source3/lib/util_sid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4    Copyright (C) Andrew Tridgell                1992-1998
   5    Copyright (C) Luke Kenneth Caseson Leighton  1998-1999
   6    Copyright (C) Jeremy Allison                 1999
   7    Copyright (C) Stefan (metze) Metzmacher      2002
   8    Copyright (C) Simo Sorce                     2002
   9    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "../librpc/gen_ndr/ndr_security.h"
  27 #include "../librpc/gen_ndr/netlogon.h"
  28 #include "../libcli/security/security.h"
  29
  30
  31 /*****************************************************************
  32  Convert a SID to an ascii string.
  33 *****************************************************************/
  34
  35 char *sid_to_fstring(fstring sidstr_out, const struct dom_sid *sid)
  36 {
  37         struct dom_sid_buf buf;
  38         fstrcpy(sidstr_out, dom_sid_str_buf(sid, &buf));
  39         return sidstr_out;
  40 }
  41
  42 /*****************************************************************
  43  Write a sid out into on-the-wire format.
  44 *****************************************************************/
  45
  46 bool sid_linearize(uint8_t *outbuf, size_t len, const struct dom_sid *sid)
  47 {
  48         int8_t i;
  49
  50         if (len < ndr_size_dom_sid(sid, 0))
  51                 return False;
  52
  53         SCVAL(outbuf,0,sid->sid_rev_num);
  54         SCVAL(outbuf,1,sid->num_auths);
  55         memcpy(&outbuf[2], sid->id_auth, 6);
  56         for(i = 0; i < sid->num_auths; i++)
  57                 SIVAL(outbuf, 8 + (i*4), sid->sub_auths[i]);
  58
  59         return True;
  60 }
  61
  62 /*****************************************************************
  63  Returns true if SID is internal (and non-mappable).
  64 *****************************************************************/
  65
  66 bool non_mappable_sid(struct dom_sid *sid)
  67 {
  68         struct dom_sid dom;
  69
  70         sid_copy(&dom, sid);
  71         sid_split_rid(&dom, NULL);
  72
  73         if (dom_sid_equal(&dom, &global_sid_Builtin))
  74                 return True;
  75
  76         if (dom_sid_equal(&dom, &global_sid_NT_Authority))
  77                 return True;
  78
  79         return False;
  80 }
  81
  82 /*****************************************************************
  83  Return the binary string representation of a struct dom_sid.
  84  Caller must free.
  85 *****************************************************************/
  86
  87 char *sid_binstring_hex_talloc(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
  88 {
  89         int len = ndr_size_dom_sid(sid, 0);
  90         uint8_t buf[len];
  91         sid_linearize(buf, len, sid);
  92         return hex_encode_talloc(mem_ctx, buf, len);
  93 }
  94
  95 NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
  96                               const struct netr_SamInfo3 *info3,
  97                               struct dom_sid **user_sids,
  98                               uint32_t *num_user_sids,
  99                               bool include_user_group_rid)
 100 {
 101         NTSTATUS status;
 102         struct dom_sid sid;
 103         struct dom_sid *sid_array = NULL;
 104         uint32_t num_sids = 0;
 105         uint32_t i;
 106
 107         if (include_user_group_rid) {
 108                 if (!sid_compose(&sid, info3->base.domain_sid, info3->base.rid)) {
 109                         DEBUG(3, ("could not compose user SID from rid 0x%x\n",
 110                                   info3->base.rid));
 111                         return NT_STATUS_INVALID_PARAMETER;
 112                 }
 113                 status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
 114                 if (!NT_STATUS_IS_OK(status)) {
 115                         DEBUG(3, ("could not append user SID from rid 0x%x\n",
 116                                   info3->base.rid));
 117                         return status;
 118                 }
 119         }
 120
 121         if (!sid_compose(&sid, info3->base.domain_sid, info3->base.primary_gid)) {
 122                 DEBUG(3, ("could not compose group SID from rid 0x%x\n",
 123                           info3->base.primary_gid));
 124                 return NT_STATUS_INVALID_PARAMETER;
 125         }
 126         status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
 127         if (!NT_STATUS_IS_OK(status)) {
 128                 DEBUG(3, ("could not append group SID from rid 0x%x\n",
 129                           info3->base.rid));
 130                 return status;
 131         }
 132
 133         for (i = 0; i < info3->base.groups.count; i++) {
 134                 /* Don't add the primary group sid twice. */
 135                 if (info3->base.primary_gid == info3->base.groups.rids[i].rid) {
 136                         continue;
 137                 }
 138                 if (!sid_compose(&sid, info3->base.domain_sid,
 139                                  info3->base.groups.rids[i].rid)) {
 140                         DEBUG(3, ("could not compose SID from additional group "
 141                                   "rid 0x%x\n", info3->base.groups.rids[i].rid));
 142                         return NT_STATUS_INVALID_PARAMETER;
 143                 }
 144                 status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
 145                 if (!NT_STATUS_IS_OK(status)) {
 146                         DEBUG(3, ("could not append SID from additional group "
 147                                   "rid 0x%x\n", info3->base.groups.rids[i].rid));
 148                         return status;
 149                 }
 150         }
 151
 152         /* Copy 'other' sids.  We need to do sid filtering here to
 153            prevent possible elevation of privileges.  See:
 154
 155            http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
 156          */
 157
 158         for (i = 0; i < info3->sidcount; i++) {
 159
 160                 if (sid_check_is_in_asserted_identity(info3->sids[i].sid)) {
 161                         continue;
 162                 }
 163
 164                 status = add_sid_to_array(mem_ctx, info3->sids[i].sid,
 165                                       &sid_array, &num_sids);
 166                 if (!NT_STATUS_IS_OK(status)) {
 167                         struct dom_sid_buf buf;
 168                         DEBUG(3, ("could not add SID to array: %s\n",
 169                                   dom_sid_str_buf(info3->sids[i].sid, &buf)));
 170                         return status;
 171                 }
 172         }
 173
 174         *user_sids = sid_array;
 175         *num_user_sids = num_sids;
 176
 177         return NT_STATUS_OK;
 178 }