source/rpc_parse/parse_sec.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998,
   6  *  Copyright (C) Jeremy R. Allison            1995-1998
   7  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   8  *  Copyright (C) Paul Ashton                  1997-1998.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 #include "includes.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_RPC_PARSE
  29
  30 /*******************************************************************
  31  Sets up a SEC_ACCESS structure.
  32 ********************************************************************/
  33
  34 void init_sec_access(SEC_ACCESS *t, uint32 mask)
  35 {
  36         t->mask = mask;
  37 }
  38
  39 /*******************************************************************
  40  Reads or writes a SEC_ACCESS structure.
  41 ********************************************************************/
  42
  43 BOOL sec_io_access(char *desc, SEC_ACCESS *t, prs_struct *ps, int depth)
  44 {
  45         if (t == NULL)
  46                 return False;
  47
  48         prs_debug(ps, depth, desc, "sec_io_access");
  49         depth++;
  50
  51         if(!prs_uint32("mask", ps, depth, &(t->mask)))
  52                 return False;
  53
  54         return True;
  55 }
  56
  57 /*******************************************************************
  58  Check if ACE has OBJECT type.
  59 ********************************************************************/
  60
  61 BOOL sec_ace_object(uint8 type)
  62 {
  63         if (type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT ||
  64             type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT ||
  65             type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT ||
  66             type == SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT) {
  67                 return True;
  68         }
  69         return False;
  70 }
  71
  72 /*******************************************************************
  73  copy a SEC_ACE structure.
  74 ********************************************************************/
  75 void sec_ace_copy(SEC_ACE *ace_dest, SEC_ACE *ace_src)
  76 {
  77         ace_dest->type  = ace_src->type;
  78         ace_dest->flags = ace_src->flags;
  79         ace_dest->size  = ace_src->size;
  80         ace_dest->info.mask = ace_src->info.mask;
  81         ace_dest->obj_flags = ace_src->obj_flags;
  82         memcpy(&ace_dest->obj_guid, &ace_src->obj_guid, GUID_SIZE);
  83         memcpy(&ace_dest->inh_guid, &ace_src->inh_guid, GUID_SIZE);
  84         sid_copy(&ace_dest->trustee, &ace_src->trustee);
  85 }
  86
  87 /*******************************************************************
  88  Sets up a SEC_ACE structure.
  89 ********************************************************************/
  90
  91 void init_sec_ace(SEC_ACE *t, DOM_SID *sid, uint8 type, SEC_ACCESS mask, uint8 flag)
  92 {
  93         t->type = type;
  94         t->flags = flag;
  95         t->size = sid_size(sid) + 8;
  96         t->info = mask;
  97
  98         ZERO_STRUCTP(&t->trustee);
  99         sid_copy(&t->trustee, sid);
 100 }
 101
 102 /*******************************************************************
 103  Reads or writes a SEC_ACE structure.
 104 ********************************************************************/
 105
 106 BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth)
 107 {
 108         uint32 old_offset;
 109         uint32 offset_ace_size;
 110
 111         if (psa == NULL)
 112                 return False;
 113
 114         prs_debug(ps, depth, desc, "sec_io_ace");
 115         depth++;
 116
 117         old_offset = prs_offset(ps);
 118
 119         if(!prs_uint8("type ", ps, depth, &psa->type))
 120                 return False;
 121
 122         if(!prs_uint8("flags", ps, depth, &psa->flags))
 123                 return False;
 124
 125         if(!prs_uint16_pre("size ", ps, depth, &psa->size, &offset_ace_size))
 126                 return False;
 127
 128         if(!sec_io_access("info ", &psa->info, ps, depth))
 129                 return False;
 130
 131         /* check whether object access is present */
 132         if (!sec_ace_object(psa->type)) {
 133                 if (!smb_io_dom_sid("trustee  ", &psa->trustee , ps, depth))
 134                         return False;
 135         } else {
 136                 if (!prs_uint32("obj_flags", ps, depth, &psa->obj_flags))
 137                         return False;
 138
 139                 if (psa->obj_flags & SEC_ACE_OBJECT_PRESENT)
 140                         if (!prs_uint8s(False, "obj_guid", ps, depth, psa->obj_guid.info, GUID_SIZE))
