source/rpc_client/cli_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4    Copyright (C) Tim Potter                        2000-2001,
   5    Copyright (C) Andrew Tridgell              1992-1997,2000,
   6    Copyright (C) Rafal Szczesniak                       2002
   7    Copyright (C) Jeremy Allison                         2005.
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25
  26 /** @defgroup lsa LSA - Local Security Architecture
  27  *  @ingroup rpc_client
  28  *
  29  * @{
  30  **/
  31
  32 /**
  33  * @file cli_lsarpc.c
  34  *
  35  * RPC client routines for the LSA RPC pipe.  LSA means "local
  36  * security authority", which is half of a password database.
  37  **/
  38
  39 /** Open a LSA policy handle
  40  *
  41  * @param cli Handle on an initialised SMB connection */
  42
  43 NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
  44                                 TALLOC_CTX *mem_ctx,
  45                                 BOOL sec_qos, uint32 des_access,
  46                                 POLICY_HND *pol)
  47 {
  48         prs_struct qbuf, rbuf;
  49         LSA_Q_OPEN_POL q;
  50         LSA_R_OPEN_POL r;
  51         LSA_SEC_QOS qos;
  52         NTSTATUS result;
  53
  54         ZERO_STRUCT(q);
  55         ZERO_STRUCT(r);
  56
  57         /* Initialise input parameters */
  58
  59         if (sec_qos) {
  60                 init_lsa_sec_qos(&qos, 2, 1, 0);
  61                 init_q_open_pol(&q, '\\', 0, des_access, &qos);
  62         } else {
  63                 init_q_open_pol(&q, '\\', 0, des_access, NULL);
  64         }
  65
  66         /* Marshall data and send request */
  67
  68         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY,
  69                         q, r,
  70                         qbuf, rbuf,
  71                         lsa_io_q_open_pol,
  72                         lsa_io_r_open_pol,
  73                         NT_STATUS_UNSUCCESSFUL );
  74
  75         /* Return output parameters */
  76
  77         result = r.status;
  78
  79         if (NT_STATUS_IS_OK(result)) {
  80                 *pol = r.pol;
  81         }
  82
  83         return result;
  84 }
  85
  86 /** Open a LSA policy handle
  87   *
  88   * @param cli Handle on an initialised SMB connection
  89   */
  90
  91 NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
  92                                  TALLOC_CTX *mem_ctx, BOOL sec_qos,
  93                                  uint32 des_access, POLICY_HND *pol)
  94 {
  95         prs_struct qbuf, rbuf;
  96         LSA_Q_OPEN_POL2 q;
  97         LSA_R_OPEN_POL2 r;
  98         LSA_SEC_QOS qos;
  99         NTSTATUS result;
 100         char *srv_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", cli->cli->desthost);
 101
 102         ZERO_STRUCT(q);
 103         ZERO_STRUCT(r);
 104
 105         if (sec_qos) {
 106                 init_lsa_sec_qos(&qos, 2, 1, 0);
 107                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, &qos);
 108         } else {
 109                 init_q_open_pol2(&q, srv_name_slash, 0, des_access, NULL);
 110         }
 111
 112         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENPOLICY2,
 113                         q, r,
 114                         qbuf, rbuf,
 115                         lsa_io_q_open_pol2,
 116                         lsa_io_r_open_pol2,
 117                         NT_STATUS_UNSUCCESSFUL );
 118
 119         /* Return output parameters */
 120
 121         result = r.status;
 122
 123         if (NT_STATUS_IS_OK(result)) {
 124                 *pol = r.pol;
 125         }
 126
 127         return result;
 128 }
 129
 130 /* Lookup a list of sids
 131  *
 132  * internal version withOUT memory allocation of the target arrays.
 133  * this assumes suffciently sized arrays to store domains, names and types. */
 134
 135 static NTSTATUS rpccli_lsa_lookup_sids_noalloc(struct rpc_pipe_client *cli,
 136                                                TALLOC_CTX *mem_ctx,
 137                                                POLICY_HND *pol,
 138                                                int num_sids,
 139                                                const DOM_SID *sids,
 140                                                char **domains,
 141                                                char **names,
 142                                                enum lsa_SidType *types)
 143 {
 144         prs_struct qbuf, rbuf;
 145         LSA_Q_LOOKUP_SIDS q;
 146         LSA_R_LOOKUP_SIDS r;
 147         DOM_R_REF ref;
 148         NTSTATUS result = NT_STATUS_OK;
 149         TALLOC_CTX *tmp_ctx = NULL;
 150         int i;
 151
 152         tmp_ctx = talloc_new(mem_ctx);
 153         if (!tmp_ctx) {
 154                 DEBUG(0, ("rpccli_lsa_lookup_sids_noalloc: out of memory!\n"));
 155                 result = NT_STATUS_UNSUCCESSFUL;
 156                 goto done;
 157         }
 158
 159         ZERO_STRUCT(q);
 160         ZERO_STRUCT(r);
 161
 162         init_q_lookup_sids(tmp_ctx, &q, pol, num_sids, sids, 1);
 163
 164         ZERO_STRUCT(ref);
 165
 166         r.dom_ref = &ref;
 167
 168         CLI_DO_RPC( cli, tmp_ctx, PI_LSARPC, LSA_LOOKUPSIDS,
 169                         q, r,
 170                         qbuf, rbuf,
 171                         lsa_io_q_lookup_sids,
 172                         lsa_io_r_lookup_sids,
 173                         NT_STATUS_UNSUCCESSFUL );
 174
 175         if (!NT_STATUS_IS_OK(r.status) &&
 176             !NT_STATUS_EQUAL(r.status, STATUS_SOME_UNMAPPED))
 177         {
 178                 /* An actual error occured */
 179                 result = r.status;
 180                 goto done;
 181         }
 182
 183         /* Return output parameters */
 184
 185         if (r.mapped_count == 0) {
 186                 result = NT_STATUS_NONE_MAPPED;
 187                 goto done;
 188         }
 189
 190         for (i = 0; i < num_sids; i++) {
 191                 fstring name, dom_name;
 192                 uint32 dom_idx = r.names.name[i].domain_idx;
 193
 194                 /* Translate optimised name through domain index array */
 195
 196                 if (dom_idx != 0xffffffff) {
 197
 198                         rpcstr_pull_unistr2_fstring(
 199                                 dom_name, &ref.ref_dom[dom_idx].uni_dom_name);
 200                         rpcstr_pull_unistr2_fstring(
 201                                 name, &r.names.uni_name[i]);
 202
 203                         (names)[i] = talloc_strdup(mem_ctx, name);
 204                         (domains)[i] = talloc_strdup(mem_ctx, dom_name);
 205                         (types)[i] = (enum lsa_SidType)r.names.name[i].sid_name_use;
 206
 207                         if (((names)[i] == NULL) || ((domains)[i] == NULL)) {
 208                                 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
 209                                 result = NT_STATUS_UNSUCCESSFUL;
 210                                 goto done;
 211                         }
 212
 213                 } else {
 214                         (names)[i] = NULL;
 215                         (domains)[i] = NULL;
 216                         (types)[i] = SID_NAME_UNKNOWN;
 217                 }
 218         }
 219
 220 done:
 221         TALLOC_FREE(tmp_ctx);
 222         return result;
 223 }
 224
 225 /* Lookup a list of sids
 226  *
 227  * do it the right way: there is a limit (of 20480 for w2k3) entries
 228  * returned by this call. when the sids list contains more entries,
 229  * empty lists are returned. This version of lsa_lookup_sids passes
 230  * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
 231
 232 /* This constant defines the limit of how many sids to look up
 233  * in one call (maximum). the limit from the server side is
 234  * at 20480 for win2k3, but we keep it at a save 1000 for now. */
 235 #define LOOKUP_SIDS_HUNK_SIZE 1000
 236
 237 NTSTATUS rpccli_lsa_lookup_sids_all(struct rpc_pipe_client *cli,
 238                                     TALLOC_CTX *mem_ctx,
 239                                     POLICY_HND *pol,
 240                                     int num_sids,
 241                                     const DOM_SID *sids,
 242                                     char ***domains,
