import HEAD into svn+ssh://svn.samba.org/home/svn/samba/trunk
[metze/old/v3-2-winbind-ndr.git] / source / passdb / util_sam_sid.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Samba utility functions
4    Copyright (C) Andrew Tridgell 1992-1998
5    Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6    Copyright (C) Jeremy Allison  1999
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 2 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program; if not, write to the Free Software
20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21 */
22
23 #include "includes.h"
24
25 #define MAX_SID_NAMES   7
26
27 typedef struct _known_sid_users {
28         uint32 rid;
29         enum SID_NAME_USE sid_name_use;
30         const char *known_user_name;
31 } known_sid_users;
32
33 static struct sid_name_map_info
34 {
35         DOM_SID *sid;
36         const char *name;
37         const known_sid_users *known_users;
38 } sid_name_map[MAX_SID_NAMES];
39
40 extern DOM_SID global_sid_Builtin;                              /* Local well-known domain */
41 extern DOM_SID global_sid_World_Domain;         /* Everyone domain */
42 extern DOM_SID global_sid_Creator_Owner_Domain;    /* Creator Owner domain */
43 extern DOM_SID global_sid_NT_Authority;                 /* NT Authority */
44
45
46 static BOOL sid_name_map_initialized = False;
47 /* static known_sid_users no_users[] = {{0, 0, NULL}}; */
48
49 static const known_sid_users everyone_users[] = {
50         { 0, SID_NAME_WKN_GRP, "Everyone" },
51         {0, (enum SID_NAME_USE)0, NULL}};
52
53 static const known_sid_users creator_owner_users[] = {
54         { 0, SID_NAME_WKN_GRP, "Creator Owner" },
55         { 1, SID_NAME_WKN_GRP, "Creator Group" },
56         {0, (enum SID_NAME_USE)0, NULL}};
57
58 static const known_sid_users nt_authority_users[] = {
59         {  1, SID_NAME_ALIAS, "Dialup" },
60         {  2, SID_NAME_ALIAS, "Network"},
61         {  3, SID_NAME_ALIAS, "Batch"},
62         {  4, SID_NAME_ALIAS, "Interactive"},
63         {  6, SID_NAME_ALIAS, "Service"},
64         {  7, SID_NAME_ALIAS, "AnonymousLogon"},
65         {  8, SID_NAME_ALIAS, "Proxy"},
66         {  9, SID_NAME_ALIAS, "ServerLogon"},
67         { 11, SID_NAME_ALIAS, "Authenticated Users"},
68         { 18, SID_NAME_ALIAS, "SYSTEM"},
69         {  0, (enum SID_NAME_USE)0, NULL}};
70
71 static const known_sid_users builtin_groups[] = {
72         { BUILTIN_ALIAS_RID_ADMINS, SID_NAME_ALIAS, "Administrators" },
73         { BUILTIN_ALIAS_RID_USERS, SID_NAME_ALIAS, "Users" },
74         { BUILTIN_ALIAS_RID_GUESTS, SID_NAME_ALIAS, "Guests" },
75         { BUILTIN_ALIAS_RID_POWER_USERS, SID_NAME_ALIAS, "Power Users" },
76         { BUILTIN_ALIAS_RID_ACCOUNT_OPS, SID_NAME_ALIAS, "Account Operators" },
77         { BUILTIN_ALIAS_RID_SYSTEM_OPS, SID_NAME_ALIAS, "Server Operators" },
78         { BUILTIN_ALIAS_RID_PRINT_OPS, SID_NAME_ALIAS, "Print Operators" },
79         { BUILTIN_ALIAS_RID_BACKUP_OPS, SID_NAME_ALIAS, "Backup Operators" },
80         { BUILTIN_ALIAS_RID_REPLICATOR, SID_NAME_ALIAS, "Replicator" },
81         { BUILTIN_ALIAS_RID_RAS_SERVERS, SID_NAME_ALIAS, "RAS Servers" },
82         { BUILTIN_ALIAS_RID_PRE_2K_ACCESS, SID_NAME_ALIAS, "Pre-Windows 2000 Compatible Access" },
83         {  0, (enum SID_NAME_USE)0, NULL}};
