source3/lib/netapi/samr.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  NetApi Samr Support
   4  *  Copyright (C) Guenther Deschner 2008
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "lib/netapi/netapi.h"
  22 #include "lib/netapi/netapi_private.h"
  23 #include "rpc_client/rpc_client.h"
  24 #include "../librpc/gen_ndr/ndr_samr_c.h"
  25 #include "rpc_client/cli_samr.h"
  26 #include "rpc_client/init_lsa.h"
  27 #include "../libcli/security/security.h"
  28
  29 /****************************************************************
  30 ****************************************************************/
  31
  32 WERROR libnetapi_samr_open_domain(struct libnetapi_ctx *mem_ctx,
  33                                   struct rpc_pipe_client *pipe_cli,
  34                                   uint32_t connect_mask,
  35                                   uint32_t domain_mask,
  36                                   struct policy_handle *connect_handle,
  37                                   struct policy_handle *domain_handle,
  38                                   struct dom_sid2 **domain_sid)
  39 {
  40         NTSTATUS status, result;
  41         WERROR werr;
  42         struct libnetapi_private_ctx *priv;
  43         uint32_t resume_handle = 0;
  44         uint32_t num_entries = 0;
  45         struct samr_SamArray *sam = NULL;
  46         const char *domain_name = NULL;
  47         struct lsa_String lsa_domain_name;
  48         bool domain_found = false;
  49         int i;
  50         struct dcerpc_binding_handle *b = pipe_cli->binding_handle;
  51
  52         priv = talloc_get_type_abort(mem_ctx->private_data,
  53                 struct libnetapi_private_ctx);
  54
  55         if (is_valid_policy_hnd(&priv->samr.connect_handle)) {
  56                 if ((priv->samr.connect_mask & connect_mask) == connect_mask) {
  57                         *connect_handle = priv->samr.connect_handle;
  58                 } else {
  59                         libnetapi_samr_close_connect_handle(mem_ctx,
  60                                 &priv->samr.connect_handle);
  61                 }
  62         }
  63
  64         if (is_valid_policy_hnd(&priv->samr.domain_handle)) {
  65                 if ((priv->samr.domain_mask & domain_mask) == domain_mask) {
  66                         *domain_handle = priv->samr.domain_handle;
  67                 } else {
  68                         libnetapi_samr_close_domain_handle(mem_ctx,
  69                                 &priv->samr.domain_handle);
  70                 }
  71         }
  72
  73         if (priv->samr.domain_sid) {
  74                 *domain_sid = priv->samr.domain_sid;
  75         }
  76
  77         if (is_valid_policy_hnd(&priv->samr.connect_handle) &&
  78             ((priv->samr.connect_mask & connect_mask) == connect_mask) &&
  79             is_valid_policy_hnd(&priv->samr.domain_handle) &&
  80             (priv->samr.domain_mask & domain_mask) == domain_mask) {
  81                 return WERR_OK;
  82         }
  83
  84         if (!is_valid_policy_hnd(connect_handle)) {
  85                 status = dcerpc_try_samr_connects(pipe_cli->binding_handle, mem_ctx,
  86                                                   pipe_cli->srv_name_slash,
  87                                                   connect_mask,
  88                                                   connect_handle,
  89                                                   &result);
  90                 if (any_nt_status_not_ok(status, result, &status)) {
  91                         werr = ntstatus_to_werror(status);
  92                         goto done;
  93                 }
  94         }
  95
  96         status = dcerpc_samr_EnumDomains(b, mem_ctx,
  97                                          connect_handle,
  98                                          &resume_handle,
  99                                          &sam,
 100                                          0xffffffff,
 101                                          &num_entries,
 102                                          &result);
 103         if (any_nt_status_not_ok(status, result, &status)) {
 104                 werr = ntstatus_to_werror(status);
 105                 goto done;
 106         }
 107
 108         for (i=0; i<num_entries; i++) {
 109
 110                 domain_name = sam->entries[i].name.string;
 111
 112                 if (strequal(domain_name, builtin_domain_name())) {
 113                         continue;
 114                 }
 115
 116                 domain_found = true;
