1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
|
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
*/
#ifndef _SMB_SID_H
#define _SMB_SID_H
/*
* Security Identifier (SID) interface definition.
*/
#include <smbsrv/wintypes.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
* Predefined global user RIDs.
*/
#define DOMAIN_USER_RID_ADMIN (0x000001F4L) /* 500 */
#define DOMAIN_USER_RID_GUEST (0x000001F5L) /* 501 */
#define DOMAIN_USER_RID_KRBTGT (0x000001F6L) /* 502 */
/*
* Predefined global group RIDs.
*/
#define DOMAIN_GROUP_RID_ADMINS (0x00000200L) /* 512 */
#define DOMAIN_GROUP_RID_USERS (0x00000201L) /* 513 */
#define DOMAIN_GROUP_RID_GUESTS (0x00000202L) /* 514 */
#define DOMAIN_GROUP_RID_COMPUTERS (0x00000203L) /* 515 */
#define DOMAIN_GROUP_RID_CONTROLLERS (0x00000204L) /* 516 */
#define DOMAIN_GROUP_RID_CERT_ADMINS (0x00000205L) /* 517 */
#define DOMAIN_GROUP_RID_SCHEMA_ADMINS (0x00000206L) /* 518 */
#define DOMAIN_GROUP_RID_EP_ADMINS (0x00000207L) /* 519 */
#define DOMAIN_GROUP_RID_GP_CREATOR (0x00000208L) /* 520 */
/*
* Predefined local alias RIDs.
*/
#define DOMAIN_ALIAS_RID_ADMINS (0x00000220L) /* 544 */
#define DOMAIN_ALIAS_RID_USERS (0x00000221L)
#define DOMAIN_ALIAS_RID_GUESTS (0x00000222L)
#define DOMAIN_ALIAS_RID_POWER_USERS (0x00000223L)
#define DOMAIN_ALIAS_RID_ACCOUNT_OPS (0x00000224L)
#define DOMAIN_ALIAS_RID_SYSTEM_OPS (0x00000225L)
#define DOMAIN_ALIAS_RID_PRINT_OPS (0x00000226L)
#define DOMAIN_ALIAS_RID_BACKUP_OPS (0x00000227L)
#define DOMAIN_ALIAS_RID_REPLICATOR (0x00000228L)
/*
* Universal and NT well-known SIDs
*/
#define NT_NULL_AUTH_SIDSTR "S-1-0"
#define NT_NULL_SIDSTR "S-1-0-0"
#define NT_WORLD_AUTH_SIDSTR "S-1-1"
#define NT_WORLD_SIDSTR "S-1-1-0"
#define NT_LOCAL_AUTH_SIDSTR "S-1-2"
#define NT_LOCAL_SIDSTR "S-1-2-0"
#define NT_CREATOR_AUTH_SIDSTR "S-1-3"
#define NT_CREATOR_OWNER_ID_SIDSTR "S-1-3-0"
#define NT_CREATOR_GROUP_ID_SIDSTR "S-1-3-1"
#define NT_CREATOR_OWNER_SERVER_ID_SIDSTR "S-1-3-2"
#define NT_CREATOR_GROUP_SERVER_ID_SIDSTR "S-1-3-3"
#define NT_OWNER_RIGHTS_SIDSTR "S-1-3-4"
#define NT_GROUP_RIGHTS_SIDSTR "S-1-3-5"
#define NT_NON_UNIQUE_IDS_SIDSTR "S-1-4"
#define NT_AUTHORITY_SIDSTR "S-1-5"
#define NT_DIALUP_SIDSTR "S-1-5-1"
#define NT_NETWORK_SIDSTR "S-1-5-2"
#define NT_BATCH_SIDSTR "S-1-5-3"
#define NT_INTERACTIVE_SIDSTR "S-1-5-4"
#define NT_LOGON_SESSION_SIDSTR "S-1-5-5"
#define NT_SERVICE_SIDSTR "S-1-5-6"
#define NT_ANONYMOUS_LOGON_SIDSTR "S-1-5-7"
#define NT_PROXY_SIDSTR "S-1-5-8"
#define NT_SERVER_LOGON_SIDSTR "S-1-5-9"
#define NT_SELF_SIDSTR "S-1-5-10"
#define NT_AUTHENTICATED_USER_SIDSTR "S-1-5-11"
#define NT_RESTRICTED_CODE_SIDSTR "S-1-5-12"
#define NT_TERMINAL_SERVER_SIDSTR "S-1-5-13"
#define NT_LOCAL_SYSTEM_SIDSTR "S-1-5-18"
#define NT_NON_UNIQUE_SIDSTR "S-1-5-21"
#define NT_BUILTIN_DOMAIN_SIDSTR "S-1-5-32"
#define NT_BUILTIN_CURRENT_OWNER_SIDSTR "S-1-5-32-766"
#define NT_BUILTIN_CURRENT_GROUP_SIDSTR "S-1-5-32-767"
/*
* SID type indicators (SID_NAME_USE).
