source/rpc_client/cli_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4    Copyright (C) Tim Potter                        2000-2001,
   5    Copyright (C) Andrew Tridgell              1992-1997,2000,
   6    Copyright (C) Rafal Szczesniak                       2002
   7    Copyright (C) Jeremy Allison                         2005.
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24
  25 /** @defgroup lsa LSA - Local Security Architecture
  26  *  @ingroup rpc_client
  27  *
  28  * @{
  29  **/
  30
  31 /**
  32  * @file cli_lsarpc.c
  33  *
  34  * RPC client routines for the LSA RPC pipe.  LSA means "local
  35  * security authority", which is half of a password database.
  36  **/
  37
  38 /** Open a LSA policy handle
  39  *
  40  * @param cli Handle on an initialised SMB connection */
  41
  42 NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
  43                                 TALLOC_CTX *mem_ctx,
  44                                 BOOL sec_qos, uint32 des_access,
  45                                 POLICY_HND *pol)
  46 {
  47         prs_struct qbuf, rbuf;
  48         LSA_Q_OPEN_POL q;
  49         LSA_R_OPEN_POL r;
  50         LSA_SEC_QOS qos;
  51         NTSTATUS result;
  52
  53         ZERO_STRUCT(q);
  54         ZERO_STRUCT(r);
  55
  56         /* Initialise input parameters */
  57
  58         if (sec_qos) {
  59                 init_lsa_sec_qos(&qos, 2, 1, 0);
  60                 init_q_open_pol(&q, '\\', 0, des_access, &qos);
  61         } else {
  62                 init_q_open_pol(&q, '\\', 0, des_access, NULL);
  63         }
  64
  65         /* Marshall data and send request */
  66
  67         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY,
  68                         q, r,
  69                         qbuf, rbuf,
  70                         lsa_io_q_open_pol,
  71                         lsa_io_r_open_pol,
  72                         NT_STATUS_UNSUCCESSFUL );
  73
  74         /* Return output parameters */
  75
  76         result = r.status;
  77
  78         if (NT_STATUS_IS_OK(result)) {
  79                 *pol = r.pol;
  80         }
  81
  82         return result;
  83 }
  84
  85 /** Open a LSA policy handle
  86   *
  87   * @param cli Handle on an initialised SMB connection
  88   */
  89
  90 NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
  91                                  TALLOC_CTX *mem_ctx, BOOL sec_qos,
  92                                  uint32 des_access, POLICY_HND *pol)
  93 {
  94         prs_struct qbuf, rbuf;
  95         LSA_Q_OPEN_POL2 q;
  96         LSA_R_OPEN_POL2 r;
  97         LSA_SEC_QOS qos;
  98         NTSTATUS result;
  99         char *srv_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", cli->cli->desthost);
 100
 101         ZERO_STRUCT(q);
 102         ZERO_STRUCT(r);
 103
 104         if (sec_qos) {
 105                 init_lsa_sec_qos(&qos, 2, 1, 0);
 106                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, &qos);
 107         } else {
 108                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, NULL);
 109         }
 110
 111         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY2,
 112                         q, r,
 113                         qbuf, rbuf,
 114                         lsa_io_q_open_pol2,
 115                         lsa_io_r_open_pol2,
 116                         NT_STATUS_UNSUCCESSFUL );
 117
 118         /* Return output parameters */
 119
 120         result = r.status;
 121
 122         if (NT_STATUS_IS_OK(result)) {
 123                 *pol = r.pol;
 124         }
 125
 126         return result;
 127 }
 128
 129 /* Lookup a list of sids
 130  *
 131  * internal version withOUT memory allocation of the target arrays.
 132  * this assumes suffciently sized arrays to store domains, names and types. */
 133
 134 static NTSTATUS rpccli_lsa_lookup_sids_noalloc(struct rpc_pipe_client *cli,
 135                                                TALLOC_CTX *mem_ctx,
 136                                                POLICY_HND *pol,
 137                                                int num_sids,
 138                                                const DOM_SID *sids,
 139                                                char **domains,
 140                                                char **names,
 141                                                enum lsa_SidType *types)
 142 {
 143         prs_struct qbuf, rbuf;
 144         LSA_Q_LOOKUP_SIDS q;
 145         LSA_R_LOOKUP_SIDS r;
 146         DOM_R_REF ref;
 147         NTSTATUS result = NT_STATUS_OK;
 148         TALLOC_CTX *tmp_ctx = NULL;
 149         int i;
 150
 151         tmp_ctx = talloc_new(mem_ctx);
 152         if (!tmp_ctx) {
 153                 DEBUG(0, ("rpccli_lsa_lookup_sids_noalloc: out of memory!\n"));
 154                 result = NT_STATUS_UNSUCCESSFUL;
 155                 goto done;
 156         }
 157
 158         ZERO_STRUCT(q);
 159         ZERO_STRUCT(r);
 160
 161         init_q_lookup_sids(tmp_ctx, &q, pol, num_sids, sids, 1);
 162
 163         ZERO_STRUCT(ref);
 164
 165         r.dom_ref = &ref;
 166
 167         CLI_DO_RPC( cli, tmp_ctx, PI_LSARPC, LSA_LOOKUPSIDS,
 168                         q, r,
 169                         qbuf, rbuf,
 170                         lsa_io_q_lookup_sids,
 171                         lsa_io_r_lookup_sids,
 172                         NT_STATUS_UNSUCCESSFUL );
 173
 174         DEBUG(10, ("LSA_LOOKUPSIDS returned '%s', mapped count = %d'\n",
 175                    nt_errstr(r.status), r.mapped_count));
 176
 177         if (!NT_STATUS_IS_OK(r.status) &&
 178             !NT_STATUS_EQUAL(r.status, NT_STATUS_NONE_MAPPED) &&
 179             !NT_STATUS_EQUAL(r.status, STATUS_SOME_UNMAPPED))
 180         {
 181                 /* An actual error occured */
 182                 result = r.status;
 183                 goto done;
 184         }
 185
 186         /* Return output parameters */
 187
 188         if (NT_STATUS_EQUAL(r.status, NT_STATUS_NONE_MAPPED) ||
 189             (r.mapped_count == 0))
 190         {
 191                 for (i = 0; i < num_sids; i++) {
 192                         (names)[i] = NULL;
 193                         (domains)[i] = NULL;
 194                         (types)[i] = SID_NAME_UNKNOWN;
 195                 }
 196                 result = NT_STATUS_NONE_MAPPED;
 197                 goto done;
 198         }
 199
 200         for (i = 0; i < num_sids; i++) {
 201                 fstring name, dom_name;
 202                 uint32 dom_idx = r.names.name[i].domain_idx;
 203
 204                 /* Translate optimised name through domain index array */
 205
 206                 if (dom_idx != 0xffffffff) {
 207
 208                         rpcstr_pull_unistr2_fstring(
 209                                 dom_name, &ref.ref_dom[dom_idx].uni_dom_name);
 210                         rpcstr_pull_unistr2_fstring(
 211                                 name, &r.names.uni_name[i]);
 212
 213                         (names)[i] = talloc_strdup(mem_ctx, name);
 214                         (domains)[i] = talloc_strdup(mem_ctx, dom_name);
