2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 /* NOTE! the global_sam_sid is the SID of our local SAM. This is only
26 equal to the domain SID when we are a DC, otherwise its our
28 DOM_SID global_sam_sid
;
29 extern pstring global_myname
;
30 extern fstring global_myworkgroup
;
36 DOM_SID global_sid_Builtin
; /* Local well-known domain */
37 DOM_SID global_sid_World_Domain
; /* Everyone domain */
38 DOM_SID global_sid_World
; /* Everyone */
39 DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
40 DOM_SID global_sid_Creator_Owner
; /* Creator Owner */
41 DOM_SID global_sid_Creator_Group
; /* Creator Group */
42 DOM_SID global_sid_NT_Authority
; /* NT Authority */
43 DOM_SID global_sid_NULL
; /* NULL sid */
44 DOM_SID global_sid_Builtin_Guests
; /* Builtin guest users */
45 DOM_SID global_sid_Authenticated_Users
; /* All authenticated rids */
46 DOM_SID global_sid_Network
; /* Network rids */
47 DOM_SID global_sid_Anonymous
; /* Anonymous login */
49 const DOM_SID
*global_sid_everyone
= &global_sid_World
;
51 typedef struct _known_sid_users
{
53 enum SID_NAME_USE sid_name_use
;
54 char *known_user_name
;
57 /* static known_sid_users no_users[] = {{0, 0, NULL}}; */
59 static known_sid_users everyone_users
[] = {
60 { 0, SID_NAME_WKN_GRP
, "Everyone" },
61 {0, (enum SID_NAME_USE
)0, NULL
}};
63 static known_sid_users creator_owner_users
[] = {
64 { 0, SID_NAME_ALIAS
, "Creator Owner" },
65 {0, (enum SID_NAME_USE
)0, NULL
}};
67 static known_sid_users nt_authority_users
[] = {
68 { 1, SID_NAME_ALIAS
, "Dialup" },
69 { 2, SID_NAME_ALIAS
, "Network"},
70 { 3, SID_NAME_ALIAS
, "Batch"},
71 { 4, SID_NAME_ALIAS
, "Interactive"},
72 { 6, SID_NAME_ALIAS
, "Service"},
73 { 7, SID_NAME_ALIAS
, "AnonymousLogon"},
74 { 8, SID_NAME_ALIAS
, "Proxy"},
75 { 9, SID_NAME_ALIAS
, "ServerLogon"},
76 { 11, SID_NAME_ALIAS
, "Authenticated Users"},
77 { 18, SID_NAME_ALIAS
, "SYSTEM"},
78 { 0, (enum SID_NAME_USE
)0, NULL
}};
80 static known_sid_users builtin_groups
[] = {
81 { BUILTIN_ALIAS_RID_ADMINS
, SID_NAME_ALIAS
, "Administrators" },
82 { BUILTIN_ALIAS_RID_USERS
, SID_NAME_ALIAS
, "Users" },
83 { BUILTIN_ALIAS_RID_GUESTS
, SID_NAME_ALIAS
, "Guests" },
84 { BUILTIN_ALIAS_RID_ACCOUNT_OPS
, SID_NAME_ALIAS
, "Account Operators" },
85 { BUILTIN_ALIAS_RID_SYSTEM_OPS
, SID_NAME_ALIAS
, "Server Operators" },
86 { BUILTIN_ALIAS_RID_PRINT_OPS
, SID_NAME_ALIAS
, "Print Operators" },
87 { BUILTIN_ALIAS_RID_BACKUP_OPS
, SID_NAME_ALIAS
, "Backup Operators" },
88 { 0, (enum SID_NAME_USE
)0, NULL
}};
90 #define MAX_SID_NAMES 7
92 static struct sid_name_map_info
96 known_sid_users
*known_users
;
97 } sid_name_map
[MAX_SID_NAMES
];
99 static BOOL sid_name_map_initialized
= False
;
102 * An NT compatible anonymous token.
