/*
return the wire size of a security descriptor
*/
size_t ndr_size_security_descriptor(const struct security_descriptor *sd, int flags)
{
size_t ret;
if (!sd) return 0;
ret = 20;
ret += ndr_size_dom_sid(sd->owner_sid, flags);
ret += ndr_size_dom_sid(sd->group_sid, flags);
ret += ndr_size_security_acl(sd->dacl, flags);
ret += ndr_size_security_acl(sd->sacl, flags);
return ret;
}
/*
return the wire size of a security_ace
*/
size_t ndr_size_security_ace(const struct security_ace *ace, int flags)
{
size_t ret;
if (!ace) return 0;
ret = 8 + ndr_size_dom_sid(&ace->trustee, flags);
switch (ace->type) {
case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
ret += 4; /* uint32 bitmap ace->object.object.flags */
if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
ret += 16; /* GUID ace->object.object.type.type */
}
if (ace->object.object.flags & SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT) {
ret += 16; /* GUID ace->object.object.inherited_typeinherited_type */
}
break;
default:
break;
}
return ret;
}
char *sid_binstring_hex_talloc(TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
{
int len = ndr_size_dom_sid(sid, 0);
uint8_t buf[len];
sid_linearize(buf, len, sid);
return hex_encode_talloc(mem_ctx, buf, len);
}
bool cli_set_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_STRUCT *pqt)
{
bool ret = False;
uint16 setup;
char params[2];
char data[112];
char *rparam=NULL, *rdata=NULL;
unsigned int rparam_count=0, rdata_count=0;
unsigned int sid_len;
memset(data,'\0',112);
if (!cli||!pqt) {
smb_panic("cli_set_user_quota() called with NULL Pointer!");
}
setup = NT_TRANSACT_SET_USER_QUOTA;
SSVAL(params,0,quota_fnum);
sid_len = ndr_size_dom_sid(&pqt->sid, NULL, 0);
SIVAL(data,0,0);
SIVAL(data,4,sid_len);
SBIG_UINT(data, 8,(uint64_t)0);
SBIG_UINT(data,16,pqt->usedspace);
SBIG_UINT(data,24,pqt->softlim);
SBIG_UINT(data,32,pqt->hardlim);
sid_linearize(data+40, sid_len, &pqt->sid);
if (!cli_send_nt_trans(cli,
NT_TRANSACT_SET_USER_QUOTA,
0,
&setup, 1, 0,
params, 2, 0,
data, 112, 0)) {
DEBUG(1,("Failed to send NT_TRANSACT_SET_USER_QUOTA\n"));
goto cleanup;
}
if (!cli_receive_nt_trans(cli,
&rparam, &rparam_count,
&rdata, &rdata_count)) {
DEBUG(1,("NT_TRANSACT_SET_USER_QUOTA failed\n"));
goto cleanup;
}
if (cli_is_error(cli)) {
ret = False;
goto cleanup;
} else {
ret = True;
}
cleanup:
SAFE_FREE(rparam);
SAFE_FREE(rdata);
return ret;
}
NTSTATUS cli_get_user_quota(struct cli_state *cli, int quota_fnum,
SMB_NTQUOTA_STRUCT *pqt)
{
uint16_t setup[1];
uint8_t params[16];
unsigned int data_len;
uint8_t data[SID_MAX_SIZE+8];
uint8_t *rparam, *rdata;
uint32_t rparam_count, rdata_count;
unsigned int sid_len;
unsigned int offset;
NTSTATUS status;
if (!cli||!pqt) {
smb_panic("cli_get_user_quota() called with NULL Pointer!");
}
SSVAL(setup + 0, 0, NT_TRANSACT_GET_USER_QUOTA);
SSVAL(params, 0,quota_fnum);
SSVAL(params, 2,TRANSACT_GET_USER_QUOTA_FOR_SID);
SIVAL(params, 4,0x00000024);
SIVAL(params, 8,0x00000000);
SIVAL(params,12,0x00000024);
sid_len = ndr_size_dom_sid(&pqt->sid, 0);
data_len = sid_len+8;
SIVAL(data, 0, 0x00000000);
SIVAL(data, 4, sid_len);
sid_linearize((char *)data+8, sid_len, &pqt->sid);
status = cli_trans(talloc_tos(), cli, SMBnttrans,
NULL, -1, /* name, fid */
NT_TRANSACT_GET_USER_QUOTA, 0,
setup, 1, 0, /* setup */
params, 16, 4, /* params */
data, data_len, 112, /* data */
NULL, /* recv_flags2 */
NULL, 0, NULL, /* rsetup */
&rparam, 4, &rparam_count,