 215                         (types)[i] = (enum lsa_SidType)r.names.name[i].sid_name_use;
 216
 217                         if (((names)[i] == NULL) || ((domains)[i] == NULL)) {
 218                                 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
 219                                 result = NT_STATUS_UNSUCCESSFUL;
 220                                 goto done;
 221                         }
 222
 223                 } else {
 224                         (names)[i] = NULL;
 225                         (domains)[i] = NULL;
 226                         (types)[i] = SID_NAME_UNKNOWN;
 227                 }
 228         }
 229
 230 done:
 231         TALLOC_FREE(tmp_ctx);
 232         return result;
 233 }
 234
 235 /* Lookup a list of sids
 236  *
 237  * do it the right way: there is a limit (of 20480 for w2k3) entries
 238  * returned by this call. when the sids list contains more entries,
 239  * empty lists are returned. This version of lsa_lookup_sids passes
 240  * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
 241
 242 /* This constant defines the limit of how many sids to look up
 243  * in one call (maximum). the limit from the server side is
 244  * at 20480 for win2k3, but we keep it at a save 1000 for now. */
 245 #define LOOKUP_SIDS_HUNK_SIZE 1000
 246
 247 NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
 248                                 TALLOC_CTX *mem_ctx,
 249                                 POLICY_HND *pol,
 250                                 int num_sids,
 251                                 const DOM_SID *sids,
 252                                 char ***domains,
 253                                 char ***names,
 254                                 enum lsa_SidType **types)
 255 {
 256         NTSTATUS result = NT_STATUS_OK;
 257         int sids_left = 0;
 258         int sids_processed = 0;
 259         const DOM_SID *hunk_sids = sids;
 260         char **hunk_domains = NULL;
 261         char **hunk_names = NULL;
 262         enum lsa_SidType *hunk_types = NULL;
 263
 264         if (num_sids) {
 265                 if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 266                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 267                         result = NT_STATUS_NO_MEMORY;
 268                         goto fail;
 269                 }
 270
 271                 if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 272                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 273                         result = NT_STATUS_NO_MEMORY;
 274                         goto fail;
 275                 }
 276
 277                 if (!((*types) = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
 278                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 279                         result = NT_STATUS_NO_MEMORY;
 280                         goto fail;
 281                 }
 282         } else {
 283                 (*domains) = NULL;
 284                 (*names) = NULL;
 285                 (*types) = NULL;
 286         }
 287
 288         sids_left = num_sids;
 289         hunk_domains = *domains;
 290         hunk_names = *names;
 291         hunk_types = *types;
 292
 293         while (sids_left > 0) {
 294                 int hunk_num_sids;
 295                 NTSTATUS hunk_result = NT_STATUS_OK;
 296
 297                 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
 298                                 ? LOOKUP_SIDS_HUNK_SIZE
 299                                 : sids_left);
 300
 301                 DEBUG(10, ("rpccli_lsa_lookup_sids: processing items "
 302                            "%d -- %d of %d.\n",
 303                            sids_processed,
 304                            sids_processed + hunk_num_sids - 1,
 305                            num_sids));
 306
 307                 hunk_result = rpccli_lsa_lookup_sids_noalloc(cli,
 308                                                              mem_ctx,
 309                                                              pol,
 310                                                              hunk_num_sids,
 311                                                              hunk_sids,
 312                                                              hunk_domains,
 313                                                              hunk_names,
 314                                                              hunk_types);
 315
 316                 if (!NT_STATUS_IS_OK(hunk_result) &&
 317                     !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
 318                     !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED))
 319                 {
 320                         /* An actual error occured */
 321                         result = hunk_result;
 322                         goto fail;
 323                 }
 324
 325                 /* adapt overall result */
 326                 if (( NT_STATUS_IS_OK(result) &&
 327                      !NT_STATUS_IS_OK(hunk_result))
 328                     ||
 329                     ( NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
 330                      !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)))
 331                 {
 332                         result = STATUS_SOME_UNMAPPED;
 333                 }
 334
 335                 sids_left -= hunk_num_sids;
 336                 sids_processed += hunk_num_sids; /* only used in DEBUG */
 337                 hunk_sids += hunk_num_sids;
 338                 hunk_domains += hunk_num_sids;
 339                 hunk_names += hunk_num_sids;
 340                 hunk_types += hunk_num_sids;
 341         }
 342
 343         return result;
 344
 345 fail:
 346         TALLOC_FREE(*domains);
 347         TALLOC_FREE(*names);
 348         TALLOC_FREE(*types);
 349         return result;
 350 }
 351
 352 /** Lookup a list of names */
 353
 354 NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
 355                                  TALLOC_CTX *mem_ctx,
 356                                  POLICY_HND *pol, int num_names,
 357                                  const char **names,
 358                                  const char ***dom_names,
 359                                  int level,
 360                                  DOM_SID **sids,
 361                                  enum lsa_SidType **types)
 362 {
 363         prs_struct qbuf, rbuf;
 364         LSA_Q_LOOKUP_NAMES q;
 365         LSA_R_LOOKUP_NAMES r;
 366         DOM_R_REF ref;
 367         NTSTATUS result;
 368         int i;
 369
 370         ZERO_STRUCT(q);
 371         ZERO_STRUCT(r);
 372
 373         ZERO_STRUCT(ref);
 374         r.dom_ref = &ref;
 375
 376         init_q_lookup_names(mem_ctx, &q, pol, num_names, names, level);
 377
 378         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPNAMES,
 379                         q, r,
 380                         qbuf, rbuf,
 381                         lsa_io_q_lookup_names,
 382                         lsa_io_r_lookup_names,
 383                         NT_STATUS_UNSUCCESSFUL);
 384
 385         result = r.status;
 386
