diff options
Diffstat (limited to 'source4/rpc_server/samr')
| -rw-r--r-- | source4/rpc_server/samr/dcesrv_samr.c | 5365 | ||||
| -rw-r--r-- | source4/rpc_server/samr/dcesrv_samr.h | 88 | ||||
| -rw-r--r-- | source4/rpc_server/samr/samr_password.c | 833 |
3 files changed, 6286 insertions, 0 deletions
diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c new file mode 100644 index 0000000..b1342cb --- /dev/null +++ b/source4/rpc_server/samr/dcesrv_samr.c @@ -0,0 +1,5365 @@ +/* + Unix SMB/CIFS implementation. + + endpoint server for the samr pipe + + Copyright (C) Andrew Tridgell 2004 + Copyright (C) Volker Lendecke 2004 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005 + Copyright (C) Matthias Dieter Wallnöfer 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "librpc/gen_ndr/ndr_samr.h" +#include "rpc_server/dcerpc_server.h" +#include "rpc_server/common/common.h" +#include "rpc_server/samr/dcesrv_samr.h" +#include "system/time.h" +#include <ldb.h> +#include <ldb_errors.h> +#include "../libds/common/flags.h" +#include "dsdb/samdb/samdb.h" +#include "dsdb/common/util.h" +#include "libcli/ldap/ldap_ndr.h" +#include "libcli/security/security.h" +#include "rpc_server/samr/proto.h" +#include "../lib/util/util_ldb.h" +#include "param/param.h" +#include "lib/util/tsort.h" +#include "libds/common/flag_mapping.h" + +#undef strcasecmp + +#define DCESRV_INTERFACE_SAMR_BIND(context, iface) \ + dcesrv_interface_samr_bind(context, iface) +static NTSTATUS dcesrv_interface_samr_bind(struct dcesrv_connection_context *context, + const struct dcesrv_interface *iface) +{ + return dcesrv_interface_bind_reject_connect(context, iface); +} + +/* these query macros make samr_Query[User|Group|Alias]Info a bit easier to read */ + +#define QUERY_STRING(msg, field, attr) \ + info->field.string = ldb_msg_find_attr_as_string(msg, attr, ""); +#define QUERY_UINT(msg, field, attr) \ + info->field = ldb_msg_find_attr_as_uint(msg, attr, 0); +#define QUERY_RID(msg, field, attr) \ + info->field = samdb_result_rid_from_sid(mem_ctx, msg, attr, 0); +#define QUERY_UINT64(msg, field, attr) \ + info->field = ldb_msg_find_attr_as_uint64(msg, attr, 0); +#define QUERY_APASSC(msg, field, attr) \ + info->field = samdb_result_allow_password_change(sam_ctx, mem_ctx, \ + a_state->domain_state->domain_dn, msg, attr); +#define QUERY_BPWDCT(msg, field, attr) \ + info->field = samdb_result_effective_badPwdCount(sam_ctx, mem_ctx, \ + a_state->domain_state->domain_dn, msg); +#define QUERY_LHOURS(msg, field, attr) \ + info->field = samdb_result_logon_hours(mem_ctx, msg, attr); +#define QUERY_AFLAGS(msg, field, attr) \ + info->field = samdb_result_acct_flags(msg, attr); + + +/* these are used to make the Set[User|Group]Info code easier to follow */ + +#define SET_STRING(msg, field, attr) do { \ + struct ldb_message_element *set_el; \ + if (r->in.info->field.string == NULL) return NT_STATUS_INVALID_PARAMETER; \ + if (r->in.info->field.string[0] == '\0') { \ + if (ldb_msg_add_empty(msg, attr, LDB_FLAG_MOD_DELETE, NULL) != LDB_SUCCESS) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + } \ + if (ldb_msg_add_string(msg, attr, r->in.info->field.string) != LDB_SUCCESS) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + set_el = ldb_msg_find_element(msg, attr); \ + set_el->flags = LDB_FLAG_MOD_REPLACE; \ +} while (0) + +#define SET_UINT(msg, field, attr) do { \ + struct ldb_message_element *set_el; \ + if (samdb_msg_add_uint(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + set_el = ldb_msg_find_element(msg, attr); \ + set_el->flags = LDB_FLAG_MOD_REPLACE; \ +} while (0) + +#define SET_INT64(msg, field, attr) do { \ + struct ldb_message_element *set_el; \ + if (samdb_msg_add_int64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + set_el = ldb_msg_find_element(msg, attr); \ + set_el->flags = LDB_FLAG_MOD_REPLACE; \ +} while (0) + +#define SET_UINT64(msg, field, attr) do { \ + struct ldb_message_element *set_el; \ + if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != LDB_SUCCESS) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + set_el = ldb_msg_find_element(msg, attr); \ + set_el->flags = LDB_FLAG_MOD_REPLACE; \ +} while (0) + +/* Set account flags, discarding flags that cannot be set with SAMR */ +#define SET_AFLAGS(msg, field, attr) do { \ + struct ldb_message_element *set_el; \ + if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + set_el = ldb_msg_find_element(msg, attr); \ + set_el->flags = LDB_FLAG_MOD_REPLACE; \ +} while (0) + +#define SET_LHOURS(msg, field, attr) do { \ + struct ldb_message_element *set_el; \ + if (samdb_msg_add_logon_hours(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != LDB_SUCCESS) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + set_el = ldb_msg_find_element(msg, attr); \ + set_el->flags = LDB_FLAG_MOD_REPLACE; \ +} while (0) + +#define SET_PARAMETERS(msg, field, attr) do { \ + struct ldb_message_element *set_el; \ + if (r->in.info->field.length != 0) { \ + if (samdb_msg_add_parameters(sam_ctx, mem_ctx, msg, attr, &r->in.info->field) != LDB_SUCCESS) { \ + return NT_STATUS_NO_MEMORY; \ + } \ + set_el = ldb_msg_find_element(msg, attr); \ + set_el->flags = LDB_FLAG_MOD_REPLACE; \ + } \ +} while (0) + +/* + * Clear a GUID cache + */ +static void clear_guid_cache(struct samr_guid_cache *cache) +{ + cache->handle = 0; + cache->size = 0; + TALLOC_FREE(cache->entries); +} + +/* + * initialize a GUID cache + */ +static void initialize_guid_cache(struct samr_guid_cache *cache) +{ + cache->handle = 0; + cache->size = 0; + cache->entries = NULL; +} + +static NTSTATUS load_guid_cache( + struct samr_guid_cache *cache, + struct samr_domain_state *d_state, + unsigned int ldb_cnt, + struct ldb_message **res) +{ + NTSTATUS status = NT_STATUS_OK; + unsigned int i; + TALLOC_CTX *frame = talloc_stackframe(); + + clear_guid_cache(cache); + + /* + * Store the GUID's in the cache. + */ + cache->handle = 0; + cache->size = ldb_cnt; + cache->entries = talloc_array(d_state, struct GUID, ldb_cnt); + if (cache->entries == NULL) { + clear_guid_cache(cache); + status = NT_STATUS_NO_MEMORY; + goto exit; + } + + /* + * Extract a list of the GUIDs for all the matching objects + * we cache just the GUIDS to reduce the memory overhead of + * the result cache. + */ + for (i = 0; i < ldb_cnt; i++) { + cache->entries[i] = samdb_result_guid(res[i], "objectGUID"); + } +exit: + TALLOC_FREE(frame); + return status; +} + +/* + samr_Connect + + create a connection to the SAM database +*/ +static NTSTATUS dcesrv_samr_Connect(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_Connect *r) +{ + struct samr_connect_state *c_state; + struct dcesrv_handle *handle; + + ZERO_STRUCTP(r->out.connect_handle); + + c_state = talloc(mem_ctx, struct samr_connect_state); + if (!c_state) { + return NT_STATUS_NO_MEMORY; + } + + /* make sure the sam database is accessible */ + c_state->sam_ctx = dcesrv_samdb_connect_as_user(c_state, dce_call); + if (c_state->sam_ctx == NULL) { + talloc_free(c_state); + return NT_STATUS_INVALID_SYSTEM_SERVICE; + } + + handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_CONNECT); + if (!handle) { + talloc_free(c_state); + return NT_STATUS_NO_MEMORY; + } + + handle->data = talloc_steal(handle, c_state); + + c_state->access_mask = r->in.access_mask; + *r->out.connect_handle = handle->wire_handle; + + return NT_STATUS_OK; +} + + +/* + samr_Close +*/ +static NTSTATUS dcesrv_samr_Close(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_Close *r) +{ + struct dcesrv_handle *h; + + *r->out.handle = *r->in.handle; + + DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY); + + talloc_free(h); + + ZERO_STRUCTP(r->out.handle); + + return NT_STATUS_OK; +} + + +/* + samr_SetSecurity +*/ +static NTSTATUS dcesrv_samr_SetSecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetSecurity *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_QuerySecurity +*/ +static NTSTATUS dcesrv_samr_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QuerySecurity *r) +{ + struct dcesrv_handle *h; + struct sec_desc_buf *sd; + + *r->out.sdbuf = NULL; + + DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY); + + sd = talloc(mem_ctx, struct sec_desc_buf); + if (sd == NULL) { + return NT_STATUS_NO_MEMORY; + } + + sd->sd = samdb_default_security_descriptor(mem_ctx); + + *r->out.sdbuf = sd; + + return NT_STATUS_OK; +} + + +/* + samr_Shutdown + + we refuse this operation completely. If a admin wants to shutdown samr + in Samba then they should use the samba admin tools to disable the samr pipe +*/ +static NTSTATUS dcesrv_samr_Shutdown(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_Shutdown *r) +{ + return NT_STATUS_ACCESS_DENIED; +} + + +/* + samr_LookupDomain + + this maps from a domain name to a SID +*/ +static NTSTATUS dcesrv_samr_LookupDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_LookupDomain *r) +{ + struct samr_connect_state *c_state; + struct dcesrv_handle *h; + struct dom_sid *sid; + const char * const dom_attrs[] = { "objectSid", NULL}; + struct ldb_message **dom_msgs; + int ret; + + *r->out.sid = NULL; + + DCESRV_PULL_HANDLE(h, r->in.connect_handle, SAMR_HANDLE_CONNECT); + + c_state = h->data; + + if (r->in.domain_name->string == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + if (strcasecmp(r->in.domain_name->string, "BUILTIN") == 0) { + ret = gendb_search(c_state->sam_ctx, + mem_ctx, NULL, &dom_msgs, dom_attrs, + "(objectClass=builtinDomain)"); + } else if (strcasecmp_m(r->in.domain_name->string, lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx)) == 0) { + ret = gendb_search_dn(c_state->sam_ctx, + mem_ctx, ldb_get_default_basedn(c_state->sam_ctx), + &dom_msgs, dom_attrs); + } else { + return NT_STATUS_NO_SUCH_DOMAIN; + } + if (ret != 1) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + + sid = samdb_result_dom_sid(mem_ctx, dom_msgs[0], + "objectSid"); + + if (sid == NULL) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + + *r->out.sid = sid; + + return NT_STATUS_OK; +} + + +/* + samr_EnumDomains + + list the domains in the SAM +*/ +static NTSTATUS dcesrv_samr_EnumDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_EnumDomains *r) +{ + struct dcesrv_handle *h; + struct samr_SamArray *array; + uint32_t i, start_i; + + *r->out.resume_handle = 0; + *r->out.sam = NULL; + *r->out.num_entries = 0; + + DCESRV_PULL_HANDLE(h, r->in.connect_handle, SAMR_HANDLE_CONNECT); + + *r->out.resume_handle = 2; + + start_i = *r->in.resume_handle; + + if (start_i >= 2) { + /* search past end of list is not an error for this call */ + return NT_STATUS_OK; + } + + array = talloc(mem_ctx, struct samr_SamArray); + if (array == NULL) { + return NT_STATUS_NO_MEMORY; + } + + array->count = 0; + array->entries = NULL; + + array->entries = talloc_array(mem_ctx, struct samr_SamEntry, 2 - start_i); + if (array->entries == NULL) { + return NT_STATUS_NO_MEMORY; + } + + for (i=0;i<2-start_i;i++) { + array->entries[i].idx = start_i + i; + if (i == 0) { + array->entries[i].name.string = lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx); + } else { + array->entries[i].name.string = "BUILTIN"; + } + } + + *r->out.sam = array; + *r->out.num_entries = i; + array->count = *r->out.num_entries; + + return NT_STATUS_OK; +} + + +/* + samr_OpenDomain +*/ +static NTSTATUS dcesrv_samr_OpenDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_OpenDomain *r) +{ + struct dcesrv_handle *h_conn, *h_domain; + struct samr_connect_state *c_state; + struct samr_domain_state *d_state; + const char * const dom_attrs[] = { "cn", NULL}; + struct ldb_message **dom_msgs; + int ret; + unsigned int i; + + ZERO_STRUCTP(r->out.domain_handle); + + DCESRV_PULL_HANDLE(h_conn, r->in.connect_handle, SAMR_HANDLE_CONNECT); + + c_state = h_conn->data; + + if (r->in.sid == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + d_state = talloc(mem_ctx, struct samr_domain_state); + if (!d_state) { + return NT_STATUS_NO_MEMORY; + } + + d_state->domain_sid = talloc_steal(d_state, r->in.sid); + + if (dom_sid_equal(d_state->domain_sid, dom_sid_parse_talloc(mem_ctx, SID_BUILTIN))) { + d_state->builtin = true; + d_state->domain_name = "BUILTIN"; + } else { + d_state->builtin = false; + d_state->domain_name = lpcfg_sam_name(dce_call->conn->dce_ctx->lp_ctx); + } + + ret = gendb_search(c_state->sam_ctx, + mem_ctx, ldb_get_default_basedn(c_state->sam_ctx), &dom_msgs, dom_attrs, + "(objectSid=%s)", + ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid)); + + if (ret == 0) { + talloc_free(d_state); + return NT_STATUS_NO_SUCH_DOMAIN; + } else if (ret > 1) { + talloc_free(d_state); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } else if (ret == -1) { + talloc_free(d_state); + DEBUG(1, ("Failed to open domain %s: %s\n", dom_sid_string(mem_ctx, r->in.sid), ldb_errstring(c_state->sam_ctx))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + d_state->domain_dn = talloc_steal(d_state, dom_msgs[0]->dn); + d_state->role = lpcfg_server_role(dce_call->conn->dce_ctx->lp_ctx); + d_state->connect_state = talloc_reference(d_state, c_state); + d_state->sam_ctx = c_state->sam_ctx; + d_state->access_mask = r->in.access_mask; + d_state->domain_users_cached = NULL; + + d_state->lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + + for (i = 0; i < SAMR_LAST_CACHE; i++) { + initialize_guid_cache(&d_state->guid_caches[i]); + } + + h_domain = dcesrv_handle_create(dce_call, SAMR_HANDLE_DOMAIN); + if (!h_domain) { + talloc_free(d_state); + return NT_STATUS_NO_MEMORY; + } + + h_domain->data = talloc_steal(h_domain, d_state); + + *r->out.domain_handle = h_domain->wire_handle; + + return NT_STATUS_OK; +} + +/* + return DomInfo1 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo1(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo1 *info) +{ + info->min_password_length = + ldb_msg_find_attr_as_uint(dom_msgs[0], "minPwdLength", 0); + info->password_history_length = + ldb_msg_find_attr_as_uint(dom_msgs[0], "pwdHistoryLength", 0); + info->password_properties = + ldb_msg_find_attr_as_uint(dom_msgs[0], "pwdProperties", 0); + info->max_password_age = + ldb_msg_find_attr_as_int64(dom_msgs[0], "maxPwdAge", 0); + info->min_password_age = + ldb_msg_find_attr_as_int64(dom_msgs[0], "minPwdAge", 0); + + return NT_STATUS_OK; +} + +/* + return DomInfo2 +*/ +static NTSTATUS dcesrv_samr_info_DomGeneralInformation(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomGeneralInformation *info) +{ + size_t count = 0; + const enum ldb_scope scope = LDB_SCOPE_SUBTREE; + int ret = 0; + + /* MS-SAMR 2.2.4.1 - ReplicaSourceNodeName: "domainReplica" attribute */ + info->primary.string = ldb_msg_find_attr_as_string(dom_msgs[0], + "domainReplica", + ""); + + info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff", + 0x8000000000000000LL); + + info->oem_information.string = ldb_msg_find_attr_as_string(dom_msgs[0], + "oEMInformation", + ""); + info->domain_name.string = state->domain_name; + + info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount", + 0); + switch (state->role) { + case ROLE_ACTIVE_DIRECTORY_DC: + /* This pulls the NetBIOS name from the + cn=NTDS Settings,cn=<NETBIOS name of PDC>,.... + string */ + if (samdb_is_pdc(state->sam_ctx)) { + info->role = SAMR_ROLE_DOMAIN_PDC; + } else { + info->role = SAMR_ROLE_DOMAIN_BDC; + } + break; + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: + case ROLE_IPA_DC: + case ROLE_AUTO: + return NT_STATUS_INTERNAL_ERROR; + case ROLE_DOMAIN_MEMBER: + info->role = SAMR_ROLE_DOMAIN_MEMBER; + break; + case ROLE_STANDALONE: + info->role = SAMR_ROLE_STANDALONE; + break; + } + + /* + * Users are not meant to be in BUILTIN + * so to speed up the query we do not filter on domain_sid + */ + ret = dsdb_domain_count( + state->sam_ctx, + &count, + state->domain_dn, + NULL, + scope, + "(objectClass=user)"); + if (ret != LDB_SUCCESS || count > UINT32_MAX) { + goto error; + } + info->num_users = count; + + /* + * Groups are not meant to be in BUILTIN + * so to speed up the query we do not filter on domain_sid + */ + ret = dsdb_domain_count( + state->sam_ctx, + &count, + state->domain_dn, + NULL, + scope, + "(&(objectClass=group)(|(groupType=%d)(groupType=%d)))", + GTYPE_SECURITY_UNIVERSAL_GROUP, + GTYPE_SECURITY_GLOBAL_GROUP); + if (ret != LDB_SUCCESS || count > UINT32_MAX) { + goto error; + } + info->num_groups = count; + + ret = dsdb_domain_count( + state->sam_ctx, + &count, + state->domain_dn, + state->domain_sid, + scope, + "(&(objectClass=group)(|(groupType=%d)(groupType=%d)))", + GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, + GTYPE_SECURITY_DOMAIN_LOCAL_GROUP); + if (ret != LDB_SUCCESS || count > UINT32_MAX) { + goto error; + } + info->num_aliases = count; + + return NT_STATUS_OK; + +error: + if (count > UINT32_MAX) { + return NT_STATUS_INTEGER_OVERFLOW; + } + return dsdb_ldb_err_to_ntstatus(ret); + +} + +/* + return DomInfo3 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo3(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo3 *info) +{ + info->force_logoff_time = ldb_msg_find_attr_as_uint64(dom_msgs[0], "forceLogoff", + 0x8000000000000000LL); + + return NT_STATUS_OK; +} + +/* + return DomInfo4 +*/ +static NTSTATUS dcesrv_samr_info_DomOEMInformation(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomOEMInformation *info) +{ + info->oem_information.string = ldb_msg_find_attr_as_string(dom_msgs[0], + "oEMInformation", + ""); + + return NT_STATUS_OK; +} + +/* + return DomInfo5 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo5(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo5 *info) +{ + info->domain_name.string = state->domain_name; + + return NT_STATUS_OK; +} + +/* + return DomInfo6 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo6(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo6 *info) +{ + /* MS-SAMR 2.2.4.1 - ReplicaSourceNodeName: "domainReplica" attribute */ + info->primary.string = ldb_msg_find_attr_as_string(dom_msgs[0], + "domainReplica", + ""); + + return NT_STATUS_OK; +} + +/* + return DomInfo7 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo7(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo7 *info) +{ + + switch (state->role) { + case ROLE_ACTIVE_DIRECTORY_DC: + /* This pulls the NetBIOS name from the + cn=NTDS Settings,cn=<NETBIOS name of PDC>,.... + string */ + if (samdb_is_pdc(state->sam_ctx)) { + info->role = SAMR_ROLE_DOMAIN_PDC; + } else { + info->role = SAMR_ROLE_DOMAIN_BDC; + } + break; + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: + case ROLE_IPA_DC: + case ROLE_AUTO: + return NT_STATUS_INTERNAL_ERROR; + case ROLE_DOMAIN_MEMBER: + info->role = SAMR_ROLE_DOMAIN_MEMBER; + break; + case ROLE_STANDALONE: + info->role = SAMR_ROLE_STANDALONE; + break; + } + + return NT_STATUS_OK; +} + +/* + return DomInfo8 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo8(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo8 *info) +{ + info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount", + time(NULL)); + + info->domain_create_time = ldb_msg_find_attr_as_uint(dom_msgs[0], "creationTime", + 0x0LL); + + return NT_STATUS_OK; +} + +/* + return DomInfo9 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo9(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo9 *info) +{ + info->domain_server_state = DOMAIN_SERVER_ENABLED; + + return NT_STATUS_OK; +} + +/* + return DomInfo11 +*/ +static NTSTATUS dcesrv_samr_info_DomGeneralInformation2(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomGeneralInformation2 *info) +{ + NTSTATUS status; + status = dcesrv_samr_info_DomGeneralInformation(state, mem_ctx, dom_msgs, &info->general); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration", + -18000000000LL); + info->lockout_window = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockOutObservationWindow", + -18000000000LL); + info->lockout_threshold = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutThreshold", 0); + + return NT_STATUS_OK; +} + +/* + return DomInfo12 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo12(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo12 *info) +{ + info->lockout_duration = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutDuration", + -18000000000LL); + info->lockout_window = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockOutObservationWindow", + -18000000000LL); + info->lockout_threshold = ldb_msg_find_attr_as_int64(dom_msgs[0], "lockoutThreshold", 0); + + return NT_STATUS_OK; +} + +/* + return DomInfo13 +*/ +static NTSTATUS dcesrv_samr_info_DomInfo13(struct samr_domain_state *state, + TALLOC_CTX *mem_ctx, + struct ldb_message **dom_msgs, + struct samr_DomInfo13 *info) +{ + info->sequence_num = ldb_msg_find_attr_as_uint64(dom_msgs[0], "modifiedCount", + time(NULL)); + + info->domain_create_time = ldb_msg_find_attr_as_uint(dom_msgs[0], "creationTime", + 0x0LL); + + info->modified_count_at_last_promotion = 0; + + return NT_STATUS_OK; +} + +/* + samr_QueryDomainInfo +*/ +static NTSTATUS dcesrv_samr_QueryDomainInfo(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_QueryDomainInfo *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + union samr_DomainInfo *info; + + struct ldb_message **dom_msgs; + const char * const *attrs = NULL; + + *r->out.info = NULL; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + switch (r->in.level) { + case 1: + { + static const char * const attrs2[] = { "minPwdLength", + "pwdHistoryLength", + "pwdProperties", + "maxPwdAge", + "minPwdAge", + NULL }; + attrs = attrs2; + break; + } + case 2: + { + static const char * const attrs2[] = {"forceLogoff", + "oEMInformation", + "modifiedCount", + "domainReplica", + NULL}; + attrs = attrs2; + break; + } + case 3: + { + static const char * const attrs2[] = {"forceLogoff", + NULL}; + attrs = attrs2; + break; + } + case 4: + { + static const char * const attrs2[] = {"oEMInformation", + NULL}; + attrs = attrs2; + break; + } + case 5: + { + attrs = NULL; + break; + } + case 6: + { + static const char * const attrs2[] = { "domainReplica", + NULL }; + attrs = attrs2; + break; + } + case 7: + { + attrs = NULL; + break; + } + case 8: + { + static const char * const attrs2[] = { "modifiedCount", + "creationTime", + NULL }; + attrs = attrs2; + break; + } + case 9: + { + attrs = NULL; + break; + } + case 11: + { + static const char * const attrs2[] = { "oEMInformation", + "forceLogoff", + "modifiedCount", + "lockoutDuration", + "lockOutObservationWindow", + "lockoutThreshold", + NULL}; + attrs = attrs2; + break; + } + case 12: + { + static const char * const attrs2[] = { "lockoutDuration", + "lockOutObservationWindow", + "lockoutThreshold", + NULL}; + attrs = attrs2; + break; + } + case 13: + { + static const char * const attrs2[] = { "modifiedCount", + "creationTime", + NULL }; + attrs = attrs2; + break; + } + default: + { + return NT_STATUS_INVALID_INFO_CLASS; + } + } + + /* some levels don't need a search */ + if (attrs) { + int ret; + ret = gendb_search_dn(d_state->sam_ctx, mem_ctx, + d_state->domain_dn, &dom_msgs, attrs); + if (ret == 0) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + if (ret != 1) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + } + + /* allocate the info structure */ + info = talloc_zero(mem_ctx, union samr_DomainInfo); + if (info == NULL) { + return NT_STATUS_NO_MEMORY; + } + + *r->out.info = info; + + switch (r->in.level) { + case 1: + return dcesrv_samr_info_DomInfo1(d_state, mem_ctx, dom_msgs, + &info->info1); + case 2: + return dcesrv_samr_info_DomGeneralInformation(d_state, mem_ctx, dom_msgs, + &info->general); + case 3: + return dcesrv_samr_info_DomInfo3(d_state, mem_ctx, dom_msgs, + &info->info3); + case 4: + return dcesrv_samr_info_DomOEMInformation(d_state, mem_ctx, dom_msgs, + &info->oem); + case 5: + return dcesrv_samr_info_DomInfo5(d_state, mem_ctx, dom_msgs, + &info->info5); + case 6: + return dcesrv_samr_info_DomInfo6(d_state, mem_ctx, dom_msgs, + &info->info6); + case 7: + return dcesrv_samr_info_DomInfo7(d_state, mem_ctx, dom_msgs, + &info->info7); + case 8: + return dcesrv_samr_info_DomInfo8(d_state, mem_ctx, dom_msgs, + &info->info8); + case 9: + return dcesrv_samr_info_DomInfo9(d_state, mem_ctx, dom_msgs, + &info->info9); + case 11: + return dcesrv_samr_info_DomGeneralInformation2(d_state, mem_ctx, dom_msgs, + &info->general2); + case 12: + return dcesrv_samr_info_DomInfo12(d_state, mem_ctx, dom_msgs, + &info->info12); + case 13: + return dcesrv_samr_info_DomInfo13(d_state, mem_ctx, dom_msgs, + &info->info13); + default: + return NT_STATUS_INVALID_INFO_CLASS; + } +} + + +/* + samr_SetDomainInfo +*/ +static NTSTATUS dcesrv_samr_SetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetDomainInfo *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + struct ldb_message *msg; + int ret; + struct ldb_context *sam_ctx; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + sam_ctx = d_state->sam_ctx; + + msg = ldb_msg_new(mem_ctx); + if (msg == NULL) { + return NT_STATUS_NO_MEMORY; + } + + msg->dn = talloc_reference(mem_ctx, d_state->domain_dn); + if (!msg->dn) { + return NT_STATUS_NO_MEMORY; + } + + switch (r->in.level) { + case 1: + SET_UINT (msg, info1.min_password_length, "minPwdLength"); + SET_UINT (msg, info1.password_history_length, "pwdHistoryLength"); + SET_UINT (msg, info1.password_properties, "pwdProperties"); + SET_INT64 (msg, info1.max_password_age, "maxPwdAge"); + SET_INT64 (msg, info1.min_password_age, "minPwdAge"); + break; + case 3: + SET_UINT64 (msg, info3.force_logoff_time, "forceLogoff"); + break; + case 4: + SET_STRING(msg, oem.oem_information, "oEMInformation"); + break; + + case 6: + case 7: + case 9: + /* No op, we don't know where to set these */ + return NT_STATUS_OK; + + case 12: + /* + * It is not possible to set lockout_duration < lockout_window. + * (The test is the other way around since the negative numbers + * are stored...) + * + * TODO: + * This check should be moved to the backend, i.e. to some + * ldb module under dsdb/samdb/ldb_modules/ . + * + * This constraint is documented here for the samr rpc service: + * MS-SAMR 3.1.1.6 Attribute Constraints for Originating Updates + * http://msdn.microsoft.com/en-us/library/cc245667%28PROT.10%29.aspx + * + * And here for the ldap backend: + * MS-ADTS 3.1.1.5.3.2 Constraints + * http://msdn.microsoft.com/en-us/library/cc223462(PROT.10).aspx + */ + if (r->in.info->info12.lockout_duration > + r->in.info->info12.lockout_window) + { + return NT_STATUS_INVALID_PARAMETER; + } + SET_INT64 (msg, info12.lockout_duration, "lockoutDuration"); + SET_INT64 (msg, info12.lockout_window, "lockOutObservationWindow"); + SET_INT64 (msg, info12.lockout_threshold, "lockoutThreshold"); + break; + + default: + /* many info classes are not valid for SetDomainInfo */ + return NT_STATUS_INVALID_INFO_CLASS; + } + + /* modify the samdb record */ + ret = ldb_modify(sam_ctx, msg); + if (ret != LDB_SUCCESS) { + DEBUG(1,("Failed to modify record %s: %s\n", + ldb_dn_get_linearized(d_state->domain_dn), + ldb_errstring(sam_ctx))); + return dsdb_ldb_err_to_ntstatus(ret); + } + + return NT_STATUS_OK; +} + +/* + samr_CreateDomainGroup +*/ +static NTSTATUS dcesrv_samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_CreateDomainGroup *r) +{ + NTSTATUS status; + struct samr_domain_state *d_state; + struct samr_account_state *a_state; + struct dcesrv_handle *h; + const char *groupname; + struct dom_sid *group_sid; + struct ldb_dn *group_dn; + struct dcesrv_handle *g_handle; + + ZERO_STRUCTP(r->out.group_handle); + *r->out.rid = 0; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + if (d_state->builtin) { + DEBUG(5, ("Cannot create a domain group in the BUILTIN domain")); + return NT_STATUS_ACCESS_DENIED; + } + + groupname = r->in.name->string; + + if (groupname == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + status = dsdb_add_domain_group(d_state->sam_ctx, mem_ctx, groupname, &group_sid, &group_dn); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + a_state = talloc(mem_ctx, struct samr_account_state); + if (!a_state) { + return NT_STATUS_NO_MEMORY; + } + a_state->sam_ctx = d_state->sam_ctx; + a_state->access_mask = r->in.access_mask; + a_state->domain_state = talloc_reference(a_state, d_state); + a_state->account_dn = talloc_steal(a_state, group_dn); + + a_state->account_name = talloc_steal(a_state, groupname); + + /* create the policy handle */ + g_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_GROUP); + if (!g_handle) { + return NT_STATUS_NO_MEMORY; + } + + g_handle->data = talloc_steal(g_handle, a_state); + + *r->out.group_handle = g_handle->wire_handle; + *r->out.rid = group_sid->sub_auths[group_sid->num_auths-1]; + + return NT_STATUS_OK; +} + + +/* + comparison function for sorting SamEntry array +*/ +static int compare_SamEntry(struct samr_SamEntry *e1, struct samr_SamEntry *e2) +{ + return e1->idx - e2->idx; +} + +static int compare_msgRid(struct ldb_message **m1, struct ldb_message **m2) { + struct dom_sid *sid1 = NULL; + struct dom_sid *sid2 = NULL; + uint32_t rid1; + uint32_t rid2; + int res = 0; + NTSTATUS status; + TALLOC_CTX *frame = talloc_stackframe(); + + sid1 = samdb_result_dom_sid(frame, *m1, "objectSid"); + sid2 = samdb_result_dom_sid(frame, *m2, "objectSid"); + + /* + * If entries don't have a SID we want to sort them to the end of + * the list. + */ + if (sid1 == NULL && sid2 == NULL) { + res = 0; + goto exit; + } else if (sid2 == NULL) { + res = 1; + goto exit; + } else if (sid1 == NULL) { + res = -1; + goto exit; + } + + /* + * Get and compare the rids, if we fail to extract a rid treat it as a + * missing SID and sort to the end of the list + */ + status = dom_sid_split_rid(NULL, sid1, NULL, &rid1); + if (!NT_STATUS_IS_OK(status)) { + res = 1; + goto exit; + } + + status = dom_sid_split_rid(NULL, sid2, NULL, &rid2); + if (!NT_STATUS_IS_OK(status)) { + res = -1; + goto exit; + } + + if (rid1 == rid2) { + res = 0; + } + else if (rid1 > rid2) { + res = 1; + } + else { + res = -1; + } +exit: + TALLOC_FREE(frame); + return res; +} + +/* + samr_EnumDomainGroups +*/ +static NTSTATUS dcesrv_samr_EnumDomainGroups(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_EnumDomainGroups *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + struct ldb_message **res; + uint32_t i; + uint32_t count; + uint32_t results; + uint32_t max_entries; + uint32_t remaining_entries; + uint32_t resume_handle; + struct samr_SamEntry *entries; + const char * const attrs[] = { "objectSid", "sAMAccountName", NULL }; + const char * const cache_attrs[] = { "objectSid", "objectGUID", NULL }; + struct samr_SamArray *sam; + struct samr_guid_cache *cache = NULL; + + *r->out.resume_handle = 0; + *r->out.sam = NULL; + *r->out.num_entries = 0; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + cache = &d_state->guid_caches[SAMR_ENUM_DOMAIN_GROUPS_CACHE]; + + /* + * If the resume_handle is zero, query the database and cache the + * matching GUID's + */ + if (*r->in.resume_handle == 0) { + NTSTATUS status; + int ldb_cnt; + clear_guid_cache(cache); + /* + * search for all domain groups in this domain. + */ + ldb_cnt = samdb_search_domain( + d_state->sam_ctx, + mem_ctx, + d_state->domain_dn, + &res, + cache_attrs, + d_state->domain_sid, + "(&(|(groupType=%d)(groupType=%d))(objectClass=group))", + GTYPE_SECURITY_UNIVERSAL_GROUP, + GTYPE_SECURITY_GLOBAL_GROUP); + if (ldb_cnt < 0) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + /* + * Sort the results into RID order, while the spec states there + * is no order, Windows appears to sort the results by RID and + * so it is possible that there are clients that depend on + * this ordering + */ + TYPESAFE_QSORT(res, ldb_cnt, compare_msgRid); + + /* + * cache the sorted GUID's + */ + status = load_guid_cache(cache, d_state, ldb_cnt, res); + TALLOC_FREE(res); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + cache->handle = 0; + } + + + /* + * If the resume handle is out of range we return an empty response + * and invalidate the cache. + * + * From the specification: + * Servers SHOULD validate that EnumerationContext is an expected + * value for the server's implementation. Windows does NOT validate + * the input, though the result of malformed information merely results + * in inconsistent output to the client. + */ + if (*r->in.resume_handle >= cache->size) { + clear_guid_cache(cache); + sam = talloc(mem_ctx, struct samr_SamArray); + if (!sam) { + return NT_STATUS_NO_MEMORY; + } + sam->entries = NULL; + sam->count = 0; + + *r->out.sam = sam; + *r->out.resume_handle = 0; + return NT_STATUS_OK; + } + + + /* + * Calculate the number of entries to return limit by max_size. + * Note that we use the w2k3 element size value of 54 + */ + max_entries = 1 + (r->in.max_size/SAMR_ENUM_USERS_MULTIPLIER); + remaining_entries = cache->size - *r->in.resume_handle; + results = MIN(remaining_entries, max_entries); + + /* + * Process the list of result GUID's. + * Read the details of each object and populate the Entries + * for the current level. + */ + count = 0; + resume_handle = *r->in.resume_handle; + entries = talloc_array(mem_ctx, struct samr_SamEntry, results); + if (entries == NULL) { + clear_guid_cache(cache); + return NT_STATUS_NO_MEMORY; + } + for (i = 0; i < results; i++) { + struct dom_sid *objectsid; + uint32_t rid; + struct ldb_result *rec; + const uint32_t idx = *r->in.resume_handle + i; + int ret; + NTSTATUS status; + const char *name = NULL; + resume_handle++; + /* + * Read an object from disk using the GUID as the key + * + * If the object can not be read, or it does not have a SID + * it is ignored. + * + * As a consequence of this, if all the remaining GUID's + * have been deleted an empty result will be returned. + * i.e. even if the previous call returned a non zero + * resume_handle it is possible for no results to be returned. + * + */ + ret = dsdb_search_by_dn_guid(d_state->sam_ctx, + mem_ctx, + &rec, + &cache->entries[idx], + attrs, + 0); + if (ret == LDB_ERR_NO_SUCH_OBJECT) { + struct GUID_txt_buf guid_buf; + DBG_WARNING( + "GUID [%s] not found\n", + GUID_buf_string(&cache->entries[idx], &guid_buf)); + continue; + } else if (ret != LDB_SUCCESS) { + clear_guid_cache(cache); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + objectsid = samdb_result_dom_sid(mem_ctx, + rec->msgs[0], + "objectSID"); + if (objectsid == NULL) { + struct GUID_txt_buf guid_buf; + DBG_WARNING( + "objectSID for GUID [%s] not found\n", + GUID_buf_string(&cache->entries[idx], &guid_buf)); + continue; + } + status = dom_sid_split_rid(NULL, + objectsid, + NULL, + &rid); + if (!NT_STATUS_IS_OK(status)) { + struct dom_sid_buf sid_buf; + struct GUID_txt_buf guid_buf; + DBG_WARNING( + "objectSID [%s] for GUID [%s] invalid\n", + dom_sid_str_buf(objectsid, &sid_buf), + GUID_buf_string(&cache->entries[idx], &guid_buf)); + continue; + } + + entries[count].idx = rid; + name = ldb_msg_find_attr_as_string( + rec->msgs[0], "sAMAccountName", ""); + entries[count].name.string = talloc_strdup(entries, name); + count++; + } + + sam = talloc(mem_ctx, struct samr_SamArray); + if (!sam) { + clear_guid_cache(cache); + return NT_STATUS_NO_MEMORY; + } + + sam->entries = entries; + sam->count = count; + + *r->out.sam = sam; + *r->out.resume_handle = resume_handle; + *r->out.num_entries = count; + + /* + * Signal no more results by returning zero resume handle, + * the cache is also cleared at this point + */ + if (*r->out.resume_handle >= cache->size) { + *r->out.resume_handle = 0; + clear_guid_cache(cache); + return NT_STATUS_OK; + } + /* + * There are more results to be returned. + */ + return STATUS_MORE_ENTRIES; +} + + +/* + samr_CreateUser2 + + This call uses transactions to ensure we don't get a new conflicting + user while we are processing this, and to ensure the user either + completly exists, or does not. +*/ +static NTSTATUS dcesrv_samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_CreateUser2 *r) +{ + NTSTATUS status; + struct samr_domain_state *d_state; + struct samr_account_state *a_state; + struct dcesrv_handle *h; + struct ldb_dn *dn; + struct dom_sid *sid; + struct dcesrv_handle *u_handle; + const char *account_name; + + ZERO_STRUCTP(r->out.user_handle); + *r->out.access_granted = 0; + *r->out.rid = 0; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + if (d_state->builtin) { + DEBUG(5, ("Cannot create a user in the BUILTIN domain")); + return NT_STATUS_ACCESS_DENIED; + } else if (r->in.acct_flags == ACB_DOMTRUST) { + /* Domain trust accounts must be created by the LSA calls */ + return NT_STATUS_ACCESS_DENIED; + } + account_name = r->in.account_name->string; + + if (account_name == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + status = dsdb_add_user(d_state->sam_ctx, mem_ctx, account_name, r->in.acct_flags, NULL, + &sid, &dn); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + a_state = talloc(mem_ctx, struct samr_account_state); + if (!a_state) { + return NT_STATUS_NO_MEMORY; + } + a_state->sam_ctx = d_state->sam_ctx; + a_state->access_mask = r->in.access_mask; + a_state->domain_state = talloc_reference(a_state, d_state); + a_state->account_dn = talloc_steal(a_state, dn); + + a_state->account_name = talloc_steal(a_state, account_name); + if (!a_state->account_name) { + return NT_STATUS_NO_MEMORY; + } + + /* create the policy handle */ + u_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_USER); + if (!u_handle) { + return NT_STATUS_NO_MEMORY; + } + + u_handle->data = talloc_steal(u_handle, a_state); + + *r->out.user_handle = u_handle->wire_handle; + *r->out.access_granted = 0xf07ff; /* TODO: fix access mask calculations */ + + *r->out.rid = sid->sub_auths[sid->num_auths-1]; + + return NT_STATUS_OK; +} + + +/* + samr_CreateUser +*/ +static NTSTATUS dcesrv_samr_CreateUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_CreateUser *r) +{ + struct samr_CreateUser2 r2; + uint32_t access_granted = 0; + + + /* a simple wrapper around samr_CreateUser2 works nicely */ + + r2 = (struct samr_CreateUser2) { + .in.domain_handle = r->in.domain_handle, + .in.account_name = r->in.account_name, + .in.acct_flags = ACB_NORMAL, + .in.access_mask = r->in.access_mask, + .out.user_handle = r->out.user_handle, + .out.access_granted = &access_granted, + .out.rid = r->out.rid + }; + + return dcesrv_samr_CreateUser2(dce_call, mem_ctx, &r2); +} + +struct enum_dom_users_ctx { + struct samr_SamEntry *entries; + uint32_t num_entries; + uint32_t acct_flags; + struct dom_sid *domain_sid; +}; + +static int user_iterate_callback(struct ldb_request *req, + struct ldb_reply *ares); + +/* + * Iterate users and add all those that match a domain SID and pass an acct + * flags check to an array of SamEntry objects. + */ +static int user_iterate_callback(struct ldb_request *req, + struct ldb_reply *ares) +{ + struct enum_dom_users_ctx *ac =\ + talloc_get_type(req->context, struct enum_dom_users_ctx); + int ret = LDB_ERR_OPERATIONS_ERROR; + + if (!ares) { + return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR); + } + if (ares->error != LDB_SUCCESS) { + return ldb_request_done(req, ares->error); + } + + switch (ares->type) { + case LDB_REPLY_ENTRY: + { + struct ldb_message *msg = ares->message; + const struct ldb_val *val; + struct samr_SamEntry *ent; + struct dom_sid objectsid; + uint32_t rid; + size_t entries_array_len = 0; + NTSTATUS status; + ssize_t sid_size; + + if (ac->acct_flags && ((samdb_result_acct_flags(msg, NULL) & + ac->acct_flags) == 0)) { + ret = LDB_SUCCESS; + break; + } + + val = ldb_msg_find_ldb_val(msg, "objectSID"); + if (val == NULL) { + DBG_WARNING("objectSID for DN %s not found\n", + ldb_dn_get_linearized(msg->dn)); + ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR); + break; + } + + sid_size = sid_parse(val->data, val->length, &objectsid); + if (sid_size == -1) { + struct dom_sid_buf sid_buf; + DBG_WARNING("objectsid [%s] for DN [%s] invalid\n", + dom_sid_str_buf(&objectsid, &sid_buf), + ldb_dn_get_linearized(msg->dn)); + ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR); + break; + } + + if (!dom_sid_in_domain(ac->domain_sid, &objectsid)) { + /* Ignore if user isn't in the domain */ + ret = LDB_SUCCESS; + break; + } + + status = dom_sid_split_rid(ares, &objectsid, NULL, &rid); + if (!NT_STATUS_IS_OK(status)) { + struct dom_sid_buf sid_buf; + DBG_WARNING("Couldn't split RID from " + "SID [%s] of DN [%s]\n", + dom_sid_str_buf(&objectsid, &sid_buf), + ldb_dn_get_linearized(msg->dn)); + ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR); + break; + } + + entries_array_len = talloc_array_length(ac->entries); + if (ac->num_entries >= entries_array_len) { + if (entries_array_len * 2 < entries_array_len) { + ret = ldb_request_done(req, + LDB_ERR_OPERATIONS_ERROR); + break; + } + ac->entries = talloc_realloc(ac, + ac->entries, + struct samr_SamEntry, + entries_array_len * 2); + if (ac->entries == NULL) { + ret = ldb_request_done(req, + LDB_ERR_OPERATIONS_ERROR); + break; + } + } + + ent = &(ac->entries[ac->num_entries++]); + val = ldb_msg_find_ldb_val(msg, "samaccountname"); + if (val == NULL) { + DBG_WARNING("samaccountname attribute not found\n"); + ret = ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR); + break; + } + ent->name.string = talloc_steal(ac->entries, + (char *)val->data); + ent->idx = rid; + ret = LDB_SUCCESS; + break; + } + case LDB_REPLY_DONE: + { + if (ac->num_entries != 0 && + ac->num_entries != talloc_array_length(ac->entries)) { + ac->entries = talloc_realloc(ac, + ac->entries, + struct samr_SamEntry, + ac->num_entries); + if (ac->entries == NULL) { + ret = ldb_request_done(req, + LDB_ERR_OPERATIONS_ERROR); + break; + } + } + ret = ldb_request_done(req, LDB_SUCCESS); + break; + } + case LDB_REPLY_REFERRAL: + { + ret = LDB_SUCCESS; + break; + } + default: + /* Doesn't happen */ + ret = LDB_ERR_OPERATIONS_ERROR; + } + TALLOC_FREE(ares); + + return ret; +} + +/* + * samr_EnumDomainUsers + * The previous implementation did an initial search and stored a list of + * matching GUIDs on the connection handle's domain state, then did direct + * GUID lookups for each record in a page indexed by resume_handle. That + * approach was memory efficient, requiring only 16 bytes per record, but + * was too slow for winbind which needs this RPC call for getpwent. + * + * Now we use an iterate pattern to populate a cached list of the rids and + * names for each record. This improves runtime performance but requires + * about 200 bytes per record which will mean for a 100k database we use + * about 2MB, which is fine. The speedup achieved by this new approach is + * around 50%. + */ +static NTSTATUS dcesrv_samr_EnumDomainUsers(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_EnumDomainUsers *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + uint32_t results; + uint32_t max_entries; + uint32_t num_entries; + uint32_t remaining_entries; + struct samr_SamEntry *entries; + const char * const attrs[] = { "objectSid", "sAMAccountName", + "userAccountControl", NULL }; + struct samr_SamArray *sam; + struct ldb_request *req; + + *r->out.resume_handle = 0; + *r->out.sam = NULL; + *r->out.num_entries = 0; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + entries = d_state->domain_users_cached; + + /* + * If the resume_handle is zero, query the database and cache the + * matching entries. + */ + if (*r->in.resume_handle == 0) { + int ret; + struct enum_dom_users_ctx *ac; + if (entries != NULL) { + talloc_free(entries); + d_state->domain_users_cached = NULL; + } + + ac = talloc(mem_ctx, struct enum_dom_users_ctx); + ac->num_entries = 0; + ac->domain_sid = d_state->domain_sid; + ac->entries = talloc_array(ac, + struct samr_SamEntry, + 100); + if (ac->entries == NULL) { + talloc_free(ac); + return NT_STATUS_NO_MEMORY; + } + ac->acct_flags = r->in.acct_flags; + + ret = ldb_build_search_req(&req, + d_state->sam_ctx, + mem_ctx, + d_state->domain_dn, + LDB_SCOPE_SUBTREE, + "(objectClass=user)", + attrs, + NULL, + ac, + user_iterate_callback, + NULL); + if (ret != LDB_SUCCESS) { + talloc_free(ac); + return dsdb_ldb_err_to_ntstatus(ret); + } + + ret = ldb_request(d_state->sam_ctx, req); + if (ret != LDB_SUCCESS) { + talloc_free(ac); + return dsdb_ldb_err_to_ntstatus(ret); + } + + ret = ldb_wait(req->handle, LDB_WAIT_ALL); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + if (ac->num_entries == 0) { + DBG_WARNING("No users in domain %s", + ldb_dn_get_linearized(d_state->domain_dn)); + talloc_free(ac); + return NT_STATUS_OK; + } + + entries = talloc_steal(d_state, ac->entries); + d_state->domain_users_cached = entries; + num_entries = ac->num_entries; + talloc_free(ac); + + /* + * Sort the entries into RID order, while the spec states there + * is no order, Windows appears to sort the results by RID and + * so it is possible that there are clients that depend on + * this ordering + */ + TYPESAFE_QSORT(entries, num_entries, compare_SamEntry); + } else { + num_entries = talloc_array_length(entries); + } + + /* + * If the resume handle is out of range we return an empty response + * and invalidate the cache. + * + * From the specification: + * Servers SHOULD validate that EnumerationContext is an expected + * value for the server's implementation. Windows does NOT validate + * the input, though the result of malformed information merely results + * in inconsistent output to the client. + */ + if (*r->in.resume_handle >= num_entries) { + talloc_free(entries); + d_state->domain_users_cached = NULL; + sam = talloc(mem_ctx, struct samr_SamArray); + if (!sam) { + return NT_STATUS_NO_MEMORY; + } + sam->entries = NULL; + sam->count = 0; + + *r->out.sam = sam; + *r->out.resume_handle = 0; + return NT_STATUS_OK; + } + + /* + * Calculate the number of entries to return limit by max_size. + * Note that we use the w2k3 element size value of 54 + */ + max_entries = 1 + (r->in.max_size / SAMR_ENUM_USERS_MULTIPLIER); + remaining_entries = num_entries - *r->in.resume_handle; + results = MIN(remaining_entries, max_entries); + + sam = talloc(mem_ctx, struct samr_SamArray); + if (!sam) { + d_state->domain_users_cached = NULL; + return NT_STATUS_NO_MEMORY; + } + + sam->entries = entries + *r->in.resume_handle; + sam->count = results; + + *r->out.sam = sam; + *r->out.resume_handle = *r->in.resume_handle + results; + *r->out.num_entries = results; + + /* + * Signal no more results by returning zero resume handle, + * the cache is also cleared at this point + */ + if (*r->out.resume_handle >= num_entries) { + *r->out.resume_handle = 0; + return NT_STATUS_OK; + } + /* + * There are more results to be returned. + */ + return STATUS_MORE_ENTRIES; +} + + +/* + samr_CreateDomAlias +*/ +static NTSTATUS dcesrv_samr_CreateDomAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_CreateDomAlias *r) +{ + struct samr_domain_state *d_state; + struct samr_account_state *a_state; + struct dcesrv_handle *h; + const char *alias_name; + struct dom_sid *sid; + struct dcesrv_handle *a_handle; + struct ldb_dn *dn; + NTSTATUS status; + + ZERO_STRUCTP(r->out.alias_handle); + *r->out.rid = 0; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + if (d_state->builtin) { + DEBUG(5, ("Cannot create a domain alias in the BUILTIN domain")); + return NT_STATUS_ACCESS_DENIED; + } + + alias_name = r->in.alias_name->string; + + if (alias_name == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + status = dsdb_add_domain_alias(d_state->sam_ctx, mem_ctx, alias_name, &sid, &dn); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + a_state = talloc(mem_ctx, struct samr_account_state); + if (!a_state) { + return NT_STATUS_NO_MEMORY; + } + + a_state->sam_ctx = d_state->sam_ctx; + a_state->access_mask = r->in.access_mask; + a_state->domain_state = talloc_reference(a_state, d_state); + a_state->account_dn = talloc_steal(a_state, dn); + + a_state->account_name = talloc_steal(a_state, alias_name); + + /* create the policy handle */ + a_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_ALIAS); + if (a_handle == NULL) + return NT_STATUS_NO_MEMORY; + + a_handle->data = talloc_steal(a_handle, a_state); + + *r->out.alias_handle = a_handle->wire_handle; + + *r->out.rid = sid->sub_auths[sid->num_auths-1]; + + return NT_STATUS_OK; +} + + +/* + samr_EnumDomainAliases +*/ +static NTSTATUS dcesrv_samr_EnumDomainAliases(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_EnumDomainAliases *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + struct ldb_message **res; + int i, ldb_cnt; + uint32_t first, count; + struct samr_SamEntry *entries; + const char * const attrs[] = { "objectSid", "sAMAccountName", NULL }; + struct samr_SamArray *sam; + + *r->out.resume_handle = 0; + *r->out.sam = NULL; + *r->out.num_entries = 0; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + /* search for all domain aliases in this domain. This could possibly be + cached and resumed based on resume_key */ + ldb_cnt = samdb_search_domain(d_state->sam_ctx, mem_ctx, NULL, + &res, attrs, + d_state->domain_sid, + "(&(|(grouptype=%d)(grouptype=%d)))" + "(objectclass=group))", + GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, + GTYPE_SECURITY_DOMAIN_LOCAL_GROUP); + if (ldb_cnt < 0) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + /* convert to SamEntry format */ + entries = talloc_array(mem_ctx, struct samr_SamEntry, ldb_cnt); + if (!entries) { + return NT_STATUS_NO_MEMORY; + } + + count = 0; + + for (i=0;i<ldb_cnt;i++) { + struct dom_sid *alias_sid; + + alias_sid = samdb_result_dom_sid(mem_ctx, res[i], + "objectSid"); + + if (alias_sid == NULL) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + entries[count].idx = + alias_sid->sub_auths[alias_sid->num_auths-1]; + entries[count].name.string = + ldb_msg_find_attr_as_string(res[i], "sAMAccountName", ""); + count += 1; + } + + /* sort the results by rid */ + TYPESAFE_QSORT(entries, count, compare_SamEntry); + + /* find the first entry to return */ + for (first=0; + first<count && entries[first].idx <= *r->in.resume_handle; + first++) ; + + /* return the rest, limit by max_size. Note that we + use the w2k3 element size value of 54 */ + *r->out.num_entries = count - first; + *r->out.num_entries = MIN(*r->out.num_entries, + 1+(r->in.max_size/SAMR_ENUM_USERS_MULTIPLIER)); + + sam = talloc(mem_ctx, struct samr_SamArray); + if (!sam) { + return NT_STATUS_NO_MEMORY; + } + + sam->entries = entries+first; + sam->count = *r->out.num_entries; + + *r->out.sam = sam; + + if (first == count) { + return NT_STATUS_OK; + } + + if (*r->out.num_entries < count - first) { + *r->out.resume_handle = + entries[first+*r->out.num_entries-1].idx; + return STATUS_MORE_ENTRIES; + } + + return NT_STATUS_OK; +} + + +/* + samr_GetAliasMembership +*/ +static NTSTATUS dcesrv_samr_GetAliasMembership(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetAliasMembership *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + char *filter; + const char * const attrs[] = { "objectSid", NULL }; + struct ldb_message **res; + uint32_t i; + int count = 0; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + filter = talloc_asprintf(mem_ctx, + "(&(|(grouptype=%d)(grouptype=%d))" + "(objectclass=group)(|", + GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, + GTYPE_SECURITY_DOMAIN_LOCAL_GROUP); + if (filter == NULL) { + return NT_STATUS_NO_MEMORY; + } + + for (i=0; i<r->in.sids->num_sids; i++) { + struct dom_sid_buf buf; + + filter = talloc_asprintf_append( + filter, + "(member=<SID=%s>)", + dom_sid_str_buf(r->in.sids->sids[i].sid, &buf)); + + if (filter == NULL) { + return NT_STATUS_NO_MEMORY; + } + } + + /* Find out if we had at least one valid member SID passed - otherwise + * just skip the search. */ + if (strstr(filter, "member") != NULL) { + count = samdb_search_domain(d_state->sam_ctx, mem_ctx, NULL, + &res, attrs, d_state->domain_sid, + "%s))", filter); + if (count < 0) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + } + + r->out.rids->count = 0; + r->out.rids->ids = talloc_array(mem_ctx, uint32_t, count); + if (r->out.rids->ids == NULL) + return NT_STATUS_NO_MEMORY; + + for (i=0; i<count; i++) { + struct dom_sid *alias_sid; + + alias_sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid"); + if (alias_sid == NULL) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + r->out.rids->ids[r->out.rids->count] = + alias_sid->sub_auths[alias_sid->num_auths-1]; + r->out.rids->count += 1; + } + + return NT_STATUS_OK; +} + + +/* + samr_LookupNames +*/ +static NTSTATUS dcesrv_samr_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_LookupNames *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + uint32_t i, num_mapped; + NTSTATUS status = NT_STATUS_OK; + const char * const attrs[] = { "sAMAccountType", "objectSid", NULL }; + int count; + + ZERO_STRUCTP(r->out.rids); + ZERO_STRUCTP(r->out.types); + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + if (r->in.num_names == 0) { + return NT_STATUS_OK; + } + + r->out.rids->ids = talloc_array(mem_ctx, uint32_t, r->in.num_names); + r->out.types->ids = talloc_array(mem_ctx, uint32_t, r->in.num_names); + if (!r->out.rids->ids || !r->out.types->ids) { + return NT_STATUS_NO_MEMORY; + } + r->out.rids->count = r->in.num_names; + r->out.types->count = r->in.num_names; + + num_mapped = 0; + + for (i=0;i<r->in.num_names;i++) { + struct ldb_message **res; + struct dom_sid *sid; + uint32_t atype, rtype; + + r->out.rids->ids[i] = 0; + r->out.types->ids[i] = SID_NAME_UNKNOWN; + + count = gendb_search(d_state->sam_ctx, mem_ctx, d_state->domain_dn, &res, attrs, + "sAMAccountName=%s", + ldb_binary_encode_string(mem_ctx, r->in.names[i].string)); + if (count != 1) { + status = STATUS_SOME_UNMAPPED; + continue; + } + + sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid"); + if (sid == NULL) { + status = STATUS_SOME_UNMAPPED; + continue; + } + + atype = ldb_msg_find_attr_as_uint(res[0], "sAMAccountType", 0); + if (atype == 0) { + status = STATUS_SOME_UNMAPPED; + continue; + } + + rtype = ds_atype_map(atype); + + if (rtype == SID_NAME_UNKNOWN) { + status = STATUS_SOME_UNMAPPED; + continue; + } + + r->out.rids->ids[i] = sid->sub_auths[sid->num_auths-1]; + r->out.types->ids[i] = rtype; + num_mapped++; + } + + if (num_mapped == 0) { + return NT_STATUS_NONE_MAPPED; + } + return status; +} + + +/* + samr_LookupRids +*/ +static NTSTATUS dcesrv_samr_LookupRids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_LookupRids *r) +{ + NTSTATUS status; + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + const char **names; + struct lsa_String *lsa_names; + enum lsa_SidType *ids; + + ZERO_STRUCTP(r->out.names); + ZERO_STRUCTP(r->out.types); + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + if (r->in.num_rids == 0) + return NT_STATUS_OK; + + lsa_names = talloc_zero_array(mem_ctx, struct lsa_String, r->in.num_rids); + names = talloc_zero_array(mem_ctx, const char *, r->in.num_rids); + ids = talloc_zero_array(mem_ctx, enum lsa_SidType, r->in.num_rids); + + if ((lsa_names == NULL) || (names == NULL) || (ids == NULL)) + return NT_STATUS_NO_MEMORY; + + r->out.names->names = lsa_names; + r->out.names->count = r->in.num_rids; + + r->out.types->ids = (uint32_t *) ids; + r->out.types->count = r->in.num_rids; + + status = dsdb_lookup_rids(d_state->sam_ctx, mem_ctx, d_state->domain_sid, + r->in.num_rids, r->in.rids, names, ids); + if (NT_STATUS_IS_OK(status) || NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) || NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) { + uint32_t i; + for (i = 0; i < r->in.num_rids; i++) { + lsa_names[i].string = names[i]; + } + } + return status; +} + + +/* + samr_OpenGroup +*/ +static NTSTATUS dcesrv_samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_OpenGroup *r) +{ + struct samr_domain_state *d_state; + struct samr_account_state *a_state; + struct dcesrv_handle *h; + const char *groupname; + struct dom_sid *sid; + struct ldb_message **msgs; + struct dcesrv_handle *g_handle; + const char * const attrs[2] = { "sAMAccountName", NULL }; + int ret; + + ZERO_STRUCTP(r->out.group_handle); + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + /* form the group SID */ + sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid); + if (!sid) { + return NT_STATUS_NO_MEMORY; + } + + /* search for the group record */ + if (d_state->builtin) { + ret = gendb_search(d_state->sam_ctx, + mem_ctx, d_state->domain_dn, &msgs, attrs, + "(&(objectSid=%s)(objectClass=group)" + "(groupType=%d))", + ldap_encode_ndr_dom_sid(mem_ctx, sid), + GTYPE_SECURITY_BUILTIN_LOCAL_GROUP); + } else { + ret = gendb_search(d_state->sam_ctx, + mem_ctx, d_state->domain_dn, &msgs, attrs, + "(&(objectSid=%s)(objectClass=group)" + "(|(groupType=%d)(groupType=%d)))", + ldap_encode_ndr_dom_sid(mem_ctx, sid), + GTYPE_SECURITY_UNIVERSAL_GROUP, + GTYPE_SECURITY_GLOBAL_GROUP); + } + if (ret == 0) { + return NT_STATUS_NO_SUCH_GROUP; + } + if (ret != 1) { + DEBUG(0,("Found %d records matching sid %s\n", + ret, dom_sid_string(mem_ctx, sid))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + groupname = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL); + if (groupname == NULL) { + DEBUG(0,("sAMAccountName field missing for sid %s\n", + dom_sid_string(mem_ctx, sid))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + a_state = talloc(mem_ctx, struct samr_account_state); + if (!a_state) { + return NT_STATUS_NO_MEMORY; + } + a_state->sam_ctx = d_state->sam_ctx; + a_state->access_mask = r->in.access_mask; + a_state->domain_state = talloc_reference(a_state, d_state); + a_state->account_dn = talloc_steal(a_state, msgs[0]->dn); + a_state->account_sid = talloc_steal(a_state, sid); + a_state->account_name = talloc_strdup(a_state, groupname); + if (!a_state->account_name) { + return NT_STATUS_NO_MEMORY; + } + + /* create the policy handle */ + g_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_GROUP); + if (!g_handle) { + return NT_STATUS_NO_MEMORY; + } + + g_handle->data = talloc_steal(g_handle, a_state); + + *r->out.group_handle = g_handle->wire_handle; + + return NT_STATUS_OK; +} + +/* + samr_QueryGroupInfo +*/ +static NTSTATUS dcesrv_samr_QueryGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryGroupInfo *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct ldb_message *msg, **res; + const char * const attrs[4] = { "sAMAccountName", "description", + "numMembers", NULL }; + int ret; + union samr_GroupInfo *info; + + *r->out.info = NULL; + + DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP); + + a_state = h->data; + + /* pull all the