2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
7 Copyright (C) Stefan (metze) Metzmacher 2002
8 Copyright (C) Simo Sorce 2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
31 DOM_SID global_sid_World_Domain
; /* Everyone domain */
32 DOM_SID global_sid_World
; /* Everyone */
33 DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
34 DOM_SID global_sid_NT_Authority
; /* NT Authority */
35 DOM_SID global_sid_System
; /* System */
36 DOM_SID global_sid_NULL
; /* NULL sid */
37 DOM_SID global_sid_Authenticated_Users
; /* All authenticated rids */
38 DOM_SID global_sid_Network
; /* Network rids */
40 DOM_SID global_sid_Creator_Owner
; /* Creator Owner */
41 DOM_SID global_sid_Creator_Group
; /* Creator Group */
42 DOM_SID global_sid_Anonymous
; /* Anonymous login */
44 DOM_SID global_sid_Builtin
; /* Local well-known domain */
45 DOM_SID global_sid_Builtin_Administrators
; /* Builtin administrators */
46 DOM_SID global_sid_Builtin_Users
; /* Builtin users */
47 DOM_SID global_sid_Builtin_Guests
; /* Builtin guest users */
48 DOM_SID global_sid_Builtin_Power_Users
; /* Builtin power users */
49 DOM_SID global_sid_Builtin_Account_Operators
; /* Builtin account operators */
50 DOM_SID global_sid_Builtin_Server_Operators
; /* Builtin server operators */
51 DOM_SID global_sid_Builtin_Print_Operators
; /* Builtin print operators */
52 DOM_SID global_sid_Builtin_Backup_Operators
; /* Builtin backup operators */
53 DOM_SID global_sid_Builtin_Replicator
; /* Builtin replicator */
55 #define SECURITY_NULL_SID_AUTHORITY 0
56 #define SECURITY_WORLD_SID_AUTHORITY 1
57 #define SECURITY_LOCAL_SID_AUTHORITY 2
58 #define SECURITY_CREATOR_SID_AUTHORITY 3
59 #define SECURITY_NT_AUTHORITY 5
62 * An NT compatible anonymous token.
65 static DOM_SID anon_sid_array
[3];
67 NT_USER_TOKEN anonymous_token
= {
72 static DOM_SID system_sid_array
[4];
73 NT_USER_TOKEN system_token
= {
78 /****************************************************************************
79 Lookup string names for SID types.
80 ****************************************************************************/
83 enum SID_NAME_USE sid_type
;
86 {SID_NAME_USER
, "User"},
87 {SID_NAME_DOM_GRP
, "Domain Group"},
88 {SID_NAME_DOMAIN
, "Domain"},
89 {SID_NAME_ALIAS
, "Local Group"},
90 {SID_NAME_WKN_GRP
, "Well-known Group"},
91 {SID_NAME_DELETED
, "Deleted Account"},
92 {SID_NAME_INVALID
, "Invalid Account"},
93 {SID_NAME_UNKNOWN
, "UNKNOWN"},
94 {SID_NAME_COMPUTER
, "Computer"},
96 {(enum SID_NAME_USE
)0, NULL
}
99 const char *sid_type_lookup(uint32 sid_type
)
103 /* Look through list */
104 while(sid_name_type
[i
].sid_type
!= 0) {
105 if (sid_name_type
[i
].sid_type
== sid_type
)
106 return sid_name_type
[i
].string
;
111 return "SID *TYPE* is INVALID";
114 /****************************************************************************
115 Creates some useful well known sids
116 ****************************************************************************/
118 void generate_wellknown_sids(void)
120 static BOOL initialised
= False
;
125 /* SECURITY_NULL_SID_AUTHORITY */
126 string_to_sid(&global_sid_NULL
, "S-1-0-0");
128 /* SECURITY_WORLD_SID_AUTHORITY */
129 string_to_sid(&global_sid_World_Domain
, "S-1-1");
130 string_to_sid(&global_sid_World
, "S-1-1-0");
132 /* SECURITY_CREATOR_SID_AUTHORITY */
133 string_to_sid(&global_sid_Creator_Owner_Domain
, "S-1-3");
134 string_to_sid(&global_sid_Creator_Owner
, "S-1-3-0");
135 string_to_sid(&global_sid_Creator_Group
, "S-1-3-1");
137 /* SECURITY_NT_AUTHORITY */
138 string_to_sid(&global_sid_NT_Authority
, "S-1-5");
139 string_to_sid(&global_sid_Network
, "S-1-5-2");
140 string_to_sid(&global_sid_Anonymous
, "S-1-5-7");