 387         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 388             NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
 389
 390                 /* An actual error occured */
 391
 392                 goto done;
 393         }
 394
 395         /* Return output parameters */
 396
 397         if (r.mapped_count == 0) {
 398                 result = NT_STATUS_NONE_MAPPED;
 399                 goto done;
 400         }
 401
 402         if (num_names) {
 403                 if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
 404                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 405                         result = NT_STATUS_NO_MEMORY;
 406                         goto done;
 407                 }
 408
 409                 if (!((*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_names)))) {
 410                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 411                         result = NT_STATUS_NO_MEMORY;
 412                         goto done;
 413                 }
 414
 415                 if (dom_names != NULL) {
 416                         *dom_names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
 417                         if (*dom_names == NULL) {
 418                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 419                                 result = NT_STATUS_NO_MEMORY;
 420                                 goto done;
 421                         }
 422                 }
 423         } else {
 424                 *sids = NULL;
 425                 *types = NULL;
 426                 if (dom_names != NULL) {
 427                         *dom_names = NULL;
 428                 }
 429         }
 430
 431         for (i = 0; i < num_names; i++) {
 432                 DOM_RID *t_rids = r.dom_rid;
 433                 uint32 dom_idx = t_rids[i].rid_idx;
 434                 uint32 dom_rid = t_rids[i].rid;
 435                 DOM_SID *sid = &(*sids)[i];
 436
 437                 /* Translate optimised sid through domain index array */
 438
 439                 if (dom_idx == 0xffffffff) {
 440                         /* Nothing to do, this is unknown */
 441                         ZERO_STRUCTP(sid);
 442                         (*types)[i] = SID_NAME_UNKNOWN;
 443                         continue;
 444                 }
 445
 446                 sid_copy(sid, &ref.ref_dom[dom_idx].ref_dom.sid);
 447
 448                 if (dom_rid != 0xffffffff) {
 449                         sid_append_rid(sid, dom_rid);
 450                 }
 451
 452                 (*types)[i] = (enum lsa_SidType)t_rids[i].type;
 453
 454                 if (dom_names == NULL) {
 455                         continue;
 456                 }
 457
 458                 (*dom_names)[i] = rpcstr_pull_unistr2_talloc(
 459                         *dom_names, &ref.ref_dom[dom_idx].uni_dom_name);
 460         }
 461
 462  done:
 463
 464         return result;
 465 }
 466
 467 NTSTATUS rpccli_lsa_query_info_policy_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 468                                           POLICY_HND *pol, uint16 info_class,
 469                                           LSA_INFO_CTR *ctr)
 470 {
 471         prs_struct qbuf, rbuf;
 472         LSA_Q_QUERY_INFO q;
 473         LSA_R_QUERY_INFO r;
 474         NTSTATUS result;
 475
 476         ZERO_STRUCT(q);
 477         ZERO_STRUCT(r);
 478
 479         init_q_query(&q, pol, info_class);
 480
 481         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
 482                 q, r,
 483                 qbuf, rbuf,
 484                 lsa_io_q_query,
 485                 lsa_io_r_query,
 486                 NT_STATUS_UNSUCCESSFUL);
 487
 488         result = r.status;
 489
 490         if (!NT_STATUS_IS_OK(result)) {
 491                 goto done;
 492         }
 493
 494  done:
 495
 496         *ctr = r.ctr;
 497
 498         return result;
 499 }
 500
 501 NTSTATUS rpccli_lsa_query_info_policy2_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 502                                           POLICY_HND *pol, uint16 info_class,
 503                                           LSA_INFO_CTR2 *ctr)
 504 {
 505         prs_struct qbuf, rbuf;
 506         LSA_Q_QUERY_INFO2 q;
 507         LSA_R_QUERY_INFO2 r;
 508         NTSTATUS result;
 509
 510         ZERO_STRUCT(q);
 511         ZERO_STRUCT(r);
 512
 513         init_q_query2(&q, pol, info_class);
 514
 515         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
 516                 q, r,
 517                 qbuf, rbuf,
 518                 lsa_io_q_query_info2,
 519                 lsa_io_r_query_info2,
 520                 NT_STATUS_UNSUCCESSFUL);
 521
 522         result = r.status;
 523
 524         if (!NT_STATUS_IS_OK(result)) {
 525                 goto done;
 526         }
 527
 528  done:
 529
 530         *ctr = r.ctr;
 531
 532         return result;
 533 }
 534
 535
 536
 537 /** Query info policy
 538  *
 539  *  @param domain_sid - returned remote server's domain sid */
 540
 541 NTSTATUS rpccli_lsa_query_info_policy(struct rpc_pipe_client *cli,
 542                                       TALLOC_CTX *mem_ctx,
 543                                       POLICY_HND *pol, uint16 info_class,
 544                                       char **domain_name, DOM_SID **domain_sid)
 545 {
 546         prs_struct qbuf, rbuf;
 547         LSA_Q_QUERY_INFO q;
 548         LSA_R_QUERY_INFO r;
 549         NTSTATUS result;
 550
 551         ZERO_STRUCT(q);
 552         ZERO_STRUCT(r);
 553
 554         init_q_query(&q, pol, info_class);
 555
 556         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
 557                 q, r,
 558                 qbuf, rbuf,
 559                 lsa_io_q_query,
 560                 lsa_io_r_query,
 561                 NT_STATUS_UNSUCCESSFUL);
 562
 563         result = r.status;
 564
 565         if (!NT_STATUS_IS_OK(result)) {
 566                 goto done;
 567         }
 568
 569         /* Return output parameters */
 570
 571         switch (info_class) {
 572
 573         case 3:
 574                 if (domain_name && (r.ctr.info.id3.buffer_dom_name != 0)) {
 575                         *domain_name = unistr2_tdup(mem_ctx,
 576                                                    &r.ctr.info.id3.
 577                                                    uni_domain_name);
 578                         if (!*domain_name) {
 579                                 return NT_STATUS_NO_MEMORY;
 580                         }
 581                 }
 582
 583                 if (domain_sid && (r.ctr.info.id3.buffer_dom_sid != 0)) {
 584                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 585                         if (!*domain_sid) {
 586                                 return NT_STATUS_NO_MEMORY;
 587                         }
 588                         sid_copy(*domain_sid, &r.ctr.info.id3.dom_sid.sid);
 589                 }
 590
 591                 break;
 592
 593         case 5:
 594
 595                 if (domain_name && (r.ctr.info.id5.buffer_dom_name != 0)) {
 596                         *domain_name = unistr2_tdup(mem_ctx,
 597                                                    &r.ctr.info.id5.
