usr/src/uts/common/smbsrv/smb_sid.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24
  25 #ifndef _SMB_SID_H
  26 #define _SMB_SID_H
  27
  28 /*
  29  * Security Identifier (SID) interface definition.
  30  */
  31 #include <smbsrv/wintypes.h>
  32
  33 #ifdef __cplusplus
  34 extern "C" {
  35 #endif
  36
  37 /*
  38  * Predefined global user RIDs.
  39  */
  40 #define DOMAIN_USER_RID_ADMIN           (0x000001F4L)   /* 500 */
  41 #define DOMAIN_USER_RID_GUEST           (0x000001F5L)   /* 501 */
  42 #define DOMAIN_USER_RID_KRBTGT          (0x000001F6L)   /* 502 */
  43
  44 /*
  45  * Predefined global group RIDs.
  46  */
  47 #define DOMAIN_GROUP_RID_ADMINS         (0x00000200L)   /* 512 */
  48 #define DOMAIN_GROUP_RID_USERS          (0x00000201L)   /* 513 */
  49 #define DOMAIN_GROUP_RID_GUESTS         (0x00000202L)   /* 514 */
  50 #define DOMAIN_GROUP_RID_COMPUTERS      (0x00000203L)   /* 515 */
  51 #define DOMAIN_GROUP_RID_CONTROLLERS    (0x00000204L)   /* 516 */
  52 #define DOMAIN_GROUP_RID_CERT_ADMINS    (0x00000205L)   /* 517 */
  53 #define DOMAIN_GROUP_RID_SCHEMA_ADMINS  (0x00000206L)   /* 518 */
  54 #define DOMAIN_GROUP_RID_EP_ADMINS      (0x00000207L)   /* 519 */
  55 #define DOMAIN_GROUP_RID_GP_CREATOR     (0x00000208L)   /* 520 */
  56
  57
  58 /*
  59  * Predefined local alias RIDs.
  60  */
  61 #define DOMAIN_ALIAS_RID_ADMINS         (0x00000220L)   /* 544 */
  62 #define DOMAIN_ALIAS_RID_USERS          (0x00000221L)
  63 #define DOMAIN_ALIAS_RID_GUESTS         (0x00000222L)
  64 #define DOMAIN_ALIAS_RID_POWER_USERS    (0x00000223L)
  65 #define DOMAIN_ALIAS_RID_ACCOUNT_OPS    (0x00000224L)
  66 #define DOMAIN_ALIAS_RID_SYSTEM_OPS     (0x00000225L)
  67 #define DOMAIN_ALIAS_RID_PRINT_OPS      (0x00000226L)
  68 #define DOMAIN_ALIAS_RID_BACKUP_OPS     (0x00000227L)
  69 #define DOMAIN_ALIAS_RID_REPLICATOR     (0x00000228L)
  70
  71
  72 /*
  73  * Universal and NT well-known SIDs
  74  */
  75 #define NT_NULL_AUTH_SIDSTR                     "S-1-0"
  76 #define NT_NULL_SIDSTR                          "S-1-0-0"
  77 #define NT_WORLD_AUTH_SIDSTR                    "S-1-1"
  78 #define NT_WORLD_SIDSTR                         "S-1-1-0"
  79 #define NT_LOCAL_AUTH_SIDSTR                    "S-1-2"
  80 #define NT_LOCAL_SIDSTR                         "S-1-2-0"
  81 #define NT_CREATOR_AUTH_SIDSTR                  "S-1-3"
  82 #define NT_CREATOR_OWNER_ID_SIDSTR              "S-1-3-0"
  83 #define NT_CREATOR_GROUP_ID_SIDSTR              "S-1-3-1"
  84 #define NT_CREATOR_OWNER_SERVER_ID_SIDSTR       "S-1-3-2"
  85 #define NT_CREATOR_GROUP_SERVER_ID_SIDSTR       "S-1-3-3"
  86 #define NT_OWNER_RIGHTS_SIDSTR                  "S-1-3-4"
  87 #define NT_GROUP_RIGHTS_SIDSTR                  "S-1-3-5"
  88 #define NT_NON_UNIQUE_IDS_SIDSTR                "S-1-4"
  89 #define NT_AUTHORITY_SIDSTR                     "S-1-5"
  90 #define NT_DIALUP_SIDSTR                        "S-1-5-1"
  91 #define NT_NETWORK_SIDSTR                       "S-1-5-2"
  92 #define NT_BATCH_SIDSTR                         "S-1-5-3"
  93 #define NT_INTERACTIVE_SIDSTR                   "S-1-5-4"
  94 #define NT_LOGON_SESSION_SIDSTR                 "S-1-5-5"
  95 #define NT_SERVICE_SIDSTR                       "S-1-5-6"
