source3/winbindd/winbindd_msrpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind rpc backend functions
   5
   6    Copyright (C) Tim Potter 2000-2001,2003
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2008 (pidl conversion)
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #include "winbindd_rpc.h"
  28
  29 #include "../librpc/gen_ndr/ndr_samr_c.h"
  30 #include "rpc_client/cli_pipe.h"
  31 #include "rpc_client/cli_samr.h"
  32 #include "rpc_client/cli_lsarpc.h"
  33 #include "../libcli/security/security.h"
  34 #include "libsmb/samlogon_cache.h"
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_WINBIND
  38
  39 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
  40                                       struct winbindd_domain *domain,
  41                                       uint32_t num_names,
  42                                       const char **names,
  43                                       const char ***domains,
  44                                       struct dom_sid **sids,
  45                                       enum lsa_SidType **types);
  46
  47 /* Query display info for a domain.  This returns enough information plus a
  48    bit extra to give an overview of domain users for the User Manager
  49    application. */
  50 static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
  51                                       TALLOC_CTX *mem_ctx,
  52                                       uint32_t **prids)
  53 {
  54         struct rpc_pipe_client *samr_pipe = NULL;
  55         struct policy_handle dom_pol;
  56         uint32_t *rids = NULL;
  57         TALLOC_CTX *tmp_ctx;
  58         NTSTATUS status;
  59
  60         DEBUG(3, ("msrpc_query_user_list\n"));
  61
  62         tmp_ctx = talloc_stackframe();
  63         if (tmp_ctx == NULL) {
  64                 return NT_STATUS_NO_MEMORY;
  65         }
  66
  67         if ( !winbindd_can_contact_domain( domain ) ) {
  68                 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
  69                           domain->name));
  70                 status = NT_STATUS_OK;
  71                 goto done;
  72         }
  73
  74         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
  75         if (!NT_STATUS_IS_OK(status)) {
  76                 goto done;
  77         }
  78
  79         status = rpc_query_user_list(tmp_ctx,
  80                                      samr_pipe,
  81                                      &dom_pol,
  82                                      &domain->sid,
  83                                      &rids);
  84         if (!NT_STATUS_IS_OK(status)) {
  85                 goto done;
  86         }
  87
  88         if (prids) {
  89                 *prids = talloc_move(mem_ctx, &rids);
  90         }
  91
  92 done:
  93         TALLOC_FREE(rids);
  94         TALLOC_FREE(tmp_ctx);
  95         return status;
  96 }
  97
  98 /* list all domain groups */
  99 static NTSTATUS msrpc_enum_dom_groups(struct winbindd_domain *domain,
 100                                       TALLOC_CTX *mem_ctx,
 101                                       uint32_t *pnum_info,
 102                                       struct wb_acct_info **pinfo)
 103 {
 104         struct rpc_pipe_client *samr_pipe;
 105         struct policy_handle dom_pol;
 106         struct wb_acct_info *info = NULL;
 107         uint32_t num_info = 0;
 108         TALLOC_CTX *tmp_ctx;
 109         NTSTATUS status;
 110
 111         DEBUG(3,("msrpc_enum_dom_groups\n"));
 112
 113         if (pnum_info) {
 114                 *pnum_info = 0;
 115         }
 116
 117         tmp_ctx = talloc_stackframe();
 118         if (tmp_ctx == NULL) {
 119                 return NT_STATUS_NO_MEMORY;
 120         }
 121
 122         if ( !winbindd_can_contact_domain( domain ) ) {
 123                 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
 124                           domain->name));
 125                 status = NT_STATUS_OK;
 126                 goto done;
 127         }
 128
 129         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 130         if (!NT_STATUS_IS_OK(status)) {
 131                 goto done;
 132         }
 133
 134         status = rpc_enum_dom_groups(tmp_ctx,
 135                                      samr_pipe,
 136                                      &dom_pol,
 137                                      &num_info,
 138                                      &info);
 139         if (!NT_STATUS_IS_OK(status)) {
 140                 goto done;
 141         }
 142
 143         if (pnum_info) {
 144                 *pnum_info = num_info;
 145         }
 146
 147         if (pinfo) {
 148                 *pinfo = talloc_move(mem_ctx, &info);
 149         }
 150
 151 done:
 152         TALLOC_FREE(tmp_ctx);
 153         return status;
 154 }
 155
 156 /* List all domain groups */
 157
 158 static NTSTATUS msrpc_enum_local_groups(struct winbindd_domain *domain,
 159                                         TALLOC_CTX *mem_ctx,
 160                                         uint32_t *pnum_info,
 161                                         struct wb_acct_info **pinfo)
 162 {
 163         struct rpc_pipe_client *samr_pipe;
 164         struct policy_handle dom_pol;
 165         struct wb_acct_info *info = NULL;
 166         uint32_t num_info = 0;
 167         TALLOC_CTX *tmp_ctx;
 168         NTSTATUS status;
 169
 170         DEBUG(3,("msrpc_enum_local_groups\n"));
 171
 172         if (pnum_info) {
 173                 *pnum_info = 0;
 174         }
 175
 176         tmp_ctx = talloc_stackframe();
 177         if (tmp_ctx == NULL) {
 178                 return NT_STATUS_NO_MEMORY;
 179         }
 180
 181         if ( !winbindd_can_contact_domain( domain ) ) {
 182                 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