 598                                                    uni_domain_name);
 599                         if (!*domain_name) {
 600                                 return NT_STATUS_NO_MEMORY;
 601                         }
 602                 }
 603
 604                 if (domain_sid && (r.ctr.info.id5.buffer_dom_sid != 0)) {
 605                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 606                         if (!*domain_sid) {
 607                                 return NT_STATUS_NO_MEMORY;
 608                         }
 609                         sid_copy(*domain_sid, &r.ctr.info.id5.dom_sid.sid);
 610                 }
 611                 break;
 612
 613         default:
 614                 DEBUG(3, ("unknown info class %d\n", info_class));
 615                 break;
 616         }
 617
 618  done:
 619
 620         return result;
 621 }
 622
 623 /** Query info policy2
 624  *
 625  *  @param domain_name - returned remote server's domain name
 626  *  @param dns_name - returned remote server's dns domain name
 627  *  @param forest_name - returned remote server's forest name
 628  *  @param domain_guid - returned remote server's domain guid
 629  *  @param domain_sid - returned remote server's domain sid */
 630
 631 NTSTATUS rpccli_lsa_query_info_policy2(struct rpc_pipe_client *cli,
 632                                        TALLOC_CTX *mem_ctx,
 633                                        POLICY_HND *pol, uint16 info_class,
 634                                        char **domain_name, char **dns_name,
 635                                        char **forest_name,
 636                                        struct GUID **domain_guid,
 637                                        DOM_SID **domain_sid)
 638 {
 639         prs_struct qbuf, rbuf;
 640         LSA_Q_QUERY_INFO2 q;
 641         LSA_R_QUERY_INFO2 r;
 642         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 643
 644         if (info_class != 12)
 645                 goto done;
 646
 647         ZERO_STRUCT(q);
 648         ZERO_STRUCT(r);
 649
 650         init_q_query2(&q, pol, info_class);
 651
 652         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
 653                 q, r,
 654                 qbuf, rbuf,
 655                 lsa_io_q_query_info2,
 656                 lsa_io_r_query_info2,
 657                 NT_STATUS_UNSUCCESSFUL);
 658
 659         result = r.status;
 660
 661         if (!NT_STATUS_IS_OK(result)) {
 662                 goto done;
 663         }
 664
 665         /* Return output parameters */
 666
 667         ZERO_STRUCTP(domain_guid);
 668
 669         if (domain_name && r.ctr.info.id12.hdr_nb_dom_name.buffer) {
 670                 *domain_name = unistr2_tdup(mem_ctx,
 671                                             &r.ctr.info.id12
 672                                             .uni_nb_dom_name);
 673                 if (!*domain_name) {
 674                         return NT_STATUS_NO_MEMORY;
 675                 }
 676         }
 677         if (dns_name && r.ctr.info.id12.hdr_dns_dom_name.buffer) {
 678                 *dns_name = unistr2_tdup(mem_ctx,
 679                                          &r.ctr.info.id12
 680                                          .uni_dns_dom_name);
 681                 if (!*dns_name) {
 682                         return NT_STATUS_NO_MEMORY;
 683                 }
 684         }
 685         if (forest_name && r.ctr.info.id12.hdr_forest_name.buffer) {
 686                 *forest_name = unistr2_tdup(mem_ctx,
 687                                             &r.ctr.info.id12
 688                                             .uni_forest_name);
 689                 if (!*forest_name) {
 690                         return NT_STATUS_NO_MEMORY;
 691                 }
 692         }
 693
 694         if (domain_guid) {
 695                 *domain_guid = TALLOC_P(mem_ctx, struct GUID);
 696                 if (!*domain_guid) {
 697                         return NT_STATUS_NO_MEMORY;
 698                 }
 699                 memcpy(*domain_guid,
 700                        &r.ctr.info.id12.dom_guid,
 701                        sizeof(struct GUID));
 702         }
 703
 704         if (domain_sid && r.ctr.info.id12.ptr_dom_sid != 0) {
 705                 *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 706                 if (!*domain_sid) {
 707                         return NT_STATUS_NO_MEMORY;
 708                 }
 709                 sid_copy(*domain_sid,
 710                          &r.ctr.info.id12.dom_sid.sid);
 711         }
 712
 713  done:
 714
 715         return result;
 716 }
 717
 718 NTSTATUS rpccli_lsa_set_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 719                                     POLICY_HND *pol, uint16 info_class,
 720                                     LSA_INFO_CTR ctr)
 721 {
 722         prs_struct qbuf, rbuf;
 723         LSA_Q_SET_INFO q;
 724         LSA_R_SET_INFO r;
 725         NTSTATUS result;
 726
 727         ZERO_STRUCT(q);
 728         ZERO_STRUCT(r);
 729
 730         init_q_set(&q, pol, info_class, ctr);
 731
 732         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_SETINFOPOLICY,
 733                 q, r,
 734                 qbuf, rbuf,
 735                 lsa_io_q_set,
 736                 lsa_io_r_set,
 737                 NT_STATUS_UNSUCCESSFUL);
 738
 739         result = r.status;
 740
 741         if (!NT_STATUS_IS_OK(result)) {
 742                 goto done;
 743         }
 744
 745         /* Return output parameters */
 746
 747  done:
 748
 749         return result;
 750 }
 751
 752
 753 /**
 754  * Enumerate list of trusted domains
 755  *
 756  * @param cli client state (cli_state) structure of the connection
 757  * @param mem_ctx memory context
 758  * @param pol opened lsa policy handle
 759  * @param enum_ctx enumeration context ie. index of first returned domain entry
 760  * @param pref_num_domains preferred max number of entries returned in one response
 761  * @param num_domains total number of trusted domains returned by response
 762  * @param domain_names returned trusted domain names
 763  * @param domain_sids returned trusted domain sids
 764  *
 765  * @return nt status code of response
 766  **/
 767
 768 NTSTATUS rpccli_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
 769                                    TALLOC_CTX *mem_ctx,
 770                                    POLICY_HND *pol, uint32 *enum_ctx,
 771                                    uint32 *num_domains,
 772                                    char ***domain_names, DOM_SID **domain_sids)
 773 {
 774         prs_struct qbuf, rbuf;
 775         LSA_Q_ENUM_TRUST_DOM in;
 776         LSA_R_ENUM_TRUST_DOM out;
 777         int i;
 778         fstring tmp;
 779
 780         ZERO_STRUCT(in);
 781         ZERO_STRUCT(out);
 782
 783         /* 64k is enough for about 2000 trusted domains */
 784
 785         init_q_enum_trust_dom(&in, pol, *enum_ctx, 0x10000);
 786
 787         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMTRUSTDOM,
 788                     in, out,
 789                     qbuf, rbuf,
