2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
7 Copyright (C) Stefan (metze) Metzmacher 2002
8 Copyright (C) Simo Sorce 2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
31 DOM_SID global_sid_World_Domain
; /* Everyone domain */
32 DOM_SID global_sid_World
; /* Everyone */
33 DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
34 DOM_SID global_sid_NT_Authority
; /* NT Authority */
35 DOM_SID global_sid_System
; /* System */
36 DOM_SID global_sid_NULL
; /* NULL sid */
37 DOM_SID global_sid_Authenticated_Users
; /* All authenticated rids */
38 DOM_SID global_sid_Network
; /* Network rids */
40 DOM_SID global_sid_Creator_Owner
; /* Creator Owner */
41 DOM_SID global_sid_Creator_Group
; /* Creator Group */
42 DOM_SID global_sid_Anonymous
; /* Anonymous login */
44 DOM_SID global_sid_Builtin
; /* Local well-known domain */
45 DOM_SID global_sid_Builtin_Administrators
; /* Builtin administrators */
46 DOM_SID global_sid_Builtin_Users
; /* Builtin users */
47 DOM_SID global_sid_Builtin_Guests
; /* Builtin guest users */
48 DOM_SID global_sid_Builtin_Power_Users
; /* Builtin power users */
49 DOM_SID global_sid_Builtin_Account_Operators
; /* Builtin account operators */
50 DOM_SID global_sid_Builtin_Server_Operators
; /* Builtin server operators */
51 DOM_SID global_sid_Builtin_Print_Operators
; /* Builtin print operators */
52 DOM_SID global_sid_Builtin_Backup_Operators
; /* Builtin backup operators */
53 DOM_SID global_sid_Builtin_Replicator
; /* Builtin replicator */
55 #define SECURITY_NULL_SID_AUTHORITY 0
56 #define SECURITY_WORLD_SID_AUTHORITY 1
57 #define SECURITY_LOCAL_SID_AUTHORITY 2
58 #define SECURITY_CREATOR_SID_AUTHORITY 3
59 #define SECURITY_NT_AUTHORITY 5
62 * An NT compatible anonymous token.
65 static DOM_SID anon_sid_array
[3];
67 NT_USER_TOKEN anonymous_token
= {
72 static DOM_SID system_sid_array
[4];
73 NT_USER_TOKEN system_token
= {
78 /****************************************************************************
79 Lookup string names for SID types.
80 ****************************************************************************/
83 enum SID_NAME_USE sid_type
;
86 {SID_NAME_USER
, "User"},
87 {SID_NAME_DOM_GRP
, "Domain Group"},
88 {SID_NAME_DOMAIN
, "Domain"},
89 {SID_NAME_ALIAS
, "Local Group"},
90 {SID_NAME_WKN_GRP
, "Well-known Group"},
91 {SID_NAME_DELETED
, "Deleted Account"},
92 {SID_NAME_INVALID
, "Invalid Account"},
93 {SID_NAME_UNKNOWN
, "UNKNOWN"},
95 {SID_NAME_USE_NONE
, NULL
}
98 const char *sid_type_lookup(uint32 sid_type
)
102 /* Look through list */
103 while(sid_name_type
[i
].sid_type
!= 0) {
104 if (sid_name_type
[i
].sid_type
== sid_type
)
105 return sid_name_type
[i
].string
;
110 return "SID *TYPE* is INVALID";
113 /****************************************************************************
114 Creates some useful well known sids
115 ****************************************************************************/
117 void generate_wellknown_sids(void)
119 static BOOL initialised
= False
;
124 /* SECURITY_NULL_SID_AUTHORITY */
125 string_to_sid(&global_sid_NULL
, "S-1-0-0");
127 /* SECURITY_WORLD_SID_AUTHORITY */
128 string_to_sid(&global_sid_World_Domain
, "S-1-1");
129 string_to_sid(&global_sid_World
, "S-1-1-0");
131 /* SECURITY_CREATOR_SID_AUTHORITY */
132 string_to_sid(&global_sid_Creator_Owner_Domain
, "S-1-3");
133 string_to_sid(&global_sid_Creator_Owner
, "S-1-3-0");
134 string_to_sid(&global_sid_Creator_Group
, "S-1-3-1");
136 /* SECURITY_NT_AUTHORITY */
137 string_to_sid(&global_sid_NT_Authority
, "S-1-5");
138 string_to_sid(&global_sid_Network
, "S-1-5-2");
139 string_to_sid(&global_sid_Anonymous
, "S-1-5-7");
140 string_to_sid(&global_sid_Authenticated_Users
