Copyright (C) Jeremy Allison 1999
Copyright (C) Stefan (metze) Metzmacher 2002
Copyright (C) Simo Sorce 2002
+ Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
/*
- * Some useful sids
+ * Some useful sids, more well known sids can be found at
+ * http://support.microsoft.com/kb/243330/EN-US/
*/
-DOM_SID global_sid_World_Domain; /* Everyone domain */
-DOM_SID global_sid_World; /* Everyone */
-DOM_SID global_sid_Creator_Owner_Domain; /* Creator Owner domain */
-DOM_SID global_sid_NT_Authority; /* NT Authority */
-DOM_SID global_sid_System; /* System */
-DOM_SID global_sid_NULL; /* NULL sid */
-DOM_SID global_sid_Authenticated_Users; /* All authenticated rids */
-DOM_SID global_sid_Network; /* Network rids */
-
-DOM_SID global_sid_Creator_Owner; /* Creator Owner */
-DOM_SID global_sid_Creator_Group; /* Creator Group */
-DOM_SID global_sid_Anonymous; /* Anonymous login */
-
-DOM_SID global_sid_Builtin; /* Local well-known domain */
-DOM_SID global_sid_Builtin_Administrators; /* Builtin administrators */
-DOM_SID global_sid_Builtin_Users; /* Builtin users */
-DOM_SID global_sid_Builtin_Guests; /* Builtin guest users */
-DOM_SID global_sid_Builtin_Power_Users; /* Builtin power users */
-DOM_SID global_sid_Builtin_Account_Operators; /* Builtin account operators */
-DOM_SID global_sid_Builtin_Server_Operators; /* Builtin server operators */
-DOM_SID global_sid_Builtin_Print_Operators; /* Builtin print operators */
-DOM_SID global_sid_Builtin_Backup_Operators; /* Builtin backup operators */
-DOM_SID global_sid_Builtin_Replicator; /* Builtin replicator */
+const DOM_SID global_sid_World_Domain = /* Everyone domain */
+{ 1, 0, {0,0,0,0,0,1}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_World = /* Everyone */
+{ 1, 1, {0,0,0,0,0,1}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Creator_Owner_Domain = /* Creator Owner domain */
+{ 1, 0, {0,0,0,0,0,3}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_NT_Authority = /* NT Authority */
+{ 1, 0, {0,0,0,0,0,5}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_System = /* System */
+{ 1, 1, {0,0,0,0,0,5}, {18,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_NULL = /* NULL sid */
+{ 1, 1, {0,0,0,0,0,0}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Authenticated_Users = /* All authenticated rids */
+{ 1, 1, {0,0,0,0,0,5}, {11,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+#if 0
+/* for documentation */
+const DOM_SID global_sid_Restriced = /* Restriced Code */
+{ 1, 1, {0,0,0,0,0,5}, {12,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+#endif
+const DOM_SID global_sid_Network = /* Network rids */
+{ 1, 1, {0,0,0,0,0,5}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+
+const DOM_SID global_sid_Creator_Owner = /* Creator Owner */
+{ 1, 1, {0,0,0,0,0,3}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Creator_Group = /* Creator Group */
+{ 1, 1, {0,0,0,0,0,3}, {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Anonymous = /* Anonymous login */
+{ 1, 1, {0,0,0,0,0,5}, {7,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+
+const DOM_SID global_sid_Builtin = /* Local well-known domain */
+{ 1, 1, {0,0,0,0,0,5}, {32,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Administrators = /* Builtin administrators */
+{ 1, 2, {0,0,0,0,0,5}, {32,544,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Users = /* Builtin users */
+{ 1, 2, {0,0,0,0,0,5}, {32,545,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Guests = /* Builtin guest users */
+{ 1, 2, {0,0,0,0,0,5}, {32,546,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Power_Users = /* Builtin power users */
+{ 1, 2, {0,0,0,0,0,5}, {32,547,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Account_Operators = /* Builtin account operators */
+{ 1, 2, {0,0,0,0,0,5}, {32,548,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Server_Operators = /* Builtin server operators */
+{ 1, 2, {0,0,0,0,0,5}, {32,549,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Print_Operators = /* Builtin print operators */
+{ 1, 2, {0,0,0,0,0,5}, {32,550,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Backup_Operators = /* Builtin backup operators */
+{ 1, 2, {0,0,0,0,0,5}, {32,551,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_Replicator = /* Builtin replicator */
+{ 1, 2, {0,0,0,0,0,5}, {32,552,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Builtin_PreWin2kAccess = /* Builtin pre win2k access */
+{ 1, 2, {0,0,0,0,0,5}, {32,554,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+
+const DOM_SID global_sid_Unix_Users = /* Unmapped Unix users */
+{ 1, 1, {0,0,0,0,0,22}, {1,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+const DOM_SID global_sid_Unix_Groups = /* Unmapped Unix groups */
+{ 1, 1, {0,0,0,0,0,22}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
+
+/* Unused, left here for documentary purposes */
+#if 0
#define SECURITY_NULL_SID_AUTHORITY 0
#define SECURITY_WORLD_SID_AUTHORITY 1
#define SECURITY_LOCAL_SID_AUTHORITY 2
#define SECURITY_CREATOR_SID_AUTHORITY 3
#define SECURITY_NT_AUTHORITY 5
+#endif
/*
* An NT compatible anonymous token.