 243                                     char ***names,
 244                                     enum lsa_SidType **types)
 245 {
 246         NTSTATUS result = NT_STATUS_OK;
 247         int sids_left = 0;
 248         int sids_processed = 0;
 249         const DOM_SID *hunk_sids = sids;
 250         char **hunk_domains = NULL;
 251         char **hunk_names = NULL;
 252         enum lsa_SidType *hunk_types = NULL;
 253
 254         if (num_sids) {
 255                 if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 256                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
 257                         result = NT_STATUS_NO_MEMORY;
 258                         goto done;
 259                 }
 260
 261                 if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 262                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
 263                         result = NT_STATUS_NO_MEMORY;
 264                         goto done;
 265                 }
 266
 267                 if (!((*types) = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
 268                         DEBUG(0, ("rpccli_lsa_lookup_sids_all(): out of memory\n"));
 269                         result = NT_STATUS_NO_MEMORY;
 270                         goto done;
 271                 }
 272         } else {
 273                 (*domains) = NULL;
 274                 (*names) = NULL;
 275                 (*types) = NULL;
 276         }
 277
 278         sids_left = num_sids;
 279         hunk_domains = *domains;
 280         hunk_names = *names;
 281         hunk_types = *types;
 282
 283         while (sids_left > 0) {
 284                 int hunk_num_sids;
 285                 NTSTATUS hunk_result = NT_STATUS_OK;
 286
 287                 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
 288                                 ? LOOKUP_SIDS_HUNK_SIZE
 289                                 : sids_left);
 290
 291                 DEBUG(10, ("rpccli_lsa_lookup_sids_all: processing items "
 292                            "%d -- %d of %d.\n",
 293                            sids_processed,
 294                            sids_processed + hunk_num_sids - 1,
 295                            num_sids));
 296
 297                 hunk_result = rpccli_lsa_lookup_sids_noalloc(cli,
 298                                                              mem_ctx,
 299                                                              pol,
 300                                                              hunk_num_sids,
 301                                                              hunk_sids,
 302                                                              hunk_domains,
 303                                                              hunk_names,
 304                                                              hunk_types);
 305
 306                 if (!NT_STATUS_IS_OK(hunk_result) &&
 307                     !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
 308                     !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED))
 309                 {
 310                         /* An actual error occured */
 311                         goto done;
 312                 }
 313
 314                 /* adapt overall result */
 315                 if (( NT_STATUS_IS_OK(result) &&
 316                      !NT_STATUS_IS_OK(hunk_result))
 317                     ||
 318                     ( NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
 319                      !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)))
 320                 {
 321                         result = STATUS_SOME_UNMAPPED;
 322                 }
 323
 324                 sids_left -= hunk_num_sids;
 325                 sids_processed += hunk_num_sids; /* only used in DEBUG */
 326                 hunk_sids += hunk_num_sids;
 327                 hunk_domains += hunk_num_sids;
 328                 hunk_names += hunk_num_sids;
 329                 hunk_types += hunk_num_sids;
 330         }
 331
 332 done:
 333         return result;
 334 }
 335
 336 /** Lookup a list of sids */
 337
 338 NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
 339                                 TALLOC_CTX *mem_ctx,
 340                                 POLICY_HND *pol, int num_sids,
 341                                 const DOM_SID *sids,
 342                                 char ***domains,
 343                                 char ***names,
 344                                 enum lsa_SidType **types)
 345 {
 346         prs_struct qbuf, rbuf;
 347         LSA_Q_LOOKUP_SIDS q;
 348         LSA_R_LOOKUP_SIDS r;
 349         DOM_R_REF ref;
 350         NTSTATUS result = NT_STATUS_OK;
 351         int i;
 352
 353         ZERO_STRUCT(q);
 354         ZERO_STRUCT(r);
 355
 356         init_q_lookup_sids(mem_ctx, &q, pol, num_sids, sids, 1);
 357
 358         ZERO_STRUCT(ref);
 359
 360         r.dom_ref = &ref;
 361
 362         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPSIDS,
 363                         q, r,
 364                         qbuf, rbuf,
 365                         lsa_io_q_lookup_sids,
 366                         lsa_io_r_lookup_sids,
 367                         NT_STATUS_UNSUCCESSFUL );
 368
 369         if (!NT_STATUS_IS_OK(r.status) &&
 370             !NT_STATUS_EQUAL(r.status, STATUS_SOME_UNMAPPED)) {
 371
 372                 /* An actual error occured */
 373                 result = r.status;
 374
 375                 goto done;
 376         }
 377
 378         /* Return output parameters */
 379
 380         if (r.mapped_count == 0) {
 381                 result = NT_STATUS_NONE_MAPPED;
 382                 goto done;
 383         }
 384
 385         if (num_sids) {
 386                 if (!((*domains) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 387                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 388                         result = NT_STATUS_NO_MEMORY;
 389                         goto done;
 390                 }
 391
 392                 if (!((*names) = TALLOC_ARRAY(mem_ctx, char *, num_sids))) {
 393                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 394                         result = NT_STATUS_NO_MEMORY;
 395                         goto done;
 396                 }
 397
 398                 if (!((*types) = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_sids))) {
 399                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 400                         result = NT_STATUS_NO_MEMORY;
 401                         goto done;
 402                 }
 403         } else {
 404                 (*domains) = NULL;
 405                 (*names) = NULL;
 406                 (*types) = NULL;
 407         }
 408
 409         for (i = 0; i < num_sids; i++) {
 410                 fstring name, dom_name;
 411                 uint32 dom_idx = r.names.name[i].domain_idx;
 412
 413                 /* Translate optimised name through domain index array */
 414
 415                 if (dom_idx != 0xffffffff) {
 416
 417                         rpcstr_pull_unistr2_fstring(
 418                                 dom_name, &ref.ref_dom[dom_idx].uni_dom_name);
 419                         rpcstr_pull_unistr2_fstring(
 420                                 name, &r.names.uni_name[i]);
 421
 422                         (*names)[i] = talloc_strdup(mem_ctx, name);
 423                         (*domains)[i] = talloc_strdup(mem_ctx, dom_name);
 424                         (*types)[i] = (enum lsa_SidType)r.names.name[i].sid_name_use;
 425
 426                         if (((*names)[i] == NULL) || ((*domains)[i] == NULL)) {
 427                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 428                                 result = NT_STATUS_UNSUCCESSFUL;
 429                                 goto done;
 430                         }
 431
 432                 } else {
 433                         (*names)[i] = NULL;
 434                         (*domains)[i] = NULL;
 435                         (*types)[i] = SID_NAME_UNKNOWN;
 436                 }
 437         }
 438
 439  done:
 440
 441         return result;
 442 }
 443
 444 /** Lookup a list of names */
 445
 446 NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
 447                                  TALLOC_CTX *mem_ctx,
