[GLUE] Rsync SAMBA_3_2_0 SVN r25598 in order to create the v3-2-test branch.
[samba.git] / source / rpc_server / srv_lsa_nt.c
index 41df87041433f8fc4e7261a0210ab223bd65534a..c513d8489cb2632d2a68ad1e23bae7d13494c4e6 100644 (file)
@@ -13,7 +13,7 @@
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
+ *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
  *  
  *  This program is distributed in the hope that it will be useful,
@@ -22,8 +22,7 @@
  *  GNU General Public License for more details.
  *  
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /* This is the implementation of the lsa server code. */
@@ -40,7 +39,7 @@ struct lsa_info {
        uint32 access;
 };
 
-struct generic_mapping lsa_generic_mapping = {
+const struct generic_mapping lsa_generic_mapping = {
        POLICY_READ,
        POLICY_WRITE,
        POLICY_EXECUTE,
@@ -164,7 +163,7 @@ static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
                int dom_idx;
                char *full_name;
                const char *domain;
-               enum SID_NAME_USE type = SID_NAME_UNKNOWN;
+               enum lsa_SidType type = SID_NAME_UNKNOWN;
 
                /* Split name into domain and user component */
 
@@ -239,7 +238,7 @@ static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
                int dom_idx;
                char *full_name;
                const char *domain;
-               enum SID_NAME_USE type = SID_NAME_UNKNOWN;
+               enum lsa_SidType type = SID_NAME_UNKNOWN;
 
                /* Split name into domain and user component */
 
@@ -380,12 +379,10 @@ static void init_reply_lookup_names4(LSA_R_LOOKUP_NAMES4 *r_l,
 
 static void init_reply_lookup_sids2(LSA_R_LOOKUP_SIDS2 *r_l,
                                DOM_R_REF *ref,
-                               LSA_TRANS_NAME_ENUM2 *names,
                                uint32 mapped_count)
 {
        r_l->ptr_dom_ref  = ref ? 1 : 0;
        r_l->dom_ref      = ref;
-       r_l->names        = names;
        r_l->mapped_count = mapped_count;
 }
 
@@ -395,12 +392,10 @@ static void init_reply_lookup_sids2(LSA_R_LOOKUP_SIDS2 *r_l,
 
 static void init_reply_lookup_sids3(LSA_R_LOOKUP_SIDS3 *r_l,
                                DOM_R_REF *ref,
-                               LSA_TRANS_NAME_ENUM2 *names,
                                uint32 mapped_count)
 {
        r_l->ptr_dom_ref  = ref ? 1 : 0;
        r_l->dom_ref      = ref;
-       r_l->names        = names;
        r_l->mapped_count = mapped_count;
 }
 
@@ -414,11 +409,7 @@ static NTSTATUS init_reply_lookup_sids(TALLOC_CTX *mem_ctx,
                                LSA_TRANS_NAME_ENUM2 *names,
                                uint32 mapped_count)
 {
-       LSA_TRANS_NAME_ENUM *oldnames = TALLOC_ZERO_P(mem_ctx, LSA_TRANS_NAME_ENUM);
-
-       if (!oldnames) {
-               return NT_STATUS_NO_MEMORY;
-       }
+       LSA_TRANS_NAME_ENUM *oldnames = &r_l->names;
 
        oldnames->num_entries = names->num_entries;
        oldnames->ptr_trans_names = names->ptr_trans_names;
@@ -428,7 +419,7 @@ static NTSTATUS init_reply_lookup_sids(TALLOC_CTX *mem_ctx,
        if (names->num_entries) {
                int i;
 
-               oldnames->name = TALLOC_ARRAY(oldnames, LSA_TRANS_NAME, names->num_entries);
+               oldnames->name = TALLOC_ARRAY(mem_ctx, LSA_TRANS_NAME, names->num_entries);
 
                if (!oldnames->name) {
                        return NT_STATUS_NO_MEMORY;
@@ -442,7 +433,6 @@ static NTSTATUS init_reply_lookup_sids(TALLOC_CTX *mem_ctx,
 
        r_l->ptr_dom_ref  = ref ? 1 : 0;
        r_l->dom_ref      = ref;
-       r_l->names        = oldnames;
        r_l->mapped_count = mapped_count;
        return NT_STATUS_OK;
 }
@@ -487,7 +477,7 @@ static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *s
 