  96 #define NT_ANONYMOUS_LOGON_SIDSTR               "S-1-5-7"
  97 #define NT_PROXY_SIDSTR                         "S-1-5-8"
  98 #define NT_SERVER_LOGON_SIDSTR                  "S-1-5-9"
  99 #define NT_SELF_SIDSTR                          "S-1-5-10"
 100 #define NT_AUTHENTICATED_USER_SIDSTR            "S-1-5-11"
 101 #define NT_RESTRICTED_CODE_SIDSTR               "S-1-5-12"
 102 #define NT_TERMINAL_SERVER_SIDSTR               "S-1-5-13"
 103 #define NT_LOCAL_SYSTEM_SIDSTR                  "S-1-5-18"
 104 #define NT_NON_UNIQUE_SIDSTR                    "S-1-5-21"
 105 #define NT_BUILTIN_DOMAIN_SIDSTR                "S-1-5-32"
 106 #define NT_BUILTIN_CURRENT_OWNER_SIDSTR         "S-1-5-32-766"
 107 #define NT_BUILTIN_CURRENT_GROUP_SIDSTR         "S-1-5-32-767"
 108
 109
 110 /*
 111  * SID type indicators (SID_NAME_USE).
 112  */
 113 #define SidTypeNull                     0
 114 #define SidTypeUser                     1
 115 #define SidTypeGroup                    2
 116 #define SidTypeDomain                   3
 117 #define SidTypeAlias                    4
 118 #define SidTypeWellKnownGroup           5
 119 #define SidTypeDeletedAccount           6
 120 #define SidTypeInvalid                  7
 121 #define SidTypeUnknown                  8
 122 #define SidTypeComputer                 9
 123 #define SidTypeLabel                    10
 124
 125
 126 /*
 127  * Identifier authorities for various domains.
 128  */
 129 #define NT_SID_NULL_AUTH                0
 130 #define NT_SID_WORLD_AUTH               1
 131 #define NT_SID_LOCAL_AUTH               2
 132 #define NT_SID_CREATOR_AUTH             3
 133 #define NT_SID_NON_UNIQUE_AUTH          4
 134 #define NT_SID_NT_AUTH                  5
 135
 136
 137 #define NT_SECURITY_NULL_AUTH           {0, 0, 0, 0, 0, 0}
 138 #define NT_SECURITY_WORLD_AUTH          {0, 0, 0, 0, 0, 1}
 139 #define NT_SECURITY_LOCAL_AUTH          {0, 0, 0, 0, 0, 2}
 140 #define NT_SECURITY_CREATOR_AUTH        {0, 0, 0, 0, 0, 3}
 141 #define NT_SECURITY_NON_UNIQUE_AUTH     {0, 0, 0, 0, 0, 4}
 142 #define NT_SECURITY_NT_AUTH             {0, 0, 0, 0, 0, 5}
 143 #define NT_SECURITY_UNIX_AUTH           {0, 0, 0, 0, 0, 99}
 144
 145
 146 #define SECURITY_NULL_RID                       (0x00000000L)
 147 #define SECURITY_WORLD_RID                      (0x00000000L)
 148 #define SECURITY_LOCAL_RID                      (0X00000000L)
 149
 150 #define SECURITY_CREATOR_OWNER_RID              (0x00000000L)
 151 #define SECURITY_CREATOR_GROUP_RID              (0x00000001L)
 152 #define SECURITY_CREATOR_OWNER_SERVER_RID       (0x00000002L)
 153 #define SECURITY_CREATOR_GROUP_SERVER_RID       (0x00000003L)
 154 #define SECURITY_OWNER_RIGHTS_RID               (0x00000004L)
 155 #define SECURITY_GROUP_RIGHTS_RID               (0x00000005L)
 156 #define SECURITY_CURRENT_OWNER_RID              (0x000002FEL)
 157 #define SECURITY_CURRENT_GROUP_RID              (0x000002FFL)
 158
 159 #define SECURITY_DIALUP_RID                     (0x00000001L)
 160 #define SECURITY_NETWORK_RID                    (0x00000002L)
 161 #define SECURITY_BATCH_RID                      (0x00000003L)
 162 #define SECURITY_INTERACTIVE_RID                (0x00000004L)
