2 Unix SMB/Netbios implementation.
4 Samba utility functions
5 Copyright (C) Andrew Tridgell 1992-1998
6 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
7 Copyright (C) Jeremy Allison 1999
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 extern int DEBUGLEVEL
;
28 DOM_SID global_sam_sid
;
29 extern pstring global_myname
;
30 extern fstring global_myworkgroup
;
36 DOM_SID global_sid_Builtin
; /* Local well-known domain */
37 DOM_SID global_sid_World_Domain
; /* Everyone domain */
38 DOM_SID global_sid_World
; /* Everyone */
39 DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
40 DOM_SID global_sid_Creator_Owner
; /* Creator Owner */
41 DOM_SID global_sid_NT_Authority
; /* NT Authority */
42 DOM_SID global_sid_NULL
; /* NULL sid */
43 DOM_SID global_sid_Builtin_Guests
; /* Builtin guest users */
44 DOM_SID global_sid_Authenticated_Users
; /* All authenticated rids */
45 DOM_SID global_sid_Network
; /* Network rids */
46 DOM_SID global_sid_Anonymous
; /* Anonymous login */
48 const DOM_SID
*global_sid_everyone
= &global_sid_World
;
50 typedef struct _known_sid_users
{
52 enum SID_NAME_USE sid_name_use
;
53 char *known_user_name
;
56 /* static known_sid_users no_users[] = {{0, 0, NULL}}; */
58 static known_sid_users everyone_users
[] = {
59 { 0, SID_NAME_WKN_GRP
, "Everyone" },
60 {0, (enum SID_NAME_USE
)0, NULL
}};
62 static known_sid_users creator_owner_users
[] = {
63 { 0, SID_NAME_ALIAS
, "Creator Owner" },
64 {0, (enum SID_NAME_USE
)0, NULL
}};
66 static known_sid_users nt_authority_users
[] = {
67 { 1, SID_NAME_ALIAS
, "Dialup" },
68 { 2, SID_NAME_ALIAS
, "Network"},
69 { 3, SID_NAME_ALIAS
, "Batch"},
70 { 4, SID_NAME_ALIAS
, "Interactive"},
71 { 6, SID_NAME_ALIAS
, "Service"},
72 { 7, SID_NAME_ALIAS
, "AnonymousLogon"},
73 { 8, SID_NAME_ALIAS
, "Proxy"},
74 { 9, SID_NAME_ALIAS
, "ServerLogon"},
75 { 11, SID_NAME_ALIAS
, "Authenticated Users"},
76 { 18, SID_NAME_ALIAS
, "SYSTEM"},
77 { 0, (enum SID_NAME_USE
)0, NULL
}};
79 static known_sid_users builtin_groups
[] = {
80 { BUILTIN_ALIAS_RID_ADMINS
, SID_NAME_ALIAS
, "Administrators" },
81 { BUILTIN_ALIAS_RID_USERS
, SID_NAME_ALIAS
, "Users" },
82 { BUILTIN_ALIAS_RID_GUESTS
, SID_NAME_ALIAS
, "Guests" },
83 { BUILTIN_ALIAS_RID_ACCOUNT_OPS
, SID_NAME_ALIAS
, "Account Operators" },
84 { BUILTIN_ALIAS_RID_SYSTEM_OPS
, SID_NAME_ALIAS
, "Server Operators" },
85 { BUILTIN_ALIAS_RID_PRINT_OPS
, SID_NAME_ALIAS
, "Print Operators" },
86 { BUILTIN_ALIAS_RID_BACKUP_OPS
, SID_NAME_ALIAS
, "Backup Operators" },
87 { 0, (enum SID_NAME_USE
)0, NULL
}};
89 static struct sid_name_map_info
93 known_sid_users
*known_users
;
97 { &global_sam_sid
, global_myname
, NULL
},
98 { &global_sam_sid
, global_myworkgroup
, NULL
},
99 { &global_sid_Builtin
, "BUILTIN", &builtin_groups
[0]},
100 { &global_sid_World_Domain
, "", &everyone_users
[0] },
101 { &global_sid_Creator_Owner_Domain
, "", &creator_owner_users
[0] },
102 { &global_sid_NT_Authority
, "NT Authority", &nt_authority_users
[0] },
107 * An NT compatible anonymous token.
110 static DOM_SID anon_sid_array
[3];
112 NT_USER_TOKEN anonymous_token
= {
117 /****************************************************************************
118 Creates some useful well known sids
119 ****************************************************************************/
121 void generate_wellknown_sids(void)
123 string_to_sid(&global_sid_Builtin
, "S-1-5-32");
124 string_to_sid(&global_sid_Builtin_Guests
, "S-1-5-32-546");
125 string_to_sid(&global_sid_World_Domain
, "S-1-1");
126 string_to_sid(&global_sid_World
, "S-1-1-0");
127 string_to_sid(&global_sid_Creator_Owner_Domain
, "S-1-3");
128 string_to_sid(&global_sid_Creator_Owner
, "S-1-3-0");
129 string_to_sid(&global_sid_NT_Authority
, "S-1-5");
130 string_to_sid(&global_sid_NULL
, "S-1-0-0");
131 string_to_sid(&global_sid_Authenticated_Users
, "S-1-5-11");
132 string_to_sid(&global_sid_Network
, "S-1-5-2");
133 string_to_sid(&global_sid_Anonymous
, "S-1-5-7");
135 /* Create the anon token. */
136 sid_copy( &anonymous_token
.user_sids
[0], &global_sid_World
);
137 sid_copy( &anonymous_token
.user_sids
[1], &global_sid_Network
);
138 sid_copy( &anonymous_token
.user_sids
[2], &global_sid_Anonymous
);
