mirror of
https://github.com/altlinux/admc.git
synced 2025-01-08 01:18:25 +03:00
Update dom_sid utils for samba 4.20 compatibility
This commit is contained in:
Semyon Knyazev
parent
c04753a3e1
commit
0aeaa43e1c
@ -2,9 +2,9 @@
|
||||
Unix SMB/CIFS implementation.
|
||||
Samba utility functions
|
||||
|
||||
Copyright (C) Stefan (metze) Metzmacher 2002-2004
|
||||
Copyright (C) Andrew Tridgell 1992-2004
|
||||
Copyright (C) Jeremy Allison 1999
|
||||
Copyright (C) Stefan (metze) Metzmacher 2002-2004
|
||||
Copyright (C) Andrew Tridgell 1992-2004
|
||||
Copyright (C) Jeremy Allison 1999
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -20,40 +20,41 @@
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "replace.h"
|
||||
#include "util/data_blob.h"
|
||||
#include "gen_ndr/security.h"
|
||||
#include "dom_sid.h"
|
||||
#include <string.h>
|
||||
|
||||
/*
|
||||
* This file is a copy of private samba sources. Parts of it
|
||||
* were removed or edited.
|
||||
*/
|
||||
|
||||
#include "dom_sid.h"
|
||||
|
||||
#include "replace.h"
|
||||
#include "string.h"
|
||||
|
||||
/*****************************************************************
|
||||
Compare the auth portion of two sids.
|
||||
*****************************************************************/
|
||||
|
||||
int dom_sid_compare_auth(const struct dom_sid *sid1,
|
||||
const struct dom_sid *sid2)
|
||||
const struct dom_sid *sid2)
|
||||
{
|
||||
int i;
|
||||
int i;
|
||||
|
||||
if (sid1 == sid2)
|
||||
return 0;
|
||||
if (!sid1)
|
||||
return -1;
|
||||
if (!sid2)
|
||||
return 1;
|
||||
if (sid1 == sid2)
|
||||
return 0;
|
||||
if (!sid1)
|
||||
return -1;
|
||||
if (!sid2)
|
||||
return 1;
|
||||
|
||||
if (sid1->sid_rev_num != sid2->sid_rev_num)
|
||||
return sid1->sid_rev_num - sid2->sid_rev_num;
|
||||
if (sid1->sid_rev_num != sid2->sid_rev_num)
|
||||
return sid1->sid_rev_num - sid2->sid_rev_num;
|
||||
|
||||
for (i = 0; i < 6; i++)
|
||||
if (sid1->id_auth[i] != sid2->id_auth[i])
|
||||
return sid1->id_auth[i] - sid2->id_auth[i];
|
||||
for (i = 0; i < 6; i++)
|
||||
if (sid1->id_auth[i] != sid2->id_auth[i])
|
||||
return sid1->id_auth[i] - sid2->id_auth[i];
|
||||
|
||||
return 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*****************************************************************
|
||||
@ -62,24 +63,29 @@ int dom_sid_compare_auth(const struct dom_sid *sid1,
|
||||
|
||||
int dom_sid_compare(const struct dom_sid *sid1, const struct dom_sid *sid2)
|
||||
{
|
||||
int i;
|
||||
int i;
|
||||
|
||||
if (sid1 == sid2)
|
||||
return 0;
|
||||
if (!sid1)
|
||||
return -1;
|
||||
if (!sid2)
|
||||
return 1;
|
||||
if (sid1 == sid2)
|
||||
return 0;
|
||||
if (!sid1)
|
||||
return -1;
|
||||
if (!sid2)
|
||||
return 1;
|
||||
|
||||
/* Compare most likely different rids, first: i.e start at end */
|
||||
if (sid1->num_auths != sid2->num_auths)
|
||||
return sid1->num_auths - sid2->num_auths;
|
||||
/* Compare most likely different rids, first: i.e start at end */
|
||||
if (sid1->num_auths != sid2->num_auths)
|
||||
return sid1->num_auths - sid2->num_auths;
|
||||
|
||||
for (i = sid1->num_auths-1; i >= 0; --i)
|
||||
if (sid1->sub_auths[i] != sid2->sub_auths[i])
|
||||
return sid1->sub_auths[i] - sid2->sub_auths[i];
|
||||
for (i = sid1->num_auths-1; i >= 0; --i) {
|
||||
if (sid1->sub_auths[i] < sid2->sub_auths[i]) {
|
||||
return -1;
|
||||
}
|
||||
if (sid1->sub_auths[i] > sid2->sub_auths[i]) {
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
return dom_sid_compare_auth(sid1, sid2);
|
||||
return dom_sid_compare_auth(sid1, sid2);
|
||||
}
|
||||
|
||||
/*****************************************************************
|
||||
@ -88,7 +94,7 @@ int dom_sid_compare(const struct dom_sid *sid1, const struct dom_sid *sid2)