 141                                 return False;
 142
 143                 if (psa->obj_flags & SEC_ACE_OBJECT_INHERITED_PRESENT)
 144                         if (!prs_uint8s(False, "inh_guid", ps, depth, psa->inh_guid.info, GUID_SIZE))
 145                                 return False;
 146
 147                 if(!smb_io_dom_sid("trustee  ", &psa->trustee , ps, depth))
 148                         return False;
 149         }
 150
 151         if(!prs_uint16_post("size ", ps, depth, &psa->size, offset_ace_size, old_offset))
 152                 return False;
 153         return True;
 154 }
 155
 156 /*******************************************************************
 157  adds new SID with its permissions to ACE list
 158 ********************************************************************/
 159
 160 NTSTATUS sec_ace_add_sid(TALLOC_CTX *ctx, SEC_ACE **new, SEC_ACE *old, size_t *num, DOM_SID *sid, uint32 mask)
 161 {
 162         int i = 0;
 163
 164         if (!ctx || !new || !old || !sid || !num)  return NT_STATUS_INVALID_PARAMETER;
 165
 166         *num += 1;
 167
 168         if((new[0] = (SEC_ACE *) talloc_zero(ctx, *num * sizeof(SEC_ACE))) == 0)
 169                 return NT_STATUS_NO_MEMORY;
 170
 171         for (i = 0; i < *num - 1; i ++)
 172                 sec_ace_copy(&(*new)[i], &old[i]);
 173
 174         (*new)[i].type  = 0;
 175         (*new)[i].flags = 0;
 176         (*new)[i].size  = SEC_ACE_HEADER_SIZE + sid_size(sid);
 177         (*new)[i].info.mask = mask;
 178         sid_copy(&(*new)[i].trustee, sid);
 179         return NT_STATUS_OK;
 180 }
 181
 182 /*******************************************************************
 183   modify SID's permissions at ACL
 184 ********************************************************************/
 185
 186 NTSTATUS sec_ace_mod_sid(SEC_ACE *ace, size_t num, DOM_SID *sid, uint32 mask)
 187 {
 188         int i = 0;
 189
 190         if (!ace || !sid)  return NT_STATUS_INVALID_PARAMETER;
 191
 192         for (i = 0; i < num; i ++) {
 193                 if (sid_compare(&ace[i].trustee, sid) == 0) {
 194                         ace[i].info.mask = mask;
 195                         return NT_STATUS_OK;
 196                 }
 197         }
 198         return NT_STATUS_NOT_FOUND;
 199 }
 200
 201 /*******************************************************************
 202  delete SID from ACL
 203 ********************************************************************/
 204
 205 NTSTATUS sec_ace_del_sid(TALLOC_CTX *ctx, SEC_ACE **new, SEC_ACE *old, size_t *num, DOM_SID *sid)
 206 {
 207         int i     = 0;
 208         int n_del = 0;
 209
 210         if (!ctx || !new || !old || !sid || !num)  return NT_STATUS_INVALID_PARAMETER;
 211
 212         if((new[0] = (SEC_ACE *) talloc_zero(ctx, *num * sizeof(SEC_ACE))) == 0)
 213                 return NT_STATUS_NO_MEMORY;
 214
 215         for (i = 0; i < *num; i ++) {
 216                 if (sid_compare(&old[i].trustee, sid) != 0)
 217                         sec_ace_copy(&(*new)[i], &old[i]);
 218                 else
 219                         n_del ++;
 220         }
 221         if (n_del == 0)
 222                 return NT_STATUS_NOT_FOUND;
 223         else {
 224                 *num -= n_del;
 225                 return NT_STATUS_OK;
 226         }
 227 }
 228
 229 /*******************************************************************
 230  Create a SEC_ACL structure.
 231 ********************************************************************/
 232
 233 SEC_ACL *make_sec_acl(TALLOC_CTX *ctx, uint16 revision, int num_aces, SEC_ACE *ace_list)
 234 {
 235         SEC_ACL *dst;
 236         int i;
 237
 238         if((dst = (SEC_ACL *)talloc_zero(ctx,sizeof(SEC_ACL))) == NULL)
 239                 return NULL;
 240
 241         dst->revision = revision;
 242         dst->num_aces = num_aces;
 243         dst->size = SEC_ACL_HEADER_SIZE;
 244
 245         /* Now we need to return a non-NULL address for the ace list even
 246            if the number of aces required is zero.  This is because there
 247            is a distinct difference between a NULL ace and an ace with zero
 248            entries in it.  This is achieved by checking that num_aces is a
 249            positive number. */
 250
 251         if ((num_aces) &&
 252             ((dst->ace = (SEC_ACE *)talloc(ctx, sizeof(SEC_ACE) * num_aces))
 253              == NULL)) {
 254                 return NULL;
 255         }
 256
 257         for (i = 0; i < num_aces; i++) {
 258                 dst->ace[i] = ace_list[i]; /* Structure copy. */
 259                 dst->size += ace_list[i].size;
 260         }
 261
 262         return dst;
