source3/rpc_client/cli_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4    Copyright (C) Tim Potter                        2000-2001,
   5    Copyright (C) Andrew Tridgell              1992-1997,2000,
   6    Copyright (C) Rafal Szczesniak                       2002
   7    Copyright (C) Jeremy Allison                         2005.
   8    Copyright (C) Michael Adam                           2007.
   9    Copyright (C) Guenther Deschner                      2008.
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "rpc_client/rpc_client.h"
  27 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  28 #include "rpc_client/cli_lsarpc.h"
  29 #include "rpc_client/init_lsa.h"
  30 #include "../libcli/security/security.h"
  31
  32 /** @defgroup lsa LSA - Local Security Architecture
  33  *  @ingroup rpc_client
  34  *
  35  * @{
  36  **/
  37
  38 /**
  39  * @file cli_lsarpc.c
  40  *
  41  * RPC client routines for the LSA RPC pipe.  LSA means "local
  42  * security authority", which is half of a password database.
  43  **/
  44
  45 NTSTATUS dcerpc_lsa_open_policy(struct dcerpc_binding_handle *h,
  46                                 TALLOC_CTX *mem_ctx,
  47                                 bool sec_qos,
  48                                 uint32_t des_access,
  49                                 struct policy_handle *pol,
  50                                 NTSTATUS *result)
  51 {
  52         struct lsa_ObjectAttribute attr;
  53         struct lsa_QosInfo qos;
  54         uint16_t system_name = '\\';
  55
  56         ZERO_STRUCT(attr);
  57
  58         attr.len        = 0x18;
  59
  60         if (sec_qos) {
  61                 qos.len                 = 0xc;
  62                 qos.impersonation_level = 2;
  63                 qos.context_mode        = 1;
  64                 qos.effective_only      = 0;
  65
  66                 attr.sec_qos            = &qos;
  67         }
  68
  69         return dcerpc_lsa_OpenPolicy(h,
  70                                      mem_ctx,
  71                                      &system_name,
  72                                      &attr,
  73                                      des_access,
  74                                      pol,
  75                                      result);
  76 }
  77
  78 /** Open a LSA policy handle
  79  *
  80  * @param cli Handle on an initialised SMB connection */
  81
  82 NTSTATUS rpccli_lsa_open_policy(struct rpc_pipe_client *cli,
  83                                 TALLOC_CTX *mem_ctx,
  84                                 bool sec_qos, uint32 des_access,
  85                                 struct policy_handle *pol)
  86 {
  87         NTSTATUS status;
  88         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  89
  90         status = dcerpc_lsa_open_policy(cli->binding_handle,
  91                                         mem_ctx,
  92                                         sec_qos,
  93                                         des_access,
  94                                         pol,
  95                                         &result);
  96         if (!NT_STATUS_IS_OK(status)) {
  97                 return status;
  98         }
  99
 100         return result;
 101 }
 102
 103 NTSTATUS dcerpc_lsa_open_policy2(struct dcerpc_binding_handle *h,
 104                                  TALLOC_CTX *mem_ctx,
 105                                  const char *srv_name_slash,
 106                                  bool sec_qos,
 107                                  uint32_t des_access,
 108                                  struct policy_handle *pol,
 109                                  NTSTATUS *result)
 110 {
 111         struct lsa_ObjectAttribute attr;
 112         struct lsa_QosInfo qos;
 113
 114         ZERO_STRUCT(attr);
 115
 116         attr.len        = 0x18;
 117
 118         if (sec_qos) {
 119                 qos.len                 = 0xc;
 120                 qos.impersonation_level = 2;
 121                 qos.context_mode        = 1;
 122                 qos.effective_only      = 0;
 123
 124                 attr.sec_qos            = &qos;
 125         }
 126
 127         return dcerpc_lsa_OpenPolicy2(h,
 128                                       mem_ctx,
 129                                       srv_name_slash,
 130                                       &attr,
 131                                       des_access,
 132                                       pol,
 133                                       result);
 134 }
 135
 136 /** Open a LSA policy handle
 137   *
 138   * @param cli Handle on an initialised SMB connection
 139   */
 140
 141 NTSTATUS rpccli_lsa_open_policy2(struct rpc_pipe_client *cli,
 142                                  TALLOC_CTX *mem_ctx, bool sec_qos,
 143                                  uint32 des_access, struct policy_handle *pol)
 144 {
 145         NTSTATUS status;
 146         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 147
 148         status = dcerpc_lsa_open_policy2(cli->binding_handle,
 149                                          mem_ctx,
 150                                          cli->srv_name_slash,
 151                                          sec_qos,
 152                                          des_access,
 153                                          pol,
 154                                          &result);
 155         if (!NT_STATUS_IS_OK(status)) {
 156                 return status;
 157         }
 158
 159         return result;
 160 }
 161
 162 /* Lookup a list of sids
 163  *
 164  * internal version withOUT memory allocation of the target arrays.
