2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
7 Copyright (C) Stefan (metze) Metzmacher 2002
8 Copyright (C) Simo Sorce 2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
31 DOM_SID global_sid_World_Domain
; /* Everyone domain */
32 DOM_SID global_sid_World
; /* Everyone */
33 DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
34 DOM_SID global_sid_NT_Authority
; /* NT Authority */
35 DOM_SID global_sid_System
; /* System */
36 DOM_SID global_sid_NULL
; /* NULL sid */
37 DOM_SID global_sid_Authenticated_Users
; /* All authenticated rids */
38 DOM_SID global_sid_Network
; /* Network rids */
40 DOM_SID global_sid_Creator_Owner
; /* Creator Owner */
41 DOM_SID global_sid_Creator_Group
; /* Creator Group */
42 DOM_SID global_sid_Anonymous
; /* Anonymous login */
44 DOM_SID global_sid_Builtin
; /* Local well-known domain */
45 DOM_SID global_sid_Builtin_Administrators
; /* Builtin administrators */
46 DOM_SID global_sid_Builtin_Users
; /* Builtin users */
47 DOM_SID global_sid_Builtin_Guests
; /* Builtin guest users */
48 DOM_SID global_sid_Builtin_Power_Users
; /* Builtin power users */
49 DOM_SID global_sid_Builtin_Account_Operators
; /* Builtin account operators */
50 DOM_SID global_sid_Builtin_Server_Operators
; /* Builtin server operators */
51 DOM_SID global_sid_Builtin_Print_Operators
; /* Builtin print operators */
52 DOM_SID global_sid_Builtin_Backup_Operators
; /* Builtin backup operators */
53 DOM_SID global_sid_Builtin_Replicator
; /* Builtin replicator */
55 #define SECURITY_NULL_SID_AUTHORITY 0
56 #define SECURITY_WORLD_SID_AUTHORITY 1
57 #define SECURITY_LOCAL_SID_AUTHORITY 2
58 #define SECURITY_CREATOR_SID_AUTHORITY 3
59 #define SECURITY_NT_AUTHORITY 5
62 * An NT compatible anonymous token.
65 static DOM_SID anon_sid_array
[3];
67 NT_USER_TOKEN anonymous_token
= {
72 static DOM_SID system_sid_array
[4];
73 NT_USER_TOKEN system_token
= {
78 /****************************************************************************
79 Lookup string names for SID types.
80 ****************************************************************************/
83 enum SID_NAME_USE sid_type
;
86 {SID_NAME_USER
, "User"},
87 {SID_NAME_DOM_GRP
, "Domain Group"},
88 {SID_NAME_DOMAIN
, "Domain"},
89 {SID_NAME_ALIAS
, "Local Group"},
90 {SID_NAME_WKN_GRP
, "Well-known Group"},
91 {SID_NAME_DELETED
, "Deleted Account"},
92 {SID_NAME_INVALID
, "Invalid Account"},
93 {SID_NAME_UNKNOWN
, "UNKNOWN"},
94 {SID_NAME_COMPUTER
, "Computer"},
96 {(enum SID_NAME_USE
)0, NULL
}
99 const char *sid_type_lookup(uint32 sid_type
)
103 /* Look through list */
104 while(sid_name_type
[i
].sid_type
!= 0) {
105 if (sid_name_type
[i
].sid_type
== sid_type
)
106 return sid_name_type
[i
].string
;
111 return "SID *TYPE* is INVALID";
114 /****************************************************************************
115 Creates some useful well known sids
116 ****************************************************************************/
118 void generate_wellknown_sids(void)
120 static BOOL initialised
= False
;
125 /* SECURITY_NULL_SID_AUTHORITY */
126 string_to_sid(&global_sid_NULL
, "S-1-0-0");
128 /* SECURITY_WORLD_SID_AUTHORITY */
129 string_to_sid(&global_sid_World_Domain
, "S-1-1");
130 string_to_sid(&global_sid_World
, "S-1-1-0");
132 /* SECURITY_CREATOR_SID_AUTHORITY */
133 string_to_sid(&global_sid_Creator_Owner_Domain
, "S-1-3");
134 string_to_sid(&global_sid_Creator_Owner
, "S-1-3-0");
135 string_to_sid(&global_sid_Creator_Group
, "S-1-3-1");
137 /* SECURITY_NT_AUTHORITY */
138 string_to_sid(&global_sid_NT_Authority
, "S-1-5");
