2 Unix SMB/Netbios implementation.
4 Samba utility functions
5 Copyright (C) Andrew Tridgell 1992-1998
6 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
7 Copyright (C) Jeremy Allison 1999
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 DOM_SID global_sam_sid
;
28 extern pstring global_myname
;
29 extern fstring global_myworkgroup
;
35 DOM_SID global_sid_Builtin
; /* Local well-known domain */
36 DOM_SID global_sid_World_Domain
; /* Everyone domain */
37 DOM_SID global_sid_World
; /* Everyone */
38 DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
39 DOM_SID global_sid_Creator_Owner
; /* Creator Owner */
40 DOM_SID global_sid_Creator_Group
; /* Creator Group */
41 DOM_SID global_sid_NT_Authority
; /* NT Authority */
42 DOM_SID global_sid_NULL
; /* NULL sid */
43 DOM_SID global_sid_Builtin_Guests
; /* Builtin guest users */
44 DOM_SID global_sid_Authenticated_Users
; /* All authenticated rids */
45 DOM_SID global_sid_Network
; /* Network rids */
46 DOM_SID global_sid_Anonymous
; /* Anonymous login */
48 const DOM_SID
*global_sid_everyone
= &global_sid_World
;
50 typedef struct _known_sid_users
{
52 enum SID_NAME_USE sid_name_use
;
53 char *known_user_name
;
56 /* static known_sid_users no_users[] = {{0, 0, NULL}}; */
58 static known_sid_users everyone_users
[] = {
59 { 0, SID_NAME_WKN_GRP
, "Everyone" },
60 {0, (enum SID_NAME_USE
)0, NULL
}};
62 static known_sid_users creator_owner_users
[] = {
63 { 0, SID_NAME_ALIAS
, "Creator Owner" },
64 { 1, SID_NAME_ALIAS
, "Creator Group" },
65 {0, (enum SID_NAME_USE
)0, NULL
}};
67 static known_sid_users nt_authority_users
[] = {
68 { 1, SID_NAME_ALIAS
, "Dialup" },
69 { 2, SID_NAME_ALIAS
, "Network"},
70 { 3, SID_NAME_ALIAS
, "Batch"},
71 { 4, SID_NAME_ALIAS
, "Interactive"},
72 { 6, SID_NAME_ALIAS
, "Service"},
73 { 7, SID_NAME_ALIAS
, "AnonymousLogon"},
74 { 8, SID_NAME_ALIAS
, "Proxy"},
75 { 9, SID_NAME_ALIAS
, "ServerLogon"},
76 { 11, SID_NAME_ALIAS
, "Authenticated Users"},
77 { 18, SID_NAME_ALIAS
, "SYSTEM"},
78 { 0, (enum SID_NAME_USE
)0, NULL
}};
80 static known_sid_users builtin_groups
[] = {
81 { BUILTIN_ALIAS_RID_ADMINS
, SID_NAME_ALIAS
, "Administrators" },
82 { BUILTIN_ALIAS_RID_USERS
, SID_NAME_ALIAS
, "Users" },
83 { BUILTIN_ALIAS_RID_GUESTS
, SID_NAME_ALIAS
, "Guests" },
84 { BUILTIN_ALIAS_RID_ACCOUNT_OPS
, SID_NAME_ALIAS
, "Account Operators" },
85 { BUILTIN_ALIAS_RID_SYSTEM_OPS
, SID_NAME_ALIAS
, "Server Operators" },
86 { BUILTIN_ALIAS_RID_PRINT_OPS
, SID_NAME_ALIAS
, "Print Operators" },
87 { BUILTIN_ALIAS_RID_BACKUP_OPS
, SID_NAME_ALIAS
, "Backup Operators" },
88 { 0, (enum SID_NAME_USE
)0, NULL
}};
90 #define MAX_SID_NAMES 7
92 static struct sid_name_map_info
96 known_sid_users
*known_users
;
97 } sid_name_map
[MAX_SID_NAMES
];
99 static BOOL sid_name_map_initialized
= False
;
102 * An NT compatible anonymous token.