 263 }
 264
 265 /*******************************************************************
 266  Duplicate a SEC_ACL structure.
 267 ********************************************************************/
 268
 269 SEC_ACL *dup_sec_acl(TALLOC_CTX *ctx, SEC_ACL *src)
 270 {
 271         if(src == NULL)
 272                 return NULL;
 273
 274         return make_sec_acl(ctx, src->revision, src->num_aces, src->ace);
 275 }
 276
 277 /*******************************************************************
 278  Reads or writes a SEC_ACL structure.
 279
 280  First of the xx_io_xx functions that allocates its data structures
 281  for you as it reads them.
 282 ********************************************************************/
 283
 284 BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
 285 {
 286         int i;
 287         uint32 old_offset;
 288         uint32 offset_acl_size;
 289         SEC_ACL *psa;
 290
 291         /*
 292          * Note that the size is always a multiple of 4 bytes due to the
 293          * nature of the data structure.  Therefore the prs_align() calls
 294          * have been removed as they through us off when doing two-layer
 295          * marshalling such as in the printing code (NEW_BUFFER).  --jerry
 296          */
 297
 298         if (ppsa == NULL)
 299                 return False;
 300
 301         psa = *ppsa;
 302
 303         if(UNMARSHALLING(ps) && psa == NULL) {
 304                 /*
 305                  * This is a read and we must allocate the stuct to read into.
 306                  */
 307                 if((psa = (SEC_ACL *)prs_alloc_mem(ps, sizeof(SEC_ACL))) == NULL)
 308                         return False;
 309                 *ppsa = psa;
 310         }
 311
 312         prs_debug(ps, depth, desc, "sec_io_acl");
 313         depth++;
 314
 315         old_offset = prs_offset(ps);
 316
 317         if(!prs_uint16("revision", ps, depth, &psa->revision))
 318                 return False;
 319
 320         if(!prs_uint16_pre("size     ", ps, depth, &psa->size, &offset_acl_size))
 321                 return False;
 322
 323         if(!prs_uint32("num_aces ", ps, depth, &psa->num_aces))
 324                 return False;
 325
 326         if (UNMARSHALLING(ps)) {
 327                 /*
 328                  * Even if the num_aces is zero, allocate memory as there's a difference
 329                  * between a non-present DACL (allow all access) and a DACL with no ACE's
 330                  * (allow no access).
 331                  */
 332                 if((psa->ace = (SEC_ACE *)prs_alloc_mem(ps,sizeof(psa->ace[0]) * (psa->num_aces+1))) == NULL)
 333                         return False;
 334         }
 335
 336         for (i = 0; i < psa->num_aces; i++) {
 337                 fstring tmp;
 338                 slprintf(tmp, sizeof(tmp)-1, "ace_list[%02d]: ", i);
 339                 if(!sec_io_ace(tmp, &psa->ace[i], ps, depth))
 340                         return False;
 341         }
 342
 343         if(!prs_uint16_post("size     ", ps, depth, &psa->size, offset_acl_size, old_offset))
 344                 return False;
 345
 346         return True;