 448                                  POLICY_HND *pol, int num_names,
 449                                  const char **names,
 450                                  const char ***dom_names,
 451                                  DOM_SID **sids,
 452                                  enum lsa_SidType **types)
 453 {
 454         prs_struct qbuf, rbuf;
 455         LSA_Q_LOOKUP_NAMES q;
 456         LSA_R_LOOKUP_NAMES r;
 457         DOM_R_REF ref;
 458         NTSTATUS result;
 459         int i;
 460
 461         ZERO_STRUCT(q);
 462         ZERO_STRUCT(r);
 463
 464         ZERO_STRUCT(ref);
 465         r.dom_ref = &ref;
 466
 467         init_q_lookup_names(mem_ctx, &q, pol, num_names, names);
 468
 469         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPNAMES,
 470                         q, r,
 471                         qbuf, rbuf,
 472                         lsa_io_q_lookup_names,
 473                         lsa_io_r_lookup_names,
 474                         NT_STATUS_UNSUCCESSFUL);
 475
 476         result = r.status;
 477
 478         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 479             NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
 480
 481                 /* An actual error occured */
 482
 483                 goto done;
 484         }
 485
 486         /* Return output parameters */
 487
 488         if (r.mapped_count == 0) {
 489                 result = NT_STATUS_NONE_MAPPED;
 490                 goto done;
 491         }
 492
 493         if (num_names) {
 494                 if (!((*sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_names)))) {
 495                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 496                         result = NT_STATUS_NO_MEMORY;
 497                         goto done;
 498                 }
 499
 500                 if (!((*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_names)))) {
 501                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 502                         result = NT_STATUS_NO_MEMORY;
 503                         goto done;
 504                 }
 505
 506                 if (dom_names != NULL) {
 507                         *dom_names = TALLOC_ARRAY(mem_ctx, const char *, num_names);
 508                         if (*dom_names == NULL) {
 509                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 510                                 result = NT_STATUS_NO_MEMORY;
 511                                 goto done;
 512                         }
 513                 }
 514         } else {
 515                 *sids = NULL;
 516                 *types = NULL;
 517                 if (dom_names != NULL) {
 518                         *dom_names = NULL;
 519                 }
 520         }
 521
 522         for (i = 0; i < num_names; i++) {
 523                 DOM_RID *t_rids = r.dom_rid;
 524                 uint32 dom_idx = t_rids[i].rid_idx;
 525                 uint32 dom_rid = t_rids[i].rid;
 526                 DOM_SID *sid = &(*sids)[i];
 527
 528                 /* Translate optimised sid through domain index array */
 529
 530                 if (dom_idx == 0xffffffff) {
 531                         /* Nothing to do, this is unknown */
 532                         ZERO_STRUCTP(sid);
 533                         (*types)[i] = SID_NAME_UNKNOWN;
 534                         continue;
 535                 }
 536
 537                 sid_copy(sid, &ref.ref_dom[dom_idx].ref_dom.sid);
 538
 539                 if (dom_rid != 0xffffffff) {
 540                         sid_append_rid(sid, dom_rid);
 541                 }
 542
 543                 (*types)[i] = (enum lsa_SidType)t_rids[i].type;
 544
 545                 if (dom_names == NULL) {
 546                         continue;
 547                 }
 548
 549                 (*dom_names)[i] = rpcstr_pull_unistr2_talloc(
 550                         *dom_names, &ref.ref_dom[dom_idx].uni_dom_name);
 551         }
 552
 553  done:
 554
 555         return result;
 556 }
 557
 558 NTSTATUS rpccli_lsa_query_info_policy_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 559                                           POLICY_HND *pol, uint16 info_class,
 560                                           LSA_INFO_CTR *ctr)
 561 {
 562         prs_struct qbuf, rbuf;
 563         LSA_Q_QUERY_INFO q;
 564         LSA_R_QUERY_INFO r;
 565         NTSTATUS result;
 566
 567         ZERO_STRUCT(q);
 568         ZERO_STRUCT(r);
 569
 570         init_q_query(&q, pol, info_class);
 571
 572         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
 573                 q, r,
 574                 qbuf, rbuf,
 575                 lsa_io_q_query,
 576                 lsa_io_r_query,
 577                 NT_STATUS_UNSUCCESSFUL);
 578
 579         result = r.status;
 580
 581         if (!NT_STATUS_IS_OK(result)) {
 582                 goto done;
 583         }
 584
 585  done:
 586
 587         *ctr = r.ctr;
 588
 589         return result;
 590 }
 591
 592 NTSTATUS rpccli_lsa_query_info_policy2_new(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 593                                           POLICY_HND *pol, uint16 info_class,
 594                                           LSA_INFO_CTR2 *ctr)
 595 {
 596         prs_struct qbuf, rbuf;
 597         LSA_Q_QUERY_INFO2 q;
 598         LSA_R_QUERY_INFO2 r;
 599         NTSTATUS result;
 600
 601         ZERO_STRUCT(q);
 602         ZERO_STRUCT(r);
 603
 604         init_q_query2(&q, pol, info_class);
 605
 606         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
 607                 q, r,
 608                 qbuf, rbuf,
 609                 lsa_io_q_query_info2,
 610                 lsa_io_r_query_info2,
 611                 NT_STATUS_UNSUCCESSFUL);
 612
 613         result = r.status;
 614
 615         if (!NT_STATUS_IS_OK(result)) {
 616                 goto done;
 617         }
 618
 619  done:
 620
 621         *ctr = r.ctr;
 622
 623         return result;
 624 }
 625
 626
 627
 628 /** Query info policy
 629  *
 630  *  @param domain_sid - returned remote server's domain sid */
 631
 632 NTSTATUS rpccli_lsa_query_info_policy(struct rpc_pipe_client *cli,
 633                                       TALLOC_CTX *mem_ctx,
 634                                       POLICY_HND *pol, uint16 info_class,
 635                                       char **domain_name, DOM_SID **domain_sid)
 636 {
 637         prs_struct qbuf, rbuf;
 638         LSA_Q_QUERY_INFO q;
 639         LSA_R_QUERY_INFO r;
 640         NTSTATUS result;
 641
 642         ZERO_STRUCT(q);
 643         ZERO_STRUCT(r);
 644
 645         init_q_query(&q, pol, info_class);
 646
 647         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_QUERYINFOPOLICY,
 648                 q, r,
 649                 qbuf, rbuf,
 650                 lsa_io_q_query,
 651                 lsa_io_r_query,
 652                 NT_STATUS_UNSUCCESSFUL);
 653
 654         result = r.status;
 655
 656         if (!NT_STATUS_IS_OK(result)) {
 657                 goto done;
 658         }
 659
 660         /* Return output parameters */
 661
 662         switch (info_class) {
 663
 664         case 3:
 665                 if (domain_name && (r.ctr.info.id3.buffer_dom_name != 0)) {
 666                         *domain_name = unistr2_tdup(mem_ctx,
 667                                                    &r.ctr.info.id3.
 668                                                    uni_domain_name);
 669                         if (!*domain_name) {
 670                                 return NT_STATUS_NO_MEMORY;
 671                         }
 672                 }
 673
 674                 if (domain_sid && (r.ctr.info.id3.buffer_dom_sid != 0)) {
 675                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 676                         if (!*domain_sid) {
 677                                 return NT_STATUS_NO_MEMORY;
 678                         }
 679                         sid_copy(*domain_sid, &r.ctr.info.id3.dom_sid.sid);
 680                 }
 681
 682                 break;
 683
 684         case 5:
 685
 686                 if (domain_name && (r.ctr.info.id5.buffer_dom_name != 0)) {
 687                         *domain_name = unistr2_tdup(mem_ctx,
 688                                                    &r.ctr.info.id5.