141 /**************************************************************************
142 Turns a domain SID into a name, returned in the nt_domain argument.
143 ***************************************************************************/
145 BOOL
map_domain_sid_to_name(DOM_SID
*sid
, char *nt_domain
)
149 sid_to_string(sid_str
, sid
);
151 DEBUG(5,("map_domain_sid_to_name: %s\n", sid_str
));
153 if (nt_domain
== NULL
)
156 while (sid_name_map
[i
].sid
!= NULL
) {
157 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
158 DEBUG(5,("map_domain_sid_to_name: compare: %s\n", sid_str
));
159 if (sid_equal(sid_name_map
[i
].sid
, sid
)) {
160 fstrcpy(nt_domain
, sid_name_map
[i
].name
);
161 DEBUG(5,("map_domain_sid_to_name: found '%s'\n", nt_domain
));
167 DEBUG(5,("map_domain_sid_to_name: mapping for %s not found\n", sid_str
));
172 /**************************************************************************
173 Looks up a known username from one of the known domains.
174 ***************************************************************************/
176 BOOL
lookup_known_rid(DOM_SID
*sid
, uint32 rid
, char *name
, enum SID_NAME_USE
*psid_name_use
)
179 struct sid_name_map_info
*psnm
;
181 for(i
= 0; sid_name_map
[i
].sid
!= NULL
; i
++) {
182 psnm
= &sid_name_map
[i
];
183 if(sid_equal(psnm
->sid
, sid
)) {
185 for(j
= 0; psnm
->known_users
&& psnm
->known_users
[j
].known_user_name
!= NULL
; j
++) {
186 if(rid
== psnm
->known_users
[j
].rid
) {
187 DEBUG(5,("lookup_builtin_rid: rid = %u, domain = '%s', user = '%s'\n",
188 (unsigned int)rid
, psnm
->name
, psnm
->known_users
[j
].known_user_name
));
189 fstrcpy( name
, psnm
->known_users
[j
].known_user_name
);
190 *psid_name_use
= psnm
->known_users
[j
].sid_name_use
;
200 /**************************************************************************
201 Turns a domain name into a SID.
202 *** side-effect: if the domain name is NULL, it is set to our domain ***
203 ***************************************************************************/
205 BOOL
map_domain_name_to_sid(DOM_SID
*sid
, char *nt_domain
)
209 if (nt_domain
== NULL
) {
210 DEBUG(5,("map_domain_name_to_sid: mapping NULL domain to our SID.\n"));
211 sid_copy(sid
, &global_sam_sid
);
215 if (nt_domain
[0] == 0) {
216 fstrcpy(nt_domain
, global_myname
);
217 DEBUG(5,("map_domain_name_to_sid: overriding blank name to %s\n", nt_domain
));
218 sid_copy(sid
, &global_sam_sid
);
222 DEBUG(5,("map_domain_name_to_sid: %s\n", nt_domain
));
224 while (sid_name_map
[i
].name
!= NULL
) {
225 DEBUG(5,("map_domain_name_to_sid: compare: %s\n", sid_name_map
[i
].name
));
226 if (strequal(sid_name_map
[i
].name
, nt_domain
)) {
228 sid_copy(sid
, sid_name_map
[i
].sid
);
229 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
230 DEBUG(5,("map_domain_name_to_sid: found %s\n", sid_str
));
236 DEBUG(0,("map_domain_name_to_sid: mapping to %s not found.\n", nt_domain
));
240 /**************************************************************************
241 Splits a name of format \DOMAIN\name or name into its two components.
242 Sets the DOMAIN name to global_myname if it has not been specified.
243 ***************************************************************************/
245 void split_domain_name(const char *fullname
, char *domain
, char *name
)
250 sep
= lp_winbind_separator();
252 *domain
= *name
= '\0';
254 if (fullname
[0] == sep
[0] || fullname
[0] == '\\')
257 pstrcpy(full_name
, fullname
);
258 p
= strchr(full_name
+1, '\\');
259 if (!p
) p
= strchr(full_name
+1, sep
[0]);
263 fstrcpy(domain
, full_name
);
266 fstrcpy(domain
, global_myname
);
267 fstrcpy(name
, full_name
);
270 DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
271 fullname
, domain
, name
));
