1da6c28aamw/*
2da6c28aamw * CDDL HEADER START
3da6c28aamw *
4da6c28aamw * The contents of this file are subject to the terms of the
5da6c28aamw * Common Development and Distribution License (the "License").
6da6c28aamw * You may not use this file except in compliance with the License.
7da6c28aamw *
8da6c28aamw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9da6c28aamw * or http://www.opensolaris.org/os/licensing.
10da6c28aamw * See the License for the specific language governing permissions
11da6c28aamw * and limitations under the License.
12da6c28aamw *
13da6c28aamw * When distributing Covered Code, include this CDDL HEADER in each
14da6c28aamw * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15da6c28aamw * If applicable, add the following below this CDDL HEADER, with the
16da6c28aamw * fields enclosed by brackets "[]" replaced with your own identifying
17da6c28aamw * information: Portions Copyright [yyyy] [name of copyright owner]
18da6c28aamw *
19da6c28aamw * CDDL HEADER END
20da6c28aamw */
21148c5f4Alan Wright
22da6c28aamw/*
23148c5f4Alan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24dafb549Gordon Ross * Copyright 2019 Nexenta Systems, Inc.  All rights reserved.
25da6c28aamw */
26da6c28aamw
27da6c28aamw/*
28da6c28aamw * This module provides the high level interface to the LSA RPC functions.
29da6c28aamw */
30da6c28aamw
31da6c28aamw#include <strings.h>
32da6c28aamw#include <unistd.h>
33da6c28aamw
34da6c28aamw#include <smbsrv/libsmb.h>
35da6c28aamw#include <smbsrv/libmlsvc.h>
36da6c28aamw#include <smbsrv/smbinfo.h>
37da6c28aamw#include <smbsrv/smb_token.h>
38da6c28aamw
3989dc44cjose borrego#include <lsalib.h>
40dc20a30as
41dafb549Gordon Rossstatic uint32_t lsa_lookup_name_int(char *, uint16_t, smb_account_t *,
42dafb549Gordon Ross    boolean_t);
43dafb549Gordon Rossstatic uint32_t lsa_lookup_sid_int(smb_sid_t *, smb_account_t *, boolean_t);
44dafb549Gordon Ross
457f667e7jose borregostatic uint32_t lsa_lookup_name_builtin(char *, char *, smb_account_t *);
467f667e7jose borregostatic uint32_t lsa_lookup_name_domain(char *, smb_account_t *);
47dc20a30as
487f667e7jose borregostatic uint32_t lsa_lookup_sid_builtin(smb_sid_t *, smb_account_t *);
497f667e7jose borregostatic uint32_t lsa_lookup_sid_domain(smb_sid_t *, smb_account_t *);
50dc20a30as
51b3700b0Gordon Rossstatic uint32_t lsa_list_accounts(mlsvc_handle_t *);
52b3700b0Gordon Rossstatic uint32_t lsa_map_status(uint32_t);
53da6c28aamw
54da6c28aamw/*
55dc20a30as * Lookup the given account and returns the account information
567f667e7jose borrego * in the passed smb_account_t structure.
5789dc44cjose borrego *
5889dc44cjose borrego * The lookup is performed in the following order:
5989dc44cjose borrego *    well known accounts
6089dc44cjose borrego *    local accounts
6189dc44cjose borrego *    domain accounts
6289dc44cjose borrego *
6389dc44cjose borrego * If it's established the given account is well know or local
6489dc44cjose borrego * but the lookup fails for some reason, the next step(s) won't be
6589dc44cjose borrego * performed.
66dc20a30as *
67dc20a30as * If the name is a domain account, it may refer to a user, group or
68dc20a30as * alias. If it is a local account, its type should be specified
69dc20a30as * in the sid_type parameter. In case the account type is unknown
70dc20a30as * sid_type should be set to SidTypeUnknown.
71dc20a30as *
7289dc44cjose borrego * account argument could be either [domain\]name or [domain/]name.
