(* SPDX-License-Identifier: LGPL-3.0-only WITH OCaml-LGPL-linking-exception *) module U64 = Stdint.Uint64 module U32 = Stdint.Uint32 type sid = { sid_ident_auth : U64.t (* 6 B *) ; sid_sub_auths : U32.t array (* max. 15 × *) } and sub_auths = U32.t array let sizeof_ident_auth = 6 let max_ident_auth = U64.of_string "0x0000_ffff_ffff_ffff" let ident_auth_hexlen = 14 (* 0x, 12 × hex digit *) let ident_auth_hexmin = U64.of_string "0x0001_0000_0000" let sizeof_sub_auth = 4 let max_subauth_count = 15 let create_unsafe ia sa = { sid_ident_auth = ia ; sid_sub_auths = sa } (* There isn’t much to validate to begin with except for the hard cap on the number of subauths. *) let create ia sa = let nsa = Array.length sa in if nsa < 1 || max_subauth_count < nsa then None else if U64.compare ia max_ident_auth > 0 then None else Some (create_unsafe ia sa) let get_ident_auth s = s.sid_ident_auth let get_sub_auths s = s.sid_sub_auths exception Nope let equal_sub_auths saa sab = try Array.iter2 (fun saa sab -> if U32.compare saa sab <> 0 then raise Nope) saa sab; true with Nope -> false let equal a b = U64.compare a.sid_ident_auth b.sid_ident_auth = 0 && Array.length a.sid_sub_auths = Array.length b.sid_sub_auths && equal_sub_auths a.sid_sub_auths b.sid_sub_auths module Util = struct let expect_char s c p = if s.[p] = c then () else raise (Invalid_argument (Printf.sprintf "Invalid SID [%s]: expected ‘%c’ at position %d, found ‘%c’" s c p s.[p])) let is_digit c = '0' <= c && c <= '9' let is_xdigit c = '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' end module type Conformance = sig val name : string val parse_hex_ia : string -> int -> U64.t * int (** [parse_hex_ia raw p] read ia from [raw] at position [p] in hexadecimal, return the value and the next position in the string. This only enforces parsing behavior, not the value range. *) val valid_decimal : string -> bool (** [valid_decimal s] holds if [s] conforms to the constraints for decimal numbers. Assumes the input already is all decimal digits. *) val valid_ia : bool -> U64.t -> bool (** [valid_ia ia] holds if [ia] is a valid identifier authority. *) val valid_sas : U32.t array -> bool (** [valid_sas sas] holds if [sas] is a valid array of subauthorities. *) val pad_hex_ia : int -> int (** [pad n] return the number of padding zeros to prepend to the hex format ident auth. *) end (* Validate and convert as though the spec in [MS-DTYP] were normative. *) module Con_strict = struct let name = "strict" let parse_hex_ia s p = assert (p <= String.length s - ident_auth_hexlen); let e = p + ident_auth_hexlen - 1 in let b = Bytes.make ident_auth_hexlen '\x2a' in Bytes.set b 0 '0'; (* hex indicator for U64.of_string *) Bytes.set b 1 'x'; for i = p + 2 to e do (* assumption: prefix “0x” checked by caller *) if not (Util.is_xdigit s.[i]) then raise (Invalid_argument (Printf.sprintf "Invalid SID [%s]: expected hexadecimal digit at \ position %d while parsing ident auth, got ‘%c’" s i s.