 117                 break;
 118         }
 119
 120         if (!domain_found) {
 121                 werr = WERR_NO_SUCH_DOMAIN;
 122                 goto done;
 123         }
 124
 125         init_lsa_String(&lsa_domain_name, domain_name);
 126
 127         status = dcerpc_samr_LookupDomain(b, mem_ctx,
 128                                           connect_handle,
 129                                           &lsa_domain_name,
 130                                           domain_sid,
 131                                           &result);
 132         if (any_nt_status_not_ok(status, result, &status)) {
 133                 werr = ntstatus_to_werror(status);
 134                 goto done;
 135         }
 136
 137         status = dcerpc_samr_OpenDomain(b, mem_ctx,
 138                                         connect_handle,
 139                                         domain_mask,
 140                                         *domain_sid,
 141                                         domain_handle,
 142                                         &result);
 143         if (any_nt_status_not_ok(status, result, &status)) {
 144                 werr = ntstatus_to_werror(status);
 145                 goto done;
 146         }
 147
 148         priv->samr.cli                  = pipe_cli;
 149
 150         priv->samr.domain_name          = domain_name;
 151         priv->samr.domain_sid           = *domain_sid;
 152
 153         priv->samr.connect_mask         = connect_mask;
 154         priv->samr.connect_handle       = *connect_handle;
 155
 156         priv->samr.domain_mask          = domain_mask;
 157         priv->samr.domain_handle        = *domain_handle;
 158
 159         werr = WERR_OK;
 160
 161  done:
 162         return werr;
 163 }
 164
 165 /****************************************************************
 166 ****************************************************************/
 167
 168 WERROR libnetapi_samr_open_builtin_domain(struct libnetapi_ctx *mem_ctx,
 169                                           struct rpc_pipe_client *pipe_cli,
 170                                           uint32_t connect_mask,
 171                                           uint32_t builtin_mask,
 172                                           struct policy_handle *connect_handle,
 173                                           struct policy_handle *builtin_handle)
 174 {
 175         NTSTATUS status, result;
 176         WERROR werr;
 177         struct libnetapi_private_ctx *priv;
 178         struct dcerpc_binding_handle *b = pipe_cli->binding_handle;
 179
 180         priv = talloc_get_type_abort(mem_ctx->private_data,
 181                 struct libnetapi_private_ctx);
 182
 183         if (is_valid_policy_hnd(&priv->samr.connect_handle)) {
 184                 if ((priv->samr.connect_mask & connect_mask) == connect_mask) {
 185                         *connect_handle = priv->samr.connect_handle;
 186                 } else {
 187                         libnetapi_samr_close_connect_handle(mem_ctx,
 188                                 &priv->samr.connect_handle);
 189                 }
 190         }
 191
 192         if (is_valid_policy_hnd(&priv->samr.builtin_handle)) {
 193                 if ((priv->samr.builtin_mask & builtin_mask) == builtin_mask) {
 194                         *builtin_handle = priv->samr.builtin_handle;
 195                 } else {
 196                         libnetapi_samr_close_builtin_handle(mem_ctx,
 197                                 &priv->samr.builtin_handle);
 198                 }
 199         }
 200
 201         if (is_valid_policy_hnd(&priv->samr.connect_handle) &&
 202             ((priv->samr.connect_mask & connect_mask) == connect_mask) &&
 203             is_valid_policy_hnd(&priv->samr.builtin_handle) &&
 204             (priv->samr.builtin_mask & builtin_mask) == builtin_mask) {
 205                 return WERR_OK;
 206         }
 207
 208         if (!is_valid_policy_hnd(connect_handle)) {
 209                 status = dcerpc_try_samr_connects(pipe_cli->binding_handle, mem_ctx,
 210                                                   pipe_cli->srv_name_slash,
 211                                                   connect_mask,
 212                                                   connect_handle,
 213                                                   &result);
 214                 if (any_nt_status_not_ok(status, result, &status)) {
 215                         werr = ntstatus_to_werror(status);
 216                         goto done;
 217                 }