105 static DOM_SID anon_sid_array
[3];
107 NT_USER_TOKEN anonymous_token
= {
112 /**************************************************************************
114 *************************************************************************/
115 static void init_sid_name_map (void)
119 if (sid_name_map_initialized
) return;
122 if ((lp_security() == SEC_USER
) && lp_domain_logons()) {
123 sid_name_map
[i
].sid
= &global_sam_sid
;
124 sid_name_map
[i
].name
= global_myworkgroup
;
125 sid_name_map
[i
].known_users
= NULL
;
127 sid_name_map
[i
].sid
= &global_sam_sid
;
128 sid_name_map
[i
].name
= global_myname
;
129 sid_name_map
[i
].known_users
= NULL
;
133 sid_name_map
[i
].sid
= &global_sam_sid
;
134 sid_name_map
[i
].name
= global_myname
;
135 sid_name_map
[i
].known_users
= NULL
;
139 sid_name_map
[i
].sid
= &global_sid_Builtin
;
140 sid_name_map
[i
].name
= "BUILTIN";
141 sid_name_map
[i
].known_users
= &builtin_groups
[0];
144 sid_name_map
[i
].sid
= &global_sid_World_Domain
;
145 sid_name_map
[i
].name
= "";
146 sid_name_map
[i
].known_users
= &everyone_users
[0];
149 sid_name_map
[i
].sid
= &global_sid_Creator_Owner_Domain
;
150 sid_name_map
[i
].name
= "";
151 sid_name_map
[i
].known_users
= &creator_owner_users
[0];
154 sid_name_map
[i
].sid
= &global_sid_NT_Authority
;
155 sid_name_map
[i
].name
= "NT Authority";
156 sid_name_map
[i
].known_users
= &nt_authority_users
[0];
161 sid_name_map
[i
].sid
= NULL
;
162 sid_name_map
[i
].name
= NULL
;
163 sid_name_map
[i
].known_users
= NULL
;
165 sid_name_map_initialized
= True
;
171 /****************************************************************************
172 Creates some useful well known sids
173 ****************************************************************************/
175 void generate_wellknown_sids(void)
177 string_to_sid(&global_sid_Builtin
, "S-1-5-32");
178 string_to_sid(&global_sid_Builtin_Guests
, "S-1-5-32-546");
179 string_to_sid(&global_sid_World_Domain
, "S-1-1");
180 string_to_sid(&global_sid_World
, "S-1-1-0");
181 string_to_sid(&global_sid_Creator_Owner_Domain
, "S-1-3");
182 string_to_sid(&global_sid_Creator_Owner
, "S-1-3-0");
183 string_to_sid(&global_sid_Creator_Group
, "S-1-3-1");
184 string_to_sid(&global_sid_NT_Authority
, "S-1-5");
185 string_to_sid(&global_sid_NULL
, "S-1-0-0");
186 string_to_sid(&global_sid_Authenticated_Users
, "S-1-5-11");
187 string_to_sid(&global_sid_Network
, "S-1-5-2");
188 string_to_sid(&global_sid_Anonymous
, "S-1-5-7");
190 /* Create the anon token. */
191 sid_copy( &anonymous_token
.user_sids
[0], &global_sid_World
);
192 sid_copy( &anonymous_token
.user_sids
[1], &global_sid_Network
);
193 sid_copy( &anonymous_token
.user_sids
[2], &global_sid_Anonymous
);
196 /**************************************************************************
197 Turns a domain SID into a name, returned in the nt_domain argument.
198 ***************************************************************************/
200 BOOL
map_domain_sid_to_name(DOM_SID
*sid
, char *nt_domain
)
205 sid_to_string(sid_str
, sid
);
207 if (!sid_name_map_initialized
)
210 DEBUG(5,("map_domain_sid_to_name: %s\n", sid_str
));
212 if (nt_domain
== NULL
)
215 while (sid_name_map
[i
].sid
!= NULL
) {
216 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
217 DEBUG(5,("map_domain_sid_to_name: compare: %s\n", sid_str
));
218 if (sid_equal(sid_name_map
[i
].sid
, sid
)) {
219 fstrcpy(nt_domain
, sid_name_map
[i
].name
);
220 DEBUG(5,("map_domain_sid_to_name: found '%s'\n", nt_domain
));
226 DEBUG(5,("map_domain_sid_to_name: mapping for %s not found\n", sid_str
));
231 /**************************************************************************
232 Looks up a known username from one of the known domains.
233 ***************************************************************************/
235 BOOL
lookup_known_rid(DOM_SID
*sid
, uint32 rid
, char *name
, enum SID_NAME_USE
*psid_name_use
)
238 struct sid_name_map_info
*psnm
;
240 if (!sid_name_map_initialized
)
243 for(i
= 0; sid_name_map
[i
].sid
!= NULL
; i
++) {
244 psnm
= &sid_name_map
[i
];
245 if(sid_equal(psnm
->sid
, sid
)) {
247 for(j
= 0; psnm
->known_users
&& psnm
->known_users
[j
].known_user_name
!= NULL
; j
++) {
248 if(rid
== psnm
->known_users
[j
].rid
) {
249 DEBUG(5,("lookup_builtin_rid: rid = %u, domain = '%s', user = '%s'\n",
250 (unsigned int)rid
, psnm
->name
, psnm
->known_users
[j
].known_user_name
));
251 fstrcpy( name
, psnm
->known_users
[j
].known_user_name
);
252 *psid_name_use
= psnm
->known_users
[j
].sid_name_use
;