84
85 /**************************************************************************
86  Quick init function.
87 *************************************************************************/
88
89 static void init_sid_name_map (void)
90 {
91         int i = 0;
92         
93         if (sid_name_map_initialized) return;
94
95         generate_wellknown_sids();
96
97         if ((lp_security() == SEC_USER) && lp_domain_logons()) {
98                 sid_name_map[i].sid = get_global_sam_sid();
99                 /* This is not lp_workgroup() for good reason:
100                    it must stay around longer than the lp_*() 
101                    strings do */
102                 sid_name_map[i].name = strdup(lp_workgroup());
103                 sid_name_map[i].known_users = NULL;
104                 i++;
105                 sid_name_map[i].sid = get_global_sam_sid();
106                 sid_name_map[i].name = strdup(global_myname());
107                 sid_name_map[i].known_users = NULL;
108                 i++;
109         } else {
110                 sid_name_map[i].sid = get_global_sam_sid();
111                 sid_name_map[i].name = strdup(global_myname());
112                 sid_name_map[i].known_users = NULL;
113                 i++;
114         }
115
116         sid_name_map[i].sid = &global_sid_Builtin;
117         sid_name_map[i].name = "BUILTIN";
118         sid_name_map[i].known_users = &builtin_groups[0];
119         i++;
120         
121         sid_name_map[i].sid = &global_sid_World_Domain;
122         sid_name_map[i].name = "";
123         sid_name_map[i].known_users = &everyone_users[0];
124         i++;
125
126         sid_name_map[i].sid = &global_sid_Creator_Owner_Domain;
127         sid_name_map[i].name = "";
128         sid_name_map[i].known_users = &creator_owner_users[0];
129         i++;
130                 
131         sid_name_map[i].sid = &global_sid_NT_Authority;
132         sid_name_map[i].name = "NT Authority";
133         sid_name_map[i].known_users = &nt_authority_users[0];
134         i++;
135                 
136         /* End of array. */
137         sid_name_map[i].sid = NULL;
138         sid_name_map[i].name = NULL;
139         sid_name_map[i].known_users = NULL;
140         
141         sid_name_map_initialized = True;
142                 
143         return;
144 }
145
146 /**************************************************************************
147  Turns a domain SID into a name, returned in the nt_domain argument.
148 ***************************************************************************/
149
150 BOOL map_domain_sid_to_name(DOM_SID *sid, fstring nt_domain)
151 {
152         fstring sid_str;
153         int i = 0;
154         
155         sid_to_string(sid_str, sid);
156
157         if (!sid_name_map_initialized) 
158                 init_sid_name_map();
159
160         DEBUG(5,("map_domain_sid_to_name: %s\n", sid_str));
161
162         if (nt_domain == NULL)
163                 return False;
164
165         while (sid_name_map[i].sid != NULL) {
166                 sid_to_string(sid_str, sid_name_map[i].sid);
167                 DEBUG(5,("map_domain_sid_to_name: compare: %s\n", sid_str));
168                 if (sid_equal(sid_name_map[i].sid, sid)) {              
169                         fstrcpy(nt_domain, sid_name_map[i].name);
170                         DEBUG(5,("map_domain_sid_to_name: found '%s'\n", nt_domain));
171                         return True;
172                 }
173                 i++;
174         }
175
176         DEBUG(5,("map_domain_sid_to_name: mapping for %s not found\n", sid_str));
177
178     return False;
179 }
180
181 /**************************************************************************
182  Looks up a known username from one of the known domains.
183 ***************************************************************************/
184
185 BOOL lookup_known_rid(DOM_SID *sid, uint32 rid, char *name, enum SID_NAME_USE *psid_name_use)
186 {
187         int i = 0;
188         struct sid_name_map_info *psnm;
189
190         if (!sid_name_map_initialized) 
191                 init_sid_name_map();
192
193         for(i = 0; sid_name_map[i].sid != NULL; i++) {
194                 psnm = &sid_name_map[i];
195                 if(sid_equal(psnm->sid, sid)) {
196                         int j;
197                         for(j = 0; psnm->known_users && psnm->known_users[j].known_user_name != NULL; j++) {
198                                 if(rid == psnm->known_users[j].rid) {
199                                         DEBUG(5,("lookup_builtin_rid: rid = %u, domain = '%s', user = '%s'\n",
200                                                 (unsigned int)rid, psnm->name, psnm->known_users[j].known_user_name ));
201                                         fstrcpy( name, psnm->known_users[j].known_user_name);
202                                         *psid_name_use = psnm->known_users[j].sid_name_use;
203                                         return True;
204                                 }
205                         }
206                 }
207         }
208
209         return False;