 183                           domain->name));
 184                 status = NT_STATUS_OK;
 185                 goto done;
 186         }
 187
 188         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 189         if (!NT_STATUS_IS_OK(status)) {
 190                 goto done;
 191         }
 192
 193         status = rpc_enum_local_groups(mem_ctx,
 194                                        samr_pipe,
 195                                        &dom_pol,
 196                                        &num_info,
 197                                        &info);
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 goto done;
 200         }
 201
 202         if (pnum_info) {
 203                 *pnum_info = num_info;
 204         }
 205
 206         if (pinfo) {
 207                 *pinfo = talloc_move(mem_ctx, &info);
 208         }
 209
 210 done:
 211         TALLOC_FREE(tmp_ctx);
 212         return status;
 213 }
 214
 215 /* convert a single name to a sid in a domain */
 216 static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
 217                                   TALLOC_CTX *mem_ctx,
 218                                   const char *domain_name,
 219                                   const char *name,
 220                                   uint32_t flags,
 221                                   const char **pdom_name,
 222                                   struct dom_sid *sid,
 223                                   enum lsa_SidType *type)
 224 {
 225         NTSTATUS result;
 226         struct dom_sid *sids = NULL;
 227         enum lsa_SidType *types = NULL;
 228         char *full_name = NULL;
 229         const char *names[1] = { NULL, };
 230         const char **domains = NULL;
 231         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 232         char *mapped_name = NULL;
 233
 234         if (name == NULL || *name=='\0') {
 235                 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
 236         } else if (domain_name == NULL || *domain_name == '\0') {
 237                 full_name = talloc_asprintf(mem_ctx, "%s", name);
 238         } else {
 239                 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
 240         }
 241         if (!full_name) {
 242                 DEBUG(0, ("talloc_asprintf failed!\n"));
 243                 return NT_STATUS_NO_MEMORY;
 244         }
 245
 246         DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name));
 247
 248         name_map_status = normalize_name_unmap(mem_ctx, full_name,
 249                                                &mapped_name);
 250
 251         /* Reset the full_name pointer if we mapped anything */
 252
 253         if (NT_STATUS_IS_OK(name_map_status) ||
 254             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 255         {
 256                 full_name = mapped_name;
 257         }
 258
 259         DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
 260                  full_name?full_name:"", domain_name ));
 261
 262         names[0] = full_name;
 263
 264         result = winbindd_lookup_names(mem_ctx, domain, 1,
 265                                        names, &domains,
 266                                        &sids, &types);
 267         if (!NT_STATUS_IS_OK(result))
 268                 return result;
 269
 270         /* Return rid and type if lookup successful */
 271
 272         if (pdom_name != NULL) {
 273                 const char *dom_name = NULL;
 274
 275                 if (domains[0] != NULL) {
 276                         dom_name = talloc_strdup(mem_ctx, domains[0]);
 277                         if (dom_name == NULL) {
 278                                 return NT_STATUS_NO_MEMORY;
 279                         }
 280                 }
 281                 *pdom_name = dom_name;
 282         }
 283
 284         sid_copy(sid, &sids[0]);
 285         *type = types[0];
 286
 287         return NT_STATUS_OK;
 288 }
 289
 290 /*
 291   convert a domain SID to a user or group name
 292 */
 293 static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
 294                                   TALLOC_CTX *mem_ctx,
 295                                   const struct dom_sid *sid,
 296                                   char **domain_name,
 297                                   char **name,
 298                                   enum lsa_SidType *type)
 299 {
 300         char **domains;
 301         char **names;
 302         enum lsa_SidType *types = NULL;
 303         NTSTATUS result;
 304         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 305         char *mapped_name = NULL;
 306         struct dom_sid_buf buf;
 307
 308         DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n",
 309                   dom_sid_str_buf(sid, &buf),
 310                   domain->name));
 311
 312         result = winbindd_lookup_sids(mem_ctx,
 313                                       domain,
 314                                       1,
 315                                       sid,
 316                                       &domains,
 317                                       &names,
 318                                       &types);
 319         if (!NT_STATUS_IS_OK(result)) {
 320                 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
 321                         nt_errstr(result)));
 322                 return result;
 323         }
 324
 325
 326         *type = (enum lsa_SidType)types[0];
 327         *domain_name = domains[0];
 328         *name = names[0];
 329
 330         DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
 331
 332         name_map_status = normalize_name_map(mem_ctx, domain->name, *name,
 333                                              &mapped_name);
 334         if (NT_STATUS_IS_OK(name_map_status) ||
