From 5e8c7192ba5469547ba3101885dfbaba2f8181f4 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Tue, 18 Apr 2023 11:31:16 +0200 Subject: libcli: Add security_token_count_flag_sids() To be used in a few places when checking special-case Samba SIDs. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15361 Signed-off-by: Volker Lendecke Reviewed-by: Stefan Metzmacher --- libcli/security/security_token.c | 37 +++++++++++++++++++++++++++++++++++++ libcli/security/security_token.h | 9 +++++++++ 2 files changed, 46 insertions(+) (limited to 'libcli') diff --git a/libcli/security/security_token.c b/libcli/security/security_token.c index 17e69f861ff..31be678941e 100644 --- a/libcli/security/security_token.c +++ b/libcli/security/security_token.c @@ -23,6 +23,7 @@ #include "replace.h" #include "lib/util/debug.h" +#include "lib/util/fault.h" #include "libcli/security/security_token.h" #include "libcli/security/dom_sid.h" #include "libcli/security/privileges.h" @@ -96,6 +97,42 @@ bool security_token_has_sid(const struct security_token *token, const struct dom return false; } +size_t security_token_count_flag_sids(const struct security_token *token, + const struct dom_sid *prefix_sid, + size_t num_flags, + const struct dom_sid **_flag_sid) +{ + const size_t num_auths_expected = prefix_sid->num_auths + num_flags; + const struct dom_sid *found = NULL; + size_t num = 0; + uint32_t i; + + SMB_ASSERT(num_auths_expected <= ARRAY_SIZE(prefix_sid->sub_auths)); + + for (i = 0; i < token->num_sids; i++) { + const struct dom_sid *sid = &token->sids[i]; + int cmp; + + if ((size_t)sid->num_auths != num_auths_expected) { + continue; + } + + cmp = dom_sid_compare_domain(sid, prefix_sid); + if (cmp != 0) { + continue; + } + + num += 1; + found = sid; + } + + if ((num == 1) && (_flag_sid != NULL)) { + *_flag_sid = found; + } + + return num; +} + bool security_token_has_builtin_guests(const struct security_token *token) { return security_token_has_sid(token, &global_sid_Builtin_Guests); diff --git a/libcli/security/security_token.h b/libcli/security/security_token.h index ee7fd8d2509..bb8795919e9 100644 --- a/libcli/security/security_token.h +++ b/libcli/security/security_token.h @@ -51,6 +51,15 @@ bool security_token_is_anonymous(const struct security_token *token); bool security_token_has_sid(const struct security_token *token, const struct dom_sid *sid); +/* + * Return any of the domain sids found in the token matching "domain" + * in _domain_sid, makes most sense if you just found one. + */ +size_t security_token_count_flag_sids(const struct security_token *token, + const struct dom_sid *prefix_sid, + size_t num_flags, + const struct dom_sid **_flag_sid); + bool security_token_has_builtin_guests(const struct security_token *token); bool security_token_has_builtin_administrators(const struct security_token *token); -- cgit v1.2.1