xref: /titanic_41/usr/src/uts/common/smbsrv/smb_sid.h (revision 148c5f43199ca0b43fc8e3b643aab11cd66ea327)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 #ifndef _SMB_SID_H
26 #define	_SMB_SID_H
27 
28 /*
29  * Security Identifier (SID) interface definition.
30  */
31 #include <smbsrv/wintypes.h>
32 
33 #ifdef __cplusplus
34 extern "C" {
35 #endif
36 
37 /*
38  * Predefined global user RIDs.
39  */
40 #define	DOMAIN_USER_RID_ADMIN		(0x000001F4L)	/* 500 */
41 #define	DOMAIN_USER_RID_GUEST		(0x000001F5L)	/* 501 */
42 #define	DOMAIN_USER_RID_KRBTGT		(0x000001F6L)	/* 502 */
43 
44 /*
45  * Predefined global group RIDs.
46  */
47 #define	DOMAIN_GROUP_RID_ADMINS		(0x00000200L)	/* 512 */
48 #define	DOMAIN_GROUP_RID_USERS		(0x00000201L)	/* 513 */
49 #define	DOMAIN_GROUP_RID_GUESTS		(0x00000202L)	/* 514 */
50 #define	DOMAIN_GROUP_RID_COMPUTERS	(0x00000203L)	/* 515 */
51 #define	DOMAIN_GROUP_RID_CONTROLLERS	(0x00000204L)	/* 516 */
52 #define	DOMAIN_GROUP_RID_CERT_ADMINS	(0x00000205L)	/* 517 */
53 #define	DOMAIN_GROUP_RID_SCHEMA_ADMINS	(0x00000206L)	/* 518 */
54 #define	DOMAIN_GROUP_RID_EP_ADMINS	(0x00000207L)	/* 519 */
55 #define	DOMAIN_GROUP_RID_GP_CREATOR	(0x00000208L)	/* 520 */
56 
57 
58 /*
59  * Predefined local alias RIDs.
60  */
61 #define	DOMAIN_ALIAS_RID_ADMINS		(0x00000220L)	/* 544 */
62 #define	DOMAIN_ALIAS_RID_USERS		(0x00000221L)
63 #define	DOMAIN_ALIAS_RID_GUESTS		(0x00000222L)
64 #define	DOMAIN_ALIAS_RID_POWER_USERS	(0x00000223L)
65 #define	DOMAIN_ALIAS_RID_ACCOUNT_OPS	(0x00000224L)
66 #define	DOMAIN_ALIAS_RID_SYSTEM_OPS	(0x00000225L)
67 #define	DOMAIN_ALIAS_RID_PRINT_OPS	(0x00000226L)
68 #define	DOMAIN_ALIAS_RID_BACKUP_OPS	(0x00000227L)
69 #define	DOMAIN_ALIAS_RID_REPLICATOR	(0x00000228L)
70 
71 
72 /*
73  * Universal and NT well-known SIDs
74  */
75 #define	NT_NULL_AUTH_SIDSTR			"S-1-0"
76 #define	NT_NULL_SIDSTR				"S-1-0-0"
77 #define	NT_WORLD_AUTH_SIDSTR			"S-1-1"
78 #define	NT_WORLD_SIDSTR				"S-1-1-0"
79 #define	NT_LOCAL_AUTH_SIDSTR			"S-1-2"
80 #define	NT_LOCAL_SIDSTR				"S-1-2-0"
81 #define	NT_CREATOR_AUTH_SIDSTR			"S-1-3"
82 #define	NT_CREATOR_OWNER_ID_SIDSTR		"S-1-3-0"
83 #define	NT_CREATOR_GROUP_ID_SIDSTR		"S-1-3-1"
84 #define	NT_CREATOR_OWNER_SERVER_ID_SIDSTR	"S-1-3-2"
85 #define	NT_CREATOR_GROUP_SERVER_ID_SIDSTR	"S-1-3-3"
86 #define	NT_OWNER_RIGHTS_SIDSTR			"S-1-3-4"
87 #define	NT_GROUP_RIGHTS_SIDSTR			"S-1-3-5"
88 #define	NT_NON_UNIQUE_IDS_SIDSTR		"S-1-4"
89 #define	NT_AUTHORITY_SIDSTR			"S-1-5"
90 #define	NT_DIALUP_SIDSTR			"S-1-5-1"
91 #define	NT_NETWORK_SIDSTR			"S-1-5-2"
92 #define	NT_BATCH_SIDSTR				"S-1-5-3"
93 #define	NT_INTERACTIVE_SIDSTR			"S-1-5-4"
94 #define	NT_LOGON_SESSION_SIDSTR			"S-1-5-5"
95 #define	NT_SERVICE_SIDSTR			"S-1-5-6"
96 #define	NT_ANONYMOUS_LOGON_SIDSTR		"S-1-5-7"