 335             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 336         {
 337                 *name = mapped_name;
 338                 DEBUG(5,("returning mapped name -- %s\n", *name));
 339         }
 340
 341         return NT_STATUS_OK;
 342 }
 343
 344 static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
 345                                     TALLOC_CTX *mem_ctx,
 346                                     const struct dom_sid *sid,
 347                                     uint32_t *rids,
 348                                     size_t num_rids,
 349                                     char **domain_name,
 350                                     char ***names,
 351                                     enum lsa_SidType **types)
 352 {
 353         char **domains;
 354         NTSTATUS result;
 355         struct dom_sid *sids;
 356         size_t i;
 357         char **ret_names;
 358
 359         DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain->name ));
 360
 361         if (num_rids) {
 362                 sids = talloc_array(mem_ctx, struct dom_sid, num_rids);
 363                 if (sids == NULL) {
 364                         return NT_STATUS_NO_MEMORY;
 365                 }
 366         } else {
 367                 sids = NULL;
 368         }
 369
 370         for (i=0; i<num_rids; i++) {
 371                 if (!sid_compose(&sids[i], sid, rids[i])) {
 372                         return NT_STATUS_INTERNAL_ERROR;
 373                 }
 374         }
 375
 376         result = winbindd_lookup_sids(mem_ctx,
 377                                       domain,
 378                                       num_rids,
 379                                       sids,
 380                                       &domains,
 381                                       names,
 382                                       types);
 383
 384         if (!NT_STATUS_IS_OK(result) &&
 385             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
 386                 return result;
 387         }
 388
 389         ret_names = *names;
 390         for (i=0; i<num_rids; i++) {
 391                 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 392                 char *mapped_name = NULL;
 393
 394                 if ((*types)[i] != SID_NAME_UNKNOWN) {
 395                         name_map_status = normalize_name_map(mem_ctx,
 396                                                              domain->name,
 397                                                              ret_names[i],
 398                                                              &mapped_name);
 399                         if (NT_STATUS_IS_OK(name_map_status) ||
 400                             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 401                         {
 402                                 ret_names[i] = mapped_name;
 403                         }
 404
 405                         *domain_name = domains[i];
 406                 }
 407         }
 408
 409         return result;
 410 }
 411
 412 /* Lookup groups a user is a member of.  I wish Unix had a call like this! */
 413 static NTSTATUS msrpc_lookup_usergroups(struct winbindd_domain *domain,
 414                                         TALLOC_CTX *mem_ctx,
 415                                         const struct dom_sid *user_sid,
 416                                         uint32_t *pnum_groups,
 417                                         struct dom_sid **puser_grpsids)
 418 {
 419         struct rpc_pipe_client *samr_pipe;
 420         struct policy_handle dom_pol;
 421         struct dom_sid *user_grpsids = NULL;
 422         struct dom_sid_buf buf;
 423         uint32_t num_groups = 0;
 424         TALLOC_CTX *tmp_ctx;
 425         NTSTATUS status;
 426
 427         DEBUG(3,("msrpc_lookup_usergroups sid=%s\n",
 428                  dom_sid_str_buf(user_sid, &buf)));
 429
 430         *pnum_groups = 0;
 431
 432         tmp_ctx = talloc_stackframe();
 433         if (tmp_ctx == NULL) {
 434                 return NT_STATUS_NO_MEMORY;
 435         }
 436
 437         /* Check if we have a cached user_info_3 */
 438         status = lookup_usergroups_cached(tmp_ctx,
 439                                           user_sid,
 440                                           &num_groups,
 441                                           &user_grpsids);
 442         if (NT_STATUS_IS_OK(status)) {
 443                 goto cached;
 444         }
 445
 446         if ( !winbindd_can_contact_domain( domain ) ) {
 447                 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
 448                           domain->name));
 449
 450                 /* Tell the cache manager not to remember this one */
 451                 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 452                 goto done;
 453         }
 454
 455         /* no cache; hit the wire */
 456         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 457         if (!NT_STATUS_IS_OK(status)) {
 458                 goto done;
 459         }
 460
 461         status = rpc_lookup_usergroups(tmp_ctx,
 462                                        samr_pipe,
 463                                        &dom_pol,
 464                                        &domain->sid,
 465                                        user_sid,
 466                                        &num_groups,
 467                                        &user_grpsids);
 468         if (!NT_STATUS_IS_OK(status)) {
 469                 goto done;
 470         }
 471
 472 cached:
 473         *pnum_groups = num_groups;
 474
 475         if (puser_grpsids) {
 476                 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
 477         }
 478
 479 done:
 480         TALLOC_FREE(tmp_ctx);
 481         return status;
 482         return NT_STATUS_OK;
 483 }
 484