 163 #define SECURITY_LOGON_IDS_RID                  (0x00000005L)
 164 #define SECURITY_LOGON_IDS_RID_COUNT            (3L)
 165 #define SECURITY_SERVICE_RID                    (0x00000006L)
 166 #define SECURITY_ANONYMOUS_LOGON_RID            (0x00000007L)
 167 #define SECURITY_PROXY_RID                      (0x00000008L)
 168 #define SECURITY_ENTERPRISE_CONTROLLERS_RID     (0x00000009L)
 169 #define SECURITY_SERVER_LOGON_RID       SECURITY_ENTERPRISE_CONTROLLERS_RID
 170 #define SECURITY_PRINCIPAL_SELF_RID             (0x0000000AL)
 171 #define SECURITY_AUTHENTICATED_USER_RID         (0x0000000BL)
 172 #define SECURITY_RESTRICTED_CODE_RID            (0x0000000CL)
 173
 174 #define SECURITY_LOCAL_SYSTEM_RID               (0x00000012L)
 175 #define SECURITY_NT_NON_UNIQUE                  (0x00000015L)
 176 #define SECURITY_BUILTIN_DOMAIN_RID             (0x00000020L)
 177
 178
 179 #define NT_SID_NON_UNIQUE_SUBAUTH 21
 180
 181
 182 /*
 183  * Common definition for a SID.
 184  */
 185 #define NT_SID_REVISION         1
 186 #define NT_SID_AUTH_MAX         6
 187 #define NT_SID_SUBAUTH_MAX      15
 188
 189
 190 /*
 191  * Security Identifier (SID)
 192  *
 193  * The security identifier (SID) uniquely identifies a user, group or
 194  * a domain. It consists of a revision number, the identifier authority,
 195  * and a list of sub-authorities. The revision number is currently 1.
 196  * The identifier authority identifies which system issued the SID. The
 197  * sub-authorities of a domain SID uniquely identify a domain. A user
 198  * or group SID consists of a domain SID with the user or group id
 199  * appended. The user or group id (also known as a relative id (RID)
 200  * uniquely identifies a user within a domain. A user or group SID
 201  * uniquely identifies a user or group across all domains. The SidType
 202  * values identify the various types of SID.
 203  *
 204  *      1   1   1   1   1   1
 205  *      5   4   3   2   1   0   9   8   7   6   5   4   3   2   1   0
 206  *   +---------------------------------------------------------------+
 207  *   |      SubAuthorityCount        |Reserved1 (SBZ)|   Revision    |
 208  *   +---------------------------------------------------------------+
 209  *   |                   IdentifierAuthority[0]                      |
 210  *   +---------------------------------------------------------------+
 211  *   |                   IdentifierAuthority[1]                      |
 212  *   +---------------------------------------------------------------+
 213  *   |                   IdentifierAuthority[2]                      |
 214  *   +---------------------------------------------------------------+
 215  *   |                                                               |
 216  *   +- -  -  -  -  -  -  -  SubAuthority[]  -  -  -  -  -  -  -  - -+
 217  *   |                                                               |
 218  *   +---------------------------------------------------------------+
 219  *
 220  */
 221 /*
 222  * Note: NT defines the Identifier Authority as a separate
 223  * structure (SID_IDENTIFIER_AUTHORITY) containing a literal
 224  * definition of a 6 byte vector but the effect is the same
 225  * as defining it as a member value.
