summaryrefslogtreecommitdiff
path: root/sid.mli
blob: e9b5c78586a94a0c9e65ac4fca2ae23ac2bdbfb8 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
(* SPDX-License-Identifier: LGPL-3.0-only WITH OCaml-LGPL-linking-exception *)

type t
type sub_auths = Stdint.Uint32.t array

val create : ?sa:Stdint.Uint32.t array -> Stdint.Uint64.t -> t option
(** [create sas ia] constructs a SID with the identifier authority [ia]
    and, optionally, the subauthorities [sas]. The operation will return
    [None] if [sa] contains more than fifteen subauthorities. *)

val create_unsafe : Stdint.Uint32.t array -> Stdint.Uint64.t -> t
(** [create_unsafe sas ia] constructs a SID with the identifier authority [ia]
    and, optionally, the sub authorities [sas] without validating the inputs.
    Use with caution. *)

val equal : t -> t -> bool
(** [equal sa sb] tests whether [sa] and [sb] are identical. *)

val equal_sub_auths : Stdint.Uint32.t array -> Stdint.Uint32.t array -> bool
(** [equal_sub_auths sa sb] tests whether [sa] and [sb] have identical
    subauthorities. *)

val get_ident_auth : t -> Stdint.Uint64.t
(** [get_ident_auth s] get the identifier authority of SID [s]. *)

val get_sub_auths : t -> sub_auths
(** [get_ident_auth s] get the subauthorities array of SID [s]. *)

(** Conversions to and from the {e string format syntax} (MS-DTYP 2.4.2.1). *)
module StringFmt :
  sig
    val decode : string -> (t, string) result
    (** [decode b] parse string buffer [b] into a SID. *)

    val encode : t -> string
    (** [encode s] convert SID [s] to its string representation. *)
  end

(** Conversion to and from the {e packet representation} (MS-DTYP 2.4.2.2). *)
module PacketRep :
  sig
    type endian = Big | Little
    val decode : ?endian:endian -> bytes -> (t, string) result
    (** [decode endian b] decode the byte buffer [b] as a SID. *)

    val encode : ?endian:endian -> t -> bytes
    (** [encode endian s] convert SID [s] to the packet representation
        encoding subauthorities in endianness [endian]. *)
  end

(** Pre-defined SID constansts and constructors with fixed identifier
    authority (MS-DTYP 2.4.2.4). *)
module WellKnown :
  sig
    val null : t
    (** The SID {e S-1-0-0}. *)

    val everyone : t
    (** The SID {e S-1-1-0}. *)

    val world : t
    (** Alias for [everyone]. *)

    val local : t
    (** The SID {e S-1-2-0}. *)

    val console_logon : t
    (** The SID {e S-1-2-1}. *)

    val creator_owner_id : t
    (** The SID {e S-1-3-0}. *)

    val creator_group_id : t
    (** The SID {e S-1-3-1}. *)

    val creator_owner_server : t
    (** The SID {e S-1-3-2}. *)

    val creator_group_server : t
    (** The SID {e S-1-3-3}. *)

    val owner_rights : t
    (** The SID {e S-1-3-4}. *)

    val elite : t

    val nt_authority : t
    (** The SID {e S-1-5}. *)

    val dialup : t
    (** The SID {e S-1-5-1}. *)

    val network : t
    (** The SID {e S-1-5-2}. *)

    val batch : t
    (** The SID {e S-1-5-3}. *)

    val interactive : t
    (** The SID {e S-1-5-4}. *)

    val logon_id : t
    (** The SID {e S-1-5-5}. *)

    val service : t
    (** The SID {e S-1-5-6}. *)

    val anonymous : t
    (** The SID {e S-1-5-7}. *)

    val proxy : t
    (** The SID {e S-1-5-8}. *)

    val enterprise_domain_controllers : t
    (** The SID {e S-1-5-9}. *)

    val principal_self : t
    (** The SID {e S-1-5-10}. *)

    val authenticated_users : t
    (** The SID {e S-1-5-11}. *)

    val restricted_code : t
    (** The SID {e S-1-5-12}. *)

    val terminal_server_user : t
    (** The SID {e S-1-5-13}. *)

    val remote_interactive_logon : t
    (** The SID {e S-1-5-14}. *)

    val this_organisation : t
    (** The SID {e S-1-5-15}. *)

    val iusr : t
    (** The SID {e S-1-5-17}. *)

    val local_system : t
    (** The SID {e S-1-5-18}. *)

    val local_service : t
    (** The SID {e S-1-5-19}. *)

    val compounded_authentication : t
    (** The SID {e S-1-5-21-0-0-0-496}. *)

    val claims_valid : t
    (** The SID {e S-1-5-21-0-0-0-497}. *)

    val administrator : Stdint.Uint32.t -> t
    (** [administrator machine] constructs a SID {e S-1-5-21-[machine]-500}. *)