*/
-static DOM_SID anon_sid_array[3];
+static DOM_SID anon_sid_array[3] =
+{ { 1, 1, {0,0,0,0,0,1}, {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
+ { 1, 1, {0,0,0,0,0,5}, {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0}},
+ { 1, 1, {0,0,0,0,0,5}, {7,0,0,0,0,0,0,0,0,0,0,0,0,0,0}} };
+NT_USER_TOKEN anonymous_token = { 3, anon_sid_array, SE_NONE };
-NT_USER_TOKEN anonymous_token = {
- 3,
- anon_sid_array
-};
-
-static DOM_SID system_sid_array[4];
-NT_USER_TOKEN system_token = {
- 1,
- system_sid_array
-};
+static DOM_SID system_sid_array[1] =
+{ { 1, 1, {0,0,0,0,0,5}, {18,0,0,0,0,0,0,0,0,0,0,0,0,0,0}} };
+NT_USER_TOKEN system_token = { 1, system_sid_array, SE_ALL_PRIVS };
/****************************************************************************
Lookup string names for SID types.
****************************************************************************/
static const struct {
- enum SID_NAME_USE sid_type;
+ enum lsa_SidType sid_type;
const char *string;
} sid_name_type[] = {
{SID_NAME_USER, "User"},
{SID_NAME_UNKNOWN, "UNKNOWN"},
{SID_NAME_COMPUTER, "Computer"},
- {(enum SID_NAME_USE)0, NULL}
+ {(enum lsa_SidType)0, NULL}
};
const char *sid_type_lookup(uint32 sid_type)
return "SID *TYPE* is INVALID";
}
-/****************************************************************************
- Creates some useful well known sids
-****************************************************************************/
-
-void generate_wellknown_sids(void)
-{
- static BOOL initialised = False;
-
- if (initialised)
- return;
-
- /* SECURITY_NULL_SID_AUTHORITY */
- string_to_sid(&global_sid_NULL, "S-1-0-0");
-
- /* SECURITY_WORLD_SID_AUTHORITY */
- string_to_sid(&global_sid_World_Domain, "S-1-1");
- string_to_sid(&global_sid_World, "S-1-1-0");
-
- /* SECURITY_CREATOR_SID_AUTHORITY */
- string_to_sid(&global_sid_Creator_Owner_Domain, "S-1-3");
- string_to_sid(&global_sid_Creator_Owner, "S-1-3-0");
- string_to_sid(&global_sid_Creator_Group, "S-1-3-1");
-
- /* SECURITY_NT_AUTHORITY */
- string_to_sid(&global_sid_NT_Authority, "S-1-5");
- string_to_sid(&global_sid_Network, "S-1-5-2");
- string_to_sid(&global_sid_Anonymous, "S-1-5-7");
- string_to_sid(&global_sid_Authenticated_Users, "S-1-5-11");
- string_to_sid(&global_sid_System, "S-1-5-18");
-
- /* SECURITY_BUILTIN_DOMAIN_RID */
- string_to_sid(&global_sid_Builtin, "S-1-5-32");
- string_to_sid(&global_sid_Builtin_Administrators, "S-1-5-32-544");
- string_to_sid(&global_sid_Builtin_Users, "S-1-5-32-545");
- string_to_sid(&global_sid_Builtin_Guests, "S-1-5-32-546");
- string_to_sid(&global_sid_Builtin_Power_Users, "S-1-5-32-547");
- string_to_sid(&global_sid_Builtin_Account_Operators, "S-1-5-32-548");
- string_to_sid(&global_sid_Builtin_Server_Operators, "S-1-5-32-549");
- string_to_sid(&global_sid_Builtin_Print_Operators, "S-1-5-32-550");
- string_to_sid(&global_sid_Builtin_Backup_Operators, "S-1-5-32-551");
- string_to_sid(&global_sid_Builtin_Replicator, "S-1-5-32-552");
-
- /* Create the anon token. */
- sid_copy( &anonymous_token.user_sids[0], &global_sid_World);
- sid_copy( &anonymous_token.user_sids[1], &global_sid_Network);
- sid_copy( &anonymous_token.user_sids[2], &global_sid_Anonymous);
-
- /* Create the system token. */
- sid_copy( &system_token.user_sids[0], &global_sid_System);
-
- initialised = True;
-}
-
/**************************************************************************
Create the SYSTEM token.