 165  * this assumes sufficiently sized arrays to store domains, names and types. */
 166
 167 static NTSTATUS dcerpc_lsa_lookup_sids_noalloc(struct dcerpc_binding_handle *h,
 168                                                TALLOC_CTX *mem_ctx,
 169                                                TALLOC_CTX *domains_ctx,
 170                                                TALLOC_CTX *names_ctx,
 171                                                struct policy_handle *pol,
 172                                                int num_sids,
 173                                                const struct dom_sid *sids,
 174                                                char **domains,
 175                                                char **names,
 176                                                enum lsa_SidType *types,
 177                                                bool use_lookupsids3,
 178                                                NTSTATUS *presult)
 179 {
 180         NTSTATUS status = NT_STATUS_OK;
 181         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 182         struct lsa_SidArray sid_array;
 183         struct lsa_RefDomainList *ref_domains = NULL;
 184         struct lsa_TransNameArray lsa_names;
 185         enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
 186         uint32_t count = 0;
 187         int i;
 188
 189         ZERO_STRUCT(lsa_names);
 190
 191         sid_array.num_sids = num_sids;
 192         sid_array.sids = talloc_array(mem_ctx, struct lsa_SidPtr, num_sids);
 193         if (sid_array.sids == NULL) {
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196
 197         for (i = 0; i<num_sids; i++) {
 198                 sid_array.sids[i].sid = dom_sid_dup(mem_ctx, &sids[i]);
 199                 if (!sid_array.sids[i].sid) {
 200                         return NT_STATUS_NO_MEMORY;
 201                 }
 202         }
 203
 204         if (use_lookupsids3) {
 205                 struct lsa_TransNameArray2 lsa_names2;
 206                 uint32_t n;
 207
 208                 ZERO_STRUCT(lsa_names2);
 209
 210                 status = dcerpc_lsa_LookupSids3(h,
 211                                                 mem_ctx,
 212                                                 &sid_array,
 213                                                 &ref_domains,
 214                                                 &lsa_names2,
 215                                                 level,
 216                                                 &count,
 217                                                 LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
 218                                                 LSA_CLIENT_REVISION_2,
 219                                                 &result);
 220                 if (!NT_STATUS_IS_OK(status)) {
 221                         return status;
 222                 }
 223
 224                 if(!NT_STATUS_IS_ERR(result)) {
 225                         lsa_names.count = lsa_names2.count;
 226                         lsa_names.names = talloc_array(mem_ctx,
 227                                                        struct lsa_TranslatedName,
 228                                                        lsa_names.count);
 229                         if (lsa_names.names == NULL) {
 230                                 return NT_STATUS_NO_MEMORY;
 231                         }
 232                         for (n=0; n < lsa_names.count; n++) {
 233                                 lsa_names.names[n].sid_type     = lsa_names2.names[n].sid_type;
 234                                 lsa_names.names[n].name         = lsa_names2.names[n].name;
 235                                 lsa_names.names[n].sid_index    = lsa_names2.names[n].sid_index;
 236                         }
 237                 }
 238
 239         } else {
 240                 status = dcerpc_lsa_LookupSids(h,
 241                                                mem_ctx,
 242                                                pol,
 243                                                &sid_array,
 244                                                &ref_domains,
 245                                                &lsa_names,
 246                                                level,
 247                                                &count,
 248                                                &result);
 249         }
 250
 251         DEBUG(10, ("LSA_LOOKUPSIDS returned status: '%s', result: '%s', "
 252                    "mapped count = %d'\n",
 253                    nt_errstr(status), nt_errstr(result), count));
 254
 255         if (!NT_STATUS_IS_OK(status)) {
 256                 return status;
 257         }
 258
 259         if (!NT_STATUS_IS_OK(result) &&
 260             !NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) &&
 261             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
 262         {
 263                 *presult = result;
 264                 return status;
 265         }
 266
 267         /* Return output parameters */
 268         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) ||
 269             (count == 0))
 270         {
 271                 for (i = 0; i < num_sids; i++) {
 272                         (names)[i] = NULL;
 273                         (domains)[i] = NULL;
 274                         (types)[i] = SID_NAME_UNKNOWN;
 275                 }
 276                 *presult = NT_STATUS_NONE_MAPPED;
 277                 return status;
 278         }
 279
 280         for (i = 0; i < num_sids; i++) {