 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
                              const char *dns_name, const char *forest_name,
-                             struct uuid *dom_guid, DOM_SID *dom_sid)
+                             struct GUID *dom_guid, DOM_SID *dom_sid)
 {
        if (nb_name && *nb_name) {
                init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
@@ -512,7 +502,7 @@ static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
 
        /* how do we init the guid ? probably should write an init fn */
        if (dom_guid) {
-               memcpy(&r_l->dom_guid, dom_guid, sizeof(struct uuid));
+               memcpy(&r_l->dom_guid, dom_guid, sizeof(struct GUID));
        }
        
        if (dom_sid) {
@@ -648,8 +638,7 @@ NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u,
        if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
                return NT_STATUS_ACCESS_DENIED;
 
-       nt_status = secrets_trusted_domains(p->mem_ctx, &num_domains,
-                                           &domains);
+       nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
 
        if (!NT_STATUS_IS_OK(nt_status)) {
                return nt_status;
@@ -811,13 +800,12 @@ static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
                                int num_sids,                           /* input */
                                const DOM_SID2 *sid,                    /* input */
                                DOM_R_REF **pp_ref,                     /* output */
-                               LSA_TRANS_NAME_ENUM2 **pp_names,        /* output */
+                               LSA_TRANS_NAME_ENUM2 *names,            /* input/output */
                                uint32 *pp_mapped_count)
 {
        NTSTATUS status;
        int i;
        const DOM_SID **sids = NULL;
-       LSA_TRANS_NAME_ENUM2 *names = NULL;
        DOM_R_REF *ref = NULL;
        uint32 mapped_count = 0;
        struct lsa_dom_info *dom_infos = NULL;
@@ -825,13 +813,16 @@ static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
 
        *pp_mapped_count = 0;
        *pp_ref = NULL;
-       *pp_names = NULL;
-       
-       names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM2);
+       ZERO_STRUCTP(names);
+
+       if (num_sids == 0) {
+               return NT_STATUS_OK;
+       }
+
        sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
        ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
 
-       if (sids == NULL || names == NULL || ref == NULL) {
+       if (sids == NULL || ref == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -846,12 +837,10 @@ static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
                return status;
        }
 
-       if (num_sids > 0) {
-               names->name = TALLOC_ARRAY(names, LSA_TRANS_NAME2, num_sids);
-               names->uni_name = TALLOC_ARRAY(names, UNISTR2, num_sids);
-               if ((names->name == NULL) || (names->uni_name == NULL)) {
-                       return NT_STATUS_NO_MEMORY;
-               }
+       names->name = TALLOC_ARRAY(p->mem_ctx, LSA_TRANS_NAME2, num_sids);
+       names->uni_name = TALLOC_ARRAY(p->mem_ctx, UNISTR2, num_sids);
+       if ((names->name == NULL) || (names->uni_name == NULL)) {
+               return NT_STATUS_NO_MEMORY;
        }
 
        for (i=0; i<MAX_REF_DOMAINS; i++) {
@@ -906,7 +895,6 @@ static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
 
        *pp_mapped_count = mapped_count;
        *pp_ref = ref;
-       *pp_names = names;
 
        return status;
 }
@@ -923,7 +911,7 @@ NTSTATUS _lsa_lookup_sids(pipes_struct *p,
        int num_sids = q_u->sids.num_entries;
        uint32 mapped_count = 0;
        DOM_R_REF *ref = NULL;
-       LSA_TRANS_NAME_ENUM2 *names = NULL;
+       LSA_TRANS_NAME_ENUM2 names;
        NTSTATUS status;
 
        if ((q_u->level < 1) || (q_u->level > 6)) {
@@ -955,7 +943,7 @@ NTSTATUS _lsa_lookup_sids(pipes_struct *p,
 
