2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
7 Copyright (C) Stefan (metze) Metzmacher 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 extern pstring global_myname
;
27 extern fstring global_myworkgroup
;
33 DOM_SID global_sid_Builtin
; /* Local well-known domain */
34 DOM_SID global_sid_World_Domain
; /* Everyone domain */
35 DOM_SID global_sid_World
; /* Everyone */
36 DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
37 DOM_SID global_sid_NT_Authority
; /* NT Authority */
38 DOM_SID global_sid_NULL
; /* NULL sid */
39 DOM_SID global_sid_Builtin_Guests
; /* Builtin guest users */
40 DOM_SID global_sid_Authenticated_Users
; /* All authenticated rids */
41 DOM_SID global_sid_Network
; /* Network rids */
43 static DOM_SID global_sid_Creator_Owner
; /* Creator Owner */
44 static DOM_SID global_sid_Creator_Group
; /* Creator Group */
45 static DOM_SID global_sid_Anonymous
; /* Anonymous login */
48 * An NT compatible anonymous token.
51 static DOM_SID anon_sid_array
[3];
53 NT_USER_TOKEN anonymous_token
= {
58 /****************************************************************************
59 Lookup string names for SID types.
60 ****************************************************************************/
63 enum SID_NAME_USE sid_type
;
66 {SID_NAME_USER
, "user"},
67 {SID_NAME_DOM_GRP
, "domain group"},
68 {SID_NAME_DOMAIN
, "domain"},
69 {SID_NAME_ALIAS
, "local group"},
70 {SID_NAME_WKN_GRP
, "well-known group"},
71 {SID_NAME_DELETED
, "deleted account"},
72 {SID_NAME_INVALID
, "invalid account"},
73 {SID_NAME_UNKNOWN
, "UNKNOWN"},
75 {SID_NAME_USE_NONE
, NULL
}
78 const char *sid_type_lookup(uint32 sid_type
)
82 /* Look through list */
83 while(sid_name_type
[i
].sid_type
!= 0) {
84 if (sid_name_type
[i
].sid_type
== sid_type
)
85 return sid_name_type
[i
].string
;
90 return "SID *TYPE* is INVALID";
95 /****************************************************************************
96 Creates some useful well known sids
97 ****************************************************************************/
99 void generate_wellknown_sids(void)
101 string_to_sid(&global_sid_Builtin
, "S-1-5-32");
102 string_to_sid(&global_sid_Builtin_Guests
, "S-1-5-32-546");
103 string_to_sid(&global_sid_World_Domain
, "S-1-1");
104 string_to_sid(&global_sid_World
, "S-1-1-0");
105 string_to_sid(&global_sid_Creator_Owner_Domain
, "S-1-3");
106 string_to_sid(&global_sid_Creator_Owner
, "S-1-3-0");
107 string_to_sid(&global_sid_Creator_Group
, "S-1-3-1");
108 string_to_sid(&global_sid_NT_Authority
, "S-1-5");
109 string_to_sid(&global_sid_NULL
, "S-1-0-0");
110 string_to_sid(&global_sid_Authenticated_Users
, "S-1-5-11");
111 string_to_sid(&global_sid_Network
, "S-1-5-2");
112 string_to_sid(&global_sid_Anonymous
, "S-1-5-7");
114 /* Create the anon token. */
115 sid_copy( &anonymous_token
.user_sids
[0], &global_sid_World
);
116 sid_copy( &anonymous_token
.user_sids
[1], &global_sid_Network
);
117 sid_copy( &anonymous_token
.user_sids
[2], &global_sid_Anonymous
);
120 /**************************************************************************
121 Splits a name of format \DOMAIN\name or name into its two components.
122 Sets the DOMAIN name to global_myname if it has not been specified.
123 ***************************************************************************/
125 void split_domain_name(const char *fullname
, char *domain
, char *name
)
130 sep
= lp_winbind_separator();
132 *domain
= *name
= '\0';
134 if (fullname
[0] == sep
[0] || fullname
[0] == '\\')
137 pstrcpy(full_name
, fullname
);
138 p
= strchr_m(full_name
+1, '\\');
139 if (!p
) p
= strchr_m(full_name
+1, sep
[0]);
143 fstrcpy(domain
, full_name
);
146 fstrcpy(domain
, global_myname
);
147 fstrcpy(name
, full_name
);
150 DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
151 fullname
, domain
, name
));