 790                     lsa_io_q_enum_trust_dom,
 791                     lsa_io_r_enum_trust_dom,
 792                     NT_STATUS_UNSUCCESSFUL );
 793
 794
 795         /* check for an actual error */
 796
 797         if ( !NT_STATUS_IS_OK(out.status)
 798                 && !NT_STATUS_EQUAL(out.status, NT_STATUS_NO_MORE_ENTRIES)
 799                 && !NT_STATUS_EQUAL(out.status, STATUS_MORE_ENTRIES) )
 800         {
 801                 return out.status;
 802         }
 803
 804         /* Return output parameters */
 805
 806         *num_domains  = out.count;
 807         *enum_ctx     = out.enum_context;
 808
 809         if ( out.count ) {
 810
 811                 /* Allocate memory for trusted domain names and sids */
 812
 813                 if ( !(*domain_names = TALLOC_ARRAY(mem_ctx, char *, out.count)) ) {
 814                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
 815                         return NT_STATUS_NO_MEMORY;
 816                 }
 817
 818                 if ( !(*domain_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, out.count)) ) {
 819                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
 820                         return NT_STATUS_NO_MEMORY;
 821                 }
 822
 823                 /* Copy across names and sids */
 824
 825                 for (i = 0; i < out.count; i++) {
 826
 827                         rpcstr_pull( tmp, out.domlist->domains[i].name.string->buffer,
 828                                 sizeof(tmp), out.domlist->domains[i].name.length, 0);
 829                         (*domain_names)[i] = talloc_strdup(mem_ctx, tmp);
 830
 831                         sid_copy(&(*domain_sids)[i], &out.domlist->domains[i].sid->sid );
 832                 }
 833         }
 834
 835         return out.status;
 836 }
 837
 838 /** Enumerate privileges*/
 839
 840 NTSTATUS rpccli_lsa_enum_privilege(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 841                                 POLICY_HND *pol, uint32 *enum_context, uint32 pref_max_length,
 842                                 uint32 *count, char ***privs_name, uint32 **privs_high, uint32 **privs_low)
 843 {
 844         prs_struct qbuf, rbuf;
 845         LSA_Q_ENUM_PRIVS q;
 846         LSA_R_ENUM_PRIVS r;
 847         NTSTATUS result;
 848         int i;
 849
 850         ZERO_STRUCT(q);
 851         ZERO_STRUCT(r);
 852
 853         init_q_enum_privs(&q, pol, *enum_context, pref_max_length);
 854
 855         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_PRIVS,
 856                 q, r,
 857                 qbuf, rbuf,
 858                 lsa_io_q_enum_privs,
 859                 lsa_io_r_enum_privs,
 860                 NT_STATUS_UNSUCCESSFUL);
 861
 862         result = r.status;
 863
 864         if (!NT_STATUS_IS_OK(result)) {
 865                 goto done;
 866         }
 867
 868         /* Return output parameters */
 869
 870         *enum_context = r.enum_context;
 871         *count = r.count;
 872
 873         if (r.count) {
 874                 if (!((*privs_name = TALLOC_ARRAY(mem_ctx, char *, r.count)))) {
 875                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 876                         result = NT_STATUS_UNSUCCESSFUL;
 877                         goto done;
 878                 }
 879
 880                 if (!((*privs_high = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
 881                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 882                         result = NT_STATUS_UNSUCCESSFUL;
 883                         goto done;
 884                 }
 885
 886                 if (!((*privs_low = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
 887                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 888                         result = NT_STATUS_UNSUCCESSFUL;
 889                         goto done;
 890                 }
 891         } else {
 892                 *privs_name = NULL;
 893                 *privs_high = NULL;
 894                 *privs_low = NULL;
 895         }
 896
 897         for (i = 0; i < r.count; i++) {
 898                 fstring name;
 899
 900                 rpcstr_pull_unistr2_fstring( name, &r.privs[i].name);
 901
 902                 (*privs_name)[i] = talloc_strdup(mem_ctx, name);
 903
 904                 (*privs_high)[i] = r.privs[i].luid_high;
 905                 (*privs_low)[i] = r.privs[i].luid_low;
 906         }
 907
 908  done:
 909
 910         return result;
 911 }
 912
 913 /** Get privilege name */
 914
 915 NTSTATUS rpccli_lsa_get_dispname(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 916                               POLICY_HND *pol, const char *name,
 917                               uint16 lang_id, uint16 lang_id_sys,
 918                               fstring description, uint16 *lang_id_desc)
 919 {
 920         prs_struct qbuf, rbuf;
 921         LSA_Q_PRIV_GET_DISPNAME q;
 922         LSA_R_PRIV_GET_DISPNAME r;
 923         NTSTATUS result;
 924
 925         ZERO_STRUCT(q);
 926         ZERO_STRUCT(r);
 927
 928         init_lsa_priv_get_dispname(&q, pol, name, lang_id, lang_id_sys);
 929
 930         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_PRIV_GET_DISPNAME,
 931                 q, r,
 932                 qbuf, rbuf,
 933                 lsa_io_q_priv_get_dispname,
 934                 lsa_io_r_priv_get_dispname,
 935                 NT_STATUS_UNSUCCESSFUL);
 936
 937         result = r.status;
 938
 939         if (!NT_STATUS_IS_OK(result)) {
 940                 goto done;
 941         }
 942
 943         /* Return output parameters */
 944
 945         rpcstr_pull_unistr2_fstring(description , &r.desc);
 946         *lang_id_desc = r.lang_id;
 947
 948  done:
 949
 950         return result;
 951 }
 952
 953 /** Enumerate list of SIDs  */
 954
 955 NTSTATUS rpccli_lsa_enum_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 956                                 POLICY_HND *pol, uint32 *enum_ctx, uint32 pref_max_length,
 957                                 uint32 *num_sids, DOM_SID **sids)
 958 {
 959         prs_struct qbuf, rbuf;
 960         LSA_Q_ENUM_ACCOUNTS q;
 961         LSA_R_ENUM_ACCOUNTS r;
 962         NTSTATUS result;
 963         int i;
 964
 965         ZERO_STRUCT(q);
 966         ZERO_STRUCT(r);
 967
 968         init_lsa_q_enum_accounts(&q, pol, *enum_ctx, pref_max_length);
 969
 970         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_ACCOUNTS,
 971                 q, r,
 972                 qbuf, rbuf,
 973                 lsa_io_q_enum_accounts,
 974                 lsa_io_r_enum_accounts,
 975                 NT_STATUS_UNSUCCESSFUL);
 976
 977         result = r.status;
 978
 979         if (!NT_STATUS_IS_OK(result)) {
 980                 goto done;
 981         }
 982
 983         if (r.sids.num_entries==0)
 984                 goto done;
 985
 986         /* Return output parameters */
 987
 988         *sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.sids.num_entries);
 989         if (!*sids) {
 990                 DEBUG(0, ("(cli_lsa_enum_sids): out of memory\n"));
 991                 result = NT_STATUS_UNSUCCESSFUL;