 485 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
 486
 487 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
 488                                          TALLOC_CTX *mem_ctx,
 489                                          uint32_t num_sids, const struct dom_sid *sids,
 490                                          uint32_t *pnum_aliases,
 491                                          uint32_t **palias_rids)
 492 {
 493         struct rpc_pipe_client *samr_pipe;
 494         struct policy_handle dom_pol;
 495         uint32_t num_aliases = 0;
 496         uint32_t *alias_rids = NULL;
 497         TALLOC_CTX *tmp_ctx;
 498         NTSTATUS status;
 499
 500         DEBUG(3,("msrpc_lookup_useraliases\n"));
 501
 502         if (pnum_aliases) {
 503                 *pnum_aliases = 0;
 504         }
 505
 506         tmp_ctx = talloc_stackframe();
 507         if (tmp_ctx == NULL) {
 508                 return NT_STATUS_NO_MEMORY;
 509         }
 510
 511         if (!winbindd_can_contact_domain(domain)) {
 512                 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
 513                           domain->name));
 514                 /* Tell the cache manager not to remember this one */
 515                 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 516                 goto done;
 517         }
 518
 519         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 520         if (!NT_STATUS_IS_OK(status)) {
 521                 goto done;
 522         }
 523
 524         status = rpc_lookup_useraliases(tmp_ctx,
 525                                         samr_pipe,
 526                                         &dom_pol,
 527                                         num_sids,
 528                                         sids,
 529                                         &num_aliases,
 530                                         &alias_rids);
 531         if (!NT_STATUS_IS_OK(status)) {
 532                 goto done;
 533         }
 534
 535         if (pnum_aliases) {
 536                 *pnum_aliases = num_aliases;
 537         }
 538
 539         if (palias_rids) {
 540                 *palias_rids = talloc_move(mem_ctx, &alias_rids);
 541         }
 542
 543 done:
 544         TALLOC_FREE(tmp_ctx);
 545         return status;
 546 }
 547
 548 /* lookup alias membership */
 549 static NTSTATUS msrpc_lookup_aliasmem(struct winbindd_domain *domain,
 550                                       TALLOC_CTX *mem_ctx,
 551                                       const struct dom_sid *alias_sid,
 552                                       enum lsa_SidType type,
 553                                       uint32_t *pnum_sids,
 554                                       struct dom_sid **sid_mem)
 555 {
 556         struct rpc_pipe_client *samr_pipe = NULL;
 557         struct policy_handle dom_pol;
 558         struct dom_sid *alias_members = NULL;
 559         struct dom_sid_buf buf;
 560         uint32_t num_groups = 0;
 561         TALLOC_CTX *tmp_ctx = talloc_stackframe();
 562         NTSTATUS status;
 563
 564         D_INFO("Lookup alias members in domain=%s for sid=%s.\n",
 565                domain->name,
 566                dom_sid_str_buf(alias_sid, &buf));
 567
 568         *pnum_sids = 0;
 569
 570         if (!winbindd_can_contact_domain(domain)) {
 571                 D_DEBUG("No incoming trust for domain %s\n", domain->name);
 572                 status = NT_STATUS_OK;
 573                 goto done;
 574         }
 575
 576         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 577         if (!NT_STATUS_IS_OK(status)) {
 578                 goto done;
 579         }
 580
 581         status = rpc_lookup_aliasmem(tmp_ctx,
 582                                      samr_pipe,
 583                                      &dom_pol,
 584                                      &domain->sid,
 585                                      alias_sid,
 586                                      type,
 587                                      &num_groups,
 588                                      &alias_members);
 589         if (!NT_STATUS_IS_OK(status)) {
 590                 goto done;
 591         }
 592
 593         *pnum_sids = num_groups;
 594         if (sid_mem) {
 595                 *sid_mem = talloc_move(mem_ctx, &alias_members);
 596         }
 597
 598 done:
 599         talloc_free(tmp_ctx);
 600         return status;
 601 }
 602
 603 /* Lookup group membership given a rid.   */
 604 static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
 605                                       TALLOC_CTX *mem_ctx,
 606                                       const struct dom_sid *group_sid,
 607                                       enum lsa_SidType type,
 608                                       uint32_t *num_names,
 609                                       struct dom_sid **sid_mem,
 610                                       char ***names,
 611                                       uint32_t **name_types)
 612 {
 613         NTSTATUS status, result;
 614         uint32_t i, total_names = 0;
 615         struct policy_handle dom_pol, group_pol;
 616         uint32_t des_access = SEC_FLAG_MAXIMUM_ALLOWED;
 617         uint32_t *rid_mem = NULL;
 618         uint32_t group_rid;
 619         unsigned int j, r;
 620         struct rpc_pipe_client *cli;
 621         unsigned int orig_timeout;
 622         struct samr_RidAttrArray *rids = NULL;
 623         struct dcerpc_binding_handle *b;
 624         struct dom_sid_buf buf;
 625
 626         DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain->name,
 627                  dom_sid_str_buf(group_sid, &buf)));
 628
 629         if ( !winbindd_can_contact_domain( domain ) ) {
 630                 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
 631                           domain->name));