[i])) done; Bytes.blit_string s (p+2) b 2 12; U64.of_string (Bytes.unsafe_to_string b), p + ident_auth_hexlen (* leading zeros forbidden except for zero itself *) let valid_decimal d = String.length d > 0 && (String.length d = 1 || String.get d 0 <> '0') let valid_ia hex v = if U64.compare v max_ident_auth > 0 then false else if not hex && U64.compare v ident_auth_hexmin >= 0 then false else not (hex && U64.compare v ident_auth_hexmin < 0) let valid_sas v = let nsa = Array.length v in 0 < nsa && nsa <= max_subauth_count (* zero-pad to exactly twelve hex digits *) let pad_hex_ia niax = ident_auth_hexlen - niax end (* [module Con_strict] *) (* Validate simulating the empirically determined behavior of MS’s own implementation “ConvertStringSidToSidA()”. The error code it returns when rejecting an input is “ERROR_INVALID_SID”. input | well-formed parsed | round-trip well-formed -------------------------+----------------------+------------------------------------ S-1-0x000000000000-1 | no yes | S-1-0-1 yes S-1-0x0000000000ff-1 | no yes | S-1-255-1 yes S-1-0x0001000000ff-1 | yes yes | S-1-0x1000000FF-1 no S-1-0xffffffffffff-1 | yes yes | S-1-0xFFFFFFFFFFFF-1 yes S-1-0xff00ff00ff-1 | no yes | S-1-0xFF00FF00FF-1 no S-1-0xff00ff00ff00ff-1 | no no | ø - S-1-4294967296-1 | no yes | S-1-0x100000000-1 no S-1-01-1 | no yes | S-1-1-1 yes S-1-08-1 | no yes | S-1-8-1 yes S-1-001-1 | no yes | S-1-1-1 yes S-1-1 | no no | ø - S-1-5 | no no | ø - The inverse operations were modeled after “ConvertSidToStringSidA()”. *) module Con_MS = struct let name = "MS" let parse_hex_ia s p = assert (String.length s - p - 2 > 0); let e = p + ident_auth_hexlen in let b = Buffer.create ident_auth_hexlen in Buffer.add_string b "0x"; (* hex indicator for U64.of_string *) let i = ref (p + 2) in while !i < min (String.length s) e && Util.is_xdigit s.[!i] do Buffer.add_char b s.[!i]; incr i; done; U64.of_string (Buffer.contents b), !i (* MS doesn’t care for leading zeros. *) let valid_decimal d = String.length d > 0 (* MS accepts hex-formatted ias of arbitrary values as long as they fit a u64 *) let valid_ia _hex v = true (* Interestingly, subauths behave as specified. *) let valid_sas v = let nsa = Array.length v in 0 < nsa && nsa <= max_subauth_count (* No leading zeros in the hex output despite the spec mandating this only for decimal formatting. *) let pad_hex_ia _niax = 0 end (* [module Con_strict] *) module type StringFmt_intf = sig val decode : string -> (sid, string) result val encode : sid -> string end module MkStringFmt (Con : Conformance) = struct let read_decimal_string f s p = let n = String.length s in assert (p < n); let p' = ref p in let b = Buffer.create 16 in while !p' < n && Util.is_digit s.[!p'] do Buffer.add_char b s.[!p']; incr p' done; let d = Buffer.contents b in if not (Con.valid_decimal d) then raise (Invalid_argument (Printf.sprintf "Invalid SID [%s]: “%s” is not a valid decimal in mode %s" s d Con.name)) else p + String.length d, f d let read_decimal_u64 = read_decimal_string U64.of_string let read_decimal_u32 = read_decimal_string U32.of_string (* specialized cause only needed for ia *) let read_ident_auth_hex s p = let ia, p' = Con.parse_hex_ia s p in if not (Con.valid_ia true ia) then raise (Invalid_argument (Printf.sprintf "input malformed: hex-encoded