97 #define	NT_PROXY_SIDSTR				"S-1-5-8"
98 #define	NT_SERVER_LOGON_SIDSTR			"S-1-5-9"
99 #define	NT_SELF_SIDSTR				"S-1-5-10"
100 #define	NT_AUTHENTICATED_USER_SIDSTR		"S-1-5-11"
101 #define	NT_RESTRICTED_CODE_SIDSTR		"S-1-5-12"
102 #define	NT_TERMINAL_SERVER_SIDSTR		"S-1-5-13"
103 #define	NT_LOCAL_SYSTEM_SIDSTR			"S-1-5-18"
104 #define	NT_NON_UNIQUE_SIDSTR			"S-1-5-21"
105 #define	NT_BUILTIN_DOMAIN_SIDSTR		"S-1-5-32"
106 #define	NT_BUILTIN_CURRENT_OWNER_SIDSTR		"S-1-5-32-766"
107 #define	NT_BUILTIN_CURRENT_GROUP_SIDSTR		"S-1-5-32-767"
108 
109 
110 /*
111  * SID type indicators (SID_NAME_USE).
112  */
113 #define	SidTypeNull			0
114 #define	SidTypeUser			1
115 #define	SidTypeGroup			2
116 #define	SidTypeDomain			3
117 #define	SidTypeAlias			4
118 #define	SidTypeWellKnownGroup		5
119 #define	SidTypeDeletedAccount		6
120 #define	SidTypeInvalid			7
121 #define	SidTypeUnknown			8
122 #define	SidTypeComputer			9
123 #define	SidTypeLabel			10
124 
125 
126 /*
127  * Identifier authorities for various domains.
128  */
129 #define	NT_SID_NULL_AUTH		0
130 #define	NT_SID_WORLD_AUTH		1
131 #define	NT_SID_LOCAL_AUTH		2
132 #define	NT_SID_CREATOR_AUTH		3
133 #define	NT_SID_NON_UNIQUE_AUTH		4
134 #define	NT_SID_NT_AUTH			5
135 
136 
137 #define	NT_SECURITY_NULL_AUTH		{0, 0, 0, 0, 0, 0}
138 #define	NT_SECURITY_WORLD_AUTH		{0, 0, 0, 0, 0, 1}
139 #define	NT_SECURITY_LOCAL_AUTH		{0, 0, 0, 0, 0, 2}
140 #define	NT_SECURITY_CREATOR_AUTH	{0, 0, 0, 0, 0, 3}
141 #define	NT_SECURITY_NON_UNIQUE_AUTH	{0, 0, 0, 0, 0, 4}
142 #define	NT_SECURITY_NT_AUTH		{0, 0, 0, 0, 0, 5}
143 #define	NT_SECURITY_UNIX_AUTH		{0, 0, 0, 0, 0, 99}
144 
145 
146 #define	SECURITY_NULL_RID			(0x00000000L)
147 #define	SECURITY_WORLD_RID			(0x00000000L)
148 #define	SECURITY_LOCAL_RID			(0X00000000L)
149 
150 #define	SECURITY_CREATOR_OWNER_RID		(0x00000000L)
151 #define	SECURITY_CREATOR_GROUP_RID		(0x00000001L)
152 #define	SECURITY_CREATOR_OWNER_SERVER_RID	(0x00000002L)
153 #define	SECURITY_CREATOR_GROUP_SERVER_RID	(0x00000003L)
154 #define	SECURITY_OWNER_RIGHTS_RID		(0x00000004L)
155 #define	SECURITY_GROUP_RIGHTS_RID		(0x00000005L)
156 #define	SECURITY_CURRENT_OWNER_RID		(0x000002FEL)
157 #define	SECURITY_CURRENT_GROUP_RID		(0x000002FFL)
158 
159 #define	SECURITY_DIALUP_RID			(0x00000001L)
160 #define	SECURITY_NETWORK_RID			(0x00000002L)
161 #define	SECURITY_BATCH_RID			(0x00000003L)
162 #define	SECURITY_INTERACTIVE_RID		(0x00000004L)
163 #define	SECURITY_LOGON_IDS_RID			(0x00000005L)
164 #define	SECURITY_LOGON_IDS_RID_COUNT		(3L)
165 #define	SECURITY_SERVICE_RID			(0x00000006L)
166 #define	SECURITY_ANONYMOUS_LOGON_RID		(0x00000007L)
167 #define	SECURITY_PROXY_RID			(0x00000008L)
168 #define	SECURITY_ENTERPRISE_CONTROLLERS_RID	(0x00000009L)