group attributes */ + ret = gendb_search_dn(a_state->sam_ctx, mem_ctx, + a_state->account_dn, &res, attrs); + if (ret == 0) { + return NT_STATUS_NO_SUCH_GROUP; + } + if (ret != 1) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + msg = res[0]; + + /* allocate the info structure */ + info = talloc_zero(mem_ctx, union samr_GroupInfo); + if (info == NULL) { + return NT_STATUS_NO_MEMORY; + } + + /* Fill in the level */ + switch (r->in.level) { + case GROUPINFOALL: + QUERY_STRING(msg, all.name, "sAMAccountName"); + info->all.attributes = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED; /* Do like w2k3 */ + QUERY_UINT (msg, all.num_members, "numMembers") + QUERY_STRING(msg, all.description, "description"); + break; + case GROUPINFONAME: + QUERY_STRING(msg, name, "sAMAccountName"); + break; + case GROUPINFOATTRIBUTES: + info->attributes.attributes = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED; /* Do like w2k3 */ + break; + case GROUPINFODESCRIPTION: + QUERY_STRING(msg, description, "description"); + break; + case GROUPINFOALL2: + QUERY_STRING(msg, all2.name, "sAMAccountName"); + info->all.attributes = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED; /* Do like w2k3 */ + QUERY_UINT (msg, all2.num_members, "numMembers") + QUERY_STRING(msg, all2.description, "description"); + break; + default: + talloc_free(info); + return NT_STATUS_INVALID_INFO_CLASS; + } + + *r->out.info = info; + + return NT_STATUS_OK; +} + + +/* + samr_SetGroupInfo +*/ +static NTSTATUS dcesrv_samr_SetGroupInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetGroupInfo *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *g_state; + struct ldb_message *msg; + int ret; + + DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP); + + g_state = h->data; + + msg = ldb_msg_new(mem_ctx); + if (msg == NULL) { + return NT_STATUS_NO_MEMORY; + } + + msg->dn = ldb_dn_copy(mem_ctx, g_state->account_dn); + if (!msg->dn) { + return NT_STATUS_NO_MEMORY; + } + + switch (r->in.level) { + case GROUPINFODESCRIPTION: + SET_STRING(msg, description, "description"); + break; + case GROUPINFONAME: + /* On W2k3 this does not change the name, it changes the + * sAMAccountName attribute */ + SET_STRING(msg, name, "sAMAccountName"); + break; + case GROUPINFOATTRIBUTES: + /* This does not do anything obviously visible in W2k3 LDAP */ + return NT_STATUS_OK; + default: + return NT_STATUS_INVALID_INFO_CLASS; + } + + /* modify the samdb record */ + ret = ldb_modify(g_state->sam_ctx, msg); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + return NT_STATUS_OK; +} + + +/* + samr_AddGroupMember +*/ +static NTSTATUS dcesrv_samr_AddGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_AddGroupMember *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct samr_domain_state *d_state; + struct ldb_message *mod; + struct dom_sid *membersid; + const char *memberdn; + struct ldb_result *res; + const char * const attrs[] = { NULL }; + int ret; + + DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP); + + a_state = h->data; + d_state = a_state->domain_state; + + membersid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid); + if (membersid == NULL) { + return NT_STATUS_NO_MEMORY; + } + + /* according to MS-SAMR 3.1.5.8.2 all type of accounts are accepted */ + ret = ldb_search(d_state->sam_ctx, mem_ctx, &res, + d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs, + "(objectSid=%s)", + ldap_encode_ndr_dom_sid(mem_ctx, membersid)); + + if (ret != LDB_SUCCESS) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + if (res->count == 0) { + return NT_STATUS_NO_SUCH_USER; + } + + if (res->count > 1) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + memberdn = ldb_dn_alloc_linearized(mem_ctx, res->msgs[0]->dn); + + if (memberdn == NULL) + return NT_STATUS_NO_MEMORY; + + mod = ldb_msg_new(mem_ctx); + if (mod == NULL) { + return NT_STATUS_NO_MEMORY; + } + + mod->dn = talloc_reference(mem_ctx, a_state->account_dn); + + ret = samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member", + memberdn); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + ret = ldb_modify(a_state->sam_ctx, mod); + switch (ret) { + case LDB_SUCCESS: + return NT_STATUS_OK; + case LDB_ERR_ENTRY_ALREADY_EXISTS: + return NT_STATUS_MEMBER_IN_GROUP; + case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS: + return NT_STATUS_ACCESS_DENIED; + default: + return dsdb_ldb_err_to_ntstatus(ret); + } +} + + +/* + samr_DeleteDomainGroup +*/ +static NTSTATUS dcesrv_samr_DeleteDomainGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_DeleteDomainGroup *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + int ret; + + *r->out.group_handle = *r->in.group_handle; + + DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP); + + a_state = h->data; + + ret = ldb_delete(a_state->sam_ctx, a_state->account_dn); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + talloc_free(h); + ZERO_STRUCTP(r->out.group_handle); + + return NT_STATUS_OK; +} + + +/* + samr_DeleteGroupMember +*/ +static NTSTATUS dcesrv_samr_DeleteGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_DeleteGroupMember *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct samr_domain_state *d_state; + struct ldb_message *mod; + struct dom_sid *membersid; + const char *memberdn; + struct ldb_result *res; + const char * const attrs[] = { NULL }; + int ret; + + DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP); + + a_state = h->data; + d_state = a_state->domain_state; + + membersid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid); + if (membersid == NULL) { + return NT_STATUS_NO_MEMORY; + } + + /* according to MS-SAMR 3.1.5.8.2 all type of accounts are accepted */ + ret = ldb_search(d_state->sam_ctx, mem_ctx, &res, + d_state->domain_dn, LDB_SCOPE_SUBTREE, attrs, + "(objectSid=%s)", + ldap_encode_ndr_dom_sid(mem_ctx, membersid)); + + if (ret != LDB_SUCCESS) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + if (res->count == 0) { + return NT_STATUS_NO_SUCH_USER; + } + + if (res->count > 1) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + memberdn = ldb_dn_alloc_linearized(mem_ctx, res->msgs[0]->dn); + + if (memberdn == NULL) + return NT_STATUS_NO_MEMORY; + + mod = ldb_msg_new(mem_ctx); + if (mod == NULL) { + return NT_STATUS_NO_MEMORY; + } + + mod->dn = talloc_reference(mem_ctx, a_state->account_dn); + + ret = samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member", + memberdn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_NO_MEMORY; + } + + ret = ldb_modify(a_state->sam_ctx, mod); + switch (ret) { + case LDB_SUCCESS: + return NT_STATUS_OK; + case LDB_ERR_UNWILLING_TO_PERFORM: + return NT_STATUS_MEMBER_NOT_IN_GROUP; + case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS: + return NT_STATUS_ACCESS_DENIED; + default: + return dsdb_ldb_err_to_ntstatus(ret); + } +} + + +/* + samr_QueryGroupMember +*/ +static NTSTATUS dcesrv_samr_QueryGroupMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryGroupMember *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct samr_domain_state *d_state; + struct samr_RidAttrArray *array; + unsigned int i, num_members; + struct dom_sid *members; + NTSTATUS status; + + DCESRV_PULL_HANDLE(h, r->in.group_handle, SAMR_HANDLE_GROUP); + + a_state = h->data; + d_state = a_state->domain_state; + + status = dsdb_enum_group_mem(d_state->sam_ctx, mem_ctx, + a_state->account_dn, &members, + &num_members); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + array = talloc_zero(mem_ctx, struct samr_RidAttrArray); + if (array == NULL) { + return NT_STATUS_NO_MEMORY; + } + + if (num_members == 0) { + *r->out.rids = array; + + return NT_STATUS_OK; + } + + array->rids = talloc_array(array, uint32_t, num_members); + if (array->rids == NULL) { + return NT_STATUS_NO_MEMORY; + } + + array->attributes = talloc_array(array, uint32_t, num_members); + if (array->attributes == NULL) { + return NT_STATUS_NO_MEMORY; + } + + array->count = 0; + for (i=0; i<num_members; i++) { + if (!dom_sid_in_domain(d_state->domain_sid, &members[i])) { + continue; + } + + status = dom_sid_split_rid(NULL, &members[i], NULL, + &array->rids[array->count]); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + array->attributes[array->count] = SE_GROUP_MANDATORY | + SE_GROUP_ENABLED_BY_DEFAULT | + SE_GROUP_ENABLED; + array->count++; + } + + *r->out.rids = array; + + return NT_STATUS_OK; +} + + +/* + samr_SetMemberAttributesOfGroup +*/ +static NTSTATUS dcesrv_samr_SetMemberAttributesOfGroup(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetMemberAttributesOfGroup *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_OpenAlias +*/ +static NTSTATUS dcesrv_samr_OpenAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_OpenAlias *r) +{ + struct samr_domain_state *d_state; + struct samr_account_state *a_state; + struct dcesrv_handle *h; + const char *alias_name; + struct dom_sid *sid; + struct ldb_message **msgs; + struct dcesrv_handle *g_handle; + const char * const attrs[2] = { "sAMAccountName", NULL }; + int ret; + + ZERO_STRUCTP(r->out.alias_handle); + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + /* form the alias SID */ + sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid); + if (sid == NULL) + return NT_STATUS_NO_MEMORY; + + /* search for the group record */ + ret = gendb_search(d_state->sam_ctx, mem_ctx, NULL, &msgs, attrs, + "(&(objectSid=%s)(objectclass=group)" + "(|(grouptype=%d)(grouptype=%d)))", + ldap_encode_ndr_dom_sid(mem_ctx, sid), + GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, + GTYPE_SECURITY_DOMAIN_LOCAL_GROUP); + if (ret == 0) { + return NT_STATUS_NO_SUCH_ALIAS; + } + if (ret != 1) { + DEBUG(0,("Found %d records matching sid %s\n", + ret, dom_sid_string(mem_ctx, sid))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + alias_name = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL); + if (alias_name == NULL) { + DEBUG(0,("sAMAccountName field missing for sid %s\n", + dom_sid_string(mem_ctx, sid))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + a_state = talloc(mem_ctx, struct samr_account_state); + if (!a_state) { + return NT_STATUS_NO_MEMORY; + } + a_state->sam_ctx = d_state->sam_ctx; + a_state->access_mask = r->in.access_mask; + a_state->domain_state = talloc_reference(a_state, d_state); + a_state->account_dn = talloc_steal(a_state, msgs[0]->dn); + a_state->account_sid = talloc_steal(a_state, sid); + a_state->account_name = talloc_strdup(a_state, alias_name); + if (!a_state->account_name) { + return NT_STATUS_NO_MEMORY; + } + + /* create the policy handle */ + g_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_ALIAS); + if (!g_handle) { + return NT_STATUS_NO_MEMORY; + } + + g_handle->data = talloc_steal(g_handle, a_state); + + *r->out.alias_handle = g_handle->wire_handle; + + return NT_STATUS_OK; +} + + +/* + samr_QueryAliasInfo +*/ +static NTSTATUS dcesrv_samr_QueryAliasInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryAliasInfo *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct ldb_message *msg, **res; + const char * const attrs[4] = { "sAMAccountName", "description", + "numMembers", NULL }; + int ret; + union samr_AliasInfo *info; + + *r->out.info = NULL; + + DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS); + + a_state = h->data; + + /* pull all the alias attributes */ + ret = gendb_search_dn(a_state->sam_ctx, mem_ctx, + a_state->account_dn, &res, attrs); + if (ret == 0) { + return NT_STATUS_NO_SUCH_ALIAS; + } + if (ret != 1) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + msg = res[0]; + + /* allocate the info structure */ + info = talloc_zero(mem_ctx, union samr_AliasInfo); + if (info == NULL) { + return NT_STATUS_NO_MEMORY; + } + + switch(r->in.level) { + case ALIASINFOALL: + QUERY_STRING(msg, all.name, "sAMAccountName"); + QUERY_UINT (msg, all.num_members, "numMembers"); + QUERY_STRING(msg, all.description, "description"); + break; + case ALIASINFONAME: + QUERY_STRING(msg, name, "sAMAccountName"); + break; + case ALIASINFODESCRIPTION: + QUERY_STRING(msg, description, "description"); + break; + default: + talloc_free(info); + return NT_STATUS_INVALID_INFO_CLASS; + } + + *r->out.info = info; + + return NT_STATUS_OK; +} + + +/* + samr_SetAliasInfo +*/ +static NTSTATUS dcesrv_samr_SetAliasInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetAliasInfo *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct ldb_message *msg; + int ret; + + DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS); + + a_state = h->data; + + msg = ldb_msg_new(mem_ctx); + if (msg == NULL) { + return NT_STATUS_NO_MEMORY; + } + + msg->dn = ldb_dn_copy(mem_ctx, a_state->account_dn); + if (!msg->dn) { + return NT_STATUS_NO_MEMORY; + } + + switch (r->in.level) { + case ALIASINFODESCRIPTION: + SET_STRING(msg, description, "description"); + break; + case ALIASINFONAME: + /* On W2k3 this does not change the name, it changes the + * sAMAccountName attribute */ + SET_STRING(msg, name, "sAMAccountName"); + break; + default: + return NT_STATUS_INVALID_INFO_CLASS; + } + + /* modify the samdb record */ + ret = ldb_modify(a_state->sam_ctx, msg); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + return NT_STATUS_OK; +} + + +/* + samr_DeleteDomAlias +*/ +static NTSTATUS dcesrv_samr_DeleteDomAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_DeleteDomAlias *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + int ret; + + *r->out.alias_handle = *r->in.alias_handle; + + DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS); + + a_state = h->data; + + ret = ldb_delete(a_state->sam_ctx, a_state->account_dn); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + talloc_free(h); + ZERO_STRUCTP(r->out.alias_handle); + + return NT_STATUS_OK; +} + + +/* + samr_AddAliasMember +*/ +static NTSTATUS dcesrv_samr_AddAliasMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_AddAliasMember *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct samr_domain_state *d_state; + struct ldb_message *mod; + struct ldb_message **msgs; + const char * const attrs[] = { NULL }; + struct ldb_dn *memberdn = NULL; + int ret; + NTSTATUS status; + + DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS); + + a_state = h->data; + d_state = a_state->domain_state; + + ret = gendb_search(d_state->sam_ctx, mem_ctx, NULL, + &msgs, attrs, "(objectsid=%s)", + ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid)); + + if (ret == 1) { + memberdn = msgs[0]->dn; + } else if (ret == 0) { + status = samdb_create_foreign_security_principal( + d_state->sam_ctx, mem_ctx, r->in.sid, &memberdn); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + } else { + DEBUG(0,("Found %d records matching sid %s\n", + ret, dom_sid_string(mem_ctx, r->in.sid))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + if (memberdn == NULL) { + DEBUG(0, ("Could not find memberdn\n")); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + mod = ldb_msg_new(mem_ctx); + if (mod == NULL) { + return NT_STATUS_NO_MEMORY; + } + + mod->dn = talloc_reference(mem_ctx, a_state->account_dn); + + ret = samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member", + ldb_dn_alloc_linearized(mem_ctx, memberdn)); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + ret = ldb_modify(a_state->sam_ctx, mod); + switch (ret) { + case LDB_SUCCESS: + return NT_STATUS_OK; + case LDB_ERR_ENTRY_ALREADY_EXISTS: + return NT_STATUS_MEMBER_IN_GROUP; + case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS: + return NT_STATUS_ACCESS_DENIED; + default: + return dsdb_ldb_err_to_ntstatus(ret); + } +} + + +/* + samr_DeleteAliasMember +*/ +static NTSTATUS dcesrv_samr_DeleteAliasMember(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_DeleteAliasMember *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct samr_domain_state *d_state; + struct ldb_message *mod; + const char *memberdn; + int ret; + + DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS); + + a_state = h->data; + d_state = a_state->domain_state; + + memberdn = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL, + "distinguishedName", "(objectSid=%s)", + ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid)); + if (memberdn == NULL) { + return NT_STATUS_OBJECT_NAME_NOT_FOUND; + } + + mod = ldb_msg_new(mem_ctx); + if (mod == NULL) { + return NT_STATUS_NO_MEMORY; + } + + mod->dn = talloc_reference(mem_ctx, a_state->account_dn); + + ret = samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, "member", + memberdn); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + + ret = ldb_modify(a_state->sam_ctx, mod); + switch (ret) { + case LDB_SUCCESS: + return NT_STATUS_OK; + case LDB_ERR_UNWILLING_TO_PERFORM: + return NT_STATUS_MEMBER_NOT_IN_GROUP; + case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS: + return NT_STATUS_ACCESS_DENIED; + default: + return dsdb_ldb_err_to_ntstatus(ret); + } +} + + +/* + samr_GetMembersInAlias +*/ +static NTSTATUS dcesrv_samr_GetMembersInAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetMembersInAlias *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct samr_domain_state *d_state; + struct lsa_SidPtr *array; + unsigned int i, num_members; + struct dom_sid *members; + NTSTATUS status; + + DCESRV_PULL_HANDLE(h, r->in.alias_handle, SAMR_HANDLE_ALIAS); + + a_state = h->data; + d_state = a_state->domain_state; + + status = dsdb_enum_group_mem(d_state->sam_ctx, mem_ctx, + a_state->account_dn, &members, + &num_members); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + if (num_members == 0) { + r->out.sids->sids = NULL; + + return NT_STATUS_OK; + } + + array = talloc_array(mem_ctx, struct lsa_SidPtr, num_members); + if (array == NULL) { + return NT_STATUS_NO_MEMORY; + } + + for (i=0; i<num_members; i++) { + array[i].sid = &members[i]; + } + + r->out.sids->num_sids = num_members; + r->out.sids->sids = array; + + return NT_STATUS_OK; +} + +/* + samr_OpenUser +*/ +static NTSTATUS dcesrv_samr_OpenUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_OpenUser *r) +{ + struct samr_domain_state *d_state; + struct samr_account_state *a_state; + struct dcesrv_handle *h; + const char *account_name; + struct dom_sid *sid; + struct ldb_message **msgs; + struct dcesrv_handle *u_handle; + const char * const attrs[2] = { "sAMAccountName", NULL }; + int ret; + + ZERO_STRUCTP(r->out.user_handle); + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + /* form the users SID */ + sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid); + if (!sid) { + return NT_STATUS_NO_MEMORY; + } + + /* search for the user record */ + ret = gendb_search(d_state->sam_ctx, + mem_ctx, d_state->domain_dn, &msgs, attrs, + "(&(objectSid=%s)(objectclass=user))", + ldap_encode_ndr_dom_sid(mem_ctx, sid)); + if (ret == 0) { + return NT_STATUS_NO_SUCH_USER; + } + if (ret != 1) { + DEBUG(0,("Found %d records matching sid %s\n", ret, + dom_sid_string(mem_ctx, sid))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + account_name = ldb_msg_find_attr_as_string(msgs[0], "sAMAccountName", NULL); + if (account_name == NULL) { + DEBUG(0,("sAMAccountName field missing for sid %s\n", + dom_sid_string(mem_ctx, sid))); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + a_state = talloc(mem_ctx, struct samr_account_state); + if (!a_state) { + return NT_STATUS_NO_MEMORY; + } + a_state->sam_ctx = d_state->sam_ctx; + a_state->access_mask = r->in.access_mask; + a_state->domain_state = talloc_reference(a_state, d_state); + a_state->account_dn = talloc_steal(a_state, msgs[0]->dn); + a_state->account_sid = talloc_steal(a_state, sid); + a_state->account_name = talloc_strdup(a_state, account_name); + if (!a_state->account_name) { + return NT_STATUS_NO_MEMORY; + } + + /* create the policy handle */ + u_handle = dcesrv_handle_create(dce_call, SAMR_HANDLE_USER); + if (!u_handle) { + return NT_STATUS_NO_MEMORY; + } + + u_handle->data = talloc_steal(u_handle, a_state); + + *r->out.user_handle = u_handle->wire_handle; + + return NT_STATUS_OK; + +} + + +/* + samr_DeleteUser +*/ +static NTSTATUS dcesrv_samr_DeleteUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_DeleteUser *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + int ret; + + *r->out.user_handle = *r->in.user_handle; + + DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER); + + a_state = h->data; + + ret = ldb_delete(a_state->sam_ctx, a_state->account_dn); + if (ret != LDB_SUCCESS) { + DEBUG(1, ("Failed to delete user: %s: %s\n", + ldb_dn_get_linearized(a_state->account_dn), + ldb_errstring(a_state->sam_ctx))); + return dsdb_ldb_err_to_ntstatus(ret); + } + + talloc_free(h); + ZERO_STRUCTP(r->out.user_handle); + + return NT_STATUS_OK; +} + + +/* + samr_QueryUserInfo +*/ +static NTSTATUS dcesrv_samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryUserInfo *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct ldb_message *msg, **res; + int ret; + struct ldb_context *sam_ctx; + + const char * const *attrs = NULL; + union samr_UserInfo *info; + + NTSTATUS status; + + *r->out.info = NULL; + + DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER); + + a_state = h->data; + sam_ctx = a_state->sam_ctx; + + /* fill in the reply */ + switch (r->in.level) { + case 1: + { + static const char * const attrs2[] = {"sAMAccountName", + "displayName", + "primaryGroupID", + "description", + "comment", + NULL}; + attrs = attrs2; + break; + } + case 2: + { + static const char * const attrs2[] = {"comment", + "countryCode", + "codePage", + NULL}; + attrs = attrs2; + break; + } + case 3: + { + static const char * const attrs2[] = {"sAMAccountName", + "displayName", + "objectSid", + "primaryGroupID", + "homeDirectory", + "homeDrive", + "scriptPath", + "profilePath", + "userWorkstations", + "lastLogon", + "lastLogoff", + "pwdLastSet", + "msDS-UserPasswordExpiryTimeComputed", + "logonHours", + "badPwdCount", + "badPasswordTime", + "logonCount", + "userAccountControl", + "msDS-User-Account-Control-Computed", + NULL}; + attrs = attrs2; + break; + } + case 4: + { + static const char * const attrs2[] = {"logonHours", + NULL}; + attrs = attrs2; + break; + } + case 5: + { + static const char * const attrs2[] = {"sAMAccountName", + "displayName", + "objectSid", + "primaryGroupID", + "homeDirectory", + "homeDrive", + "scriptPath", + "profilePath", + "description", + "userWorkstations", + "lastLogon", + "lastLogoff", + "logonHours", + "badPwdCount", + "badPasswordTime", + "logonCount", + "pwdLastSet", + "msDS-ResultantPSO", + "msDS-UserPasswordExpiryTimeComputed", + "accountExpires", + "userAccountControl", + "msDS-User-Account-Control-Computed", + NULL}; + attrs = attrs2; + break; + } + case 6: + { + static const char * const attrs2[] = {"sAMAccountName", + "displayName", + NULL}; + attrs = attrs2; + break; + } + case 7: + { + static const char * const attrs2[] = {"sAMAccountName", + NULL}; + attrs = attrs2; + break; + } + case 8: + { + static const char * const attrs2[] = {"displayName", + NULL}; + attrs = attrs2; + break; + } + case 9: + { + static const char * const attrs2[] = {"primaryGroupID", + NULL}; + attrs = attrs2; + break; + } + case 10: + { + static const char * const attrs2[] = {"homeDirectory", + "homeDrive", + NULL}; + attrs = attrs2; + break; + } + case 11: + { + static const char * const attrs2[] = {"scriptPath", + NULL}; + attrs = attrs2; + break; + } + case 12: + { + static const char * const attrs2[] = {"profilePath", + NULL}; + attrs = attrs2; + break; + } + case 13: + { + static const char * const attrs2[] = {"description", + NULL}; + attrs = attrs2; + break; + } + case 14: + { + static const char * const attrs2[] = {"userWorkstations", + NULL}; + attrs = attrs2; + break; + } + case 16: + { + static const char * const attrs2[] = {"userAccountControl", + "msDS-User-Account-Control-Computed", + "pwdLastSet", + "msDS-UserPasswordExpiryTimeComputed", + NULL}; + attrs = attrs2; + break; + } + case 17: + { + static const char * const attrs2[] = {"accountExpires", + NULL}; + attrs = attrs2; + break; + } + case 18: + { + return NT_STATUS_NOT_SUPPORTED; + } + case 20: + { + static const char * const attrs2[] = {"userParameters", + NULL}; + attrs = attrs2; + break; + } + case 21: + { + static const char * const attrs2[] = {"lastLogon", + "lastLogoff", + "pwdLastSet", + "msDS-ResultantPSO", + "msDS-UserPasswordExpiryTimeComputed", + "accountExpires", + "sAMAccountName", + "displayName", + "homeDirectory", + "homeDrive", + "scriptPath", + "profilePath", + "description", + "userWorkstations", + "comment", + "userParameters", + "objectSid", + "primaryGroupID", + "userAccountControl", + "msDS-User-Account-Control-Computed", + "logonHours", + "badPwdCount", + "badPasswordTime", + "logonCount", + "countryCode", + "codePage", + NULL}; + attrs = attrs2; + break; + } + case 23: + case 24: + case 25: + case 26: + { + return NT_STATUS_NOT_SUPPORTED; + } + default: + { + return NT_STATUS_INVALID_INFO_CLASS; + } + } + + /* pull all the user attributes */ + ret = gendb_search_dn(a_state->sam_ctx, mem_ctx, + a_state->account_dn, &res, attrs); + if (ret == 0) { + return NT_STATUS_NO_SUCH_USER; + } + if (ret != 1) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + msg = res[0]; + + /* allocate the info structure */ + info = talloc_zero(mem_ctx, union samr_UserInfo); + if (info == NULL) { + return NT_STATUS_NO_MEMORY; + } + + /* fill in the reply */ + switch (r->in.level) { + case 1: + QUERY_STRING(msg, info1.account_name, "sAMAccountName"); + QUERY_STRING(msg, info1.full_name, "displayName"); + QUERY_UINT (msg, info1.primary_gid, "primaryGroupID"); + QUERY_STRING(msg, info1.description, "description"); + QUERY_STRING(msg, info1.comment, "comment"); + break; + + case 2: + QUERY_STRING(msg, info2.comment, "comment"); + QUERY_UINT (msg, info2.country_code, "countryCode"); + QUERY_UINT (msg, info2.code_page, "codePage"); + break; + + case 3: + QUERY_STRING(msg, info3.account_name, "sAMAccountName"); + QUERY_STRING(msg, info3.full_name, "displayName"); + QUERY_RID (msg, info3.rid, "objectSid"); + QUERY_UINT (msg, info3.primary_gid, "primaryGroupID"); + QUERY_STRING(msg, info3.home_directory, "homeDirectory"); + QUERY_STRING(msg, info3.home_drive, "homeDrive"); + QUERY_STRING(msg, info3.logon_script, "scriptPath"); + QUERY_STRING(msg, info3.profile_path, "profilePath"); + QUERY_STRING(msg, info3.workstations, "userWorkstations"); + QUERY_UINT64(msg, info3.last_logon, "lastLogon"); + QUERY_UINT64(msg, info3.last_logoff, "lastLogoff"); + QUERY_UINT64(msg, info3.last_password_change, "pwdLastSet"); + QUERY_APASSC(msg, info3.allow_password_change, "pwdLastSet"); + QUERY_UINT64(msg, info3.force_password_change, "msDS-UserPasswordExpiryTimeComputed"); + QUERY_LHOURS(msg, info3.logon_hours, "logonHours"); + /* level 3 gives the raw badPwdCount value */ + QUERY_UINT (msg, info3.bad_password_count, "badPwdCount"); + QUERY_UINT (msg, info3.logon_count, "logonCount"); + QUERY_AFLAGS(msg, info3.acct_flags, "msDS-User-Account-Control-Computed"); + break; + + case 4: + QUERY_LHOURS(msg, info4.logon_hours, "logonHours"); + break; + + case 5: + QUERY_STRING(msg, info5.account_name, "sAMAccountName"); + QUERY_STRING(msg, info5.full_name, "displayName"); + QUERY_RID (msg, info5.rid, "objectSid"); + QUERY_UINT (msg, info5.primary_gid, "primaryGroupID"); + QUERY_STRING(msg, info5.home_directory, "homeDirectory"); + QUERY_STRING(msg, info5.home_drive, "homeDrive"); + QUERY_STRING(msg, info5.logon_script, "scriptPath"); + QUERY_STRING(msg, info5.profile_path, "profilePath"); + QUERY_STRING(msg, info5.description, "description"); + QUERY_STRING(msg, info5.workstations, "userWorkstations"); + QUERY_UINT64(msg, info5.last_logon, "lastLogon"); + QUERY_UINT64(msg, info5.last_logoff, "lastLogoff"); + QUERY_LHOURS(msg, info5.logon_hours, "logonHours"); + QUERY_BPWDCT(msg, info5.bad_password_count, "badPwdCount"); + QUERY_UINT (msg, info5.logon_count, "logonCount"); + QUERY_UINT64(msg, info5.last_password_change, "pwdLastSet"); + QUERY_UINT64(msg, info5.acct_expiry, "accountExpires"); + QUERY_AFLAGS(msg, info5.acct_flags, "msDS-User-Account-Control-Computed"); + break; + + case 6: + QUERY_STRING(msg, info6.account_name, "sAMAccountName"); + QUERY_STRING(msg, info6.full_name, "displayName"); + break; + + case 7: + QUERY_STRING(msg, info7.account_name, "sAMAccountName"); + break; + + case 8: + QUERY_STRING(msg, info8.full_name, "displayName"); + break; + + case 9: + QUERY_UINT (msg, info9.primary_gid, "primaryGroupID"); + break; + + case 10: + QUERY_STRING(msg, info10.home_directory,"homeDirectory"); + QUERY_STRING(msg, info10.home_drive, "homeDrive"); + break; + + case 11: + QUERY_STRING(msg, info11.logon_script, "scriptPath"); + break; + + case 12: + QUERY_STRING(msg, info12.profile_path, "profilePath"); + break; + + case 13: + QUERY_STRING(msg, info13.description, "description"); + break; + + case 14: + QUERY_STRING(msg, info14.workstations, "userWorkstations"); + break; + + case 16: + QUERY_AFLAGS(msg, info16.acct_flags, "msDS-User-Account-Control-Computed"); + break; + + case 17: + QUERY_UINT64(msg, info17.acct_expiry, "accountExpires"); + break; + + case 20: + status = samdb_result_parameters(mem_ctx, msg, "userParameters", &info->info20.parameters); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(info); + return status; + } + break; + + case 21: + QUERY_UINT64(msg, info21.last_logon, "lastLogon"); + QUERY_UINT64(msg, info21.last_logoff, "lastLogoff"); + QUERY_UINT64(msg, info21.last_password_change, "pwdLastSet"); + QUERY_UINT64(msg, info21.acct_expiry, "accountExpires"); + QUERY_APASSC(msg, info21.allow_password_change,"pwdLastSet"); + QUERY_UINT64(msg, info21.force_password_change, "msDS-UserPasswordExpiryTimeComputed"); + QUERY_STRING(msg, info21.account_name, "sAMAccountName"); + QUERY_STRING(msg, info21.full_name, "displayName"); + QUERY_STRING(msg, info21.home_directory, "homeDirectory"); + QUERY_STRING(msg, info21.home_drive, "homeDrive"); + QUERY_STRING(msg, info21.logon_script, "scriptPath"); + QUERY_STRING(msg, info21.profile_path, "profilePath"); + QUERY_STRING(msg, info21.description, "description"); + QUERY_STRING(msg, info21.workstations, "userWorkstations"); + QUERY_STRING(msg, info21.comment, "comment"); + status = samdb_result_parameters(mem_ctx, msg, "userParameters", &info->info21.parameters); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(info); + return status; + } + + QUERY_RID (msg, info21.rid, "objectSid"); + QUERY_UINT (msg, info21.primary_gid, "primaryGroupID"); + QUERY_AFLAGS(msg, info21.acct_flags, "msDS-User-Account-Control-Computed"); + info->info21.fields_present = 0x08FFFFFF; + QUERY_LHOURS(msg, info21.logon_hours, "logonHours"); + QUERY_BPWDCT(msg, info21.bad_password_count, "badPwdCount"); + QUERY_UINT (msg, info21.logon_count, "logonCount"); + if ((info->info21.acct_flags & ACB_PW_EXPIRED) != 0) { + info->info21.password_expired = PASS_MUST_CHANGE_AT_NEXT_LOGON; + } else { + info->info21.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON; + } + QUERY_UINT (msg, info21.country_code, "countryCode"); + QUERY_UINT (msg, info21.code_page, "codePage"); + break; + + + default: + talloc_free(info); + return NT_STATUS_INVALID_INFO_CLASS; + } + + *r->out.info = info; + + return NT_STATUS_OK; +} + + +/* + samr_SetUserInfo +*/ +static NTSTATUS dcesrv_samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetUserInfo *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct ldb_message *msg; + int ret; + NTSTATUS status = NT_STATUS_OK; + struct ldb_context *sam_ctx; + DATA_BLOB session_key = data_blob_null; + + DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER); + + a_state = h->data; + sam_ctx = a_state->sam_ctx; + + msg = ldb_msg_new(mem_ctx); + if (msg == NULL) { + return NT_STATUS_NO_MEMORY; + } + + msg->dn = talloc_reference(mem_ctx, a_state->account_dn); + if (!msg->dn) { + return NT_STATUS_NO_MEMORY; + } + + ret = ldb_transaction_start(sam_ctx); + if (ret != LDB_SUCCESS) { + DBG_ERR("Failed to start a transaction: %s\n", + ldb_errstring(sam_ctx)); + return NT_STATUS_LOCK_NOT_GRANTED; + } + + switch (r->in.level) { + case 2: + SET_STRING(msg, info2.comment, "comment"); + SET_UINT (msg, info2.country_code, "countryCode"); + SET_UINT (msg, info2.code_page, "codePage"); + break; + + case 4: + SET_LHOURS(msg, info4.logon_hours, "logonHours"); + break; + + case 6: + SET_STRING(msg, info6.account_name, "samAccountName"); + SET_STRING(msg, info6.full_name, "displayName"); + break; + + case 7: + SET_STRING(msg, info7.account_name, "samAccountName"); + break; + + case 8: + SET_STRING(msg, info8.full_name, "displayName"); + break; + + case 9: + SET_UINT(msg, info9.primary_gid, "primaryGroupID"); + break; + + case 10: + SET_STRING(msg, info10.home_directory, "homeDirectory"); + SET_STRING(msg, info10.home_drive, "homeDrive"); + break; + + case 11: + SET_STRING(msg, info11.logon_script, "scriptPath"); + break; + + case 12: + SET_STRING(msg, info12.profile_path, "profilePath"); + break; + + case 13: + SET_STRING(msg, info13.description, "description"); + break; + + case 14: + SET_STRING(msg, info14.workstations, "userWorkstations"); + break; + + case 16: + SET_AFLAGS(msg, info16.acct_flags, "userAccountControl"); + break; + + case 17: + SET_UINT64(msg, info17.acct_expiry, "accountExpires"); + break; + + case 18: + status = samr_set_password_buffers(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + r->in.info->info18.lm_pwd_active ? r->in.info->info18.lm_pwd.hash : NULL, + r->in.info->info18.nt_pwd_active ? r->in.info->info18.nt_pwd.hash : NULL); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + if (r->in.info->info18.password_expired > 0) { + struct ldb_message_element *set_el; + if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } + break; + + case 20: + SET_PARAMETERS(msg, info20.parameters, "userParameters"); + break; + + case 21: + if (r->in.info->info21.fields_present == 0) { + status = NT_STATUS_INVALID_PARAMETER; + goto done; + } + +#define IFSET(bit) if (bit & r->in.info->info21.fields_present) + IFSET(SAMR_FIELD_LAST_LOGON) + SET_UINT64(msg, info21.last_logon, "lastLogon"); + IFSET(SAMR_FIELD_LAST_LOGOFF) + SET_UINT64(msg, info21.last_logoff, "lastLogoff"); + IFSET(SAMR_FIELD_ACCT_EXPIRY) + SET_UINT64(msg, info21.acct_expiry, "accountExpires"); + IFSET(SAMR_FIELD_ACCOUNT_NAME) + SET_STRING(msg, info21.account_name, "samAccountName"); + IFSET(SAMR_FIELD_FULL_NAME) + SET_STRING(msg, info21.full_name, "displayName"); + IFSET(SAMR_FIELD_HOME_DIRECTORY) + SET_STRING(msg, info21.home_directory, "homeDirectory"); + IFSET(SAMR_FIELD_HOME_DRIVE) + SET_STRING(msg, info21.home_drive, "homeDrive"); + IFSET(SAMR_FIELD_LOGON_SCRIPT) + SET_STRING(msg, info21.logon_script, "scriptPath"); + IFSET(SAMR_FIELD_PROFILE_PATH) + SET_STRING(msg, info21.profile_path, "profilePath"); + IFSET(SAMR_FIELD_DESCRIPTION) + SET_STRING(msg, info21.description, "description"); + IFSET(SAMR_FIELD_WORKSTATIONS) + SET_STRING(msg, info21.workstations, "userWorkstations"); + IFSET(SAMR_FIELD_COMMENT) + SET_STRING(msg, info21.comment, "comment"); + IFSET(SAMR_FIELD_PARAMETERS) + SET_PARAMETERS(msg, info21.parameters, "userParameters"); + IFSET(SAMR_FIELD_PRIMARY_GID) + SET_UINT(msg, info21.primary_gid, "primaryGroupID"); + IFSET(SAMR_FIELD_ACCT_FLAGS) + SET_AFLAGS(msg, info21.acct_flags, "userAccountControl"); + IFSET(SAMR_FIELD_LOGON_HOURS) + SET_LHOURS(msg, info21.logon_hours, "logonHours"); + IFSET(SAMR_FIELD_BAD_PWD_COUNT) + SET_UINT (msg, info21.bad_password_count, "badPwdCount"); + IFSET(SAMR_FIELD_NUM_LOGONS) + SET_UINT (msg, info21.logon_count, "logonCount"); + IFSET(SAMR_FIELD_COUNTRY_CODE) + SET_UINT (msg, info21.country_code, "countryCode"); + IFSET(SAMR_FIELD_CODE_PAGE) + SET_UINT (msg, info21.code_page, "codePage"); + + /* password change fields */ + IFSET(SAMR_FIELD_LAST_PWD_CHANGE) { + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + IFSET((SAMR_FIELD_LM_PASSWORD_PRESENT + | SAMR_FIELD_NT_PASSWORD_PRESENT)) { + uint8_t *lm_pwd_hash = NULL, *nt_pwd_hash = NULL; + + if (r->in.info->info21.lm_password_set) { + if ((r->in.info->info21.lm_owf_password.length != 16) + || (r->in.info->info21.lm_owf_password.size != 16)) { + status = NT_STATUS_INVALID_PARAMETER; + goto done; + } + + lm_pwd_hash = (uint8_t *) r->in.info->info21.lm_owf_password.array; + } + if (r->in.info->info21.nt_password_set) { + if ((r->in.info->info21.nt_owf_password.length != 16) + || (r->in.info->info21.nt_owf_password.size != 16)) { + status = NT_STATUS_INVALID_PARAMETER; + goto done; + } + + nt_pwd_hash = (uint8_t *) r->in.info->info21.nt_owf_password.array; + } + status = samr_set_password_buffers(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + lm_pwd_hash, + nt_pwd_hash); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + } + + + IFSET(SAMR_FIELD_EXPIRED_FLAG) { + const char *t = "0"; + struct ldb_message_element *set_el; + if (r->in.info->info21.password_expired + == PASS_DONT_CHANGE_AT_NEXT_LOGON) { + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } +#undef IFSET + break; + + case 23: + if (r->in.info->info23.info.fields_present == 0) { + status = NT_STATUS_INVALID_PARAMETER; + goto done; + } + +#define IFSET(bit) if (bit & r->in.info->info23.info.fields_present) + IFSET(SAMR_FIELD_LAST_LOGON) + SET_UINT64(msg, info23.info.last_logon, "lastLogon"); + IFSET(SAMR_FIELD_LAST_LOGOFF) + SET_UINT64(msg, info23.info.last_logoff, "lastLogoff"); + IFSET(SAMR_FIELD_ACCT_EXPIRY) + SET_UINT64(msg, info23.info.acct_expiry, "accountExpires"); + IFSET(SAMR_FIELD_ACCOUNT_NAME) + SET_STRING(msg, info23.info.account_name, "samAccountName"); + IFSET(SAMR_FIELD_FULL_NAME) + SET_STRING(msg, info23.info.full_name, "displayName"); + IFSET(SAMR_FIELD_HOME_DIRECTORY) + SET_STRING(msg, info23.info.home_directory, "homeDirectory"); + IFSET(SAMR_FIELD_HOME_DRIVE) + SET_STRING(msg, info23.info.home_drive, "homeDrive"); + IFSET(SAMR_FIELD_LOGON_SCRIPT) + SET_STRING(msg, info23.info.logon_script, "scriptPath"); + IFSET(SAMR_FIELD_PROFILE_PATH) + SET_STRING(msg, info23.info.profile_path, "profilePath"); + IFSET(SAMR_FIELD_DESCRIPTION) + SET_STRING(msg, info23.info.description, "description"); + IFSET(SAMR_FIELD_WORKSTATIONS) + SET_STRING(msg, info23.info.workstations, "userWorkstations"); + IFSET(SAMR_FIELD_COMMENT) + SET_STRING(msg, info23.info.comment, "comment"); + IFSET(SAMR_FIELD_PARAMETERS) + SET_PARAMETERS(msg, info23.info.parameters, "userParameters"); + IFSET(SAMR_FIELD_PRIMARY_GID) + SET_UINT(msg, info23.info.primary_gid, "primaryGroupID"); + IFSET(SAMR_FIELD_ACCT_FLAGS) + SET_AFLAGS(msg, info23.info.acct_flags, "userAccountControl"); + IFSET(SAMR_FIELD_LOGON_HOURS) + SET_LHOURS(msg, info23.info.logon_hours, "logonHours"); + IFSET(SAMR_FIELD_BAD_PWD_COUNT) + SET_UINT (msg, info23.info.bad_password_count, "badPwdCount"); + IFSET(SAMR_FIELD_NUM_LOGONS) + SET_UINT (msg, info23.info.logon_count, "logonCount"); + + IFSET(SAMR_FIELD_COUNTRY_CODE) + SET_UINT (msg, info23.info.country_code, "countryCode"); + IFSET(SAMR_FIELD_CODE_PAGE) + SET_UINT (msg, info23.info.code_page, "codePage"); + + /* password change fields */ + IFSET(SAMR_FIELD_LAST_PWD_CHANGE) { + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) { + status = samr_set_password(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info23.password); + } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) { + status = samr_set_password(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info23.password); + } + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + IFSET(SAMR_FIELD_EXPIRED_FLAG) { + const char *t = "0"; + struct ldb_message_element *set_el; + if (r->in.info->info23.info.password_expired + == PASS_DONT_CHANGE_AT_NEXT_LOGON) { + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } +#undef IFSET + break; + + /* the set password levels are handled separately */ + case 24: + status = samr_set_password(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info24.password); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + if (r->in.info->info24.password_expired > 0) { + struct ldb_message_element *set_el; + if (samdb_msg_add_uint64(sam_ctx, mem_ctx, msg, "pwdLastSet", 0) != LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } + break; + + case 25: + if (r->in.info->info25.info.fields_present == 0) { + status = NT_STATUS_INVALID_PARAMETER; + goto done; + } + +#define IFSET(bit) if (bit & r->in.info->info25.info.fields_present) + IFSET(SAMR_FIELD_LAST_LOGON) + SET_UINT64(msg, info25.info.last_logon, "lastLogon"); + IFSET(SAMR_FIELD_LAST_LOGOFF) + SET_UINT64(msg, info25.info.last_logoff, "lastLogoff"); + IFSET(SAMR_FIELD_ACCT_EXPIRY) + SET_UINT64(msg, info25.info.acct_expiry, "accountExpires"); + IFSET(SAMR_FIELD_ACCOUNT_NAME) + SET_STRING(msg, info25.info.account_name, "samAccountName"); + IFSET(SAMR_FIELD_FULL_NAME) + SET_STRING(msg, info25.info.full_name, "displayName"); + IFSET(SAMR_FIELD_HOME_DIRECTORY) + SET_STRING(msg, info25.info.home_directory, "homeDirectory"); + IFSET(SAMR_FIELD_HOME_DRIVE) + SET_STRING(msg, info25.info.home_drive, "homeDrive"); + IFSET(SAMR_FIELD_LOGON_SCRIPT) + SET_STRING(msg, info25.info.logon_script, "scriptPath"); + IFSET(SAMR_FIELD_PROFILE_PATH) + SET_STRING(msg, info25.info.profile_path, "profilePath"); + IFSET(SAMR_FIELD_DESCRIPTION) + SET_STRING(msg, info25.info.description, "description"); + IFSET(SAMR_FIELD_WORKSTATIONS) + SET_STRING(msg, info25.info.workstations, "userWorkstations"); + IFSET(SAMR_FIELD_COMMENT) + SET_STRING(msg, info25.info.comment, "comment"); + IFSET(SAMR_FIELD_PARAMETERS) + SET_PARAMETERS(msg, info25.info.parameters, "userParameters"); + IFSET(SAMR_FIELD_PRIMARY_GID) + SET_UINT(msg, info25.info.primary_gid, "primaryGroupID"); + IFSET(SAMR_FIELD_ACCT_FLAGS) + SET_AFLAGS(msg, info25.info.acct_flags, "userAccountControl"); + IFSET(SAMR_FIELD_LOGON_HOURS) + SET_LHOURS(msg, info25.info.logon_hours, "logonHours"); + IFSET(SAMR_FIELD_BAD_PWD_COUNT) + SET_UINT (msg, info25.info.bad_password_count, "badPwdCount"); + IFSET(SAMR_FIELD_NUM_LOGONS) + SET_UINT (msg, info25.info.logon_count, "logonCount"); + IFSET(SAMR_FIELD_COUNTRY_CODE) + SET_UINT (msg, info25.info.country_code, "countryCode"); + IFSET(SAMR_FIELD_CODE_PAGE) + SET_UINT (msg, info25.info.code_page, "codePage"); + + /* password change fields */ + IFSET(SAMR_FIELD_LAST_PWD_CHANGE) { + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) { + status = samr_set_password_ex(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info25.password); + } else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) { + status = samr_set_password_ex(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info25.password); + } + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + IFSET(SAMR_FIELD_EXPIRED_FLAG) { + const char *t = "0"; + struct ldb_message_element *set_el; + if (r->in.info->info25.info.password_expired + == PASS_DONT_CHANGE_AT_NEXT_LOGON) { + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } +#undef IFSET + break; + + /* the set password levels are handled separately */ + case 26: + status = samr_set_password_ex(dce_call, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + mem_ctx, + &r->in.info->info26.password); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + if (r->in.info->info26.password_expired > 0) { + const char *t = "0"; + struct ldb_message_element *set_el; + if (r->in.info->info26.password_expired + == PASS_DONT_CHANGE_AT_NEXT_LOGON) { + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } + break; + + case 31: + status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(status)) { + DBG_NOTICE("samr: failed to get session key: %s\n", + nt_errstr(status)); + goto done; + } + + status = samr_set_password_aes(dce_call, + mem_ctx, + &session_key, + sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + &r->in.info->info31.password, + DSDB_PASSWORD_RESET); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + if (r->in.info->info31.password_expired > 0) { + const char *t = "0"; + struct ldb_message_element *set_el = NULL; + + if (r->in.info->info31.password_expired == + PASS_DONT_CHANGE_AT_NEXT_LOGON) { + t = "-1"; + } + + ret = ldb_msg_add_string(msg, "pwdLastSet", t); + if (ret != LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } + + break; + case 32: + status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(status)) { + DBG_NOTICE("samr: failed to get session key: %s\n", + nt_errstr(status)); + goto done; + } + + if (r->in.info->info32.info.fields_present == 0) { + status = NT_STATUS_INVALID_PARAMETER; + goto done; + } + +#define IFSET(bit) if (bit & r->in.info->info32.info.fields_present) + IFSET(SAMR_FIELD_LAST_LOGON) + { + SET_UINT64(msg, info32.info.last_logon, "lastLogon"); + } + IFSET(SAMR_FIELD_LAST_LOGOFF) + { + SET_UINT64(msg, info32.info.last_logoff, "lastLogoff"); + } + IFSET(SAMR_FIELD_ACCT_EXPIRY) + { + SET_UINT64(msg, + info32.info.acct_expiry, + "accountExpires"); + } + IFSET(SAMR_FIELD_ACCOUNT_NAME) + { + SET_STRING(msg, + info32.info.account_name, + "samAccountName"); + } + IFSET(SAMR_FIELD_FULL_NAME) + { + SET_STRING(msg, info32.info.full_name, "displayName"); + } + IFSET(SAMR_FIELD_HOME_DIRECTORY) + { + SET_STRING(msg, + info32.info.home_directory, + "homeDirectory"); + } + IFSET(SAMR_FIELD_HOME_DRIVE) + { + SET_STRING(msg, info32.info.home_drive, "homeDrive"); + } + IFSET(SAMR_FIELD_LOGON_SCRIPT) + { + SET_STRING(msg, info32.info.logon_script, "scriptPath"); + } + IFSET(SAMR_FIELD_PROFILE_PATH) + { + SET_STRING(msg, + info32.info.profile_path, + "profilePath"); + } + IFSET(SAMR_FIELD_DESCRIPTION) + { + SET_STRING(msg, info32.info.description, "description"); + } + IFSET(SAMR_FIELD_WORKSTATIONS) + { + SET_STRING(msg, + info32.info.workstations, + "userWorkstations"); + } + IFSET(SAMR_FIELD_COMMENT) + { + SET_STRING(msg, info32.info.comment, "comment"); + } + IFSET(SAMR_FIELD_PARAMETERS) + { + SET_PARAMETERS(msg, + info32.info.parameters, + "userParameters"); + } + IFSET(SAMR_FIELD_PRIMARY_GID) + { + SET_UINT(msg, + info32.info.primary_gid, + "primaryGroupID"); + } + IFSET(SAMR_FIELD_ACCT_FLAGS) + { + SET_AFLAGS(msg, + info32.info.acct_flags, + "userAccountControl"); + } + IFSET(SAMR_FIELD_LOGON_HOURS) + { + SET_LHOURS(msg, info32.info.logon_hours, "logonHours"); + } + IFSET(SAMR_FIELD_BAD_PWD_COUNT) + { + SET_UINT(msg, + info32.info.bad_password_count, + "badPwdCount"); + } + IFSET(SAMR_FIELD_NUM_LOGONS) + { + SET_UINT(msg, info32.info.logon_count, "logonCount"); + } + IFSET(SAMR_FIELD_COUNTRY_CODE) + { + SET_UINT(msg, info32.info.country_code, "countryCode"); + } + IFSET(SAMR_FIELD_CODE_PAGE) + { + SET_UINT(msg, info32.info.code_page, "codePage"); + } + + /* password change fields */ + IFSET(SAMR_FIELD_LAST_PWD_CHANGE) + { + status = NT_STATUS_ACCESS_DENIED; + goto done; + } + + IFSET(SAMR_FIELD_NT_PASSWORD_PRESENT) + { + status = samr_set_password_aes( + dce_call, + mem_ctx, + &session_key, + a_state->sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + &r->in.info->info32.password, + DSDB_PASSWORD_RESET); + } + else IFSET(SAMR_FIELD_LM_PASSWORD_PRESENT) + { + status = samr_set_password_aes( + dce_call, + mem_ctx, + &session_key, + a_state->sam_ctx, + a_state->account_dn, + a_state->domain_state->domain_dn, + &r->in.info->info32.password, + DSDB_PASSWORD_RESET); + } + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + IFSET(SAMR_FIELD_EXPIRED_FLAG) + { + const char *t = "0"; + struct ldb_message_element *set_el; + if (r->in.info->info32.info.password_expired == + PASS_DONT_CHANGE_AT_NEXT_LOGON) { + t = "-1"; + } + if (ldb_msg_add_string(msg, "pwdLastSet", t) != + LDB_SUCCESS) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + set_el = ldb_msg_find_element(msg, "pwdLastSet"); + set_el->flags = LDB_FLAG_MOD_REPLACE; + } +#undef IFSET + + break; + default: + /* many info classes are not valid for SetUserInfo */ + status = NT_STATUS_INVALID_INFO_CLASS; + goto done; + } + + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + /* modify the samdb record */ + if (msg->num_elements > 0) { + ret = ldb_modify(sam_ctx, msg); + if (ret != LDB_SUCCESS) { + DEBUG(1,("Failed to modify record %s: %s\n", + ldb_dn_get_linearized(a_state->account_dn), + ldb_errstring(sam_ctx))); + + status = dsdb_ldb_err_to_ntstatus(ret); + goto done; + } + } + + ret = ldb_transaction_commit(sam_ctx); + if (ret != LDB_SUCCESS) { + DBG_ERR("Failed to commit transaction modifying account record " + "%s: %s\n", + ldb_dn_get_linearized(msg->dn), + ldb_errstring(sam_ctx)); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + status = NT_STATUS_OK; +done: + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); + } + + return status; +} + + +/* + samr_GetGroupsForUser +*/ +static NTSTATUS dcesrv_samr_GetGroupsForUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetGroupsForUser *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + struct samr_domain_state *d_state; + struct ldb_result *res, *res_memberof; + const char * const attrs[] = { "primaryGroupID", + "memberOf", + NULL }; + const char * const group_attrs[] = { "objectSid", + NULL }; + + struct samr_RidWithAttributeArray *array; + struct ldb_message_element *memberof_el; + int i, ret, count = 0; + uint32_t primary_group_id; + char *filter; + + DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER); + + a_state = h->data; + d_state = a_state->domain_state; + + ret = dsdb_search_dn(a_state->sam_ctx, mem_ctx, + &res, + a_state->account_dn, + attrs, DSDB_SEARCH_SHOW_EXTENDED_DN); + + if (ret == LDB_ERR_NO_SUCH_OBJECT) { + return NT_STATUS_NO_SUCH_USER; + } else if (ret != LDB_SUCCESS) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } else if (res->count != 1) { + return NT_STATUS_NO_SUCH_USER; + } + + primary_group_id = ldb_msg_find_attr_as_uint(res->msgs[0], "primaryGroupID", + 0); + + filter = talloc_asprintf(mem_ctx, + "(&(|(grouptype=%d)(grouptype=%d))" + "(objectclass=group)(|", + GTYPE_SECURITY_UNIVERSAL_GROUP, + GTYPE_SECURITY_GLOBAL_GROUP); + if (filter == NULL) { + return NT_STATUS_NO_MEMORY; + } + + memberof_el = ldb_msg_find_element(res->msgs[0], "memberOf"); + if (memberof_el != NULL) { + for (i = 0; i < memberof_el->num_values; i++) { + const struct ldb_val *memberof_sid_binary; + char *memberof_sid_escaped; + struct ldb_dn *memberof_dn + = ldb_dn_from_ldb_val(mem_ctx, + a_state->sam_ctx, + &memberof_el->values[i]); + if (memberof_dn == NULL) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + memberof_sid_binary + = ldb_dn_get_extended_component(memberof_dn, + "SID"); + if (memberof_sid_binary == NULL) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + memberof_sid_escaped = ldb_binary_encode(mem_ctx, + *memberof_sid_binary); + if (memberof_sid_escaped == NULL) { + return NT_STATUS_NO_MEMORY; + } + filter = talloc_asprintf_append(filter, "(objectSID=%s)", + memberof_sid_escaped); + if (filter == NULL) { + return NT_STATUS_NO_MEMORY; + } + } + + ret = dsdb_search(a_state->sam_ctx, mem_ctx, + &res_memberof, + d_state->domain_dn, + LDB_SCOPE_SUBTREE, + group_attrs, 0, + "%s))", filter); + + if (ret != LDB_SUCCESS) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + count = res_memberof->count; + } + + array = talloc(mem_ctx, struct samr_RidWithAttributeArray); + if (array == NULL) + return NT_STATUS_NO_MEMORY; + + array->count = 0; + array->rids = NULL; + + array->rids = talloc_array(mem_ctx, struct samr_RidWithAttribute, + count + 1); + if (array->rids == NULL) + return NT_STATUS_NO_MEMORY; + + /* Adds the primary group */ + + array->rids[0].rid = primary_group_id; + array->rids[0].attributes = SE_GROUP_MANDATORY + | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED; + array->count += 1; + + /* Adds the additional groups */ + for (i = 0; i < count; i++) { + struct dom_sid *group_sid; + + group_sid = samdb_result_dom_sid(mem_ctx, + res_memberof->msgs[i], + "objectSid"); + if (group_sid == NULL) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + array->rids[i + 1].rid = + group_sid->sub_auths[group_sid->num_auths-1]; + array->rids[i + 1].attributes = SE_GROUP_MANDATORY + | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED; + array->count += 1; + } + + *r->out.rids = array; + + return NT_STATUS_OK; +} + +/* + * samr_QueryDisplayInfo + * + * A cache of the GUID's matching the last query is maintained + * in the SAMR_QUERY_DISPLAY_INFO_CACHE guid_cache maintained o + * n the dcesrv_handle. + */ +static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryDisplayInfo *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + struct ldb_result *res; + uint32_t i; + uint32_t results = 0; + uint32_t count = 0; + const char *const cache_attrs[] = {"objectGUID", NULL}; + const char *const attrs[] = { + "objectSID", "sAMAccountName", "displayName", "description", NULL}; + struct samr_DispEntryFull *entriesFull = NULL; + struct samr_DispEntryFullGroup *entriesFullGroup = NULL; + struct samr_DispEntryAscii *entriesAscii = NULL; + struct samr_DispEntryGeneral *entriesGeneral = NULL; + const char *filter; + int ret; + NTSTATUS status; + struct samr_guid_cache *cache = NULL; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + cache = &d_state->guid_caches[SAMR_QUERY_DISPLAY_INFO_CACHE]; + /* + * Can the cached results be used? + * The cache is discarded if the start index is zero, or the requested + * level is different from that in the cache. + */ + if ((r->in.start_idx == 0) || (r->in.level != cache->handle)) { + /* + * The cached results can not be used, so will need to query + * the database. + */ + + /* + * Get the search filter for the current level + */ + switch (r->in.level) { + case 1: + case 4: + filter = talloc_asprintf(mem_ctx, + "(&(objectclass=user)" + "(sAMAccountType=%d))", + ATYPE_NORMAL_ACCOUNT); + break; + case 2: + filter = talloc_asprintf(mem_ctx, + "(&(objectclass=user)" + "(sAMAccountType=%d))", + ATYPE_WORKSTATION_TRUST); + break; + case 3: + case 5: + filter = + talloc_asprintf(mem_ctx, + "(&(|(groupType=%d)(groupType=%d))" + "(objectClass=group))", + GTYPE_SECURITY_UNIVERSAL_GROUP, + GTYPE_SECURITY_GLOBAL_GROUP); + break; + default: + return NT_STATUS_INVALID_INFO_CLASS; + } + clear_guid_cache(cache); + + /* + * search for all requested objects in all domains. + */ + ret = dsdb_search(d_state->sam_ctx, + mem_ctx, + &res, + ldb_get_default_basedn(d_state->sam_ctx), + LDB_SCOPE_SUBTREE, + cache_attrs, + 0, + "%s", + filter); + if (ret != LDB_SUCCESS) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + if ((res->count == 0) || (r->in.max_entries == 0)) { + return NT_STATUS_OK; + } + + status = load_guid_cache(cache, d_state, res->count, res->msgs); + TALLOC_FREE(res); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + cache->handle = r->in.level; + } + *r->out.total_size = cache->size; + + /* + * if there are no entries or the requested start index is greater + * than the number of entries, we return an empty response. + */ + if (r->in.start_idx >= cache->size) { + *r->out.returned_size = 0; + switch(r->in.level) { + case 1: + r->out.info->info1.count = *r->out.returned_size; + r->out.info->info1.entries = NULL; + break; + case 2: + r->out.info->info2.count = *r->out.returned_size; + r->out.info->info2.entries = NULL; + break; + case 3: + r->out.info->info3.count = *r->out.returned_size; + r->out.info->info3.entries = NULL; + break; + case 4: + r->out.info->info4.count = *r->out.returned_size; + r->out.info->info4.entries = NULL; + break; + case 5: + r->out.info->info5.count = *r->out.returned_size; + r->out.info->info5.entries = NULL; + break; + } + return NT_STATUS_OK; + } + + /* + * Allocate an array of the appropriate result structures for the + * current query level. + * + * r->in.start_idx is always < cache->size due to the check above + */ + results = MIN((cache->size - r->in.start_idx), r->in.max_entries); + switch (r->in.level) { + case 1: + entriesGeneral = talloc_array( + mem_ctx, struct samr_DispEntryGeneral, results); + break; + case 2: + entriesFull = + talloc_array(mem_ctx, struct samr_DispEntryFull, results); + break; + case 3: + entriesFullGroup = talloc_array( + mem_ctx, struct samr_DispEntryFullGroup, results); + break; + case 4: + case 5: + entriesAscii = + talloc_array(mem_ctx, struct samr_DispEntryAscii, results); + break; + } + + if ((entriesGeneral == NULL) && (entriesFull == NULL) && + (entriesAscii == NULL) && (entriesFullGroup == NULL)) + return NT_STATUS_NO_MEMORY; + + /* + * Process the list of result GUID's. + * Read the details of each object and populate the result structure + * for the current level. + */ + count = 0; + for (i = 0; i < results; i++) { + struct dom_sid *objectsid; + struct ldb_result *rec; + const uint32_t idx = r->in.start_idx + i; + uint32_t rid; + + /* + * Read an object from disk using the GUID as the key + * + * If the object can not be read, or it does not have a SID + * it is ignored. In this case the number of entries returned + * will be less than the requested size, there will also be + * a gap in the idx numbers in the returned elements e.g. if + * there are 3 GUIDs a, b, c in the cache and b is deleted from + * disk then details for a, and c will be returned with + * idx values of 1 and 3 respectively. + * + */ + ret = dsdb_search_by_dn_guid(d_state->sam_ctx, + mem_ctx, + &rec, + &cache->entries[idx], + attrs, + 0); + if (ret == LDB_ERR_NO_SUCH_OBJECT) { + struct GUID_txt_buf guid_buf; + char *guid_str = + GUID_buf_string(&cache->entries[idx], + &guid_buf); + DBG_WARNING("GUID [%s] not found\n", guid_str); + continue; + } else if (ret != LDB_SUCCESS) { + clear_guid_cache(cache); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + objectsid = samdb_result_dom_sid(mem_ctx, + rec->msgs[0], + "objectSID"); + if (objectsid == NULL) { + struct GUID_txt_buf guid_buf; + DBG_WARNING( + "objectSID for GUID [%s] not found\n", + GUID_buf_string(&cache->entries[idx], &guid_buf)); + continue; + } + status = dom_sid_split_rid(NULL, + objectsid, + NULL, + &rid); + if (!NT_STATUS_IS_OK(status)) { + struct dom_sid_buf sid_buf; + struct GUID_txt_buf guid_buf; + DBG_WARNING( + "objectSID [%s] for GUID [%s] invalid\n", + dom_sid_str_buf(objectsid, &sid_buf), + GUID_buf_string(&cache->entries[idx], &guid_buf)); + continue; + } + + /* + * Populate the result structure for the current object + */ + switch(r->in.level) { + case 1: + + entriesGeneral[count].idx = idx + 1; + entriesGeneral[count].rid = rid; + + entriesGeneral[count].acct_flags = + samdb_result_acct_flags(rec->msgs[0], NULL); + entriesGeneral[count].account_name.