        /* Convert from LSA_TRANS_NAME_ENUM2 to LSA_TRANS_NAME_ENUM */
 
-       status = init_reply_lookup_sids(p->mem_ctx, r_u, ref, names, mapped_count);
+       status = init_reply_lookup_sids(p->mem_ctx, r_u, ref, &names, mapped_count);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -974,7 +962,6 @@ NTSTATUS _lsa_lookup_sids2(pipes_struct *p,
        int num_sids = q_u->sids.num_entries;
        uint32 mapped_count = 0;
        DOM_R_REF *ref = NULL;
-       LSA_TRANS_NAME_ENUM2 *names = NULL;
 
        if ((q_u->level < 1) || (q_u->level > 6)) {
                return NT_STATUS_INVALID_PARAMETER;
@@ -1000,45 +987,51 @@ NTSTATUS _lsa_lookup_sids2(pipes_struct *p,
                                                num_sids, 
                                                q_u->sids.sid,
                                                &ref,
-                                               &names,
+                                               &r_u->names,
                                                &mapped_count);
 
-       init_reply_lookup_sids2(r_u, ref, names, mapped_count);
+       init_reply_lookup_sids2(r_u, ref, mapped_count);
        return r_u->status;
 }
 
 /***************************************************************************
  _lsa_lookup_sida3
-
- Before someone actually re-activates this, please present a sniff showing
- this call against some Windows server. I (vl) could not make it work against
- w2k3 at all.
  ***************************************************************************/
 
 NTSTATUS _lsa_lookup_sids3(pipes_struct *p,
                          LSA_Q_LOOKUP_SIDS3 *q_u,
                          LSA_R_LOOKUP_SIDS3 *r_u)
 {
+       int num_sids = q_u->sids.num_entries;
        uint32 mapped_count = 0;
-       DOM_R_REF *ref;
-       LSA_TRANS_NAME_ENUM2 *names;
+       DOM_R_REF *ref = NULL;
 
        if ((q_u->level < 1) || (q_u->level > 6)) {
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       r_u->status = NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED;
-
-       ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
-       names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM2);
+       /* No policy handle on this call. Restrict to crypto connections. */
+       if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
+               DEBUG(0,("_lsa_lookup_sids3: client %s not using schannel for netlogon\n",
+                       get_remote_machine_name() ));
+               return NT_STATUS_INVALID_PARAMETER;
+       }
 
-       if ((ref == NULL) || (names == NULL)) {
-               /* We would segfault later on in lsa_io_r_lookup_sids3 anyway,
-                * so do a planned exit here. We NEEEED pidl! */
-               smb_panic("talloc failed");
+       if (num_sids >  MAX_LOOKUP_SIDS) {
+               DEBUG(5,("_lsa_lookup_sids3: limit of %d exceeded, requested %d\n",
+                        MAX_LOOKUP_SIDS, num_sids));
+               return NT_STATUS_NONE_MAPPED;
        }
 
-       init_reply_lookup_sids3(r_u, ref, names, mapped_count);
+       r_u->status = _lsa_lookup_sids_internal(p,
+                                               q_u->level,
+                                               num_sids, 
+                                               q_u->sids.sid,
+                                               &ref,
+                                               &r_u->names,
+                                               &mapped_count);
+
+       init_reply_lookup_sids3(r_u, ref, mapped_count);
        return r_u->status;
 }
 
@@ -1067,7 +1060,18 @@ NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP
        }
 
        ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
-       rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID, num_entries);
+       if (!ref) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (num_entries) {
+               rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID, num_entries);
+               if (!rids) {
+                       return NT_STATUS_NO_MEMORY;
+               }
+       } else {
+               rids = NULL;
+       }
 
        if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
                r_u->status = NT_STATUS_INVALID_HANDLE;
@@ -1080,9 +1084,6 @@ NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP
                goto done;
        }
 
-       if (!ref || !rids)
-               return NT_STATUS_NO_MEMORY;
-
        /* set up the LSA Lookup RIDs response */
        become_root(); /* lookup_name can require root privs */
        r_u->status = lookup_lsa_rids(p->mem_ctx, ref, rids, num_entries,
@@ -1129,14 +1130,23 @@ NTSTATUS _lsa_lookup_names2(pipes_struct *p, LSA_Q_LOOKUP_NAMES2 *q_u, LSA_R_LOO
        }
 
        ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
-       rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID, num_entries);
-       rids2 = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, num_entries);
-
-       if ((ref == NULL) || (rids == NULL) || (rids2 == NULL)) {
+       if (ref == NULL) {
                r_u->status = NT_STATUS_NO_MEMORY;
                return NT_STATUS_NO_MEMORY;
        }
 