 281                 const char *name, *dom_name;
 282                 uint32_t dom_idx = lsa_names.names[i].sid_index;
 283
 284                 /* Translate optimised name through domain index array */
 285
 286                 if (dom_idx != 0xffffffff) {
 287
 288                         dom_name = ref_domains->domains[dom_idx].name.string;
 289                         name = lsa_names.names[i].name.string;
 290
 291                         if (name) {
 292                                 (names)[i] = talloc_strdup(names_ctx, name);
 293                                 if ((names)[i] == NULL) {
 294                                         DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
 295                                         *presult = NT_STATUS_UNSUCCESSFUL;
 296                                         return status;
 297                                 }
 298                         } else {
 299                                 (names)[i] = NULL;
 300                         }
 301                         domains[i] = talloc_strdup(domains_ctx,
 302                                                    dom_name ? dom_name : "");
 303                         (types)[i] = lsa_names.names[i].sid_type;
 304                         if ((domains)[i] == NULL) {
 305                                 DEBUG(0, ("cli_lsa_lookup_sids_noalloc(): out of memory\n"));
 306                                 *presult = NT_STATUS_UNSUCCESSFUL;
 307                                 return status;
 308                         }
 309
 310                 } else {
 311                         (names)[i] = NULL;
 312                         (domains)[i] = NULL;
 313                         (types)[i] = SID_NAME_UNKNOWN;
 314                 }
 315         }
 316
 317         *presult = NT_STATUS_OK;
 318         return status;
 319 }
 320
 321 /* Lookup a list of sids
 322  *
 323  * do it the right way: there is a limit (of 20480 for w2k3) entries
 324  * returned by this call. when the sids list contains more entries,
 325  * empty lists are returned. This version of lsa_lookup_sids passes
 326  * the list of sids in hunks of LOOKUP_SIDS_HUNK_SIZE to the lsa call. */
 327
 328 /* This constant defines the limit of how many sids to look up
 329  * in one call (maximum). the limit from the server side is
 330  * at 20480 for win2k3, but we keep it at a save 1000 for now. */
 331 #define LOOKUP_SIDS_HUNK_SIZE 1000
 332
 333 NTSTATUS dcerpc_lsa_lookup_sids_generic(struct dcerpc_binding_handle *h,
 334                                         TALLOC_CTX *mem_ctx,
 335                                         struct policy_handle *pol,
 336                                         int num_sids,
 337                                         const struct dom_sid *sids,
 338                                         char ***pdomains,
 339                                         char ***pnames,
 340                                         enum lsa_SidType **ptypes,
 341                                         bool use_lookupsids3,
 342                                         NTSTATUS *presult)
 343 {
 344         NTSTATUS status = NT_STATUS_OK;
 345         NTSTATUS result = NT_STATUS_OK;
 346         int sids_left = 0;
 347         int sids_processed = 0;
 348         const struct dom_sid *hunk_sids = sids;
 349         char **hunk_domains;
 350         char **hunk_names;
 351         enum lsa_SidType *hunk_types;
 352         char **domains = NULL;
 353         char **names = NULL;
 354         enum lsa_SidType *types = NULL;
 355         bool have_mapped = false;
 356         bool have_unmapped = false;
 357
 358         if (num_sids) {
 359                 if (!(domains = talloc_array(mem_ctx, char *, num_sids))) {
 360                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 361                         status = NT_STATUS_NO_MEMORY;
 362                         goto fail;
 363                 }
 364
 365                 if (!(names = talloc_array(mem_ctx, char *, num_sids))) {
 366                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 367                         status = NT_STATUS_NO_MEMORY;
 368                         goto fail;
 369                 }
 370
 371                 if (!(types = talloc_array(mem_ctx, enum lsa_SidType, num_sids))) {
 372                         DEBUG(0, ("rpccli_lsa_lookup_sids(): out of memory\n"));
 373                         status = NT_STATUS_NO_MEMORY;
 374                         goto fail;
 375                 }
 376         }
 377
 378         sids_left = num_sids;
 379         hunk_domains = domains;
 380         hunk_names = names;
 381         hunk_types = types;
 382
 383         while (sids_left > 0) {
 384                 int hunk_num_sids;
 385                 NTSTATUS hunk_result = NT_STATUS_UNSUCCESSFUL;
 386
 387                 hunk_num_sids = ((sids_left > LOOKUP_SIDS_HUNK_SIZE)
 388                                 ? LOOKUP_SIDS_HUNK_SIZE
 389                                 : sids_left);
 390
 391                 DEBUG(10, ("rpccli_lsa_lookup_sids: processing items "
 392                            "%d -- %d of %d.\n",
 393                            sids_processed,
 394                            sids_processed + hunk_num_sids - 1,
 395                            num_sids));
 396
 397                 status = dcerpc_lsa_lookup_sids_noalloc(h,
 398                                                         mem_ctx,
 399                                                         (TALLOC_CTX *)domains,
 400                                                         (TALLOC_CTX *)names,