|
||||
|
||||
bool dom_sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2)
|
||||
{
|
||||
return dom_sid_compare(sid1, sid2) == 0;
|
||||
return dom_sid_compare(sid1, sid2) == 0;
|
||||
}
|
||||
|
||||
/*****************************************************************
|
||||
@ -97,11 +103,11 @@ bool dom_sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2)
|
||||
|
||||
bool sid_append_rid(struct dom_sid *sid, uint32_t rid)
|
||||
{
|
||||
if ((size_t) (sid->num_auths) < ARRAY_SIZE(sid->sub_auths)) {
|
||||
sid->sub_auths[sid->num_auths++] = rid;
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
if ((size_t)(sid->num_auths) < ARRAY_SIZE(sid->sub_auths)) {
|
||||
sid->sub_auths[sid->num_auths++] = rid;
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/*
|
||||
@ -109,17 +115,22 @@ bool sid_append_rid(struct dom_sid *sid, uint32_t rid)
|
||||
this just compares the leading sub-auths
|
||||
*/
|
||||
int dom_sid_compare_domain(const struct dom_sid *sid1,
|
||||
const struct dom_sid *sid2)
|
||||
const struct dom_sid *sid2)
|
||||
{
|
||||
int n, i;
|
||||
int n, i;
|
||||
|
||||
n = MIN(sid1->num_auths, sid2->num_auths);
|
||||
n = MIN(sid1->num_auths, sid2->num_auths);
|
||||
|
||||
for (i = n-1; i >= 0; --i)
|
||||
if (sid1->sub_auths[i] != sid2->sub_auths[i])
|
||||
return sid1->sub_auths[i] - sid2->sub_auths[i];
|
||||
for (i = n-1; i >= 0; --i) {
|
||||
if (sid1->sub_auths[i] < sid2->sub_auths[i]) {
|
||||
return -1;
|
||||
}
|
||||
if (sid1->sub_auths[i] > sid2->sub_auths[i]) {
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
return dom_sid_compare_auth(sid1, sid2);
|
||||
return dom_sid_compare_auth(sid1, sid2);
|
||||
}
|
||||
|
||||
/*****************************************************************
|
||||
@ -129,108 +140,133 @@ int dom_sid_compare_domain(const struct dom_sid *sid1,
|
||||
#define AUTHORITY_MASK (~(0xffffffffffffULL))
|
||||
|
||||
bool dom_sid_parse_endp(const char *sidstr,struct dom_sid *sidout,
|
||||
const char **endp)
|
||||
const char **endp)
|
||||
{
|
||||
const char *p;
|
||||
char *q;
|
||||
/* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
|
||||
uint64_t conv;
|
||||
const char *p;
|
||||
char *q = NULL;
|
||||
char *end = NULL;
|
||||
uint64_t conv;
|
||||
// int error = 0;
|
||||
|
||||
ZERO_STRUCTP(sidout);
|
||||
|
||||
if ((sidstr[0] != 'S' && sidstr[0] != 's') || sidstr[1] != '-') {
|
||||
goto format_error;
|
||||
}
|
||||
if ((sidstr[0] != 'S' && sidstr[0] != 's') || sidstr[1] != '-') {
|
||||
goto format_error;
|
||||
}
|
||||
|
||||
/* Get the revision number. */
|
||||
p = sidstr + 2;
|
||||
/* Get the revision number. */
|
||||
p = sidstr + 2;
|
||||
|
||||
if (!isdigit(*p)) {
|
||||
goto format_error;
|
||||
}
|
||||
if (!isdigit((unsigned char)*p)) {
|
||||
goto format_error;
|
||||
}
|
||||
|
||||
// NOTE: replaced with strtoul()
|
||||
// conv = smb_strtoul(p, &q, 10, &error, SMB_STR_STANDARD);
|
||||
// if (error != 0 || (*q != '-') || conv > UINT8_MAX) {
|
||||
// goto format_error;
|
||||
// }
|
||||
// conv = smb_strtoul(p, &q, 10, &error, SMB_STR_STANDARD);
|
||||
// if (error != 0 || (*q != '-') || conv > UINT8_MAX || q - p > 4) {
|
||||
// goto format_error;
|
||||
// }
|
||||
conv = strtoul(p, &q, 10);
|
||||
sidout->sid_rev_num = (uint8_t) conv;
|
||||
q++;
|
||||
sidout->sid_rev_num = (uint8_t) conv;
|
||||
q++;
|
||||
|
||||
if (!isdigit(*q)) {
|
||||
goto format_error;
|
||||
}
|
||||
if (!isdigit((unsigned char)*q)) {
|
||||
goto format_error;
|
||||
}
|
||||
while (q[0] == '0' && isdigit((unsigned char)q[1])) {
|
||||
/*
|
||||
* strtoull will think this is octal, which is not how SIDs
|
||||
* work! So let's walk along until there are no leading zeros
|
||||
* (or a single zero).
