEMORY;
|
---|
635 | goto done;
|
---|
636 | }
|
---|
637 |
|
---|
638 | if (!((*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_names)))) {
|
---|
639 | DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
|
---|
640 | *presult = NT_STATUS_NO_MEMORY;
|
---|
641 | goto done;
|
---|
642 | }
|
---|
643 |
|
---|
644 | if (dom_names != NULL) {
|
---|
645 | *dom_names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
|
---|
646 | if (*dom_names == NULL) {
|
---|
647 | DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
|
---|
648 | *presult = NT_STATUS_NO_MEMORY;
|
---|
649 | goto done;
|
---|
650 | }
|
---|
651 | }
|
---|
652 | } else {
|
---|
653 | *sids = NULL;
|
---|
654 | *types = NULL;
|
---|
655 | if (dom_names != NULL) {
|
---|
656 | *dom_names = NULL;
|
---|
657 | }
|
---|
658 | }
|
---|
659 |
|
---|
660 | for (i = 0; i < num_names; i++) {
|
---|
661 | uint32_t dom_idx;
|
---|
662 | struct dom_sid *sid = &(*sids)[i];
|
---|
663 |
|
---|
664 | if (use_lookupnames4) {
|
---|
665 | if (i >= sid_array3.count) {
|
---|
666 | *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
667 | goto done;
|
---|
668 | }
|
---|
669 |
|
---|
670 | dom_idx = sid_array3.sids[i].sid_index;
|
---|
671 | (*types)[i] = sid_array3.sids[i].sid_type;
|
---|
672 | } else {
|
---|
673 | if (i >= sid_array.count) {
|
---|
674 | *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
675 | goto done;
|
---|
676 | }
|
---|
677 |
|
---|
678 | dom_idx = sid_array.sids[i].sid_index;
|
---|
679 | (*types)[i] = sid_array.sids[i].sid_type;
|
---|
680 | }
|
---|
681 |
|
---|
682 | /* Translate optimised sid through domain index array */
|
---|
683 |
|
---|
684 | if (dom_idx == 0xffffffff) {
|
---|
685 | /* Nothing to do, this is unknown */
|
---|
686 | ZERO_STRUCTP(sid);
|
---|
687 | (*types)[i] = SID_NAME_UNKNOWN;
|
---|
688 | continue;
|
---|
689 | }
|
---|
690 | if (domains == NULL) {
|
---|
691 | *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
692 | goto done;
|
---|
693 | }
|
---|
694 | if (dom_idx >= domains->count) {
|
---|
695 | *presult = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
696 | goto done;
|
---|
697 | }
|
---|
698 |
|
---|
699 | if (use_lookupnames4) {
|
---|
700 | sid_copy(sid, sid_array3.sids[i].sid);
|
---|
701 | } else {
|
---|
702 | sid_copy(sid, domains->domains[dom_idx].sid);
|
---|
703 |
|
---|
704 | if (sid_array.sids[i].rid != 0xffffffff) {
|
---|
705 | sid_append_rid(sid, sid_array.sids[i].rid);
|
---|
706 | }
|
---|
707 | }
|
---|
708 |
|
---|
709 | if (dom_names == NULL) {
|
---|
710 | continue;
|
---|
711 | }
|
---|
712 |
|
---|
713 | (*dom_names)[i] = domains->domains[dom_idx].name.string;
|
---|
714 | }
|
---|
715 |
|
---|
716 | done:
|
---|
717 | return status;
|
---|
718 | }
|
---|
719 |
|
---|
720 | NTSTATUS dcerpc_lsa_lookup_names(struct dcerpc_binding_handle *h,
|
---|
721 | TALLOC_CTX *mem_ctx,
|
---|
722 | struct policy_handle *pol,
|
---|
723 | uint32_t num_names,
|
---|
724 | const char **names,
|
---|
725 | const char ***dom_names,
|
---|
726 | enum lsa_LookupNamesLevel level,
|
---|
727 | struct dom_sid **sids,
|
---|
728 | enum lsa_SidType **types,
|
---|
729 | NTSTATUS *result)
|
---|
730 | {
|
---|
731 | return dcerpc_lsa_lookup_names_generic(h,
|
---|
732 | mem_ctx,
|
---|
733 | pol,
|
---|
734 | num_names,
|
---|
735 | names,
|
---|
736 | dom_names,
|
---|
737 | level,
|
---|
738 | sids,
|
---|
739 | types,
|
---|
740 | false,
|
---|
741 | result);
|
---|
742 | }
|
---|
743 |
|
---|
744 | NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
|
---|
745 | TALLOC_CTX *mem_ctx,
|
---|
746 | struct policy_handle *pol,
|
---|
747 | int num_names,
|
---|
748 | const char **names,
|
---|
749 | const char ***dom_names,
|
---|
750 | int level,
|
---|
751 | struct dom_sid **sids,
|
---|
752 | enum lsa_SidType **types)
|
---|
753 | {
|
---|
754 | NTSTATUS status;
|
---|
755 | NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
|
---|
756 |
|
---|
757 | status = dcerpc_lsa_lookup_names(cli->binding_handle,
|
---|
758 | mem_ctx,
|
---|
759 | pol,
|
---|
760 | num_names,
|
---|
761 | names,
|
---|
762 | dom_names,
|
---|
763 | level,
|
---|
764 | sids,
|
---|
765 | types,
|
---|
766 | &result);
|
---|
767 | if (!NT_STATUS_IS_OK(status)) {
|
---|
768 | return status;
|
---|
769 | }
|
---|
770 |
|
---|
771 | return result;
|
---|
772 | }
|
---|
773 |
|
---|
774 | NTSTATUS dcerpc_lsa_lookup_names4(struct dcerpc_binding_handle *h,
|
---|
775 | TALLOC_CTX *mem_ctx,
|
---|
776 | struct policy_handle *pol,
|
---|
777 | uint32_t num_names,
|
---|
778 | const char **names,
|
---|
779 | const char ***dom_names,
|
---|
780 | enum lsa_LookupNamesLevel level,
|
---|
781 | struct dom_sid **sids,
|
---|
782 | enum lsa_SidType **types,
|
---|
783 | NTSTATUS *result)
|
---|
784 | {
|
---|
785 | return dcerpc_lsa_lookup_names_generic(h,
|
---|
786 | mem_ctx,
|
---|
787 | pol,
|
---|
788 | num_names,
|
---|
789 | names,
|
---|
790 | dom_names,
|
---|
791 | level,
|
---|
792 | sids,
|
---|
793 | types,
|
---|
794 | true,
|
---|
795 | result);
|
---|
796 | }
|
---|