Ejemplo n.º 1
0
/* Fills the samr_RidWithAttributeArray with the provided sids.
 * If it happens that we have additional groups that do not belong
 * to the domain, add their sids as extra sids */
static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
				    const struct dom_sid *sids,
				    size_t num_sids)
{
	uint32_t attributes = SE_GROUP_MANDATORY |
				SE_GROUP_ENABLED_BY_DEFAULT |
				SE_GROUP_ENABLED;
	struct samr_RidWithAttributeArray *groups;
	struct dom_sid *domain_sid;
	unsigned int i;
	NTSTATUS status;
	uint32_t rid;
	bool ok;

	domain_sid = info3->base.domain_sid;
	groups = &info3->base.groups;

	groups->rids = talloc_array(info3,
				    struct samr_RidWithAttribute, num_sids);
	if (!groups->rids) {
		return NT_STATUS_NO_MEMORY;
	}

	for (i = 0; i < num_sids; i++) {
		ok = sid_peek_check_rid(domain_sid, &sids[i], &rid);
		if (ok) {
			/* store domain group rid */
			groups->rids[groups->count].rid = rid;
			groups->rids[groups->count].attributes = attributes;
			groups->count++;
			continue;
		}

		/* if this wasn't a domain sid, add it as extra sid */
		status = append_netr_SidAttr(info3, &info3->sids,
					     &info3->sidcount,
					     &sids[i], attributes);
		if (!NT_STATUS_IS_OK(status)) {
			return status;
		}
	}

	return NT_STATUS_OK;
}
Ejemplo n.º 2
0
static NTSTATUS merge_resource_sids(const struct PAC_LOGON_INFO *logon_info,
				struct netr_SamInfo3 *info3)
{
	uint32_t i = 0;
	const struct PAC_DOMAIN_GROUP_MEMBERSHIP *rg = NULL;

	if (logon_info->info3.base.user_flags & NETLOGON_RESOURCE_GROUPS) {
		rg = &logon_info->resource_groups;
	}

	if (rg == NULL) {
		return NT_STATUS_OK;
	}

	if (rg->domain_sid == NULL) {
		DEBUG(10, ("Missing Resource Group Domain SID\n"));
		return NT_STATUS_INVALID_PARAMETER;
	}

	/* The IDL layer would be a better place to check this, but to
	 * guard the integer addition below, we double-check */
	if (rg->groups.count > 65535) {
		DEBUG(10, ("Too much Resource Group RIDs %u\n",
			  (unsigned)rg->groups.count));
		return NT_STATUS_INVALID_PARAMETER;
	}

	/*
	 * If there are any resource groups (SID Compression) add
	 * them to the extra sids portion of the info3 in the PAC.
	 *
	 * This makes the info3 look like it would if we got the info
	 * from the DC rather than the PAC.
	 */

	/*
	 * Construct a SID for each RID in the list and then append it
	 * to the info3.
	 */
	for (i = 0; i < rg->groups.count; i++) {
		NTSTATUS status;
		struct dom_sid new_sid;
		uint32_t attributes = rg->groups.rids[i].attributes;

		sid_compose(&new_sid,
			    rg->domain_sid,
			    rg->groups.rids[i].rid);

		DEBUG(10, ("Adding SID %s to extra SIDS\n",
			sid_string_dbg(&new_sid)));

		status = append_netr_SidAttr(info3, &info3->sids,
					&info3->sidcount,
					&new_sid,
					attributes);
		if (!NT_STATUS_IS_OK(status)) {
			DEBUG(1, ("failed to append SID %s to extra SIDS: %s\n",
				sid_string_dbg(&new_sid),
				nt_errstr(status)));
			return status;
		}
	}

	return NT_STATUS_OK;
}