 347 }
 348
 349 /*******************************************************************
 350  Works out the linearization size of a SEC_DESC.
 351 ********************************************************************/
 352
 353 size_t sec_desc_size(SEC_DESC *psd)
 354 {
 355         size_t offset;
 356
 357         if (!psd) return 0;
 358
 359         offset = SEC_DESC_HEADER_SIZE;
 360
 361         /* don't align */
 362
 363         if (psd->owner_sid != NULL)
 364                 offset += sid_size(psd->owner_sid);
 365
 366         if (psd->grp_sid != NULL)
 367                 offset += sid_size(psd->grp_sid);
 368
 369         if (psd->sacl != NULL)
 370                 offset += psd->sacl->size;
 371
 372         if (psd->dacl != NULL)
 373                 offset += psd->dacl->size;
 374
 375         return offset;
 376 }
 377
 378 /*******************************************************************
 379  Compares two SEC_ACE structures
 380 ********************************************************************/
 381
 382 BOOL sec_ace_equal(SEC_ACE *s1, SEC_ACE *s2)
 383 {
 384         /* Trivial case */
 385
 386         if (!s1 && !s2) return True;
 387
 388         /* Check top level stuff */
 389
 390         if (s1->type != s2->type || s1->flags != s2->flags ||
 391             s1->info.mask != s2->info.mask) {
 392                 return False;
 393         }
 394
 395         /* Check SID */
 396
 397         if (!sid_equal(&s1->trustee, &s2->trustee)) {
 398                 return False;
 399         }
 400
 401         return True;
 402 }
 403
 404 /*******************************************************************
 405  Compares two SEC_ACL structures
 406 ********************************************************************/
 407
 408 BOOL sec_acl_equal(SEC_ACL *s1, SEC_ACL *s2)
 409 {
 410         int i, j;
 411
 412         /* Trivial cases */
 413
 414         if (!s1 && !s2) return True;
 415         if (!s1 || !s2) return False;
 416
 417         /* Check top level stuff */
 418
 419         if (s1->revision != s2->revision) {
 420                 DEBUG(10, ("sec_acl_equal(): revision differs (%d != %d)\n",
 421                            s1->revision, s2->revision));
 422                 return False;
 423         }
 424
 425         if (s1->num_aces != s2->num_aces) {
 426                 DEBUG(10, ("sec_acl_equal(): num_aces differs (%d != %d)\n",
 427                            s1->revision, s2->revision));
 428                 return False;
 429         }
 430
 431         /* The ACEs could be in any order so check each ACE in s1 against
 432            each ACE in s2. */
 433
 434         for (i = 0; i < s1->num_aces; i++) {
 435                 BOOL found = False;
 436
 437                 for (j = 0; j < s2->num_aces; j++) {
 438                         if (sec_ace_equal(&s1->ace[i], &s2->ace[j])) {
 439                                 found = True;
 440                                 break;
 441                         }
 442                 }
 443
 444                 if (!found) return False;
 445         }
 446
 447         return True;
 448 }
 449
 450 /*******************************************************************
 451  Compares two SEC_DESC structures
 452 ********************************************************************/
 453
 454 BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2)
 455 {
 456         /* Trivial case */
 457
 458         if (!s1 && !s2) {
 459                 goto done;
 460         }
 461
 462         /* Check top level stuff */
 463
 464         if (s1->revision != s2->revision) {
 465                 DEBUG(10, ("sec_desc_equal(): revision differs (%d != %d)\n",
 466                            s1->revision, s2->revision));
 467                 return False;
 468         }
 469
 470         if (s1->type!= s2->type) {
 471                 DEBUG(10, ("sec_desc_equal(): type differs (%d != %d)\n",
 472                            s1->type, s2->type));
 473                 return False;
 474         }
 475
 476         /* Check owner and group */
 477
 478         if (!sid_equal(s1->owner_sid, s2->owner_sid)) {
 479                 fstring str1, str2;
 480
 481                 sid_to_string(str1, s1->owner_sid);
 482                 sid_to_string(str2, s2->owner_sid);
 483
 484                 DEBUG(10, ("sec_desc_equal(): owner differs (%s != %s)\n",
 485                            str1, str2));
 486                 return False;
 487         }
 488
 489         if (!sid_equal(s1->grp_sid, s2->grp_sid)) {
 490                 fstring str1, str2;
 491
 492                 sid_to_string(str1, s1->grp_sid);
 493                 sid_to_string(str2, s2->grp_sid);
 494
 495                 DEBUG(10, ("sec_desc_equal(): group differs (%s != %s)\n",
 496                            str1, str2));
 497                 return False;
 498         }
 499
 500         /* Check ACLs present in one but not the other */
 501
 502         if ((s1->dacl && !s2->dacl) || (!s1->dacl && s2->dacl) ||
 503             (s1->sacl && !s2->sacl) || (!s1->sacl && s2->sacl)) {
 504                 DEBUG(10, ("sec_desc_equal(): dacl or sacl not present\n"));
 505                 return False;
 506         }
 507
 508         /* Sigh - we have to do it the hard way by iterating over all
 509            the ACEs in the ACLs */
 510
 511         if (!sec_acl_equal(s1->dacl, s2->dacl) ||
 512             !sec_acl_equal(s1->sacl, s2->sacl)) {
 513                 DEBUG(10, ("sec_desc_equal(): dacl/sacl list not equal\n"));
 514                 return False;
 515         }
 516
 517  done:
 518         DEBUG(10, ("sec_desc_equal(): secdescs are identical\n"));
 519         return True;
 520 }
 521
 522 /*******************************************************************
 523  Merge part of security descriptor old_sec in to the empty sections of
 524  security descriptor new_sec.