 632                 return NT_STATUS_OK;
 633         }
 634
 635         if (!sid_peek_check_rid(&domain->sid, group_sid, &group_rid))
 636                 return NT_STATUS_UNSUCCESSFUL;
 637
 638         *num_names = 0;
 639
 640         result = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
 641         if (!NT_STATUS_IS_OK(result))
 642                 return result;
 643
 644         b = cli->binding_handle;
 645
 646         status = dcerpc_samr_OpenGroup(b, mem_ctx,
 647                                        &dom_pol,
 648                                        des_access,
 649                                        group_rid,
 650                                        &group_pol,
 651                                        &result);
 652         if (any_nt_status_not_ok(status, result, &status)) {
 653                 return status;
 654         }
 655
 656         /* Step #1: Get a list of user rids that are the members of the
 657            group. */
 658
 659         /* This call can take a long time - allow the server to time out.
 660            35 seconds should do it. */
 661
 662         orig_timeout = rpccli_set_timeout(cli, 35000);
 663
 664         status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
 665                                               &group_pol,
 666                                               &rids,
 667                                               &result);
 668
 669         /* And restore our original timeout. */
 670         rpccli_set_timeout(cli, orig_timeout);
 671
 672         {
 673                 NTSTATUS _result;
 674                 dcerpc_samr_Close(b, mem_ctx, &group_pol, &_result);
 675         }
 676
 677         if (any_nt_status_not_ok(status, result, &status)) {
 678                 return status;
 679         }
 680
 681         if (!rids || !rids->count) {
 682                 names = NULL;
 683                 name_types = NULL;
 684                 sid_mem = NULL;
 685                 return NT_STATUS_OK;
 686         }
 687
 688         *num_names = rids->count;
 689         rid_mem = rids->rids;
 690
 691         /* Step #2: Convert list of rids into list of usernames.  Do this
 692            in bunches of ~1000 to avoid crashing NT4.  It looks like there
 693            is a buffer overflow or something like that lurking around
 694            somewhere. */
 695
 696 #define MAX_LOOKUP_RIDS 900
 697
 698         *names = talloc_zero_array(mem_ctx, char *, *num_names);
 699         *name_types = talloc_zero_array(mem_ctx, uint32_t, *num_names);
 700         *sid_mem = talloc_zero_array(mem_ctx, struct dom_sid, *num_names);
 701
 702         for (j=0;j<(*num_names);j++)
 703                 sid_compose(&(*sid_mem)[j], &domain->sid, rid_mem[j]);
 704
 705         if (*num_names>0 && (!*names || !*name_types))
 706                 return NT_STATUS_NO_MEMORY;
 707
 708         for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
 709                 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
 710                 struct lsa_Strings tmp_names;
 711                 struct samr_Ids tmp_types;
 712
 713                 /* Lookup a chunk of rids */
 714
 715                 status = dcerpc_samr_LookupRids(b, mem_ctx,
 716                                                 &dom_pol,
 717                                                 num_lookup_rids,
 718                                                 &rid_mem[i],
 719                                                 &tmp_names,
 720                                                 &tmp_types,
 721                                                 &result);
 722                 if (!NT_STATUS_IS_OK(status)) {
 723                         return status;
 724                 }
 725
 726                 /* see if we have a real error (and yes the
 727                    STATUS_SOME_UNMAPPED is the one returned from 2k) */
 728
 729                 if (!NT_STATUS_IS_OK(result) &&
 730                     !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
 731                         return result;
 732
 733                 /* Copy result into array.  The talloc system will take
 734                    care of freeing the temporary arrays later on. */
 735
 736                 if (tmp_names.count != num_lookup_rids) {
 737                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
 738                 }
 739                 if (tmp_types.count != num_lookup_rids) {
 740                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
 741                 }
 742
 743                 for (r=0; r<tmp_names.count; r++) {
 744                         if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
 745                                 continue;
 746                         }
 747                         if (total_names >= *num_names) {
 748                                 break;
 749                         }
 750                         (*names)[total_names] = fill_domain_username_talloc(
 751                                 mem_ctx, domain->name,
 752                                 tmp_names.names[r].string, true);
 753                         (*name_types)[total_names] = tmp_types.ids[r];
 754                         total_names += 1;
 755                 }
 756         }
 757
 758         *num_names = total_names;
 759
 760         return NT_STATUS_OK;
 761 }
 762
 763 /* get a list of trusted domains */
 764 static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
 765                                       TALLOC_CTX *mem_ctx,
 766                                       struct netr_DomainTrustList *ptrust_list)
 767 {
 768         struct rpc_pipe_client *lsa_pipe;
 769         struct policy_handle lsa_policy;
 770         struct netr_DomainTrust *trusts = NULL;