***************************************************************************/
NT_USER_TOKEN *get_system_token(void)
{
- generate_wellknown_sids(); /* The token is initialised here */
return &system_token;
}
-/**************************************************************************
- Splits a name of format \DOMAIN\name or name into its two components.
- Sets the DOMAIN name to global_myname() if it has not been specified.
-***************************************************************************/
+/******************************************************************
+ get the default domain/netbios name to be used when dealing
+ with our passdb list of accounts
+******************************************************************/
-void split_domain_name(const char *fullname, char *domain, char *name)
+const char *get_global_sam_name(void)
{
- pstring full_name;
- const char *sep;
- char *p;
-
- sep = lp_winbind_separator();
-
- *domain = *name = '\0';
-
- if (fullname[0] == sep[0] || fullname[0] == '\\')
- fullname++;
-
- pstrcpy(full_name, fullname);
- p = strchr_m(full_name+1, '\\');
- if (!p) p = strchr_m(full_name+1, sep[0]);
-
- if (p != NULL) {
- *p = 0;
- fstrcpy(domain, full_name);
- fstrcpy(name, p+1);
- } else {
- fstrcpy(domain, global_myname());
- fstrcpy(name, full_name);
+ if ((lp_server_role() == ROLE_DOMAIN_PDC) || (lp_server_role() == ROLE_DOMAIN_BDC)) {
+ return lp_workgroup();
}
-
- DEBUG(10,("split_domain_name:name '%s' split into domain :'%s' and user :'%s'\n",
- fullname, domain, name));
-}
-
-/****************************************************************************
- Test if a SID is wellknown and resolvable.
-****************************************************************************/
-
-BOOL resolvable_wellknown_sid(DOM_SID *sid)
-{
- uint32 ia = (sid->id_auth[5]) +
- (sid->id_auth[4] << 8 ) +
- (sid->id_auth[3] << 16) +
- (sid->id_auth[2] << 24);
-
- if (sid->sid_rev_num != SEC_DESC_REVISION || sid->num_auths < 1)
- return False;
-
- return (ia == SECURITY_WORLD_SID_AUTHORITY ||
- ia == SECURITY_CREATOR_SID_AUTHORITY);
+ return global_myname();
}
/*****************************************************************
return sid_str;
}
+char *sid_string_talloc(TALLOC_CTX *mem_ctx, const DOM_SID *sid)
+{
+ fstring sid_str;
+ char *result;
+ sid_to_string(sid_str, sid);
+ result = talloc_strdup(mem_ctx, sid_str);
+ SMB_ASSERT(result != NULL);
+ return result;
+}
+
+char *sid_string_dbg(const DOM_SID *sid)
+{
+ return sid_string_talloc(debug_ctx(), sid);
+}
+
+char *sid_string_tos(const DOM_SID *sid)
+{
+ return sid_string_talloc(talloc_tos(), sid);
+}
+
/*****************************************************************
Convert a string to a SID. Returns True on success, False on fail.