|
||||
*/
|
||||
q++;
|
||||
}
|
||||
|
||||
/* get identauth */
|
||||
// conv = smb_strtoull(q, &q, 0, &error, SMB_STR_STANDARD);
|
||||
// if (conv & AUTHORITY_MASK || error != 0) {
|
||||
// goto format_error;
|
||||
// }
|
||||
conv = strtoull(q, &q, 0);
|
||||
/* get identauth */
|
||||
// conv = smb_strtoull(q, &end, 0, &error, SMB_STR_STANDARD);
|
||||
// if (conv & AUTHORITY_MASK || error != 0) {
|
||||
// goto format_error;
|
||||
// }
|
||||
conv = strtoull(q, &end, 0);
|
||||
if (conv >= (1ULL << 48) || end - q > 15) {
|
||||
/*
|
||||
* This identauth looks like a big number, but resolves to a
|
||||
* small number after rounding.
|
||||
*/
|
||||
goto format_error;
|
||||
}
|
||||
|
||||
/* NOTE - the conv value is in big-endian format. */
|
||||
sidout->id_auth[0] = (conv & 0xff0000000000ULL) >> 40;
|
||||
sidout->id_auth[1] = (conv & 0x00ff00000000ULL) >> 32;
|
||||
sidout->id_auth[2] = (conv & 0x0000ff000000ULL) >> 24;
|
||||
sidout->id_auth[3] = (conv & 0x000000ff0000ULL) >> 16;
|
||||
sidout->id_auth[4] = (conv & 0x00000000ff00ULL) >> 8;
|
||||
sidout->id_auth[5] = (conv & 0x0000000000ffULL);
|
||||
|
||||
/* When identauth >= UINT32_MAX, it's in hex with a leading 0x */
|
||||
/* NOTE - the conv value is in big-endian format. */
|
||||
sidout->id_auth[0] = (conv & 0xff0000000000ULL) >> 40;
|
||||
sidout->id_auth[1] = (conv & 0x00ff00000000ULL) >> 32;
|
||||
sidout->id_auth[2] = (conv & 0x0000ff000000ULL) >> 24;
|
||||
sidout->id_auth[3] = (conv & 0x000000ff0000ULL) >> 16;
|
||||
sidout->id_auth[4] = (conv & 0x00000000ff00ULL) >> 8;
|
||||
sidout->id_auth[5] = (conv & 0x0000000000ffULL);
|
||||
sidout->num_auths = 0;
|
||||
q = end;
|
||||
if (*q != '-') {
|
||||
/* Just id_auth, no subauths */
|
||||
goto done;
|
||||
}
|
||||
|
||||
sidout->num_auths = 0;
|
||||
if (*q != '-') {
|
||||
/* Just id_auth, no subauths */
|
||||
goto done;
|
||||
}
|
||||
q++;
|
||||
|
||||
q++;
|
||||
|
||||
while (true) {
|
||||
char *end;
|
||||
|
||||
if (!isdigit(*q)) {
|
||||
goto format_error;
|
||||
}
|
||||
|
||||
// conv = smb_strtoull(q, &end, 10, &error, SMB_STR_STANDARD);
|
||||
// if (conv > UINT32_MAX || error != 0) {
|
||||
// goto format_error;
|
||||
// }
|
||||
conv = strtoull(q, &end, 10);
|
||||
|
||||
if (!sid_append_rid(sidout, conv)) {
|
||||
while (true) {
|
||||
if (!isdigit((unsigned char)*q)) {
|
||||
goto format_error;
|
||||
}
|
||||
while (q[0] == '0' && isdigit((unsigned char)q[1])) {
|
||||
/*
|
||||
* strtoull will think this is octal, which is not how
|
||||
* SIDs work! So let's walk along until there are no
|
||||
* leading zeros (or a single zero).
|
||||
*/
|
||||
q++;
|
||||
}
|
||||
// conv = smb_strtoull(q, &end, 0, &error, SMB_STR_STANDARD);
|
||||
// if (conv > UINT32_MAX || error != 0 || end - q > 12) {
|
||||
// /*
|
||||
// * This sub-auth is greater than 4294967295,
|
||||
// * and hence invalid. Windows will treat it as
|
||||
// * 4294967295, while we prefer to refuse (old
|
||||
// * versions of Samba will wrap, arriving at
|
||||
// * another number altogether).