 771         uint32_t num_trusts = 0;
 772         TALLOC_CTX *tmp_ctx;
 773         NTSTATUS status;
 774
 775         DEBUG(3,("msrpc_trusted_domains\n"));
 776
 777         if (ptrust_list) {
 778                 ZERO_STRUCTP(ptrust_list);
 779         }
 780
 781         tmp_ctx = talloc_stackframe();
 782         if (tmp_ctx == NULL) {
 783                 return NT_STATUS_NO_MEMORY;
 784         }
 785
 786         status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
 787         if (!NT_STATUS_IS_OK(status)) {
 788                 goto done;
 789         }
 790
 791         status = rpc_trusted_domains(tmp_ctx,
 792                                      lsa_pipe,
 793                                      &lsa_policy,
 794                                      &num_trusts,
 795                                      &trusts);
 796         if (!NT_STATUS_IS_OK(status)) {
 797                 goto done;
 798         }
 799
 800         if (ptrust_list) {
 801                 ptrust_list->count = num_trusts;
 802                 ptrust_list->array = talloc_move(mem_ctx, &trusts);
 803         }
 804
 805 done:
 806         TALLOC_FREE(tmp_ctx);
 807         return status;
 808 }
 809
 810 /* find the lockout policy for a domain */
 811 static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
 812                                      TALLOC_CTX *mem_ctx,
 813                                      struct samr_DomInfo12 *lockout_policy)
 814 {
 815         NTSTATUS status, result;
 816         struct rpc_pipe_client *cli;
 817         struct policy_handle dom_pol;
 818         union samr_DomainInfo *info = NULL;
 819         struct dcerpc_binding_handle *b;
 820
 821         DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain->name));
 822
 823         if ( !winbindd_can_contact_domain( domain ) ) {
 824                 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
 825                           domain->name));
 826                 return NT_STATUS_NOT_SUPPORTED;
 827         }
 828
 829         status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
 830         if (!NT_STATUS_IS_OK(status)) {
 831                 goto done;
 832         }
 833
 834         b = cli->binding_handle;
 835
 836         status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
 837                                              &dom_pol,
 838                                              DomainLockoutInformation,
 839                                              &info,
 840                                              &result);
 841         if (any_nt_status_not_ok(status, result, &status)) {
 842                 return status;
 843         }
 844
 845         *lockout_policy = info->info12;
 846
 847         DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
 848                 info->info12.lockout_threshold));
 849
 850   done:
 851
 852         return status;
 853 }
 854
 855 /* find the password policy for a domain */
 856 static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
 857                                       TALLOC_CTX *mem_ctx,
 858                                       struct samr_DomInfo1 *password_policy)
 859 {
 860         NTSTATUS status, result;
 861         struct rpc_pipe_client *cli;
 862         struct policy_handle dom_pol;
 863         union samr_DomainInfo *info = NULL;
 864         struct dcerpc_binding_handle *b;
 865
 866         DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
 867                   domain->name));
 868
 869         if ( !winbindd_can_contact_domain( domain ) ) {
 870                 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
 871                           domain->name));
 872                 return NT_STATUS_NOT_SUPPORTED;
 873         }
 874
 875         status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
 876         if (!NT_STATUS_IS_OK(status)) {
 877                 goto done;
 878         }
 879
 880         b = cli->binding_handle;
 881
 882         status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
 883                                              &dom_pol,
 884                                              DomainPasswordInformation,
 885                                              &info,
 886                                              &result);
 887         if (!NT_STATUS_IS_OK(status)) {
 888                 goto done;
 889         }
 890         if (!NT_STATUS_IS_OK(result)) {
 891                 goto done;
 892         }
 893
 894         *password_policy = info->info1;
 895
 896         DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
 897                 info->info1.min_password_length));
 898
 899   done:
 900
 901         return status;
 902 }
 903
 904 static enum lsa_LookupNamesLevel winbindd_lookup_level(
 905         struct winbindd_domain *domain)
 906 {
 907         enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_DOMAINS_ONLY;
 908
 909         if (domain->internal) {
 910                 level = LSA_LOOKUP_NAMES_ALL;
 911         } else if (domain->secure_channel_type == SEC_CHAN_DNS_DOMAIN) {
 912                 if (domain->domain_flags & NETR_TRUST_FLAG_IN_FOREST) {
 913                         /*
 914                          * TODO:
 915                          *
 916                          * Depending on what we want to resolve. We need to use:
 917                          * 1. LsapLookupXForestReferral(5)/LSA_LOOKUP_NAMES_FOREST_TRUSTS_ONLY
 918                          *    if we want to pass the request into the direction of the forest
 919                          *    root domain. The forest root domain uses
 920                          *    LsapLookupXForestResolve(6)/LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2
 921                          *    when passing the request to trusted forests.
