[SUBSYSTEM::NDR_SECURITY]
PUBLIC_DEPENDENCIES = NDR_MISC LIBSECURITY
-NDR_SECURITY_OBJ_FILES = $(gen_ndrsrcdir)/ndr_security.o $(ndrsrcdir)/ndr_sec_helper.o
+NDR_SECURITY_OBJ_FILES = $(gen_ndrsrcdir)/ndr_security.o \
+ $(ndrsrcdir)/ndr_sec_helper.o \
+ $(gen_ndrsrcdir)/ndr_dom_sid.o \
+ $(ndrsrcdir)/ndr_dom_sid.o
PUBLIC_HEADERS += $(gen_ndrsrcdir)/security.h
LIBRARY_REALNAME = samba/dcerpc/security.$(SHLIBEXT)
PRIVATE_DEPENDENCIES = PYTALLOC python_dcerpc_misc python_dcerpc
-python_dcerpc_security_OBJ_FILES = $(gen_ndrsrcdir)/py_security.o
+python_dcerpc_security_OBJ_FILES = $(gen_ndrsrcdir)/py_security.o \
+ $(gen_ndrsrcdir)/py_dom_sid.o
$(IDL_HEADER_FILES) $(IDL_NDR_PARSE_H_FILES) $(IDL_NDR_PARSE_C_FILES) \
$(IDL_NDR_CLIENT_C_FILES) $(IDL_NDR_CLIENT_H_FILES) \
--- /dev/null
+/*
+ use the same structure for dom_sid2 as dom_sid. A dom_sid2 is really
+ just a dom sid, but with the sub_auths represented as a conformant
+ array. As with all in-structure conformant arrays, the array length
+ is placed before the start of the structure. That's what gives rise
+ to the extra num_auths elemenent. We don't want the Samba code to
+ have to bother with such esoteric NDR details, so its easier to just
+ define it as a dom_sid and use pidl magic to make it all work. It
+ just means you need to mark a sid as a "dom_sid2" in the IDL when you
+ know it is of the conformant array variety
+*/
+cpp_quote("#define dom_sid2 dom_sid")
+
+/* same struct as dom_sid but inside a 28 bytes fixed buffer in NDR */
+cpp_quote("#define dom_sid28 dom_sid")
+
+/* same struct as dom_sid but in a variable byte buffer, which is maybe empty in NDR */
+cpp_quote("#define dom_sid0 dom_sid")
+
+[
+ pointer_default(unique)
+]
+interface dom_sid
+{
+ /* a domain SID. Note that unlike Samba3 this contains a pointer,
+ so you can't copy them using assignment */
+ typedef [public,gensize,noprint,noejs,nosize] struct {
+ uint8 sid_rev_num; /**< SID revision number */
+ [range(0,15)] int8 num_auths; /**< Number of sub-authorities */
+ uint8 id_auth[6]; /**< Identifier Authority */
+ uint32 sub_auths[num_auths];
+ } dom_sid;
+}
+
*/
import "misc.idl";
-
-/*
- use the same structure for dom_sid2 as dom_sid. A dom_sid2 is really
- just a dom sid, but with the sub_auths represented as a conformant
- array. As with all in-structure conformant arrays, the array length
- is placed before the start of the structure. That's what gives rise
- to the extra num_auths elemenent. We don't want the Samba code to
- have to bother with such esoteric NDR details, so its easier to just
- define it as a dom_sid and use pidl magic to make it all work. It
- just means you need to mark a sid as a "dom_sid2" in the IDL when you
- know it is of the conformant array variety
-*/
-cpp_quote("#define dom_sid2 dom_sid")
-
-/* same struct as dom_sid but inside a 28 bytes fixed buffer in NDR */
-cpp_quote("#define dom_sid28 dom_sid")
-
-/* same struct as dom_sid but in a variable byte buffer, which is maybe empty in NDR */
-cpp_quote("#define dom_sid0 dom_sid")
+import "dom_sid.idl";
[
+ helper("librpc/gen_ndr/ndr_dom_sid.h"),
pointer_default(unique)
]
interface security
SEC_PRIV_REMOTE_INTERACTIVE_LOGON = 24
} sec_privilege;
-
- /* a domain SID. Note that unlike Samba3 this contains a pointer,
- so you can't copy them using assignment */
- typedef [public,gensize,noprint,noejs,nosize] struct {