105 static DOM_SID anon_sid_array
[3];
107 NT_USER_TOKEN anonymous_token
= {
112 /**************************************************************************
114 *************************************************************************/
115 static void init_sid_name_map (void)
119 if (sid_name_map_initialized
) return;
122 if ((lp_security() == SEC_USER
) && lp_domain_logons()) {
123 sid_name_map
[i
].sid
= &global_sam_sid
;
124 sid_name_map
[i
].name
= global_myworkgroup
;
125 sid_name_map
[i
].known_users
= NULL
;
127 sid_name_map
[i
].sid
= &global_sam_sid
;
128 sid_name_map
[i
].name
= global_myname
;
129 sid_name_map
[i
].known_users
= NULL
;
133 sid_name_map
[i
].sid
= &global_sam_sid
;
134 sid_name_map
[i
].name
= global_myname
;
135 sid_name_map
[i
].known_users
= NULL
;
139 sid_name_map
[i
].sid
= &global_sid_Builtin
;
140 sid_name_map
[i
].name
= "BUILTIN";
141 sid_name_map
[i
].known_users
= &builtin_groups
[0];
144 sid_name_map
[i
].sid
= &global_sid_World_Domain
;
145 sid_name_map
[i
].name
= "";
146 sid_name_map
[i
].known_users
= &everyone_users
[0];
149 sid_name_map
[i
].sid
= &global_sid_Creator_Owner_Domain
;
150 sid_name_map
[i
].name
= "";
151 sid_name_map
[i
].known_users
= &creator_owner_users
[0];
154 sid_name_map
[i
].sid
= &global_sid_NT_Authority
;
155 sid_name_map
[i
].name
= "NT Authority";
156 sid_name_map
[i
].known_users
= &nt_authority_users
[0];
161 sid_name_map
[i
].sid
= NULL
;
162 sid_name_map
[i
].name
= NULL
;
163 sid_name_map
[i
].known_users
= NULL
;
165 sid_name_map_initialized
= True
;
171 /****************************************************************************
172 Creates some useful well known sids
173 ****************************************************************************/
175 void generate_wellknown_sids(void)
177 string_to_sid(&global_sid_Builtin
, "S-1-5-32");
178 string_to_sid(&global_sid_Builtin_Guests
, "S-1-5-32-546");
179 string_to_sid(&global_sid_World_Domain
, "S-1-1");
180 string_to_sid(&global_sid_World
, "S-1-1-0");
181 string_to_sid(&global_sid_Creator_Owner_Domain
, "S-1-3");
182 string_to_sid(&global_sid_Creator_Owner
, "S-1-3-0");
183 string_to_sid(&global_sid_Creator_Group
, "S-1-3-1");
184 string_to_sid(&global_sid_NT_Authority
, "S-1-5");
185 string_to_sid(&global_sid_NULL
, "S-1-0-0");
186 string_to_sid(&global_sid_Authenticated_Users
, "S-1-5-11");
187 string_to_sid(&global_sid_Network
, "S-1-5-2");
188 string_to_sid(&global_sid_Anonymous
, "S-1-5-7");
190 /* Create the anon token. */
191 sid_copy( &anonymous_token
.user_sids
[0], &global_sid_World
);
192 sid_copy( &anonymous_token
.user_sids
[1], &global_sid_Network
);
193 sid_copy( &anonymous_token
.user_sids
[2], &global_sid_Anonymous
);
196 /**************************************************************************
197 Turns a domain SID into a name, returned in the nt_domain argument.
198 ***************************************************************************/
200 BOOL
map_domain_sid_to_name(DOM_SID
*sid
, char *nt_domain
)
205 sid_to_string(sid_str
, sid
);
207 if (!sid_name_map_initialized
)
210 DEBUG(5,("map_domain_sid_to_name: %s\n", sid_str
));
212 if (nt_domain
== NULL
)
215 while (sid_name_map
[i
].sid
!= NULL
) {
216 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
217 DEBUG(5,("map_domain_sid_to_name: compare: %s\n", sid_str
));
218 if (sid_equal(sid_name_map
[i
].sid
, sid
)) {
219 fstrcpy(nt_domain
, sid_name_map
[i
].name
);
220 DEBUG(5,("map_domain_sid_to_name: found '%s'\n", nt_domain
));
226 DEBUG(5,("map_domain_sid_to_name: mapping for %s not found\n", sid_str
));