139 string_to_sid(&global_sid_Network
, "S-1-5-2");
140 string_to_sid(&global_sid_Anonymous
, "S-1-5-7");
141 string_to_sid(&global_sid_Authenticated_Users
, "S-1-5-11");
142 string_to_sid(&global_sid_System
, "S-1-5-18");
144 /* SECURITY_BUILTIN_DOMAIN_RID */
145 string_to_sid(&global_sid_Builtin
, "S-1-5-32");
146 string_to_sid(&global_sid_Builtin_Administrators
, "S-1-5-32-544");
147 string_to_sid(&global_sid_Builtin_Users
, "S-1-5-32-545");
148 string_to_sid(&global_sid_Builtin_Guests
, "S-1-5-32-546");
149 string_to_sid(&global_sid_Builtin_Power_Users
, "S-1-5-32-547");
150 string_to_sid(&global_sid_Builtin_Account_Operators
, "S-1-5-32-548");
151 string_to_sid(&global_sid_Builtin_Server_Operators
, "S-1-5-32-549");
152 string_to_sid(&global_sid_Builtin_Print_Operators
, "S-1-5-32-550");
153 string_to_sid(&global_sid_Builtin_Backup_Operators
, "S-1-5-32-551");
154 string_to_sid(&global_sid_Builtin_Replicator
, "S-1-5-32-552");
156 /* Create the anon token. */
157 sid_copy( &anonymous_token
.user_sids
[0], &global_sid_World
);
158 sid_copy( &anonymous_token
.user_sids
[1], &global_sid_Network
);
159 sid_copy( &anonymous_token
.user_sids
[2], &global_sid_Anonymous
);
161 /* Create the system token. */
162 sid_copy( &system_token
.user_sids
[0], &global_sid_System
);
167 /**************************************************************************
168 Create the SYSTEM token.
169 ***************************************************************************/
171 NT_USER_TOKEN
*get_system_token(void)
173 generate_wellknown_sids(); /* The token is initialised here */
174 return &system_token
;
177 /**************************************************************************
178 Splits a name of format \DOMAIN\name or name into its two components.
179 Sets the DOMAIN name to global_myname() if it has not been specified.
180 ***************************************************************************/
182 void split_domain_name(const char *fullname
, char *domain
, char *name
)
188 sep
= lp_winbind_separator();
190 *domain
= *name
= '\0';
192 if (fullname
[0] == sep
[0] || fullname
[0] == '\\')
195 pstrcpy(full_name
, fullname
);
196 p
= strchr_m(full_name
+1, '\\');
197 if (!p
) p
= strchr_m(full_name
+1, sep
[0]);
201 fstrcpy(domain
, full_name
);
204 if(!lp_domain_logons()) {
205 fstrcpy(domain
, global_myname());
206 fstrcpy(name
, full_name
);
208 fstrcpy(domain
, lp_workgroup());
209 fstrcpy(name
, full_name
);
211 fstrcpy(domain
, global_myname());
212 fstrcpy(name
, full_name
);
215 DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
216 fullname
, domain
, name
));
219 /****************************************************************************
220 Test if a SID is wellknown and resolvable.
221 ****************************************************************************/
223 BOOL
resolvable_wellknown_sid(DOM_SID
*sid
)
225 uint32 ia
= (sid
->id_auth
[5]) +
226 (sid
->id_auth
[4] << 8 ) +
227 (sid
->id_auth
[3] << 16) +
228 (sid
->id_auth
[2] << 24);
230 if (sid
->sid_rev_num
!= SEC_DESC_REVISION
|| sid
->num_auths
< 1)
233 return (ia
== SECURITY_WORLD_SID_AUTHORITY
||
234 ia
== SECURITY_CREATOR_SID_AUTHORITY
);
237 /*****************************************************************
238 Convert a SID to an ascii string.
239 *****************************************************************/
241 char *sid_to_string(fstring sidstr_out
, const DOM_SID
*sid
)
248 fstrcpy(sidstr_out
, "(NULL SID)");
253 * BIG NOTE: this function only does SIDS where the identauth is not >= 2^32
254 * in a range of 2^48.