- uint8 sid_rev_num; /**< SID revision number */
- [range(0,15)] int8 num_auths; /**< Number of sub-authorities */
- uint8 id_auth[6]; /**< Identifier Authority */
- uint32 sub_auths[num_auths];
- } dom_sid;
-
/* id used to identify a endpoint, possibly in a cluster */
typedef [public] struct {
hyper id;
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ fast routines for getting the wire size of security objects
+
+ Copyright (C) Andrew Tridgell 2003
+ Copyright (C) Stefan Metzmacher 2006-2008
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+
+#include "includes.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "libcli/security/security.h"
+
+/*
+ return the wire size of a dom_sid
+*/
+size_t ndr_size_dom_sid(const struct dom_sid *sid, int flags)
+{
+ if (!sid) return 0;
+ return 8 + 4*sid->num_auths;
+}
+
+size_t ndr_size_dom_sid28(const struct dom_sid *sid, int flags)
+{
+ struct dom_sid zero_sid;
+
+ if (!sid) return 0;
+
+ ZERO_STRUCT(zero_sid);
+
+ if (memcmp(&zero_sid, sid, sizeof(zero_sid)) == 0) {
+ return 0;
+ }
+
+ return 8 + 4*sid->num_auths;
+}
+
+size_t ndr_size_dom_sid0(const struct dom_sid *sid, int flags)
+{
+ return ndr_size_dom_sid28(sid, flags);
+}
+
+/*
+ print a dom_sid
+*/
+void ndr_print_dom_sid(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
+{
+ ndr->print(ndr, "%-25s: %s", name, dom_sid_string(ndr, sid));
+}
+
+void ndr_print_dom_sid2(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
+{
+ ndr_print_dom_sid(ndr, name, sid);
+}
+
+void ndr_print_dom_sid28(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
+{
+ ndr_print_dom_sid(ndr, name, sid);
+}
+
+void ndr_print_dom_sid0(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
+{
+ ndr_print_dom_sid(ndr, name, sid);
+}
+
+
+/*
+ parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
+*/
+enum ndr_err_code ndr_pull_dom_sid2(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
+{
+ uint32_t num_auths;
+ if (!(ndr_flags & NDR_SCALARS)) {
+ return NDR_ERR_SUCCESS;
+ }
+ NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &num_auths));
+ NDR_CHECK(ndr_pull_dom_sid(ndr, ndr_flags, sid));
+ if (sid->num_auths != num_auths) {
+ return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE,
+ "Bad array size %u should exceed %u",
+ num_auths, sid->num_auths);
+ }
+ return NDR_ERR_SUCCESS;
+}
+
+/*
+ parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
+*/
+enum ndr_err_code ndr_push_dom_sid2(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
+{
+ if (!(ndr_flags & NDR_SCALARS)) {
+ return NDR_ERR_SUCCESS;
+ }
+ NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, sid->num_auths));
+ return ndr_push_dom_sid(ndr, ndr_flags, sid);
+}
+
+/*
+ parse a dom_sid28 - this is a dom_sid in a fixed 28 byte buffer, so we need to ensure there are only upto 5 sub_auth
+*/
+enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
+{
+ enum ndr_err_code status;
+ struct ndr_pull *subndr;
+
+ if (!(ndr_flags & NDR_SCALARS)) {
+ return NDR_ERR_SUCCESS;
+ }
+
+ subndr = talloc_zero(ndr, struct ndr_pull);
+ NDR_ERR_HAVE_NO_MEMORY(subndr);
+ subndr->flags = ndr->flags;
+ subndr->current_mem_ctx = ndr->current_mem_ctx;
+
+ subndr->data = ndr->data + ndr->offset;
+ subndr->data_size = 28;
+ subndr->offset = 0;
+
+ NDR_CHECK(ndr_pull_advance(ndr, 28));
+
+ status = ndr_pull_dom_sid(subndr, ndr_flags, sid);