 401                                                         pol,
 402                                                         hunk_num_sids,
 403                                                         hunk_sids,
 404                                                         hunk_domains,
 405                                                         hunk_names,
 406                                                         hunk_types,
 407                                                         use_lookupsids3,
 408                                                         &hunk_result);
 409                 if (!NT_STATUS_IS_OK(status)) {
 410                         goto fail;
 411                 }
 412
 413                 if (!NT_STATUS_IS_OK(hunk_result) &&
 414                     !NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED) &&
 415                     !NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED))
 416                 {
 417                         /* An actual error occured */
 418                         *presult = hunk_result;
 419                         goto fail;
 420                 }
 421
 422                 if (NT_STATUS_IS_OK(hunk_result)) {
 423                         have_mapped = true;
 424                 }
 425                 if (NT_STATUS_EQUAL(hunk_result, NT_STATUS_NONE_MAPPED)) {
 426                         have_unmapped = true;
 427                 }
 428                 if (NT_STATUS_EQUAL(hunk_result, STATUS_SOME_UNMAPPED)) {
 429                         int i;
 430                         for (i=0; i<hunk_num_sids; i++) {
 431                                 if (hunk_types[i] == SID_NAME_UNKNOWN) {
 432                                         have_unmapped = true;
 433                                 } else {
 434                                         have_mapped = true;
 435                                 }
 436                         }
 437                 }
 438
 439                 sids_left -= hunk_num_sids;
 440                 sids_processed += hunk_num_sids;
 441                 hunk_sids += hunk_num_sids;
 442                 hunk_domains += hunk_num_sids;
 443                 hunk_names += hunk_num_sids;
 444                 hunk_types += hunk_num_sids;
 445         }
 446
 447         *pdomains = domains;
 448         *pnames = names;
 449         *ptypes = types;
 450
 451         if (!have_mapped) {
 452                 result = NT_STATUS_NONE_MAPPED;
 453         }
 454         if (have_unmapped) {
 455                 result = STATUS_SOME_UNMAPPED;
 456         }
 457         *presult = result;
 458
 459         return status;
 460
 461 fail:
 462         TALLOC_FREE(domains);
 463         TALLOC_FREE(names);
 464         TALLOC_FREE(types);
 465
 466         return status;
 467 }
 468
 469 NTSTATUS dcerpc_lsa_lookup_sids(struct dcerpc_binding_handle *h,
 470                                 TALLOC_CTX *mem_ctx,
 471                                 struct policy_handle *pol,
 472                                 int num_sids,
 473                                 const struct dom_sid *sids,
 474                                 char ***pdomains,
 475                                 char ***pnames,
 476                                 enum lsa_SidType **ptypes,
 477                                 NTSTATUS *result)
 478 {
 479         return dcerpc_lsa_lookup_sids_generic(h,
 480                                               mem_ctx,
 481                                               pol,
 482                                               num_sids,
 483                                               sids,
 484                                               pdomains,
 485                                               pnames,
 486                                               ptypes,
 487                                               false,
 488                                               result);
 489 }
 490
 491 NTSTATUS rpccli_lsa_lookup_sids(struct rpc_pipe_client *cli,
 492                                 TALLOC_CTX *mem_ctx,
 493                                 struct policy_handle *pol,
 494                                 int num_sids,
 495                                 const struct dom_sid *sids,
 496                                 char ***pdomains,
 497                                 char ***pnames,
 498                                 enum lsa_SidType **ptypes)
 499 {
 500         NTSTATUS status;
 501         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 502
 503         status = dcerpc_lsa_lookup_sids_generic(cli->binding_handle,
 504                                                 mem_ctx,
 505                                                 pol,
 506                                                 num_sids,
 507                                                 sids,
 508                                                 pdomains,
 509                                                 pnames,
 510                                                 ptypes,
 511                                                 false,
 512                                                 &result);
 513         if (!NT_STATUS_IS_OK(status)) {
 514                 return status;
 515         }
 516
 517         return result;
 518 }
 519
 520 NTSTATUS dcerpc_lsa_lookup_sids3(struct dcerpc_binding_handle *h,
 521                                  TALLOC_CTX *mem_ctx,
 522                                  struct policy_handle *pol,
 523                                  int num_sids,
 524                                  const struct dom_sid *sids,