 525 ********************************************************************/
 526
 527 SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
 528 {
 529         DOM_SID *owner_sid, *group_sid;
 530         SEC_DESC_BUF *return_sdb;
 531         SEC_ACL *dacl, *sacl;
 532         SEC_DESC *psd = NULL;
 533         uint16 secdesc_type;
 534         size_t secdesc_size;
 535
 536         /* Copy over owner and group sids.  There seems to be no flag for
 537            this so just check the pointer values. */
 538
 539         owner_sid = new_sdb->sec->owner_sid ? new_sdb->sec->owner_sid :
 540                 old_sdb->sec->owner_sid;
 541
 542         group_sid = new_sdb->sec->grp_sid ? new_sdb->sec->grp_sid :
 543                 old_sdb->sec->grp_sid;
 544
 545         secdesc_type = new_sdb->sec->type;
 546
 547         /* Ignore changes to the system ACL.  This has the effect of making
 548            changes through the security tab audit button not sticking.
 549            Perhaps in future Samba could implement these settings somehow. */
 550
 551         sacl = NULL;
 552         secdesc_type &= ~SEC_DESC_SACL_PRESENT;
 553
 554         /* Copy across discretionary ACL */
 555
 556         if (secdesc_type & SEC_DESC_DACL_PRESENT) {
 557                 dacl = new_sdb->sec->dacl;
 558         } else {
 559                 dacl = old_sdb->sec->dacl;
 560         }
 561
 562         /* Create new security descriptor from bits */
 563
 564         psd = make_sec_desc(ctx, new_sdb->sec->revision,
 565                             owner_sid, group_sid, sacl, dacl, &secdesc_size);
 566
 567         return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd);
 568
 569         return(return_sdb);
 570 }
 571
 572 /*******************************************************************
 573  Tallocs a duplicate SID.
 574 ********************************************************************/
 575
 576 static DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, DOM_SID *src)
 577 {
 578   DOM_SID *dst;
 579
 580   if(!src)
 581     return NULL;
 582
 583   if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) {
 584     sid_copy( dst, src);
 585   }
 586
 587   return dst;
 588 }
 589
 590 /*******************************************************************
 591  Creates a SEC_DESC structure
 592 ********************************************************************/
 593
 594 SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision,
 595                         DOM_SID *owner_sid, DOM_SID *grp_sid,
 596                         SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size)
 597 {
 598         SEC_DESC *dst;
 599         uint32 offset     = 0;
 600         uint32 offset_sid = SEC_DESC_HEADER_SIZE;
 601         uint32 offset_acl = 0;
 602
 603         *sd_size = 0;
 604
 605         if(( dst = (SEC_DESC *)talloc_zero(ctx, sizeof(SEC_DESC))) == NULL)
 606                 return NULL;
 607
 608         dst->revision = revision;
 609         dst->type     = SEC_DESC_SELF_RELATIVE;
 610
 611         if (sacl) dst->type |= SEC_DESC_SACL_PRESENT;
 612         if (dacl) dst->type |= SEC_DESC_DACL_PRESENT;
 613
 614         dst->off_owner_sid = 0;
 615         dst->off_grp_sid   = 0;
 616         dst->off_sacl      = 0;
 617         dst->off_dacl      = 0;
 618
 619         if(owner_sid && ((dst->owner_sid = sid_dup_talloc(ctx,owner_sid)) == NULL))
 620                 goto error_exit;
 621
 622         if(grp_sid && ((dst->grp_sid = sid_dup_talloc(ctx,grp_sid)) == NULL))
 623                 goto error_exit;
 624
 625         if(sacl && ((dst->sacl = dup_sec_acl(ctx, sacl)) == NULL))
 626                 goto error_exit;
 627
 628         if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL))
 629                 goto error_exit;
 630
 631         offset = 0;
 632
 633         /*
 634          * Work out the linearization sizes.