|
||||
// */
|
||||
// DBG_NOTICE("bad sub-auth in %s\n", sidstr);
|
||||
// goto format_error;
|
||||
// }
|
||||
conv = strtoull(q, &end, 0);
|
||||
if (!sid_append_rid(sidout, conv)) {
|
||||
// DEBUG(3, ("Too many sid auths in %s\n", sidstr));
|
||||
return false;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
q = end;
|
||||
if (*q != '-') {
|
||||
break;
|
||||
}
|
||||
q += 1;
|
||||
}
|
||||
q = end;
|
||||
if (*q != '-') {
|
||||
break;
|
||||
}
|
||||
q += 1;
|
||||
}
|
||||
done:
|
||||
if (endp != NULL) {
|
||||
*endp = q;
|
||||
}
|
||||
return true;
|
||||
if (endp != NULL) {
|
||||
*endp = q;
|
||||
}
|
||||
return true;
|
||||
|
||||
format_error:
|
||||
// DEBUG(3, ("string_to_sid: SID %s is not in a valid format\n", sidstr));
|
||||
return false;
|
||||
return false;
|
||||
}
|
||||
|
||||
bool string_to_sid(struct dom_sid *sidout, const char *sidstr)
|
||||
{
|
||||
return dom_sid_parse(sidstr, sidout);
|
||||
return dom_sid_parse(sidstr, sidout);
|
||||
}
|
||||
|
||||
bool dom_sid_parse(const char *sidstr, struct dom_sid *ret)
|
||||
{
|
||||
return dom_sid_parse_endp(sidstr, ret, NULL);
|
||||
return dom_sid_parse_endp(sidstr, ret, NULL);
|
||||
}
|
||||
|
||||
/*
|
||||
@ -238,17 +274,17 @@ bool dom_sid_parse(const char *sidstr, struct dom_sid *ret)
|
||||
*/
|
||||
struct dom_sid *dom_sid_parse_talloc(TALLOC_CTX *mem_ctx, const char *sidstr)
|
||||
{
|
||||
struct dom_sid *ret;
|
||||
ret = talloc(mem_ctx, struct dom_sid);
|
||||
if (!ret) {
|
||||
return NULL;
|
||||
}
|
||||
if (!dom_sid_parse(sidstr, ret)) {
|
||||
talloc_free(ret);
|
||||
return NULL;
|
||||
}
|
||||
struct dom_sid *ret;
|
||||
ret = talloc(mem_ctx, struct dom_sid);
|
||||
if (!ret) {
|
||||
return NULL;
|
||||
}
|
||||
if (!dom_sid_parse(sidstr, ret)) {
|
||||
talloc_free(ret);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return ret;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
@ -256,10 +292,10 @@ struct dom_sid *dom_sid_parse_talloc(TALLOC_CTX *mem_ctx, const char *sidstr)
|
||||
*/
|
||||
struct dom_sid *dom_sid_parse_length(TALLOC_CTX *mem_ctx, const DATA_BLOB *sid)
|
||||
{
|
||||
char p[sid->length+1];
|
||||
memcpy(p, sid->data, sid->length);
|
||||
p[sid->length] = '\0';
|
||||
return dom_sid_parse_talloc(mem_ctx, p);
|
||||
char p[sid->length+1];
|
||||
memcpy(p, sid->data, sid->length);
|
||||
p[sid->length] = '\0';
|
||||
return dom_sid_parse_talloc(mem_ctx, p);
|
||||
}
|
||||
|
||||
/*
|
||||
@ -267,32 +303,19 @@ struct dom_sid *dom_sid_parse_length(TALLOC_CTX *mem_ctx, const DATA_BLOB *sid)
|
||||
*/
|
||||
struct dom_sid *dom_sid_dup(TALLOC_CTX *mem_ctx, const struct dom_sid *dom_sid)
|
||||
{
|
||||
struct dom_sid *ret;
|
||||
int i;
|
||||
struct dom_sid *ret;
|
||||
|
||||
if (!dom_sid) {
|
||||
return NULL;
|
||||
}
|
||||
if (!dom_sid) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
ret = talloc(mem_ctx, struct dom_sid);
|
||||
if (!ret) {
|
||||
return NULL;
|
||||
}
|
||||
ret = talloc(mem_ctx, struct dom_sid);
|
||||
if (!ret) {
|
||||
return NULL;
|
||||
}
|
||||
sid_copy(ret, dom_sid);
|
||||
|
||||
ret->sid_rev_num = dom_sid->sid_rev_num;
|
||||
ret->id_auth[0] = dom_sid->id_auth[0];
|
||||
ret->id_auth[1] = dom_sid->id_auth[1];
|
||||
ret->id_auth[2] = dom_sid->id_auth[2];
|
||||
ret->id_auth[3] = dom_sid->id_auth[3];
|
||||
ret->id_auth[4] = dom_sid->id_auth[4];
|
||||
ret->id_auth[5] = dom_sid->id_auth[5];
|
||||
ret->num_auths = dom_sid->num_auths;
|
||||
|
||||
for (i=0;i<dom_sid->num_auths;i++) {
|
||||
ret->sub_auths[i] = dom_sid->sub_auths[i];
|
||||
}
|
||||
|
||||
return ret;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
@ -300,137 +323,174 @@ struct dom_sid *dom_sid_dup(TALLOC_CTX *mem_ctx, const struct dom_sid *dom_sid)
|
||||
returns a new sid in the supplied memory context
|
||||
*/
|
||||
struct dom_sid *dom_sid_add_rid(TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *domain_sid,
|
||||
uint32_t rid)
|
||||
const struct dom_sid *domain_sid,
|
||||
uint32_t rid)
|
||||
{
|
||||
struct dom_sid *sid;
|
||||
struct dom_sid *sid;
|
||||
|
||||
