sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code
7be535315a
samba-mirror/libcli/security/claims-conversions.h

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

61 lines
2.1 KiB
C
Raw Normal View History

libcli:security: helpers for converting claim types There are three different forms for claims, and we need to convert between them. For now, we are only going to be converting between conditional ACE type and the CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 type used by resource ACEs and in the security token, and later we will add the PAC claim types. It doesn't help that these all have incompatible definitions, but we do our best. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-29 06:16:20 +03:00
/*
* Unix SMB implementation.
* Utility functions for converting between claims formats.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
libcli/security: Add header guard Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:45:35 +03:00
#ifndef LIBCLI_SECURITY_CLAIMS_CONVERSIONS_H
#define LIBCLI_SECURITY_CLAIMS_CONVERSIONS_H
libcli:security: helpers for converting claim types There are three different forms for claims, and we need to convert between them. For now, we are only going to be converting between conditional ACE type and the CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 type used by resource ACEs and in the security token, and later we will add the PAC claim types. It doesn't help that these all have incompatible definitions, but we do our best. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-29 06:16:20 +03:00
libcli/security: Add some missing declarations so that users of this header file don’t have to declare them. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:46:33 +03:00
#include "replace.h"
#include <talloc.h>
libcli/security: Add function to convert token claims to security attribute claims Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-21 06:16:20 +03:00
#include "libcli/util/ntstatus.h"
libcli/security: Add some missing declarations so that users of this header file don’t have to declare them. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:46:33 +03:00
libcli/security: Add function to convert token claims to security attribute claims Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-21 06:16:20 +03:00
struct CLAIMS_SET;
libcli/security: Add some missing declarations so that users of this header file don’t have to declare them. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:46:33 +03:00
struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1;
struct ace_condition_token;
struct security_token;
libcli:security: helpers for converting claim types There are three different forms for claims, and we need to convert between them. For now, we are only going to be converting between conditional ACE type and the CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 type used by resource ACEs and in the security token, and later we will add the PAC claim types. It doesn't help that these all have incompatible definitions, but we do our best. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-29 06:16:20 +03:00
bool claim_v1_to_ace_token(TALLOC_CTX *mem_ctx,
const struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *claim,
struct ace_condition_token *result);
bool ace_token_to_claim_v1(TALLOC_CTX *mem_ctx,
const char *name,
libcli/security: Const‐qualify function parameters Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:44:49 +03:00
const struct ace_condition_token *tok,
libcli:security: helpers for converting claim types There are three different forms for claims, and we need to convert between them. For now, we are only going to be converting between conditional ACE type and the CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 type used by resource ACEs and in the security token, and later we will add the PAC claim types. It doesn't help that these all have incompatible definitions, but we do our best. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-29 06:16:20 +03:00
struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 **claim,
uint32_t flags);
bool add_claim_to_token(TALLOC_CTX *mem_ctx,
struct security_token *token,
libcli/security: Const‐qualify function parameters Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:44:49 +03:00
const struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *claim,
libcli:security: helpers for converting claim types There are three different forms for claims, and we need to convert between them. For now, we are only going to be converting between conditional ACE type and the CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 type used by resource ACEs and in the security token, and later we will add the PAC claim types. It doesn't help that these all have incompatible definitions, but we do our best. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-29 06:16:20 +03:00
const char *claim_type);
libcli/security: Add header guard Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:45:35 +03:00
libcli/security: Add function to convert token claims to security attribute claims Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-21 06:16:20 +03:00
NTSTATUS token_claims_to_claims_v1(TALLOC_CTX *mem_ctx,
const struct CLAIMS_SET *claims_set,
struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 **out_claims,
uint32_t *out_n_claims);
libcli/security: separate out claim_v1_to_ace_composite_unchecked() For SDDL Resource ACE conversions we don't want to check too much claim validity so that a semi-invalid ACE can round-trip through deserialisation and serialisation. This is because Windows allows it, but also because if the check puts the values in a sorted order that makes the round-trip less round (that is, the return string is semantically the same but possibly different in byte order). The validity we're talking about is mostly uniqueness. For example `S:(RA;;;;;WD;("foo",TU,0,7,5,7))` has two 7s, and that would be invalid as a claim, but this is not checked while in ACE form. On the other hand `S:(RA;;;;;WD;("foo",TU,0,3,2))` is valid, but the return string will have 3 and 2 reversed when the check is made. We prefer the ACE to stay the same while it is just being an ACE. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-17 03:58:12 +03:00
bool claim_v1_to_ace_composite_unchecked(TALLOC_CTX *mem_ctx,
const struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *claim,
struct ace_condition_token *result);
libcli/security: begin claim_v1_check_and_sort with Boolean checks claim_v1_check_and_sort() is meant to sort the claim values and check that there are no duplicates, as well as making some value checks. In order to ease into the idea, we look first at the case where the claim has Boolean values. There are only two values allowed, which limits the length of a valid claim set and means we only really need to "sort" in the {1, 0} case, which we rewrite in place as {0, 1}. That's what will happen with other types: we'll sort in-place, make some checks on values, set flags, and return an error if there are duplicates or value errors. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-22 01:07:29 +03:00
NTSTATUS claim_v1_check_and_sort(
TALLOC_CTX *mem_ctx,
struct CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *claim,
bool case_sensitive);
libcli/security: Add header guard Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-20 06:45:35 +03:00
#endif /* LIBCLI_SECURITY_CLAIMS_CONVERSIONS_H */
Copy Permalink