 635          */
 636         if (dst->owner_sid != NULL) {
 637
 638                 if (offset == 0)
 639                         offset = SEC_DESC_HEADER_SIZE;
 640
 641                 offset += sid_size(dst->owner_sid);
 642         }
 643
 644         if (dst->grp_sid != NULL) {
 645
 646                 if (offset == 0)
 647                         offset = SEC_DESC_HEADER_SIZE;
 648
 649                 offset += sid_size(dst->grp_sid);
 650         }
 651
 652         if (dst->sacl != NULL) {
 653
 654                 offset_acl = SEC_DESC_HEADER_SIZE;
 655
 656                 dst->off_sacl  = offset_acl;
 657                 offset_acl    += dst->sacl->size;
 658                 offset        += dst->sacl->size;
 659                 offset_sid    += dst->sacl->size;
 660         }
 661
 662         if (dst->dacl != NULL) {
 663
 664                 if (offset_acl == 0)
 665                         offset_acl = SEC_DESC_HEADER_SIZE;
 666
 667                 dst->off_dacl  = offset_acl;
 668                 offset_acl    += dst->dacl->size;
 669                 offset        += dst->dacl->size;
 670                 offset_sid    += dst->dacl->size;
 671         }
 672
 673         *sd_size = (size_t)((offset == 0) ? SEC_DESC_HEADER_SIZE : offset);
 674
 675         if (dst->owner_sid != NULL)
 676                 dst->off_owner_sid = offset_sid;
 677
 678         /* sid_size() returns 0 if the sid is NULL so this is ok */
 679
 680         if (dst->grp_sid != NULL)
 681                 dst->off_grp_sid = offset_sid + sid_size(dst->owner_sid);
 682
 683         return dst;
 684
 685 error_exit:
 686
 687         *sd_size = 0;
 688         return NULL;
 689 }
 690
 691 /*******************************************************************
 692  Duplicate a SEC_DESC structure.
 693 ********************************************************************/
 694
 695 SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src)
 696 {
 697         size_t dummy;
 698
 699         if(src == NULL)
 700                 return NULL;
 701
 702         return make_sec_desc( ctx, src->revision,
 703                                 src->owner_sid, src->grp_sid, src->sacl,
 704                                 src->dacl, &dummy);
 705 }
 706
 707 /*******************************************************************
 708  Creates a SEC_DESC structure with typical defaults.
 709 ********************************************************************/
 710
 711 SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid,
 712                                  SEC_ACL *dacl, size_t *sd_size)
 713 {
 714         return make_sec_desc(ctx, SEC_DESC_REVISION,
 715                              owner_sid, grp_sid, NULL, dacl, sd_size);
 716 }
 717
 718 /*******************************************************************
 719  Reads or writes a SEC_DESC structure.
 720  If reading and the *ppsd = NULL, allocates the structure.
 721 ********************************************************************/
 722
 723 BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
 724 {
 725         uint32 old_offset;
 726         uint32 max_offset = 0; /* after we're done, move offset to end */
 727         uint32 tmp_offset = 0;
 728
 729         SEC_DESC *psd;
 730
 731         if (ppsd == NULL)
 732                 return False;
 733
 734         psd = *ppsd;
 735
 736         if (psd == NULL) {
 737                 if(UNMARSHALLING(ps)) {
 738                         if((psd = (SEC_DESC *)prs_alloc_mem(ps,sizeof(SEC_DESC))) == NULL)
 739                                 return False;
 740                         *ppsd = psd;
 741                 } else {
 742                         /* Marshalling - just ignore. */
 743                         return True;
 744                 }
 745         }
 746
 747         prs_debug(ps, depth, desc, "sec_io_desc");
 748         depth++;
 749
 750 #if 0
 751         /*
 752          * if alignment is needed, should be done by the the
 753          * caller.  Not here.  This caused me problems when marshalling
 754          * printer info into a buffer.   --jerry
 755          */
 756         if(!prs_align(ps))
 757                 return False;
 758 #endif
 759
 760         /* start of security descriptor stored for back-calc offset purposes */
 761         old_offset = prs_offset(ps);
 762
 763         if(!prs_uint16("revision ", ps, depth, &psd->revision))