*****************************************************************/
-BOOL string_to_sid(DOM_SID *sidout, const char *sidstr)
+bool string_to_sid(DOM_SID *sidout, const char *sidstr)
{
- pstring tok;
- char *q;
const char *p;
+ char *q;
/* BIG NOTE: this function only does SIDS where the identauth is not >= 2^32 */
- uint32 ia;
+ uint32 conv;
- if (StrnCaseCmp( sidstr, "S-", 2)) {
- DEBUG(0,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr));
+ if ((sidstr[0] != 'S' && sidstr[0] != 's') || sidstr[1] != '-') {
+ DEBUG(3,("string_to_sid: Sid %s does not start with 'S-'.\n", sidstr));
return False;
}
- memset((char *)sidout, '\0', sizeof(DOM_SID));
+ ZERO_STRUCTP(sidout);
- p = q = strdup(sidstr + 2);
- if (p == NULL) {
- DEBUG(0, ("string_to_sid: out of memory!\n"));
- return False;
- }
-
- if (!next_token(&p, tok, "-", sizeof(tok))) {
- DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr));
- SAFE_FREE(q);
+ /* Get the revision number. */
+ p = sidstr + 2;
+ conv = (uint32) strtoul(p, &q, 10);
+ if (!q || (*q != '-')) {
+ DEBUG(3,("string_to_sid: Sid %s is not in a valid format.\n", sidstr));
return False;
}
+ sidout->sid_rev_num = (uint8) conv;
+ q++;
- /* Get the revision number. */
- sidout->sid_rev_num = (uint8)strtoul(tok, NULL, 10);
-
- if (!next_token(&p, tok, "-", sizeof(tok))) {
+ /* get identauth */
+ conv = (uint32) strtoul(q, &q, 10);
+ if (!q || (*q != '-')) {
DEBUG(0,("string_to_sid: Sid %s is not in a valid format.\n", sidstr));
- SAFE_FREE(q);
return False;
}
-
/* identauth in decimal should be < 2^32 */
- ia = (uint32)strtoul(tok, NULL, 10);
-
- /* NOTE - the ia value is in big-endian format. */
+ /* NOTE - the conv value is in big-endian format. */
sidout->id_auth[0] = 0;
sidout->id_auth[1] = 0;
- sidout->id_auth[2] = (ia & 0xff000000) >> 24;
- sidout->id_auth[3] = (ia & 0x00ff0000) >> 16;
- sidout->id_auth[4] = (ia & 0x0000ff00) >> 8;
- sidout->id_auth[5] = (ia & 0x000000ff);
+ sidout->id_auth[2] = (conv & 0xff000000) >> 24;
+ sidout->id_auth[3] = (conv & 0x00ff0000) >> 16;
+ sidout->id_auth[4] = (conv & 0x0000ff00) >> 8;
+ sidout->id_auth[5] = (conv & 0x000000ff);
+ q++;
sidout->num_auths = 0;
- while(next_token(&p, tok, "-", sizeof(tok)) &&
- sidout->num_auths < MAXSUBAUTHS) {
- /*
- * NOTE - the subauths are in native machine-endian format. They
- * are converted to little-endian when linearized onto the wire.
- */
- sid_append_rid(sidout, (uint32)strtoul(tok, NULL, 10));
+ for(conv = (uint32) strtoul(q, &q, 10);
+ q && (*q =='-' || *q =='\0') && (sidout->num_auths < MAXSUBAUTHS);
+ conv = (uint32) strtoul(q, &q, 10)) {
+ sid_append_rid(sidout, conv);
+ if (*q == '\0')
+ break;
+ q++;
}
-
- SAFE_FREE(q);
+
return True;
}
+DOM_SID *string_sid_talloc(TALLOC_CTX *mem_ctx, const char *sidstr)
+{
+ DOM_SID *result = TALLOC_P(mem_ctx, DOM_SID);
+
+ if (result == NULL)
+ return NULL;
+
+ if (!string_to_sid(result, sidstr))
+ return NULL;
+
+ return result;
+}
+
/*****************************************************************
Add a rid to the end of a sid
*****************************************************************/
-BOOL sid_append_rid(DOM_SID *sid, uint32 rid)
+bool sid_append_rid(DOM_SID *sid, uint32 rid)
{
if (sid->num_auths < MAXSUBAUTHS) {
sid->sub_auths[sid->num_auths++] = rid;
return False;
}
+bool sid_compose(DOM_SID *dst, const DOM_SID *domain_sid, uint32 rid)
+{
+ sid_copy(dst, domain_sid);
+ return sid_append_rid(dst, rid);
+}
+
/*****************************************************************
Removes the last rid from the end of a sid
*****************************************************************/
-BOOL sid_split_rid(DOM_SID *sid, uint32 *rid)
+bool sid_split_rid(DOM_SID *sid, uint32 *rid)
{
if (sid->num_auths > 0) {
sid->num_auths--;
Return the last rid from the end of a sid
*****************************************************************/
-BOOL sid_peek_rid(const DOM_SID *sid, uint32 *rid)
+bool sid_peek_rid(const DOM_SID *sid, uint32 *rid)
{
if (!sid || !rid)
return False;
and check the sid against the exp_dom_sid
*****************************************************************/
-BOOL sid_peek_check_rid(const DOM_SID *exp_dom_sid, const DOM_SID *sid, uint32 *rid)
+bool sid_peek_check_rid(const DOM_SID *exp_dom_sid, const DOM_SID *sid, uint32 *rid)
{
if (!exp_dom_sid || !sid || !rid)
return False;
Write a sid out into on-the-wire format.
