diff options
Diffstat (limited to 'source3/librpc/ndr/ndr_sec_helper.c')
| -rw-r--r-- | source3/librpc/ndr/ndr_sec_helper.c | 832 |
1 files changed, 774 insertions, 58 deletions
diff --git a/source3/librpc/ndr/ndr_sec_helper.c b/source3/librpc/ndr/ndr_sec_helper.c index edbdd9a40e..944b172d6c 100644 --- a/source3/librpc/ndr/ndr_sec_helper.c +++ b/source3/librpc/ndr/ndr_sec_helper.c @@ -91,97 +91,813 @@ void ndr_print_dom_sid28(struct ndr_print *ndr, const char *name, const struct d ndr_print_dom_sid(ndr, name, sid); } +static NTSTATUS ndr_push_security_ace_flags(struct ndr_push *ndr, int ndr_flags, uint8_t r) +{ + NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, r)); + return NT_STATUS_OK; +} -/* - parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field -*/ -NTSTATUS ndr_pull_dom_sid2(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid) +static NTSTATUS ndr_pull_security_ace_flags(struct ndr_pull *ndr, int ndr_flags, uint8_t *r) +{ + uint8_t v; + NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &v)); + *r = v; + return NT_STATUS_OK; +} + +void ndr_print_security_ace_flags(struct ndr_print *ndr, const char *name, uint8_t r) +{ + ndr_print_uint8(ndr, name, r); + ndr->depth++; + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_OBJECT_INHERIT", SEC_ACE_FLAG_OBJECT_INHERIT, r); + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_CONTAINER_INHERIT", SEC_ACE_FLAG_CONTAINER_INHERIT, r); + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_NO_PROPAGATE_INHERIT", SEC_ACE_FLAG_NO_PROPAGATE_INHERIT, r); + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_INHERIT_ONLY", SEC_ACE_FLAG_INHERIT_ONLY, r); + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_INHERITED_ACE", SEC_ACE_FLAG_INHERITED_ACE, r); + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_VALID_INHERIT", SEC_ACE_FLAG_VALID_INHERIT, r); + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_SUCCESSFUL_ACCESS", SEC_ACE_FLAG_SUCCESSFUL_ACCESS, r); + ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_FAILED_ACCESS", SEC_ACE_FLAG_FAILED_ACCESS, r); + ndr->depth--; +} + +static NTSTATUS ndr_push_security_ace_type(struct ndr_push *ndr, int ndr_flags, enum security_ace_type r) +{ + NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, r)); + return NT_STATUS_OK; +} + +static NTSTATUS ndr_pull_security_ace_type(struct ndr_pull *ndr, int ndr_flags, enum security_ace_type *r) +{ + uint8_t v; + NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &v)); + *r = v; + return NT_STATUS_OK; +} + +void ndr_print_security_ace_type(struct ndr_print *ndr, const char *name, enum security_ace_type r) +{ + const char *val = NULL; + + switch (r) { + case SEC_ACE_TYPE_ACCESS_ALLOWED: val = "SEC_ACE_TYPE_ACCESS_ALLOWED"; break; + case SEC_ACE_TYPE_ACCESS_DENIED: val = "SEC_ACE_TYPE_ACCESS_DENIED"; break; + case SEC_ACE_TYPE_SYSTEM_AUDIT: val = "SEC_ACE_TYPE_SYSTEM_AUDIT"; break; + case SEC_ACE_TYPE_SYSTEM_ALARM: val = "SEC_ACE_TYPE_SYSTEM_ALARM"; break; + case SEC_ACE_TYPE_ALLOWED_COMPOUND: val = "SEC_ACE_TYPE_ALLOWED_COMPOUND"; break; + case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: val = "SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT"; break; + case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: val = "SEC_ACE_TYPE_ACCESS_DENIED_OBJECT"; break; + case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: val = "SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT"; break; + case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: val = "SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT"; break; + } + ndr_print_enum(ndr, name, "ENUM", val, r); +} + +static NTSTATUS ndr_push_security_ace_object_flags(struct ndr_push *ndr, int ndr_flags, uint32_t r) +{ + NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r)); + return NT_STATUS_OK; +} + +static NTSTATUS ndr_pull_security_ace_object_flags(struct ndr_pull *ndr, int ndr_flags, uint32_t *r) +{ + uint32_t v; + NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v)); + *r = v; + return NT_STATUS_OK; +} + +void ndr_print_security_ace_object_flags(struct ndr_print *ndr, const char *name, uint32_t r) { - uint32_t num_auths; - if (!