210 }
211
212 /**************************************************************************
213  Turns a domain name into a SID.
214  *** side-effect: if the domain name is NULL, it is set to our domain ***
215 ***************************************************************************/
216
217 BOOL map_domain_name_to_sid(DOM_SID *sid, char *nt_domain)
218 {
219         int i = 0;
220
221         if (nt_domain == NULL) {
222                 DEBUG(5,("map_domain_name_to_sid: mapping NULL domain to our SID.\n"));
223                 sid_copy(sid, get_global_sam_sid());
224                 return True;
225         }
226
227         if (nt_domain[0] == 0) {
228                 fstrcpy(nt_domain, global_myname());
229                 DEBUG(5,("map_domain_name_to_sid: overriding blank name to %s\n", nt_domain));
230                 sid_copy(sid, get_global_sam_sid());
231                 return True;
232         }
233
234         DEBUG(5,("map_domain_name_to_sid: %s\n", nt_domain));
235
236         if (!sid_name_map_initialized) 
237                 init_sid_name_map();
238
239         while (sid_name_map[i].name != NULL) {
240                 DEBUG(5,("map_domain_name_to_sid: compare: %s\n", sid_name_map[i].name));
241                 if (strequal(sid_name_map[i].name, nt_domain)) {
242                         fstring sid_str;
243                         sid_copy(sid, sid_name_map[i].sid);
244                         sid_to_string(sid_str, sid_name_map[i].sid);
245                         DEBUG(5,("map_domain_name_to_sid: found %s\n", sid_str));
246                         return True;
247                 }
248                 i++;
249         }
250
251         DEBUG(0,("map_domain_name_to_sid: mapping to %s not found.\n", nt_domain));
252         return False;
253 }
254
255 /*****************************************************************
256  Check if the SID is our domain SID (S-1-5-21-x-y-z).
257 *****************************************************************/  
258
259 BOOL sid_check_is_domain(const DOM_SID *sid)
260 {
261         return sid_equal(sid, get_global_sam_sid());
262 }
263
264 /*****************************************************************
265  Check if the SID is our domain SID (S-1-5-21-x-y-z).
266 *****************************************************************/  
267
268 BOOL sid_check_is_in_our_domain(const DOM_SID *sid)
269 {
270         DOM_SID dom_sid;
271         uint32 rid;
272
273         sid_copy(&dom_sid, sid);
274         sid_split_rid(&dom_sid, &rid);
275         
276         return sid_equal(&dom_sid, get_global_sam_sid());
277 }
278
279 /**************************************************************************
280  Try and map a name to one of the well known SIDs.
281 ***************************************************************************/
282
283 BOOL map_name_to_wellknown_sid(DOM_SID *sid, enum SID_NAME_USE *use, const char *name)
284 {
285         int i, j;
286
287         if (!sid_name_map_initialized)
288                 init_sid_name_map();
289
290         for (i=0; sid_name_map[i].sid != NULL; i++) {
291                 const known_sid_users *users = sid_name_map[i].known_users;
292
293                 if (users == NULL)
294                         continue;
295
296                 for (j=0; users[j].known_user_name != NULL; j++) {
297                         if ( strequal(users[j].known_user_name, name) ) {
298                                 sid_copy(sid, sid_name_map[i].sid);
299                                 sid_append_rid(sid, users[j].rid);
300                                 *use = users[j].sid_name_use;
301                                 return True;
302                         }
303                 }
304         }
305
306         return False;
307 }
308
309 void add_sid_to_array(const DOM_SID *sid, DOM_SID **sids, int *num)
310 {
311         *sids = Realloc(*sids, ((*num)+1) * sizeof(DOM_SID));
312
313         if (*sids == NULL)
314                 return;
315
316         sid_copy(&((*sids)[*num]), sid);
317         *num += 1;
318
319         return;
320 }
321
322 void add_sid_to_array_unique(const DOM_SID *sid, DOM_SID **sids, int *num)
323 {
324         int i;
325
326         for (i=0; i<*num; i++) {
327                 if (sid_compare(sid, &(*sids)[i]) == 0)
328                         return;
329         }
330
331         add_sid_to_array(sid, sids, num);
332 }