    val guest : Stdint.Uint32.t -> t
    (** [guest machine] constructs a SID {e S-1-5-21-[machine]-501}. *)

    val krbtgt : Stdint.Uint32.t -> t
    (** [krbtgt domain] constructs a SID {e S-1-5-21-[domain]-502}. *)

    val domain_admins : Stdint.Uint32.t -> t
    (** [domain_admins domain] constructs a SID {e S-1-5-21-[domain]-512}. *)

    val domain_users : Stdint.Uint32.t -> t
    (** [domain_users domain] constructs a SID {e S-1-5-21-[domain]-513}. *)

    val domain_guests : Stdint.Uint32.t -> t
    (** [domain_guests domain] constructs a SID {e S-1-5-21-[domain]-514}. *)

    val domain_computers : Stdint.Uint32.t -> t
    (** [domain_computers domain] constructs a SID {e S-1-5-21-[domain]-515}. *)

    val domain_domain_controllers : Stdint.Uint32.t -> t
    (** [domain_domain_controllers domain] constructs a SID
        {e S-1-5-21-[domain]-516}. *)

    val cert_publishers : Stdint.Uint32.t -> t
    (** [cert_publishers domain] constructs a SID {e S-1-5-21-[domain]-517}. *)

    val schema_administrators : Stdint.Uint32.t -> t
    (** [schema_administrators root_domain] constructs a SID
        {e S-1-5-21-[root_domain]-518}. *)

    val enterprise_admins : Stdint.Uint32.t -> t
    (** [enterprise_admins root_domain] constructs a SID
        {e S-1-5-21-[root_domain]-519}. *)

    val group_policy_creator_owners : Stdint.Uint32.t -> t
    (** [group_policy_creator_owners domain] constructs a SID
        {e S-1-5-21-[domain]-520}. *)

    val readonly_domain_controllers : Stdint.Uint32.t -> t
    (** [readonly_domain_controllers domain] constructs a SID
        {e S-1-5-21-[domain]-521}. *)

    val cloneable_controllers : Stdint.Uint32.t -> t
    (** [cloneable_controllers domain] constructs a SID
        {e S-1-5-21-[domain]-522}. *)

    val protected_users : Stdint.Uint32.t -> t
    (** [protected_users domain] constructs a SID {e S-1-5-21-[domain]-525}. *)

    val key_admins : Stdint.Uint32.t -> t
    (** [key_admins domain] constructs a SID {e S-1-5-21-[domain]-526}. *)

    val enterprise_key_admins : Stdint.Uint32.t -> t
    (** [enterprise_key_admins domain] constructs a SID {e S-1-5-21-[domain]-527}. *)

    val ras_servers : Stdint.Uint32.t -> t
    (** [ras_servers domain] constructs a SID {e S-1-5-21-[domain]-553}. *)

    val allowed_rodc_password_replication_group : Stdint.Uint32.t -> t
    (** [allowed_rodc_password_replication_group domain] constructs a SID
        {e S-1-5-21-[domain]-571}. *)

    val denied_rodc_password_replication_group : Stdint.Uint32.t -> t
    (** [denied_rodc_password_replication_group domain] constructs a SID
        {e S-1-5-21-[domain]-572}. *)

    val builtin_administrators : t
    (** The SID {e S-1-5-32-544}. *)

    val builtin_users : t
    (** The SID {e S-1-5-32-545}. *)

    val builtin_guests : t
    (** The SID {e S-1-5-32-546}. *)

    val power_users : t
    (** The SID {e S-1-5-32-547}. *)

    val account_operators : t
    (** The SID {e S-1-5-32-548}. *)

    val server_operators : t
    (** The SID {e S-1-5-32-549}. *)

    val printer_operators : t
    (** The SID {e S-1-5-32-550}. *)

    val backup_operators : t
    (** The SID {e S-1-5-32-551}. *)

    val replicator : t
    (** The SID {e S-1-5-32-552}. *)

    val alias_prew2kcompacc : t
    (** The SID {e S-1-5-32-554}. *)

    val remote_desktop : t
    (** The SID {e S-1-5-32-555}. *)

    val network_configuration_ops : t
    (** The SID {e S-1-5-32-556}. *)

    val incoming_forest_trust_builders : t
    (** The SID {e S-1-5-32-557}. *)

    val perfmon_users : t
    (** The SID {e S-1-5-32-558}. *)

    val perflog_users : t
    (** The SID {e S-1-5-32-559}. *)

    val windows_authorization_access_group : t
    (** The SID {e S-1-5-32-560}. *)

    val terminal_server_license_servers : t
    (** The SID {e S-1-5-32-561}. *)

    val distributed_com_users : t
    (** The SID {e S-1-5-32-562}. *)

    val iis_iusrs : t
    (** The SID {e S-1-5-32-568}. *)

    val cryptographic_operators : t
    (** The SID {e S-1-5-32-569}. *)