262 /**************************************************************************
263 Turns a domain name into a SID.
264 *** side-effect: if the domain name is NULL, it is set to our domain ***
265 ***************************************************************************/
267 BOOL
map_domain_name_to_sid(DOM_SID
*sid
, char *nt_domain
)
271 if (nt_domain
== NULL
) {
272 DEBUG(5,("map_domain_name_to_sid: mapping NULL domain to our SID.\n"));
273 sid_copy(sid
, &global_sam_sid
);
277 if (nt_domain
[0] == 0) {
278 fstrcpy(nt_domain
, global_myname
);
279 DEBUG(5,("map_domain_name_to_sid: overriding blank name to %s\n", nt_domain
));
280 sid_copy(sid
, &global_sam_sid
);
284 DEBUG(5,("map_domain_name_to_sid: %s\n", nt_domain
));
286 if (!sid_name_map_initialized
)
289 while (sid_name_map
[i
].name
!= NULL
) {
290 DEBUG(5,("map_domain_name_to_sid: compare: %s\n", sid_name_map
[i
].name
));
291 if (strequal(sid_name_map
[i
].name
, nt_domain
)) {
293 sid_copy(sid
, sid_name_map
[i
].sid
);
294 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
295 DEBUG(5,("map_domain_name_to_sid: found %s\n", sid_str
));
301 DEBUG(0,("map_domain_name_to_sid: mapping to %s not found.\n", nt_domain
));
305 /**************************************************************************
306 Splits a name of format \DOMAIN\name or name into its two components.
307 Sets the DOMAIN name to global_myname if it has not been specified.
308 ***************************************************************************/
310 void split_domain_name(const char *fullname
, char *domain
, char *name
)
315 sep
= lp_winbind_separator();
317 *domain
= *name
= '\0';
319 if (fullname
[0] == sep
[0] || fullname
[0] == '\\')
322 pstrcpy(full_name
, fullname
);
323 p
= strchr(full_name
+1, '\\');
324 if (!p
) p
= strchr(full_name
+1, sep
[0]);
328 fstrcpy(domain
, full_name
);
331 fstrcpy(domain
, global_myname
);
332 fstrcpy(name
, full_name
);
335 DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
336 fullname
, domain
, name
));
339 /*****************************************************************
340 Convert a SID to an ascii string.
341 *****************************************************************/
343 char *sid_to_string(fstring sidstr_out
, DOM_SID
*sid
)
347 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
348 uint32 ia
= (sid
->id_auth
[5]) +
349 (sid
->id_auth
[4] << 8 ) +
350 (sid
->id_auth
[3] << 16) +
351 (sid
->id_auth
[2] << 24);
353 slprintf(sidstr_out
, sizeof(fstring
) - 1, "S-%u-%lu", (unsigned int)sid
->sid_rev_num
, (unsigned long)ia
);
355 for (i
= 0; i
< sid
->num_auths
; i
++) {
356 slprintf(subauth
, sizeof(subauth
)-1, "-%lu", (unsigned long)sid
->sub_auths
[i
]);
357 fstrcat(sidstr_out
, subauth
);
363 /*****************************************************************
364 Convert a string to a SID. Returns True on success, False on fail.
365 *****************************************************************/
367 BOOL
string_to_sid(DOM_SID
*sidout
, const char *sidstr
)
371 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
375 if (StrnCaseCmp( sidstr
, "S-", 2)) {
376 DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr
));
380 memset((char *)sidout
, '\0', sizeof(DOM_SID
));
382 q
= p
= strdup(sidstr
+ 2);
384 DEBUG(0, ("string_to_sid: out of memory!\n"));
388 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
389 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
394 /* Get the revision number. */
395 sidout
->sid_rev_num
= (uint8
)strtoul(tok
, NULL
, 10);
397 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
398 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
403 /* identauth in decimal should be < 2^32 */
404 ia
= (uint32
)strtoul(tok
, NULL
, 10);
406 /* NOTE - the ia value is in big-endian format. */
407 sidout
->id_auth
[0] = 0;
408 sidout
->id_auth
[1] = 0;
409 sidout
->id_auth
[2] = (ia
& 0xff000000) >> 24;
410 sidout
->id_auth
[3] = (ia
& 0x00ff0000) >> 16;
411 sidout
->id_auth
[4] = (ia
& 0x0000ff00) >> 8;
412 sidout
->id_auth
[5] = (ia
& 0x000000ff);
414 sidout
->num_auths
= 0;
416 while(next_token(&p
, tok
, "-", sizeof(tok
)) &&
417 sidout
->num_auths
< MAXSUBAUTHS
) {
419 * NOTE - the subauths are in native machine-endian format. They
420 * are converted to little-endian when linearized onto the wire.