 922                          * 2. LsapLookupGC(4)/LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY
 923                          *    if we're not a GC and want to resolve a name within our own forest.
 924                          *
 925                          * As we don't support more than one domain in our own forest
 926                          * and always try to be a GC for now, we just set
 927                          * LSA_LOOKUP_NAMES_FOREST_TRUSTS_ONLY.
 928                          */
 929                         level = LSA_LOOKUP_NAMES_FOREST_TRUSTS_ONLY;
 930                 } else if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
 931                         /*
 932                          * This is LsapLookupXForestResolve(6)/LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2
 933                          */
 934                         level = LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2;
 935                 } else {
 936                         /*
 937                          * This is LsapLookupTDL(3)/LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY
 938                          */
 939                         level = LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY;
 940                 }
 941         } else if (domain->secure_channel_type == SEC_CHAN_DOMAIN) {
 942                 /*
 943                  * This is LsapLookupTDL(3)/LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY
 944                  */
 945                 level = LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY;
 946         } else if (domain->rodc) {
 947                 level = LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC;
 948         } else {
 949                 /*
 950                  * This is LsapLookupPDC(2)/LSA_LOOKUP_NAMES_DOMAINS_ONLY
 951                  */
 952                 level = LSA_LOOKUP_NAMES_DOMAINS_ONLY;
 953         }
 954
 955         return level;
 956 }
 957
 958 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
 959                               struct winbindd_domain *domain,
 960                               uint32_t num_sids,
 961                               const struct dom_sid *sids,
 962                               char ***domains,
 963                               char ***names,
 964                               enum lsa_SidType **types)
 965 {
 966         NTSTATUS status;
 967         NTSTATUS result;
 968         struct rpc_pipe_client *cli = NULL;
 969         struct dcerpc_binding_handle *b = NULL;
 970         struct policy_handle lsa_policy;
 971         unsigned int orig_timeout;
 972         bool use_lookupsids3 = false;
 973         bool retried = false;
 974         enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
 975
 976  connect:
 977         status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
 978         if (!NT_STATUS_IS_OK(status)) {
 979                 return status;
 980         }
 981
 982         b = cli->binding_handle;
 983
 984         if (cli->transport->transport == NCACN_IP_TCP) {
 985                 use_lookupsids3 = true;
 986         }
 987
 988         level = winbindd_lookup_level(domain);
 989
 990         /*
 991          * This call can take a long time
 992          * allow the server to time out.
 993          * 35 seconds should do it.
 994          */
 995         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
 996
 997         status = dcerpc_lsa_lookup_sids_generic(b,
 998                                                 mem_ctx,
 999                                                 &lsa_policy,
1000                                                 num_sids,
1001                                                 sids,
1002                                                 level,
1003                                                 domains,
1004                                                 names,
1005                                                 types,
1006                                                 use_lookupsids3,
1007                                                 &result);
1008
1009         /* And restore our original timeout. */
1010         dcerpc_binding_handle_set_timeout(b, orig_timeout);
1011
1012         if (reset_cm_connection_on_error(domain, b, status)) {
1013                 /*
1014                  * This can happen if the schannel key is not
1015                  * valid anymore, we need to invalidate the
1016                  * all connections to the dc and reestablish
1017                  * a netlogon connection first.