141 string_to_sid(&global_sid_Authenticated_Users
, "S-1-5-11");
142 string_to_sid(&global_sid_System
, "S-1-5-18");
144 /* SECURITY_BUILTIN_DOMAIN_RID */
145 string_to_sid(&global_sid_Builtin
, "S-1-5-32");
146 string_to_sid(&global_sid_Builtin_Administrators
, "S-1-5-32-544");
147 string_to_sid(&global_sid_Builtin_Users
, "S-1-5-32-545");
148 string_to_sid(&global_sid_Builtin_Guests
, "S-1-5-32-546");
149 string_to_sid(&global_sid_Builtin_Power_Users
, "S-1-5-32-547");
150 string_to_sid(&global_sid_Builtin_Account_Operators
, "S-1-5-32-548");
151 string_to_sid(&global_sid_Builtin_Server_Operators
, "S-1-5-32-549");
152 string_to_sid(&global_sid_Builtin_Print_Operators
, "S-1-5-32-550");
153 string_to_sid(&global_sid_Builtin_Backup_Operators
, "S-1-5-32-551");
154 string_to_sid(&global_sid_Builtin_Replicator
, "S-1-5-32-552");
156 /* Create the anon token. */
157 sid_copy( &anonymous_token
.user_sids
[0], &global_sid_World
);
158 sid_copy( &anonymous_token
.user_sids
[1], &global_sid_Network
);
159 sid_copy( &anonymous_token
.user_sids
[2], &global_sid_Anonymous
);
161 /* Create the system token. */
162 sid_copy( &system_token
.user_sids
[0], &global_sid_System
);
167 /**************************************************************************
168 Create the SYSTEM token.
169 ***************************************************************************/
171 NT_USER_TOKEN
*get_system_token(void)
173 generate_wellknown_sids(); /* The token is initialised here */
174 return &system_token
;
177 /******************************************************************
178 get the default domain/netbios name to be used when dealing
179 with our passdb list of accounts
180 ******************************************************************/
182 const char *get_global_sam_name(void)
184 if ((lp_server_role() == ROLE_DOMAIN_PDC
) || (lp_server_role() == ROLE_DOMAIN_BDC
)) {
185 return lp_workgroup();
187 return global_myname();
190 /**************************************************************************
191 Splits a name of format \DOMAIN\name or name into its two components.
192 Sets the DOMAIN name to global_myname() if it has not been specified.
193 ***************************************************************************/
195 void split_domain_name(const char *fullname
, char *domain
, char *name
)
201 sep
= lp_winbind_separator();
203 *domain
= *name
= '\0';
205 if (fullname
[0] == sep
[0] || fullname
[0] == '\\')
208 pstrcpy(full_name
, fullname
);
209 p
= strchr_m(full_name
+1, '\\');
210 if (!p
) p
= strchr_m(full_name
+1, sep
[0]);
214 fstrcpy(domain
, full_name
);
217 fstrcpy(domain
, get_global_sam_name());
218 fstrcpy(name
, full_name
);
221 DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
222 fullname
, domain
, name
));
225 /****************************************************************************
226 Test if a SID is wellknown and resolvable.
227 ****************************************************************************/
229 BOOL
resolvable_wellknown_sid(DOM_SID
*sid
)
231 uint32 ia
= (sid
->id_auth
[5]) +
232 (sid
->id_auth
[4] << 8 ) +
233 (sid
->id_auth
[3] << 16) +
234 (sid
->id_auth
[2] << 24);
236 if (sid
->sid_rev_num
!= SEC_DESC_REVISION
|| sid
->num_auths
< 1)
239 return (ia
== SECURITY_WORLD_SID_AUTHORITY
||
240 ia
== SECURITY_CREATOR_SID_AUTHORITY
);
243 /*****************************************************************
244 Convert a SID to an ascii string.
245 *****************************************************************/
247 char *sid_to_string(fstring sidstr_out
, const DOM_SID
*sid
)
254 fstrcpy(sidstr_out
, "(NULL SID)");
259 * BIG NOTE: this function only does SIDS where the identauth is not >= 2^32
260 * in a range of 2^48.
