xref: /titanic_50/usr/src/uts/common/smbsrv/smb_sid.h (revision ba7962c0250fa58d6c360c01c4866d394aae57b8)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef _SMB_SID_H
27 #define	_SMB_SID_H
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * NT Security Identifier (SID) interface definition.
33  */
34 #include <smbsrv/wintypes.h>
35 
36 #ifdef __cplusplus
37 extern "C" {
38 #endif
39 
40 /*
41  * Predefined global user RIDs.
42  */
43 #define	DOMAIN_USER_RID_ADMIN		(0x000001F4L)	/* 500 */
44 #define	DOMAIN_USER_RID_GUEST		(0x000001F5L)	/* 501 */
45 #define	DOMAIN_USER_RID_KRBTGT		(0x000001F6L)	/* 502 */
46 
47 /*
48  * Predefined global group RIDs.
49  */
50 #define	DOMAIN_GROUP_RID_ADMINS		(0x00000200L)	/* 512 */
51 #define	DOMAIN_GROUP_RID_USERS		(0x00000201L)
52 #define	DOMAIN_GROUP_RID_GUESTS		(0x00000202L)
53 #define	DOMAIN_GROUP_RID_COMPUTERS	(0x00000203L)
54 #define	DOMAIN_GROUP_RID_CONTROLLERS	(0x00000204L)
55 #define	DOMAIN_GROUP_RID_CERT_ADMINS	(0x00000205L)
56 #define	DOMAIN_GROUP_RID_SCHEMA_ADMINS	(0x00000206L)
57 
58 
59 /*
60  * Predefined local alias RIDs.
61  */
62 #define	DOMAIN_ALIAS_RID_ADMINS		(0x00000220L)	/* 544 */
63 #define	DOMAIN_ALIAS_RID_USERS		(0x00000221L)
64 #define	DOMAIN_ALIAS_RID_GUESTS		(0x00000222L)
65 #define	DOMAIN_ALIAS_RID_POWER_USERS	(0x00000223L)
66 #define	DOMAIN_ALIAS_RID_ACCOUNT_OPS	(0x00000224L)
67 #define	DOMAIN_ALIAS_RID_SYSTEM_OPS	(0x00000225L)
68 #define	DOMAIN_ALIAS_RID_PRINT_OPS	(0x00000226L)
69 #define	DOMAIN_ALIAS_RID_BACKUP_OPS	(0x00000227L)
70 #define	DOMAIN_ALIAS_RID_REPLICATOR	(0x00000228L)
71 
72 
73 /*
74  * Universal and NT well-known SIDs
75  */
76 #define	NT_NULL_SIDSTR				"S-1-0-0"
77 #define	NT_WORLD_SIDSTR				"S-1-1-0"
78 #define	NT_LOCAL_SIDSTR				"S-1-2-0"
79 #define	NT_CREATOR_OWNER_ID_SIDSTR		"S-1-3-0"
80 #define	NT_CREATOR_GROUP_ID_SIDSTR		"S-1-3-1"
81 #define	NT_CREATOR_OWNER_SERVER_ID_SIDSTR	"S-1-3-2"
82 #define	NT_CREATOR_GROUP_SERVER_ID_SIDSTR	"S-1-3-3"
83 #define	NT_NON_UNIQUE_IDS_SIDSTR		"S-1-4"
84 #define	NT_AUTHORITY_SIDSTR			"S-1-5"
85 #define	NT_DIALUP_SIDSTR			"S-1-5-1"
86 #define	NT_NETWORK_SIDSTR			"S-1-5-2"
87 #define	NT_BATCH_SIDSTR				"S-1-5-3"
88 #define	NT_INTERACTIVE_SIDSTR			"S-1-5-4"
89 #define	NT_SERVICE_SIDSTR			"S-1-5-6"
90 #define	NT_ANONYMOUS_LOGON_SIDSTR		"S-1-5-7"
91 #define	NT_PROXY_SIDSTR				"S-1-5-8"
92 #define	NT_SERVER_LOGON_SIDSTR			"S-1-5-9"
93 #define	NT_SELF_SIDSTR				"S-1-5-10"
94 #define	NT_AUTHENTICATED_USER_SIDSTR		"S-1-5-11"
95 #define	NT_RESTRICTED_CODE_SIDSTR		"S-1-5-12"
96 #define	NT_LOCAL_SYSTEM_SIDSTR			"S-1-5-18"
97 #define	NT_NON_UNIQUE_SIDSTR			"S-1-5-21"
98 #define	NT_BUILTIN_DOMAIN_SIDSTR		"S-1-5-32"
99 
100 
101 /*
102  * SID type indicators (SID_NAME_USE).