    val event_log_readers : t
    (** The SID {e S-1-5-32-573}. *)

    val certificate_service_dcom_access : t
    (** The SID {e S-1-5-32-574}. *)

    val rds_remote_access_servers : t
    (** The SID {e S-1-5-32-575}. *)

    val rds_endpoint_servers : t
    (** The SID {e S-1-5-32-576}. *)

    val rds_management_servers : t
    (** The SID {e S-1-5-32-577}. *)

    val hyper_v_admins : t
    (** The SID {e S-1-5-32-578}. *)

    val access_control_assistance_ops : t
    (** The SID {e S-1-5-32-579}. *)

    val remote_management_users : t
    (** The SID {e S-1-5-32-580}. *)

    val write_restricted_code : t
    (** The SID {e S-1-5-33}. *)

    val ntlm_authentication : t
    (** The SID {e S-1-5-64-10}. *)

    val schannel_authentication : t
    (** The SID {e S-1-5-64-14}. *)

    val digest_authentication : t
    (** The SID {e S-1-5-64-21}. *)

    val this_organization_certificate : t
    (** The SID {e S-1-5-65-1}. *)

    val nt_service : t
    (** The SID {e S-1-5-80}. *)

    val user_mode_drivers : t
    (** The SID {e S-1-5-84-0-0-0-0-0}. *)

    val local_account : t
    (** The SID {e S-1-5-113}. *)

    val local_account_and_member_of_administrators_group : t
    (** The SID {e S-1-5-114}. *)

    val other_organization : t
    (** The SID {e S-1-5-1000}. *)

    val all_app_packages : t
    (** The SID {e S-1-15-2-1}. *)

    val ml_untrusted : t
    (** The SID {e S-1-16-0}. *)

    val ml_low : t
    (** The SID {e S-1-16-4096}. *)

    val ml_medium : t
    (** The SID {e S-1-16-8192}. *)

    val ml_medium_plus : t
    (** The SID {e S-1-16-8448}. *)

    val ml_high : t
    (** The SID {e S-1-16-12288}. *)

    val ml_system : t
    (** The SID {e S-1-16-16384}. *)

    val ml_protected_process : t
    (** The SID {e S-1-16-20480}. *)

    val ml_secure_process : t
    (** The SID {e S-1-16-28672}. *)

    val authentication_authority_asserted_identity : t
    (** The SID {e S-1-18-1}. *)

    val service_asserted_identity : t
    (** The SID {e S-1-18-2}. *)

    val fresh_public_key_identity : t
    (** The SID {e S-1-18-3}. *)

    val key_trust_identity : t
    (** The SID {e S-1-18-4}. *)

    val key_property_mfa : t
    (** The SID {e S-1-18-5}. *)

    val key_property_attestation : t
    (** The SID {e S-1-18-6}. *)

    module Prefix :
      sig
        val security_null_sid_authority : ?sa:sub_auths -> unit -> t
        (** [security_null_sid_authority sub_auths ()] constructs a SID
            {e S-1-0-[sub_auths]…}. *)

        val security_world_sid_authority : ?sa:sub_auths -> unit -> t
        (** [security_world_sid_authority sub_auths ()] constructs a SID
            {e S-1-1-[sub_auths]…}. *)

        val security_local_sid_authority : ?sa:sub_auths -> unit -> t
        (** [security_local_sid_authority sub_auths ()] constructs a SID
            {e S-1-2-[sub_auths]…}. *)

        val security_creator_sid_authority : ?sa:sub_auths -> unit -> t
        (** [security_creator_sid_authority sub_auths ()] constructs a SID
            {e S-1-3-[sub_auths]…}. *)

        val security_nt_authority : ?sa:sub_auths -> unit -> t
        (** [security_nt_authority sub_auths ()] constructs a SID
            {e S-1-5-[sub_auths]…}. *)

        val security_app_package_authority : ?sa:sub_auths -> unit -> t
        (** [security_app_package_authority sub_auths ()] constructs a SID
            {e S-1-15-[sub_auths]…}. *)

        val security_mandatory_label_authority : ?sa:sub_auths -> unit -> t
        (** [security_mandatory_label_authority sub_auths ()] constructs a SID
            {e S-1-16-[sub_auths]…}. *)

        val security_scoped_policy_id_authority : ?sa:sub_auths -> unit -> t
        (** [security_scoped_policy_id_authority sub_auths ()] constructs a SID
            {e S-1-17-[sub_auths]…}. *)

        val security_authentication_authority : ?sa:sub_auths -> unit -> t
        (** [security_authentication_authority sub_auths ()] constructs a SID
            {e S-1-18-[sub_auths]…}. *)
      end
  end

val of_string : string -> (t, string) result
(** [of_string b] is an alias for [StringFmt.decode b]. *)

val to_string : t -> string
(** [to_string s] is an alias for [StringFmt.encode s]. *)