231 /**************************************************************************
232 Looks up a known username from one of the known domains.
233 ***************************************************************************/
235 BOOL
lookup_known_rid(DOM_SID
*sid
, uint32 rid
, char *name
, enum SID_NAME_USE
*psid_name_use
)
238 struct sid_name_map_info
*psnm
;
240 if (!sid_name_map_initialized
)
243 for(i
= 0; sid_name_map
[i
].sid
!= NULL
; i
++) {
244 psnm
= &sid_name_map
[i
];
245 if(sid_equal(psnm
->sid
, sid
)) {
247 for(j
= 0; psnm
->known_users
&& psnm
->known_users
[j
].known_user_name
!= NULL
; j
++) {
248 if(rid
== psnm
->known_users
[j
].rid
) {
249 DEBUG(5,("lookup_builtin_rid: rid = %u, domain = '%s', user = '%s'\n",
250 (unsigned int)rid
, psnm
->name
, psnm
->known_users
[j
].known_user_name
));
251 fstrcpy( name
, psnm
->known_users
[j
].known_user_name
);
252 *psid_name_use
= psnm
->known_users
[j
].sid_name_use
;
262 /**************************************************************************
263 Turns a domain name into a SID.
264 *** side-effect: if the domain name is NULL, it is set to our domain ***
265 ***************************************************************************/
267 BOOL
map_domain_name_to_sid(DOM_SID
*sid
, char *nt_domain
)
271 if (nt_domain
== NULL
) {
272 DEBUG(5,("map_domain_name_to_sid: mapping NULL domain to our SID.\n"));
273 sid_copy(sid
, &global_sam_sid
);
277 if (nt_domain
[0] == 0) {
278 fstrcpy(nt_domain
, global_myname
);
279 DEBUG(5,("map_domain_name_to_sid: overriding blank name to %s\n", nt_domain
));
280 sid_copy(sid
, &global_sam_sid
);
284 DEBUG(5,("map_domain_name_to_sid: %s\n", nt_domain
));
286 if (!sid_name_map_initialized
)
289 while (sid_name_map
[i
].name
!= NULL
) {
290 DEBUG(5,("map_domain_name_to_sid: compare: %s\n", sid_name_map
[i
].name
));
291 if (strequal(sid_name_map
[i
].name
, nt_domain
)) {
293 sid_copy(sid
, sid_name_map
[i
].sid
);
294 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
295 DEBUG(5,("map_domain_name_to_sid: found %s\n", sid_str
));
301 DEBUG(0,("map_domain_name_to_sid: mapping to %s not found.\n", nt_domain
));
305 /**************************************************************************
306 Splits a name of format \DOMAIN\name or name into its two components.
307 Sets the DOMAIN name to global_myname if it has not been specified.
308 ***************************************************************************/
310 void split_domain_name(const char *fullname
, char *domain
, char *name
)
315 sep
= lp_winbind_separator();
317 *domain
= *name
= '\0';
319 if (fullname
[0] == sep
[0] || fullname
[0] == '\\')
322 pstrcpy(full_name
, fullname
);
323 p
= strchr(full_name
+1, '\\');
324 if (!p
) p
= strchr(full_name
+1, sep
[0]);
328 fstrcpy(domain
, full_name
);
331 fstrcpy(domain
, global_myname
);
332 fstrcpy(name
, full_name
);
335 DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
336 fullname
, domain
, name
));
339 /*****************************************************************
340 Convert a SID to an ascii string.
341 *****************************************************************/
343 char *sid_to_string(fstring sidstr_out
, DOM_SID
*sid
)
347 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
348 uint32 ia
= (sid
->id_auth
[5]) +
349 (sid
->id_auth
[4] << 8 ) +
350 (sid
->id_auth
[3] << 16) +
351 (sid
->id_auth
[2] << 24);
353 slprintf(sidstr_out
, sizeof(fstring
) - 1, "S-%u-%lu", (unsigned int)sid
->sid_rev_num
, (unsigned long)ia
);
355 for (i
= 0; i
< sid
->num_auths
; i
++) {
356 slprintf(subauth
, sizeof(subauth
)-1, "-%lu", (unsigned long)sid
->sub_auths
[i
]);
357 fstrcat(sidstr_out
, subauth
);
364 useful function for debug lines
366 const char *sid_string_static(DOM_SID
*sid
)
368 static fstring sid_str
;
369 sid_to_string(sid_str
, sid
);