+       if (num_entries) {
+               rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID, num_entries);
+               rids2 = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, num_entries);
+               if ((rids == NULL) || (rids2 == NULL)) {
+                       r_u->status = NT_STATUS_NO_MEMORY;
+                       return NT_STATUS_NO_MEMORY;
+               }
+       } else {
+               rids = NULL;
+               rids2 = NULL;
+       }
+
        if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
                r_u->status = NT_STATUS_INVALID_HANDLE;
                goto done;
@@ -1201,7 +1211,17 @@ NTSTATUS _lsa_lookup_names3(pipes_struct *p, LSA_Q_LOOKUP_NAMES3 *q_u, LSA_R_LOO
        }
 
        ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
-       trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_TRANSLATED_SID3, num_entries);
+       if (ref == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       if (num_entries) {
+               trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_TRANSLATED_SID3, num_entries);
+               if (!trans_sids) {
+                       return NT_STATUS_NO_MEMORY;
+               }
+       } else {
+               trans_sids = NULL;
+       }
 
        if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle)) {
                r_u->status = NT_STATUS_INVALID_HANDLE;
@@ -1214,10 +1234,6 @@ NTSTATUS _lsa_lookup_names3(pipes_struct *p, LSA_Q_LOOKUP_NAMES3 *q_u, LSA_R_LOO
                goto done;
        }
 
-       if (!ref || !trans_sids) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
        /* set up the LSA Lookup SIDs response */
        become_root(); /* lookup_name can require root privs */
        r_u->status = lookup_lsa_sids(p->mem_ctx, ref, trans_sids, num_entries,
@@ -1269,12 +1285,19 @@ NTSTATUS _lsa_lookup_names4(pipes_struct *p, LSA_Q_LOOKUP_NAMES4 *q_u, LSA_R_LOO
        }
 
        ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
-       trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_TRANSLATED_SID3, num_entries);
-
-       if (!ref || !trans_sids) {
+       if (!ref) {
                return NT_STATUS_NO_MEMORY;
        }
 
+       if (num_entries) {
+               trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_TRANSLATED_SID3, num_entries);
+               if (!trans_sids) {
+                       return NT_STATUS_NO_MEMORY;
+               }
+       } else {
+               trans_sids = NULL;
+       }
+
        /* set up the LSA Lookup SIDs response */
        become_root(); /* lookup_name can require root privs */
        r_u->status = lookup_lsa_sids(p->mem_ctx, ref, trans_sids, num_entries,
@@ -1297,20 +1320,20 @@ NTSTATUS _lsa_lookup_names4(pipes_struct *p, LSA_Q_LOOKUP_NAMES4 *q_u, LSA_R_LOO
  _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
  ***************************************************************************/
 
-NTSTATUS _lsa_close(pipes_struct *p, LSA_Q_CLOSE *q_u, LSA_R_CLOSE *r_u)
+NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
 {
-       if (!find_policy_by_hnd(p, &q_u->pol, NULL)) {
+       if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
                return NT_STATUS_INVALID_HANDLE;
        }
 
-       close_policy_hnd(p, &q_u->pol);
+       close_policy_hnd(p, r->in.handle);
        return NT_STATUS_OK;
 }
 
 /***************************************************************************
  ***************************************************************************/
 
-NTSTATUS _lsa_open_secret(pipes_struct *p, LSA_Q_OPEN_SECRET *q_u, LSA_R_OPEN_SECRET *r_u)
+NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
 {
        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 }
@@ -1318,7 +1341,7 @@ NTSTATUS _lsa_open_secret(pipes_struct *p, LSA_Q_OPEN_SECRET *q_u, LSA_R_OPEN_SE
 /***************************************************************************
  ***************************************************************************/
 
-NTSTATUS _lsa_open_trusted_domain(pipes_struct *p, LSA_Q_OPEN_TRUSTED_DOMAIN *q_u, LSA_R_OPEN_TRUSTED_DOMAIN *r_u)
+NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
 {
        return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 }
@@ -1326,7 +1349,7 @@ NTSTATUS _lsa_open_trusted_domain(pipes_struct *p, LSA_Q_OPEN_TRUSTED_DOMAIN *q_
 /***************************************************************************
  ***************************************************************************/
 