274 /*****************************************************************
275 Convert a SID to an ascii string.
276 *****************************************************************/
278 char *sid_to_string(fstring sidstr_out
, DOM_SID
*sid
)
282 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
283 uint32 ia
= (sid
->id_auth
[5]) +
284 (sid
->id_auth
[4] << 8 ) +
285 (sid
->id_auth
[3] << 16) +
286 (sid
->id_auth
[2] << 24);
288 slprintf(sidstr_out
, sizeof(fstring
) - 1, "S-%u-%lu", (unsigned int)sid
->sid_rev_num
, (unsigned long)ia
);
290 for (i
= 0; i
< sid
->num_auths
; i
++) {
291 slprintf(subauth
, sizeof(subauth
)-1, "-%lu", (unsigned long)sid
->sub_auths
[i
]);
292 fstrcat(sidstr_out
, subauth
);
298 /*****************************************************************
299 Convert a string to a SID. Returns True on success, False on fail.
300 *****************************************************************/
302 BOOL
string_to_sid(DOM_SID
*sidout
, char *sidstr
)
306 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
309 memset((char *)sidout
, '\0', sizeof(DOM_SID
));
311 if (StrnCaseCmp( sidstr
, "S-", 2)) {
312 DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr
));
317 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
318 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
322 /* Get the revision number. */
323 sidout
->sid_rev_num
= (uint8
)strtoul(tok
, NULL
, 10);
325 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
326 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
330 /* identauth in decimal should be < 2^32 */
331 ia
= (uint32
)strtoul(tok
, NULL
, 10);
333 /* NOTE - the ia value is in big-endian format. */
334 sidout
->id_auth
[0] = 0;
335 sidout
->id_auth
[1] = 0;
336 sidout
->id_auth
[2] = (ia
& 0xff000000) >> 24;
337 sidout
->id_auth
[3] = (ia
& 0x00ff0000) >> 16;
338 sidout
->id_auth
[4] = (ia
& 0x0000ff00) >> 8;
339 sidout
->id_auth
[5] = (ia
& 0x000000ff);
341 sidout
->num_auths
= 0;
343 while(next_token(&p
, tok
, "-", sizeof(tok
)) &&
344 sidout
->num_auths
< MAXSUBAUTHS
) {
346 * NOTE - the subauths are in native machine-endian format. They
347 * are converted to little-endian when linearized onto the wire.
349 sid_append_rid(sidout
, (uint32
)strtoul(tok
, NULL
, 10));
352 DEBUG(7,("string_to_sid: converted SID %s ok\n", sidstr
));
357 /*****************************************************************
358 Add a rid to the end of a sid
359 *****************************************************************/
361 BOOL
sid_append_rid(DOM_SID
*sid
, uint32 rid
)
363 if (sid
->num_auths
< MAXSUBAUTHS
) {
364 sid
->sub_auths
[sid
->num_auths
++] = rid
;
370 /*****************************************************************
371 Removes the last rid from the end of a sid
372 *****************************************************************/
374 BOOL
sid_split_rid(DOM_SID
*sid
, uint32
*rid
)
376 if (sid
->num_auths
> 0) {
378 *rid
= sid
->sub_auths
[sid
->num_auths
];
384 /*****************************************************************
386 *****************************************************************/
388 void sid_copy(DOM_SID
*dst
, const DOM_SID
*src
)
392 memset((char *)dst
, '\0', sizeof(DOM_SID
));
394 dst
->sid_rev_num
= src
->sid_rev_num
;
395 dst
->num_auths
= src
->num_auths
;
397 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
399 for (i
= 0; i
< src
->num_auths
; i
++)
400 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
403 /*****************************************************************
404 Duplicates a sid - mallocs the target.
405 *****************************************************************/
407 DOM_SID
*sid_dup(DOM_SID
*src
)
414 if((dst
= malloc(sizeof(DOM_SID
))) != NULL
) {
415 memset(dst
, '\0', sizeof(DOM_SID
));
422 /*****************************************************************
423 Write a sid out into on-the-wire format.
424 *****************************************************************/
426 BOOL
sid_linearize(char *outbuf
, size_t len
, DOM_SID
*sid
)
430 if(len
< sid_size(sid
))
433 SCVAL(outbuf
,0,sid
->sid_rev_num
);
434 SCVAL(outbuf
,1,sid
->num_auths
);
435 memcpy(&outbuf
[2], sid
->id_auth
, 6);
436 for(i
= 0; i
< sid
->num_auths
; i
++)
437 SIVAL(outbuf
, 8 + (i
*4), sid
->sub_auths
[i
]);
442 /*****************************************************************
444 *****************************************************************/
446 BOOL
sid_equal(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
450 if (sid1
== sid2
) return True
;
451 if (!sid1
|| !sid2
) return False
;
453 /* compare most likely different rids, first: i.e start at end */
454 for (i
= sid1
->num_auths
-1; i
>= 0; --i
)
455 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
458 if (sid1
->num_auths
!= sid2
->num_auths
)
460 if (sid1
->sid_rev_num
!= sid2
->sid_rev_num
)
463 for (i
= 0; i
< 6; i
++)
464 if (sid1
->id_auth
[i
] != sid2
->id_auth
[i
])
471 /*****************************************************************
472 Calculates size of a sid.
473 *****************************************************************/
475 size_t sid_size(DOM_SID
*sid
)
480 return sid
->num_auths
* sizeof(uint32
) + 8;