7389dc44cjose borrego *
7489dc44cjose borrego * Return status:
7589dc44cjose borrego *
7689dc44cjose borrego *   NT_STATUS_SUCCESS		Account is successfully translated
7789dc44cjose borrego *   NT_STATUS_NONE_MAPPED	Couldn't translate the account
78dc20a30as */
79dc20a30asuint32_t
807f667e7jose borregolsa_lookup_name(char *account, uint16_t type, smb_account_t *info)
81dc20a30as{
82dafb549Gordon Ross	return (lsa_lookup_name_int(account, type, info, B_TRUE));
83dafb549Gordon Ross}
84dafb549Gordon Ross
85dafb549Gordon Ross/* Variant that avoids the call out to AD. */
86dafb549Gordon Rossuint32_t
87dafb549Gordon Rosslsa_lookup_lname(char *account, uint16_t type, smb_account_t *info)
88dafb549Gordon Ross{
89dafb549Gordon Ross	return (lsa_lookup_name_int(account, type, info, B_FALSE));
90dafb549Gordon Ross}
91dafb549Gordon Ross
92dafb549Gordon Rossuint32_t
93dafb549Gordon Rosslsa_lookup_name_int(char *account, uint16_t type, smb_account_t *info,
94dafb549Gordon Ross    boolean_t try_ad)
95dafb549Gordon Ross{
9689dc44cjose borrego	char nambuf[SMB_USERNAME_MAXLEN];
9789dc44cjose borrego	char dombuf[SMB_PI_MAX_DOMAIN];
9889dc44cjose borrego	char *name, *domain;
9989dc44cjose borrego	uint32_t status;
10089dc44cjose borrego	char *slash;
10189dc44cjose borrego
1025831d79Gordon Ross	if (account == NULL)
1035831d79Gordon Ross		return (NT_STATUS_NONE_MAPPED);
1045831d79Gordon Ross
10589dc44cjose borrego	(void) strsubst(account, '/', '\\');
10689dc44cjose borrego	(void) strcanon(account, "\\");
10789dc44cjose borrego	/* \john -> john */
10889dc44cjose borrego	account += strspn(account, "\\");
10989dc44cjose borrego
11089dc44cjose borrego	if ((slash = strchr(account, '\\')) != NULL) {
11189dc44cjose borrego		*slash = '\0';
11289dc44cjose borrego		(void) strlcpy(dombuf, account, sizeof (dombuf));
11389dc44cjose borrego		(void) strlcpy(nambuf, slash + 1, sizeof (nambuf));
11489dc44cjose borrego		*slash = '\\';
11589dc44cjose borrego		name = nambuf;
11689dc44cjose borrego		domain = dombuf;
117dc20a30as	} else {
118dc20a30as		name = account;
119dc20a30as		domain = NULL;
120dc20a30as	}
121dc20a30as
12289dc44cjose borrego	status = lsa_lookup_name_builtin(domain, name, info);
12389dc44cjose borrego	if (status == NT_STATUS_NOT_FOUND) {
1247f667e7jose borrego		status = smb_sam_lookup_name(domain, name, type, info);
12589dc44cjose borrego		if (status == NT_STATUS_SUCCESS)
126dc20a30as			return (status);
127dc20a30as
128dafb549Gordon Ross		if (try_ad && ((domain == NULL) ||
129dafb549Gordon Ross		    (status == NT_STATUS_NOT_FOUND))) {
13089dc44cjose borrego			status = lsa_lookup_name_domain(account, info);
131dafb549Gordon Ross		}
132dc20a30as	}
133dc20a30as
13489dc44cjose borrego	return ((status == NT_STATUS_SUCCESS) ? status : NT_STATUS_NONE_MAPPED);
135dc20a30as}
136dc20a30as
137dc20a30asuint32_t
1387f667e7jose borregolsa_lookup_sid(smb_sid_t *sid, smb_account_t *info)
139dc20a30as{
140dafb549Gordon Ross	return (lsa_lookup_sid_int(sid, info, B_TRUE));
141dafb549Gordon Ross}
142dafb549Gordon Ross
143dafb549Gordon Ross/* Variant that avoids the call out to AD. */
144dafb549Gordon Rossuint32_t
145dafb549Gordon Rosslsa_lookup_lsid(smb_sid_t *sid, smb_account_t *info)
146dafb549Gordon Ross{
147dafb549Gordon Ross	return (lsa_lookup_sid_int(sid, info, B_FALSE));
148dafb549Gordon Ross}
149dafb549Gordon Ross
150dafb549Gordon Rossstatic uint32_t
151dafb549Gordon Rosslsa_lookup_sid_int(smb_sid_t *sid, smb_account_t *info, boolean_t try_ad)
152dafb549Gordon Ross{
1537f667e7jose borrego	uint32_t status;
1547f667e7jose borrego
1556537f38as	if (!smb_sid_isvalid(sid))
156dc20a30as		return (NT_STATUS_INVALID_SID);
157dc20a30as
1587f667e7jose borrego	status = lsa_lookup_sid_builtin(sid, info);
1597f667e7jose borrego	if (status == NT_STATUS_NOT_FOUND) {
1607f667e7jose borrego		status = smb_sam_lookup_sid(sid, info);
161dafb549Gordon Ross		if (try_ad && status == NT_STATUS_NOT_FOUND) {
1627f667e7jose borrego			status = lsa_lookup_sid_domain(sid, info);
163dafb549Gordon Ross		}
1647f667e7jose borrego	}
165dc20a30as
1667f667e7jose borrego	return ((status == NT_STATUS_SUCCESS) ? status : NT_STATUS_NONE_MAPPED);
167dc20a30as}
168dc20a30as
169dc20a30as/*
170da6c28aamw * Obtains the primary domain SID and name from the specified server
17129bd288Alan Wright * (domain controller).