&rdata, 8, &rdata_count);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("NT_TRANSACT_GET_USER_QUOTA failed: %s\n",
nt_errstr(status)));
return status;
}
if (!parse_user_quota_record(rdata, rdata_count, &offset, pqt)) {
status = NT_STATUS_INVALID_NETWORK_RESPONSE;
DEBUG(0,("Got INVALID NT_TRANSACT_GET_USER_QUOTA reply.\n"));
}
TALLOC_FREE(rparam);
TALLOC_FREE(rdata);
return status;
}
void init_sec_ace(struct security_ace *t, const struct dom_sid *sid, enum security_ace_type type,
uint32_t mask, uint8_t flag)
{
t->type = type;
t->flags = flag;
t->size = ndr_size_dom_sid(sid, 0) + 8;
t->access_mask = mask;
t->trustee = *sid;
}
void init_sec_ace(SEC_ACE *t, const DOM_SID *sid, enum security_ace_type type,
uint32 mask, uint8 flag)
{
t->type = type;
t->flags = flag;
t->size = ndr_size_dom_sid(sid, 0) + 8;
t->access_mask = mask;
ZERO_STRUCTP(&t->trustee);
sid_copy(&t->trustee, sid);
}
char *sid_binstring_hex(const DOM_SID *sid)
{
char *buf, *s;
int len = ndr_size_dom_sid(sid, NULL, 0);
buf = (char *)SMB_MALLOC(len);
if (!buf)
return NULL;
sid_linearize(buf, len, sid);
s = binary_string(buf, len);
free(buf);
return s;
}
bool sid_linearize(uint8_t *outbuf, size_t len, const struct dom_sid *sid)
{
size_t i;
if (len < ndr_size_dom_sid(sid, 0))
return False;
SCVAL(outbuf,0,sid->sid_rev_num);
SCVAL(outbuf,1,sid->num_auths);
memcpy(&outbuf[2], sid->id_auth, 6);
for(i = 0; i < sid->num_auths; i++)
SIVAL(outbuf, 8 + (i*4), sid->sub_auths[i]);
return True;
}
NTSTATUS cli_set_user_quota(struct cli_state *cli, int quota_fnum,
SMB_NTQUOTA_STRUCT *pqt)
{
uint16_t setup[1];
uint8_t params[2];
uint8_t data[112];
unsigned int sid_len;
NTSTATUS status;
memset(data,'\0',112);
if (!cli||!pqt) {
smb_panic("cli_set_user_quota() called with NULL Pointer!");
}
SSVAL(setup + 0, 0, NT_TRANSACT_SET_USER_QUOTA);
SSVAL(params,0,quota_fnum);
sid_len = ndr_size_dom_sid(&pqt->sid, 0);
SIVAL(data,0,0);
SIVAL(data,4,sid_len);
SBIG_UINT(data, 8,(uint64_t)0);
SBIG_UINT(data,16,pqt->usedspace);
SBIG_UINT(data,24,pqt->softlim);
SBIG_UINT(data,32,pqt->hardlim);
sid_linearize((char *)data+40, sid_len, &pqt->sid);
status = cli_trans(talloc_tos(), cli, SMBnttrans,
NULL, -1, /* name, fid */
NT_TRANSACT_SET_USER_QUOTA, 0,
setup, 1, 0, /* setup */
params, 2, 0, /* params */
data, 112, 0, /* data */
NULL, /* recv_flags2 */
NULL, 0, NULL, /* rsetup */
NULL, 0, NULL, /* rparams */
NULL, 0, NULL); /* rdata */
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("NT_TRANSACT_SET_USER_QUOTA failed: %s\n",
nt_errstr(status)));
}
return status;
}
static bool delete_sid_cache(const struct dom_sid* psid)
{
DATA_BLOB sid = data_blob_const(psid, ndr_size_dom_sid(psid, 0));
DATA_BLOB id;
if (memcache_lookup(NULL, SID_GID_CACHE, sid, &id)) {
DEBUG(3, ("Delete mapping %s <-> GID %d from memcache\n",
sid_string_dbg(psid), *(int*)id.data));
memcache_delete(NULL, SID_GID_CACHE, sid);
memcache_delete(NULL, GID_SID_CACHE, id);
} else if (memcache_lookup(NULL, SID_UID_CACHE, sid, &id)) {
DEBUG(3, ("Delete mapping %s <-> UID %d from memcache\n",
sid_string_dbg(psid), *(int*)id.data));
memcache_delete(NULL, SID_UID_CACHE, sid);
memcache_delete(NULL, UID_SID_CACHE, id);
} else {
DEBUG(3, ("SID %s is not memcached!\n", sid_string_dbg(psid)));
return false;
}
return true;
}
NTSTATUS sec_ace_add_sid(TALLOC_CTX *ctx, SEC_ACE **pp_new, SEC_ACE *old, unsigned *num, DOM_SID *sid, uint32 mask)
{
unsigned int i = 0;