*****************************************************************/
-BOOL sid_linearize(char *outbuf, size_t len, const DOM_SID *sid)
+bool sid_linearize(char *outbuf, size_t len, const DOM_SID *sid)
{
size_t i;
Parse a on-the-wire SID to a DOM_SID.
*****************************************************************/
-BOOL sid_parse(const char *inbuf, size_t len, DOM_SID *sid)
+bool sid_parse(const char *inbuf, size_t len, DOM_SID *sid)
{
int i;
if (len < 8)
Compare two sids.
*****************************************************************/
-BOOL sid_equal(const DOM_SID *sid1, const DOM_SID *sid2)
+bool sid_equal(const DOM_SID *sid1, const DOM_SID *sid2)
{
return sid_compare(sid1, sid2) == 0;
}
-/*****************************************************************
- Check if the SID is the builtin SID (S-1-5-32).
-*****************************************************************/
-
-BOOL sid_check_is_builtin(const DOM_SID *sid)
-{
- return sid_equal(sid, &global_sid_Builtin);
-}
-
-/*****************************************************************
- Check if the SID is one of the builtin SIDs (S-1-5-32-a).
-*****************************************************************/
-
-BOOL sid_check_is_in_builtin(const DOM_SID *sid)
-{
- DOM_SID dom_sid;
- uint32 rid;
-
- sid_copy(&dom_sid, sid);
- sid_split_rid(&dom_sid, &rid);
-
- return sid_equal(&dom_sid, &global_sid_Builtin);
-}
-
/*****************************************************************
Calculates size of a sid.
*****************************************************************/
Returns true if SID is internal (and non-mappable).
*****************************************************************/
-BOOL non_mappable_sid(DOM_SID *sid)
+bool non_mappable_sid(DOM_SID *sid)
{
DOM_SID dom;
uint32 rid;
{
char *buf, *s;
int len = sid_size(sid);
- buf = malloc(len);
+ buf = (char *)SMB_MALLOC(len);
if (!buf)
return NULL;
sid_linearize(buf, len, sid);
- s = binary_string(buf, len);
+ s = binary_string_rfc2254(buf, len);
free(buf);
return s;
}
-
/*****************************************************************
- Print a GUID structure for debugging.
+ Return the binary string representation of a DOM_SID.
+ Caller must free.
*****************************************************************/
-void print_guid(GUID *guid)
+char *sid_binstring_hex(const DOM_SID *sid)
{
- int i;
-
- d_printf("%08x-%04x-%04x",
- IVAL(guid->info, 0), SVAL(guid->info, 4), SVAL(guid->info, 6));
- d_printf("-%02x%02x-", guid->info[8], guid->info[9]);
- for (i=10;i<GUID_SIZE;i++)
- d_printf("%02x", guid->info[i]);
- d_printf("\n");
+ char *buf, *s;
+ int len = sid_size(sid);
+ buf = (char *)SMB_MALLOC(len);
+ if (!buf)
+ return NULL;
+ sid_linearize(buf, len, sid);
+ s = binary_string(buf, len);
+ free(buf);
+ return s;
}
/*******************************************************************
Tallocs a duplicate SID.