262 ia
= (sid
->id_auth
[5]) +
263 (sid
->id_auth
[4] << 8 ) +
264 (sid
->id_auth
[3] << 16) +
265 (sid
->id_auth
[2] << 24);
267 slprintf(sidstr_out
, sizeof(fstring
) - 1, "S-%u-%lu", (unsigned int)sid
->sid_rev_num
, (unsigned long)ia
);
269 for (i
= 0; i
< sid
->num_auths
; i
++) {
270 slprintf(subauth
, sizeof(subauth
)-1, "-%lu", (unsigned long)sid
->sub_auths
[i
]);
271 fstrcat(sidstr_out
, subauth
);
277 /*****************************************************************
278 Useful function for debug lines.
279 *****************************************************************/
281 const char *sid_string_static(const DOM_SID
*sid
)
283 static fstring sid_str
;
284 sid_to_string(sid_str
, sid
);
288 /*****************************************************************
289 Convert a string to a SID. Returns True on success, False on fail.
290 *****************************************************************/
292 BOOL
string_to_sid(DOM_SID
*sidout
, const char *sidstr
)
297 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
300 if (StrnCaseCmp( sidstr
, "S-", 2)) {
301 DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr
));
305 memset((char *)sidout
, '\0', sizeof(DOM_SID
));
307 p
= q
= SMB_STRDUP(sidstr
+ 2);
309 DEBUG(0, ("string_to_sid: out of memory!\n"));
313 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
314 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
319 /* Get the revision number. */
320 sidout
->sid_rev_num
= (uint8
)strtoul(tok
, NULL
, 10);
322 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
323 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
328 /* identauth in decimal should be < 2^32 */
329 ia
= (uint32
)strtoul(tok
, NULL
, 10);
331 /* NOTE - the ia value is in big-endian format. */
332 sidout
->id_auth
[0] = 0;
333 sidout
->id_auth
[1] = 0;
334 sidout
->id_auth
[2] = (ia
& 0xff000000) >> 24;
335 sidout
->id_auth
[3] = (ia
& 0x00ff0000) >> 16;
336 sidout
->id_auth
[4] = (ia
& 0x0000ff00) >> 8;
337 sidout
->id_auth
[5] = (ia
& 0x000000ff);
339 sidout
->num_auths
= 0;
341 while(next_token(&p
, tok
, "-", sizeof(tok
)) &&
342 sidout
->num_auths
< MAXSUBAUTHS
) {
344 * NOTE - the subauths are in native machine-endian format. They
345 * are converted to little-endian when linearized onto the wire.
347 sid_append_rid(sidout
, (uint32
)strtoul(tok
, NULL
, 10));
354 /*****************************************************************
355 Add a rid to the end of a sid
356 *****************************************************************/
358 BOOL
sid_append_rid(DOM_SID
*sid
, uint32 rid
)
360 if (sid
->num_auths
< MAXSUBAUTHS
) {
361 sid
->sub_auths
[sid
->num_auths
++] = rid
;
367 /*****************************************************************
368 Removes the last rid from the end of a sid
369 *****************************************************************/
371 BOOL
sid_split_rid(DOM_SID
*sid
, uint32
*rid
)
373 if (sid
->num_auths
> 0) {
375 *rid
= sid
->sub_auths
[sid
->num_auths
];
381 /*****************************************************************
382 Return the last rid from the end of a sid
383 *****************************************************************/
385 BOOL
sid_peek_rid(const DOM_SID
*sid
, uint32
*rid
)
390 if (sid
->num_auths
> 0) {
391 *rid
= sid
->sub_auths
[sid
->num_auths
- 1];
397 /*****************************************************************
398 Return the last rid from the end of a sid
399 and check the sid against the exp_dom_sid
400 *****************************************************************/
402 BOOL
sid_peek_check_rid(const DOM_SID
*exp_dom_sid
, const DOM_SID
*sid
, uint32
*rid
)
404 if (!exp_dom_sid
|| !sid
|| !rid
)
407 if (sid
->num_auths
!= (exp_dom_sid
->num_auths
+1)) {
411 if (sid_compare_domain(exp_dom_sid
, sid
)!=0){
416 return sid_peek_rid(sid
, rid
);
419 /*****************************************************************
421 *****************************************************************/
423 void sid_copy(DOM_SID
*dst
, const DOM_SID
*src
)
429 dst
->sid_rev_num
= src
->sid_rev_num
;
430 dst
->num_auths
= src
->num_auths
;
432 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
434 for (i
= 0; i
< src
->num_auths
; i
++)