, "S-1-5-11");
141 string_to_sid(&global_sid_System
, "S-1-5-18");
143 /* SECURITY_BUILTIN_DOMAIN_RID */
144 string_to_sid(&global_sid_Builtin
, "S-1-5-32");
145 string_to_sid(&global_sid_Builtin_Administrators
, "S-1-5-32-544");
146 string_to_sid(&global_sid_Builtin_Users
, "S-1-5-32-545");
147 string_to_sid(&global_sid_Builtin_Guests
, "S-1-5-32-546");
148 string_to_sid(&global_sid_Builtin_Power_Users
, "S-1-5-32-547");
149 string_to_sid(&global_sid_Builtin_Account_Operators
, "S-1-5-32-548");
150 string_to_sid(&global_sid_Builtin_Server_Operators
, "S-1-5-32-549");
151 string_to_sid(&global_sid_Builtin_Print_Operators
, "S-1-5-32-550");
152 string_to_sid(&global_sid_Builtin_Backup_Operators
, "S-1-5-32-551");
153 string_to_sid(&global_sid_Builtin_Replicator
, "S-1-5-32-552");
155 /* Create the anon token. */
156 sid_copy( &anonymous_token
.user_sids
[0], &global_sid_World
);
157 sid_copy( &anonymous_token
.user_sids
[1], &global_sid_Network
);
158 sid_copy( &anonymous_token
.user_sids
[2], &global_sid_Anonymous
);
160 /* Create the system token. */
161 sid_copy( &system_token
.user_sids
[0], &global_sid_System
);
166 /**************************************************************************
167 Create the SYSTEM token.
168 ***************************************************************************/
170 NT_USER_TOKEN
*get_system_token(void)
172 generate_wellknown_sids(); /* The token is initialised here */
173 return &system_token
;
176 /**************************************************************************
177 Splits a name of format \DOMAIN\name or name into its two components.
178 Sets the DOMAIN name to global_myname() if it has not been specified.
179 ***************************************************************************/
181 void split_domain_name(const char *fullname
, char *domain
, char *name
)
187 sep
= lp_winbind_separator();
189 *domain
= *name
= '\0';
191 if (fullname
[0] == sep
[0] || fullname
[0] == '\\')
194 pstrcpy(full_name
, fullname
);
195 p
= strchr_m(full_name
+1, '\\');
196 if (!p
) p
= strchr_m(full_name
+1, sep
[0]);
200 fstrcpy(domain
, full_name
);
203 fstrcpy(domain
, global_myname());
204 fstrcpy(name
, full_name
);
207 DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
208 fullname
, domain
, name
));
211 /****************************************************************************
212 Test if a SID is wellknown and resolvable.
213 ****************************************************************************/
215 BOOL
resolvable_wellknown_sid(DOM_SID
*sid
)
217 uint32 ia
= (sid
->id_auth
[5]) +
218 (sid
->id_auth
[4] << 8 ) +
219 (sid
->id_auth
[3] << 16) +
220 (sid
->id_auth
[2] << 24);
222 if (sid
->sid_rev_num
!= SEC_DESC_REVISION
|| sid
->num_auths
< 1)
225 return (ia
== SECURITY_WORLD_SID_AUTHORITY
||
226 ia
== SECURITY_CREATOR_SID_AUTHORITY
);
229 /*****************************************************************
230 Convert a SID to an ascii string.
231 *****************************************************************/
233 char *sid_to_string(fstring sidstr_out
, const DOM_SID
*sid
)
240 fstrcpy(sidstr_out
, "(NULL SID)");
245 * BIG NOTE: this function only does SIDS where the identauth is not >= 2^32
246 * in a range of 2^48.
248 ia
= (sid
->id_auth
[5]) +
249 (sid
->id_auth
[4] << 8 ) +
250 (sid
->id_auth
[3] << 16) +
251 (sid
->id_auth
[2] << 24);
253 slprintf(sidstr_out
, sizeof(fstring
) - 1, "S-%u-%lu", (unsigned int)sid
->sid_rev_num
, (unsigned long)ia
);
255 for (i
= 0; i
< sid
->num_auths
; i
++) {
256 slprintf(subauth
, sizeof(subauth
)-1, "-%lu", (unsigned long)sid
->sub_auths
[i
]);
257 fstrcat(sidstr_out
, subauth
);