103  */
104 #define	SidTypeNull			0
105 #define	SidTypeUser			1
106 #define	SidTypeGroup			2
107 #define	SidTypeDomain			3
108 #define	SidTypeAlias			4
109 #define	SidTypeWellKnownGroup		5
110 #define	SidTypeDeletedAccount		6
111 #define	SidTypeInvalid			7
112 #define	SidTypeUnknown			8
113 #define	SidTypeComputer			9
114 
115 
116 /*
117  * Identifier authorities for various domains.
118  */
119 #define	NT_SID_NULL_AUTH		0
120 #define	NT_SID_WORLD_AUTH		1
121 #define	NT_SID_LOCAL_AUTH		2
122 #define	NT_SID_CREATOR_AUTH		3
123 #define	NT_SID_NON_UNIQUE_AUTH		4
124 #define	NT_SID_NT_AUTH			5
125 
126 
127 #define	NT_SECURITY_NULL_AUTH		{0, 0, 0, 0, 0, 0}
128 #define	NT_SECURITY_WORLD_AUTH		{0, 0, 0, 0, 0, 1}
129 #define	NT_SECURITY_LOCAL_AUTH		{0, 0, 0, 0, 0, 2}
130 #define	NT_SECURITY_CREATOR_AUTH	{0, 0, 0, 0, 0, 3}
131 #define	NT_SECURITY_NON_UNIQUE_AUTH	{0, 0, 0, 0, 0, 4}
132 #define	NT_SECURITY_NT_AUTH		{0, 0, 0, 0, 0, 5}
133 #define	NT_SECURITY_UNIX_AUTH		{0, 0, 0, 0, 0, 99}
134 
135 
136 #define	SECURITY_NULL_RID			(0x00000000L)
137 #define	SECURITY_WORLD_RID			(0x00000000L)
138 #define	SECURITY_LOCAL_RID			(0X00000000L)
139 
140 #define	SECURITY_CREATOR_OWNER_RID		(0x00000000L)
141 #define	SECURITY_CREATOR_GROUP_RID		(0x00000001L)
142 #define	SECURITY_CREATOR_OWNER_SERVER_RID	(0x00000002L)
143 #define	SECURITY_CREATOR_GROUP_SERVER_RID	(0x00000003L)
144 
145 #define	SECURITY_DIALUP_RID			(0x00000001L)
146 #define	SECURITY_NETWORK_RID			(0x00000002L)
147 #define	SECURITY_BATCH_RID			(0x00000003L)
148 #define	SECURITY_INTERACTIVE_RID		(0x00000004L)
149 #define	SECURITY_LOGON_IDS_RID			(0x00000005L)
150 #define	SECURITY_LOGON_IDS_RID_COUNT		(3L)
151 #define	SECURITY_SERVICE_RID			(0x00000006L)
152 #define	SECURITY_ANONYMOUS_LOGON_RID		(0x00000007L)
153 #define	SECURITY_PROXY_RID			(0x00000008L)
154 #define	SECURITY_ENTERPRISE_CONTROLLERS_RID	(0x00000009L)
155 #define	SECURITY_SERVER_LOGON_RID	SECURITY_ENTERPRISE_CONTROLLERS_RID
156 #define	SECURITY_PRINCIPAL_SELF_RID		(0x0000000AL)
157 #define	SECURITY_AUTHENTICATED_USER_RID		(0x0000000BL)
158 #define	SECURITY_RESTRICTED_CODE_RID		(0x0000000CL)
159 
160 #define	SECURITY_LOCAL_SYSTEM_RID		(0x00000012L)
161 #define	SECURITY_NT_NON_UNIQUE			(0x00000015L)
162 #define	SECURITY_BUILTIN_DOMAIN_RID		(0x00000020L)
163 
164 
165 #define	NT_SID_NON_UNIQUE_SUBAUTH 21
166 
167 
168 /*
169  * Common definition for a SID.
170  */
171 #define	NT_SID_REVISION		1
172 #define	NT_SID_AUTH_MAX		6
173 #define	NT_SID_SUBAUTH_MAX	15
174 
175 
176 /*
177  * Security Identifier (SID)
178  *
179  * The security identifier (SID) uniquely identifies a user, group or
180  * a domain. It consists of a revision number, the identifier authority,
181  * and a list of sub-authorities. The revision number is currently 1.