256 ia
= (sid
->id_auth
[5]) +
257 (sid
->id_auth
[4] << 8 ) +
258 (sid
->id_auth
[3] << 16) +
259 (sid
->id_auth
[2] << 24);
261 slprintf(sidstr_out
, sizeof(fstring
) - 1, "S-%u-%lu", (unsigned int)sid
->sid_rev_num
, (unsigned long)ia
);
263 for (i
= 0; i
< sid
->num_auths
; i
++) {
264 slprintf(subauth
, sizeof(subauth
)-1, "-%lu", (unsigned long)sid
->sub_auths
[i
]);
265 fstrcat(sidstr_out
, subauth
);
271 /*****************************************************************
272 Useful function for debug lines.
273 *****************************************************************/
275 const char *sid_string_static(const DOM_SID
*sid
)
277 static fstring sid_str
;
278 sid_to_string(sid_str
, sid
);
282 /*****************************************************************
283 Convert a string to a SID. Returns True on success, False on fail.
284 *****************************************************************/
286 BOOL
string_to_sid(DOM_SID
*sidout
, const char *sidstr
)
291 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
294 if (StrnCaseCmp( sidstr
, "S-", 2)) {
295 DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr
));
299 memset((char *)sidout
, '\0', sizeof(DOM_SID
));
301 p
= q
= strdup(sidstr
+ 2);
303 DEBUG(0, ("string_to_sid: out of memory!\n"));
307 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
308 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
313 /* Get the revision number. */
314 sidout
->sid_rev_num
= (uint8
)strtoul(tok
, NULL
, 10);
316 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
317 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
322 /* identauth in decimal should be < 2^32 */
323 ia
= (uint32
)strtoul(tok
, NULL
, 10);
325 /* NOTE - the ia value is in big-endian format. */
326 sidout
->id_auth
[0] = 0;
327 sidout
->id_auth
[1] = 0;
328 sidout
->id_auth
[2] = (ia
& 0xff000000) >> 24;
329 sidout
->id_auth
[3] = (ia
& 0x00ff0000) >> 16;
330 sidout
->id_auth
[4] = (ia
& 0x0000ff00) >> 8;
331 sidout
->id_auth
[5] = (ia
& 0x000000ff);
333 sidout
->num_auths
= 0;
335 while(next_token(&p
, tok
, "-", sizeof(tok
)) &&
336 sidout
->num_auths
< MAXSUBAUTHS
) {
338 * NOTE - the subauths are in native machine-endian format. They
339 * are converted to little-endian when linearized onto the wire.
341 sid_append_rid(sidout
, (uint32
)strtoul(tok
, NULL
, 10));
348 /*****************************************************************
349 Add a rid to the end of a sid
350 *****************************************************************/
352 BOOL
sid_append_rid(DOM_SID
*sid
, uint32 rid
)
354 if (sid
->num_auths
< MAXSUBAUTHS
) {
355 sid
->sub_auths
[sid
->num_auths
++] = rid
;
361 /*****************************************************************
362 Removes the last rid from the end of a sid
363 *****************************************************************/
365 BOOL
sid_split_rid(DOM_SID
*sid
, uint32
*rid
)
367 if (sid
->num_auths
> 0) {
369 *rid
= sid
->sub_auths
[sid
->num_auths
];
375 /*****************************************************************
376 Return the last rid from the end of a sid
377 *****************************************************************/
379 BOOL
sid_peek_rid(const DOM_SID
*sid
, uint32
*rid
)
384 if (sid
->num_auths
> 0) {
385 *rid
= sid
->sub_auths
[sid
->num_auths
- 1];
391 /*****************************************************************
392 Return the last rid from the end of a sid
393 and check the sid against the exp_dom_sid
394 *****************************************************************/
396 BOOL
sid_peek_check_rid(const DOM_SID
*exp_dom_sid
, const DOM_SID
*sid
, uint32
*rid
)
398 if (!exp_dom_sid
|| !sid
|| !rid
)
401 if (sid
->num_auths
!= (exp_dom_sid
->num_auths
+1)) {
405 if (sid_compare_domain(exp_dom_sid
, sid
)!=0){
410 return sid_peek_rid(sid
, rid
);
413 /*****************************************************************
415 *****************************************************************/
417 void sid_copy(DOM_SID
*dst
, const DOM_SID
*src
)
423 dst
->sid_rev_num
= src
->sid_rev_num
;
424 dst
->num_auths
= src
->num_auths
;
426 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
428 for (i
= 0; i
< src
->num_auths
; i
++)