263 /*****************************************************************
264 Useful function for debug lines.
265 *****************************************************************/
267 const char *sid_string_static(const DOM_SID
*sid
)
269 static fstring sid_str
;
270 sid_to_string(sid_str
, sid
);
274 /*****************************************************************
275 Convert a string to a SID. Returns True on success, False on fail.
276 *****************************************************************/
278 BOOL
string_to_sid(DOM_SID
*sidout
, const char *sidstr
)
283 /* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
286 if (StrnCaseCmp( sidstr
, "S-", 2)) {
287 DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr
));
291 memset((char *)sidout
, '\0', sizeof(DOM_SID
));
293 p
= q
= strdup(sidstr
+ 2);
295 DEBUG(0, ("string_to_sid: out of memory!\n"));
299 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
300 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
305 /* Get the revision number. */
306 sidout
->sid_rev_num
= (uint8
)strtoul(tok
, NULL
, 10);
308 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
309 DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr
));
314 /* identauth in decimal should be < 2^32 */
315 ia
= (uint32
)strtoul(tok
, NULL
, 10);
317 /* NOTE - the ia value is in big-endian format. */
318 sidout
->id_auth
[0] = 0;
319 sidout
->id_auth
[1] = 0;
320 sidout
->id_auth
[2] = (ia
& 0xff000000) >> 24;
321 sidout
->id_auth
[3] = (ia
& 0x00ff0000) >> 16;
322 sidout
->id_auth
[4] = (ia
& 0x0000ff00) >> 8;
323 sidout
->id_auth
[5] = (ia
& 0x000000ff);
325 sidout
->num_auths
= 0;
327 while(next_token(&p
, tok
, "-", sizeof(tok
)) &&
328 sidout
->num_auths
< MAXSUBAUTHS
) {
330 * NOTE - the subauths are in native machine-endian format. They
331 * are converted to little-endian when linearized onto the wire.
333 sid_append_rid(sidout
, (uint32
)strtoul(tok
, NULL
, 10));
340 /*****************************************************************
341 Add a rid to the end of a sid
342 *****************************************************************/
344 BOOL
sid_append_rid(DOM_SID
*sid
, uint32 rid
)
346 if (sid
->num_auths
< MAXSUBAUTHS
) {
347 sid
->sub_auths
[sid
->num_auths
++] = rid
;
353 /*****************************************************************
354 Removes the last rid from the end of a sid
355 *****************************************************************/
357 BOOL
sid_split_rid(DOM_SID
*sid
, uint32
*rid
)
359 if (sid
->num_auths
> 0) {
361 *rid
= sid
->sub_auths
[sid
->num_auths
];
367 /*****************************************************************
368 Return the last rid from the end of a sid
369 *****************************************************************/
371 BOOL
sid_peek_rid(const DOM_SID
*sid
, uint32
*rid
)
376 if (sid
->num_auths
> 0) {
377 *rid
= sid
->sub_auths
[sid
->num_auths
- 1];
383 /*****************************************************************
384 Return the last rid from the end of a sid
385 and check the sid against the exp_dom_sid
386 *****************************************************************/
388 BOOL
sid_peek_check_rid(const DOM_SID
*exp_dom_sid
, const DOM_SID
*sid
, uint32
*rid
)
390 if (!exp_dom_sid
|| !sid
|| !rid
)
394 if (sid_compare_domain(exp_dom_sid
, sid
)!=0){
399 return sid_peek_rid(sid
, rid
);
402 /*****************************************************************
404 *****************************************************************/
406 void sid_copy(DOM_SID
*dst
, const DOM_SID
*src
)
412 dst
->sid_rev_num
= src
->sid_rev_num
;
413 dst
->num_auths
= src
->num_auths
;
415 memcpy(&dst
->id_auth
[0], &src
->id_auth
[0], sizeof(src
->id_auth
));
417 for (i
= 0; i
< src
->num_auths
; i
++)
418 dst
->sub_auths
[i
] = src
->sub_auths
[i
];
421 /*****************************************************************
422 Write a sid out into on-the-wire format.
423 *****************************************************************/
425 BOOL
sid_linearize(char *outbuf
, size_t len
, const DOM_SID
*sid
)
429 if (len
< sid_size(sid
))
432 SCVAL(outbuf
,0,sid
->sid_rev_num
);
433 SCVAL(outbuf
,1,sid
->num_auths
);
434 memcpy(&outbuf
[2], sid
->id_auth
, 6);
435 for(i
= 0; i
< sid
->num_auths
; i
++)
436 SIVAL(outbuf
, 8 + (i
*4), sid
->sub_auths
[i
]);