 689                                                    uni_domain_name);
 690                         if (!*domain_name) {
 691                                 return NT_STATUS_NO_MEMORY;
 692                         }
 693                 }
 694
 695                 if (domain_sid && (r.ctr.info.id5.buffer_dom_sid != 0)) {
 696                         *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 697                         if (!*domain_sid) {
 698                                 return NT_STATUS_NO_MEMORY;
 699                         }
 700                         sid_copy(*domain_sid, &r.ctr.info.id5.dom_sid.sid);
 701                 }
 702                 break;
 703
 704         default:
 705                 DEBUG(3, ("unknown info class %d\n", info_class));
 706                 break;
 707         }
 708
 709  done:
 710
 711         return result;
 712 }
 713
 714 /** Query info policy2
 715  *
 716  *  @param domain_name - returned remote server's domain name
 717  *  @param dns_name - returned remote server's dns domain name
 718  *  @param forest_name - returned remote server's forest name
 719  *  @param domain_guid - returned remote server's domain guid
 720  *  @param domain_sid - returned remote server's domain sid */
 721
 722 NTSTATUS rpccli_lsa_query_info_policy2(struct rpc_pipe_client *cli,
 723                                        TALLOC_CTX *mem_ctx,
 724                                        POLICY_HND *pol, uint16 info_class,
 725                                        char **domain_name, char **dns_name,
 726                                        char **forest_name,
 727                                        struct GUID **domain_guid,
 728                                        DOM_SID **domain_sid)
 729 {
 730         prs_struct qbuf, rbuf;
 731         LSA_Q_QUERY_INFO2 q;
 732         LSA_R_QUERY_INFO2 r;
 733         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 734
 735         if (info_class != 12)
 736                 goto done;
 737
 738         ZERO_STRUCT(q);
 739         ZERO_STRUCT(r);
 740
 741         init_q_query2(&q, pol, info_class);
 742
 743         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYINFO2,
 744                 q, r,
 745                 qbuf, rbuf,
 746                 lsa_io_q_query_info2,
 747                 lsa_io_r_query_info2,
 748                 NT_STATUS_UNSUCCESSFUL);
 749
 750         result = r.status;
 751
 752         if (!NT_STATUS_IS_OK(result)) {
 753                 goto done;
 754         }
 755
 756         /* Return output parameters */
 757
 758         ZERO_STRUCTP(domain_guid);
 759
 760         if (domain_name && r.ctr.info.id12.hdr_nb_dom_name.buffer) {
 761                 *domain_name = unistr2_tdup(mem_ctx,
 762                                             &r.ctr.info.id12
 763                                             .uni_nb_dom_name);
 764                 if (!*domain_name) {
 765                         return NT_STATUS_NO_MEMORY;
 766                 }
 767         }
 768         if (dns_name && r.ctr.info.id12.hdr_dns_dom_name.buffer) {
 769                 *dns_name = unistr2_tdup(mem_ctx,
 770                                          &r.ctr.info.id12
 771                                          .uni_dns_dom_name);
 772                 if (!*dns_name) {
 773                         return NT_STATUS_NO_MEMORY;
 774                 }
 775         }
 776         if (forest_name && r.ctr.info.id12.hdr_forest_name.buffer) {
 777                 *forest_name = unistr2_tdup(mem_ctx,
 778                                             &r.ctr.info.id12
 779                                             .uni_forest_name);
 780                 if (!*forest_name) {
 781                         return NT_STATUS_NO_MEMORY;
 782                 }
 783         }
 784
 785         if (domain_guid) {
 786                 *domain_guid = TALLOC_P(mem_ctx, struct GUID);
 787                 if (!*domain_guid) {
 788                         return NT_STATUS_NO_MEMORY;
 789                 }
 790                 memcpy(*domain_guid,
 791                        &r.ctr.info.id12.dom_guid,
 792                        sizeof(struct GUID));
 793         }
 794
 795         if (domain_sid && r.ctr.info.id12.ptr_dom_sid != 0) {
 796                 *domain_sid = TALLOC_P(mem_ctx, DOM_SID);
 797                 if (!*domain_sid) {
 798                         return NT_STATUS_NO_MEMORY;
 799                 }
 800                 sid_copy(*domain_sid,
 801                          &r.ctr.info.id12.dom_sid.sid);
 802         }
 803
 804  done:
 805
 806         return result;
 807 }
 808
 809 NTSTATUS rpccli_lsa_set_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 810                                     POLICY_HND *pol, uint16 info_class,
 811                                     LSA_INFO_CTR ctr)
 812 {
 813         prs_struct qbuf, rbuf;
 814         LSA_Q_SET_INFO q;
 815         LSA_R_SET_INFO r;
 816         NTSTATUS result;
 817
 818         ZERO_STRUCT(q);
 819         ZERO_STRUCT(r);
 820
 821         init_q_set(&q, pol, info_class, ctr);
 822
 823         CLI_DO_RPC(cli, mem_ctx, PI_LSARPC, LSA_SETINFOPOLICY,
 824                 q, r,
 825                 qbuf, rbuf,
 826                 lsa_io_q_set,
 827                 lsa_io_r_set,
 828                 NT_STATUS_UNSUCCESSFUL);
 829
 830         result = r.status;
 831
 832         if (!NT_STATUS_IS_OK(result)) {
 833                 goto done;
 834         }
 835
 836         /* Return output parameters */
 837
 838  done:
 839
 840         return result;
 841 }
 842
 843
 844 /**
 845  * Enumerate list of trusted domains
 846  *
 847  * @param cli client state (cli_state) structure of the connection
 848  * @param mem_ctx memory context
 849  * @param pol opened lsa policy handle
 850  * @param enum_ctx enumeration context ie. index of first returned domain entry
 851  * @param pref_num_domains preferred max number of entries returned in one response
 852  * @param num_domains total number of trusted domains returned by response
 853  * @param domain_names returned trusted domain names
 854  * @param domain_sids returned trusted domain sids
 855  *
 856  * @return nt status code of response
 857  **/
 858
 859 NTSTATUS rpccli_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
 860                                    TALLOC_CTX *mem_ctx,
 861                                    POLICY_HND *pol, uint32 *enum_ctx,
 862                                    uint32 *num_domains,
 863                                    char ***domain_names, DOM_SID **domain_sids)
 864 {
 865         prs_struct qbuf, rbuf;
 866         LSA_Q_ENUM_TRUST_DOM in;
 867         LSA_R_ENUM_TRUST_DOM out;
 868         int i;
 869         fstring tmp;
 870
 871         ZERO_STRUCT(in);
 872         ZERO_STRUCT(out);
 873
 874         /* 64k is enough for about 2000 trusted domains */
 875
 876         init_q_enum_trust_dom(&in, pol, *enum_ctx, 0x10000);
 877
 878         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMTRUSTDOM,
 879                     in, out,
 880                     qbuf, rbuf,