 525                                  char ***pdomains,
 526                                  char ***pnames,
 527                                  enum lsa_SidType **ptypes,
 528                                  NTSTATUS *result)
 529 {
 530         return dcerpc_lsa_lookup_sids_generic(h,
 531                                               mem_ctx,
 532                                               pol,
 533                                               num_sids,
 534                                               sids,
 535                                               pdomains,
 536                                               pnames,
 537                                               ptypes,
 538                                               true,
 539                                               result);
 540 }
 541
 542 /** Lookup a list of names */
 543
 544 static NTSTATUS dcerpc_lsa_lookup_names_generic(struct dcerpc_binding_handle *h,
 545                                                 TALLOC_CTX *mem_ctx,
 546                                                 struct policy_handle *pol,
 547                                                 uint32_t num_names,
 548                                                 const char **names,
 549                                                 const char ***dom_names,
 550                                                 enum lsa_LookupNamesLevel level,
 551                                                 struct dom_sid **sids,
 552                                                 enum lsa_SidType **types,
 553                                                 bool use_lookupnames4,
 554                                                 NTSTATUS *presult)
 555 {
 556         NTSTATUS status;
 557         struct lsa_String *lsa_names = NULL;
 558         struct lsa_RefDomainList *domains = NULL;
 559         struct lsa_TransSidArray sid_array;
 560         struct lsa_TransSidArray3 sid_array3;
 561         uint32_t count = 0;
 562         uint32_t i;
 563
 564         ZERO_STRUCT(sid_array);
 565         ZERO_STRUCT(sid_array3);
 566
 567         lsa_names = talloc_array(mem_ctx, struct lsa_String, num_names);
 568         if (lsa_names == NULL) {
 569                 return NT_STATUS_NO_MEMORY;
 570         }
 571
 572         for (i = 0; i < num_names; i++) {
 573                 init_lsa_String(&lsa_names[i], names[i]);
 574         }
 575
 576         if (use_lookupnames4) {
 577                 status = dcerpc_lsa_LookupNames4(h,
 578                                                  mem_ctx,
 579                                                  num_names,
 580                                                  lsa_names,
 581                                                  &domains,
 582                                                  &sid_array3,
 583                                                  level,
 584                                                  &count,
 585                                                  LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES,
 586                                                  LSA_CLIENT_REVISION_2,
 587                                                  presult);
 588         } else {
 589                 status = dcerpc_lsa_LookupNames(h,
 590                                                 mem_ctx,
 591                                                 pol,
 592                                                 num_names,
 593                                                 lsa_names,
 594                                                 &domains,
 595                                                 &sid_array,
 596                                                 level,
 597                                                 &count,
 598                                                 presult);
 599         }
 600         if (!NT_STATUS_IS_OK(status)) {
 601                 goto done;
 602         }
 603
 604         if (!NT_STATUS_IS_OK(*presult) &&
 605             !NT_STATUS_EQUAL(*presult, STATUS_SOME_UNMAPPED)) {
 606                 /* An actual error occured */
 607                 goto done;
 608         }
 609
 610         /* Return output parameters */
 611         if (count == 0) {
 612                 *presult = NT_STATUS_NONE_MAPPED;
 613                 goto done;
 614         }
 615
 616         if (num_names) {
 617                 if (!((*sids = talloc_array(mem_ctx, struct dom_sid, num_names)))) {
 618                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 619                         *presult = NT_STATUS_NO_MEMORY;
 620                         goto done;
 621                 }
 622
 623                 if (!((*types = talloc_array(mem_ctx, enum lsa_SidType, num_names)))) {
 624                         DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 625                         *presult = NT_STATUS_NO_MEMORY;
 626                         goto done;
 627                 }
 628
 629                 if (dom_names != NULL) {
 630                         *dom_names = talloc_array(mem_ctx, const char *, num_names);
 631                         if (*dom_names == NULL) {
 632                                 DEBUG(0, ("cli_lsa_lookup_sids(): out of memory\n"));
 633                                 *presult = NT_STATUS_NO_MEMORY;
 634                                 goto done;
 635                         }
 636                 }
 637         } else {
 638                 *sids = NULL;
 639                 *types = NULL;
 640                 if (dom_names != NULL) {
 641                         *dom_names = NULL;