identifier authority failed \ “%s” validation (value=%s)" Con.name (U64.to_string ia))) else p', ia let ident_auth_decimal s p = let p, ia = read_decimal_u64 s p in if not (Con.valid_ia false ia) then raise (Invalid_argument (Printf.sprintf "input malformed: decimal identifier authority failed \ “%s” validation (value=%s)" Con.name (U64.to_string ia))) else p, ia let read_ident_auth s p = let r = String.length s - p in if r < ident_auth_hexlen then ident_auth_decimal s p else (* hex can’t fit *) match s.[p], s.[p+1] with | '0', 'x' -> read_ident_auth_hex s p | _ -> ident_auth_decimal s p (* * The spec ([MS-DTYP]): * * 2.4.2.1: SID= "S-1-" IdentifierAuthority 1*SubAuthority *) let decode s = let n = String.length s in if n <= 4 then Error (Printf.sprintf "Invalid SID: ‘%s’ too short to be a SID in string format" s) else begin try Util.expect_char s 'S' 0; Util.expect_char s '-' 1; Util.expect_char s '1' 2; Util.expect_char s '-' 3; let p = 4 in let p, ia = read_ident_auth s p in let sa = ref [] and p' = ref p in while !p' < n - 1 && List.length !sa < max_subauth_count && s.[!p'] = '-' do let np, d = try read_decimal_u32 s (!p' + 1) with Invalid_argument e -> (* Brr, but Stdint’s error messages aren’t overly instructive. *) raise (Invalid_argument (Printf.sprintf "Invalid SID: error parsing subauth at position %d, \ (err: %s)" (!p' + 1) e)) in sa := d :: !sa; p' := np done; let sas = Array.of_list (List.rev !sa) in if not (Con.valid_sas sas) then Error (Printf.sprintf "input malformed: subauthority list failed “%s” validation \ (count=%n)" Con.name (Array.length sas)) else Ok { sid_ident_auth = ia ; sid_sub_auths = sas } with Invalid_argument e -> Error e; end let ident_auth_blank = "0x000000000000" let fmt_ident_auth b ia = if U64.compare ia ident_auth_hexmin < 0 then Buffer.add_string b (U64.to_string ia) else begin let iax = U64.to_string_hex ia in let niax = String.length iax in let pad = Con.pad_hex_ia niax in if pad = 0 then Buffer.add_string b iax else (Buffer.add_string b (String.sub ident_auth_blank 0 (2+pad)); Buffer.add_string b (String.sub iax 2 (niax - 2))) end let fmt_sub_auths b sas = Array.iter (fun sa -> Buffer.add_char b '-'; Buffer.add_string b (U32.to_string sa)) sas let encode s = let b = Buffer.create 16 in Buffer.add_string b "S-1-"; fmt_ident_auth b s.sid_ident_auth; fmt_sub_auths b s.sid_sub_auths; Buffer.contents b end (* [module MkStringFmt] *) module StringFmt = MkStringFmt (Con_strict) module MSStringFmt = MkStringFmt (Con_MS) module PacketRep = struct (* [MS-DTYP] 2.4.22 *) type endian = Big | Little let wordlen = 4 (* sizeof int *) let min_pktrep_len = 1 + 1 + sizeof_ident_auth let max_pktrep_len = 1 + 1 + sizeof_ident_auth + max_subauth_count * sizeof_sub_auth let pktrep_sa_off = min_pktrep_len let encode ?(endian=Little) s = let nsa = Array.length s.sid_sub_auths in let l = 8 + nsa * sizeof_sub_auth in let b = Bytes.create l in let o = ref 0 in let pushbyte c = char_of_int c |> Bytes.set b !o; incr o in assert (0 <= nsa && nsa <= 15); pushbyte 1; pushbyte nsa; let getia n = pushbyte (U64.to_int (U64.shift_right s.sid_ident_auth n) land 0xff) in (* big endian!, cf. [MS-DTYP] 2.4.1.1 *) getia 5; getia 4; getia 3; getia 2; getia 1; getia 0; let write_u32 = match endian with | Big -> U32.to_bytes_big_endian | Little -> U32.to_bytes_little_endian in Array.iteri (fun i sa -> let o' = !o + i * wordlen in write_u32 sa b o') s.sid_sub_auths; b let decode ?