sid = dom_sid_dup(mem_ctx, domain_sid);
|
||||
if (!sid) return NULL;
|
||||
sid = dom_sid_dup(mem_ctx, domain_sid);
|
||||
if (!sid) return NULL;
|
||||
|
||||
if (!sid_append_rid(sid, rid)) {
|
||||
talloc_free(sid);
|
||||
return NULL;
|
||||
}
|
||||
if (!sid_append_rid(sid, rid)) {
|
||||
talloc_free(sid);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return sid;
|
||||
return sid;
|
||||
}
|
||||
|
||||
/*
|
||||
Split up a SID into its domain and RID part
|
||||
*/
|
||||
NTSTATUS dom_sid_split_rid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
|
||||
struct dom_sid **domain, uint32_t *rid)
|
||||
struct dom_sid **domain, uint32_t *rid)
|
||||
{
|
||||
if (sid->num_auths == 0) {
|
||||
return NT_STATUS_INVALID_PARAMETER;
|
||||
}
|
||||
if (sid->num_auths == 0) {
|
||||
return NT_STATUS_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
if (domain) {
|
||||
if (!(*domain = dom_sid_dup(mem_ctx, sid))) {
|
||||
return NT_STATUS_NO_MEMORY;
|
||||
}
|
||||
if (domain) {
|
||||
if (!(*domain = dom_sid_dup(mem_ctx, sid))) {
|
||||
return NT_STATUS_NO_MEMORY;
|
||||
}
|
||||
|
||||
(*domain)->num_auths -= 1;
|
||||
}
|
||||
(*domain)->num_auths -= 1;
|
||||
}
|
||||
|
||||
if (rid) {
|
||||
*rid = sid->sub_auths[sid->num_auths - 1];
|
||||
}
|
||||
if (rid) {
|
||||
*rid = sid->sub_auths[sid->num_auths - 1];
|
||||
}
|
||||
|
||||
return NT_STATUS_OK;
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
/*
|
||||
return true if the 2nd sid is in the domain given by the first sid
|
||||
*/
|
||||
bool dom_sid_in_domain(const struct dom_sid *domain_sid,
|
||||
const struct dom_sid *sid)
|
||||
const struct dom_sid *sid)
|
||||
{
|
||||
int i;
|
||||
int i;
|
||||
|
||||
if (!domain_sid || !sid) {
|
||||
return false;
|
||||
}
|
||||
if (!domain_sid || !sid) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (sid->num_auths < 2) {
|
||||
return false;
|
||||
}
|
||||
if (sid->num_auths < 2) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (domain_sid->num_auths != (sid->num_auths - 1)) {
|
||||
return false;
|
||||
}
|
||||
if (domain_sid->num_auths != (sid->num_auths - 1)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
for (i = domain_sid->num_auths-1; i >= 0; --i) {
|
||||
if (domain_sid->sub_auths[i] != sid->sub_auths[i]) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
for (i = domain_sid->num_auths-1; i >= 0; --i) {
|
||||
if (domain_sid->sub_auths[i] != sid->sub_auths[i]) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return dom_sid_compare_auth(domain_sid, sid) == 0;
|
||||
return dom_sid_compare_auth(domain_sid, sid) == 0;
|
||||
}
|
||||
|
||||
bool dom_sid_has_account_domain(const struct dom_sid *sid)
|
||||
{
|
||||
if (sid == NULL) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (sid->sid_rev_num != 1) {
|
||||
return false;
|
||||
}
|
||||
if (sid->num_auths != 5) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[5] != 5) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[4] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[3] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[2] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[1] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[0] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[0] != 21) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
bool dom_sid_is_valid_account_domain(const struct dom_sid *sid)
|
||||
{
|
||||
/*
|
||||
* We expect S-1-5-21-9-8-7, but we don't
|
||||
* allow S-1-5-21-0-0-0 as this is used
|
||||
* for claims and compound identities.
|
||||
*
|
||||
* With this structure:
|
||||
*
|
||||
* struct dom_sid {
|
||||
* uint8_t sid_rev_num;
|
||||
* int8_t num_auths; [range(0,15)]
|
||||
* uint8_t id_auth[6];
|
||||
* uint32_t sub_auths[15];
|
||||
* }
|
||||
*
|
||||
* S-1-5-21-9-8-7 looks like this:
|
||||
* {1, 4, {0,0,0,0,0,5}, {21,9,8,7,0,0,0,0,0,0,0,0,0,0,0}};
|
||||
*/
|
||||
if (sid == NULL) {
|
||||
return false;
|
||||
}
|
||||
/*
|
||||
* We expect S-1-5-21-9-8-7, but we don't
|
||||
* allow S-1-5-21-0-0-0 as this is used
|
||||
* for claims and compound identities.