 881                     lsa_io_q_enum_trust_dom,
 882                     lsa_io_r_enum_trust_dom,
 883                     NT_STATUS_UNSUCCESSFUL );
 884
 885
 886         /* check for an actual error */
 887
 888         if ( !NT_STATUS_IS_OK(out.status)
 889                 && !NT_STATUS_EQUAL(out.status, NT_STATUS_NO_MORE_ENTRIES)
 890                 && !NT_STATUS_EQUAL(out.status, STATUS_MORE_ENTRIES) )
 891         {
 892                 return out.status;
 893         }
 894
 895         /* Return output parameters */
 896
 897         *num_domains  = out.count;
 898         *enum_ctx     = out.enum_context;
 899
 900         if ( out.count ) {
 901
 902                 /* Allocate memory for trusted domain names and sids */
 903
 904                 if ( !(*domain_names = TALLOC_ARRAY(mem_ctx, char *, out.count)) ) {
 905                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
 906                         return NT_STATUS_NO_MEMORY;
 907                 }
 908
 909                 if ( !(*domain_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, out.count)) ) {
 910                         DEBUG(0, ("cli_lsa_enum_trust_dom(): out of memory\n"));
 911                         return NT_STATUS_NO_MEMORY;
 912                 }
 913
 914                 /* Copy across names and sids */
 915
 916                 for (i = 0; i < out.count; i++) {
 917
 918                         rpcstr_pull( tmp, out.domlist->domains[i].name.string->buffer,
 919                                 sizeof(tmp), out.domlist->domains[i].name.length, 0);
 920                         (*domain_names)[i] = talloc_strdup(mem_ctx, tmp);
 921
 922                         sid_copy(&(*domain_sids)[i], &out.domlist->domains[i].sid->sid );
 923                 }
 924         }
 925
 926         return out.status;
 927 }
 928
 929 /** Enumerate privileges*/
 930
 931 NTSTATUS rpccli_lsa_enum_privilege(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 932                                 POLICY_HND *pol, uint32 *enum_context, uint32 pref_max_length,
 933                                 uint32 *count, char ***privs_name, uint32 **privs_high, uint32 **privs_low)
 934 {
 935         prs_struct qbuf, rbuf;
 936         LSA_Q_ENUM_PRIVS q;
 937         LSA_R_ENUM_PRIVS r;
 938         NTSTATUS result;
 939         int i;
 940
 941         ZERO_STRUCT(q);
 942         ZERO_STRUCT(r);
 943
 944         init_q_enum_privs(&q, pol, *enum_context, pref_max_length);
 945
 946         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_PRIVS,
 947                 q, r,
 948                 qbuf, rbuf,
 949                 lsa_io_q_enum_privs,
 950                 lsa_io_r_enum_privs,
 951                 NT_STATUS_UNSUCCESSFUL);
 952
 953         result = r.status;
 954
 955         if (!NT_STATUS_IS_OK(result)) {
 956                 goto done;
 957         }
 958
 959         /* Return output parameters */
 960
 961         *enum_context = r.enum_context;
 962         *count = r.count;
 963
 964         if (r.count) {
 965                 if (!((*privs_name = TALLOC_ARRAY(mem_ctx, char *, r.count)))) {
 966                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 967                         result = NT_STATUS_UNSUCCESSFUL;
 968                         goto done;
 969                 }
 970
 971                 if (!((*privs_high = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
 972                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 973                         result = NT_STATUS_UNSUCCESSFUL;
 974                         goto done;
 975                 }
 976
 977                 if (!((*privs_low = TALLOC_ARRAY(mem_ctx, uint32, r.count)))) {
 978                         DEBUG(0, ("(cli_lsa_enum_privilege): out of memory\n"));
 979                         result = NT_STATUS_UNSUCCESSFUL;
 980                         goto done;
 981                 }
 982         } else {
 983                 *privs_name = NULL;
 984                 *privs_high = NULL;
 985                 *privs_low = NULL;
 986         }
 987
 988         for (i = 0; i < r.count; i++) {
 989                 fstring name;
 990
 991                 rpcstr_pull_unistr2_fstring( name, &r.privs[i].name);
 992
 993                 (*privs_name)[i] = talloc_strdup(mem_ctx, name);
 994
 995                 (*privs_high)[i] = r.privs[i].luid_high;
 996                 (*privs_low)[i] = r.privs[i].luid_low;
 997         }
 998
 999  done:
1000
1001         return result;
1002 }
1003
1004 /** Get privilege name */
1005
1006 NTSTATUS rpccli_lsa_get_dispname(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1007                               POLICY_HND *pol, const char *name,
1008                               uint16 lang_id, uint16 lang_id_sys,
1009                               fstring description, uint16 *lang_id_desc)
1010 {
1011         prs_struct qbuf, rbuf;
1012         LSA_Q_PRIV_GET_DISPNAME q;
1013         LSA_R_PRIV_GET_DISPNAME r;
1014         NTSTATUS result;
1015
1016         ZERO_STRUCT(q);
1017         ZERO_STRUCT(r);
1018
1019         init_lsa_priv_get_dispname(&q, pol, name, lang_id, lang_id_sys);
1020
1021         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_PRIV_GET_DISPNAME,
1022                 q, r,
1023                 qbuf, rbuf,
1024                 lsa_io_q_priv_get_dispname,
1025                 lsa_io_r_priv_get_dispname,
1026                 NT_STATUS_UNSUCCESSFUL);
1027
1028         result = r.status;
1029
1030         if (!NT_STATUS_IS_OK(result)) {
1031                 goto done;
1032         }
1033
1034         /* Return output parameters */
1035
1036         rpcstr_pull_unistr2_fstring(description , &r.desc);
1037         *lang_id_desc = r.lang_id;
1038
1039  done:
1040
1041         return result;
1042 }
1043
1044 /** Enumerate list of SIDs  */
1045
1046 NTSTATUS rpccli_lsa_enum_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1047                                 POLICY_HND *pol, uint32 *enum_ctx, uint32 pref_max_length,
1048                                 uint32 *num_sids, DOM_SID **sids)
1049 {
1050         prs_struct qbuf, rbuf;
1051         LSA_Q_ENUM_ACCOUNTS q;
1052         LSA_R_ENUM_ACCOUNTS r;
1053         NTSTATUS result;
1054         int i;
1055
1056         ZERO_STRUCT(q);
1057         ZERO_STRUCT(r);
1058
1059         init_lsa_q_enum_accounts(&q, pol, *enum_ctx, pref_max_length);
1060
1061         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUM_ACCOUNTS,
1062                 q, r,
1063                 qbuf, rbuf,
1064                 lsa_io_q_enum_accounts,
1065                 lsa_io_r_enum_accounts,
1066                 NT_STATUS_UNSUCCESSFUL);
1067
1068         result = r.status;
1069
1070         if (!NT_STATUS_IS_OK(result)) {
1071                 goto done;
1072         }
1073
1074         if (r.sids.num_entries==0)
1075                 goto done;
1076
1077         /* Return output parameters */
1078
1079         *sids = TALLOC_ARRAY(mem_ctx, DOM_SID, r.sids.num_entries);
1080         if (!*sids) {
1081                 DEBUG(0, ("(cli_lsa_enum_sids): out of memory\n"));
1082                 result = NT_STATUS_UNSUCCESSFUL;
