libcli: Add security_token_count_flag_sids()

To be used in a few places when checking special-case Samba SIDs.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15361
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

2 files changed, 46 insertions, 0 deletions

diff --git a/libcli/security/security_token.c b/libcli/security/security_token.c
index 17e69f861ff..31be678941e 100644
--- a/libcli/security/security_token.c
+++ b/libcli/security/security_token.c
@@ -23,6 +23,7 @@
 
 #include "replace.h"
 #include "lib/util/debug.h"
+#include "lib/util/fault.h"
 #include "libcli/security/security_token.h"
 #include "libcli/security/dom_sid.h"
 #include "libcli/security/privileges.h"
@@ -96,6 +97,42 @@ bool security_token_has_sid(const struct security_token *token, const struct dom
 	return false;
 }
 
+size_t security_token_count_flag_sids(const struct security_token *token,
+				      const struct dom_sid *prefix_sid,
+				      size_t num_flags,
+				      const struct dom_sid **_flag_sid)
+{
+	const size_t num_auths_expected = prefix_sid->num_auths + num_flags;
+	const struct dom_sid *found = NULL;
+	size_t num = 0;
+	uint32_t i;
+
+	SMB_ASSERT(num_auths_expected <= ARRAY_SIZE(prefix_sid->sub_auths));
+
+	for (i = 0; i < token->num_sids; i++) {
+		const struct dom_sid *sid = &token->sids[i];
+		int cmp;
+
+		if ((size_t)sid->num_auths != num_auths_expected) {
+			continue;
+		}
+
+		cmp = dom_sid_compare_domain(sid, prefix_sid);
+		if (cmp != 0) {
+			continue;
+		}
+
+		num += 1;
+		found = sid;
+	}
+
+	if ((num == 1) && (_flag_sid != NULL)) {
+		*_flag_sid = found;
+	}
+
+	return num;
+}
+
 bool security_token_has_builtin_guests(const struct security_token *token)
 {
 	return security_token_has_sid(token, &global_sid_Builtin_Guests);
diff --git a/libcli/security/security_token.h b/libcli/security/security_token.h
index ee7fd8d2509..bb8795919e9 100644
--- a/libcli/security/security_token.h
+++ b/libcli/security/security_token.h
@@ -51,6 +51,15 @@ bool security_token_is_anonymous(const struct security_token *token);
 
 bool security_token_has_sid(const struct security_token *token, const struct dom_sid *sid);
 
+/*
+ * Return any of the domain sids found in the token matching "domain"
+ * in _domain_sid, makes most sense if you just found one.
+ */
+size_t security_token_count_flag_sids(const struct security_token *token,
+				      const struct dom_sid *prefix_sid,
+				      size_t num_flags,
+				      const struct dom_sid **_flag_sid);
+
 bool security_token_has_builtin_guests(const struct security_token *token);
 
 bool security_token_has_builtin_administrators(const struct security_token *token);