373 /*****************************************************************
374 Convert a string to a SID. Returns True on success, False on fail.
375 *****************************************************************/
377 BOOL
string_to_sid(DOM_SID
*sidout
, const char *sidstr
)
381 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
384 if (StrnCaseCmp( sidstr
, "S-", 2)) {
385 DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr
));
389 memset((char *)sidout
, '\0', sizeof(DOM_SID
));
391 q
= p
= strdup(sidstr
+ 2);
393 DEBUG(0, ("string_to_sid: out of memory!\n"));
397 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
398 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
403 /* Get the revision number. */
404 sidout
->sid_rev_num
= (uint8
)strtoul(tok
, NULL
, 10);
406 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
407 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
412 /* identauth in decimal should be < 2^32 */
413 ia
= (uint32
)strtoul(tok
, NULL
, 10);
415 /* NOTE - the ia value is in big-endian format. */
416 sidout
->id_auth
[0] = 0;
417 sidout
->id_auth
[1] = 0;
418 sidout
->id_auth
[2] = (ia
& 0xff000000) >> 24;
419 sidout
->id_auth
[3] = (ia
& 0x00ff0000) >> 16;
420 sidout
->id_auth
[4] = (ia
& 0x0000ff00) >> 8;
421 sidout
->id_auth
[5] = (ia
& 0x000000ff);
423 sidout
->num_auths
= 0;
425 while(next_token(&p
, tok
, "-", sizeof(tok
)) &&
426 sidout
->num_auths
< MAXSUBAUTHS
) {
428 * NOTE - the subauths are in native machine-endian format. They
429 * are converted to little-endian when linearized onto the wire.
431 sid_append_rid(sidout
, (uint32
)strtoul(tok
, NULL
, 10));
438 /*****************************************************************
439 Add a rid to the end of a sid
440 *****************************************************************/
442 BOOL
sid_append_rid(DOM_SID
*sid
, uint32 rid
)
444 if (sid
->num_auths
< MAXSUBAUTHS
) {
445 sid
->sub_auths
[sid
->num_auths
++] = rid
;
451 /*****************************************************************
452 Removes the last rid from the end of a sid
453 *****************************************************************/
455 BOOL
sid_split_rid(DOM_SID
*sid
, uint32
*rid
)
457 if (sid
->num_auths
> 0) {
459 *rid
= sid
->sub_auths
[sid
->num_auths
];
465 /*****************************************************************
466 Return the last rid from the end of a sid
467 *****************************************************************/
469 BOOL
sid_peek_rid(DOM_SID
*sid
, uint32
*rid
)
471 if (sid
->num_auths
> 0) {
472 *rid
= sid
->sub_auths
[sid
->num_auths
- 1];
478 /*****************************************************************
480 *****************************************************************/
482 void sid_copy(DOM_SID
*dst
, const DOM_SID
*src
)
486 memset((char *)dst
, '\0', sizeof(DOM_SID
));
488 dst
->sid_rev_num
= src
->sid_rev_num
;
489 dst
->num_auths
= src
->num_auths
;
491 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
493 for (i
= 0; i
< src
->num_auths
; i
++)
494 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
497 /*****************************************************************
498 Duplicates a sid - mallocs the target.
499 *****************************************************************/
501 DOM_SID
*sid_dup(DOM_SID
*src
)
508 if((dst
= malloc(sizeof(DOM_SID
))) != NULL
) {
509 memset(dst
, '\0', sizeof(DOM_SID
));
516 /*****************************************************************
517 Write a sid out into on-the-wire format.
518 *****************************************************************/
519 BOOL
sid_linearize(char *outbuf
, size_t len
, DOM_SID
*sid
)
523 if (len
< sid_size(sid
))
526 SCVAL(outbuf
,0,sid
->sid_rev_num
);
527 SCVAL(outbuf
,1,sid
->num_auths
);
528 memcpy(&outbuf
[2], sid
->id_auth
, 6);
529 for(i
= 0; i
< sid
->num_auths
; i
++)
530 SIVAL(outbuf
, 8 + (i
*4), sid
->sub_auths
[i
]);
535 /*****************************************************************
536 parse a on-the-wire SID to a DOM_SID
537 *****************************************************************/
538 BOOL
sid_parse(char *inbuf
, size_t len
, DOM_SID
*sid
)
541 if (len
< 8) return False
;
542 sid
->sid_rev_num
= CVAL(inbuf
, 0);
543 sid
->num_auths
= CVAL(inbuf
, 1);
544 memcpy(sid
->id_auth
, inbuf
+2, 6);
545 if (len
< 8 + sid
->num_auths
*4) return False
;
546 for (i
=0;i
<sid
->num_auths
;i
++) {
547 sid
->sub_auths
[i
] = IVAL(inbuf
, 8+i
*4);
