summaryrefslogtreecommitdiff
path: root/libcli/security
AgeCommit message (Collapse)AuthorFilesLines
2025-10-17Add missing include needed for cmocka.hAndreas Schneider2-0/+2
This will be required in future. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-08-26domsid: be less alarmed by non-SIDDouglas Bagnall1-1/+2
This has been causing log noise when something is trying to parse an identifier using a sequence of parsers, to see if it is a SID, a DN, an account name, etc. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-08-07libcli/security: use talloc_free at the end of sub-testsRabinarayan Panigrahi2-1/+57
Memory should be free by talloc_free() if it is allocated using talloc_new() Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Thu Aug 7 09:02:29 UTC 2025 on atb-devel-224
2025-05-28Fix clang 20 unused-but-set-variables warningsGary Lockyer1-0/+6
Suppress error: variable 'yynerrs' set but not used [-Werror,-Wunused-but-set-variable] for the code generated from the yacc files. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-04-03libcli/security: split trust_forest_info_* functions into samba-security-trustsStefan Metzmacher4-0/+1043
This will avoid dependency loops in following commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-27libcli: avoid work in security token debug no-opVolker Lendecke1-2/+7
When the debug level is too low to print, we don't need to allocate the strings. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15737 Signed-off-by: Volker Lendecke <vl@samba.org> Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Pair-programmed-with: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-02-22libcli/security: add dom_sid_match_prefix() helperStefan Metzmacher2-9/+28
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-14libcli/security: simplify logic in add_sid_to_array_attrs()Stefan Metzmacher1-2/+8
(struct auth_SidAttr) {} makes sure we don't leave uninitialized memory in case struct auth_SidAttr will change (which will happen in the next commits). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14libcli/security: add some more global_sid_ values required for SID filteringStefan Metzmacher2-0/+38
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14libcli/security: add py_claims_tf_policy_{parse_rules,wrap_xml}()Stefan Metzmacher2-1/+126
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-14libcli/security: add claims_tf_policy_[un]wrap_xml() for ↵Stefan Metzmacher2-0/+78
msDS-TransformationRules Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-14libcli/security: add claims_tf_rule_set_parse_blob() for MS-CTA rulesStefan Metzmacher4-1/+1581
It parses [MS-CTA] rules into structures. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-01-29libcli/security: let dom_sid_lookup_predefined_sid() behave like Windows 2008R2Stefan Metzmacher1-4/+1
Windows 2008R2 (172.31.9.133) returns the following: #> rpcclient 172.31.9.133 -Uadministrator%A1b2C3d4 -c 'lookupsids S-1-22-1 S-1-22-1-0;lookupsids S-1-22;lookupsids S-1-3-0 S-1-3-99;lookupsids S-1-3' S-1-22-1 *unknown*\*unknown* (8) S-1-22-1-0 *unknown*\*unknown* (8) result was NT_STATUS_INVALID_SID S-1-3-0 \CREATOR OWNER (5) S-1-3-99 *unknown*\*unknown* (8) result was NT_STATUS_INVALID_SID While the current Samba (172.31.9.163) returns the following: #> rpcclient 172.31.9.163 -Uadministrator%A1b2C3d4 -c 'lookupsids S-1-22-1 S-1-22-1-0;lookupsids S-1-22;lookupsids S-1-3-0 S-1-3-99;lookupsids S-1-3' result was NT_STATUS_INVALID_SID result was NT_STATUS_INVALID_SID S-1-3-0 \CREATOR OWNER (5) S-1-3-99 *unknown*\*unknown* (8) S-1-3 *unknown*\*unknown* (8) With this change also return the same as Windows 2008R2: #> rpcclient 172.31.9.163 -Uadministrator%A1b2C3d4 -c 'lookupsids S-1-22-1 S-1-22-1-0;lookupsids S-1-22;lookupsids S-1-3-0 S-1-3-99;lookupsids S-1-3' S-1-22-1 *unknown*\*unknown* (8) S-1-22-1-0 *unknown*\*unknown* (8) result was NT_STATUS_INVALID_SID S-1-3-0 \CREATOR OWNER (5) S-1-3-99 *unknown*\*unknown* (8) result was NT_STATUS_INVALID_SID This is a minimal fix in order to avoid crashes in the Windows Explorer. The real fix needs more work and additional tests, as the behavior seems to be different in newer Windows releases. The following patch will let us behave like Windows 2022/2025... BUG: https://bugzilla.samba.org/show_bug.cgi?id=14213 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-12-17lib: Fix Coverity ID 1636566 Untrusted loop boundVolker Lendecke1-3/+4
Sanitize num_auths to [0,15] in sid_copy() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Modernize a DEBUGVolker Lendecke1-4/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Fix a potential 32-bit problem with PRIu32Volker Lendecke1-2/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Make handling implicit_owner_rights bit easier to readVolker Lendecke1-8/+11
The first time I came across this I missed the "FALL_THROUGH" and had to look closely at what happens. I had expected IMPLICIT_OWNER_READ_CONTROL_AND_WRITE_DAC_RIGHTS to grant two rights, which to me is now more obvious. It was correct before, but to me this is now more obvious. YMMV. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Simplify disp_sec_ace_object()Volker Lendecke1-9/+7
Directly use GUID_buf_string() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Align an integer typeVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Remove the "mem_ctx" argument from pull_integer()Volker Lendecke1-8/+5
Not needed anymore Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Simplify pull_integer()Volker Lendecke1-11/+9
Use ndr_pull_struct_blob_noalloc, we don't need talloc here. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Avoid an unnecessary "else"Volker Lendecke1-1/+2