|
||||
*
|
||||
* With this structure:
|
||||
*
|
||||
* struct dom_sid {
|
||||
* uint8_t sid_rev_num;
|
||||
* int8_t num_auths; [range(0,15)]
|
||||
* uint8_t id_auth[6];
|
||||
* uint32_t sub_auths[15];
|
||||
* }
|
||||
*
|
||||
* S-1-5-21-9-8-7 looks like this:
|
||||
* {1, 4, {0,0,0,0,0,5}, {21,9,8,7,0,0,0,0,0,0,0,0,0,0,0}};
|
||||
*/
|
||||
if (sid == NULL) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (sid->sid_rev_num != 1) {
|
||||
return false;
|
||||
}
|
||||
if (sid->num_auths != 4) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[5] != 5) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[4] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[3] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[2] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[1] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[0] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[0] != 21) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[1] == 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[2] == 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[3] == 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sid_rev_num != 1) {
|
||||
return false;
|
||||
}
|
||||
if (sid->num_auths != 4) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[5] != 5) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[4] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[3] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[2] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[1] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->id_auth[0] != 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[0] != 21) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[1] == 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[2] == 0) {
|
||||
return false;
|
||||
}
|
||||
if (sid->sub_auths[3] == 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
return true;
|
||||
}
|
||||
|
||||
/*
|
||||
@ -440,48 +500,48 @@ bool dom_sid_is_valid_account_domain(const struct dom_sid *sid)
|
||||
*/
|
||||
static int dom_sid_string_buf(const struct dom_sid *sid, char *buf, int buflen)
|
||||
{
|
||||
int i, ofs, ret;
|
||||
uint64_t ia;
|
||||
int i, ofs, ret;
|
||||
uint64_t ia;
|
||||
|
||||
if (!sid) {
|
||||
return strlcpy(buf, "(NULL SID)", buflen);
|
||||
}
|
||||
if (!sid) {
|
||||
return strlcpy(buf, "(NULL SID)", buflen);
|
||||
}
|
||||
|
||||
ia = ((uint64_t)sid->id_auth[5]) +
|
||||
((uint64_t)sid->id_auth[4] << 8 ) +
|
||||
((uint64_t)sid->id_auth[3] << 16) +
|
||||
((uint64_t)sid->id_auth[2] << 24) +
|
||||
((uint64_t)sid->id_auth[1] << 32) +
|
||||
((uint64_t)sid->id_auth[0] << 40);
|
||||
ia = ((uint64_t)sid->id_auth[5]) +
|
||||
((uint64_t)sid->id_auth[4] << 8 ) +
|
||||
((uint64_t)sid->id_auth[3] << 16) +
|
||||
((uint64_t)sid->id_auth[2] << 24) +
|
||||
((uint64_t)sid->id_auth[1] << 32) +
|
||||
((uint64_t)sid->id_auth[0] << 40);
|
||||
|
||||
ret = snprintf(buf, buflen, "S-%"PRIu8"-", sid->sid_rev_num);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
ofs = ret;
|
||||
ret = snprintf(buf, buflen, "S-%"PRIu8"-", sid->sid_rev_num);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
ofs = ret;
|
||||
|
||||
if (ia >= UINT32_MAX) {
|
||||
ret = snprintf(buf+ofs, MAX(buflen-ofs, 0), "0x%"PRIx64, ia);
|
||||
} else {
|
||||
ret = snprintf(buf+ofs, MAX(buflen-ofs, 0), "%"PRIu64, ia);
|
||||
}
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
ofs += ret;
|
||||
if (ia >= UINT32_MAX) {
|
||||
ret = snprintf(buf+ofs, MAX(buflen-ofs, 0), "0x%"PRIx64, ia);
|
||||
} else {
|
||||
ret = snprintf(buf+ofs, MAX(buflen-ofs, 0), "%"PRIu64, ia);
|
||||
}
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
ofs += ret;
|
||||
|
||||
for (i = 0; i < sid->num_auths; i++) {
|
||||
ret = snprintf(
|
||||
buf+ofs,
|
||||
MAX(buflen-ofs, 0),
|
||||
"-%"PRIu32,
|
||||
sid->sub_auths[i]);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
ofs += ret;
|
||||
}
|
||||
return ofs;
|
||||
for (i = 0; i < sid->num_auths; i++) {
|
||||
ret = snprintf(
|
||||
buf+ofs,
|
||||
MAX(buflen-ofs, 0),
|
||||
"-%"PRIu32,
|
||||
sid->sub_auths[i]);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