(ndr_flags & NDR_SCALARS)) { - return NT_STATUS_OK; + ndr_print_uint32(ndr, name, r); + ndr->depth++; + ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SEC_ACE_OBJECT_TYPE_PRESENT", SEC_ACE_OBJECT_TYPE_PRESENT, r); + ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT", SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT, r); + ndr->depth--; +} + +static NTSTATUS ndr_push_security_ace_object_type(struct ndr_push *ndr, int ndr_flags, const union security_ace_object_type *r) +{ + int level; + level = ndr_push_get_switch_value(ndr, r); + if (ndr_flags & NDR_SCALARS) { + switch (level) { + case SEC_ACE_OBJECT_TYPE_PRESENT: + NDR_CHECK(ndr_push_GUID(ndr, NDR_SCALARS, &r->type)); + break; + + default: + break; + + } } - NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &num_auths)); - NDR_CHECK(ndr_pull_dom_sid(ndr, ndr_flags, sid)); - if (sid->num_auths != num_auths) { - return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, - "Bad array size %u should exceed %u", - num_auths, sid->num_auths); + if (ndr_flags & NDR_BUFFERS) { + switch (level) { + case SEC_ACE_OBJECT_TYPE_PRESENT: + break; + + default: + break; + + } } return NT_STATUS_OK; } -/* - parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field -*/ -NTSTATUS ndr_push_dom_sid2(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid) +static NTSTATUS ndr_pull_security_ace_object_type(struct ndr_pull *ndr, int ndr_flags, union security_ace_object_type *r) { - if (!(ndr_flags & NDR_SCALARS)) { - return NT_STATUS_OK; + int level; + level = ndr_pull_get_switch_value(ndr, r); + if (ndr_flags & NDR_SCALARS) { + switch (level) { + case SEC_ACE_OBJECT_TYPE_PRESENT: { + NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->type)); + break; } + + default: { + break; } + + } } - NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, sid->num_auths)); - return ndr_push_dom_sid(ndr, ndr_flags, sid); + if (ndr_flags & NDR_BUFFERS) { + switch (level) { + case SEC_ACE_OBJECT_TYPE_PRESENT: + break; + + default: + break; + + } + } + return NT_STATUS_OK; } -/* - parse a dom_sid28 - this is a dom_sid in a fixed 28 byte buffer, so we need to ensure there are only upto 5 sub_auth -*/ -NTSTATUS ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid) +void ndr_print_security_ace_object_type(struct ndr_print *ndr, const char *name, const union security_ace_object_type *r) +{ + int level; + level = ndr_print_get_switch_value(ndr, r); + ndr_print_union(ndr, name, level, "security_ace_object_type"); + switch (level) { + case SEC_ACE_OBJECT_TYPE_PRESENT: + ndr_print_GUID(ndr, "type", &r->type); + break; + + default: + break; + + } +} + +static NTSTATUS ndr_push_security_ace_object_inherited_type(struct ndr_push *ndr, int ndr_flags, const union security_ace_object_inherited_type *r) { - NTSTATUS status; - struct ndr_pull *subndr; + int level; + level = ndr_push_get_switch_value(ndr, r); + if (ndr_flags & NDR_SCALARS) { + switch (level) { + case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT: + NDR_CHECK(ndr_push_GUID(ndr, NDR_SCALARS, &r->inherited_type)); + break; - if (!