source4/libcli/security/security_token.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    security descriptor utility functions
   5
   6    Copyright (C) Andrew Tridgell                2004
   7    Copyright (C) Stefan Metzmacher              2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/security/security.h"
  25 #include "auth/session.h"
  26
  27 /*
  28   return a blank security token
  29 */
  30 struct security_token *security_token_initialise(TALLOC_CTX *mem_ctx)
  31 {
  32         struct security_token *st;
  33
  34         st = talloc_zero(mem_ctx, struct security_token);
  35         if (!st) {
  36                 return NULL;
  37         }
  38
  39         return st;
  40 }
  41
  42 /****************************************************************************
  43  prints a struct security_token to debug output.
  44 ****************************************************************************/
  45 void security_token_debug(int dbg_lev, const struct security_token *token)
  46 {
  47         TALLOC_CTX *mem_ctx;
  48         uint32_t i;
  49
  50         if (!token) {
  51                 DEBUG(dbg_lev, ("Security token: (NULL)\n"));
  52                 return;
  53         }
  54
  55         mem_ctx = talloc_init("security_token_debug()");
  56         if (!mem_ctx) {
  57                 return;
  58         }
  59
  60         DEBUG(dbg_lev, ("Security token SIDs (%lu):\n",
  61                                        (unsigned long)token->num_sids));
  62         for (i = 0; i < token->num_sids; i++) {
  63                 DEBUGADD(dbg_lev, ("  SID[%3lu]: %s\n", (unsigned long)i,
  64                            dom_sid_string(mem_ctx, &token->sids[i])));
  65         }
  66
  67         security_token_debug_privileges(dbg_lev, token);
  68
  69         talloc_free(mem_ctx);
  70 }
  71
  72 /* These really should be cheaper... */
  73
  74 bool security_token_is_sid(const struct security_token *token, const struct dom_sid *sid)
  75 {
  76         if (token->sids && dom_sid_equal(&token->sids[PRIMARY_USER_SID_INDEX], sid)) {
  77                 return true;
  78         }
  79         return false;
  80 }
  81
  82 bool security_token_is_sid_string(const struct security_token *token, const char *sid_string)
  83 {
  84         bool ret;
  85         struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
  86         if (!sid) return false;
  87
  88         ret = security_token_is_sid(token, sid);
  89
  90         talloc_free(sid);
  91         return ret;
  92 }
  93
  94 bool security_token_is_system(const struct security_token *token)
  95 {
  96         return security_token_is_sid_string(token, SID_NT_SYSTEM);
  97 }
  98
  99 bool security_token_is_anonymous(const struct security_token *token)
 100 {
 101         return security_token_is_sid_string(token, SID_NT_ANONYMOUS);
 102 }
 103
 104 bool security_token_has_sid(const struct security_token *token, const struct dom_sid *sid)
 105 {
 106         uint32_t i;
 107         for (i = 0; i < token->num_sids; i++) {
 108                 if (dom_sid_equal(&token->sids[i], sid)) {
 109                         return true;
 110                 }
 111         }
 112         return false;
 113 }
 114
 115 bool security_token_has_sid_string(const struct security_token *token, const char *sid_string)
 116 {
 117         bool ret;
 118         struct dom_sid *sid = dom_sid_parse_talloc(NULL, sid_string);
 119         if (!sid) return false;
 120
 121         ret = security_token_has_sid(token, sid);
 122
 123         talloc_free(sid);
 124         return ret;
 125 }
 126
 127 bool security_token_has_builtin_administrators(const struct security_token *token)
 128 {
 129         return security_token_has_sid_string(token, SID_BUILTIN_ADMINISTRATORS);
 130 }
 131
 132 bool security_token_has_nt_authenticated_users(const struct security_token *token)
 133 {
 134         return security_token_has_sid_string(token, SID_NT_AUTHENTICATED_USERS);
 135 }
 136
 137 bool security_token_has_enterprise_dcs(const struct security_token *token)
 138 {
 139         return security_token_has_sid_string(token, SID_NT_ENTERPRISE_DCS);
 140 }
 141
 142 enum security_user_level security_session_user_level(struct auth_session_info *session_info,
 143                                                      const struct dom_sid *domain_sid)
 144 {
 145         if (!session_info) {
 146                 return SECURITY_ANONYMOUS;
 147         }
 148
 149         if (security_token_is_system(session_info->security_token)) {
 150                 return SECURITY_SYSTEM;
 151         }
 152
 153         if (security_token_is_anonymous(session_info->security_token)) {
 154                 return SECURITY_ANONYMOUS;
 155         }
 156
 157         if (security_token_has_builtin_administrators(session_info->security_token)) {
 158                 return SECURITY_ADMINISTRATOR;
 159         }
 160
 161         if (domain_sid) {
 162                 struct dom_sid *rodc_dcs;
 163                 rodc_dcs = dom_sid_add_rid(session_info, domain_sid, DOMAIN_RID_READONLY_DCS);
 164                 if (security_token_has_sid(session_info->security_token, rodc_dcs)) {
 165                         talloc_free(rodc_dcs);
 166                         return SECURITY_RO_DOMAIN_CONTROLLER;
 167                 }
 168                 talloc_free(rodc_dcs);
 169         }
 170
 171         if (security_token_has_enterprise_dcs(session_info->security_token)) {
 172                 return SECURITY_DOMAIN_CONTROLLER;
 173         }
 174
 175         if (security_token_has_nt_authenticated_users(session_info->security_token)) {
 176                 return SECURITY_USER;
 177         }
 178
 179         return SECURITY_ANONYMOUS;
 180 }
 181