r18271: Big change:

* autogenerate lsa ndr code
* rename 'enum SID_NAME_USE' to 'enum lsa_SidType'
* merge a log more security descriptor functions from
  gen_ndr/ndr_security.c in SAMBA_4_0

The most embarassing thing is the "#define strlen_m strlen"
We need a real implementation in SAMBA_3_0 which I'll work on
after this code is in.
(This used to be commit 3da9f80c28b1e75ef6d46d38fbb81ade6b9fa951)

1 files changed, 774 insertions, 58 deletions

diff --git a/source3/librpc/ndr/ndr_sec_helper.c b/source3/librpc/ndr/ndr_sec_helper.c
index edbdd9a40eb..944b172d6cd 100644
--- a/source3/librpc/ndr/ndr_sec_helper.c
+++ b/source3/librpc/ndr/ndr_sec_helper.c
@@ -91,97 +91,813 @@ void ndr_print_dom_sid28(struct ndr_print *ndr, const char *name, const struct d
 	ndr_print_dom_sid(ndr, name, sid);
 }
 
+static NTSTATUS ndr_push_security_ace_flags(struct ndr_push *ndr, int ndr_flags, uint8_t r)
+{
+	NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, r));
+	return NT_STATUS_OK;
+}
 
-/*
-  parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
-*/
-NTSTATUS ndr_pull_dom_sid2(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
+static NTSTATUS ndr_pull_security_ace_flags(struct ndr_pull *ndr, int ndr_flags, uint8_t *r)
+{
+	uint8_t v;
+	NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_ace_flags(struct ndr_print *ndr, const char *name, uint8_t r)
+{
+	ndr_print_uint8(ndr, name, r);
+	ndr->depth++;
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_OBJECT_INHERIT", SEC_ACE_FLAG_OBJECT_INHERIT, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_CONTAINER_INHERIT", SEC_ACE_FLAG_CONTAINER_INHERIT, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_NO_PROPAGATE_INHERIT", SEC_ACE_FLAG_NO_PROPAGATE_INHERIT, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_INHERIT_ONLY", SEC_ACE_FLAG_INHERIT_ONLY, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_INHERITED_ACE", SEC_ACE_FLAG_INHERITED_ACE, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_VALID_INHERIT", SEC_ACE_FLAG_VALID_INHERIT, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_SUCCESSFUL_ACCESS", SEC_ACE_FLAG_SUCCESSFUL_ACCESS, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint8_t), "SEC_ACE_FLAG_FAILED_ACCESS", SEC_ACE_FLAG_FAILED_ACCESS, r);
+	ndr->depth--;
+}
+
+static NTSTATUS ndr_push_security_ace_type(struct ndr_push *ndr, int ndr_flags, enum security_ace_type r)
+{
+	NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, r));
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ndr_pull_security_ace_type(struct ndr_pull *ndr, int ndr_flags, enum security_ace_type *r)
+{
+	uint8_t v;
+	NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_ace_type(struct ndr_print *ndr, const char *name, enum security_ace_type r)
+{
+	const char *val = NULL;
+
+	switch (r) {
+		case SEC_ACE_TYPE_ACCESS_ALLOWED: val = "SEC_ACE_TYPE_ACCESS_ALLOWED"; break;
+		case SEC_ACE_TYPE_ACCESS_DENIED: val = "SEC_ACE_TYPE_ACCESS_DENIED"; break;
+		case SEC_ACE_TYPE_SYSTEM_AUDIT: val = "SEC_ACE_TYPE_SYSTEM_AUDIT"; break;
+		case SEC_ACE_TYPE_SYSTEM_ALARM: val = "SEC_ACE_TYPE_SYSTEM_ALARM"; break;
+		case SEC_ACE_TYPE_ALLOWED_COMPOUND: val = "SEC_ACE_TYPE_ALLOWED_COMPOUND"; break;
+		case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: val = "SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT"; break;
+		case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: val = "SEC_ACE_TYPE_ACCESS_DENIED_OBJECT"; break;
+		case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: val = "SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT"; break;
+		case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: val = "SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT"; break;
+	}
+	ndr_print_enum(ndr, name, "ENUM", val, r);
+}
+
+static NTSTATUS ndr_push_security_ace_object_flags(struct ndr_push *ndr, int ndr_flags, uint32_t r)
+{
+	NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r));
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ndr_pull_security_ace_object_flags(struct ndr_pull *ndr, int ndr_flags, uint32_t *r)
+{
+	uint32_t v;
+	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_ace_object_flags(struct ndr_print *ndr, const char *name, uint32_t r)
 {
-	uint32_t num_auths;
-	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+	ndr_print_uint32(ndr, name, r);
+	ndr->depth++;
+	ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SEC_ACE_OBJECT_TYPE_PRESENT", SEC_ACE_OBJECT_TYPE_PRESENT, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT", SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT, r);
+	ndr->depth--;
+}
+
+static NTSTATUS ndr_push_security_ace_object_type(struct ndr_push *ndr, int ndr_flags, const union security_ace_object_type *r)
+{
+	int level;
+	level = ndr_push_get_switch_value(ndr, r);
+	if (ndr_flags & NDR_SCALARS) {
+		switch (level) {
+			case SEC_ACE_OBJECT_TYPE_PRESENT:
+				NDR_CHECK(ndr_push_GUID(ndr, NDR_SCALARS, &r->type));
+			break;
+
+			default:
+			break;
+
+		}
 	}
-	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &num_auths));
-	NDR_CHECK(ndr_pull_dom_sid(ndr, ndr_flags, sid));
-	if (sid->num_auths != num_auths) {
-		return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, 
-				      "Bad array size %u should exceed %u", 
-				      num_auths, sid->num_auths);
+	if (ndr_flags & NDR_BUFFERS) {
+		switch (level) {
+			case SEC_ACE_OBJECT_TYPE_PRESENT:
+			break;
+
+			default:
+			break;
+
+		}
 	}
 	return NT_STATUS_OK;
 }
 