********************************************************************/
-DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, DOM_SID *src)
+DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, const DOM_SID *src)
{
DOM_SID *dst;
if(!src)
return NULL;
- if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) {
+ if((dst = TALLOC_ZERO_P(ctx, DOM_SID)) != NULL) {
sid_copy( dst, src);
}
return dst;
}
+
+/********************************************************************
+ Add SID to an array SIDs
+********************************************************************/
+
+bool add_sid_to_array(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
+ DOM_SID **sids, size_t *num)
+{
+ *sids = TALLOC_REALLOC_ARRAY(mem_ctx, *sids, DOM_SID,
+ (*num)+1);
+ if (*sids == NULL) {
+ *num = 0;
+ return False;
+ }
+
+ sid_copy(&((*sids)[*num]), sid);
+ *num += 1;
+
+ return True;
+}
+
+
+/********************************************************************
+ Add SID to an array SIDs ensuring that it is not already there
+********************************************************************/
+
+bool add_sid_to_array_unique(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
+ DOM_SID **sids, size_t *num_sids)
+{
+ size_t i;
+
+ for (i=0; i<(*num_sids); i++) {
+ if (sid_compare(sid, &(*sids)[i]) == 0)
+ return True;
+ }
+
+ return add_sid_to_array(mem_ctx, sid, sids, num_sids);
+}
+
+/********************************************************************
+ Remove SID from an array
+********************************************************************/
+
+void del_sid_from_array(const DOM_SID *sid, DOM_SID **sids, size_t *num)
+{
+ DOM_SID *sid_list = *sids;
+ size_t i;
+
+ for ( i=0; i<*num; i++ ) {
+
+ /* if we find the SID, then decrement the count
+ and break out of the loop */
+
+ if ( sid_equal(sid, &sid_list[i]) ) {
+ *num -= 1;
+ break;
+ }
+ }
+
+ /* This loop will copy the remainder of the array
+ if i < num of sids ni the array */
+
+ for ( ; i<*num; i++ )
+ sid_copy( &sid_list[i], &sid_list[i+1] );
+
+ return;
+}
+
+bool add_rid_to_array_unique(TALLOC_CTX *mem_ctx,
+ uint32 rid, uint32 **pp_rids, size_t *p_num)
+{
+ size_t i;
+
+ for (i=0; i<*p_num; i++) {
+ if ((*pp_rids)[i] == rid)
+ return True;
+ }
+
+ *pp_rids = TALLOC_REALLOC_ARRAY(mem_ctx, *pp_rids, uint32, *p_num+1);
+
+ if (*pp_rids == NULL) {
+ *p_num = 0;
+ return False;
+ }
+
+ (*pp_rids)[*p_num] = rid;
+ *p_num += 1;
+ return True;
+}
+
+bool is_null_sid(const DOM_SID *sid)
+{
+ static const DOM_SID null_sid = {0};
+ return sid_equal(sid, &null_sid);
+}
+
+NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
+ const NET_USER_INFO_3 *info3,
+ DOM_SID **user_sids,
+ size_t *num_user_sids,
+ bool include_user_group_rid)
+{
+ DOM_SID sid;
+ DOM_SID *sid_array = NULL;
+ size_t num_sids = 0;
+ int i;
+
+ if (include_user_group_rid) {
+
+ if (!sid_compose(&sid, &(info3->dom_sid.sid),
+ info3->user_rid)
+ || !add_sid_to_array(mem_ctx, &sid,
+ &sid_array, &num_sids)) {
+ DEBUG(3,("could not add user SID from rid 0x%x\n",
+ info3->user_rid));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (!sid_compose(&sid, &(info3->dom_sid.sid),
+ info3->group_rid)
+ || !add_sid_to_array(mem_ctx, &sid,
+ &sid_array, &num_sids)) {
+ DEBUG(3,("could not append additional group rid 0x%x\n",
+ info3->group_rid));
+
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ }
+
+ for (i = 0; i < info3->num_groups2; i++) {
+ if (!sid_compose(&sid, &(info3->dom_sid.sid),
+ info3->gids[i].g_rid)
+ || !add_sid_to_array(mem_ctx, &sid,
+ &sid_array, &num_sids)) {
+ DEBUG(3,("could not append additional group rid 0x%x\n",
+ info3->gids[i].g_rid));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ }
+
+ /* Copy 'other' sids. We need to do sid filtering here to
+ prevent possible elevation of privileges. See:
+
+ http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
+ */
+
+ for (i = 0; i < info3->num_other_sids; i++) {
+ if (!add_sid_to_array(mem_ctx, &info3->other_sids[i].sid,
+ &sid_array, &num_sids)) {
+ DEBUG(3, ("could not add SID to array: %s\n",
+ sid_string_dbg(&info3->other_sids[i].sid)));
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+
+ *user_sids = sid_array;
+ *num_user_sids = num_sids;
+
+ return NT_STATUS_OK;
+}
git.samba.org / samba.git / blobdiff