*/
#define SidTypeNull 0
#define SidTypeUser 1
#define SidTypeGroup 2
#define SidTypeDomain 3
#define SidTypeAlias 4
#define SidTypeWellKnownGroup 5
#define SidTypeDeletedAccount 6
#define SidTypeInvalid 7
#define SidTypeUnknown 8
#define SidTypeComputer 9
#define SidTypeLabel 10
/*
* Identifier authorities for various domains.
*/
#define NT_SID_NULL_AUTH 0
#define NT_SID_WORLD_AUTH 1
#define NT_SID_LOCAL_AUTH 2
#define NT_SID_CREATOR_AUTH 3
#define NT_SID_NON_UNIQUE_AUTH 4
#define NT_SID_NT_AUTH 5
#define NT_SECURITY_NULL_AUTH {0, 0, 0, 0, 0, 0}
#define NT_SECURITY_WORLD_AUTH {0, 0, 0, 0, 0, 1}
#define NT_SECURITY_LOCAL_AUTH {0, 0, 0, 0, 0, 2}
#define NT_SECURITY_CREATOR_AUTH {0, 0, 0, 0, 0, 3}
#define NT_SECURITY_NON_UNIQUE_AUTH {0, 0, 0, 0, 0, 4}
#define NT_SECURITY_NT_AUTH {0, 0, 0, 0, 0, 5}
#define NT_SECURITY_UNIX_AUTH {0, 0, 0, 0, 0, 99}
#define SECURITY_NULL_RID (0x00000000L)
#define SECURITY_WORLD_RID (0x00000000L)
#define SECURITY_LOCAL_RID (0X00000000L)
#define SECURITY_CREATOR_OWNER_RID (0x00000000L)
#define SECURITY_CREATOR_GROUP_RID (0x00000001L)
#define SECURITY_CREATOR_OWNER_SERVER_RID (0x00000002L)
#define SECURITY_CREATOR_GROUP_SERVER_RID (0x00000003L)
#define SECURITY_OWNER_RIGHTS_RID (0x00000004L)
#define SECURITY_GROUP_RIGHTS_RID (0x00000005L)
#define SECURITY_CURRENT_OWNER_RID (0x000002FEL)
#define SECURITY_CURRENT_GROUP_RID (0x000002FFL)
#define SECURITY_DIALUP_RID (0x00000001L)
#define SECURITY_NETWORK_RID (0x00000002L)
#define SECURITY_BATCH_RID (0x00000003L)
#define SECURITY_INTERACTIVE_RID (0x00000004L)
#define SECURITY_LOGON_IDS_RID (0x00000005L)
#define SECURITY_LOGON_IDS_RID_COUNT (3L)
#define SECURITY_SERVICE_RID (0x00000006L)
#define SECURITY_ANONYMOUS_LOGON_RID (0x00000007L)
#define SECURITY_PROXY_RID (0x00000008L)
#define SECURITY_ENTERPRISE_CONTROLLERS_RID (0x00000009L)
#define SECURITY_SERVER_LOGON_RID SECURITY_ENTERPRISE_CONTROLLERS_RID
#define SECURITY_PRINCIPAL_SELF_RID (0x0000000AL)
#define SECURITY_AUTHENTICATED_USER_RID (0x0000000BL)
#define SECURITY_RESTRICTED_CODE_RID (0x0000000CL)
#define SECURITY_LOCAL_SYSTEM_RID (0x00000012L)
#define SECURITY_NT_NON_UNIQUE (0x00000015L)
#define SECURITY_BUILTIN_DOMAIN_RID (0x00000020L)
#define NT_SID_NON_UNIQUE_SUBAUTH 21
/*
* Common definition for a SID.