ofs += ret;
|
||||
}
|
||||
return ofs;
|
||||
}
|
||||
|
||||
/*
|
||||
@ -489,38 +549,38 @@ static int dom_sid_string_buf(const struct dom_sid *sid, char *buf, int buflen)
|
||||
*/
|
||||
char *dom_sid_string(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
|
||||
{
|
||||
char buf[DOM_SID_STR_BUFLEN];
|
||||
char *result;
|
||||
int len;
|
||||
char buf[DOM_SID_STR_BUFLEN];
|
||||
char *result;
|
||||
int len;
|
||||
|
||||
len = dom_sid_string_buf(sid, buf, sizeof(buf));
|
||||
len = dom_sid_string_buf(sid, buf, sizeof(buf));
|
||||
|
||||
if ((len < 0) || ((size_t) (len+1) > sizeof(buf))) {
|
||||
return talloc_strdup(mem_ctx, "(SID ERR)");
|
||||
}
|
||||
if ((len < 0) || ((size_t)(len+1) > sizeof(buf))) {
|
||||
return talloc_strdup(mem_ctx, "(SID ERR)");
|
||||
}
|
||||
|
||||
/*
|
||||
* Avoid calling strlen (via talloc_strdup), we already have
|
||||
* the length
|
||||
*/
|
||||
result = (char *)talloc_memdup(mem_ctx, buf, len+1);
|
||||
if (result == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
/*
|
||||
* Avoid calling strlen (via talloc_strdup), we already have
|
||||
* the length
|
||||
*/
|
||||
result = (char *)talloc_memdup(mem_ctx, buf, len+1);
|
||||
if (result == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
* beautify the talloc_report output
|
||||
*/
|
||||
talloc_set_name_const(result, result);
|
||||
return result;
|
||||
/*
|
||||
* beautify the talloc_report output
|
||||
*/
|
||||
talloc_set_name_const(result, result);
|
||||
return result;
|
||||
}
|
||||
|
||||
char *dom_sid_str_buf(const struct dom_sid *sid, struct dom_sid_buf *dst)
|
||||
{
|
||||
int ret;
|
||||
ret = dom_sid_string_buf(sid, dst->buf, sizeof(dst->buf));
|
||||
if ((ret < 0) || ((size_t) ret >= sizeof(dst->buf))) {
|
||||
strlcpy(dst->buf, "(INVALID SID)", sizeof(dst->buf));
|
||||
}
|
||||
return dst->buf;
|
||||
int ret;
|
||||
ret = dom_sid_string_buf(sid, dst->buf, sizeof(dst->buf));
|
||||
if ((ret < 0) || ((size_t)(ret) >= sizeof(dst->buf))) {
|
||||
strlcpy(dst->buf, "(INVALID SID)", sizeof(dst->buf));
|
||||
}
|
||||
return dst->buf;
|
||||
}
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
Unix SMB/CIFS implementation.
|
||||
Samba utility functions
|
||||
|
||||
Copyright (C) Stefan (metze) Metzmacher 2002-2004
|
||||
Copyright (C) Andrew Tridgell 1992-2004
|
||||
Copyright (C) Jeremy Allison 1999
|
||||
Copyright (C) Stefan (metze) Metzmacher 2002-2004
|
||||
Copyright (C) Andrew Tridgell 1992-2004
|
||||
Copyright (C) Jeremy Allison 1999
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -32,9 +32,10 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#include "replace.h"
|
||||
#include <talloc.h>
|
||||
#include <util/data_blob.h>
|
||||
#include <gen_ndr/security.h>
|
||||
#include "util/data_blob.h"
|
||||
#include "gen_ndr/security.h"
|
||||
|
||||
/* Some well-known SIDs */
|
||||
extern const struct dom_sid global_sid_World_Domain;
|
||||
@ -45,6 +46,7 @@ extern const struct dom_sid global_sid_NT_Authority;
|
||||
extern const struct dom_sid global_sid_Enterprise_DCs;
|
||||
extern const struct dom_sid global_sid_System;
|
||||
extern const struct dom_sid global_sid_NULL;
|
||||
extern const struct dom_sid global_sid_Self;
|
||||
extern const struct dom_sid global_sid_Authenticated_Users;
|
||||
extern const struct dom_sid global_sid_Network;
|
||||
extern const struct dom_sid global_sid_Asserted_Identity;
|
||||
@ -54,6 +56,8 @@ extern const struct dom_sid global_sid_Creator_Owner;
|
||||
extern const struct dom_sid global_sid_Creator_Group;
|
||||
extern const struct dom_sid global_sid_Owner_Rights;
|
||||
extern const struct dom_sid global_sid_Anonymous;
|
||||
extern const struct dom_sid global_sid_Compounded_Authentication;
|
||||
extern const struct dom_sid global_sid_Claims_Valid;
|
||||
extern const struct dom_sid global_sid_Builtin;
|
||||
extern const struct dom_sid global_sid_Builtin_Administrators;
|
||||
extern const struct dom_sid global_sid_Builtin_Users;
|
||||
@ -72,28 +76,38 @@ extern const struct dom_sid global_sid_Unix_NFS_Users;
|
||||
extern const struct dom_sid global_sid_Unix_NFS_Groups;
|
||||