1083                 goto done;
1084         }
1085
1086         /* Copy across names and sids */
1087
1088         for (i = 0; i < r.sids.num_entries; i++) {
1089                 sid_copy(&(*sids)[i], &r.sids.sid[i].sid);
1090         }
1091
1092         *num_sids= r.sids.num_entries;
1093         *enum_ctx = r.enum_context;
1094
1095  done:
1096
1097         return result;
1098 }
1099
1100 /** Create a LSA user handle
1101  *
1102  * @param cli Handle on an initialised SMB connection
1103  *
1104  * FIXME: The code is actually identical to open account
1105  * TODO: Check and code what the function should exactly do
1106  *
1107  * */
1108
1109 NTSTATUS rpccli_lsa_create_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1110                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 desired_access,
1111                              POLICY_HND *user_pol)
1112 {
1113         prs_struct qbuf, rbuf;
1114         LSA_Q_CREATEACCOUNT q;
1115         LSA_R_CREATEACCOUNT r;
1116         NTSTATUS result;
1117
1118         ZERO_STRUCT(q);
1119         ZERO_STRUCT(r);
1120
1121         /* Initialise input parameters */
1122
1123         init_lsa_q_create_account(&q, dom_pol, sid, desired_access);
1124
1125         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_CREATEACCOUNT,
1126                 q, r,
1127                 qbuf, rbuf,
1128                 lsa_io_q_create_account,
1129                 lsa_io_r_create_account,
1130                 NT_STATUS_UNSUCCESSFUL);
1131
1132         /* Return output parameters */
1133
1134         result = r.status;
1135
1136         if (NT_STATUS_IS_OK(result)) {
1137                 *user_pol = r.pol;
1138         }
1139
1140         return result;
1141 }
1142
1143 /** Open a LSA user handle
1144  *
1145  * @param cli Handle on an initialised SMB connection */
1146
1147 NTSTATUS rpccli_lsa_open_account(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1148                              POLICY_HND *dom_pol, DOM_SID *sid, uint32 des_access,
1149                              POLICY_HND *user_pol)
1150 {
1151         prs_struct qbuf, rbuf;
1152         LSA_Q_OPENACCOUNT q;
1153         LSA_R_OPENACCOUNT r;
1154         NTSTATUS result;
1155
1156         ZERO_STRUCT(q);
1157         ZERO_STRUCT(r);
1158
1159         /* Initialise input parameters */
1160
1161         init_lsa_q_open_account(&q, dom_pol, sid, des_access);
1162
1163         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENACCOUNT,
1164                 q, r,
1165                 qbuf, rbuf,
1166                 lsa_io_q_open_account,
1167                 lsa_io_r_open_account,
1168                 NT_STATUS_UNSUCCESSFUL);
1169
1170         /* Return output parameters */
1171
1172         result = r.status;
1173
1174         if (NT_STATUS_IS_OK(result)) {
1175                 *user_pol = r.pol;
1176         }
1177
1178         return result;
1179 }
1180
1181 /** Enumerate user privileges
1182  *
1183  * @param cli Handle on an initialised SMB connection */
1184
1185 NTSTATUS rpccli_lsa_enum_privsaccount(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1186                              POLICY_HND *pol, uint32 *count, LUID_ATTR **set)
1187 {
1188         prs_struct qbuf, rbuf;
1189         LSA_Q_ENUMPRIVSACCOUNT q;
1190         LSA_R_ENUMPRIVSACCOUNT r;
1191         NTSTATUS result;
1192         int i;
1193
1194         ZERO_STRUCT(q);
1195         ZERO_STRUCT(r);
1196
1197         /* Initialise input parameters */
1198
1199         init_lsa_q_enum_privsaccount(&q, pol);
1200
1201         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMPRIVSACCOUNT,
1202                 q, r,
1203                 qbuf, rbuf,
1204                 lsa_io_q_enum_privsaccount,
1205                 lsa_io_r_enum_privsaccount,
1206                 NT_STATUS_UNSUCCESSFUL);
1207
1208         /* Return output parameters */
1209
1210         result = r.status;
1211
1212         if (!NT_STATUS_IS_OK(result)) {
1213                 goto done;
1214         }
1215
1216         if (r.count == 0)
1217                 goto done;
1218
1219         if (!((*set = TALLOC_ARRAY(mem_ctx, LUID_ATTR, r.count)))) {
1220                 DEBUG(0, ("(cli_lsa_enum_privsaccount): out of memory\n"));
1221                 result = NT_STATUS_UNSUCCESSFUL;
1222                 goto done;
1223         }
1224
1225         for (i=0; i<r.count; i++) {
1226                 (*set)[i].luid.low = r.set.set[i].luid.low;
1227                 (*set)[i].luid.high = r.set.set[i].luid.high;
1228                 (*set)[i].attr = r.set.set[i].attr;
1229         }
1230
1231         *count=r.count;
1232  done:
1233
1234         return result;
1235 }
1236
1237 /** Get a privilege value given its name */
1238
1239 NTSTATUS rpccli_lsa_lookup_priv_value(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1240                                  POLICY_HND *pol, const char *name, LUID *luid)
1241 {
1242         prs_struct qbuf, rbuf;
1243         LSA_Q_LOOKUP_PRIV_VALUE q;
1244         LSA_R_LOOKUP_PRIV_VALUE r;
1245         NTSTATUS result;
1246
1247         ZERO_STRUCT(q);
1248         ZERO_STRUCT(r);
1249
1250         /* Marshall data and send request */
1251
1252         init_lsa_q_lookup_priv_value(&q, pol, name);
1253
1254         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_LOOKUPPRIVVALUE,
1255                 q, r,
1256                 qbuf, rbuf,
1257                 lsa_io_q_lookup_priv_value,
1258                 lsa_io_r_lookup_priv_value,
1259                 NT_STATUS_UNSUCCESSFUL);
1260
1261         result = r.status;
1262
1263         if (!NT_STATUS_IS_OK(result)) {
1264                 goto done;
1265         }
1266
1267         /* Return output parameters */
1268
1269         (*luid).low=r.luid.low;
1270         (*luid).high=r.luid.high;
1271
1272  done:
1273
1274         return result;
1275 }
1276
1277 /** Query LSA security object */
1278
1279 NTSTATUS rpccli_lsa_query_secobj(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1280                               POLICY_HND *pol, uint32 sec_info,
1281                               SEC_DESC_BUF **psdb)
1282 {
1283         prs_struct qbuf, rbuf;
1284         LSA_Q_QUERY_SEC_OBJ q;
1285         LSA_R_QUERY_SEC_OBJ r;
1286         NTSTATUS result;
1287
1288         ZERO_STRUCT(q);
1289         ZERO_STRUCT(r);
1290
1291         /* Marshall data and send request */
1292
1293         init_q_query_sec_obj(&q, pol, sec_info);
1294
1295         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYSECOBJ,
1296                 q, r,
1297                 qbuf, rbuf,
1298                 lsa_io_q_query_sec_obj,
1299                 lsa_io_r_query_sec_obj,
1300                 NT_STATUS_UNSUCCESSFUL);
1301
1302         result = r.status;
1303
1304         if (!NT_STATUS_IS_OK(result)) {
1305                 goto done;
1306         }
1307
1308         /* Return output parameters */
1309
1310         if (psdb)
1311                 *psdb = r.buf;
1312
1313  done:
1314
1315         return result;
1316 }
1317
1318
1319 /* Enumerate account rights This is similar to enum_privileges but
1320    takes a SID directly, avoiding the open_account call.