1018                  */
1019                 domain->can_do_ncacn_ip_tcp = domain->active_directory;
1020                 if (!retried) {
1021                         retried = true;
1022                         goto connect;
1023                 }
1024                 status = NT_STATUS_ACCESS_DENIED;
1025         }
1026
1027         if (any_nt_status_not_ok(status, result, &status)) {
1028                 return status;
1029         }
1030
1031         return NT_STATUS_OK;
1032 }
1033
1034 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
1035                                       struct winbindd_domain *domain,
1036                                       uint32_t num_names,
1037                                       const char **names,
1038                                       const char ***domains,
1039                                       struct dom_sid **sids,
1040                                       enum lsa_SidType **types)
1041 {
1042         NTSTATUS status;
1043         NTSTATUS result;
1044         struct rpc_pipe_client *cli = NULL;
1045         struct dcerpc_binding_handle *b = NULL;
1046         struct policy_handle lsa_policy;
1047         unsigned int orig_timeout = 0;
1048         bool use_lookupnames4 = false;
1049         bool retried = false;
1050         enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
1051
1052  connect:
1053         if (domains == NULL) {
1054                 *domains = NULL;
1055         }
1056         *sids = NULL;
1057         *types = NULL;
1058
1059         status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
1060         if (!NT_STATUS_IS_OK(status)) {
1061                 return status;
1062         }
1063
1064         b = cli->binding_handle;
1065
1066         if (cli->transport->transport == NCACN_IP_TCP) {
1067                 use_lookupnames4 = true;
1068         }
1069
1070         level = winbindd_lookup_level(domain);
1071
1072         /*
1073          * This call can take a long time
1074          * allow the server to time out.
1075          * 35 seconds should do it.
1076          */
1077         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
1078
1079         status = dcerpc_lsa_lookup_names_generic(b,
1080                                                  mem_ctx,
1081                                                  &lsa_policy,
1082                                                  num_names,
1083                                                  (const char **) names,
1084                                                  domains,
1085                                                  level,
1086                                                  sids,
1087                                                  types,
1088                                                  use_lookupnames4,
1089                                                  &result);
1090
1091         /* And restore our original timeout. */
1092         dcerpc_binding_handle_set_timeout(b, orig_timeout);
1093
1094         if (reset_cm_connection_on_error(domain, b, status)) {
1095                 /*
1096                  * This can happen if the schannel key is not
1097                  * valid anymore, we need to invalidate the
1098                  * all connections to the dc and reestablish
1099                  * a netlogon connection first.
1100                  */
1101                 if (!retried) {
1102                         retried = true;
1103                         goto connect;
1104                 }
1105                 status = NT_STATUS_ACCESS_DENIED;
1106         }
1107
1108         if (!NT_STATUS_IS_OK(status)) {
1109                 return status;
1110         }
1111
1112         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED)) {
1113                 if (num_names > 0) {
1114                         uint32_t i;
1115
1116                         *sids = talloc_zero_array(mem_ctx, struct dom_sid, num_names);
1117                         if (*sids == NULL) {
1118                                 return NT_STATUS_NO_MEMORY;
1119                         }
1120
1121                         *types = talloc_zero_array(mem_ctx, enum lsa_SidType, num_names);
1122                         if (*types == NULL) {
1123                                 return NT_STATUS_NO_MEMORY;
1124                         }
1125
1126                         for (i = 0; i < num_names; i++) {
1127                                 (*types)[i] = SID_NAME_UNKNOWN;
1128                         }
1129
1130                         if (domains != NULL) {
1131                                 *domains = talloc_zero_array(mem_ctx, const char *, num_names);
1132                                 if (*domains == NULL) {
1133                                         return NT_STATUS_NO_MEMORY;
1134                                 }
1135                         }
1136                 }
1137
1138                 result = NT_STATUS_OK;
1139         } else if (NT_STATUS_EQUAL(result, NT_STATUS_SOME_NOT_MAPPED)) {
1140                 if (talloc_array_length(*sids) != num_names) {
1141                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1142                 }
1143                 if (talloc_array_length(*types) != num_names) {
1144                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1145                 }
1146                 if (domains != NULL) {
1147                         if (talloc_array_length(*domains) != num_names) {
1148                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1149                         }
1150                 }
1151                 result = NT_STATUS_OK;
1152         }
1153
1154         if (any_nt_status_not_ok(status, result, &status)) {
1155                 return status;
1156         }
1157
1158         return NT_STATUS_OK;
1159 }
1160
1161 /* the rpc backend methods are exposed via this structure */
1162 struct winbindd_methods msrpc_methods = {
1163         False,
1164         msrpc_query_user_list,
1165         msrpc_enum_dom_groups,
1166         msrpc_enum_local_groups,
1167         msrpc_name_to_sid,
1168         msrpc_sid_to_name,
1169         msrpc_rids_to_names,
1170         msrpc_lookup_usergroups,
1171         msrpc_lookup_useraliases,
1172         msrpc_lookup_groupmem,
1173         msrpc_lookup_aliasmem,
1174         msrpc_lockout_policy,
1175         msrpc_password_policy,
1176         msrpc_trusted_domains,
1177 };