 992                 goto done;
 993         }
 994
 995         /* Copy across names and sids */
 996
 997         for (i = 0; i < r.sids.num_entries; i++) {
 998                 sid_copy(&(*sids)[i], &r.sids.sid[i].sid);
 999         }
1000
1001         *num_sids= r.sids.num_entries;
1002         *enum_ctx = r.enum_context;
1003
1004  done:
1005
1006         return result;
1007 }
1008
1009 /** Create a LSA user handle
1010  *
1011  * @param cli Handle on an initialised SMB connection
1012  *
1013  * FIXME: The code is actually identical to open account
1014  * TODO: Check and code what the function should exactly do
1015  *
1016  * */
1017
1018 NTSTATUS rpccli_lsa_create_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1019                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 desired_access,
1020                              POLICY_HND *user_pol)
1021 {
1022         prs_struct qbuf, rbuf;
1023         LSA_Q_CREATEACCOUNT q;
1024         LSA_R_CREATEACCOUNT r;
1025         NTSTATUS result;
1026
1027         ZERO_STRUCT(q);
1028         ZERO_STRUCT(r);
1029
1030         /* Initialise input parameters */
1031
1032         init_lsa_q_create_account(&q, dom_pol, sid, desired_access);
1033
1034         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_CREATEACCOUNT,
1035                 q, r,
1036                 qbuf, rbuf,
1037                 lsa_io_q_create_account,
1038                 lsa_io_r_create_account,
1039                 NT_STATUS_UNSUCCESSFUL);
1040
1041         /* Return output parameters */
1042
1043         result = r.status;
1044
1045         if (NT_STATUS_IS_OK(result)) {
1046                 *user_pol = r.pol;
1047         }
1048
1049         return result;
1050 }
1051
1052 /** Open a LSA user handle
1053  *
1054  * @param cli Handle on an initialised SMB connection */
1055
1056 NTSTATUS rpccli_lsa_open_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1057                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 des_access,
1058                              POLICY_HND *user_pol)
1059 {
1060         prs_struct qbuf, rbuf;
1061         LSA_Q_OPENACCOUNT q;
1062         LSA_R_OPENACCOUNT r;
1063         NTSTATUS result;
1064
1065         ZERO_STRUCT(q);
1066         ZERO_STRUCT(r);
1067
1068         /* Initialise input parameters */
1069
1070         init_lsa_q_open_account(&q, dom_pol, sid, des_access);
1071
1072         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENACCOUNT,
1073                 q, r,
1074                 qbuf, rbuf,
1075                 lsa_io_q_open_account,
1076                 lsa_io_r_open_account,
1077                 NT_STATUS_UNSUCCESSFUL);
1078
1079         /* Return output parameters */
1080
1081         result = r.status;
1082
1083         if (NT_STATUS_IS_OK(result)) {
1084                 *user_pol = r.pol;
1085         }
1086
1087         return result;
1088 }
1089
1090 /** Enumerate user privileges
1091  *
1092  * @param cli Handle on an initialised SMB connection */
1093
1094 NTSTATUS rpccli_lsa_enum_privsaccount(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1095                              POLICY_HND *pol, uint32 *count, LUID_ATTR **set)
1096 {
1097         prs_struct qbuf, rbuf;
1098         LSA_Q_ENUMPRIVSACCOUNT q;
1099         LSA_R_ENUMPRIVSACCOUNT r;
1100         NTSTATUS result;
1101         int i;
1102
1103         ZERO_STRUCT(q);
1104         ZERO_STRUCT(r);
1105
1106         /* Initialise input parameters */
1107
1108         init_lsa_q_enum_privsaccount(&q, pol);
1109
1110         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMPRIVSACCOUNT,
1111                 q, r,
1112                 qbuf, rbuf,
1113                 lsa_io_q_enum_privsaccount,
1114                 lsa_io_r_enum_privsaccount,
1115                 NT_STATUS_UNSUCCESSFUL);
1116
1117         /* Return output parameters */
1118
1119         result = r.status;
1120
1121         if (!NT_STATUS_IS_OK(result)) {
1122                 goto done;
1123         }
1124
1125         if (r.count == 0)
1126                 goto done;
1127
1128         if (!((*set = TALLOC_ARRAY(mem_ctx, LUID_ATTR, r.count)))) {
1129                 DEBUG(0, ("(cli_lsa_enum_privsaccount): out of memory\n"));
1130                 result = NT_STATUS_UNSUCCESSFUL;
1131                 goto done;
1132         }
1133
1134         for (i=0; i<r.count; i++) {
1135                 (*set)[i].luid.low = r.set.set[i].luid.low;
1136                 (*set)[i].luid.high = r.set.set[i].luid.high;
1137                 (*set)[i].attr = r.set.set[i].attr;
1138         }
1139
1140         *count=r.count;
1141  done:
1142
1143         return result;
1144 }
1145
1146 /** Get a privilege value given its name */
1147
1148 NTSTATUS rpccli_lsa_lookup_priv_value(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1149                                  POLICY_HND *pol, const char *name, LUID *luid)
1150 {
1151         prs_struct qbuf, rbuf;
1152         LSA_Q_LOOKUP_PRIV_VALUE q;
1153         LSA_R_LOOKUP_PRIV_VALUE r;
1154         NTSTATUS result;
1155
1156         ZERO_STRUCT(q);
1157         ZERO_STRUCT(r);
1158
1159         /* Marshall data and send request */
1160
1161         init_lsa_q_lookup_priv_value(&q, pol, name);
1162
1163         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPPRIVVALUE,
1164                 q, r,
1165                 qbuf, rbuf,
1166                 lsa_io_q_lookup_priv_value,
1167                 lsa_io_r_lookup_priv_value,
1168                 NT_STATUS_UNSUCCESSFUL);
1169
1170         result = r.status;
1171
1172         if (!NT_STATUS_IS_OK(result)) {
1173                 goto done;
1174         }
1175
1176         /* Return output parameters */
1177
1178         (*luid).low=r.luid.low;
1179         (*luid).high=r.luid.high;
1180
1181  done:
1182
1183         return result;
1184 }
1185
1186 /** Query LSA security object */
1187
1188 NTSTATUS rpccli_lsa_query_secobj(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1189                               POLICY_HND *pol, uint32 sec_info,
1190                               SEC_DESC_BUF **psdb)
1191 {
1192         prs_struct qbuf, rbuf;
1193         LSA_Q_QUERY_SEC_OBJ q;
1194         LSA_R_QUERY_SEC_OBJ r;
1195         NTSTATUS result;
1196
1197         ZERO_STRUCT(q);
1198         ZERO_STRUCT(r);
1199
1200         /* Marshall data and send request */
1201
1202         init_q_query_sec_obj(&q, pol, sec_info);
1203
1204         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYSECOBJ,
1205                 q, r,
1206                 qbuf, rbuf,
1207                 lsa_io_q_query_sec_obj,
1208                 lsa_io_r_query_sec_obj,
1209                 NT_STATUS_UNSUCCESSFUL);
1210
1211         result = r.status;
1212
1213         if (!NT_STATUS_IS_OK(result)) {
1214                 goto done;
1215         }
1216
1217         /* Return output parameters */
1218
1219         if (psdb)
1220                 *psdb = r.buf;
1221
1222  done:
1223
1224         return result;
1225 }
1226
1227
1228 /* Enumerate account rights This is similar to enum_privileges but
1229    takes a SID directly, avoiding the open_account call.