(endian=Little) b = let l = Bytes.length b in if l < min_pktrep_len || max_pktrep_len < l then Error (Printf.sprintf "bad input size: expected %d–%d B, got %d B" min_pktrep_len max_pktrep_len l) else if l mod wordlen <> 0 then Error (Printf.sprintf "bad input size: not divisible by word length (%d)" wordlen) else let v = Bytes.get b 0 |> int_of_char in if v <> 0x01 then Error (Printf.sprintf "input malformed: expected SID version=0x01, got 0x%0.2x" v) else let nsa = Bytes.get b 1 |> int_of_char in if max_subauth_count < nsa then Error (Printf.sprintf "input malformed: up to %d subAuthority elements permitted, \ %d specified" max_subauth_count nsa) else let ia = U64.of_bytes_big_endian b 0 |> U64.logand max_ident_auth in let sas = Array.make nsa (U32.zero) and read_u32 = match endian with | Big -> U32.of_bytes_big_endian | Little -> U32.of_bytes_little_endian in for i = 0 to (nsa - 1) do let off = pktrep_sa_off + i * sizeof_sub_auth in sas.(i) <- read_u32 b off done; Ok { sid_ident_auth = ia ; sid_sub_auths = sas } let from_channel ?(endian=Little) ic = try let v = input_byte ic in if v <> 0x01 then Error (Printf.sprintf "input malformed: expected SID version=0x01, got 0x%0.2x" v) else let nsa = input_byte ic in if max_subauth_count < nsa then Error (Printf.sprintf "input malformed: up to %d subAuthority elements permitted, \ %d specified" max_subauth_count nsa) else let n = sizeof_ident_auth + nsa * sizeof_sub_auth in let b = Bytes.make (2 + n) '\x00' in Bytes.set b 0 '\x01'; Bytes.set b 1 (char_of_int nsa); really_input ic b 2 n; decode ~endian b with End_of_file -> Error (Printf.sprintf "input malformed: unexpected end of file at offset %d \ parsing SID" (pos_in ic)) let to_channel ?(endian=Little) oc s = encode ~endian s |> output_bytes oc end (* [module PacketRep] *) module WellKnown = struct let cu = create_unsafe let sa = U32.of_int let ia = U64.of_int (* * see also * https://docs.microsoft.com/en-us/windows/desktop/secauthz/well-known-sids *) let null = cu U64.zero [| U32.zero |] let everyone = cu U64.one [| U32.zero |] let world = everyone (* 1-2-… *) let local = cu (U64.of_int 2) [| U32.zero |] let console_logon = cu (U64.of_int 2) [| U32.one |] (* 1-3-… *) let creator_owner_id = cu (U64.of_int 3) [| U32.zero |] let creator_group_id = cu (U64.of_int 3) [| U32.one |] let creator_owner_server = cu (U64.of_int 3) [| U32.of_int 2 |] let creator_group_server = cu (U64.of_int 3) [| U32.of_int 3 |] let owner_rights = cu (U64.of_int 3) [| U32.of_int 4 |] let elite = cu U64.one [| U32.of_int 3 ; U32.of_int 3; U32.of_int 7 |] (* 1-5-… *) let nt_authority = cu (U64.of_int 5) [| |] let dialup = cu (U64.of_int 5) [| U32.one |] let network = cu (U64.of_int 5) [| U32.of_int 2 |] let batch = cu (U64.of_int 5) [| U32.of_int 3 |] let interactive = cu (U64.of_int 5) [| U32.of_int 4 |] let