libcli: Add security_token_count_flag_sids()

To be used in a few places when checking special-case Samba SIDs.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15361
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/libcli/security/security_token.c b/libcli/security/security_token.c
index 17e69f861ff6b3348fa3a76706e13fe42ab6d6eb..31be678941e60bd7db3b6ea1f6dc33003126d4e0 100644 (file)
--- a/libcli/security/security_token.c
+++ b/libcli/security/security_token.c
@@ -23,6 +23,7 @@
 
 #include "replace.h"
 #include "lib/util/debug.h"
+#include "lib/util/fault.h"
 #include "libcli/security/security_token.h"
 #include "libcli/security/dom_sid.h"
 #include "libcli/security/privileges.h"
@@ -96,6 +97,42 @@ bool security_token_has_sid(const struct security_token *token, const struct dom
        return false;
 }
 
+size_t security_token_count_flag_sids(const struct security_token *token,
+                                     const struct dom_sid *prefix_sid,
+                                     size_t num_flags,
+                                     const struct dom_sid **_flag_sid)
+{
+       const size_t num_auths_expected = prefix_sid->num_auths + num_flags;
+       const struct dom_sid *found = NULL;
+       size_t num = 0;
+       uint32_t i;
+
+       SMB_ASSERT(num_auths_expected <= ARRAY_SIZE(prefix_sid->sub_auths));
+
+       for (i = 0; i < token->num_sids; i++) {
+               const struct dom_sid *sid = &token->sids[i];
+               int cmp;
+
+               if ((size_t)sid->num_auths != num_auths_expected) {
+                       continue;
+               }
+
+               cmp = dom_sid_compare_domain(sid, prefix_sid);
+               if (cmp != 0) {
+                       continue;
+               }
+
+               num += 1;
+               found = sid;
+       }
+
+       if ((num == 1) && (_flag_sid != NULL)) {
+               *_flag_sid = found;
+       }
+
+       return num;
+}
+
 bool security_token_has_builtin_guests(const struct security_token *token)
 {
        return security_token_has_sid(token, &global_sid_Builtin_Guests);

diff --git a/libcli/security/security_token.h b/libcli/security/security_token.h
index ee7fd8d25090014c7087630e631759c248cd4add..bb8795919e917271d3dc98f6d68b8a4f7e162d9e 100644 (file)
--- a/libcli/security/security_token.h
+++ b/libcli/security/security_token.h
@@ -51,6 +51,15 @@ bool security_token_is_anonymous(const struct security_token *token);
 
 bool security_token_has_sid(const struct security_token *token, const struct dom_sid *sid);
 
+/*
+ * Return any of the domain sids found in the token matching "domain"
+ * in _domain_sid, makes most sense if you just found one.
+ */
+size_t security_token_count_flag_sids(const struct security_token *token,
+                                     const struct dom_sid *prefix_sid,
+                                     size_t num_flags,
+                                     const struct dom_sid **_flag_sid);
+
 bool security_token_has_builtin_guests(const struct security_token *token);
 
 bool security_token_has_builtin_administrators(const struct security_token *token);