154 /*****************************************************************
155 Convert a SID to an ascii string.
156 *****************************************************************/
158 char *sid_to_string(fstring sidstr_out
, const DOM_SID
*sid
)
165 fstrcpy(sidstr_out
, "(NULL SID)");
169 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
170 ia
= (sid
->id_auth
[5]) +
171 (sid
->id_auth
[4] << 8 ) +
172 (sid
->id_auth
[3] << 16) +
173 (sid
->id_auth
[2] << 24);
175 slprintf(sidstr_out
, sizeof(fstring
) - 1, "S-%u-%lu", (unsigned int)sid
->sid_rev_num
, (unsigned long)ia
);
177 for (i
= 0; i
< sid
->num_auths
; i
++) {
178 slprintf(subauth
, sizeof(subauth
)-1, "-%lu", (unsigned long)sid
->sub_auths
[i
]);
179 fstrcat(sidstr_out
, subauth
);
186 useful function for debug lines
188 const char *sid_string_static(const DOM_SID
*sid
)
190 static fstring sid_str
;
191 sid_to_string(sid_str
, sid
);
195 /*****************************************************************
196 Convert a string to a SID. Returns True on success, False on fail.
197 *****************************************************************/
199 BOOL
string_to_sid(DOM_SID
*sidout
, const char *sidstr
)
203 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
206 if (StrnCaseCmp( sidstr
, "S-", 2)) {
207 DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr
));
211 memset((char *)sidout
, '\0', sizeof(DOM_SID
));
213 q
= p
= strdup(sidstr
+ 2);
215 DEBUG(0, ("string_to_sid: out of memory!\n"));
219 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
220 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
225 /* Get the revision number. */
226 sidout
->sid_rev_num
= (uint8
)strtoul(tok
, NULL
, 10);
228 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
229 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
234 /* identauth in decimal should be < 2^32 */
235 ia
= (uint32
)strtoul(tok
, NULL
, 10);
237 /* NOTE - the ia value is in big-endian format. */
238 sidout
->id_auth
[0] = 0;
239 sidout
->id_auth
[1] = 0;
240 sidout
->id_auth
[2] = (ia
& 0xff000000) >> 24;
241 sidout
->id_auth
[3] = (ia
& 0x00ff0000) >> 16;
242 sidout
->id_auth
[4] = (ia
& 0x0000ff00) >> 8;
243 sidout
->id_auth
[5] = (ia
& 0x000000ff);
245 sidout
->num_auths
= 0;
247 while(next_token(&p
, tok
, "-", sizeof(tok
)) &&
248 sidout
->num_auths
< MAXSUBAUTHS
) {
250 * NOTE - the subauths are in native machine-endian format. They
251 * are converted to little-endian when linearized onto the wire.
253 sid_append_rid(sidout
, (uint32
)strtoul(tok
, NULL
, 10));
260 /*****************************************************************
261 Add a rid to the end of a sid
262 *****************************************************************/
264 BOOL
sid_append_rid(DOM_SID
*sid
, uint32 rid
)
266 if (sid
->num_auths
< MAXSUBAUTHS
) {
267 sid
->sub_auths
[sid
->num_auths
++] = rid
;
273 /*****************************************************************
274 Removes the last rid from the end of a sid
275 *****************************************************************/
277 BOOL
sid_split_rid(DOM_SID
*sid
, uint32
*rid
)
279 if (sid
->num_auths
> 0) {
281 *rid
= sid
->sub_auths
[sid
->num_auths
];
287 /*****************************************************************
288 Return the last rid from the end of a sid
289 *****************************************************************/
291 BOOL
sid_peek_rid(const DOM_SID
*sid
, uint32
*rid
)
296 if (sid
->num_auths
> 0) {
297 *rid
= sid
->sub_auths
[sid
->num_auths
- 1];
303 /*****************************************************************
304 Return the last rid from the end of a sid
305 and check the sid against the exp_dom_sid
306 *****************************************************************/
308 BOOL
sid_peek_check_rid(const DOM_SID
*exp_dom_sid
, const DOM_SID
*sid
, uint32
*rid
)
310 if (!exp_dom_sid
|| !sid
|| !rid
)
314 if (sid_compare_domain(exp_dom_sid
, sid
)!=0){
319 return sid_peek_rid(sid
, rid
);
322 /*****************************************************************
324 *****************************************************************/
326 void sid_copy(DOM_SID
*dst
, const DOM_SID
*src
)
332 dst
->sid_rev_num
= src
->sid_rev_num
;
333 dst
->num_auths
= src
->num_auths
;
335 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
337 for (i
= 0; i
< src
->num_auths
; i
++)