 642                 }
 643         }
 644
 645         for (i = 0; i < num_names; i++) {
 646                 uint32_t dom_idx;
 647                 struct dom_sid *sid = &(*sids)[i];
 648
 649                 if (use_lookupnames4) {
 650                         dom_idx         = sid_array3.sids[i].sid_index;
 651                         (*types)[i]     = sid_array3.sids[i].sid_type;
 652                 } else {
 653                         dom_idx         = sid_array.sids[i].sid_index;
 654                         (*types)[i]     = sid_array.sids[i].sid_type;
 655                 }
 656
 657                 /* Translate optimised sid through domain index array */
 658
 659                 if (dom_idx == 0xffffffff) {
 660                         /* Nothing to do, this is unknown */
 661                         ZERO_STRUCTP(sid);
 662                         (*types)[i] = SID_NAME_UNKNOWN;
 663                         continue;
 664                 }
 665
 666                 if (use_lookupnames4) {
 667                         sid_copy(sid, sid_array3.sids[i].sid);
 668                 } else {
 669                         sid_copy(sid, domains->domains[dom_idx].sid);
 670
 671                         if (sid_array.sids[i].rid != 0xffffffff) {
 672                                 sid_append_rid(sid, sid_array.sids[i].rid);
 673                         }
 674                 }
 675
 676                 if (dom_names == NULL) {
 677                         continue;
 678                 }
 679
 680                 (*dom_names)[i] = domains->domains[dom_idx].name.string;
 681         }
 682
 683  done:
 684         return status;
 685 }
 686
 687 NTSTATUS dcerpc_lsa_lookup_names(struct dcerpc_binding_handle *h,
 688                                  TALLOC_CTX *mem_ctx,
 689                                  struct policy_handle *pol,
 690                                  uint32_t num_names,
 691                                  const char **names,
 692                                  const char ***dom_names,
 693                                  enum lsa_LookupNamesLevel level,
 694                                  struct dom_sid **sids,
 695                                  enum lsa_SidType **types,
 696                                  NTSTATUS *result)
 697 {
 698         return dcerpc_lsa_lookup_names_generic(h,
 699                                                mem_ctx,
 700                                                pol,
 701                                                num_names,
 702                                                names,
 703                                                dom_names,
 704                                                level,
 705                                                sids,
 706                                                types,
 707                                                false,
 708                                                result);
 709 }
 710
 711 NTSTATUS rpccli_lsa_lookup_names(struct rpc_pipe_client *cli,
 712                                  TALLOC_CTX *mem_ctx,
 713                                  struct policy_handle *pol,
 714                                  int num_names,
 715                                  const char **names,
 716                                  const char ***dom_names,
 717                                  int level,
 718                                  struct dom_sid **sids,
 719                                  enum lsa_SidType **types)
 720 {
 721         NTSTATUS status;
 722         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 723
 724         status = dcerpc_lsa_lookup_names(cli->binding_handle,
 725                                          mem_ctx,
 726                                          pol,
 727                                          num_names,
 728                                          names,
 729                                          dom_names,
 730                                          level,
 731                                          sids,
 732                                          types,
 733                                          &result);
 734         if (!NT_STATUS_IS_OK(status)) {
 735                 return status;
 736         }
 737
 738         return result;
 739 }
 740
 741 NTSTATUS dcerpc_lsa_lookup_names4(struct dcerpc_binding_handle *h,
 742                                   TALLOC_CTX *mem_ctx,
 743                                   struct policy_handle *pol,
 744                                   uint32_t num_names,
 745                                   const char **names,
 746                                   const char ***dom_names,
 747                                   enum lsa_LookupNamesLevel level,
 748                                   struct dom_sid **sids,
 749                                   enum lsa_SidType **types,
 750                                   NTSTATUS *result)
 751 {
 752         return dcerpc_lsa_lookup_names_generic(h,
 753                                                mem_ctx,
 754                                                pol,
 755                                                num_names,
 756                                                names,
 757                                                dom_names,
 758                                                level,
 759                                                sids,
 760                                                types,
 761                                                true,
 762                                                result);
 763 }