1230 */
1231
1232 NTSTATUS rpccli_lsa_enum_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1233                                      POLICY_HND *pol, DOM_SID *sid,
1234                                      uint32 *count, char ***priv_names)
1235 {
1236         prs_struct qbuf, rbuf;
1237         LSA_Q_ENUM_ACCT_RIGHTS q;
1238         LSA_R_ENUM_ACCT_RIGHTS r;
1239         NTSTATUS result;
1240         int i;
1241         fstring *privileges;
1242         char **names;
1243
1244         ZERO_STRUCT(q);
1245         ZERO_STRUCT(r);
1246
1247         /* Marshall data and send request */
1248         init_q_enum_acct_rights(&q, pol, 2, sid);
1249
1250         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMACCTRIGHTS,
1251                 q, r,
1252                 qbuf, rbuf,
1253                 lsa_io_q_enum_acct_rights,
1254                 lsa_io_r_enum_acct_rights,
1255                 NT_STATUS_UNSUCCESSFUL);
1256
1257         result = r.status;
1258
1259         if (!NT_STATUS_IS_OK(result)) {
1260                 goto done;
1261         }
1262
1263         *count = r.count;
1264         if (! *count) {
1265                 goto done;
1266         }
1267
1268
1269         privileges = TALLOC_ARRAY( mem_ctx, fstring, *count );
1270         names      = TALLOC_ARRAY( mem_ctx, char *, *count );
1271
1272         if ((privileges == NULL) || (names == NULL)) {
1273                 TALLOC_FREE(privileges);
1274                 TALLOC_FREE(names);
1275                 return NT_STATUS_NO_MEMORY;
1276         }
1277
1278         for ( i=0; i<*count; i++ ) {
1279                 UNISTR4 *uni_string = &r.rights->strings[i];
1280
1281                 if ( !uni_string->string )
1282                         continue;
1283
1284                 rpcstr_pull( privileges[i], uni_string->string->buffer, sizeof(privileges[i]), -1, STR_TERMINATE );
1285
1286                 /* now copy to the return array */
1287                 names[i] = talloc_strdup( mem_ctx, privileges[i] );
1288         }
1289
1290         *priv_names = names;
1291
1292 done:
1293
1294         return result;
1295 }
1296
1297
1298
1299 /* add account rights to an account. */
1300
1301 NTSTATUS rpccli_lsa_add_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1302                                     POLICY_HND *pol, DOM_SID sid,
1303                                         uint32 count, const char **privs_name)
1304 {
1305         prs_struct qbuf, rbuf;
1306         LSA_Q_ADD_ACCT_RIGHTS q;
1307         LSA_R_ADD_ACCT_RIGHTS r;
1308         NTSTATUS result;
1309
1310         ZERO_STRUCT(q);
1311         ZERO_STRUCT(r);
1312
1313         /* Marshall data and send request */
1314         init_q_add_acct_rights(&q, pol, &sid, count, privs_name);
1315
1316         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ADDACCTRIGHTS,
1317                 q, r,
1318                 qbuf, rbuf,
1319                 lsa_io_q_add_acct_rights,
1320                 lsa_io_r_add_acct_rights,
1321                 NT_STATUS_UNSUCCESSFUL);
1322
1323         result = r.status;
1324
1325         if (!NT_STATUS_IS_OK(result)) {
1326                 goto done;
1327         }
1328 done:
1329
1330         return result;
1331 }
1332
1333
1334 /* remove account rights for an account. */
1335
1336 NTSTATUS rpccli_lsa_remove_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1337                                        POLICY_HND *pol, DOM_SID sid, BOOL removeall,
1338                                        uint32 count, const char **privs_name)
1339 {
1340         prs_struct qbuf, rbuf;
1341         LSA_Q_REMOVE_ACCT_RIGHTS q;
1342         LSA_R_REMOVE_ACCT_RIGHTS r;
1343         NTSTATUS result;
1344
1345         ZERO_STRUCT(q);
1346         ZERO_STRUCT(r);
1347
1348         /* Marshall data and send request */
1349         init_q_remove_acct_rights(&q, pol, &sid, removeall?1:0, count, privs_name);
1350
1351         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_REMOVEACCTRIGHTS,
1352                 q, r,
1353                 qbuf, rbuf,
1354                 lsa_io_q_remove_acct_rights,
1355                 lsa_io_r_remove_acct_rights,
1356                 NT_STATUS_UNSUCCESSFUL);
1357
1358         result = r.status;
1359
1360         if (!NT_STATUS_IS_OK(result)) {
1361                 goto done;
1362         }
1363 done:
1364
1365         return result;
1366 }
1367
1368
1369 #if 0
1370
1371 /** An example of how to use the routines in this file.  Fetch a DOMAIN
1372     sid. Does complete cli setup / teardown anonymously. */
1373
1374 BOOL fetch_domain_sid( char *domain, char *remote_machine, DOM_SID *psid)
1375 {
1376         extern pstring global_myname;
1377         struct cli_state *cli;
1378         NTSTATUS result;
1379         POLICY_HND lsa_pol;
1380         BOOL ret = False;
1381
1382         ZERO_STRUCT(cli);
1383         if((cli = cli_initialise()) == NULL) {
1384                 DEBUG(0,("fetch_domain_sid: unable to initialize client connection.\n"));
1385                 return False;
1386         }
1387
1388         if(!resolve_name( remote_machine, &cli->dest_ip, 0x20)) {
1389                 DEBUG(0,("fetch_domain_sid: Can't resolve address for %s\n", remote_machine));
1390                 goto done;
1391         }
1392
1393         if (!cli_connect(cli, remote_machine, &cli->dest_ip)) {
1394                 DEBUG(0,("fetch_domain_sid: unable to connect to SMB server on \
1395 machine %s. Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1396                 goto done;
1397         }
1398
1399         if (!attempt_netbios_session_request(cli, global_myname, remote_machine, &cli->dest_ip)) {
1400                 DEBUG(0,("fetch_domain_sid: machine %s rejected the NetBIOS session request.\n",
1401                         remote_machine));
1402                 goto done;
1403         }
1404
1405         cli->protocol = PROTOCOL_NT1;
1406
1407         if (!cli_negprot(cli)) {
1408                 DEBUG(0,("fetch_domain_sid: machine %s rejected the negotiate protocol. \
1409 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1410                 goto done;
1411         }
1412
1413         if (cli->protocol != PROTOCOL_NT1) {
1414                 DEBUG(0,("fetch_domain_sid: machine %s didn't negotiate NT protocol.\n",
1415                         remote_machine));
1416                 goto done;
1417         }
1418
1419         /*
1420          * Do an anonymous session setup.