 764                 return False;
 765
 766         if(!prs_uint16("type     ", ps, depth, &psd->type))
 767                 return False;
 768
 769         if(!prs_uint32("off_owner_sid", ps, depth, &psd->off_owner_sid))
 770                 return False;
 771
 772         if(!prs_uint32("off_grp_sid  ", ps, depth, &psd->off_grp_sid))
 773                 return False;
 774
 775         if(!prs_uint32("off_sacl     ", ps, depth, &psd->off_sacl))
 776                 return False;
 777
 778         if(!prs_uint32("off_dacl     ", ps, depth, &psd->off_dacl))
 779                 return False;
 780
 781         max_offset = MAX(max_offset, prs_offset(ps));
 782
 783         if (psd->off_owner_sid != 0) {
 784
 785                 if (UNMARSHALLING(ps)) {
 786                         if(!prs_set_offset(ps, old_offset + psd->off_owner_sid))
 787                                 return False;
 788                         /* reading */
 789                         if((psd->owner_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->owner_sid))) == NULL)
 790                                 return False;
 791                 }
 792
 793                 tmp_offset = ps->data_offset;
 794                 ps->data_offset = psd->off_owner_sid;
 795
 796                 if(!smb_io_dom_sid("owner_sid ", psd->owner_sid , ps, depth))
 797                         return False;
 798
 799                 ps->data_offset = tmp_offset;
 800         }
 801
 802         max_offset = MAX(max_offset, prs_offset(ps));
 803
 804         if (psd->off_grp_sid != 0) {
 805
 806                 if (UNMARSHALLING(ps)) {
 807                         /* reading */
 808                         if(!prs_set_offset(ps, old_offset + psd->off_grp_sid))
 809                                 return False;
 810                         if((psd->grp_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->grp_sid))) == NULL)
 811                                 return False;
 812                 }
 813
 814                 tmp_offset = ps->data_offset;
 815                 ps->data_offset = psd->off_grp_sid;
 816
 817                 if(!smb_io_dom_sid("grp_sid", psd->grp_sid, ps, depth))
 818                         return False;
 819
 820                 ps->data_offset = tmp_offset;
 821         }
 822
 823         max_offset = MAX(max_offset, prs_offset(ps));
 824
 825         if ((psd->type & SEC_DESC_SACL_PRESENT) && psd->off_sacl) {
 826                 if(!prs_set_offset(ps, old_offset + psd->off_sacl))
 827                         return False;
 828                 if(!sec_io_acl("sacl", &psd->sacl, ps, depth))
 829                         return False;
 830         }
 831
 832         max_offset = MAX(max_offset, prs_offset(ps));
 833
 834         if ((psd->type & SEC_DESC_DACL_PRESENT) && psd->off_dacl != 0) {
 835                 if(!prs_set_offset(ps, old_offset + psd->off_dacl))
 836                         return False;
 837                 if(!sec_io_acl("dacl", &psd->dacl, ps, depth))
 838                         return False;
 839         }
 840
 841         max_offset = MAX(max_offset, prs_offset(ps));
 842
 843         if(!prs_set_offset(ps, max_offset))
 844                 return False;
 845         return True;
 846 }
 847
 848 /*******************************************************************
 849  Creates a SEC_DESC_BUF structure.
 850 ********************************************************************/
 851
 852 SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc)
 853 {
 854         SEC_DESC_BUF *dst;
 855
 856         if((dst = (SEC_DESC_BUF *)talloc_zero(ctx, sizeof(SEC_DESC_BUF))) == NULL)
 857                 return NULL;
 858
 859         /* max buffer size (allocated size) */
 860         dst->max_len = (uint32)len;
 861         dst->len = (uint32)len;
 862
 863         if(sec_desc && ((dst->sec = dup_sec_desc(ctx, sec_desc)) == NULL)) {
 864                 return NULL;
 865         }
 866
 867         dst->ptr = 0x1;
 868
 869         return dst;
 870 }
 871
 872 /*******************************************************************
 873  Duplicates a SEC_DESC_BUF structure.
 874 ********************************************************************/
 875
 876 SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src)
 877 {
 878         if(src == NULL)
 879                 return NULL;
 880
 881         return make_sec_desc_buf( ctx, src->len, src->sec);