extern const struct dom_sid global_sid_Unix_NFS_Mode;
|
||||
extern const struct dom_sid global_sid_Unix_NFS_Other;
|
||||
extern const struct dom_sid global_sid_Samba_SMB3;
|
||||
|
||||
extern const struct dom_sid global_sid_Samba_NPA_Flags;
|
||||
#define SAMBA_NPA_FLAGS_NEED_IDLE 1
|
||||
#define SAMBA_NPA_FLAGS_WINBIND_OFF 2
|
||||
|
||||
struct auth_SidAttr;
|
||||
|
||||
bool dom_sid_lookup_is_predefined_domain(const char *domain);
|
||||
|
||||
int dom_sid_compare_auth(const struct dom_sid *sid1,
|
||||
const struct dom_sid *sid2);
|
||||
const struct dom_sid *sid2);
|
||||
int dom_sid_compare(const struct dom_sid *sid1, const struct dom_sid *sid2);
|
||||
int dom_sid_compare_domain(const struct dom_sid *sid1,
|
||||
const struct dom_sid *sid2);
|
||||
const struct dom_sid *sid2);
|
||||
bool dom_sid_equal(const struct dom_sid *sid1, const struct dom_sid *sid2);
|
||||
bool sid_append_rid(struct dom_sid *sid, uint32_t rid);
|
||||
bool string_to_sid(struct dom_sid *sidout, const char *sidstr);
|
||||
bool dom_sid_parse_endp(const char *sidstr,struct dom_sid *sidout,
|
||||
const char **endp);
|
||||
const char **endp);
|
||||
bool dom_sid_parse(const char *sidstr, struct dom_sid *ret);
|
||||
struct dom_sid *dom_sid_parse_talloc(TALLOC_CTX *mem_ctx, const char *sidstr);
|
||||
struct dom_sid *dom_sid_parse_length(TALLOC_CTX *mem_ctx, const DATA_BLOB *sid);
|
||||
struct dom_sid *dom_sid_dup(TALLOC_CTX *mem_ctx, const struct dom_sid *dom_sid);
|
||||
struct dom_sid *dom_sid_add_rid(TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *domain_sid,
|
||||
uint32_t rid);
|
||||
const struct dom_sid *domain_sid,
|
||||
uint32_t rid);
|
||||
NTSTATUS dom_sid_split_rid(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
|
||||
struct dom_sid **domain, uint32_t *rid);
|
||||
struct dom_sid **domain, uint32_t *rid);
|
||||
bool dom_sid_in_domain(const struct dom_sid *domain_sid,
|
||||
const struct dom_sid *sid);
|
||||
const struct dom_sid *sid);
|
||||
bool dom_sid_has_account_domain(const struct dom_sid *sid);
|
||||
bool dom_sid_is_valid_account_domain(const struct dom_sid *sid);
|
||||
|
||||
#define DOM_SID_STR_BUFLEN (15*11+25)
|
||||
@ -110,16 +124,31 @@ bool sid_peek_rid(const struct dom_sid *sid, uint32_t *rid);
|
||||
bool sid_peek_check_rid(const struct dom_sid *exp_dom_sid, const struct dom_sid *sid, uint32_t *rid);
|
||||
void sid_copy(struct dom_sid *dst, const struct dom_sid *src);
|
||||
ssize_t sid_parse(const uint8_t *inbuf, size_t len, struct dom_sid *sid);
|
||||
int sid_compare_domain(const struct dom_sid *sid1, const struct dom_sid *sid2);
|
||||
NTSTATUS add_sid_to_array(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
|
||||
struct dom_sid **sids, uint32_t *num);
|
||||
struct dom_sid **sids, uint32_t *num);
|
||||
NTSTATUS add_sid_to_array_unique(TALLOC_CTX *mem_ctx, const struct dom_sid *sid,
|
||||
struct dom_sid **sids, uint32_t *num_sids);
|
||||
struct dom_sid **sids, uint32_t *num_sids);
|
||||
NTSTATUS add_sid_to_array_attrs(TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *sid, uint32_t attrs,
|
||||
struct auth_SidAttr **sids, uint32_t *num);
|
||||
NTSTATUS add_sid_to_array_attrs_unique(TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *sid, uint32_t attrs,
|
||||
struct auth_SidAttr **sids, uint32_t *num_sids);
|
||||
void del_sid_from_array(const struct dom_sid *sid, struct dom_sid **sids,
|
||||
uint32_t *num);
|
||||
uint32_t *num);
|
||||
bool add_rid_to_array_unique(TALLOC_CTX *mem_ctx,
|
||||
uint32_t rid, uint32_t **pp_rids, size_t *p_num);
|
||||
uint32_t rid, uint32_t **pp_rids, size_t *p_num);
|
||||
bool is_null_sid(const struct dom_sid *sid);
|
||||
bool sids_contains_sid(const struct dom_sid *sids,
|
||||
const uint32_t num_sids,
|
||||
const struct dom_sid *sid);
|
||||
bool sid_attrs_contains_sid(const struct auth_SidAttr *sids,
|
||||
const uint32_t num_sids,
|
||||
const struct dom_sid *sid);
|
||||
bool sids_contains_sid_attrs(const struct auth_SidAttr *sids,
|
||||
const uint32_t num_sids,
|
||||
const struct dom_sid *sid,
|
||||
uint32_t attrs);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user