(ndr_flags & NDR_SCALARS)) { - return NT_STATUS_OK; + default: + break; + + } } + if (ndr_flags & NDR_BUFFERS) { + switch (level) { + case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT: + break; - subndr = talloc_zero(ndr, struct ndr_pull); - NT_STATUS_HAVE_NO_MEMORY(subndr); - subndr->flags = ndr->flags; - subndr->current_mem_ctx = ndr->current_mem_ctx; + default: + break; - subndr->data = ndr->data + ndr->offset; - subndr->data_size = 28; - subndr->offset = 0; + } + } + return NT_STATUS_OK; +} + +static NTSTATUS ndr_pull_security_ace_object_inherited_type(struct ndr_pull *ndr, int ndr_flags, union security_ace_object_inherited_type *r) +{ + int level; + level = ndr_pull_get_switch_value(ndr, r); + if (ndr_flags & NDR_SCALARS) { + switch (level) { + case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT: { + NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->inherited_type)); + break; } - NDR_CHECK(ndr_pull_advance(ndr, 28)); + default: { + break; } - status = ndr_pull_dom_sid(subndr, ndr_flags, sid); - if (!NT_STATUS_IS_OK(status)) { - /* handle a w2k bug which send random data in the buffer */ - ZERO_STRUCTP(sid); + } } + if (ndr_flags & NDR_BUFFERS) { + switch (level) { + case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT: + break; + default: + break; + + } + } return NT_STATUS_OK; } -/* - push a dom_sid28 - this is a dom_sid in a 28 byte fixed buffer -*/ -NTSTATUS ndr_push_dom_sid28(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid) +void ndr_print_security_ace_object_inherited_type(struct ndr_print *ndr, const char *name, const union security_ace_object_inherited_type *r) +{ + int level; + level = ndr_print_get_switch_value(ndr, r); + ndr_print_union(ndr, name, level, "security_ace_object_inherited_type"); + switch (level) { + case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT: + ndr_print_GUID(ndr, "inherited_type", &r->inherited_type); + break; + + default: + break; + + } +} + +static NTSTATUS ndr_push_security_ace_object(struct ndr_push *ndr, int ndr_flags, const struct security_ace_object *r) +{ + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_push_align(ndr, 4)); + NDR_CHECK(ndr_push_security_ace_object_flags(ndr, NDR_SCALARS, r->flags)); + NDR_CHECK(ndr_push_set_switch_value(ndr, &r->type, r->flags&SEC_ACE_OBJECT_TYPE_PRESENT)); + NDR_CHECK(ndr_push_security_ace_object_type(ndr, NDR_SCALARS, &r->type)); + NDR_CHECK(ndr_push_set_switch_value(ndr, &r->inherited_type, r->flags&SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)); + NDR_CHECK(ndr_push_security_ace_object_inherited_type(ndr, NDR_SCALARS, &r->inherited_type)); + } + if (ndr_flags & NDR_BUFFERS) { + NDR_CHECK(ndr_push_security_ace_object_type(ndr, NDR_BUFFERS, &r->type)); + NDR_CHECK(ndr_push_security_ace_object_inherited_type(ndr, NDR_BUFFERS, &r->inherited_type)); + } + return NT_STATUS_OK; +} + +static NTSTATUS ndr_pull_security_ace_object(struct ndr_pull *ndr, int ndr_flags, struct security_ace_object *r) +{ + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_pull_align(ndr, 4)); + NDR_CHECK(ndr_pull_security_ace_object_flags(ndr, NDR_SCALARS, &r->flags)); + NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->type, r->flags&SEC_ACE_OBJECT_TYPE_PRESENT)); + NDR_CHECK(ndr_pull_security_ace_object_type(ndr, NDR_SCALARS, &r->type)); + NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->inherited_type, r->flags&SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT)); + NDR_CHECK(ndr_pull_security_ace_object_inherited_type(ndr, NDR_SCALARS, &r->inherited_type)); + } + if (ndr_flags & NDR_BUFFERS) { + NDR_CHECK(ndr_pull_security_ace_object_type(ndr, NDR_BUFFERS, &r->type)); + NDR_CHECK(ndr_pull_security_ace_object_inherited_type(ndr, NDR_BUFFERS, &r->inherited_type)); + } + return NT_STATUS_OK; +} + +void ndr_print_security_ace_object(struct ndr_print *ndr, const char *name, const struct security_ace_object *r) +{ + ndr_print_struct(ndr, name, "security_ace_object"); + ndr->depth++; + ndr_print_security_ace_object_flags(ndr, "flags", r->flags); + ndr_print_set_switch_value(ndr, &r->type, r->flags&SEC_ACE_OBJECT_TYPE_PRESENT); + ndr_print_security_ace_object_type(ndr, "type", &r->type); + ndr_print_set_switch_value(ndr, &r->inherited_type, r->flags&SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT); + ndr_print_security_ace_object_inherited_type(ndr, "inherited_type", &r->inherited_type); + ndr->depth--; +} + +static NTSTATUS ndr_push_security_ace_object_ctr(struct ndr_push *ndr, int ndr_flags, const union security_ace_object_ctr *r) +{ + int level; + level = ndr_push_get_switch_value(ndr, r); + if (ndr_flags & NDR_SCALARS) { + switch (level) { + case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; + + case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; + + case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; + + case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; + + default: + break; + + } + } + if (ndr_flags & NDR_BUFFERS) { + switch (level) { + case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: + NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + default: + break; + + } + } + return NT_STATUS_OK; +} + +static NTSTATUS ndr_pull_security_ace_object_ctr(struct ndr_pull *ndr, int ndr_flags, union security_ace_object_ctr *r) +{ + int level; + level = ndr_pull_get_switch_value(ndr, r); + if (ndr_flags & NDR_SCALARS) { + switch (level) { + case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: { + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; } + + case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: { + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; } + + case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: { + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; } + + case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: { + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object)); + break; } + + default: { + break; } + + } + } + if (ndr_flags & NDR_BUFFERS) { + switch (level) { + case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: + NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object)); + break; + + default: + break; + + } + } + return NT_STATUS_OK; +} + +void ndr_print_security_ace_object_ctr(struct ndr_print *ndr, const char *name, const union security_ace_object_ctr *r) +{ + int level; + level = ndr_print_get_switch_value(ndr, r); + ndr_print_union(ndr, name, level, "security_ace_object_ctr"); + switch (level) { + case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: + ndr_print_security_ace_object(ndr, "object", &r->object); + break; + + case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: + ndr_print_security_ace_object(ndr, "object", &r->object); + break; + + case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: + ndr_print_security_ace_object(ndr, "object", &r->object); + break; + + case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: + ndr_print_security_ace_object(ndr, "object", &r->object); + break; + + default: + break; + + } +} + +NTSTATUS ndr_push_security_ace(struct ndr_push *ndr, int ndr_flags, const struct security_ace *r) +{ + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_push_align(ndr, 4)); + NDR_CHECK(ndr_push_security_ace_type(ndr, NDR_SCALARS, r->type)); + NDR_CHECK(ndr_push_security_ace_flags(ndr, NDR_SCALARS, r->flags)); + NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, ndr_size_security_ace(r,ndr->flags))); + NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->access_mask)); + NDR_CHECK(ndr_push_set_switch_value(ndr, &r->object, r->type)); + NDR_CHECK(ndr_push_security_ace_object_ctr(ndr, NDR_SCALARS, &r->object)); + NDR_CHECK(ndr_push_dom_sid(ndr, NDR_SCALARS, &r->trustee)); + } + if (ndr_flags & NDR_BUFFERS) { + NDR_CHECK(ndr_push_security_ace_object_ctr(ndr, NDR_BUFFERS, &r->object)); + } + return NT_STATUS_OK; +} + +NTSTATUS ndr_pull_security_ace(struct ndr_pull *ndr, int