-NTSTATUS _lsa_create_trusted_domain(pipes_struct *p, LSA_Q_CREATE_TRUSTED_DOMAIN *q_u, LSA_R_CREATE_TRUSTED_DOMAIN *r_u)
+NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -1334,7 +1357,7 @@ NTSTATUS _lsa_create_trusted_domain(pipes_struct *p, LSA_Q_CREATE_TRUSTED_DOMAIN
 /***************************************************************************
  ***************************************************************************/
 
-NTSTATUS _lsa_create_secret(pipes_struct *p, LSA_Q_CREATE_SECRET *q_u, LSA_R_CREATE_SECRET *r_u)
+NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -1342,7 +1365,7 @@ NTSTATUS _lsa_create_secret(pipes_struct *p, LSA_Q_CREATE_SECRET *q_u, LSA_R_CRE
 /***************************************************************************
  ***************************************************************************/
 
-NTSTATUS _lsa_set_secret(pipes_struct *p, LSA_Q_SET_SECRET *q_u, LSA_R_SET_SECRET *r_u)
+NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -1385,8 +1408,12 @@ NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIV
        if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
                return NT_STATUS_ACCESS_DENIED;
 
-       if ( !(entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, num_privs )) )
-               return NT_STATUS_NO_MEMORY;
+       if (num_privs) {
+               if ( !(entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, num_privs )) )
+                       return NT_STATUS_NO_MEMORY;
+       } else {
+               entries = NULL;
+       }
 
        for (i = 0; i < num_privs; i++) {
                if( i < enum_context) {
@@ -1490,20 +1517,25 @@ NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENU
        if (q_u->enum_context >= num_entries)
                return NT_STATUS_NO_MORE_ENTRIES;
 
-       sids->ptr_sid = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_entries-q_u->enum_context);
-       sids->sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_entries-q_u->enum_context);
+       if (num_entries-q_u->enum_context) {
+               sids->ptr_sid = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_entries-q_u->enum_context);
+               sids->sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_entries-q_u->enum_context);
 
-       if (sids->ptr_sid==NULL || sids->sid==NULL) {
-               SAFE_FREE(sid_list);
-               return NT_STATUS_NO_MEMORY;
-       }
+               if (sids->ptr_sid==NULL || sids->sid==NULL) {
+                       SAFE_FREE(sid_list);
+                       return NT_STATUS_NO_MEMORY;
+               }
 
-       for (i = q_u->enum_context, j = 0; i < num_entries; i++, j++) {
-               init_dom_sid2(&(*sids).sid[j], &sid_list[i]);
-               (*sids).ptr_sid[j] = 1;
+               for (i = q_u->enum_context, j = 0; i < num_entries; i++, j++) {
+                       init_dom_sid2(&(*sids).sid[j], &sid_list[i]);
+                       (*sids).ptr_sid[j] = 1;
+               }
+       } else {
+               sids->ptr_sid = NULL;
+               sids->sid = NULL;
        }
 
-       SAFE_FREE(sid_list);
+       talloc_free(sid_list);
 
        init_lsa_r_enum_accounts(r_u, num_entries);
 
@@ -1513,26 +1545,14 @@ NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENU
 
 NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u)
 {
-       const char *username, *domname;
+       fstring username, domname;
        user_struct *vuser = get_valid_user_struct(p->vuid);
   
        if (vuser == NULL)
                return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
-
-       if (vuser->guest) {
-               /*
-                * I'm 99% sure this is not the right place to do this,
-                * global_sid_Anonymous should probably be put into the token
-                * instead of the guest id -- vl
-                */
-               if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
-                               &domname, &username, NULL)) {
-                       return NT_STATUS_NO_MEMORY;
-               }
-       } else {
-               username = vuser->user.smb_name;
-               domname = vuser->user.domain;
-       }
+  
+       fstrcpy(username, vuser->user.smb_name);
+       fstrcpy(domname, vuser->user.domain);
   
        r_u->ptr_user_name = 1;
        init_unistr2(&r_u->uni2_user_name, username, UNI_STR_TERMINATE);
@@ -1568,23 +1588,17 @@ NTSTATUS _lsa_create_account(pipes_struct *p, LSA_Q_CREATEACCOUNT *q_u, LSA_R_CR
         * I don't know if it's the right one. not documented.
         * but guessed with rpcclient.
         */
-       if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION)) {
-               DEBUG(10, ("_lsa_create_account: No POLICY_GET_PRIVATE_INFORMATION access right!\n"));
+       if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
                return NT_STATUS_ACCESS_DENIED;
-       }
 