169 #define	SECURITY_SERVER_LOGON_RID	SECURITY_ENTERPRISE_CONTROLLERS_RID
170 #define	SECURITY_PRINCIPAL_SELF_RID		(0x0000000AL)
171 #define	SECURITY_AUTHENTICATED_USER_RID		(0x0000000BL)
172 #define	SECURITY_RESTRICTED_CODE_RID		(0x0000000CL)
173 
174 #define	SECURITY_LOCAL_SYSTEM_RID		(0x00000012L)
175 #define	SECURITY_NT_NON_UNIQUE			(0x00000015L)
176 #define	SECURITY_BUILTIN_DOMAIN_RID		(0x00000020L)
177 
178 
179 #define	NT_SID_NON_UNIQUE_SUBAUTH 21
180 
181 
182 /*
183  * Common definition for a SID.
184  */
185 #define	NT_SID_REVISION		1
186 #define	NT_SID_AUTH_MAX		6
187 #define	NT_SID_SUBAUTH_MAX	15
188 
189 
190 /*
191  * Security Identifier (SID)
192  *
193  * The security identifier (SID) uniquely identifies a user, group or
194  * a domain. It consists of a revision number, the identifier authority,
195  * and a list of sub-authorities. The revision number is currently 1.
196  * The identifier authority identifies which system issued the SID. The
197  * sub-authorities of a domain SID uniquely identify a domain. A user
198  * or group SID consists of a domain SID with the user or group id
199  * appended. The user or group id (also known as a relative id (RID)
200  * uniquely identifies a user within a domain. A user or group SID
201  * uniquely identifies a user or group across all domains. The SidType
202  * values identify the various types of SID.
203  *
204  *      1   1   1   1   1   1
205  *      5   4   3   2   1   0   9   8   7   6   5   4   3   2   1   0
206  *   +---------------------------------------------------------------+
207  *   |      SubAuthorityCount        |Reserved1 (SBZ)|   Revision    |
208  *   +---------------------------------------------------------------+
209  *   |                   IdentifierAuthority[0]                      |
210  *   +---------------------------------------------------------------+
211  *   |                   IdentifierAuthority[1]                      |
212  *   +---------------------------------------------------------------+
213  *   |                   IdentifierAuthority[2]                      |
214  *   +---------------------------------------------------------------+
215  *   |                                                               |
216  *   +- -  -  -  -  -  -  -  SubAuthority[]  -  -  -  -  -  -  -  - -+
217  *   |                                                               |
218  *   +---------------------------------------------------------------+
219  *
220  */
221 /*
222  * Note: NT defines the Identifier Authority as a separate
223  * structure (SID_IDENTIFIER_AUTHORITY) containing a literal
224  * definition of a 6 byte vector but the effect is the same
225  * as defining it as a member value.