172da6c28aamw *
1738d7e416jose borrego * The requested information will be returned via 'info' argument.
1748d7e416jose borrego *
175b3700b0Gordon Ross * Returns NT status codes. (Raw, not LSA-ized)
176da6c28aamw */
177da6c28aamwDWORD
17829bd288Alan Wrightlsa_query_primary_domain_info(char *server, char *domain,
179a0aa776Alan Wright    smb_domain_t *info)
180da6c28aamw{
181da6c28aamw	mlsvc_handle_t domain_handle;
182a0aa776Alan Wright	char user[SMB_USERNAME_MAXLEN];
183b3700b0Gordon Ross	DWORD status;
184a0aa776Alan Wright
185a0aa776Alan Wright	smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);
186da6c28aamw
187b3700b0Gordon Ross	status = lsar_open(server, domain, user, &domain_handle);
188b3700b0Gordon Ross	if (status != 0)
189b3700b0Gordon Ross		return (status);
190da6c28aamw
191da6c28aamw	status = lsar_query_info_policy(&domain_handle,
1928d7e416jose borrego	    MSLSA_POLICY_PRIMARY_DOMAIN_INFO, info);
193da6c28aamw
194da6c28aamw	(void) lsar_close(&domain_handle);
195da6c28aamw	return (status);
196da6c28aamw}
197da6c28aamw
198da6c28aamw/*
199da6c28aamw * Obtains the account domain SID and name from the current server
20029bd288Alan Wright * (domain controller).
201da6c28aamw *
2028d7e416jose borrego * The requested information will be returned via 'info' argument.
2038d7e416jose borrego *
204b3700b0Gordon Ross * Returns NT status codes. (Raw, not LSA-ized)
205da6c28aamw */
206da6c28aamwDWORD
20729bd288Alan Wrightlsa_query_account_domain_info(char *server, char *domain,
208a0aa776Alan Wright    smb_domain_t *info)
209da6c28aamw{
210da6c28aamw	mlsvc_handle_t domain_handle;
211a0aa776Alan Wright	char user[SMB_USERNAME_MAXLEN];
212b3700b0Gordon Ross	DWORD status;
213a0aa776Alan Wright
214a0aa776Alan Wright	smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);
215da6c28aamw
216b3700b0Gordon Ross	status = lsar_open(server, domain, user, &domain_handle);
217b3700b0Gordon Ross	if (status != 0)
218b3700b0Gordon Ross		return (status);
219da6c28aamw
220da6c28aamw	status = lsar_query_info_policy(&domain_handle,
2218d7e416jose borrego	    MSLSA_POLICY_ACCOUNT_DOMAIN_INFO, info);
2228d7e416jose borrego
2238d7e416jose borrego	(void) lsar_close(&domain_handle);
2248d7e416jose borrego	return (status);
2258d7e416jose borrego}
2268d7e416jose borrego
2278d7e416jose borrego/*
2288d7e416jose borrego * lsa_query_dns_domain_info
2298d7e416jose borrego *
2308d7e416jose borrego * Obtains the DNS domain info from the specified server
2318d7e416jose borrego * (domain controller).
2328d7e416jose borrego *
2338d7e416jose borrego * The requested information will be returned via 'info' argument.
2348d7e416jose borrego *
235b3700b0Gordon Ross * Returns NT status codes. (Raw, not LSA-ized)
2368d7e416jose borrego */
2378d7e416jose borregoDWORD
238a0aa776Alan Wrightlsa_query_dns_domain_info(char *server, char *domain, smb_domain_t *info)
2398d7e416jose borrego{
2408d7e416jose borrego	mlsvc_handle_t domain_handle;
241a0aa776Alan Wright	char user[SMB_USERNAME_MAXLEN];
242b3700b0Gordon Ross	DWORD status;
243a0aa776Alan Wright
244a0aa776Alan Wright	smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);
2458d7e416jose borrego
246b3700b0Gordon Ross	status = lsar_open(server, domain, user, &domain_handle);
247b3700b0Gordon Ross	if (status != 0)
248b3700b0Gordon Ross		return (status);
2498d7e416jose borrego
2508d7e416jose borrego	status = lsar_query_info_policy(&domain_handle,
2518d7e416jose borrego	    MSLSA_POLICY_DNS_DOMAIN_INFO, info);
252da6c28aamw
253da6c28aamw	(void) lsar_close(&domain_handle);
254da6c28aamw	return (status);
255da6c28aamw}
256da6c28aamw
257da6c28aamw/*
25829bd288Alan Wright * Enumerate the trusted domains of  primary domain.
25929bd288Alan Wright * This is the basic enumaration call which only returns the
26029bd288Alan Wright * NetBIOS name of the domain and its SID.
261da6c28aamw *
2628d7e416jose borrego * The requested information will be returned via 'info' argument.
263