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "sAMAccountName", ""); + entriesGeneral[count].full_name.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "displayName", ""); + entriesGeneral[count].description.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "description", ""); + break; + case 2: + entriesFull[count].idx = idx + 1; + entriesFull[count].rid = rid; + + /* + * No idea why we need to or in ACB_NORMAL here, + * but this is what Win2k3 seems to do... + */ + entriesFull[count].acct_flags = + samdb_result_acct_flags(rec->msgs[0], NULL) | + ACB_NORMAL; + entriesFull[count].account_name.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "sAMAccountName", ""); + entriesFull[count].description.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "description", ""); + break; + case 3: + entriesFullGroup[count].idx = idx + 1; + entriesFullGroup[count].rid = rid; + + /* + * We get a "7" here for groups + */ + entriesFullGroup[count].acct_flags = + SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | + SE_GROUP_ENABLED; + entriesFullGroup[count].account_name.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "sAMAccountName", ""); + entriesFullGroup[count].description.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "description", ""); + break; + case 4: + case 5: + entriesAscii[count].idx = idx + 1; + entriesAscii[count].account_name.string = + ldb_msg_find_attr_as_string( + rec->msgs[0], "sAMAccountName", ""); + break; + } + count++; + } + + /* + * Build the response based on the request level. + */ + *r->out.returned_size = count; + switch(r->in.level) { + case 1: + r->out.info->info1.count = count; + r->out.info->info1.entries = entriesGeneral; + break; + case 2: + r->out.info->info2.count = count; + r->out.info->info2.entries = entriesFull; + break; + case 3: + r->out.info->info3.count = count; + r->out.info->info3.entries = entriesFullGroup; + break; + case 4: + r->out.info->info4.count = count; + r->out.info->info4.entries = entriesAscii; + break; + case 5: + r->out.info->info5.count = count; + r->out.info->info5.entries = entriesAscii; + break; + } + + return ((r->in.start_idx + results) < cache->size) + ? STATUS_MORE_ENTRIES + : NT_STATUS_OK; +} + + +/* + samr_GetDisplayEnumerationIndex +*/ +static NTSTATUS dcesrv_samr_GetDisplayEnumerationIndex(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetDisplayEnumerationIndex *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_TestPrivateFunctionsDomain +*/ +static NTSTATUS dcesrv_samr_TestPrivateFunctionsDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_TestPrivateFunctionsDomain *r) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + + +/* + samr_TestPrivateFunctionsUser +*/ +static NTSTATUS dcesrv_samr_TestPrivateFunctionsUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_TestPrivateFunctionsUser *r) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + + +/* + samr_GetUserPwInfo +*/ +static NTSTATUS dcesrv_samr_GetUserPwInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetUserPwInfo *r) +{ + struct dcesrv_handle *h; + struct samr_account_state *a_state; + + ZERO_STRUCTP(r->out.info); + + DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER); + + a_state = h->data; + + r->out.info->min_password_length = samdb_search_uint(a_state->sam_ctx, + mem_ctx, 0, a_state->domain_state->domain_dn, "minPwdLength", + NULL); + r->out.info->password_properties = samdb_search_uint(a_state->sam_ctx, + mem_ctx, 0, a_state->account_dn, "pwdProperties", NULL); + + return NT_STATUS_OK; +} + + +/* + samr_RemoveMemberFromForeignDomain +*/ +static NTSTATUS dcesrv_samr_RemoveMemberFromForeignDomain(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_RemoveMemberFromForeignDomain *r) +{ + struct dcesrv_handle *h; + struct samr_domain_state *d_state; + const char *memberdn; + struct ldb_message **res; + const char *no_attrs[] = { NULL }; + int i, count; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + memberdn = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL, + "distinguishedName", "(objectSid=%s)", + ldap_encode_ndr_dom_sid(mem_ctx, r->in.sid)); + /* Nothing to do */ + if (memberdn == NULL) { + return NT_STATUS_OK; + } + + count = samdb_search_domain(d_state->sam_ctx, mem_ctx, + d_state->domain_dn, &res, no_attrs, + d_state->domain_sid, + "(&(member=%s)(objectClass=group)" + "(|(groupType=%d)(groupType=%d)))", + memberdn, + GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, + GTYPE_SECURITY_DOMAIN_LOCAL_GROUP); + + if (count < 0) + return NT_STATUS_INTERNAL_DB_CORRUPTION; + + for (i=0; i<count; i++) { + struct ldb_message *mod; + int ret; + + mod = ldb_msg_new(mem_ctx); + if (mod == NULL) { + return NT_STATUS_NO_MEMORY; + } + + mod->dn = res[i]->dn; + + if (samdb_msg_add_delval(d_state->sam_ctx, mem_ctx, mod, + "member", memberdn) != LDB_SUCCESS) + return NT_STATUS_NO_MEMORY; + + ret = ldb_modify(d_state->sam_ctx, mod); + talloc_free(mod); + if (ret != LDB_SUCCESS) { + return dsdb_ldb_err_to_ntstatus(ret); + } + } + + return NT_STATUS_OK; +} + + +/* + samr_QueryDomainInfo2 + + just an alias for samr_QueryDomainInfo +*/ +static NTSTATUS dcesrv_samr_QueryDomainInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryDomainInfo2 *r) +{ + struct samr_QueryDomainInfo r1; + NTSTATUS status; + + r1 = (struct samr_QueryDomainInfo) { + .in.domain_handle = r->in.domain_handle, + .in.level = r->in.level, + .out.info = r->out.info, + }; + + status = dcesrv_samr_QueryDomainInfo(dce_call, mem_ctx, &r1); + + return status; +} + + +/* + samr_QueryUserInfo2 + + just an alias for samr_QueryUserInfo +*/ +static NTSTATUS dcesrv_samr_QueryUserInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryUserInfo2 *r) +{ + struct samr_QueryUserInfo r1; + NTSTATUS status; + + r1 = (struct samr_QueryUserInfo) { + .in.user_handle = r->in.user_handle, + .in.level = r->in.level, + .out.info = r->out.info + }; + + status = dcesrv_samr_QueryUserInfo(dce_call, mem_ctx, &r1); + + return status; +} + + +/* + samr_QueryDisplayInfo2 +*/ +static NTSTATUS dcesrv_samr_QueryDisplayInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryDisplayInfo2 *r) +{ + struct samr_QueryDisplayInfo q; + NTSTATUS result; + + q = (struct samr_QueryDisplayInfo) { + .in.domain_handle = r->in.domain_handle, + .in.level = r->in.level, + .in.start_idx = r->in.start_idx, + .in.max_entries = r->in.max_entries, + .in.buf_size = r->in.buf_size, + .out.total_size = r->out.total_size, + .out.returned_size = r->out.returned_size, + .out.info = r->out.info, + }; + + result = dcesrv_samr_QueryDisplayInfo(dce_call, mem_ctx, &q); + + return result; +} + + +/* + samr_GetDisplayEnumerationIndex2 +*/ +static NTSTATUS dcesrv_samr_GetDisplayEnumerationIndex2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetDisplayEnumerationIndex2 *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_QueryDisplayInfo3 +*/ +static NTSTATUS dcesrv_samr_QueryDisplayInfo3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_QueryDisplayInfo3 *r) +{ + struct samr_QueryDisplayInfo q; + NTSTATUS result; + + q = (struct samr_QueryDisplayInfo) { + .in.domain_handle = r->in.domain_handle, + .in.level = r->in.level, + .in.start_idx = r->in.start_idx, + .in.max_entries = r->in.max_entries, + .in.buf_size = r->in.buf_size, + .out.total_size = r->out.total_size, + .out.returned_size = r->out.returned_size, + .out.info = r->out.info, + }; + + result = dcesrv_samr_QueryDisplayInfo(dce_call, mem_ctx, &q); + + return result; +} + + +/* + samr_AddMultipleMembersToAlias +*/ +static NTSTATUS dcesrv_samr_AddMultipleMembersToAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_AddMultipleMembersToAlias *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_RemoveMultipleMembersFromAlias +*/ +static NTSTATUS dcesrv_samr_RemoveMultipleMembersFromAlias(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_RemoveMultipleMembersFromAlias *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_GetDomPwInfo + + this fetches the default password properties for a domain + + note that w2k3 completely ignores the domain name in this call, and + always returns the information for the servers primary domain +*/ +static NTSTATUS dcesrv_samr_GetDomPwInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetDomPwInfo *r) +{ + struct ldb_message **msgs; + int ret; + const char * const attrs[] = {"minPwdLength", "pwdProperties", NULL }; + struct ldb_context *sam_ctx; + + ZERO_STRUCTP(r->out.info); + + sam_ctx = dcesrv_samdb_connect_as_user(mem_ctx, dce_call); + if (sam_ctx == NULL) { + return NT_STATUS_INVALID_SYSTEM_SERVICE; + } + + /* The domain name in this call is ignored */ + ret = gendb_search_dn(sam_ctx, + mem_ctx, NULL, &msgs, attrs); + if (ret <= 0) { + talloc_free(sam_ctx); + + return NT_STATUS_NO_SUCH_DOMAIN; + } + if (ret > 1) { + talloc_free(msgs); + talloc_free(sam_ctx); + + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + r->out.info->min_password_length = ldb_msg_find_attr_as_uint(msgs[0], + "minPwdLength", 0); + r->out.info->password_properties = ldb_msg_find_attr_as_uint(msgs[0], + "pwdProperties", 1); + + talloc_free(msgs); + talloc_unlink(mem_ctx, sam_ctx); + + return NT_STATUS_OK; +} + + +/* + samr_Connect2 +*/ +static NTSTATUS dcesrv_samr_Connect2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_Connect2 *r) +{ + struct samr_Connect c; + + c = (struct samr_Connect) { + .in.system_name = NULL, + .in.access_mask = r->in.access_mask, + .out.connect_handle = r->out.connect_handle, + }; + + return dcesrv_samr_Connect(dce_call, mem_ctx, &c); +} + + +/* + samr_SetUserInfo2 + + just an alias for samr_SetUserInfo +*/ +static NTSTATUS dcesrv_samr_SetUserInfo2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetUserInfo2 *r) +{ + struct samr_SetUserInfo r2; + + r2 = (struct samr_SetUserInfo) { + .in.user_handle = r->in.user_handle, + .in.level = r->in.level, + .in.info = r->in.info, + }; + + return dcesrv_samr_SetUserInfo(dce_call, mem_ctx, &r2); +} + + +/* + samr_SetBootKeyInformation +*/ +static NTSTATUS dcesrv_samr_SetBootKeyInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetBootKeyInformation *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_GetBootKeyInformation +*/ +static NTSTATUS dcesrv_samr_GetBootKeyInformation(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_GetBootKeyInformation *r) +{ + /* Windows Server 2008 returns this */ + return NT_STATUS_NOT_SUPPORTED; +} + + +/* + samr_Connect3 +*/ +static NTSTATUS dcesrv_samr_Connect3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_Connect3 *r) +{ + struct samr_Connect c; + + c = (struct samr_Connect) { + .in.system_name = NULL, + .in.access_mask = r->in.access_mask, + .out.connect_handle = r->out.connect_handle, + }; + + return dcesrv_samr_Connect(dce_call, mem_ctx, &c); +} + + +/* + samr_Connect4 +*/ +static NTSTATUS dcesrv_samr_Connect4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_Connect4 *r) +{ + struct samr_Connect c; + + c = (struct samr_Connect) { + .in.system_name = NULL, + .in.access_mask = r->in.access_mask, + .out.connect_handle = r->out.connect_handle, + }; + + return dcesrv_samr_Connect(dce_call, mem_ctx, &c); +} + + +/* + samr_Connect5 +*/ +static NTSTATUS dcesrv_samr_Connect5(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_Connect5 *r) +{ + struct samr_Connect c; + NTSTATUS status; + + c = (struct samr_Connect) { + .in.system_name = NULL, + .in.access_mask = r->in.access_mask, + .out.connect_handle = r->out.connect_handle, + }; + + status = dcesrv_samr_Connect(dce_call, mem_ctx, &c); + + r->out.info_out->info1.client_version = SAMR_CONNECT_AFTER_W2K; + r->out.info_out->info1.supported_features = 0; + *r->out.level_out = r->in.level_in; + + return status; +} + + +/* + samr_RidToSid +*/ +static NTSTATUS dcesrv_samr_RidToSid(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_RidToSid *r) +{ + struct samr_domain_state *d_state; + struct dcesrv_handle *h; + + DCESRV_PULL_HANDLE(h, r->in.domain_handle, SAMR_HANDLE_DOMAIN); + + d_state = h->data; + + /* form the users SID */ + *r->out.sid = dom_sid_add_rid(mem_ctx, d_state->domain_sid, r->in.rid); + if (!*r->out.sid) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + + +/* + samr_SetDsrmPassword +*/ +static NTSTATUS dcesrv_samr_SetDsrmPassword(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, + struct samr_SetDsrmPassword *r) +{ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +} + + +/* + samr_ValidatePassword + + For now the call checks the password complexity (if active) and the minimum + password length on level 2 and 3. Level 1 is ignored for now. +*/ +static NTSTATUS dcesrv_samr_ValidatePassword(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_ValidatePassword *r) +{ + struct samr_GetDomPwInfo r2; + struct samr_PwInfo pwInfo; + const char *account = NULL; + DATA_BLOB password; + enum samr_ValidationStatus res; + NTSTATUS status; + enum dcerpc_transport_t transport = + dcerpc_binding_get_transport(dce_call->conn->endpoint->ep_description); + enum dcerpc_AuthLevel auth_level = DCERPC_AUTH_LEVEL_NONE; + + if (transport != NCACN_IP_TCP && transport != NCALRPC) { + DCESRV_FAULT(DCERPC_FAULT_ACCESS_DENIED); + } + + dcesrv_call_auth_info(dce_call, NULL, &auth_level); + if (auth_level != DCERPC_AUTH_LEVEL_PRIVACY) { + DCESRV_FAULT(DCERPC_FAULT_ACCESS_DENIED); + } + + (*r->out.rep) = talloc_zero(mem_ctx, union samr_ValidatePasswordRep); + + r2 = (struct samr_GetDomPwInfo) { + .in.domain_name = NULL, + .out.info = &pwInfo, + }; + + status = dcesrv_samr_GetDomPwInfo(dce_call, mem_ctx, &r2); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + switch (r->in.level) { + case NetValidateAuthentication: + /* we don't support this yet */ + return NT_STATUS_NOT_SUPPORTED; + break; + case NetValidatePasswordChange: + account = r->in.req->req2.account.string; + password = data_blob_const(r->in.req->req2.password.string, + r->in.req->req2.password.length); + res = samdb_check_password(mem_ctx, + dce_call->conn->dce_ctx->lp_ctx, + account, + NULL, /* userPrincipalName */ + NULL, /* displayName/full_name */ + &password, + pwInfo.password_properties, + pwInfo.min_password_length); + (*r->out.rep)->ctr2.status = res; + break; + case NetValidatePasswordReset: + account = r->in.req->req3.account.string; + password = data_blob_const(r->in.req->req3.password.string, + r->in.req->req3.password.length); + res = samdb_check_password(mem_ctx, + dce_call->conn->dce_ctx->lp_ctx, + account, + NULL, /* userPrincipalName */ + NULL, /* displayName/full_name */ + &password, + pwInfo.password_properties, + pwInfo.min_password_length); + (*r->out.rep)->ctr3.status = res; + break; + default: + return NT_STATUS_INVALID_INFO_CLASS; + break; + } + + return NT_STATUS_OK; +} + +static void dcesrv_samr_Opnum68NotUsedOnWire(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_Opnum68NotUsedOnWire *r) +{ + DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR); +} + +static void dcesrv_samr_Opnum69NotUsedOnWire(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_Opnum69NotUsedOnWire *r) +{ + DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR); +} + +static void dcesrv_samr_Opnum70NotUsedOnWire(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_Opnum70NotUsedOnWire *r) +{ + DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR); +} + +static void dcesrv_samr_Opnum71NotUsedOnWire(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_Opnum71NotUsedOnWire *r) +{ + DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR); +} + +static void dcesrv_samr_Opnum72NotUsedOnWire(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_Opnum72NotUsedOnWire *r) +{ + DCESRV_FAULT_VOID(DCERPC_FAULT_OP_RNG_ERROR); +} + +/* include the generated boilerplate */ +#include "librpc/gen_ndr/ndr_samr_s.c" diff --git a/source4/rpc_server/samr/dcesrv_samr.h b/source4/rpc_server/samr/dcesrv_samr.h new file mode 100644 index 0000000..66038ed --- /dev/null +++ b/source4/rpc_server/samr/dcesrv_samr.h @@ -0,0 +1,88 @@ +/* + Unix SMB/CIFS implementation. + + endpoint server for the samr pipe - definitions + + Copyright (C) Andrew Tridgell 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "param/param.h" +#include "libds/common/roles.h" + +/* + this type allows us to distinguish handle types +*/ +enum samr_handle { + SAMR_HANDLE_CONNECT, + SAMR_HANDLE_DOMAIN, + SAMR_HANDLE_USER, + SAMR_HANDLE_GROUP, + SAMR_HANDLE_ALIAS +}; + + +/* + state asscoiated with a samr_Connect*() operation +*/ +struct samr_connect_state { + struct ldb_context *sam_ctx; + uint32_t access_mask; +}; + +/* + * Cache of object GUIDS + */ +struct samr_guid_cache { + unsigned handle; + unsigned size; + struct GUID *entries; +}; + +enum samr_guid_cache_id { + SAMR_QUERY_DISPLAY_INFO_CACHE, + SAMR_ENUM_DOMAIN_GROUPS_CACHE, + SAMR_ENUM_DOMAIN_USERS_CACHE, + SAMR_LAST_CACHE +}; + +/* + state associated with a samr_OpenDomain() operation +*/ +struct samr_domain_state { + struct samr_connect_state *connect_state; + void *sam_ctx; + uint32_t access_mask; + struct dom_sid *domain_sid; + const char *domain_name; + struct ldb_dn *domain_dn; + enum server_role role; + bool builtin; + struct loadparm_context *lp_ctx; + struct samr_guid_cache guid_caches[SAMR_LAST_CACHE]; + struct samr_SamEntry *domain_users_cached; +}; + +/* + state associated with a open account handle +*/ +struct samr_account_state { + struct samr_domain_state *domain_state; + void *sam_ctx; + uint32_t access_mask; + struct dom_sid *account_sid; + const char *account_name; + struct ldb_dn *account_dn; +}; diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c new file mode 100644 index 0000000..b581be6 --- /dev/null +++ b/source4/rpc_server/samr/samr_password.c @@ -0,0 +1,833 @@ +/* + Unix SMB/CIFS implementation. + + samr server password set/change handling + + Copyright (C) Andrew Tridgell 2004 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "rpc_server/dcerpc_server.h" +#include "rpc_server/common/common.h" +#include "rpc_server/samr/dcesrv_samr.h" +#include "system/time.h" +#include "lib/crypto/md4.h" +#include "dsdb/common/util.h" +#include "dsdb/samdb/samdb.h" +#include "auth/auth.h" +#include "libcli/auth/libcli_auth.h" +#include "../lib/util/util_ldb.h" +#include "rpc_server/samr/proto.h" +#include "auth/auth_sam.h" +#include "lib/param/loadparm.h" +#include "librpc/rpc/dcerpc_helper.h" +#include "librpc/rpc/dcerpc_samr.h" + +#include "lib/crypto/gnutls_helpers.h" +#include <gnutls/gnutls.h> +#include <gnutls/crypto.h> + +static void log_password_change_event(struct imessaging_context *msg_ctx, + struct loadparm_context *lp_ctx, + const struct tsocket_address *remote_client_address, + const struct tsocket_address *local_server_address, + const char *auth_description, + const char *password_type, + const char *original_client_name, + const char *account_name_from_db, + NTSTATUS status, + struct dom_sid *sid) +{ + /* + * Forcing this via the NTLM auth structure is not ideal, but + * it is the most practical option right now, and ensures the + * logs are consistent, even if some elements are always NULL. + */ + struct auth_usersupplied_info ui = { + .was_mapped = true, + .client = { + .account_name = original_client_name, + .domain_name = lpcfg_sam_name(lp_ctx), + }, + .mapped = { + .account_name = account_name_from_db, + .domain_name = lpcfg_sam_name(lp_ctx), + }, + .remote_host = remote_client_address, + .local_host = local_server_address, + .service_description = "SAMR Password