 218         }
 219
 220         status = dcerpc_samr_OpenDomain(b, mem_ctx,
 221                                         connect_handle,
 222                                         builtin_mask,
 223                                         discard_const_p(struct dom_sid, &global_sid_Builtin),
 224                                         builtin_handle,
 225                                         &result);
 226         if (any_nt_status_not_ok(status, result, &status)) {
 227                 werr = ntstatus_to_werror(status);
 228                 goto done;
 229         }
 230
 231         priv->samr.cli                  = pipe_cli;
 232
 233         priv->samr.connect_mask         = connect_mask;
 234         priv->samr.connect_handle       = *connect_handle;
 235
 236         priv->samr.builtin_mask         = builtin_mask;
 237         priv->samr.builtin_handle       = *builtin_handle;
 238
 239         werr = WERR_OK;
 240
 241  done:
 242         return werr;
 243 }
 244
 245 /****************************************************************
 246 ****************************************************************/
 247
 248 void libnetapi_samr_close_domain_handle(struct libnetapi_ctx *ctx,
 249                                         struct policy_handle *handle)
 250 {
 251         struct libnetapi_private_ctx *priv;
 252         struct dcerpc_binding_handle *b;
 253         NTSTATUS result;
 254
 255         if (!is_valid_policy_hnd(handle)) {
 256                 return;
 257         }
 258
 259         priv = talloc_get_type_abort(ctx->private_data,
 260                 struct libnetapi_private_ctx);
 261
 262         if (!ndr_policy_handle_equal(handle, &priv->samr.domain_handle)) {
 263                 return;
 264         }
 265
 266         b = priv->samr.cli->binding_handle;
 267
 268         dcerpc_samr_Close(b, ctx, handle, &result);
 269
 270         ZERO_STRUCT(priv->samr.domain_handle);
 271 }
 272
 273 /****************************************************************
 274 ****************************************************************/
 275
 276 void libnetapi_samr_close_builtin_handle(struct libnetapi_ctx *ctx,
 277                                          struct policy_handle *handle)
 278 {
 279         struct libnetapi_private_ctx *priv;
 280         struct dcerpc_binding_handle *b;
 281         NTSTATUS result;
 282
 283         if (!is_valid_policy_hnd(handle)) {
 284                 return;
 285         }
 286
 287         priv = talloc_get_type_abort(ctx->private_data,
 288                 struct libnetapi_private_ctx);
 289
 290         if (!ndr_policy_handle_equal(handle, &priv->samr.builtin_handle)) {
 291                 return;
 292         }
 293
 294         b = priv->samr.cli->binding_handle;
 295
 296         dcerpc_samr_Close(b, ctx, handle, &result);
 297
 298         ZERO_STRUCT(priv->samr.builtin_handle);
 299 }
 300
 301 /****************************************************************
 302 ****************************************************************/
 303
 304 void libnetapi_samr_close_connect_handle(struct libnetapi_ctx *ctx,
 305                                          struct policy_handle *handle)
 306 {
 307         struct libnetapi_private_ctx *priv;
 308         struct dcerpc_binding_handle *b;
 309         NTSTATUS result;
 310
 311         if (!is_valid_policy_hnd(handle)) {
 312                 return;
 313         }
 314
 315         priv = talloc_get_type_abort(ctx->private_data,
 316                 struct libnetapi_private_ctx);
 317
 318         if (!ndr_policy_handle_equal(handle, &priv->samr.connect_handle)) {
 319                 return;
 320         }
 321
 322         b = priv->samr.cli->binding_handle;
 323
 324         dcerpc_samr_Close(b, ctx, handle, &result);
 325
 326         ZERO_STRUCT(priv->samr.connect_handle);
 327 }
 328
 329 /****************************************************************
 330 ****************************************************************/
 331
 332 void libnetapi_samr_free(struct libnetapi_ctx *ctx)
 333 {
 334         struct libnetapi_private_ctx *priv;
 335
 336         if (!ctx->private_data) {
 337                 return;
 338         }
 339
 340         priv = talloc_get_type_abort(ctx->private_data,
 341                 struct libnetapi_private_ctx);
 342
 343         libnetapi_samr_close_domain_handle(ctx, &priv->samr.domain_handle);
 344         libnetapi_samr_close_builtin_handle(ctx, &priv->samr.builtin_handle);
 345         libnetapi_samr_close_connect_handle(ctx, &priv->samr.connect_handle);
 346 }