From 597c5a6caa871b724ee1337f14467950b0707b34 Mon Sep 17 00:00:00 2001 From: Luke Leighton Date: Thu, 12 Nov 1998 19:21:20 +0000 Subject: jean-f. sent me some S-1-3-0,1,2,3 SIDs and names. S-1-3 doesn't exist. security descriptor testing. hey wow, you can get a SD then send it back! (This used to be commit 7466c3113ef8f8a89b8496efadfeb611c9f3e069) --- source3/include/proto.h | 5 ++- source3/rpc_parse/parse_misc.c | 5 +-- source3/rpc_parse/parse_prs.c | 8 +--- source3/rpc_parse/parse_reg.c | 19 ++++++--- source3/rpc_parse/parse_sec.c | 30 +++++++++---- source3/rpc_server/srv_sid.c | 15 +++++-- source3/rpcclient/cmd_reg.c | 96 +++++++++++++++++++++++++++++++++++++++++- source3/rpcclient/rpcclient.c | 1 + 8 files changed, 149 insertions(+), 30 deletions(-) (limited to 'source3') diff --git a/source3/include/proto.h b/source3/include/proto.h index dc36273fc8..e7f48ce044 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -1480,7 +1480,7 @@ void smb_io_unihdr(char *desc, UNIHDR *hdr, prs_struct *ps, int depth); void make_buf_hdr(BUFHDR *hdr, int max_len, int len); void smb_io_hdrbuf_pre(char *desc, BUFHDR *hdr, prs_struct *ps, int depth, uint32 *offset); void smb_io_hdrbuf_post(char *desc, BUFHDR *hdr, prs_struct *ps, int depth, - uint32 ptr_hdrbuf, uint32 start_offset); + uint32 ptr_hdrbuf, uint32 max_len, uint32 len); void smb_io_hdrbuf(char *desc, BUFHDR *hdr, prs_struct *ps, int depth); void make_uni_hdr2(UNIHDR2 *hdr, int max_len, int len, uint16 terminate); void smb_io_unihdr2(char *desc, UNIHDR2 *hdr2, prs_struct *ps, int depth); @@ -1631,7 +1631,7 @@ BOOL prs_uint16_post(char *name, prs_struct *ps, int depth, uint16 *data16, uint32 ptr_uint16, uint32 start_offset); BOOL prs_uint32_pre(char *name, prs_struct *ps, int depth, uint32 *data32, uint32 *offset); BOOL prs_uint32_post(char *name, prs_struct *ps, int depth, uint32 *data32, - uint32 ptr_uint32, uint32 start_offset); + uint32 ptr_uint32, uint32 data_size); /*The following definitions come from rpc_parse/parse_reg.c */ @@ -2124,6 +2124,7 @@ void cmd_reg_create_val(struct client_info *info); void cmd_reg_delete_val(struct client_info *info); void cmd_reg_delete_key(struct client_info *info); void cmd_reg_create_key(struct client_info *info); +void cmd_reg_test_key_sec(struct client_info *info); void cmd_reg_get_key_sec(struct client_info *info); /*The following definitions come from rpcclient/cmd_samr.c */ diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c index 9d5620bbf0..4c387e0628 100644 --- a/source3/rpc_parse/parse_misc.c +++ b/source3/rpc_parse/parse_misc.c @@ -319,15 +319,14 @@ void smb_io_hdrbuf_pre(char *desc, BUFHDR *hdr, prs_struct *ps, int depth, uint does nothing on reading, as that is already handled by ...._pre() ********************************************************************/ void smb_io_hdrbuf_post(char *desc, BUFHDR *hdr, prs_struct *ps, int depth, - uint32 ptr_hdrbuf, uint32 start_offset) + uint32 ptr_hdrbuf, uint32 max_len, uint32 len) { if (!ps->io) { /* storing: go back and do a retrospective job. i hate this */ - int data_size = ps->offset - start_offset; uint32 old_offset = ps->offset; - make_buf_hdr(hdr, data_size, data_size); + make_buf_hdr(hdr, max_len, len); ps->offset = ptr_hdrbuf; smb_io_hdrbuf(desc, hdr, ps, depth); ps->offset = old_offset; diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c index 8df7d06a39..75432627ab 100644 --- a/source3/rpc_parse/parse_prs.c +++ b/source3/rpc_parse/parse_prs.c @@ -366,22 +366,16 @@ BOOL prs_uint32_pre(char *name, prs_struct *ps, int depth, uint32 *data32, uint3 does nothing on reading, as that is already handled by ...._pre() ********************************************************************/ BOOL prs_uint32_post(char *name, prs_struct *ps, int depth, uint32 *data32, - uint32 ptr_uint32, uint32 start_offset) + uint32 ptr_uint32, uint32 data_size) { if (!ps->io) { /* storing: go back and do a retrospective job. i hate this */ - uint32 data_size = ps->offset - start_offset; uint32 old_offset = ps->offset; - ps->offset = ptr_uint32; prs_uint32(name, ps, depth, &data_size); ps->offset = old_offset; } - else - { - ps->offset = start_offset + (*data32); - } return True; } diff --git a/source3/rpc_parse/parse_reg.c b/source3/rpc_parse/parse_reg.c index 7e9b12b4ec..f22bf10ff8 100644 --- a/source3/rpc_parse/parse_reg.c +++ b/source3/rpc_parse/parse_reg.c @@ -551,7 +551,7 @@ void make_reg_q_set_key_sec(REG_Q_SET_KEY_SEC *q_i, POLICY_HND *pol, memcpy(&(q_i->pol), pol, sizeof(q_i->pol)); - q_i->unknown = 0x7; + q_i->unknown = 0x4; q_i->ptr = 1; make_buf_hdr(&(q_i->hdr_sec), buf_len, buf_len); @@ -582,8 +582,10 @@ void reg_io_q_set_key_sec(char *desc, REG_Q_SET_KEY_SEC *r_q, prs_struct *ps, i smb_io_hdrbuf_pre("hdr_sec", &(r_q->hdr_sec), ps, depth, &hdr_offset); old_offset = ps->offset; sec_io_desc_buf("data ", &(r_q->data ), ps, depth); + smb_io_hdrbuf_post("hdr_sec", &(r_q->hdr_sec), ps, depth, hdr_offset, + r_q->data.max_len, r_q->data.len); + ps->offset = old_offset + r_q->data.len + sizeof(uint32) * 3; prs_align(ps); - smb_io_hdrbuf_post("hdr_sec", &(r_q->hdr_sec), ps, depth, hdr_offset, old_offset); } } @@ -594,7 +596,7 @@ void reg_io_r_set_key_sec(char *desc, REG_R_SET_KEY_SEC *r_q, prs_struct *ps, in { if (r_q == NULL) return; - prs_debug(ps, depth, desc, "reg_io_r_get_key_sec"); + prs_debug(ps, depth, desc, "reg_io_r_set_key_sec"); depth++; prs_align(ps); @@ -644,9 +646,14 @@ void reg_io_q_get_key_sec(char *desc, REG_Q_GET_KEY_SEC *r_q, prs_struct *ps, i if (r_q->ptr != 0) { - smb_io_hdrbuf ("hdr_sec", &(r_q->hdr_sec), ps, depth); - sec_io_desc_buf("data ", r_q->data , ps, depth); - + uint32 hdr_offset; + uint32 old_offset; + smb_io_hdrbuf_pre("hdr_sec", &(r_q->hdr_sec), ps, depth, &hdr_offset); + old_offset = ps->offset; + sec_io_desc_buf("data ", r_q->data , ps, depth); + smb_io_hdrbuf_post("hdr_sec", &(r_q->hdr_sec), ps, depth, hdr_offset, + r_q->data->max_len, r_q->data->len); + ps->offset = old_offset + r_q->data->len + sizeof(uint32) * 3; prs_align(ps); } } diff --git a/source3/rpc_parse/parse_sec.c b/source3/rpc_parse/parse_sec.c index e94a2a32dd..7ef6914108 100644 --- a/source3/rpc_parse/parse_sec.c +++ b/source3/rpc_parse/parse_sec.c @@ -137,36 +137,46 @@ static void sec_io_desc(char *desc, SEC_DESC *t, prs_struct *ps, int depth) if (IS_BITS_SET_ALL(t->type, SEC_DESC_DACL_PRESENT)) { - prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl ), off_dacl , old_offset); + prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl ), off_dacl , ps->offset - old_offset); + ps->offset = old_offset + t->off_dacl; sec_io_acl ("dacl" , &t->dacl , ps, depth); prs_align(ps); } else { - prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl ), off_dacl , old_offset); + prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl ), off_dacl , 0); } if (IS_BITS_SET_ALL(t->type, SEC_DESC_SACL_PRESENT)) { - prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl ), off_sacl , old_offset); + prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl ), off_sacl , ps->offset - old_offset); + ps->offset = old_offset + t->off_sacl; sec_io_acl ("sacl" , &t->sacl , ps, depth); prs_align(ps); } else { - prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl ), off_sacl , ps->offset); + prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl ), off_sacl , 0); } - prs_uint32_post("off_owner_sid", ps, depth, &(t->off_owner_sid), off_owner_sid, old_offset); + prs_uint32_post("off_owner_sid", ps, depth, &(t->off_owner_sid), off_owner_sid, ps->offset - old_offset); if (t->off_owner_sid != 0) { + if (ps->io) + { + ps->offset = old_offset + t->off_owner_sid; + } smb_io_dom_sid("owner_sid ", &t->owner_sid , ps, depth); prs_align(ps); } - prs_uint32_post("off_grp_sid ", ps, depth, &(t->off_grp_sid ), off_grp_sid , old_offset); + prs_uint32_post("off_grp_sid ", ps, depth, &(t->off_grp_sid ), off_grp_sid , ps->offset - old_offset); if (t->off_grp_sid != 0) { + if (ps->io) + { + ps->offset = old_offset + t->off_grp_sid; + } smb_io_dom_sid("grp_sid", &t->grp_sid, ps, depth); prs_align(ps); } @@ -193,7 +203,9 @@ reads or writes a SEC_DESC_BUF structure. void sec_io_desc_buf(char *desc, SEC_DESC_BUF *sec, prs_struct *ps, int depth) { uint32 off_len; + uint32 off_max_len; uint32 old_offset; + uint32 size; if (sec == NULL) return; @@ -202,7 +214,7 @@ void sec_io_desc_buf(char *desc, SEC_DESC_BUF *sec, prs_struct *ps, int depth) prs_align(ps); - prs_uint32 ("max_len", ps, depth, &(sec->max_len)); + prs_uint32_pre("max_len", ps, depth, &(sec->max_len), &off_max_len); prs_uint32 ("undoc ", ps, depth, &(sec->undoc )); prs_uint32_pre("len ", ps, depth, &(sec->len ), &off_len); @@ -214,6 +226,8 @@ void sec_io_desc_buf(char *desc, SEC_DESC_BUF *sec, prs_struct *ps, int depth) sec_io_desc("sec ", sec->sec, ps, depth); } - prs_uint32_post("len ", ps, depth, &(sec->len ), off_len , old_offset); + size = ps->offset - old_offset; + prs_uint32_post("max_len", ps, depth, &(sec->max_len), off_max_len, size == 0 ? sec->max_len : size); + prs_uint32_post("len ", ps, depth, &(sec->len ), off_len , size); } diff --git a/source3/rpc_server/srv_sid.c b/source3/rpc_server/srv_sid.c index b80902dbaa..29cc1c936c 100644 --- a/source3/rpc_server/srv_sid.c +++ b/source3/rpc_server/srv_sid.c @@ -63,8 +63,11 @@ DOM_SID global_member_sid; DOM_SID global_sid_S_1_5_20; /* local well-known domain */ DOM_SID global_sid_S_1_1; /* everyone */ -DOM_SID global_sid_S_1_3; /* */ DOM_SID global_sid_S_1_5; /* NT Authority */ +DOM_SID global_sid_S_1_3_0; /* Creator owner */ +DOM_SID global_sid_S_1_3_1; /* Creator group */ +DOM_SID global_sid_S_1_3_2; /* Creator owner server */ +DOM_SID global_sid_S_1_3_3; /* Creator group server */ extern pstring global_myworkgroup; /* extern fstring global_member_dom_name; */ @@ -79,7 +82,10 @@ sid_name_map[] = { { &global_sid_S_1_5_20, "BUILTIN" }, { &global_sid_S_1_1 , "Everyone" }, - { &global_sid_S_1_3 , "don't know" }, + { &global_sid_S_1_3_0 , "Creator Owner" }, + { &global_sid_S_1_3_1 , "Creator Group" }, + { &global_sid_S_1_3_2 , "Creator Owner Server" }, + { &global_sid_S_1_3_3 , "Creator Group Server" }, { &global_sid_S_1_5 , "NT Authority" }, { &global_sam_sid , global_sam_name }, { &global_member_sid , global_myworkgroup }, @@ -211,7 +217,10 @@ void generate_wellknown_sids(void) { string_to_sid(&global_sid_S_1_5_20, "S-1-5-32"); string_to_sid(&global_sid_S_1_1 , "S-1-1" ); - string_to_sid(&global_sid_S_1_3 , "S-1-3" ); + string_to_sid(&global_sid_S_1_3_0 , "S-1-3-0" ); + string_to_sid(&global_sid_S_1_3_1 , "S-1-3-1" ); + string_to_sid(&global_sid_S_1_3_2 , "S-1-3-2" ); + string_to_sid(&global_sid_S_1_3_3 , "S-1-3-3" ); string_to_sid(&global_sid_S_1_5 , "S-1-5" ); } diff --git a/source3/rpcclient/cmd_reg.c b/source3/rpcclient/cmd_reg.c index fd5fc71828..ada125e448 100644 --- a/source3/rpcclient/cmd_reg.c +++ b/source3/rpcclient/cmd_reg.c @@ -717,7 +717,7 @@ void cmd_reg_create_key(struct client_info *info) /**************************************************************************** nt registry security info ****************************************************************************/ -void cmd_reg_get_key_sec(struct client_info *info) +void cmd_reg_test_key_sec(struct client_info *info) { BOOL res = True; BOOL res3 = True; @@ -779,6 +779,10 @@ void cmd_reg_get_key_sec(struct client_info *info) display_sec_desc(out_hnd, ACTION_HEADER , sec_buf.sec); display_sec_desc(out_hnd, ACTION_ENUMERATE, sec_buf.sec); display_sec_desc(out_hnd, ACTION_FOOTER , sec_buf.sec); + + res4 = res4 ? do_reg_set_key_sec(smb_cli, &key_pol, + sec_buf_size, sec_buf.sec) : False; + free(sec_buf.sec); } @@ -805,3 +809,93 @@ void cmd_reg_get_key_sec(struct client_info *info) } } +/**************************************************************************** +nt registry security info +****************************************************************************/ +void cmd_reg_get_key_sec(struct client_info *info) +{ + BOOL res = True; + BOOL res3 = True; + BOOL res4 = True; + + POLICY_HND key_pol; + fstring full_keyname; + fstring key_name; + + /* + * security info + */ + + uint32 sec_buf_size; + SEC_DESC_BUF sec_buf; + + DEBUG(5, ("cmd_reg_get_key_sec: smb_cli->fd:%d\n", smb_cli->fd)); + + if (!next_token(NULL, full_keyname, NULL, sizeof(full_keyname))) + { + fprintf(out_hnd, "reggetsec \n"); + return; + } + + /* open WINREG session. */ + res = res ? cli_nt_session_open(smb_cli, PIPE_WINREG) : False; + + /* open registry receive a policy handle */ + res = res ? do_reg_connect(smb_cli, full_keyname, key_name, + &info->dom.reg_pol_connect) : False; + + if ((*key_name) != 0) + { + /* open an entry */ + res3 = res ? do_reg_open_entry(smb_cli, &info->dom.reg_pol_connect, + key_name, 0x02000000, &key_pol) : False; + } + else + { + memcpy(&key_pol, &info->dom.reg_pol_connect, sizeof(key_pol)); + } + + /* open an entry */ + res3 = res ? do_reg_open_entry(smb_cli, &info->dom.reg_pol_connect, + key_name, 0x02000000, &key_pol) : False; + + /* query key sec info. first call sets sec_buf_size. */ + sec_buf_size = 0; + sec_buf.sec = NULL; + + res4 = res3 ? do_reg_get_key_sec(smb_cli, &key_pol, + &sec_buf_size, &sec_buf) : False; + + res4 = res4 ? do_reg_get_key_sec(smb_cli, &key_pol, + &sec_buf_size, &sec_buf) : False; + + if (res4 && sec_buf.len > 0 && sec_buf.sec != NULL) + { + display_sec_desc(out_hnd, ACTION_HEADER , sec_buf.sec); + display_sec_desc(out_hnd, ACTION_ENUMERATE, sec_buf.sec); + display_sec_desc(out_hnd, ACTION_FOOTER , sec_buf.sec); + free(sec_buf.sec); + } + + /* close the key handle */ + if ((*key_name) != 0) + { + res3 = res3 ? do_reg_close(smb_cli, &key_pol) : False; + } + + /* close the registry handles */ + res = res ? do_reg_close(smb_cli, &info->dom.reg_pol_connect) : False; + + /* close the session */ + cli_nt_session_close(smb_cli); + + if (res && res3 && res4) + { + DEBUG(5,("cmd_reg_get_key_sec: query succeeded\n")); + } + else + { + DEBUG(5,("cmd_reg_get_key_sec: query failed\n")); + } +} + diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index 5fbd8e1cbc..bf003893bc 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -112,6 +112,7 @@ struct {"regdeleteval",cmd_reg_delete_val, " Registry Value Delete"}, {"regcreateval",cmd_reg_create_val, " Registry Key Create"}, {"reggetsec", cmd_reg_get_key_sec, " Registry Key Security"}, + {"regtestsec", cmd_reg_test_key_sec, " Test Registry Key Security"}, {"ntlogin", cmd_netlogon_login_test, "[username] [password] NT Domain login test"}, {"wksinfo", cmd_wks_query_info, "Workstation Query Info"}, {"srvinfo", cmd_srv_query_info, "Server Query Info"}, -- cgit