source3/lib/util_sid.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4    Copyright (C) Andrew Tridgell                1992-1998
   5    Copyright (C) Luke Kenneth Caseson Leighton  1998-1999
   6    Copyright (C) Jeremy Allison                 1999
   7    Copyright (C) Stefan (metze) Metzmacher      2002
   8    Copyright (C) Simo Sorce                     2002
   9    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "../librpc/gen_ndr/ndr_security.h"
  27 #include "../librpc/gen_ndr/netlogon.h"
  28 #include "../libcli/security/security.h"
  29
  30
  31 /*****************************************************************
  32  Convert a SID to an ascii string.
  33 *****************************************************************/
  34
  35 char *sid_to_fstring(fstring sidstr_out, const struct dom_sid *sid)
  36 {
  37         char *str = sid_string_talloc(talloc_tos(), sid);
  38         fstrcpy(sidstr_out, str);
  39         TALLOC_FREE(str);
  40         return sidstr_out;
  41 }
  42
  43 /*****************************************************************
  44  Essentially a renamed dom_sid_string from
  45  ../libcli/security/dom_sid.c with a panic if it didn't work.
  46 *****************************************************************/
  47
  48 char *sid_string_talloc(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
  49 {
  50         char *result = dom_sid_string(mem_ctx, sid);
  51         SMB_ASSERT(result != NULL);
  52         return result;
  53 }
  54
  55 /*****************************************************************
  56  Useful function for debug lines.
  57 *****************************************************************/
  58
  59 char *sid_string_dbg(const struct dom_sid *sid)
  60 {
  61         return sid_string_talloc(talloc_tos(), sid);
  62 }
  63
  64 /*****************************************************************
  65  Use with care!
  66 *****************************************************************/
  67
  68 char *sid_string_tos(const struct dom_sid *sid)
  69 {
  70         return sid_string_talloc(talloc_tos(), sid);
  71 }
  72
  73 /*****************************************************************
  74  Write a sid out into on-the-wire format.
  75 *****************************************************************/
  76
  77 bool sid_linearize(char *outbuf, size_t len, const struct dom_sid *sid)
  78 {
  79         size_t i;
  80
  81         if (len < ndr_size_dom_sid(sid, 0))
  82                 return False;
  83
  84         SCVAL(outbuf,0,sid->sid_rev_num);
  85         SCVAL(outbuf,1,sid->num_auths);
  86         memcpy(&outbuf[2], sid->id_auth, 6);
  87         for(i = 0; i < sid->num_auths; i++)
  88                 SIVAL(outbuf, 8 + (i*4), sid->sub_auths[i]);
  89
  90         return True;
  91 }
  92
  93 /*****************************************************************
  94  Returns true if SID is internal (and non-mappable).
  95 *****************************************************************/
  96
  97 bool non_mappable_sid(struct dom_sid *sid)
  98 {
  99         struct dom_sid dom;
 100         uint32 rid;
 101
 102         sid_copy(&dom, sid);
 103         sid_split_rid(&dom, &rid);
 104
 105         if (dom_sid_equal(&dom, &global_sid_Builtin))
 106                 return True;
 107
 108         if (dom_sid_equal(&dom, &global_sid_NT_Authority))
 109                 return True;
 110
 111         return False;
 112 }
 113
 114 /*****************************************************************
 115  Return the binary string representation of a struct dom_sid.
 116  Caller must free.
 117 *****************************************************************/
 118
 119 char *sid_binstring_hex(const struct dom_sid *sid)
 120 {
 121         char *buf, *s;
 122         int len = ndr_size_dom_sid(sid, 0);
 123         buf = (char *)SMB_MALLOC(len);
 124         if (!buf)
 125                 return NULL;
 126         sid_linearize(buf, len, sid);
 127         s = binary_string(buf, len);
 128         free(buf);
 129         return s;
 130 }
 131
 132 NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
 133                               const struct netr_SamInfo3 *info3,
 134                               struct dom_sid **user_sids,
 135                               uint32_t *num_user_sids,
 136                               bool include_user_group_rid,
 137                               bool skip_ressource_groups)
 138 {
 139         NTSTATUS status;
 140         struct dom_sid sid;
 141         struct dom_sid *sid_array = NULL;
 142         uint32_t num_sids = 0;
 143         int i;
 144
 145         if (include_user_group_rid) {
 146                 if (!sid_compose(&sid, info3->base.domain_sid, info3->base.rid)) {
 147                         DEBUG(3, ("could not compose user SID from rid 0x%x\n",
 148                                   info3->base.rid));
 149                         return NT_STATUS_INVALID_PARAMETER;
 150                 }
 151                 status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
 152                 if (!NT_STATUS_IS_OK(status)) {
 153                         DEBUG(3, ("could not append user SID from rid 0x%x\n",
 154                                   info3->base.rid));
 155                         return status;
 156                 }
 157         }
 158
 159         if (!sid_compose(&sid, info3->base.domain_sid, info3->base.primary_gid)) {
 160                 DEBUG(3, ("could not compose group SID from rid 0x%x\n",
 161                           info3->base.primary_gid));
 162                 return NT_STATUS_INVALID_PARAMETER;
 163         }
 164         status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(3, ("could not append group SID from rid 0x%x\n",
 167                           info3->base.rid));
 168                 return status;
 169         }
 170
 171         for (i = 0; i < info3->base.groups.count; i++) {
 172                 /* Don't add the primary group sid twice. */
 173                 if (info3->base.primary_gid == info3->base.groups.rids[i].rid) {
 174                         continue;
 175                 }
 176                 if (!sid_compose(&sid, info3->base.domain_sid,
 177                                  info3->base.groups.rids[i].rid)) {
 178                         DEBUG(3, ("could not compose SID from additional group "
 179                                   "rid 0x%x\n", info3->base.groups.rids[i].rid));
 180                         return NT_STATUS_INVALID_PARAMETER;
 181                 }
 182                 status = add_sid_to_array(mem_ctx, &sid, &sid_array, &num_sids);
 183                 if (!NT_STATUS_IS_OK(status)) {
 184                         DEBUG(3, ("could not append SID from additional group "
 185                                   "rid 0x%x\n", info3->base.groups.rids[i].rid));
 186                         return status;
 187                 }
 188         }
 189
 190         /* Copy 'other' sids.  We need to do sid filtering here to
 191            prevent possible elevation of privileges.  See:
 192
 193            http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
 194          */
 195
 196         for (i = 0; i < info3->sidcount; i++) {
 197
 198                 if (skip_ressource_groups &&
 199                     (info3->sids[i].attributes & SE_GROUP_RESOURCE)) {
 200                         continue;
 201                 }
 202
 203                 status = add_sid_to_array(mem_ctx, info3->sids[i].sid,
 204                                       &sid_array, &num_sids);
 205                 if (!NT_STATUS_IS_OK(status)) {
 206                         DEBUG(3, ("could not add SID to array: %s\n",
 207                                   sid_string_dbg(info3->sids[i].sid)));
 208                         return status;
 209                 }
 210         }
 211
 212         *user_sids = sid_array;
 213         *num_user_sids = num_sids;
 214
 215         return NT_STATUS_OK;
 216 }