1321 */
1322
1323 NTSTATUS rpccli_lsa_enum_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1324                                      POLICY_HND *pol, DOM_SID *sid,
1325                                      uint32 *count, char ***priv_names)
1326 {
1327         prs_struct qbuf, rbuf;
1328         LSA_Q_ENUM_ACCT_RIGHTS q;
1329         LSA_R_ENUM_ACCT_RIGHTS r;
1330         NTSTATUS result;
1331         int i;
1332         fstring *privileges;
1333         char **names;
1334
1335         ZERO_STRUCT(q);
1336         ZERO_STRUCT(r);
1337
1338         /* Marshall data and send request */
1339         init_q_enum_acct_rights(&q, pol, 2, sid);
1340
1341         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ENUMACCTRIGHTS,
1342                 q, r,
1343                 qbuf, rbuf,
1344                 lsa_io_q_enum_acct_rights,
1345                 lsa_io_r_enum_acct_rights,
1346                 NT_STATUS_UNSUCCESSFUL);
1347
1348         result = r.status;
1349
1350         if (!NT_STATUS_IS_OK(result)) {
1351                 goto done;
1352         }
1353
1354         *count = r.count;
1355         if (! *count) {
1356                 goto done;
1357         }
1358
1359
1360         privileges = TALLOC_ARRAY( mem_ctx, fstring, *count );
1361         names      = TALLOC_ARRAY( mem_ctx, char *, *count );
1362
1363         if ((privileges == NULL) || (names == NULL)) {
1364                 TALLOC_FREE(privileges);
1365                 TALLOC_FREE(names);
1366                 return NT_STATUS_NO_MEMORY;
1367         }
1368
1369         for ( i=0; i<*count; i++ ) {
1370                 UNISTR4 *uni_string = &r.rights->strings[i];
1371
1372                 if ( !uni_string->string )
1373                         continue;
1374
1375                 rpcstr_pull( privileges[i], uni_string->string->buffer, sizeof(privileges[i]), -1, STR_TERMINATE );
1376
1377                 /* now copy to the return array */
1378                 names[i] = talloc_strdup( mem_ctx, privileges[i] );
1379         }
1380
1381         *priv_names = names;
1382
1383 done:
1384
1385         return result;
1386 }
1387
1388
1389
1390 /* add account rights to an account. */
1391
1392 NTSTATUS rpccli_lsa_add_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1393                                     POLICY_HND *pol, DOM_SID sid,
1394                                         uint32 count, const char **privs_name)
1395 {
1396         prs_struct qbuf, rbuf;
1397         LSA_Q_ADD_ACCT_RIGHTS q;
1398         LSA_R_ADD_ACCT_RIGHTS r;
1399         NTSTATUS result;
1400
1401         ZERO_STRUCT(q);
1402         ZERO_STRUCT(r);
1403
1404         /* Marshall data and send request */
1405         init_q_add_acct_rights(&q, pol, &sid, count, privs_name);
1406
1407         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_ADDACCTRIGHTS,
1408                 q, r,
1409                 qbuf, rbuf,
1410                 lsa_io_q_add_acct_rights,
1411                 lsa_io_r_add_acct_rights,
1412                 NT_STATUS_UNSUCCESSFUL);
1413
1414         result = r.status;
1415
1416         if (!NT_STATUS_IS_OK(result)) {
1417                 goto done;
1418         }
1419 done:
1420
1421         return result;
1422 }
1423
1424
1425 /* remove account rights for an account. */
1426
1427 NTSTATUS rpccli_lsa_remove_account_rights(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1428                                        POLICY_HND *pol, DOM_SID sid, BOOL removeall,
1429                                        uint32 count, const char **privs_name)
1430 {
1431         prs_struct qbuf, rbuf;
1432         LSA_Q_REMOVE_ACCT_RIGHTS q;
1433         LSA_R_REMOVE_ACCT_RIGHTS r;
1434         NTSTATUS result;
1435
1436         ZERO_STRUCT(q);
1437         ZERO_STRUCT(r);
1438
1439         /* Marshall data and send request */
1440         init_q_remove_acct_rights(&q, pol, &sid, removeall?1:0, count, privs_name);
1441
1442         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_REMOVEACCTRIGHTS,
1443                 q, r,
1444                 qbuf, rbuf,
1445                 lsa_io_q_remove_acct_rights,
1446                 lsa_io_r_remove_acct_rights,
1447                 NT_STATUS_UNSUCCESSFUL);
1448
1449         result = r.status;
1450
1451         if (!NT_STATUS_IS_OK(result)) {
1452                 goto done;
1453         }
1454 done:
1455
1456         return result;
1457 }
1458
1459
1460 #if 0
1461
1462 /** An example of how to use the routines in this file.  Fetch a DOMAIN
1463     sid. Does complete cli setup / teardown anonymously. */
1464
1465 BOOL fetch_domain_sid( char *domain, char *remote_machine, DOM_SID *psid)
1466 {
1467         extern pstring global_myname;
1468         struct cli_state *cli;
1469         NTSTATUS result;
1470         POLICY_HND lsa_pol;
1471         BOOL ret = False;
1472
1473         ZERO_STRUCT(cli);
1474         if((cli = cli_initialise()) == NULL) {
1475                 DEBUG(0,("fetch_domain_sid: unable to initialize client connection.\n"));
1476                 return False;
1477         }
1478
1479         if(!resolve_name( remote_machine, &cli->dest_ip, 0x20)) {
1480                 DEBUG(0,("fetch_domain_sid: Can't resolve address for %s\n", remote_machine));
1481                 goto done;
1482         }
1483
1484         if (!cli_connect(cli, remote_machine, &cli->dest_ip)) {
1485                 DEBUG(0,("fetch_domain_sid: unable to connect to SMB server on \
1486 machine %s. Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1487                 goto done;
1488         }
1489
1490         if (!attempt_netbios_session_request(cli, global_myname, remote_machine, &cli->dest_ip)) {
1491                 DEBUG(0,("fetch_domain_sid: machine %s rejected the NetBIOS session request.\n",
1492                         remote_machine));
1493                 goto done;
1494         }
1495
1496         cli->protocol = PROTOCOL_NT1;
1497
1498         if (!cli_negprot(cli)) {
1499                 DEBUG(0,("fetch_domain_sid: machine %s rejected the negotiate protocol. \
1500 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1501                 goto done;
1502         }
1503
1504         if (cli->protocol != PROTOCOL_NT1) {
1505                 DEBUG(0,("fetch_domain_sid: machine %s didn't negotiate NT protocol.\n",
1506                         remote_machine));
1507                 goto done;
1508         }
1509
1510         /*
1511          * Do an anonymous session setup.