1421          */
1422
1423         if (!cli_session_setup(cli, "", "", 0, "", 0, "")) {
1424                 DEBUG(0,("fetch_domain_sid: machine %s rejected the session setup. \
1425 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1426                 goto done;
1427         }
1428
1429         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
1430                 DEBUG(0,("fetch_domain_sid: machine %s isn't in user level security mode\n",
1431                         remote_machine));
1432                 goto done;
1433         }
1434
1435         if (!cli_send_tconX(cli, "IPC$", "IPC", "", 1)) {
1436                 DEBUG(0,("fetch_domain_sid: machine %s rejected the tconX on the IPC$ share. \
1437 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1438                 goto done;
1439         }
1440
1441         /* Fetch domain sid */
1442
1443         if (!cli_nt_session_open(cli, PI_LSARPC)) {
1444                 DEBUG(0, ("fetch_domain_sid: Error connecting to SAM pipe\n"));
1445                 goto done;
1446         }
1447
1448         result = cli_lsa_open_policy(cli, cli->mem_ctx, True, SEC_RIGHTS_QUERY_VALUE, &lsa_pol);
1449         if (!NT_STATUS_IS_OK(result)) {
1450                 DEBUG(0, ("fetch_domain_sid: Error opening lsa policy handle. %s\n",
1451                         nt_errstr(result) ));
1452                 goto done;
1453         }
1454
1455         result = cli_lsa_query_info_policy(cli, cli->mem_ctx, &lsa_pol, 5, domain, psid);
1456         if (!NT_STATUS_IS_OK(result)) {
1457                 DEBUG(0, ("fetch_domain_sid: Error querying lsa policy handle. %s\n",
1458                         nt_errstr(result) ));
1459                 goto done;
1460         }
1461
1462         ret = True;
1463
1464   done:
1465
1466         cli_shutdown(cli);
1467         return ret;
1468 }
1469
1470 #endif
1471
1472 NTSTATUS rpccli_lsa_open_trusted_domain(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1473                                      POLICY_HND *pol, DOM_SID *dom_sid, uint32 access_mask,
1474                                      POLICY_HND *trustdom_pol)
1475 {
1476         prs_struct qbuf, rbuf;
1477         LSA_Q_OPEN_TRUSTED_DOMAIN q;
1478         LSA_R_OPEN_TRUSTED_DOMAIN r;
1479         NTSTATUS result;
1480
1481         ZERO_STRUCT(q);
1482         ZERO_STRUCT(r);
1483
1484         /* Initialise input parameters */
1485
1486         init_lsa_q_open_trusted_domain(&q, pol, dom_sid, access_mask);
1487
1488         /* Marshall data and send request */
1489
1490         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOM,
1491                 q, r,
1492                 qbuf, rbuf,
1493                 lsa_io_q_open_trusted_domain,
1494                 lsa_io_r_open_trusted_domain,
1495                 NT_STATUS_UNSUCCESSFUL);
1496
1497         /* Return output parameters */
1498
1499         result = r.status;
1500
1501         if (NT_STATUS_IS_OK(result)) {
1502                 *trustdom_pol = r.handle;
1503         }
1504
1505         return result;
1506 }
1507
1508 NTSTATUS rpccli_lsa_query_trusted_domain_info(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1509                                            POLICY_HND *pol,
1510                                            uint16 info_class,
1511                                            LSA_TRUSTED_DOMAIN_INFO **info)
1512 {
1513         prs_struct qbuf, rbuf;
1514         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO q;
1515         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1516         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1517
1518         ZERO_STRUCT(q);
1519         ZERO_STRUCT(r);
1520
1521         /* Marshall data and send request */
1522
1523         init_q_query_trusted_domain_info(&q, pol, info_class);
1524
1525         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFO,
1526                 q, r,
1527                 qbuf, rbuf,
1528                 lsa_io_q_query_trusted_domain_info,
1529                 lsa_io_r_query_trusted_domain_info,
1530                 NT_STATUS_UNSUCCESSFUL);
1531
1532         result = r.status;
1533
1534         if (!NT_STATUS_IS_OK(result)) {
1535                 goto done;
1536         }
1537
1538         *info = r.info;
1539
1540 done:
1541         return result;
1542 }
1543
1544 NTSTATUS rpccli_lsa_open_trusted_domain_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1545                                                 POLICY_HND *pol, const char *name, uint32 access_mask,
1546                                                 POLICY_HND *trustdom_pol)
1547 {
1548         prs_struct qbuf, rbuf;
1549         LSA_Q_OPEN_TRUSTED_DOMAIN_BY_NAME q;
1550         LSA_R_OPEN_TRUSTED_DOMAIN_BY_NAME r;
1551         NTSTATUS result;
1552
1553         ZERO_STRUCT(q);
1554         ZERO_STRUCT(r);
1555
1556         /* Initialise input parameters */
1557
1558         init_lsa_q_open_trusted_domain_by_name(&q, pol, name, access_mask);
1559
1560         /* Marshall data and send request */
1561
1562         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOMBYNAME,
1563                 q, r,
1564                 qbuf, rbuf,
1565                 lsa_io_q_open_trusted_domain_by_name,
1566                 lsa_io_r_open_trusted_domain_by_name,
1567                 NT_STATUS_UNSUCCESSFUL);
1568
1569         /* Return output parameters */
1570
1571         result = r.status;
1572
1573         if (NT_STATUS_IS_OK(result)) {
1574                 *trustdom_pol = r.handle;
1575         }
1576
1577         return result;
1578 }
1579
1580
1581 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_sid(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1582                                                   POLICY_HND *pol,
1583                                                   uint16 info_class, DOM_SID *dom_sid,
1584                                                   LSA_TRUSTED_DOMAIN_INFO **info)
1585 {
1586         prs_struct qbuf, rbuf;
1587         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_SID q;
1588         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1589         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1590
1591         ZERO_STRUCT(q);
1592         ZERO_STRUCT(r);
1593
1594         /* Marshall data and send request */
1595
1596         init_q_query_trusted_domain_info_by_sid(&q, pol, info_class, dom_sid);
1597
1598         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYSID,
1599                 q, r,
1600                 qbuf, rbuf,
1601                 lsa_io_q_query_trusted_domain_info_by_sid,
1602                 lsa_io_r_query_trusted_domain_info,
1603                 NT_STATUS_UNSUCCESSFUL);
1604
1605         result = r.status;
1606
1607         if (!NT_STATUS_IS_OK(result)) {
1608                 goto done;
1609         }
1610
1611         *info = r.info;
1612
1613 done:
1614
1615         return result;
1616 }
1617
1618 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1619                                                    POLICY_HND *pol,
1620                                                    uint16 info_class, const char *domain_name,
1621                                                    LSA_TRUSTED_DOMAIN_INFO **info)
1622 {
1623         prs_struct qbuf, rbuf;
1624         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_NAME q;
1625         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1626         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1627
1628         ZERO_STRUCT(q);
1629         ZERO_STRUCT(r);
1630
1631         /* Marshall data and send request */
1632
1633         init_q_query_trusted_domain_info_by_name(&q, pol, info_class, domain_name);
1634
1635         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYNAME,
1636                 q, r,
1637                 qbuf, rbuf,
1638                 lsa_io_q_query_trusted_domain_info_by_name,
1639                 lsa_io_r_query_trusted_domain_info,
1640                 NT_STATUS_UNSUCCESSFUL);
1641
1642         result = r.status;
1643
1644         if (!NT_STATUS_IS_OK(result)) {
1645                 goto done;
1646         }
1647
1648         *info = r.info;
1649
1650 done:
1651
1652         return result;
1653 }
1654
1655 NTSTATUS cli_lsa_query_domain_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1656                                           POLICY_HND *pol,
1657                                           uint16 info_class, LSA_DOM_INFO_UNION **info)
1658 {
1659         prs_struct qbuf, rbuf;
1660         LSA_Q_QUERY_DOM_INFO_POLICY q;
1661         LSA_R_QUERY_DOM_INFO_POLICY r;
1662         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1663
1664         ZERO_STRUCT(q);
1665         ZERO_STRUCT(r);
1666
1667         /* Marshall data and send request */
1668
1669         init_q_query_dom_info(&q, pol, info_class);
1670
1671         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYDOMINFOPOL,
1672                 q, r,
1673                 qbuf, rbuf,
1674                 lsa_io_q_query_dom_info,
1675                 lsa_io_r_query_dom_info,
1676                 NT_STATUS_UNSUCCESSFUL);
1677
1678         result = r.status;
1679
1680         if (!NT_STATUS_IS_OK(result)) {
1681                 goto done;
1682         }
1683
1684         *info = r.info;
1685
1686 done:
1687         return result;
1688 }
1689