+ if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
+ /* handle a w2k bug which send random data in the buffer */
+ ZERO_STRUCTP(sid);
+ } else if (sid->num_auths == 0 && sid->sub_auths) {
+ talloc_free(sid->sub_auths);
+ sid->sub_auths = NULL;
+ }
+
+ return NDR_ERR_SUCCESS;
+}
+
+/*
+ push a dom_sid28 - this is a dom_sid in a 28 byte fixed buffer
+*/
+enum ndr_err_code ndr_push_dom_sid28(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
+{
+ uint32_t old_offset;
+ uint32_t padding;
+
+ if (!(ndr_flags & NDR_SCALARS)) {
+ return NDR_ERR_SUCCESS;
+ }
+
+ if (sid->num_auths > 5) {
+ return ndr_push_error(ndr, NDR_ERR_RANGE,
+ "dom_sid28 allows only upto 5 sub auth [%u]",
+ sid->num_auths);
+ }
+
+ old_offset = ndr->offset;
+ NDR_CHECK(ndr_push_dom_sid(ndr, ndr_flags, sid));
+
+ padding = 28 - (ndr->offset - old_offset);
+
+ if (padding > 0) {
+ NDR_CHECK(ndr_push_zero(ndr, padding));
+ }
+
+ return NDR_ERR_SUCCESS;
+}
+
+/*
+ parse a dom_sid0 - this is a dom_sid in a variable byte buffer, which is maybe empty
+*/
+enum ndr_err_code ndr_pull_dom_sid0(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
+{
+ if (!(ndr_flags & NDR_SCALARS)) {
+ return NDR_ERR_SUCCESS;
+ }
+
+ if (ndr->data_size == ndr->offset) {
+ ZERO_STRUCTP(sid);
+ return NDR_ERR_SUCCESS;
+ }
+
+ return ndr_pull_dom_sid(ndr, ndr_flags, sid);
+}
+
+/*
+ push a dom_sid0 - this is a dom_sid in a variable byte buffer, which is maybe empty
+*/
+enum ndr_err_code ndr_push_dom_sid0(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
+{
+ struct dom_sid zero_sid;
+
+ if (!(ndr_flags & NDR_SCALARS)) {
+ return NDR_ERR_SUCCESS;
+ }
+
+ if (!sid) {
+ return NDR_ERR_SUCCESS;
+ }
+
+ ZERO_STRUCT(zero_sid);
+
+ if (memcmp(&zero_sid, sid, sizeof(zero_sid)) == 0) {
+ return NDR_ERR_SUCCESS;
+ }
+
+ return ndr_push_dom_sid(ndr, ndr_flags, sid);
+}
+
fast routines for getting the wire size of security objects
Copyright (C) Andrew Tridgell 2003
+ Copyright (C) Stefan Metzmacher 2006-2008
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include "librpc/gen_ndr/ndr_security.h"
#include "libcli/security/security.h"
-/*
- return the wire size of a dom_sid
-*/
-size_t ndr_size_dom_sid(const struct dom_sid *sid, int flags)
-{
- if (!sid) return 0;
- return 8 + 4*sid->num_auths;
-}
-
-size_t ndr_size_dom_sid28(const struct dom_sid *sid, int flags)
-{
- struct dom_sid zero_sid;
-
- if (!sid) return 0;
-
- ZERO_STRUCT(zero_sid);
-
- if (memcmp(&zero_sid, sid, sizeof(zero_sid)) == 0) {
- return 0;
- }
-
- return 8 + 4*sid->num_auths;
-}
-
-size_t ndr_size_dom_sid0(const struct dom_sid *sid, int flags)
-{
- return ndr_size_dom_sid28(sid, flags);
-}
-
/*
return the wire size of a security_ace
*/
return ret;
}
-/*
- print a dom_sid
-*/
-void ndr_print_dom_sid(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
-{
- ndr->print(ndr, "%-25s: %s", name, dom_sid_string(ndr, sid));
-}
-
-void ndr_print_dom_sid2(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
-{
- ndr_print_dom_sid(ndr, name, sid);
-}
-
-void ndr_print_dom_sid28(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
-{
- ndr_print_dom_sid(ndr, name, sid);
-}
-
-void ndr_print_dom_sid0(struct ndr_print *ndr, const char *name, const struct dom_sid *sid)
-{
- ndr_print_dom_sid(ndr, name, sid);
-}
-
-
-/*
- parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
-*/
-enum ndr_err_code ndr_pull_dom_sid2(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