ndr_flags, struct security_ace *r) +{ + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_pull_align(ndr, 4)); + NDR_CHECK(ndr_pull_security_ace_type(ndr, NDR_SCALARS, &r->type)); + NDR_CHECK(ndr_pull_security_ace_flags(ndr, NDR_SCALARS, &r->flags)); + NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->size)); + NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->access_mask)); + NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->object, r->type)); + NDR_CHECK(ndr_pull_security_ace_object_ctr(ndr, NDR_SCALARS, &r->object)); + NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, &r->trustee)); + } + if (ndr_flags & NDR_BUFFERS) { + NDR_CHECK(ndr_pull_security_ace_object_ctr(ndr, NDR_BUFFERS, &r->object)); + } + return NT_STATUS_OK; +} + +void ndr_print_security_ace(struct ndr_print *ndr, const char *name, const struct security_ace *r) +{ + ndr_print_struct(ndr, name, "security_ace"); + ndr->depth++; + ndr_print_security_ace_type(ndr, "type", r->type); + ndr_print_security_ace_flags(ndr, "flags", r->flags); + ndr_print_uint16(ndr, "size", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?ndr_size_security_ace(r,ndr->flags):r->size); + ndr_print_uint32(ndr, "access_mask", r->access_mask); + ndr_print_set_switch_value(ndr, &r->object, r->type); + ndr_print_security_ace_object_ctr(ndr, "object", &r->object); + ndr_print_dom_sid(ndr, "trustee", &r->trustee); + ndr->depth--; +} + +static NTSTATUS ndr_push_security_acl_revision(struct ndr_push *ndr, int ndr_flags, enum security_acl_revision r) +{ + NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r)); + return NT_STATUS_OK; +} + +static NTSTATUS ndr_pull_security_acl_revision(struct ndr_pull *ndr, int ndr_flags, enum security_acl_revision *r) +{ + uint16_t v; + NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &v)); + *r = v; + return NT_STATUS_OK; +} + +void ndr_print_security_acl_revision(struct ndr_print *ndr, const char *name, enum security_acl_revision r) +{ + const char *val = NULL; + + switch (r) { + case SECURITY_ACL_REVISION_NT4: val = "SECURITY_ACL_REVISION_NT4"; break; + case SECURITY_ACL_REVISION_ADS: val = "SECURITY_ACL_REVISION_ADS"; break; + } + ndr_print_enum(ndr, name, "ENUM", val, r); +} + +NTSTATUS ndr_push_security_acl(struct ndr_push *ndr, int ndr_flags, const struct security_acl *r) { - uint32_t old_offset; - uint32_t padding; + uint32_t cntr_aces_0; + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_push_align(ndr, 4)); + NDR_CHECK(ndr_push_security_acl_revision(ndr, NDR_SCALARS, r->revision)); + NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, ndr_size_security_acl(r,ndr->flags))); + NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->num_aces)); + for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) { + NDR_CHECK(ndr_push_security_ace(ndr, NDR_SCALARS, &r->aces[cntr_aces_0])); + } + } + if (ndr_flags & NDR_BUFFERS) { + for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) { + NDR_CHECK(ndr_push_security_ace(ndr, NDR_BUFFERS, &r->aces[cntr_aces_0])); + } + } + return NT_STATUS_OK; +} - if (!(ndr_flags & NDR_SCALARS)) { - return NT_STATUS_OK; +NTSTATUS ndr_pull_security_acl(struct ndr_pull *ndr, int ndr_flags, struct security_acl *r) +{ + uint32_t cntr_aces_0; + TALLOC_CTX *_mem_save_aces_0; + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_pull_align(ndr, 4)); + NDR_CHECK(ndr_pull_security_acl_revision(ndr, NDR_SCALARS, &r->revision)); + NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->size)); + NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_aces)); + if (r->num_aces < 0 || r->num_aces > 1000) { + return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range"); + } + NDR_PULL_ALLOC_N(ndr, r->aces, r->num_aces); + _mem_save_aces_0 = NDR_PULL_GET_MEM_CTX(ndr); + NDR_PULL_SET_MEM_CTX(ndr, r->aces, 