429 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
432 /*****************************************************************
433 Write a sid out into on-the-wire format.
434 *****************************************************************/
436 BOOL
sid_linearize(char *outbuf
, size_t len
, const DOM_SID
*sid
)
440 if (len
< sid_size(sid
))
443 SCVAL(outbuf
,0,sid
->sid_rev_num
);
444 SCVAL(outbuf
,1,sid
->num_auths
);
445 memcpy(&outbuf
[2], sid
->id_auth
, 6);
446 for(i
= 0; i
< sid
->num_auths
; i
++)
447 SIVAL(outbuf
, 8 + (i
*4), sid
->sub_auths
[i
]);
452 /*****************************************************************
453 Parse a on-the-wire SID to a DOM_SID.
454 *****************************************************************/
456 BOOL
sid_parse(const char *inbuf
, size_t len
, DOM_SID
*sid
)
464 sid
->sid_rev_num
= CVAL(inbuf
, 0);
465 sid
->num_auths
= CVAL(inbuf
, 1);
466 memcpy(sid
->id_auth
, inbuf
+2, 6);
467 if (len
< 8 + sid
->num_auths
*4)
469 for (i
=0;i
<sid
->num_auths
;i
++)
470 sid
->sub_auths
[i
] = IVAL(inbuf
, 8+i
*4);
474 /*****************************************************************
475 Compare the auth portion of two sids.
476 *****************************************************************/
478 static int sid_compare_auth(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
489 if (sid1
->sid_rev_num
!= sid2
->sid_rev_num
)
490 return sid1
->sid_rev_num
- sid2
->sid_rev_num
;
492 for (i
= 0; i
< 6; i
++)
493 if (sid1
->id_auth
[i
] != sid2
->id_auth
[i
])
494 return sid1
->id_auth
[i
] - sid2
->id_auth
[i
];
499 /*****************************************************************
501 *****************************************************************/
503 int sid_compare(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
514 /* Compare most likely different rids, first: i.e start at end */
515 if (sid1
->num_auths
!= sid2
->num_auths
)
516 return sid1
->num_auths
- sid2
->num_auths
;
518 for (i
= sid1
->num_auths
-1; i
>= 0; --i
)
519 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
520 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
522 return sid_compare_auth(sid1
, sid2
);
525 /*****************************************************************
526 See if 2 SIDs are in the same domain
527 this just compares the leading sub-auths
528 *****************************************************************/
530 int sid_compare_domain(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
534 n
= MIN(sid1
->num_auths
, sid2
->num_auths
);
536 for (i
= n
-1; i
>= 0; --i
)
537 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
538 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
540 return sid_compare_auth(sid1
, sid2
);
543 /*****************************************************************
545 *****************************************************************/
547 BOOL
sid_equal(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
549 return sid_compare(sid1
, sid2
) == 0;
552 /*****************************************************************
553 Check if the SID is the builtin SID (S-1-5-32).
554 *****************************************************************/
556 BOOL
sid_check_is_builtin(const DOM_SID
*sid
)
558 return sid_equal(sid
, &global_sid_Builtin
);
561 /*****************************************************************
562 Check if the SID is one of the builtin SIDs (S-1-5-32-a).
563 *****************************************************************/
565 BOOL
sid_check_is_in_builtin(const DOM_SID
*sid
)
570 sid_copy(&dom_sid
, sid
);
571 sid_split_rid(&dom_sid
, &rid
);
573 return sid_equal(&dom_sid
, &global_sid_Builtin
);
576 /*****************************************************************
577 Calculates size of a sid.
578 *****************************************************************/
580 size_t sid_size(const DOM_SID
*sid
)
585 return sid
->num_auths
* sizeof(uint32
) + 8;
588 /*****************************************************************
589 Returns true if SID is internal (and non-mappable).
590 *****************************************************************/
592 BOOL
non_mappable_sid(DOM_SID
*sid
)
598 sid_split_rid(&dom
, &rid
);
600 if (sid_equal(&dom
, &global_sid_Builtin
))
603 if (sid_equal(&dom
, &global_sid_NT_Authority
))
609 /*****************************************************************
610 Return the binary string representation of a DOM_SID.
612 *****************************************************************/
614 char *sid_binstring(const DOM_SID
*sid
)
617 int len
= sid_size(sid
);
621 sid_linearize(buf
, len
, sid
);
622 s
= binary_string(buf
, len
);
627 /*******************************************************************
628 Tallocs a duplicate SID.
629 ********************************************************************/
631 DOM_SID
*sid_dup_talloc(TALLOC_CTX
*ctx
, const DOM_SID
*src
)
638 if((dst
= talloc_zero(ctx
, sizeof(DOM_SID
))) != NULL
) {