 226  */
 227 typedef struct smb_sid {
 228         uint8_t sid_revision;
 229         uint8_t sid_subauthcnt;
 230         uint8_t sid_authority[NT_SID_AUTH_MAX];
 231         uint32_t sid_subauth[ANY_SIZE_ARRAY];
 232 } smb_sid_t;
 233
 234 #define SMB_MAX_SID_SIZE        ((2 * sizeof (uint8_t)) + \
 235         (NT_SID_AUTH_MAX * sizeof (uint8_t)) + \
 236         (NT_SID_SUBAUTH_MAX * sizeof (uint32_t)))
 237
 238 /*
 239  * Estimated number of sid_subauth is SECURITY_LOGON_IDS_RID_COUNT
 240  * plus the DOMAIN_RID and the RID.
 241  */
 242 #define SMB_EST_SID_SIZE        ((2 * sizeof (uint8_t)) + \
 243         (NT_SID_AUTH_MAX * sizeof (uint8_t)) + \
 244         ((2 + SECURITY_LOGON_IDS_RID_COUNT) * sizeof (uint32_t)))
 245
 246 /*
 247  * Only group attributes are defined. No user attributes defined.
 248  */
 249 #define SE_GROUP_MANDATORY              0x00000001
 250 #define SE_GROUP_ENABLED_BY_DEFAULT     0x00000002
 251 #define SE_GROUP_ENABLED                0x00000004
 252 #define SE_GROUP_OWNER                  0x00000008
 253 #define SE_GROUP_USE_FOR_DENY_ONLY      0x00000010
 254 #define SE_GROUP_LOGON_ID               0xC0000000
 255
 256 /*
 257  * smb_id_t consists of both the Windows security identifier
 258  * and its corresponding POSIX/ephemeral ID.
 259  */
 260 typedef struct smb_id {
 261         uint32_t        i_attrs;
 262         smb_sid_t       *i_sid;
 263         uid_t           i_id;
 264 } smb_id_t;
 265
 266 typedef struct smb_ids {
 267         uint32_t        i_cnt;
 268         smb_id_t        *i_ids;
 269 } smb_ids_t;
 270
 271 /*
 272  * The maximum size of a SID in string format
 273  */
 274 #define SMB_SID_STRSZ           256
 275
 276 boolean_t smb_sid_isvalid(smb_sid_t *);
 277 int smb_sid_len(smb_sid_t *);
 278 smb_sid_t *smb_sid_dup(smb_sid_t *);
 279 smb_sid_t *smb_sid_splice(smb_sid_t *, uint32_t);
 280 int smb_sid_getrid(smb_sid_t *, uint32_t *);
 281 smb_sid_t *smb_sid_split(smb_sid_t *, uint32_t *);
 282 boolean_t smb_sid_cmp(smb_sid_t *, smb_sid_t *);
 283 boolean_t smb_sid_islocal(smb_sid_t *);
 284 boolean_t smb_sid_indomain(smb_sid_t *, smb_sid_t *);
 285 void smb_sid_free(smb_sid_t *);
 286 int smb_sid_splitstr(char *, uint32_t *);
 287 void smb_sid_tostr(const smb_sid_t *, char *);
 288 smb_sid_t *smb_sid_fromstr(const char *);
 289 char *smb_sid_type2str(uint16_t);
 290
 291 void smb_ids_free(smb_ids_t *);
 292
 293 #ifdef __cplusplus
 294 }
 295 #endif
 296
 297
 298 #endif /* _SMB_SID_H */