diff options
Diffstat (limited to 'src/acl/ntapi_acl_helper.c')
| -rw-r--r-- | src/acl/ntapi_acl_helper.c | 172 |
1 files changed, 172 insertions, 0 deletions
diff --git a/src/acl/ntapi_acl_helper.c b/src/acl/ntapi_acl_helper.c index 40fe4c4..024dbd4 100644 --- a/src/acl/ntapi_acl_helper.c +++ b/src/acl/ntapi_acl_helper.c @@ -98,3 +98,175 @@ void __stdcall __ntapi_acl_init_common_descriptor( sd->dacl.ace_count = ace_count; sd->dacl.sbz_2nd = 0; } + +static int32_t __acl_init_common_meta_impl( + __out nt_sd_common_meta * meta, + __in nt_sd * sd) +{ + int i; + nt_sid * sid; + nt_acl * acl; + nt_access_allowed_ace * ace; + unsigned char * value; + unsigned char sacnt; + char * mark = (char *)sd; + + meta->sd = sd; + meta->owner = sd->offset_owner ? (nt_sid *)(mark + sd->offset_owner) : 0; + meta->group = 0; + meta->dacl = sd->offset_dacl ? (nt_acl *)(mark + sd->offset_dacl) : 0; + + meta->owner_ace = 0; + meta->owner_sid = 0; + meta->group_ace = 0; + meta->group_sid = 0; + meta->other_ace = 0; + meta->other_sid = 0; + meta->admin_ace = 0; + meta->admin_sid = 0; + meta->system_acc = 0; + + if (!meta->owner) + return NT_STATUS_INVALID_OWNER; + + if (!(acl = meta->dacl)) + return NT_STATUS_SUCCESS; + + if (acl->ace_count == 0) + return NT_STATUS_SUCCESS; + + if (acl->ace_count > 5) + return NT_STATUS_NOT_SUPPORTED; + + ace = (nt_access_allowed_ace *)&acl[1]; + + for (i=0; i<acl->ace_count; i++) { + if (ace->header.ace_type != NT_ACE_TYPE_ACCESS_ALLOWED) + return NT_STATUS_NOT_SUPPORTED; + + mark = (char *)ace + ace->header.ace_size; + ace = (nt_access_allowed_ace *)mark; + } + + ace = (nt_access_allowed_ace *)&acl[1]; + + for (i=0; i<acl->ace_count; i++) { + sid = (nt_sid *)&ace->sid_start; + value = sid->identifier_authority.value; + + if (!(__ntapi->tt_sid_compare(sid,&sid_system))) + meta->system_acc = ace->mask; + + else if (!(__ntapi->tt_sid_compare(sid,&sid_owner_rights))) { + if (meta->owner_ace) + return NT_STATUS_INVALID_ACL; + + meta->owner_ace = ace; + meta->owner_sid = sid; + } + + else if (!(__ntapi->tt_sid_compare(sid,&sid_auth_users))) { + if (meta->other_ace) + return NT_STATUS_INVALID_ACL; + + meta->other_ace = ace; + meta->other_sid = sid; + } + + else if (!(__ntapi->tt_sid_compare(sid,meta->owner))) { + if (meta->group_ace) + return NT_STATUS_INVALID_ACL; + + meta->group_ace = ace; + meta->group_sid = sid; + } + + else if (!(__ntapi->tt_sid_compare(sid,(nt_sid *)&sid_admins))) { + if (meta->admin_ace) + return NT_STATUS_INVALID_ACL; + + meta->admin_ace = ace; + meta->admin_sid = sid; + } + + else if ((value[0] == 0) && (value[1] == 0) + && (value[2] == 0) && (value[3] == 0) + && (value[4] == 0) && (value[5] == 5) + && (sid->sub_authority[0] == 21) + && ((sacnt = sid->sub_authority_count)) + && (sid->sub_authority[sacnt - 1] == 500)) { + if (meta->admin_ace) + return NT_STATUS_INVALID_ACL; + + meta->admin_ace = ace; + meta->admin_sid = sid; + } + + else { + if (meta->group_ace) + return NT_STATUS_INVALID_ACL; + + meta->group_ace = ace; + meta->group_sid = sid; + meta->group = sid; + } + + mark = (char *)ace + ace->header.ace_size; + ace = (nt_access_allowed_ace *)mark; + } + + return NT_STATUS_SUCCESS; +} + +static int32_t __acl_init_common_meta_strict( + __out nt_sd_common_meta * meta, + __in nt_sd * sd) +{ + int32_t status; + nt_sd_common_meta m; + + if ((status = __acl_init_common_meta_impl(&m,sd))) + return status; + + meta->sd = m.sd; + meta->owner = m.owner; + meta->group = m.group; + meta->dacl = m.dacl; + + meta->owner_ace = m.owner_ace; + meta->owner_sid = m.owner_sid; + meta->group_ace = m.group_ace; + meta->group_sid = m.group_sid; + meta->other_ace = m.other_ace; + meta->other_sid = m.other_sid; + meta->admin_ace = m.admin_ace; + meta->admin_sid = m.admin_sid; + meta->system_acc = 0; + + return NT_STATUS_SUCCESS; +} + +static int32_t __acl_init_common_meta_query( + __out nt_sd_common_meta * meta, + __in nt_sd * sd) +{ + __acl_init_common_meta_impl(meta,sd); + return NT_STATUS_SUCCESS; +} + +int32_t __stdcall __ntapi_acl_init_common_descriptor_meta( + __out nt_sd_common_meta * meta, + __in nt_sd * sd, + __in uint32_t options) +{ + switch (options) { + case NT_ACL_INIT_COMMON_DESCRIPTION_META_QUERY_MODE: + return __acl_init_common_meta_query(meta,sd); + + case NT_ACL_INIT_COMMON_DESCRIPTION_META_STRICT_MODE: + return __acl_init_common_meta_strict(meta,sd); + + default: + return NT_STATUS_INVALID_PARAMETER; + } +} |