-{
- uint32_t num_auths;
- if (!(ndr_flags & NDR_SCALARS)) {
- return NDR_ERR_SUCCESS;
- }
- NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &num_auths));
- NDR_CHECK(ndr_pull_dom_sid(ndr, ndr_flags, sid));
- if (sid->num_auths != num_auths) {
- return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE,
- "Bad array size %u should exceed %u",
- num_auths, sid->num_auths);
- }
- return NDR_ERR_SUCCESS;
-}
-
-/*
- parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
-*/
-enum ndr_err_code ndr_push_dom_sid2(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
-{
- if (!(ndr_flags & NDR_SCALARS)) {
- return NDR_ERR_SUCCESS;
- }
- NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, sid->num_auths));
- return ndr_push_dom_sid(ndr, ndr_flags, sid);
-}
-
-/*
- parse a dom_sid28 - this is a dom_sid in a fixed 28 byte buffer, so we need to ensure there are only upto 5 sub_auth
-*/
-enum ndr_err_code ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
-{
- enum ndr_err_code status;
- struct ndr_pull *subndr;
-
- if (!(ndr_flags & NDR_SCALARS)) {
- return NDR_ERR_SUCCESS;
- }
-
- subndr = talloc_zero(ndr, struct ndr_pull);
- NDR_ERR_HAVE_NO_MEMORY(subndr);
- subndr->flags = ndr->flags;
- subndr->current_mem_ctx = ndr->current_mem_ctx;
-
- subndr->data = ndr->data + ndr->offset;
- subndr->data_size = 28;
- subndr->offset = 0;
-
- NDR_CHECK(ndr_pull_advance(ndr, 28));
-
- status = ndr_pull_dom_sid(subndr, ndr_flags, sid);
- if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
- /* handle a w2k bug which send random data in the buffer */
- ZERO_STRUCTP(sid);
- } else if (sid->num_auths == 0 && sid->sub_auths) {
- talloc_free(sid->sub_auths);
- sid->sub_auths = NULL;
- }
-
- return NDR_ERR_SUCCESS;
-}
-
-/*
- push a dom_sid28 - this is a dom_sid in a 28 byte fixed buffer
-*/
-enum ndr_err_code ndr_push_dom_sid28(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
-{
- uint32_t old_offset;
- uint32_t padding;
-
- if (!(ndr_flags & NDR_SCALARS)) {
- return NDR_ERR_SUCCESS;
- }
-
- if (sid->num_auths > 5) {
- return ndr_push_error(ndr, NDR_ERR_RANGE,
- "dom_sid28 allows only upto 5 sub auth [%u]",
- sid->num_auths);
- }
-
- old_offset = ndr->offset;
- NDR_CHECK(ndr_push_dom_sid(ndr, ndr_flags, sid));
-
- padding = 28 - (ndr->offset - old_offset);
-
- if (padding > 0) {
- NDR_CHECK(ndr_push_zero(ndr, padding));
- }
-
- return NDR_ERR_SUCCESS;
-}
-
-/*
- parse a dom_sid0 - this is a dom_sid in a variable byte buffer, which is maybe empty
-*/
-enum ndr_err_code ndr_pull_dom_sid0(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
-{
- if (!(ndr_flags & NDR_SCALARS)) {
- return NDR_ERR_SUCCESS;
- }
-
- if (ndr->data_size == ndr->offset) {
- ZERO_STRUCTP(sid);
- return NDR_ERR_SUCCESS;
- }
-
- return ndr_pull_dom_sid(ndr, ndr_flags, sid);
-}
-
-/*
- push a dom_sid0 - this is a dom_sid in a variable byte buffer, which is maybe empty
-*/
-enum ndr_err_code ndr_push_dom_sid0(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
-{
- struct dom_sid zero_sid;
-
- if (!(ndr_flags & NDR_SCALARS)) {
- return NDR_ERR_SUCCESS;
- }
-
- if (!sid) {
- return NDR_ERR_SUCCESS;
- }
-
- ZERO_STRUCT(zero_sid);
-
- if (memcmp(&zero_sid, sid, sizeof(zero_sid)) == 0) {
- return NDR_ERR_SUCCESS;
- }
-
- return ndr_push_dom_sid(ndr, ndr_flags, sid);
-}
-
git.samba.org / metze / samba / wip.git / commitdiff