1512          */
1513
1514         if (!cli_session_setup(cli, "", "", 0, "", 0, "")) {
1515                 DEBUG(0,("fetch_domain_sid: machine %s rejected the session setup. \
1516 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1517                 goto done;
1518         }
1519
1520         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
1521                 DEBUG(0,("fetch_domain_sid: machine %s isn't in user level security mode\n",
1522                         remote_machine));
1523                 goto done;
1524         }
1525
1526         if (!cli_send_tconX(cli, "IPC$", "IPC", "", 1)) {
1527                 DEBUG(0,("fetch_domain_sid: machine %s rejected the tconX on the IPC$ share. \
1528 Error was : %s.\n", remote_machine, cli_errstr(cli) ));
1529                 goto done;
1530         }
1531
1532         /* Fetch domain sid */
1533
1534         if (!cli_nt_session_open(cli, PI_LSARPC)) {
1535                 DEBUG(0, ("fetch_domain_sid: Error connecting to SAM pipe\n"));
1536                 goto done;
1537         }
1538
1539         result = cli_lsa_open_policy(cli, cli->mem_ctx, True, SEC_RIGHTS_QUERY_VALUE, &lsa_pol);
1540         if (!NT_STATUS_IS_OK(result)) {
1541                 DEBUG(0, ("fetch_domain_sid: Error opening lsa policy handle. %s\n",
1542                         nt_errstr(result) ));
1543                 goto done;
1544         }
1545
1546         result = cli_lsa_query_info_policy(cli, cli->mem_ctx, &lsa_pol, 5, domain, psid);
1547         if (!NT_STATUS_IS_OK(result)) {
1548                 DEBUG(0, ("fetch_domain_sid: Error querying lsa policy handle. %s\n",
1549                         nt_errstr(result) ));
1550                 goto done;
1551         }
1552
1553         ret = True;
1554
1555   done:
1556
1557         cli_shutdown(cli);
1558         return ret;
1559 }
1560
1561 #endif
1562
1563 NTSTATUS rpccli_lsa_open_trusted_domain(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1564                                      POLICY_HND *pol, DOM_SID *dom_sid, uint32 access_mask,
1565                                      POLICY_HND *trustdom_pol)
1566 {
1567         prs_struct qbuf, rbuf;
1568         LSA_Q_OPEN_TRUSTED_DOMAIN q;
1569         LSA_R_OPEN_TRUSTED_DOMAIN r;
1570         NTSTATUS result;
1571
1572         ZERO_STRUCT(q);
1573         ZERO_STRUCT(r);
1574
1575         /* Initialise input parameters */
1576
1577         init_lsa_q_open_trusted_domain(&q, pol, dom_sid, access_mask);
1578
1579         /* Marshall data and send request */
1580
1581         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOM,
1582                 q, r,
1583                 qbuf, rbuf,
1584                 lsa_io_q_open_trusted_domain,
1585                 lsa_io_r_open_trusted_domain,
1586                 NT_STATUS_UNSUCCESSFUL);
1587
1588         /* Return output parameters */
1589
1590         result = r.status;
1591
1592         if (NT_STATUS_IS_OK(result)) {
1593                 *trustdom_pol = r.handle;
1594         }
1595
1596         return result;
1597 }
1598
1599 NTSTATUS rpccli_lsa_query_trusted_domain_info(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1600                                            POLICY_HND *pol,
1601                                            uint16 info_class,
1602                                            LSA_TRUSTED_DOMAIN_INFO **info)
1603 {
1604         prs_struct qbuf, rbuf;
1605         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO q;
1606         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1607         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1608
1609         ZERO_STRUCT(q);
1610         ZERO_STRUCT(r);
1611
1612         /* Marshall data and send request */
1613
1614         init_q_query_trusted_domain_info(&q, pol, info_class);
1615
1616         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFO,
1617                 q, r,
1618                 qbuf, rbuf,
1619                 lsa_io_q_query_trusted_domain_info,
1620                 lsa_io_r_query_trusted_domain_info,
1621                 NT_STATUS_UNSUCCESSFUL);
1622
1623         result = r.status;
1624
1625         if (!NT_STATUS_IS_OK(result)) {
1626                 goto done;
1627         }
1628
1629         *info = r.info;
1630
1631 done:
1632         return result;
1633 }
1634
1635 NTSTATUS rpccli_lsa_open_trusted_domain_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1636                                                 POLICY_HND *pol, const char *name, uint32 access_mask,
1637                                                 POLICY_HND *trustdom_pol)
1638 {
1639         prs_struct qbuf, rbuf;
1640         LSA_Q_OPEN_TRUSTED_DOMAIN_BY_NAME q;
1641         LSA_R_OPEN_TRUSTED_DOMAIN_BY_NAME r;
1642         NTSTATUS result;
1643
1644         ZERO_STRUCT(q);
1645         ZERO_STRUCT(r);
1646
1647         /* Initialise input parameters */
1648
1649         init_lsa_q_open_trusted_domain_by_name(&q, pol, name, access_mask);
1650
1651         /* Marshall data and send request */
1652
1653         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_OPENTRUSTDOMBYNAME,
1654                 q, r,
1655                 qbuf, rbuf,
1656                 lsa_io_q_open_trusted_domain_by_name,
1657                 lsa_io_r_open_trusted_domain_by_name,
1658                 NT_STATUS_UNSUCCESSFUL);
1659
1660         /* Return output parameters */
1661
1662         result = r.status;
1663
1664         if (NT_STATUS_IS_OK(result)) {
1665                 *trustdom_pol = r.handle;
1666         }
1667
1668         return result;
1669 }
1670
1671
1672 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_sid(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1673                                                   POLICY_HND *pol,
1674                                                   uint16 info_class, DOM_SID *dom_sid,
1675                                                   LSA_TRUSTED_DOMAIN_INFO **info)
1676 {
1677         prs_struct qbuf, rbuf;
1678         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_SID q;
1679         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1680         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1681
1682         ZERO_STRUCT(q);
1683         ZERO_STRUCT(r);
1684
1685         /* Marshall data and send request */
1686
1687         init_q_query_trusted_domain_info_by_sid(&q, pol, info_class, dom_sid);
1688
1689         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYSID,
1690                 q, r,
1691                 qbuf, rbuf,
1692                 lsa_io_q_query_trusted_domain_info_by_sid,
1693                 lsa_io_r_query_trusted_domain_info,
1694                 NT_STATUS_UNSUCCESSFUL);
1695
1696         result = r.status;
1697
1698         if (!NT_STATUS_IS_OK(result)) {
1699                 goto done;
1700         }
1701
1702         *info = r.info;
1703
1704 done:
1705
1706         return result;
1707 }
1708
1709 NTSTATUS rpccli_lsa_query_trusted_domain_info_by_name(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1710                                                    POLICY_HND *pol,
1711                                                    uint16 info_class, const char *domain_name,
1712                                                    LSA_TRUSTED_DOMAIN_INFO **info)
1713 {
1714         prs_struct qbuf, rbuf;
1715         LSA_Q_QUERY_TRUSTED_DOMAIN_INFO_BY_NAME q;
1716         LSA_R_QUERY_TRUSTED_DOMAIN_INFO r;
1717         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1718
1719         ZERO_STRUCT(q);
1720         ZERO_STRUCT(r);
1721
1722         /* Marshall data and send request */
1723
1724         init_q_query_trusted_domain_info_by_name(&q, pol, info_class, domain_name);
1725
1726         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYTRUSTDOMINFOBYNAME,
1727                 q, r,
1728                 qbuf, rbuf,
1729                 lsa_io_q_query_trusted_domain_info_by_name,
1730                 lsa_io_r_query_trusted_domain_info,
1731                 NT_STATUS_UNSUCCESSFUL);
1732
1733         result = r.status;
1734
1735         if (!NT_STATUS_IS_OK(result)) {
1736                 goto done;
1737         }
1738
1739         *info = r.info;
1740
1741 done:
1742
1743         return result;
1744 }
1745
1746 NTSTATUS cli_lsa_query_domain_info_policy(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
1747                                           POLICY_HND *pol,
1748                                           uint16 info_class, LSA_DOM_INFO_UNION **info)
1749 {
1750         prs_struct qbuf, rbuf;
1751         LSA_Q_QUERY_DOM_INFO_POLICY q;
1752         LSA_R_QUERY_DOM_INFO_POLICY r;
1753         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1754
1755         ZERO_STRUCT(q);
1756         ZERO_STRUCT(r);
1757
1758         /* Marshall data and send request */
1759
1760         init_q_query_dom_info(&q, pol, info_class);
1761
1762         CLI_DO_RPC( cli, mem_ctx, PI_LSARPC, LSA_QUERYDOMINFOPOL,
1763                 q, r,
1764                 qbuf, rbuf,
1765                 lsa_io_q_query_dom_info,
1766                 lsa_io_r_query_dom_info,
1767                 NT_STATUS_UNSUCCESSFUL);
1768
1769         result = r.status;
1770
1771         if (!NT_STATUS_IS_OK(result)) {
1772                 goto done;
1773         }
1774
1775         *info = r.info;
1776
1777 done:
1778         return result;
1779 }
1780