 882 }
 883
 884 /*******************************************************************
 885  Reads or writes a SEC_DESC_BUF structure.
 886 ********************************************************************/
 887
 888 BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth)
 889 {
 890         uint32 off_len;
 891         uint32 off_max_len;
 892         uint32 old_offset;
 893         uint32 size;
 894         SEC_DESC_BUF *psdb;
 895
 896         if (ppsdb == NULL)
 897                 return False;
 898
 899         psdb = *ppsdb;
 900
 901         if (UNMARSHALLING(ps) && psdb == NULL) {
 902                 if((psdb = (SEC_DESC_BUF *)prs_alloc_mem(ps,sizeof(SEC_DESC_BUF))) == NULL)
 903                         return False;
 904                 *ppsdb = psdb;
 905         }
 906
 907         prs_debug(ps, depth, desc, "sec_io_desc_buf");
 908         depth++;
 909
 910         if(!prs_align(ps))
 911                 return False;
 912
 913         if(!prs_uint32_pre("max_len", ps, depth, &psdb->max_len, &off_max_len))
 914                 return False;
 915
 916         if(!prs_uint32    ("ptr  ", ps, depth, &psdb->ptr))
 917                 return False;
 918
 919         if(!prs_uint32_pre("len    ", ps, depth, &psdb->len, &off_len))
 920                 return False;
 921
 922         old_offset = prs_offset(ps);
 923
 924         /* reading, length is non-zero; writing, descriptor is non-NULL */
 925         if ((UNMARSHALLING(ps) && psdb->len != 0) || (MARSHALLING(ps) && psdb->sec != NULL)) {
 926                 if(!sec_io_desc("sec   ", &psdb->sec, ps, depth))
 927                         return False;
 928         }
 929
 930         if(!prs_align(ps))
 931                 return False;
 932
 933         size = prs_offset(ps) - old_offset;
 934         if(!prs_uint32_post("max_len", ps, depth, &psdb->max_len, off_max_len, size == 0 ? psdb->max_len : size))
 935                 return False;
 936
 937         if(!prs_uint32_post("len    ", ps, depth, &psdb->len, off_len, size))
 938                 return False;
 939
 940         return True;
 941 }
 942
 943 /*******************************************************************
 944  adds new SID with its permissions to SEC_DESC
 945 ********************************************************************/
 946
 947 NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 mask, size_t *sd_size)
 948 {
 949         SEC_DESC *sd   = 0;
 950         SEC_ACL  *dacl = 0;
 951         SEC_ACE  *ace  = 0;
 952         NTSTATUS  status;
 953
 954         *sd_size = 0;
 955
 956         if (!ctx || !psd || !sid || !sd_size)  return NT_STATUS_INVALID_PARAMETER;
 957
 958         status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid, mask);
 959
 960         if (!NT_STATUS_IS_OK(status))
 961                 return status;
 962
 963         if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
 964                 return NT_STATUS_UNSUCCESSFUL;
 965
 966         if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->owner_sid,
 967                 psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size)))
 968                 return NT_STATUS_UNSUCCESSFUL;
 969
 970         *psd = sd;
 971          sd  = 0;
 972         return NT_STATUS_OK;
 973 }
 974
 975 /*******************************************************************
 976  modify SID's permissions at SEC_DESC
 977 ********************************************************************/
 978
 979 NTSTATUS sec_desc_mod_sid(SEC_DESC *sd, DOM_SID *sid, uint32 mask)
 980 {
 981         NTSTATUS status;
 982
 983         if (!sd || !sid) return NT_STATUS_INVALID_PARAMETER;
 984
 985         status = sec_ace_mod_sid(sd->dacl->ace, sd->dacl->num_aces, sid, mask);
 986
 987         if (!NT_STATUS_IS_OK(status))
 988                 return status;
 989
 990         return NT_STATUS_OK;
 991 }
 992
 993 /*******************************************************************
 994  delete SID from SEC_DESC
 995 ********************************************************************/
 996
 997 NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size)
 998 {
 999         SEC_DESC *sd   = 0;
1000         SEC_ACL  *dacl = 0;
1001         SEC_ACE  *ace  = 0;
1002         NTSTATUS  status;
1003
1004         *sd_size = 0;
1005
1006         if (!ctx || !psd[0] || !sid || !sd_size) return NT_STATUS_INVALID_PARAMETER;
1007
1008         status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid);
1009
1010         if (!NT_STATUS_IS_OK(status))
1011                 return status;
1012
1013         if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace)))
1014                 return NT_STATUS_UNSUCCESSFUL;
1015
1016         if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->owner_sid,
1017                 psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size)))
1018                 return NT_STATUS_UNSUCCESSFUL;
1019
1020         *psd = sd;
1021          sd  = 0;
1022         return NT_STATUS_OK;
1023 }