338 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
342 /*****************************************************************
343 Write a sid out into on-the-wire format.
344 *****************************************************************/
345 BOOL
sid_linearize(char *outbuf
, size_t len
, DOM_SID
*sid
)
349 if (len
< sid_size(sid
))
352 SCVAL(outbuf
,0,sid
->sid_rev_num
);
353 SCVAL(outbuf
,1,sid
->num_auths
);
354 memcpy(&outbuf
[2], sid
->id_auth
, 6);
355 for(i
= 0; i
< sid
->num_auths
; i
++)
356 SIVAL(outbuf
, 8 + (i
*4), sid
->sub_auths
[i
]);
361 /*****************************************************************
362 parse a on-the-wire SID to a DOM_SID
363 *****************************************************************/
364 BOOL
sid_parse(char *inbuf
, size_t len
, DOM_SID
*sid
)
367 if (len
< 8) return False
;
368 sid
->sid_rev_num
= CVAL(inbuf
, 0);
369 sid
->num_auths
= CVAL(inbuf
, 1);
370 memcpy(sid
->id_auth
, inbuf
+2, 6);
371 if (len
< 8 + sid
->num_auths
*4) return False
;
372 for (i
=0;i
<sid
->num_auths
;i
++) {
373 sid
->sub_auths
[i
] = IVAL(inbuf
, 8+i
*4);
379 /*****************************************************************
380 Compare the auth portion of two sids.
381 *****************************************************************/
382 static int sid_compare_auth(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
386 if (sid1
== sid2
) return 0;
387 if (!sid1
) return -1;
390 if (sid1
->sid_rev_num
!= sid2
->sid_rev_num
)
391 return sid1
->sid_rev_num
- sid2
->sid_rev_num
;
393 for (i
= 0; i
< 6; i
++)
394 if (sid1
->id_auth
[i
] != sid2
->id_auth
[i
])
395 return sid1
->id_auth
[i
] - sid2
->id_auth
[i
];
400 /*****************************************************************
402 *****************************************************************/
403 int sid_compare(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
407 if (sid1
== sid2
) return 0;
408 if (!sid1
) return -1;
411 /* compare most likely different rids, first: i.e start at end */
412 if (sid1
->num_auths
!= sid2
->num_auths
)
413 return sid1
->num_auths
- sid2
->num_auths
;
415 for (i
= sid1
->num_auths
-1; i
>= 0; --i
)
416 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
417 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
419 return sid_compare_auth(sid1
, sid2
);
422 /*****************************************************************
423 see if 2 SIDs are in the same domain
424 this just compares the leading sub-auths
425 *****************************************************************/
426 int sid_compare_domain(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
430 n
= MIN(sid1
->num_auths
, sid2
->num_auths
);
432 for (i
= n
-1; i
>= 0; --i
)
433 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
434 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
436 return sid_compare_auth(sid1
, sid2
);
439 /*****************************************************************
441 *****************************************************************/
442 BOOL
sid_equal(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
444 return sid_compare(sid1
, sid2
) == 0;
449 /*****************************************************************
450 Check if the SID is the builtin SID (S-1-5-32).
451 *****************************************************************/
452 BOOL
sid_check_is_builtin(const DOM_SID
*sid
)
454 return sid_equal(sid
, &global_sid_Builtin
);
458 /*****************************************************************
459 Check if the SID is our domain SID (S-1-5-21-x-y-z).
460 *****************************************************************/
461 BOOL
sid_check_is_in_builtin(const DOM_SID
*sid
)
466 sid_copy(&dom_sid
, sid
);
467 sid_split_rid(&dom_sid
, &rid
);
469 return sid_equal(&dom_sid
, &global_sid_Builtin
);
473 /*****************************************************************
474 Calculates size of a sid.
475 *****************************************************************/
477 size_t sid_size(DOM_SID
*sid
)
482 return sid
->num_auths
* sizeof(uint32
) + 8;
485 /*****************************************************************
486 Returns true if SID is internal (and non-mappable).
487 *****************************************************************/
489 BOOL
non_mappable_sid(DOM_SID
*sid
)
495 sid_split_rid(&dom
, &rid
);
497 if (sid_equal(&dom
, &global_sid_Builtin
))
500 if (sid_equal(&dom
, &global_sid_Creator_Owner_Domain
))
503 if (sid_equal(&dom
, &global_sid_NT_Authority
))
510 return the binary string representation of a DOM_SID
513 char *sid_binstring(DOM_SID
*sid
)
516 int len
= sid_size(sid
);
518 if (!buf
) return NULL
;
519 sid_linearize(buf
, len
, sid
);
520 s
= binary_string(buf
, len
);