Change", + .auth_description = auth_description, + .password_type = password_type, + }; + + log_authentication_event(msg_ctx, + lp_ctx, + NULL, + &ui, + status, + ui.mapped.domain_name, + ui.mapped.account_name, + sid); +} +/* + samr_ChangePasswordUser + + So old it is just not worth implementing + because it does not supply a plaintext and so we can't do password + complexity checking and cannot update all the other password hashes. + +*/ +NTSTATUS dcesrv_samr_ChangePasswordUser(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_ChangePasswordUser *r) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +/* + samr_OemChangePasswordUser2 + + No longer implemented as it requires the LM hash +*/ +NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_OemChangePasswordUser2 *r) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +/* + samr_ChangePasswordUser4 +*/ +NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_ChangePasswordUser4 *r) +{ +#ifdef HAVE_GNUTLS_PBKDF2 + struct ldb_context *sam_ctx = NULL; + struct ldb_message *msg = NULL; + struct ldb_dn *dn = NULL; + const char *samAccountName = NULL; + struct dom_sid *objectSid = NULL; + struct samr_Password *nt_pwd = NULL; + gnutls_datum_t nt_key; + gnutls_datum_t salt = { + .data = r->in.password->salt, + .size = sizeof(r->in.password->salt), + }; + uint8_t cdk_data[16] = {0}; + DATA_BLOB cdk = { + .data = cdk_data, + .length = sizeof(cdk_data), + }; + struct auth_session_info *call_session_info = NULL; + struct auth_session_info *old_session_info = NULL; + NTSTATUS status = NT_STATUS_WRONG_PASSWORD; + int rc; + + r->out.result = NT_STATUS_WRONG_PASSWORD; + + if (r->in.password == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + if (r->in.password->PBKDF2Iterations < 5000 || + r->in.password->PBKDF2Iterations > 1000000) { + return NT_STATUS_INVALID_PARAMETER; + } + /* + * Connect to a SAMDB with system privileges for fetching the old + * password hashes. + */ + sam_ctx = samdb_connect(mem_ctx, + dce_call->event_ctx, + dce_call->conn->dce_ctx->lp_ctx, + system_session(dce_call->conn->dce_ctx->lp_ctx), + dce_call->conn->remote_address, + 0); + if (sam_ctx == NULL) { + return NT_STATUS_INVALID_SYSTEM_SERVICE; + } + + rc = ldb_transaction_start(sam_ctx); + if (rc != LDB_SUCCESS) { + DBG_WARNING("Failed to start transaction: %s\n", + ldb_errstring(sam_ctx)); + return NT_STATUS_TRANSACTION_ABORTED; + } + + /* + * We use authsam_search_account() to be consistent with the + * other callers in the bad password and audit log handling + * systems. It ensures we get DSDB_SEARCH_SHOW_EXTENDED_DN. + */ + status = authsam_search_account(mem_ctx, + sam_ctx, + r->in.account->string, + ldb_get_default_basedn(sam_ctx), + &msg); + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); + goto done; + } + + dn = msg->dn; + samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL); + objectSid = samdb_result_dom_sid(msg, msg, "objectSid"); + + status = samdb_result_passwords(mem_ctx, + dce_call->conn->dce_ctx->lp_ctx, + msg, + &nt_pwd); + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); + goto done; + } + + if (nt_pwd == NULL) { + ldb_transaction_cancel(sam_ctx); + status = NT_STATUS_WRONG_PASSWORD; + goto done; + } + + nt_key = (gnutls_datum_t){ + .data = nt_pwd->hash, + .size = sizeof(nt_pwd->hash), + }; + + rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, + &nt_key, + &salt, + r->in.password->PBKDF2Iterations, + cdk.data, + cdk.length); + if (rc < 0) { + ldb_transaction_cancel(sam_ctx); + status = NT_STATUS_WRONG_PASSWORD; + goto done; + } + + /* Drop to user privileges for the password change */ + + old_session_info = ldb_get_opaque(sam_ctx, DSDB_SESSION_INFO); + call_session_info = dcesrv_call_session_info(dce_call); + + rc = ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, call_session_info); + if (rc != LDB_SUCCESS) { + ldb_transaction_cancel(sam_ctx); + status = NT_STATUS_INVALID_SYSTEM_SERVICE; + goto done; + } + + status = samr_set_password_aes(dce_call, + mem_ctx, + &cdk, + sam_ctx, + dn, + NULL, + r->in.password, + DSDB_PASSWORD_CHECKED_AND_CORRECT); + BURN_DATA(cdk_data); + + /* Restore our privileges to system level */ + if (old_session_info != NULL) { + ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, old_session_info); + } + + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); + goto done; + } + + /* And this confirms it in a transaction commit */ + rc = ldb_transaction_commit(sam_ctx); + if (rc != LDB_SUCCESS) { + DBG_WARNING("Failed to commit transaction to change password " + "on %s: %s\n", + ldb_dn_get_linearized(dn), + ldb_errstring(sam_ctx)); + status = NT_STATUS_TRANSACTION_ABORTED; + goto done; + } + + status = NT_STATUS_OK; +done: + { + struct imessaging_context *imsg_ctx = + dcesrv_imessaging_context(dce_call->conn); + + log_password_change_event(imsg_ctx, + dce_call->conn->dce_ctx->lp_ctx, + dce_call->conn->remote_address, + dce_call->conn->local_address, + "samr_ChangePasswordUser4", + "AES using NTLM-hash", + r->in.account->string, + samAccountName, + status, + objectSid); + } + + /* Only update the badPwdCount if we found the user */ + if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) { + authsam_update_bad_pwd_count(sam_ctx, + msg, + ldb_get_default_basedn(sam_ctx)); + } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) { + /* + * Don't give the game away: (don't allow anonymous users to + * prove the existence of usernames) + */ + status = NT_STATUS_WRONG_PASSWORD; + } + + return status; +#else /* HAVE_GNUTLS_PBKDF2 */ + DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR); +#endif /* HAVE_GNUTLS_PBKDF2 */ +} + +/* + samr_ChangePasswordUser3 +*/ +NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_ChangePasswordUser3 *r) +{ + struct imessaging_context *imsg_ctx = + dcesrv_imessaging_context(dce_call->conn); + NTSTATUS status = NT_STATUS_WRONG_PASSWORD; + DATA_BLOB new_password; + struct ldb_context *sam_ctx = NULL; + struct ldb_dn *user_dn = NULL; + int ret; + struct ldb_message *msg = NULL; + struct samr_Password *nt_pwd; + struct samr_DomInfo1 *dominfo = NULL; + struct userPwdChangeFailureInformation *reject = NULL; + enum samPwdChangeReason reason = SAM_PWD_CHANGE_NO_ERROR; + uint8_t new_nt_hash[16]; + struct samr_Password nt_verifier; + const char *user_samAccountName = NULL; + struct dom_sid *user_objectSid = NULL; + struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + enum ntlm_auth_level ntlm_auth_level + = lpcfg_ntlm_auth(lp_ctx); + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t nt_session_key; + struct auth_session_info *call_session_info = NULL; + struct auth_session_info *old_session_info = NULL; + int rc; + + *r->out.dominfo = NULL; + *r->out.reject = NULL; + + /* this call should be disabled without NTLM auth */ + if (ntlm_auth_level == NTLM_AUTH_DISABLED) { + DBG_WARNING("NTLM password changes not" + "permitted by configuration.\n"); + return NT_STATUS_NTLM_BLOCKED; + } + + if (r->in.nt_password == NULL || + r->in.nt_verifier == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + /* Connect to a SAMDB with system privileges for fetching the old pw + * hashes. */ + sam_ctx = dcesrv_samdb_connect_as_system(mem_ctx, dce_call); + if (sam_ctx == NULL) { + return NT_STATUS_INVALID_SYSTEM_SERVICE; + } + + ret = ldb_transaction_start(sam_ctx); + if (ret != LDB_SUCCESS) { + DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx))); + return NT_STATUS_TRANSACTION_ABORTED; + } + + /* + * We use authsam_search_account() to be consistent with the + * other callers in the bad password and audit log handling + * systems. It ensures we get DSDB_SEARCH_SHOW_EXTENDED_DN. + */ + status = authsam_search_account(mem_ctx, + sam_ctx, + r->in.account->string, + ldb_get_default_basedn(sam_ctx), + &msg); + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + user_dn = msg->dn; + user_samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL); + user_objectSid = samdb_result_dom_sid(mem_ctx, msg, "objectSid"); + + status = samdb_result_passwords(mem_ctx, lp_ctx, + msg, &nt_pwd); + if (!NT_STATUS_IS_OK(status) ) { + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + if (!nt_pwd) { + status = NT_STATUS_WRONG_PASSWORD; + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + /* decrypt the password we have been given */ + nt_session_key = (gnutls_datum_t) { + .data = nt_pwd->hash, + .size = sizeof(nt_pwd->hash), + }; + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &nt_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + rc = gnutls_cipher_decrypt(cipher_hnd, + r->in.nt_password->data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + if (!extract_pw_from_buffer(mem_ctx, r->in.nt_password->data, &new_password)) { + DEBUG(3,("samr: failed to decode password buffer\n")); + status = NT_STATUS_WRONG_PASSWORD; + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + if (r->in.nt_verifier == NULL) { + status = NT_STATUS_WRONG_PASSWORD; + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + /* check NT verifier */ + mdfour(new_nt_hash, new_password.data, new_password.length); + + rc = E_old_pw_hash(new_nt_hash, nt_pwd->hash, nt_verifier.hash); + if (rc != 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); + ldb_transaction_cancel(sam_ctx); + goto failed; + } + if (!mem_equal_const_time(nt_verifier.hash, r->in.nt_verifier->hash, 16)) { + status = NT_STATUS_WRONG_PASSWORD; + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + /* Drop to user privileges for the password change */ + + old_session_info = ldb_get_opaque(sam_ctx, DSDB_SESSION_INFO); + call_session_info = dcesrv_call_session_info(dce_call); + + ret = ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, call_session_info); + if (ret != LDB_SUCCESS) { + status = NT_STATUS_INVALID_SYSTEM_SERVICE; + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + /* Performs the password modification. We pass the old hashes read out + * from the database since they were already checked against the user- + * provided ones. */ + status = samdb_set_password(sam_ctx, mem_ctx, + user_dn, NULL, + &new_password, + NULL, + DSDB_PASSWORD_CHECKED_AND_CORRECT, + &reason, + &dominfo); + + /* Restore our privileges to system level */ + if (old_session_info != NULL) { + ldb_set_opaque(sam_ctx, DSDB_SESSION_INFO, old_session_info); + } + + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); + goto failed; + } + + /* And this confirms it in a transaction commit */ + ret = ldb_transaction_commit(sam_ctx); + if (ret != LDB_SUCCESS) { + DEBUG(1,("Failed to commit transaction to change password on %s: %s\n", + ldb_dn_get_linearized(user_dn), + ldb_errstring(sam_ctx))); + status = NT_STATUS_TRANSACTION_ABORTED; + goto failed; + } + + status = NT_STATUS_OK; + +failed: + + log_password_change_event(imsg_ctx, + lp_ctx, + dce_call->conn->remote_address, + dce_call->conn->local_address, + "samr_ChangePasswordUser3", + "RC4/DES using NTLM-hash", + r->in.account->string, + user_samAccountName, + status, + user_objectSid); + if (NT_STATUS_IS_OK(status)) { + return NT_STATUS_OK; + } + + /* Only update the badPwdCount if we found the user */ + if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) { + NTSTATUS bad_pwd_status; + + bad_pwd_status = authsam_update_bad_pwd_count( + sam_ctx, msg, ldb_get_default_basedn(sam_ctx)); + if (NT_STATUS_EQUAL(bad_pwd_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { + status = bad_pwd_status; + } + } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) { + /* Don't give the game away: (don't allow anonymous users to prove the existence of usernames) */ + status = NT_STATUS_WRONG_PASSWORD; + } + + reject = talloc_zero(mem_ctx, struct userPwdChangeFailureInformation); + if (reject != NULL) { + reject->extendedFailureReason = reason; + + *r->out.reject = reject; + } + + *r->out.dominfo = dominfo; + + return status; +} + +/* + samr_ChangePasswordUser2 + + easy - just a subset of samr_ChangePasswordUser3 +*/ +NTSTATUS dcesrv_samr_ChangePasswordUser2(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + struct samr_ChangePasswordUser2 *r) +{ + struct samr_ChangePasswordUser3 r2; + struct samr_DomInfo1 *dominfo = NULL; + struct userPwdChangeFailureInformation *reject = NULL; + + r2.in.server = r->in.server; + r2.in.account = r->in.account; + r2.in.nt_password = r->in.nt_password; + r2.in.nt_verifier = r->in.nt_verifier; + r2.in.lm_change = r->in.lm_change; + r2.in.lm_password = r->in.lm_password; + r2.in.lm_verifier = r->in.lm_verifier; + r2.in.password3 = NULL; + r2.out.dominfo = &dominfo; + r2.out.reject = &reject; + + return dcesrv_samr_ChangePasswordUser3(dce_call, mem_ctx, &r2); +} + + +/* + set password via a samr_CryptPassword buffer +*/ +NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, + struct ldb_context *sam_ctx, + struct ldb_dn *account_dn, struct ldb_dn *domain_dn, + TALLOC_CTX *mem_ctx, + struct samr_CryptPassword *pwbuf) +{ + NTSTATUS nt_status; + DATA_BLOB new_password; + DATA_BLOB session_key = data_blob(NULL, 0); + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t _session_key; + struct auth_session_info *session_info = + dcesrv_call_session_info(dce_call); + struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + int rc; + bool encrypted; + + encrypted = dcerpc_is_transport_encrypted(session_info); + if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + return NT_STATUS_ACCESS_DENIED; + } + + nt_status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_NOTICE("samr: failed to get session key: %s\n", + nt_errstr(nt_status)); + return nt_status; + } + + _session_key = (gnutls_datum_t) { + .data = session_key.data, + .size = session_key.length, + }; + + /* + * This is safe to support as we only have a session key + * over a SMB connection which we force to be encrypted. + */ + GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &_session_key, + NULL); + if (rc < 0) { + GNUTLS_FIPS140_SET_STRICT_MODE(); + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } + + rc = gnutls_cipher_decrypt(cipher_hnd, + pwbuf->data, + 516); + gnutls_cipher_deinit(cipher_hnd); + GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } + + if (!extract_pw_from_buffer(mem_ctx, pwbuf->data, &new_password)) { + DEBUG(3,("samr: failed to decode password buffer\n")); + return NT_STATUS_WRONG_PASSWORD; + } + + /* set the password - samdb needs to know both the domain and user DNs, + so the domain password policy can be used */ + nt_status = samdb_set_password(sam_ctx, + mem_ctx, + account_dn, + domain_dn, + &new_password, + NULL, + DSDB_PASSWORD_RESET, + NULL, + NULL); +out: + return nt_status; +} + + +/* + set password via a samr_CryptPasswordEx buffer +*/ +NTSTATUS samr_set_password_ex(struct dcesrv_call_state *dce_call, + struct ldb_context *sam_ctx, + struct ldb_dn *account_dn, + struct ldb_dn *domain_dn, + TALLOC_CTX *mem_ctx, + struct samr_CryptPasswordEx *pwbuf) +{ + struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + struct auth_session_info *session_info = + dcesrv_call_session_info(dce_call); + NTSTATUS nt_status; + DATA_BLOB new_password; + + /* The confounder is in the last 16 bytes of the buffer */ + DATA_BLOB confounder = data_blob_const(&pwbuf->data[516], 16); + DATA_BLOB pw_data = data_blob_const(pwbuf->data, 516); + DATA_BLOB session_key = data_blob(NULL, 0); + int rc; + bool encrypted; + + nt_status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(3,("samr: failed to get session key: %s " + "=> NT_STATUS_WRONG_PASSWORD\n", + nt_errstr(nt_status))); + return NT_STATUS_WRONG_PASSWORD; + } + + encrypted = dcerpc_is_transport_encrypted(session_info); + if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && + !encrypted) { + return NT_STATUS_ACCESS_DENIED; + } + + GNUTLS_FIPS140_SET_LAX_MODE(); + rc = samba_gnutls_arcfour_confounded_md5(&confounder, + &session_key, + &pw_data, + SAMBA_GNUTLS_DECRYPT); + GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED); + goto out; + } + + if (!extract_pw_from_buffer(mem_ctx, pwbuf->data, &new_password)) { + DEBUG(3,("samr: failed to decode password buffer\n")); + nt_status = NT_STATUS_WRONG_PASSWORD; + goto out; + } + + /* set the password - samdb needs to know both the domain and user DNs, + so the domain password policy can be used */ + nt_status = samdb_set_password(sam_ctx, + mem_ctx, + account_dn, + domain_dn, + &new_password, + NULL, + DSDB_PASSWORD_RESET, + NULL, + NULL); + ZERO_ARRAY_LEN(new_password.data, + new_password.length); + +out: + return nt_status; +} + +/* + set password via encrypted NT and LM hash buffers +*/ +NTSTATUS samr_set_password_buffers(struct dcesrv_call_state *dce_call, + struct ldb_context *sam_ctx, + struct ldb_dn *account_dn, + struct ldb_dn *domain_dn, + TALLOC_CTX *mem_ctx, + const uint8_t *lm_pwd_hash, + const uint8_t *nt_pwd_hash) +{ + struct samr_Password *d_lm_pwd_hash = NULL, *d_nt_pwd_hash = NULL; + uint8_t random_session_key[16] = { 0, }; + DATA_BLOB session_key = data_blob(NULL, 0); + DATA_BLOB in, out; + NTSTATUS nt_status = NT_STATUS_OK; + int rc; + + nt_status = dcesrv_transport_session_key(dce_call, &session_key); + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_USER_SESSION_KEY)) { + DEBUG(3,("samr: failed to get session key: %s " + "=> use a random session key\n", + nt_errstr(nt_status))); + + /* + * Windows just uses a random key + */ + generate_random_buffer(random_session_key, + sizeof(random_session_key)); + session_key = data_blob_const(random_session_key, + sizeof(random_session_key)); + nt_status = NT_STATUS_OK; + } + if (!NT_STATUS_IS_OK(nt_status)) { + return nt_status; + } + + if (nt_pwd_hash != NULL) { + in = data_blob_const(nt_pwd_hash, 16); + out = data_blob_talloc_zero(mem_ctx, 16); + + rc = sess_crypt_blob(&out, &in, &session_key, SAMBA_GNUTLS_DECRYPT); + if (rc != 0) { + return gnutls_error_to_ntstatus(rc, + NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); + } + + d_nt_pwd_hash = (struct samr_Password *) out.data; + } + + if ((d_lm_pwd_hash != NULL) || (d_nt_pwd_hash != NULL)) { + nt_status = samdb_set_password(sam_ctx, mem_ctx, account_dn, + domain_dn, NULL, + d_nt_pwd_hash, + DSDB_PASSWORD_RESET, + NULL, NULL); + } + + return nt_status; +} + +NTSTATUS samr_set_password_aes(struct dcesrv_call_state *dce_call, + TALLOC_CTX *mem_ctx, + const DATA_BLOB *cdk, + struct ldb_context *sam_ctx, + struct ldb_dn *account_dn, + struct ldb_dn *domain_dn, + struct samr_EncryptedPasswordAES *pwbuf, + enum dsdb_password_checked old_password_checked) +{ + DATA_BLOB pw_data = data_blob_null; + DATA_BLOB new_password = data_blob_null; + const DATA_BLOB ciphertext = + data_blob_const(pwbuf->cipher, pwbuf->cipher_len); + DATA_BLOB iv = data_blob_const(pwbuf->salt, sizeof(pwbuf->salt)); + NTSTATUS nt_status = NT_STATUS_OK; + bool ok; + + nt_status = samba_gnutls_aead_aes_256_cbc_hmac_sha512_decrypt( + mem_ctx, + &ciphertext, + cdk, + &samr_aes256_enc_key_salt, + &samr_aes256_mac_key_salt, + &iv, + pwbuf->auth_data, + &pw_data); + if (!NT_STATUS_IS_OK(nt_status)) { + return NT_STATUS_WRONG_PASSWORD; + } + + ok = extract_pwd_blob_from_buffer514(mem_ctx, + pw_data.data, + &new_password); + TALLOC_FREE(pw_data.data); + if (!ok) { + DBG_NOTICE("samr: failed to decode password buffer\n"); + return NT_STATUS_WRONG_PASSWORD; + } + + nt_status = samdb_set_password(sam_ctx, + mem_ctx, + account_dn, + domain_dn, + &new_password, + NULL, + old_password_checked, + NULL, + NULL); + TALLOC_FREE(new_password.data); + + return nt_status; +} |