435 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
438 /*****************************************************************
439 Write a sid out into on-the-wire format.
440 *****************************************************************/
442 BOOL
sid_linearize(char *outbuf
, size_t len
, const DOM_SID
*sid
)
446 if (len
< sid_size(sid
))
449 SCVAL(outbuf
,0,sid
->sid_rev_num
);
450 SCVAL(outbuf
,1,sid
->num_auths
);
451 memcpy(&outbuf
[2], sid
->id_auth
, 6);
452 for(i
= 0; i
< sid
->num_auths
; i
++)
453 SIVAL(outbuf
, 8 + (i
*4), sid
->sub_auths
[i
]);
458 /*****************************************************************
459 Parse a on-the-wire SID to a DOM_SID.
460 *****************************************************************/
462 BOOL
sid_parse(const char *inbuf
, size_t len
, DOM_SID
*sid
)
470 sid
->sid_rev_num
= CVAL(inbuf
, 0);
471 sid
->num_auths
= CVAL(inbuf
, 1);
472 memcpy(sid
->id_auth
, inbuf
+2, 6);
473 if (len
< 8 + sid
->num_auths
*4)
475 for (i
=0;i
<sid
->num_auths
;i
++)
476 sid
->sub_auths
[i
] = IVAL(inbuf
, 8+i
*4);
480 /*****************************************************************
481 Compare the auth portion of two sids.
482 *****************************************************************/
484 static int sid_compare_auth(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
495 if (sid1
->sid_rev_num
!= sid2
->sid_rev_num
)
496 return sid1
->sid_rev_num
- sid2
->sid_rev_num
;
498 for (i
= 0; i
< 6; i
++)
499 if (sid1
->id_auth
[i
] != sid2
->id_auth
[i
])
500 return sid1
->id_auth
[i
] - sid2
->id_auth
[i
];
505 /*****************************************************************
507 *****************************************************************/
509 int sid_compare(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
520 /* Compare most likely different rids, first: i.e start at end */
521 if (sid1
->num_auths
!= sid2
->num_auths
)
522 return sid1
->num_auths
- sid2
->num_auths
;
524 for (i
= sid1
->num_auths
-1; i
>= 0; --i
)
525 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
526 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
528 return sid_compare_auth(sid1
, sid2
);
531 /*****************************************************************
532 See if 2 SIDs are in the same domain
533 this just compares the leading sub-auths
534 *****************************************************************/
536 int sid_compare_domain(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
540 n
= MIN(sid1
->num_auths
, sid2
->num_auths
);
542 for (i
= n
-1; i
>= 0; --i
)
543 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
544 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
546 return sid_compare_auth(sid1
, sid2
);
549 /*****************************************************************
551 *****************************************************************/
553 BOOL
sid_equal(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
555 return sid_compare(sid1
, sid2
) == 0;
558 /*****************************************************************
559 Check if the SID is the builtin SID (S-1-5-32).
560 *****************************************************************/
562 BOOL
sid_check_is_builtin(const DOM_SID
*sid
)
564 return sid_equal(sid
, &global_sid_Builtin
);
567 /*****************************************************************
568 Check if the SID is one of the builtin SIDs (S-1-5-32-a).
569 *****************************************************************/
571 BOOL
sid_check_is_in_builtin(const DOM_SID
*sid
)
576 sid_copy(&dom_sid
, sid
);
577 sid_split_rid(&dom_sid
, &rid
);
579 return sid_equal(&dom_sid
, &global_sid_Builtin
);
582 /*****************************************************************
583 Calculates size of a sid.
584 *****************************************************************/
586 size_t sid_size(const DOM_SID
*sid
)
591 return sid
->num_auths
* sizeof(uint32
) + 8;
594 /*****************************************************************
595 Returns true if SID is internal (and non-mappable).
596 *****************************************************************/
598 BOOL
non_mappable_sid(DOM_SID
*sid
)
604 sid_split_rid(&dom
, &rid
);
606 if (sid_equal(&dom
, &global_sid_Builtin
))
609 if (sid_equal(&dom
, &global_sid_NT_Authority
))
615 /*****************************************************************
616 Return the binary string representation of a DOM_SID.
618 *****************************************************************/
620 char *sid_binstring(const DOM_SID
*sid
)
623 int len
= sid_size(sid
);
624 buf
= SMB_MALLOC(len
);
627 sid_linearize(buf
, len
, sid
);
628 s
= binary_string(buf
, len
);
633 /*******************************************************************
634 Tallocs a duplicate SID.
635 ********************************************************************/
637 DOM_SID
*sid_dup_talloc(TALLOC_CTX
*ctx
, const DOM_SID
*src
)
644 if((dst
= TALLOC_ZERO_P(ctx
, DOM_SID
)) != NULL
) {