logon_id = cu (U64.of_int 5) [| U32.of_int 5 |] let service = cu (U64.of_int 5) [| U32.of_int 6 |] let anonymous = cu (U64.of_int 5) [| U32.of_int 7 |] let proxy = cu (U64.of_int 5) [| U32.of_int 8 |] let enterprise_domain_controllers = cu (U64.of_int 5) [| U32.of_int 9 |] let principal_self = cu (U64.of_int 5) [| U32.of_int 10 |] let authenticated_users = cu (U64.of_int 5) [| U32.of_int 11 |] let restricted_code = cu (U64.of_int 5) [| U32.of_int 12 |] let terminal_server_user = cu (U64.of_int 5) [| U32.of_int 13 |] let remote_interactive_logon = cu (U64.of_int 5) [| U32.of_int 14 |] let this_organisation = cu (U64.of_int 5) [| U32.of_int 15 |] let iusr = cu (U64.of_int 5) [| U32.of_int 17 |] let local_system = cu (U64.of_int 5) [| U32.of_int 18 |] let local_service = cu (U64.of_int 5) [| U32.of_int 19 |] let network_service = cu (U64.of_int 5) [| U32.of_int 20 |] let compounded_authentication = cu (ia 5) [| sa 21; U32.zero; U32.zero; U32.zero; sa 496 |] let claims_valid = cu (ia 5) [| sa 21; U32.zero; U32.zero; U32.zero; sa 497 |] let administrator machine = cu (ia 5) [| sa 21; machine; sa 500 |] let guest machine = cu (ia 5) [| sa 21; machine; sa 501 |] let krbtgt domain = cu (ia 5) [| sa 21; domain; sa 502 |] let domain_admins domain = cu (ia 5) [| sa 21; domain; sa 512 |] let domain_users domain = cu (ia 5) [| sa 21; domain; sa 513 |] let domain_guests domain = cu (ia 5) [| sa 21; domain; sa 514 |] let domain_computers domain = cu (ia 5) [| sa 21; domain; sa 515 |] let domain_domain_controllers domain = cu (ia 5) [| sa 21; domain; sa 516 |] let cert_publishers domain = cu (ia 5) [| sa 21; domain; sa 517 |] let schema_administrators root_domain = cu (ia 5) [| sa 21; root_domain; sa 518 |] let enterprise_admins root_domain = cu (ia 5) [| sa 21; root_domain; sa 519 |] let group_policy_creator_owners domain = cu (ia 5) [| sa 21; domain; sa 520 |] let readonly_domain_controllers domain = cu (ia 5) [| sa 21; domain; sa 521 |] let cloneable_controllers domain = cu (ia 5) [| sa 21; domain; sa 522 |] let protected_users domain = cu (ia 5) [| sa 21; domain; sa 525 |] let key_admins domain = cu (ia 5) [| sa 21; domain; sa 526 |] let enterprise_key_admins domain = cu (ia 5) [| sa 21; domain; sa 527 |] let ras_servers domain = cu (ia 5) [| sa 21; domain; sa 553 |] let allowed_rodc_password_replication_group domain = cu (ia 5) [| sa 21; domain; sa 571 |] let denied_rodc_password_replication_group domain = cu (ia 5) [| sa 21; domain; sa 572 |] let builtin_administrators = cu (ia 5) [| sa 32; sa 544 |] let builtin_users = cu (ia 5) [| sa 32; sa 545 |] let builtin_guests = cu (ia 5) [| sa 32; sa 546 |] let power_users = cu (ia 5) [| sa 32; sa 547 |] let account_operators = cu (ia 5) [| sa 32; sa 548 |] let server_operators = cu (ia 5) [| sa 32; sa 549 |] let printer_operators = cu (ia 5) [| sa 32; sa 550 |] let backup_operators = cu (ia 5) [| sa 32; sa 551 |] let replicator = cu (ia 5) [| sa 32; sa 552 |] let alias_prew2kcompacc = cu (ia 5) [| sa 32; sa 554 |] let remote_desktop = cu (ia 5) [| sa 32; sa 555 |] let network_configuration_ops = cu (ia 5) [| sa 32; sa 556 |] let incoming_forest_trust_builders = cu (ia 5) [| sa 32; sa 557 |] let perfmon_users = cu (ia 5) [| sa 32; sa 558 |] let perflog_users = cu (ia 5) [| sa 32; sa 559 |] let windows_authorization_access_group = cu (ia 5) [| sa 32; sa 560 |] let terminal_server_license_servers = cu (ia 5) [| sa 32; sa 561 |] let distributed_com_users = cu (ia 5) [| sa 32; sa 562 |] let iis_iusrs = cu (ia 5) [| sa 32; sa 568 |] let cryptographic_operators = cu (ia 5) [| sa 32; sa 569 |] let event_log_readers = cu (ia 5) [| sa 32; sa 573 |] let certificate_service_dcom_access = cu (ia 5) [| sa 32; sa 574 |] let rds_remote_access_servers = cu (ia 5) [| sa 32; sa 575 |] let rds_endpoint_servers = cu (ia 5) [| sa 32; sa 576 |] let rds_management_servers = cu (ia 5) [| sa 32; sa 577 |] let hyper_v_admins = cu (ia 5) [| sa 32; sa 578 |] let access_control_assistance_ops = cu (ia 5) [| sa 32; sa 579 |] let remote_management_users = cu (ia 5) [| sa 32; sa 580 |] let write_restricted_code = cu (ia 5) [| sa 33 |] let ntlm_authentication = cu (ia 5) [| sa 64; sa 10 |] let schannel_authentication = cu (ia 5) [| sa 64; sa 14 |] let digest_authentication = cu (ia 5) [| sa 64; sa 21 |] let this_organization_certificate = cu (ia 5) [| sa 65; sa 1 |] let nt_service = cu (ia 5) [| sa 80 |] let user_mode_drivers = cu (ia 5) [| sa 84; U32.zero; U32.zero; U32.zero; U32.zero; U32.zero |] let local_account = cu (ia 5) [| sa 113 |] let local_account_and_member_of_administrators_group = cu (ia 5) [| sa 114 |] let other_organization = cu (ia 5) [| sa 1000 |] (* 1-15-… *) let all_app_packages = cu (ia 15) [| sa 2; U32.one |] (* 1-16-… *) let ml_untrusted = cu (ia 16) [| U32.zero |] let ml_low = cu (ia 16) [| sa 4096 |] let ml_medium = cu (ia 16) [| sa 8192 |] let ml_medium_plus = cu (ia 16) [| sa 8448 |] let ml_high = cu (ia 16) [| sa 12288 |] let ml_system = cu (ia 16) [| sa 16384 |] let ml_protected_process = cu (ia 16) [| sa 20480 |] let ml_secure_process = cu (ia 16) [| sa 28672 |] (* 1-18-… *) let authentication_authority_asserted_identity = cu (ia 18) [| U32.one |] let service_asserted_identity = cu (ia 18) [| sa 2 |] let fresh_public_key_identity = cu (ia 18) [| sa 3 |] let key_trust_identity = cu (ia 18) [| sa 4 |] let key_property_mfa = cu (ia 18) [| sa 5 |] let key_property_attestation = cu (ia 18) [| sa 6 |] module Prefix = struct let security_null_sid_authority sa = create_unsafe (U64.of_int 0x00) sa let security_world_sid_authority sa = create_unsafe (U64.of_int 0x01) sa let security_local_sid_authority sa = create_unsafe (U64.of_int 0x02) sa let security_creator_sid_authority sa = create_unsafe (U64.of_int 0x03) sa let security_nt_authority sa = create_unsafe (U64.of_int 0x05) sa let security_app_package_authority sa = create_unsafe (U64.of_int 0x0f) sa let security_mandatory_label_authority sa = create_unsafe (U64.of_int 0x10) sa let security_scoped_policy_id_authority sa = create_unsafe (U64.of_int 0x11) sa let security_authentication_authority sa = create_unsafe (U64.of_int 0x12) sa end end let of_string = StringFmt.decode let to_string = StringFmt.encode let of_bytes = PacketRep.decode let to_bytes = PacketRep.encode type t = sid