553 /*****************************************************************
554 Compare the auth portion of two sids.
555 *****************************************************************/
556 int sid_compare_auth(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
560 if (sid1
== sid2
) return 0;
561 if (!sid1
) return -1;
564 if (sid1
->sid_rev_num
!= sid2
->sid_rev_num
)
565 return sid1
->sid_rev_num
- sid2
->sid_rev_num
;
567 for (i
= 0; i
< 6; i
++)
568 if (sid1
->id_auth
[i
] != sid2
->id_auth
[i
])
569 return sid1
->id_auth
[i
] - sid2
->id_auth
[i
];
574 /*****************************************************************
576 *****************************************************************/
577 int sid_compare(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
581 if (sid1
== sid2
) return 0;
582 if (!sid1
) return -1;
585 /* compare most likely different rids, first: i.e start at end */
586 if (sid1
->num_auths
!= sid2
->num_auths
)
587 return sid1
->num_auths
- sid2
->num_auths
;
589 for (i
= sid1
->num_auths
-1; i
>= 0; --i
)
590 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
591 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
593 return sid_compare_auth(sid1
, sid2
);
596 /*****************************************************************
597 see if 2 SIDs are in the same domain
598 this just compares the leading sub-auths
599 *****************************************************************/
600 int sid_compare_domain(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
604 n
= MIN(sid1
->num_auths
, sid2
->num_auths
);
606 for (i
= n
-1; i
>= 0; --i
)
607 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
608 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
610 return sid_compare_auth(sid1
, sid2
);
613 /*****************************************************************
615 *****************************************************************/
616 BOOL
sid_equal(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
618 return sid_compare(sid1
, sid2
) == 0;
622 /*****************************************************************
623 Check if the SID is our domain SID (S-1-5-21-x-y-z).
624 *****************************************************************/
625 BOOL
sid_check_is_domain(const DOM_SID
*sid
)
627 return sid_equal(sid
, &global_sam_sid
);
631 /*****************************************************************
632 Check if the SID is the builtin SID (S-1-5-32).
633 *****************************************************************/
634 BOOL
sid_check_is_builtin(const DOM_SID
*sid
)
636 return sid_equal(sid
, &global_sid_Builtin
);
640 /*****************************************************************
641 Check if the SID is our domain SID (S-1-5-21-x-y-z).
642 *****************************************************************/
643 BOOL
sid_check_is_in_our_domain(const DOM_SID
*sid
)
648 sid_copy(&dom_sid
, sid
);
649 sid_split_rid(&dom_sid
, &rid
);
651 return sid_equal(&dom_sid
, &global_sam_sid
);
654 /*****************************************************************
655 Check if the SID is our domain SID (S-1-5-21-x-y-z).
656 *****************************************************************/
657 BOOL
sid_check_is_in_builtin(const DOM_SID
*sid
)
662 sid_copy(&dom_sid
, sid
);
663 sid_split_rid(&dom_sid
, &rid
);
665 return sid_equal(&dom_sid
, &global_sid_Builtin
);
669 /*****************************************************************
670 Calculates size of a sid.
671 *****************************************************************/
673 size_t sid_size(DOM_SID
*sid
)
678 return sid
->num_auths
* sizeof(uint32
) + 8;
681 /*****************************************************************
682 Returns true if SID is internal (and non-mappable).
683 *****************************************************************/
685 BOOL
non_mappable_sid(DOM_SID
*sid
)
691 sid_split_rid(&dom
, &rid
);
693 if (sid_equal(&dom
, &global_sid_Builtin
))
696 if (sid_equal(&dom
, &global_sid_Creator_Owner_Domain
))
699 if (sid_equal(&dom
, &global_sid_NT_Authority
))
706 return the binary string representation of a DOM_SID
709 char *sid_binstring(DOM_SID
*sid
)
712 int len
= sid_size(sid
);
714 if (!buf
) return NULL
;
715 sid_linearize(buf
, len
, sid
);
716 s
= binary_string(buf
, len
);