if (!ctx || !pp_new || !old || !sid || !num) return NT_STATUS_INVALID_PARAMETER;
*num += 1;
if((pp_new[0] = TALLOC_ZERO_ARRAY(ctx, SEC_ACE, *num )) == 0)
return NT_STATUS_NO_MEMORY;
for (i = 0; i < *num - 1; i ++)
sec_ace_copy(&(*pp_new)[i], &old[i]);
(*pp_new)[i].type = SEC_ACE_TYPE_ACCESS_ALLOWED;
(*pp_new)[i].flags = 0;
(*pp_new)[i].size = SEC_ACE_HEADER_SIZE + ndr_size_dom_sid(sid, 0);
(*pp_new)[i].access_mask = mask;
sid_copy(&(*pp_new)[i].trustee, sid);
return NT_STATUS_OK;
}
bool cli_get_user_quota(struct cli_state *cli, int quota_fnum, SMB_NTQUOTA_STRUCT *pqt)
{
bool ret = False;
uint16 setup;
char params[16];
unsigned int data_len;
char data[SID_MAX_SIZE+8];
char *rparam=NULL, *rdata=NULL;
unsigned int rparam_count=0, rdata_count=0;
unsigned int sid_len;
unsigned int offset;
if (!cli||!pqt) {
smb_panic("cli_get_user_quota() called with NULL Pointer!");
}
setup = NT_TRANSACT_GET_USER_QUOTA;
SSVAL(params, 0,quota_fnum);
SSVAL(params, 2,TRANSACT_GET_USER_QUOTA_FOR_SID);
SIVAL(params, 4,0x00000024);
SIVAL(params, 8,0x00000000);
SIVAL(params,12,0x00000024);
sid_len = ndr_size_dom_sid(&pqt->sid, NULL, 0);
data_len = sid_len+8;
SIVAL(data, 0, 0x00000000);
SIVAL(data, 4, sid_len);
sid_linearize(data+8, sid_len, &pqt->sid);
if (!cli_send_nt_trans(cli,
NT_TRANSACT_GET_USER_QUOTA,
0,
&setup, 1, 0,
params, 16, 4,
data, data_len, 112)) {
DEBUG(1,("Failed to send NT_TRANSACT_GET_USER_QUOTA\n"));
goto cleanup;
}
if (!cli_receive_nt_trans(cli,
&rparam, &rparam_count,
&rdata, &rdata_count)) {
DEBUG(1,("Failed to recv NT_TRANSACT_GET_USER_QUOTA\n"));
goto cleanup;
}
if (cli_is_error(cli)) {
ret = False;
goto cleanup;
} else {
ret = True;
}
if ((rparam&&rdata)&&(rparam_count>=4&&rdata_count>=8)) {
ret = parse_user_quota_record(rdata, rdata_count, &offset, pqt);
} else {
DEBUG(0,("Got INVALID NT_TRANSACT_GET_USER_QUOTA reply.\n"));
ret = False;
}
cleanup:
SAFE_FREE(rparam);
SAFE_FREE(rdata);
return ret;
}
SEC_DESC *make_sec_desc(TALLOC_CTX *ctx,
enum security_descriptor_revision revision,
uint16 type,
const DOM_SID *owner_sid, const DOM_SID *grp_sid,
SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size)
{
SEC_DESC *dst;
uint32 offset = 0;
*sd_size = 0;
if(( dst = TALLOC_ZERO_P(ctx, SEC_DESC)) == NULL)
return NULL;
dst->revision = revision;
dst->type = type;
if (sacl)
dst->type |= SEC_DESC_SACL_PRESENT;
if (dacl)
dst->type |= SEC_DESC_DACL_PRESENT;
dst->owner_sid = NULL;
dst->group_sid = NULL;
dst->sacl = NULL;
dst->dacl = NULL;
if(owner_sid && ((dst->owner_sid = sid_dup_talloc(dst,owner_sid)) == NULL))
goto error_exit;
if(grp_sid && ((dst->group_sid = sid_dup_talloc(dst,grp_sid)) == NULL))
goto error_exit;
if(sacl && ((dst->sacl = dup_sec_acl(dst, sacl)) == NULL))
goto error_exit;
if(dacl && ((dst->dacl = dup_sec_acl(dst, dacl)) == NULL))
goto error_exit;
offset = SEC_DESC_HEADER_SIZE;
/*
* Work out the linearization sizes.
*/
if (dst->sacl != NULL) {
offset += dst->sacl->size;
}
if (dst->dacl != NULL) {
offset += dst->dacl->size;
}
if (dst->owner_sid != NULL) {
offset += ndr_size_dom_sid(dst->owner_sid, 0);
}
if (dst->group_sid != NULL) {
offset += ndr_size_dom_sid(dst->group_sid, 0);
}
*sd_size = (size_t)offset;
return dst;
error_exit:
*sd_size = 0;
return NULL;
}
/*
return the wire size of a security_ace
*/
size_t ndr_size_security_ace(const struct security_ace *ace, int flags)
{
if (!ace) return 0;
return 8 + ndr_size_dom_sid(&ace->trustee, flags);
}