182  * The identifier authority identifies which system issued the SID. The
183  * sub-authorities of a domain SID uniquely identify a domain. A user
184  * or group SID consists of a domain SID with the user or group id
185  * appended. The user or group id (also known as a relative id (RID)
186  * uniquely identifies a user within a domain. A user or group SID
187  * uniquely identifies a user or group across all domains. The SidType
188  * values identify the various types of SID.
189  *
190  *      1   1   1   1   1   1
191  *      5   4   3   2   1   0   9   8   7   6   5   4   3   2   1   0
192  *   +---------------------------------------------------------------+
193  *   |      SubAuthorityCount        |Reserved1 (SBZ)|   Revision    |
194  *   +---------------------------------------------------------------+
195  *   |                   IdentifierAuthority[0]                      |
196  *   +---------------------------------------------------------------+
197  *   |                   IdentifierAuthority[1]                      |
198  *   +---------------------------------------------------------------+
199  *   |                   IdentifierAuthority[2]                      |
200  *   +---------------------------------------------------------------+
201  *   |                                                               |
202  *   +- -  -  -  -  -  -  -  SubAuthority[]  -  -  -  -  -  -  -  - -+
203  *   |                                                               |
204  *   +---------------------------------------------------------------+
205  *
206  */
207 /*
208  * Note: NT defines the Identifier Authority as a separate
209  * structure (SID_IDENTIFIER_AUTHORITY) containing a literal
210  * definition of a 6 byte vector but the effect is the same
211  * as defining it as a member value.
212  */
213 typedef struct smb_sid {
214 	uint8_t sid_revision;
215 	uint8_t sid_subauthcnt;
216 	uint8_t sid_authority[NT_SID_AUTH_MAX];
217 	uint32_t sid_subauth[ANY_SIZE_ARRAY];
218 } smb_sid_t;
219 
220 /*
221  * Well-known account structure
222  */
223 typedef struct smb_wka {
224 	uint16_t	wka_type;
225 	uint8_t		wka_domidx;
226 	char		*wka_sid;
227 	char		*wka_name;
228 	uint16_t	wka_flags;
229 	char		*wka_desc;
230 	smb_sid_t	*wka_binsid;
231 } smb_wka_t;
232 
233 /*
234  * Defined values for smb_wka.wka_flags
235  *
236  * SMB_WKAFLG_LGRP_ENABLE		Can be added as local group
237  */
238 #define	SMB_WKAFLG_LGRP_ENABLE	0x1
239 
240 /*
241  * The maximum size of a SID in string format
242  */
243 #define	SMB_SID_STRSZ		256
244 
245 boolean_t smb_sid_isvalid(smb_sid_t *);
246 int smb_sid_len(smb_sid_t *);
247 smb_sid_t *smb_sid_dup(smb_sid_t *);
248 smb_sid_t *smb_sid_splice(smb_sid_t *, uint32_t);
249 int smb_sid_getrid(smb_sid_t *, uint32_t *);
250 int smb_sid_split(smb_sid_t *, uint32_t *);
251 boolean_t smb_sid_cmp(smb_sid_t *, smb_sid_t *);
252 boolean_t smb_sid_islocal(smb_sid_t *);
253 boolean_t smb_sid_indomain(smb_sid_t *, smb_sid_t *);
254 void smb_sid_free(smb_sid_t *);
255 int smb_sid_splitstr(char *, uint32_t *);
256 void smb_sid_tostr(smb_sid_t *, char *);
257 smb_sid_t *smb_sid_fromstr(char *);
258 char *smb_sid_type2str(uint16_t);
259 
260 
261 /*
262  * Well-known account interfaces
263  */
264 int smb_wka_init(void);
265 void smb_wka_fini(void);
266 smb_wka_t *smb_wka_lookup(char *);
267 char *smb_wka_lookup_sid(smb_sid_t *, uint16_t *);
268 smb_sid_t *smb_wka_lookup_name(char *, uint16_t *);
269 char *smb_wka_lookup_domain(char *);
270 boolean_t smb_wka_is_wellknown(char *);
271 
272 
273 #ifdef __cplusplus
274 }
275 #endif
276 
277 
278 #endif /* _SMB_SID_H */
279