226  */
227 typedef struct smb_sid {
228 	uint8_t sid_revision;
229 	uint8_t sid_subauthcnt;
230 	uint8_t sid_authority[NT_SID_AUTH_MAX];
231 	uint32_t sid_subauth[ANY_SIZE_ARRAY];
232 } smb_sid_t;
233 
234 #define	SMB_MAX_SID_SIZE	((2 * sizeof (uint8_t)) + \
235 	(NT_SID_AUTH_MAX * sizeof (uint8_t)) + \
236 	(NT_SID_SUBAUTH_MAX * sizeof (uint32_t)))
237 
238 /*
239  * Estimated number of sid_subauth is SECURITY_LOGON_IDS_RID_COUNT
240  * plus the DOMAIN_RID and the RID.
241  */
242 #define	SMB_EST_SID_SIZE	((2 * sizeof (uint8_t)) + \
243 	(NT_SID_AUTH_MAX * sizeof (uint8_t)) + \
244 	((2 + SECURITY_LOGON_IDS_RID_COUNT) * sizeof (uint32_t)))
245 
246 /*
247  * Only group attributes are defined. No user attributes defined.
248  */
249 #define	SE_GROUP_MANDATORY		0x00000001
250 #define	SE_GROUP_ENABLED_BY_DEFAULT	0x00000002
251 #define	SE_GROUP_ENABLED		0x00000004
252 #define	SE_GROUP_OWNER			0x00000008
253 #define	SE_GROUP_USE_FOR_DENY_ONLY	0x00000010
254 #define	SE_GROUP_LOGON_ID		0xC0000000
255 
256 /*
257  * smb_id_t consists of both the Windows security identifier
258  * and its corresponding POSIX/ephemeral ID.
259  */
260 typedef struct smb_id {
261 	uint32_t	i_attrs;
262 	smb_sid_t	*i_sid;
263 	uid_t		i_id;
264 } smb_id_t;
265 
266 typedef struct smb_ids {
267 	uint32_t	i_cnt;
268 	smb_id_t	*i_ids;
269 } smb_ids_t;
270 
271 /*
272  * The maximum size of a SID in string format
273  */
274 #define	SMB_SID_STRSZ		256
275 
276 boolean_t smb_sid_isvalid(smb_sid_t *);
277 int smb_sid_len(smb_sid_t *);
278 smb_sid_t *smb_sid_dup(smb_sid_t *);
279 smb_sid_t *smb_sid_splice(smb_sid_t *, uint32_t);
280 int smb_sid_getrid(smb_sid_t *, uint32_t *);
281 smb_sid_t *smb_sid_split(smb_sid_t *, uint32_t *);
282 boolean_t smb_sid_cmp(smb_sid_t *, smb_sid_t *);
283 boolean_t smb_sid_islocal(smb_sid_t *);
284 boolean_t smb_sid_indomain(smb_sid_t *, smb_sid_t *);
285 void smb_sid_free(smb_sid_t *);
286 int smb_sid_splitstr(char *, uint32_t *);
287 void smb_sid_tostr(const smb_sid_t *, char *);
288 smb_sid_t *smb_sid_fromstr(const char *);
289 char *smb_sid_type2str(uint16_t);
290 
291 void smb_ids_free(smb_ids_t *);
292 
293 #ifdef __cplusplus
294 }
295 #endif
296 
297 
298 #endif /* _SMB_SID_H */
299