        /* check to see if the pipe_user is a Domain Admin since 
           account_pol.tdb was already opened as root, this is all we have */
           
-       if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) ) {
-               DEBUG(10, ("_lsa_create_account: The use is not a Domain Admin, deny access!\n"));
+       if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
                return NT_STATUS_ACCESS_DENIED;
-       }
                
-       if ( is_privileged_sid( &q_u->sid.sid ) ) {
-               DEBUG(10, ("_lsa_create_account: Policy account already exists!\n"));
+       if ( is_privileged_sid( &q_u->sid.sid ) )
                return NT_STATUS_OBJECT_NAME_COLLISION;
-       }
 
        /* associate the user/group SID with the (unique) handle. */
        
@@ -1599,7 +1613,6 @@ NTSTATUS _lsa_create_account(pipes_struct *p, LSA_Q_CREATEACCOUNT *q_u, LSA_R_CR
        if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 
-       DEBUG(10, ("_lsa_create_account: call privileges code to create an account\n"));
        return privilege_create_account( &info->sid );
 }
 
@@ -1694,7 +1707,7 @@ NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA
                return NT_STATUS_INVALID_HANDLE;
 
        if (!lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, NULL))
-               return NT_STATUS_OK;
+               return NT_STATUS_ACCESS_DENIED;
 
        /*
          0x01 -> Log on locally
@@ -1879,7 +1892,7 @@ NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_I
        char *dns_name = NULL;
        char *forest_name = NULL;
        DOM_SID *sid = NULL;
-       struct uuid guid;
+       struct GUID guid;
        fstring dnsdomname;
 
        ZERO_STRUCT(guid);
@@ -2122,3 +2135,466 @@ NTSTATUS _lsa_lookup_priv_value(pipes_struct *p, LSA_Q_LOOKUP_PRIV_VALUE *q_u, L
 
        return NT_STATUS_OK;
 }
+
+
+/*
+ * From here on the server routines are just dummy ones to make smbd link with
+ * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
+ * pulling the server stubs across one by one.
+ */ 
+
+NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_EnumPrivs(pipes_struct *p, struct lsa_EnumPrivs *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QuerySecurity(pipes_struct *p, struct lsa_QuerySecurity *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_OpenPolicy(pipes_struct *p, struct lsa_OpenPolicy *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p, struct lsa_QueryInfoPolicy *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CreateAccount(pipes_struct *p, struct lsa_CreateAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_EnumAccounts(pipes_struct *p, struct lsa_EnumAccounts *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_EnumTrustDom(pipes_struct *p, struct lsa_EnumTrustDom *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupNames(pipes_struct *p, struct lsa_LookupNames *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupSids(pipes_struct *p, struct lsa_LookupSids *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_OpenAccount(pipes_struct *p, struct lsa_OpenAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p, struct lsa_EnumPrivsAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p, struct lsa_AddPrivilegesToAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p, struct lsa_RemovePrivilegesFromAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p, struct lsa_GetSystemAccessAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p, struct lsa_SetSystemAccessAccount *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupPrivValue(pipes_struct *p, struct lsa_LookupPrivValue *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupPrivName(pipes_struct *p, struct lsa_LookupPrivName *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p, struct lsa_LookupPrivDisplayName *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_DeleteObject(pipes_struct *p, struct lsa_DeleteObject *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p, struct lsa_EnumAccountsWithUserRight *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_EnumAccountRights(pipes_struct *p, struct lsa_EnumAccountRights *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_AddAccountRights(pipes_struct *p, struct lsa_AddAccountRights *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p, struct lsa_RemoveAccountRights *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_OpenPolicy2(pipes_struct *p, struct lsa_OpenPolicy2 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_GetUserName(pipes_struct *p, struct lsa_GetUserName *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p, struct lsa_QueryInfoPolicy2 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupSids2(pipes_struct *p, struct lsa_LookupSids2 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupNames2(pipes_struct *p, struct lsa_LookupNames2 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupNames3(pipes_struct *p, struct lsa_LookupNames3 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARQUERYFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARQUERYFORESTTRUSTINFORMATION *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupSids3(pipes_struct *p, struct lsa_LookupSids3 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LookupNames4(pipes_struct *p, struct lsa_LookupNames4 *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}