We return in the if-branch Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-17libcli: Use ndr_deepcopy_struct() in security_token_duplicate()Volker Lendecke1-27/+2
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2024-12-03libcli: Speed up sddl_decode_ace()Volker Lendecke1-46/+61
Factor out talloc-less sddl_transition_decode_sid() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Tue Dec 3 09:03:01 UTC 2024 on atb-devel-224
2024-12-03libcli: Remove a special caseVolker Lendecke1-7/+0
dom_sid_parse_endp does accept the lowercase "s" in "s-1-1-0". Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-12-03libcli: Simplify sddl_decode_err_msg()Volker Lendecke1-3/+1
We have security_descriptor_initialise() for this Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-12-03libcli: README.Coding for dom_sid routinesVolker Lendecke1-8/+20
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-12-03lib: Simplify security_descriptor_initialise() with a struct initVolker Lendecke1-11/+10
Rely no the default NULL init. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-12-02libcli: Fix a signed/unsigned comparison warningVolker Lendecke1-1/+1
With this we compare pointers, not numbers Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net> Autobuild-User(master): Martin Schwenke <martins@samba.org> Autobuild-Date(master): Mon Dec 2 05:52:56 UTC 2024 on atb-devel-224
2024-12-02libcli: Use dom_sid_dup() instead of talloc_memdup()Volker Lendecke1-2/+2
We have specialized code for this, why not use it... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-12-02libcli: Apply a little constVolker Lendecke2-32/+39
Probably does not matter code-wise, but looks nicer to me. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-12-02libcli: Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-12-02libcli: Fix whitespaceVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-12-02libcli: Avoid an unnecessary "else"Volker Lendecke1-2/+1
We return in the error case anyway Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-11-19libcli: Simplify debug_conditional_ace()Volker Lendecke1-2/+3
Move a variable declaration to its only user Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2024-11-12libcli: Convert an int to a size_tVolker Lendecke2-2/+2
More appropriate for an array length Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2024-11-12libcli: Try to fix CID 1609583 Overflowed constantVolker Lendecke1-2/+6
Coverity does not like the --i Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2024-09-06libsecurity: Simplify struct ace_condition_scriptVolker Lendecke2-33/+33
We only need the stack temporarily, no reason to put it in the struct Signed-off-by: Volker Lendecke <vl@samba.org> Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Sep 6 14:23:58 UTC 2024 on atb-devel-224
2024-08-27lib: Add libcli/util/ntstatus.h in a few headers where it's neededVolker Lendecke1-0/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jennifer Sutton <jsutton@samba.org>
2024-08-27lib: Add a few explicit includesVolker Lendecke1-0/+1
Required to trim down includes from gen_ndr/*security* Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jennifer Sutton <jsutton@samba.org>
2024-07-25libcli:security: allow spaces after BAD:Douglas Bagnall1-0/+5
In AD_DS_Classes_Windows_Server_v1903.ldf from https://www.microsoft.com/en-us/download/details.aspx?id=23782, we see defaultSecurityDescriptor: O:BAG:BAD: (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPLCLORC;;;AU) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15685 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Jul 25 06:27:27 UTC 2024 on atb-devel-224
2024-04-10libcli/security: use NUMERIC_CMP in dom_sid_compare_auth()Douglas Bagnall1-3/+4
These numbers are all 8 bit, so overflow is unlikely. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-10libcli/security: use NUMERIC_CMP in dom_sid_compare()Douglas Bagnall1-3/+4
sid->num_auths is always small (int8 < 16), so this is cosmetic only. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-18libcli/security: check again for NULL valuesDouglas Bagnall1-0/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Mar 18 02:51:08 UTC 2024 on atb-devel-224
2024-03-18libcli/security: claims_conversions: check for NULL in claims arrayDouglas Bagnall1-0/+10
If by mistake we end up with a NULL in our array of claims pointers, it is better to return an error than crash. There can be NULLs in the array if a resource attribute ACE has a claim that uses 0 as a relative data pointer. Samba assumes this means a NULL pointer, rather than a zero offset. Credit to OSS-Fuzz. REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66777 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15606 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-28libcli/security: Add SID_FRESH_PUBLIC_KEY_IDENTITYAndrew Bartlett2-0/+5
This allows an ACL level check (rather than only an all-or-nothing KDC configuration) that PKINIT freshness was used during the AS-REQ. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-02-16libcli/security: Make ‘session_info’ parameter constJo Sutton2-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16libcli/security: Include missing headersJo Sutton2-0/+3
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-08libcli/security: Make ‘replace_sid’ parameter constJo Sutton2-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-01-09libcli/security: remove PRIMARY_{USER,GROUP}_SID_INDEX defines from security.hStefan Metzmacher1-3/+0
These and more are also defined in security_token.h, which is later included from security.h anyway. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 00:10:23 +0000