422 sid_append_rid(sidout
, (uint32
)strtoul(tok
, NULL
, 10));
425 DEBUG(7,("string_to_sid: converted SID %s ok\n", sidstr
));
431 /*****************************************************************
432 Add a rid to the end of a sid
433 *****************************************************************/
435 BOOL
sid_append_rid(DOM_SID
*sid
, uint32 rid
)
437 if (sid
->num_auths
< MAXSUBAUTHS
) {
438 sid
->sub_auths
[sid
->num_auths
++] = rid
;
444 /*****************************************************************
445 Removes the last rid from the end of a sid
446 *****************************************************************/
448 BOOL
sid_split_rid(DOM_SID
*sid
, uint32
*rid
)
450 if (sid
->num_auths
> 0) {
452 *rid
= sid
->sub_auths
[sid
->num_auths
];
458 /*****************************************************************
459 Return the last rid from the end of a sid
460 *****************************************************************/
462 BOOL
sid_peek_rid(DOM_SID
*sid
, uint32
*rid
)
464 if (sid
->num_auths
> 0) {
465 *rid
= sid
->sub_auths
[sid
->num_auths
- 1];
471 /*****************************************************************
473 *****************************************************************/
475 void sid_copy(DOM_SID
*dst
, const DOM_SID
*src
)
479 memset((char *)dst
, '\0', sizeof(DOM_SID
));
481 dst
->sid_rev_num
= src
->sid_rev_num
;
482 dst
->num_auths
= src
->num_auths
;
484 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
486 for (i
= 0; i
< src
->num_auths
; i
++)
487 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
490 /*****************************************************************
491 Duplicates a sid - mallocs the target.
492 *****************************************************************/
494 DOM_SID
*sid_dup(DOM_SID
*src
)
501 if((dst
= malloc(sizeof(DOM_SID
))) != NULL
) {
502 memset(dst
, '\0', sizeof(DOM_SID
));
509 /*****************************************************************
510 Write a sid out into on-the-wire format.
511 *****************************************************************/
513 BOOL
sid_linearize(char *outbuf
, size_t len
, DOM_SID
*sid
)
517 if(len
< sid_size(sid
))
520 SCVAL(outbuf
,0,sid
->sid_rev_num
);
521 SCVAL(outbuf
,1,sid
->num_auths
);
522 memcpy(&outbuf
[2], sid
->id_auth
, 6);
523 for(i
= 0; i
< sid
->num_auths
; i
++)
524 SIVAL(outbuf
, 8 + (i
*4), sid
->sub_auths
[i
]);
529 /*****************************************************************
531 *****************************************************************/
532 int sid_compare(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
536 if (sid1
== sid2
) return 0;
537 if (!sid1
) return -1;
540 /* compare most likely different rids, first: i.e start at end */
541 for (i
= sid1
->num_auths
-1; i
>= 0; --i
)
542 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
543 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
545 if (sid1
->num_auths
!= sid2
->num_auths
)
546 return sid1
->num_auths
- sid2
->num_auths
;
548 if (sid1
->sid_rev_num
!= sid2
->sid_rev_num
)
549 return sid1
->sid_rev_num
- sid2
->sid_rev_num
;
551 for (i
= 0; i
< 6; i
++)
552 if (sid1
->id_auth
[i
] != sid2
->id_auth
[i
])
553 return sid1
->id_auth
[i
] - sid2
->id_auth
[i
];
559 /*****************************************************************
561 *****************************************************************/
563 BOOL
sid_equal(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
565 return sid_compare(sid1
, sid2
) == 0;
569 /*****************************************************************
570 Calculates size of a sid.
571 *****************************************************************/
573 size_t sid_size(DOM_SID
*sid
)
578 return sid
->num_auths
* sizeof(uint32
) + 8;
581 /*****************************************************************
582 Returns true if SID is internal (and non-mappable).
583 *****************************************************************/
585 BOOL
non_mappable_sid(DOM_SID
*sid
)
591 sid_split_rid(&dom
, &rid
);
593 if (sid_equal(&dom
, &global_sid_Builtin
))
596 if (sid_equal(&dom
, &global_sid_Creator_Owner_Domain
))
599 if (sid_equal(&dom
, &global_sid_NT_Authority
))