1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 *
26 * Copyright 2017 Nexenta Systems, Inc. All rights reserved.
27 */
28
29 #ifndef _SMBFS_NTACL_H
30 #define _SMBFS_NTACL_H
31
32 /*
33 * Internal functions for dealing with
34 * NT Security data structures.
35 */
36
37 #include <netsmb/mchain.h>
38
39 /*
40 * Internal form of an NT SID
41 * Same as on the wire, but possibly byte-swapped.
42 */
43 typedef struct i_ntsid {
44 uint8_t sid_revision;
45 uint8_t sid_subauthcount;
46 uint8_t sid_authority[6];
47 uint32_t sid_subauthvec[1]; /* actually len=subauthcount */
48 } i_ntsid_t;
49 #define I_SID_SIZE(sacnt) (8 + 4 * (sacnt))
50
51 /*
52 * Internal form of an NT ACE - first the header.
53 * See MS SDK: ACE_HEADER (For MS, it's the OtW form)
54 * Note: ace_size here is the in-memoy size, not OtW.
55 */
56 typedef struct i_ntace_hdr {
57 uint8_t ace_type;
58 uint8_t ace_flags;
59 uint16_t ace_size;
60 } i_ntace_hdr_t;
61
62 /*
63 * Simple ACE for types: ACCESS_ALLOWED through SYSTEM_ALARM
64 * See MS SDK: ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE,
65 * SYSTEM_AUDIT_ACE, SYSTEM_ALARM_ACE.
66 *
67 * The above are the only types that appear in a V2 ACL.
68 * Note that in the Windows SDK, the SID is stored as
69 * "flat" data after the ACE header. This implementation
70 * stores the SID as a pointer instead.
71 */
72 typedef struct i_ntace_v2 {
73 i_ntace_hdr_t ace_hdr;
74 uint32_t ace_rights; /* generic, standard, specific, etc */
75 i_ntsid_t *ace_sid;
76 } i_ntace_v2_t;
77
78 /*
79 * A union for convenience of the conversion code.
80 * There are lots more ACE types, ignored for now.
81 */
82 typedef union i_ntace_u {
83 i_ntace_hdr_t ace_hdr;
84 i_ntace_v2_t ace_v2;
85 } i_ntace_t;
86
87 /*
88 * Internal form of an NT ACL (see sacl/dacl below)
89 */
90 typedef struct i_ntacl {
91 uint8_t acl_revision; /* 0x02 observed with W2K */
92 uint16_t acl_acecount;
93 i_ntace_t *acl_acevec[1]; /* actually, len=acecount */
94 } i_ntacl_t;
95
96 /*
97 * Internal form of an NT Security Descriptor (SD)
98 */
99 typedef struct i_ntsd {
100 uint8_t sd_revision; /* 0x01 observed between W2K */
101 uint8_t sd_rmctl; /* resource mgr control (MBZ) */
102 uint16_t sd_flags;
103 i_ntsid_t *sd_owner;
104 i_ntsid_t *sd_group;
105 i_ntacl_t *sd_sacl;
106 i_ntacl_t *sd_dacl;
107 } i_ntsd_t;
108
109 /*
110 * Import a raw SD (mb chain) into "internal" form.
111 * (like "absolute" form per. NT docs)
112 * Returns allocated data in sdp
113 */
114 int md_get_ntsd(mdchain_t *mbp, i_ntsd_t **sdp);
115
116 /*
117 * Export an "internal" SD into an raw SD (mb chain).
118 * (a.k.a "self-relative" form per. NT docs)
119 * Returns allocated mbchain in mbp.
120 */
121 int mb_put_ntsd(mbchain_t *mbp, i_ntsd_t *sd);
122
123 /*
124 * Convert an internal SD to a ZFS-style ACL.
125 * Get uid/gid too if pointers != NULL.
126 */
127 #if defined(_KERNEL) || defined(_FAKE_KERNEL)
128 int smbfs_acl_sd2zfs(i_ntsd_t *, vsecattr_t *, uid_t *, gid_t *);
129 #else /* _KERNEL */
130 /* See also: lib/libsmbfs/netsmb/smbfs_acl.h */
131 int smbfs_acl_sd2zfs(struct i_ntsd *, acl_t *, uid_t *, gid_t *);
132 #endif /* _KERNEL */
133
134 /*
135 * Convert a ZFS-style ACL to an internal SD.
136 * Set owner/group too if selector indicates.
137 * Always need to pass uid+gid, either the new
138 * (when setting them) or existing, so that any
139 * owner@ or group@ ACEs can be translated.
140 */
141 #if defined(_KERNEL) || defined(_FAKE_KERNEL)
142 int smbfs_acl_zfs2sd(vsecattr_t *, uid_t, gid_t, uint32_t, i_ntsd_t **);
143 #else /* _KERNEL */
144 /* See also: lib/libsmbfs/netsmb/smbfs_acl.h */
145 int smbfs_acl_zfs2sd(acl_t *, uid_t, gid_t, uint32_t, struct i_ntsd **);
146 #endif /* _KERNEL */
147
148 /*
149 * Free an i_ntsd_t from md_get_ntsd() or smbfs_acl_zfs2sd().
150 * See also: lib/libsmbfs/netsmb/smbfs_acl.h
151 */
152 void smbfs_acl_free_sd(struct i_ntsd *);
153
154 /*
155 * Convert an NT SID to string format.
156 */
157 int smbfs_sid2str(i_ntsid_t *sid,
158 char *obuf, size_t olen, uint32_t *ridp);
159
160 #endif /* _SMBFS_NTACL_H */