0); + for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) { + NDR_CHECK(ndr_pull_security_ace(ndr, NDR_SCALARS, &r->aces[cntr_aces_0])); + } + NDR_PULL_SET_MEM_CTX(ndr, _mem_save_aces_0, 0); + } + if (ndr_flags & NDR_BUFFERS) { + _mem_save_aces_0 = NDR_PULL_GET_MEM_CTX(ndr); + NDR_PULL_SET_MEM_CTX(ndr, r->aces, 0); + for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) { + NDR_CHECK(ndr_pull_security_ace(ndr, NDR_BUFFERS, &r->aces[cntr_aces_0])); + } + NDR_PULL_SET_MEM_CTX(ndr, _mem_save_aces_0, 0); } + return NT_STATUS_OK; +} + +void ndr_print_security_acl(struct ndr_print *ndr, const char *name, const struct security_acl *r) +{ + uint32_t cntr_aces_0; + ndr_print_struct(ndr, name, "security_acl"); + ndr->depth++; + ndr_print_security_acl_revision(ndr, "revision", r->revision); + ndr_print_uint16(ndr, "size", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?ndr_size_security_acl(r,ndr->flags):r->size); + ndr_print_uint32(ndr, "num_aces", r->num_aces); + ndr->print(ndr, "%s: ARRAY(%d)", "aces", r->num_aces); + ndr->depth++; + for (cntr_aces_0=0;cntr_aces_0<r->num_aces;cntr_aces_0++) { + char *idx_0=NULL; + asprintf(&idx_0, "[%d]", cntr_aces_0); + if (idx_0) { + ndr_print_security_ace(ndr, "aces", &r->aces[cntr_aces_0]); + free(idx_0); + } + } + ndr->depth--; + ndr->depth--; +} + +static NTSTATUS ndr_push_security_descriptor_revision(struct ndr_push *ndr, int ndr_flags, enum security_descriptor_revision r) +{ + NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, r)); + return NT_STATUS_OK; +} + +static NTSTATUS ndr_pull_security_descriptor_revision(struct ndr_pull *ndr, int ndr_flags, enum security_descriptor_revision *r) +{ + uint8_t v; + NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &v)); + *r = v; + return NT_STATUS_OK; +} - if (sid->num_auths > 5) { - return ndr_push_error(ndr, NDR_ERR_RANGE, - "dom_sid28 allows only upto 5 sub auth [%u]", - sid->num_auths); +void ndr_print_security_descriptor_revision(struct ndr_print *ndr, const char *name, enum security_descriptor_revision r) +{ + const char *val = NULL; + + switch (r) { + case SECURITY_DESCRIPTOR_REVISION_1: val = "SECURITY_DESCRIPTOR_REVISION_1"; break; } + ndr_print_enum(ndr, name, "ENUM", val, r); +} + +static NTSTATUS ndr_push_security_descriptor_type(struct ndr_push *ndr, int ndr_flags, uint16_t r) +{ + NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r)); + return NT_STATUS_OK; +} - old_offset = ndr->offset; - NDR_CHECK(ndr_push_dom_sid(ndr, ndr_flags, sid)); +static NTSTATUS ndr_pull_security_descriptor_type(struct ndr_pull *ndr, int ndr_flags, uint16_t *r) +{ + uint16_t v; + NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &v)); + *r = v; + return NT_STATUS_OK; +} + +void ndr_print_security_descriptor_type(struct ndr_print *ndr, const char *name, uint16_t r) +{ + ndr_print_uint16(ndr, name, r); + ndr->depth++; + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_OWNER_DEFAULTED", SEC_DESC_OWNER_DEFAULTED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_GROUP_DEFAULTED", SEC_DESC_GROUP_DEFAULTED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_PRESENT", SEC_DESC_DACL_PRESENT, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_DEFAULTED", SEC_DESC_DACL_DEFAULTED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_PRESENT", SEC_DESC_SACL_PRESENT, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_DEFAULTED", SEC_DESC_SACL_DEFAULTED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_TRUSTED", SEC_DESC_DACL_TRUSTED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SERVER_SECURITY", SEC_DESC_SERVER_SECURITY, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_AUTO_INHERIT_REQ", SEC_DESC_DACL_AUTO_INHERIT_REQ, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_AUTO_INHERIT_REQ", SEC_DESC_SACL_AUTO_INHERIT_REQ, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_AUTO_INHERITED", SEC_DESC_DACL_AUTO_INHERITED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_AUTO_INHERITED", SEC_DESC_SACL_AUTO_INHERITED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_PROTECTED", SEC_DESC_DACL_PROTECTED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_PROTECTED", SEC_DESC_SACL_PROTECTED, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_RM_CONTROL_VALID", SEC_DESC_RM_CONTROL_VALID, r); + ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SELF_RELATIVE", SEC_DESC_SELF_RELATIVE, r); + ndr->depth--; +} - padding = 28 - (ndr->offset - old_offset); +NTSTATUS ndr_push_security_descriptor(struct ndr_push *ndr, int ndr_flags, const struct security_descriptor *r) +{ + { + uint32_t _flags_save_STRUCT = ndr->flags; + ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN); + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_push_align(ndr, 4)); + NDR_CHECK(ndr_push_security_descriptor_revision(ndr, NDR_SCALARS, r->revision)); + NDR_CHECK(ndr_push_security_descriptor_type(ndr, NDR_SCALARS, r->type)); + NDR_CHECK(ndr_push_relative_ptr1(ndr, r->owner_sid)); + NDR_CHECK(ndr_push_relative_ptr1(ndr, r->group_sid)); + NDR_CHECK(ndr_push_relative_ptr1(ndr, r->sacl)); + NDR_CHECK(ndr_push_relative_ptr1(ndr, r->dacl)); + } + if (ndr_flags & NDR_BUFFERS) { + if (r->owner_sid) { + NDR_CHECK(ndr_push_relative_ptr2(ndr, r->owner_sid)); + NDR_CHECK(ndr_push_dom_sid(ndr, NDR_SCALARS, r->owner_sid)); + } + if (r->group_sid) { + NDR_CHECK(ndr_push_relative_ptr2(ndr, r->group_sid)); + NDR_CHECK(ndr_push_dom_sid(ndr, NDR_SCALARS, r->group_sid)); + } + if (r->sacl) { + NDR_CHECK(ndr_push_relative_ptr2(ndr, r->sacl)); + NDR_CHECK(ndr_push_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->sacl)); + } + if (r->dacl) { + NDR_CHECK(ndr_push_relative_ptr2(ndr, r->dacl)); + NDR_CHECK(ndr_push_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->dacl)); + } + } + ndr->flags = _flags_save_STRUCT; + } + return NT_STATUS_OK; +} + +NTSTATUS ndr_pull_security_descriptor(struct ndr_pull *ndr, int ndr_flags, struct security_descriptor *r) +{ + uint32_t _ptr_owner_sid; + TALLOC_CTX *_mem_save_owner_sid_0; + uint32_t _ptr_group_sid; + TALLOC_CTX *_mem_save_group_sid_0; + uint32_t _ptr_sacl; + TALLOC_CTX *_mem_save_sacl_0; + uint32_t _ptr_dacl; + TALLOC_CTX *_mem_save_dacl_0; + { + uint32_t _flags_save_STRUCT = ndr->flags; + ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN); + if (ndr_flags & NDR_SCALARS) { + NDR_CHECK(ndr_pull_align(ndr, 4)); + NDR_CHECK(ndr_pull_security_descriptor_revision(ndr, NDR_SCALARS, &r->revision)); + NDR_CHECK(ndr_pull_security_descriptor_type(ndr, NDR_SCALARS, &r->type)); + NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_owner_sid)); + if (_ptr_owner_sid) { + NDR_PULL_ALLOC(ndr, r->owner_sid); + NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->owner_sid, _ptr_owner_sid)); + } else { + r->owner_sid = NULL; + } + NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_group_sid)); + if (_ptr_group_sid) { + NDR_PULL_ALLOC(ndr, r->group_sid); + NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->group_sid, _ptr_group_sid)); + } else { + r->group_sid = NULL; + } + NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sacl)); + if (_ptr_sacl) { + NDR_PULL_ALLOC(ndr, r->sacl); + NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->sacl, _ptr_sacl)); + } else { + r->sacl = NULL; + } + NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_dacl)); + if (_ptr_dacl) { + NDR_PULL_ALLOC(ndr, r->dacl); + NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->dacl, _ptr_dacl)); + } else { + r->dacl = NULL; + } + } + if (ndr_flags & NDR_BUFFERS) { + if (r->owner_sid) { + struct ndr_pull_save _relative_save; + ndr_pull_save(ndr, &_relative_save); + NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->owner_sid)); + _mem_save_owner_sid_0 = NDR_PULL_GET_MEM_CTX(ndr); + NDR_PULL_SET_MEM_CTX(ndr, r->owner_sid, 0); + NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, r->owner_sid)); + NDR_PULL_SET_MEM_CTX(ndr, _mem_save_owner_sid_0, 0); + ndr_pull_restore(ndr, &_relative_save); + } + if (r->group_sid) { + struct ndr_pull_save _relative_save; + ndr_pull_save(ndr, &_relative_save); + NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->group_sid)); + _mem_save_group_sid_0 = NDR_PULL_GET_MEM_CTX(ndr); + NDR_PULL_SET_MEM_CTX(ndr, r->group_sid, 0); + NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, r->group_sid)); + NDR_PULL_SET_MEM_CTX(ndr, _mem_save_group_sid_0, 0); + ndr_pull_restore(ndr, &_relative_save); + } + if (r->sacl) { + struct ndr_pull_save _relative_save; + ndr_pull_save(ndr, &_relative_save); + NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->sacl)); + _mem_save_sacl_0 = NDR_PULL_GET_MEM_CTX(ndr); + NDR_PULL_SET_MEM_CTX(ndr, r->sacl, 0); + NDR_CHECK(ndr_pull_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->sacl)); + NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sacl_0, 0); + ndr_pull_restore(ndr, &_relative_save); + } + if (r->dacl) { + struct ndr_pull_save _relative_save; + ndr_pull_save(ndr, &_relative_save); + NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->dacl)); + _mem_save_dacl_0 = NDR_PULL_GET_MEM_CTX(ndr); + NDR_PULL_SET_MEM_CTX(ndr, r->dacl, 0); + NDR_CHECK(ndr_pull_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->dacl)); + NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dacl_0, 0); + ndr_pull_restore(ndr, &_relative_save); + } + } + ndr->flags = _flags_save_STRUCT; + } + return NT_STATUS_OK; +} - if (padding > 0) { - NDR_CHECK(ndr_push_zero(ndr, padding)); +void ndr_print_security_descriptor(struct ndr_print *ndr, const char *name, const struct security_descriptor *r) +{ + ndr_print_struct(ndr, name, "security_descriptor"); + { + uint32_t _flags_save_STRUCT = ndr->flags; + ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN); + ndr->depth++; + ndr_print_security_descriptor_revision(ndr, "revision", r->revision); + ndr_print_security_descriptor_type(ndr, "type", r->type); + ndr_print_ptr(ndr, "owner_sid", r->owner_sid); + ndr->depth++; + if (r->owner_sid) { + ndr_print_dom_sid(ndr, "owner_sid", r->owner_sid); + } + ndr->depth--; + ndr_print_ptr(ndr, "group_sid", r->group_sid); + ndr->depth++; + if (r->group_sid) { + ndr_print_dom_sid(ndr, "group_sid", r->group_sid); + } + ndr->depth--; + ndr_print_ptr(ndr, "sacl", r->sacl); + ndr->depth++; + if (r->sacl) { + ndr_print_security_acl(ndr, "sacl", r->sacl); + } + ndr->depth--; + ndr_print_ptr(ndr, "dacl", r->dacl); + ndr->depth++; + if (r->dacl) { + ndr_print_security_acl(ndr, "dacl", r->dacl); + } + ndr->depth--; + ndr->depth--; + ndr->flags = _flags_save_STRUCT; } +} +NTSTATUS ndr_push_security_secinfo(struct ndr_push *ndr, int ndr_flags, uint32_t r) +{ + NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r)); return NT_STATUS_OK; } +NTSTATUS ndr_pull_security_secinfo(struct ndr_pull *ndr, int ndr_flags, uint32_t *r) +{ + uint32_t v; + NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v)); + *r = v; + return NT_STATUS_OK; +} + +void ndr_print_security_secinfo(struct ndr_print *ndr, const char *name, uint32_t r) +{ + ndr_print_uint32(ndr, name, r); + ndr->depth++; + ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_OWNER", SECINFO_OWNER, r); + ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_GROUP", SECINFO_GROUP, r); + ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_DACL", SECINFO_DACL, r); + ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_SACL", SECINFO_SACL, r); + ndr->depth--; +} + |