*/
#define NT_SID_REVISION 1
#define NT_SID_AUTH_MAX 6
#define NT_SID_SUBAUTH_MAX 15
/*
* Security Identifier (SID)
*
* The security identifier (SID) uniquely identifies a user, group or
* a domain. It consists of a revision number, the identifier authority,
* and a list of sub-authorities. The revision number is currently 1.
* The identifier authority identifies which system issued the SID. The
* sub-authorities of a domain SID uniquely identify a domain. A user
* or group SID consists of a domain SID with the user or group id
* appended. The user or group id (also known as a relative id (RID)
* uniquely identifies a user within a domain. A user or group SID
* uniquely identifies a user or group across all domains. The SidType
* values identify the various types of SID.
*
* 1 1 1 1 1 1
* 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
* +---------------------------------------------------------------+
* | SubAuthorityCount |Reserved1 (SBZ)| Revision |
* +---------------------------------------------------------------+
* | IdentifierAuthority[0] |
* +---------------------------------------------------------------+
* | IdentifierAuthority[1] |
* +---------------------------------------------------------------+
* | IdentifierAuthority[2] |
* +---------------------------------------------------------------+
* | |
* +- - - - - - - - SubAuthority[] - - - - - - - - -+
* | |
* +---------------------------------------------------------------+
*
*/
/*
* Note: NT defines the Identifier Authority as a separate
* structure (SID_IDENTIFIER_AUTHORITY) containing a literal
* definition of a 6 byte vector but the effect is the same
* as defining it as a member value.
*/
typedef struct smb_sid {
uint8_t sid_revision;
uint8_t sid_subauthcnt;
uint8_t sid_authority[NT_SID_AUTH_MAX];
uint32_t sid_subauth[ANY_SIZE_ARRAY];
} smb_sid_t;
#define SMB_MAX_SID_SIZE ((2 * sizeof (uint8_t)) + \
(NT_SID_AUTH_MAX * sizeof (uint8_t)) + \
(NT_SID_SUBAUTH_MAX * sizeof (uint32_t)))
/*
* Estimated number of sid_subauth is SECURITY_LOGON_IDS_RID_COUNT
* plus the DOMAIN_RID and the RID.
*/
#define SMB_EST_SID_SIZE ((2 * sizeof (uint8_t)) + \
(NT_SID_AUTH_MAX * sizeof (uint8_t)) + \
((2 + SECURITY_LOGON_IDS_RID_COUNT) * sizeof (uint32_t)))
/*
* Only group attributes are defined. No user attributes defined.
*/
#define SE_GROUP_MANDATORY 0x00000001
#define SE_GROUP_ENABLED_BY_DEFAULT 0x00000002
#define SE_GROUP_ENABLED 0x00000004
#define SE_GROUP_OWNER 0x00000008
#define SE_GROUP_USE_FOR_DENY_ONLY 0x00000010
#define SE_GROUP_LOGON_ID 0xC0000000
/*
* smb_id_t consists of both the Windows security identifier
* and its corresponding POSIX/ephemeral ID.
*/
typedef struct smb_id {
uint32_t i_attrs;
smb_sid_t *i_sid;
uid_t i_id;
} smb_id_t;
typedef struct smb_ids {
uint32_t i_cnt;
smb_id_t *i_ids;
} smb_ids_t;
/*
* The maximum size of a SID in string format
*/
#define SMB_SID_STRSZ 256
boolean_t smb_sid_isvalid(smb_sid_t *);
int smb_sid_len(smb_sid_t *);
smb_sid_t *smb_sid_dup(smb_sid_t *);
smb_sid_t *smb_sid_splice(smb_sid_t *, uint32_t);
int smb_sid_getrid(smb_sid_t *, uint32_t *);
smb_sid_t *smb_sid_split(smb_sid_t *, uint32_t *);
boolean_t smb_sid_cmp(smb_sid_t *, smb_sid_t *);
boolean_t smb_sid_islocal(smb_sid_t *);
boolean_t smb_sid_indomain(smb_sid_t *, smb_sid_t *);
void smb_sid_free(smb_sid_t *);
int smb_sid_splitstr(char *, uint32_t *);
void smb_sid_tostr(const smb_sid_t *, char *);
smb_sid_t *smb_sid_fromstr(const char *);
char *smb_sid_type2str(uint16_t);
void smb_ids_free(smb_ids_t *);
#ifdef __cplusplus
}
#endif
#endif /* _SMB_SID_H */
|