441 /*****************************************************************
442 Parse a on-the-wire SID to a DOM_SID.
443 *****************************************************************/
445 BOOL
sid_parse(const char *inbuf
, size_t len
, DOM_SID
*sid
)
453 sid
->sid_rev_num
= CVAL(inbuf
, 0);
454 sid
->num_auths
= CVAL(inbuf
, 1);
455 memcpy(sid
->id_auth
, inbuf
+2, 6);
456 if (len
< 8 + sid
->num_auths
*4)
458 for (i
=0;i
<sid
->num_auths
;i
++)
459 sid
->sub_auths
[i
] = IVAL(inbuf
, 8+i
*4);
463 /*****************************************************************
464 Compare the auth portion of two sids.
465 *****************************************************************/
467 static int sid_compare_auth(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
478 if (sid1
->sid_rev_num
!= sid2
->sid_rev_num
)
479 return sid1
->sid_rev_num
- sid2
->sid_rev_num
;
481 for (i
= 0; i
< 6; i
++)
482 if (sid1
->id_auth
[i
] != sid2
->id_auth
[i
])
483 return sid1
->id_auth
[i
] - sid2
->id_auth
[i
];
488 /*****************************************************************
490 *****************************************************************/
492 int sid_compare(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
503 /* Compare most likely different rids, first: i.e start at end */
504 if (sid1
->num_auths
!= sid2
->num_auths
)
505 return sid1
->num_auths
- sid2
->num_auths
;
507 for (i
= sid1
->num_auths
-1; i
>= 0; --i
)
508 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
509 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
511 return sid_compare_auth(sid1
, sid2
);
514 /*****************************************************************
515 See if 2 SIDs are in the same domain
516 this just compares the leading sub-auths
517 *****************************************************************/
519 int sid_compare_domain(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
523 n
= MIN(sid1
->num_auths
, sid2
->num_auths
);
525 for (i
= n
-1; i
>= 0; --i
)
526 if (sid1
->sub_auths
[i
] != sid2
->sub_auths
[i
])
527 return sid1
->sub_auths
[i
] - sid2
->sub_auths
[i
];
529 return sid_compare_auth(sid1
, sid2
);
532 /*****************************************************************
534 *****************************************************************/
536 BOOL
sid_equal(const DOM_SID
*sid1
, const DOM_SID
*sid2
)
538 return sid_compare(sid1
, sid2
) == 0;
541 /*****************************************************************
542 Check if the SID is the builtin SID (S-1-5-32).
543 *****************************************************************/
545 BOOL
sid_check_is_builtin(const DOM_SID
*sid
)
547 return sid_equal(sid
, &global_sid_Builtin
);
550 /*****************************************************************
551 Check if the SID is one of the builtin SIDs (S-1-5-32-a).
552 *****************************************************************/
554 BOOL
sid_check_is_in_builtin(const DOM_SID
*sid
)
559 sid_copy(&dom_sid
, sid
);
560 sid_split_rid(&dom_sid
, &rid
);
562 return sid_equal(&dom_sid
, &global_sid_Builtin
);
565 /*****************************************************************
566 Calculates size of a sid.
567 *****************************************************************/
569 size_t sid_size(const DOM_SID
*sid
)
574 return sid
->num_auths
* sizeof(uint32
) + 8;
577 /*****************************************************************
578 Returns true if SID is internal (and non-mappable).
579 *****************************************************************/
581 BOOL
non_mappable_sid(DOM_SID
*sid
)
587 sid_split_rid(&dom
, &rid
);
589 if (sid_equal(&dom
, &global_sid_Builtin
))
592 if (sid_equal(&dom
, &global_sid_NT_Authority
))
598 /*****************************************************************
599 Return the binary string representation of a DOM_SID.
601 *****************************************************************/
603 char *sid_binstring(const DOM_SID
*sid
)
606 int len
= sid_size(sid
);
610 sid_linearize(buf
, len
, sid
);
611 s
= binary_string(buf
, len
);
617 /*****************************************************************
618 Print a GUID structure for debugging.
619 *****************************************************************/
621 void print_guid(GUID
*guid
)
625 d_printf("%08x-%04x-%04x",
626 IVAL(guid
->info
, 0), SVAL(guid
->info
, 4), SVAL(guid
->info
, 6));
627 d_printf("-%02x%02x-", guid
->info
[8], guid
->info
[9]);
628 for (i
=10;i
<GUID_SIZE
;i
++)
629 d_printf("%02x", guid
->info
[i
]);