-/*
-  parse a dom_sid2 - this is a dom_sid but with an extra copy of the num_auths field
-*/
-NTSTATUS ndr_push_dom_sid2(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
+static NTSTATUS ndr_pull_security_ace_object_type(struct ndr_pull *ndr, int ndr_flags, union security_ace_object_type *r)
 {
-	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+	int level;
+	level = ndr_pull_get_switch_value(ndr, r);
+	if (ndr_flags & NDR_SCALARS) {
+		switch (level) {
+			case SEC_ACE_OBJECT_TYPE_PRESENT: {
+				NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->type));
+			break; }
+
+			default: {
+			break; }
+
+		}
 	}
-	NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, sid->num_auths));
-	return ndr_push_dom_sid(ndr, ndr_flags, sid);
+	if (ndr_flags & NDR_BUFFERS) {
+		switch (level) {
+			case SEC_ACE_OBJECT_TYPE_PRESENT:
+			break;
+
+			default:
+			break;
+
+		}
+	}
+	return NT_STATUS_OK;
 }
 
-/*
-  parse a dom_sid28 - this is a dom_sid in a fixed 28 byte buffer, so we need to ensure there are only upto 5 sub_auth
-*/
-NTSTATUS ndr_pull_dom_sid28(struct ndr_pull *ndr, int ndr_flags, struct dom_sid *sid)
+void ndr_print_security_ace_object_type(struct ndr_print *ndr, const char *name, const union security_ace_object_type *r)
+{
+	int level;
+	level = ndr_print_get_switch_value(ndr, r);
+	ndr_print_union(ndr, name, level, "security_ace_object_type");
+	switch (level) {
+		case SEC_ACE_OBJECT_TYPE_PRESENT:
+			ndr_print_GUID(ndr, "type", &r->type);
+		break;
+
+		default:
+		break;
+
+	}
+}
+
+static NTSTATUS ndr_push_security_ace_object_inherited_type(struct ndr_push *ndr, int ndr_flags, const union security_ace_object_inherited_type *r)
 {
-	NTSTATUS status;
-	struct ndr_pull *subndr;
+	int level;
+	level = ndr_push_get_switch_value(ndr, r);
+	if (ndr_flags & NDR_SCALARS) {
+		switch (level) {
+			case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
+				NDR_CHECK(ndr_push_GUID(ndr, NDR_SCALARS, &r->inherited_type));
+			break;
 
-	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+			default:
+			break;
+
+		}
 	}
+	if (ndr_flags & NDR_BUFFERS) {
+		switch (level) {
+			case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
+			break;
 
-	subndr = talloc_zero(ndr, struct ndr_pull);
-	NT_STATUS_HAVE_NO_MEMORY(subndr);
-	subndr->flags		= ndr->flags;
-	subndr->current_mem_ctx	= ndr->current_mem_ctx;
+			default:
+			break;
 
-	subndr->data		= ndr->data + ndr->offset;
-	subndr->data_size	= 28;
-	subndr->offset		= 0;
+		}
+	}
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ndr_pull_security_ace_object_inherited_type(struct ndr_pull *ndr, int ndr_flags, union security_ace_object_inherited_type *r)
+{
+	int level;
+	level = ndr_pull_get_switch_value(ndr, r);
+	if (ndr_flags & NDR_SCALARS) {
+		switch (level) {
+			case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT: {
+				NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &r->inherited_type));
+			break; }
 
-	NDR_CHECK(ndr_pull_advance(ndr, 28));
+			default: {
+			break; }
 
-	status = ndr_pull_dom_sid(subndr, ndr_flags, sid);
-	if (!NT_STATUS_IS_OK(status)) {
-		/* handle a w2k bug which send random data in the buffer */
-		ZERO_STRUCTP(sid);
+		}
 	}
+	if (ndr_flags & NDR_BUFFERS) {
+		switch (level) {
+			case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
+			break;
 
+			default:
+			break;
+
+		}
+	}
 	return NT_STATUS_OK;
 }
 
-/*
-  push a dom_sid28 - this is a dom_sid in a 28 byte fixed buffer
-*/
-NTSTATUS ndr_push_dom_sid28(struct ndr_push *ndr, int ndr_flags, const struct dom_sid *sid)
+void ndr_print_security_ace_object_inherited_type(struct ndr_print *ndr, const char *name, const union security_ace_object_inherited_type *r)
+{
+	int level;
+	level = ndr_print_get_switch_value(ndr, r);
+	ndr_print_union(ndr, name, level, "security_ace_object_inherited_type");
+	switch (level) {
+		case SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT:
+			ndr_print_GUID(ndr, "inherited_type", &r->inherited_type);
+		break;
+
+		default:
+		break;
+
+	}
+}
+
+static NTSTATUS ndr_push_security_ace_object(struct ndr_push *ndr, int ndr_flags, const struct security_ace_object *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_security_ace_object_flags(ndr, NDR_SCALARS, r->flags));
+		NDR_CHECK(ndr_push_set_switch_value(ndr, &r->type, r->flags&SEC_ACE_OBJECT_TYPE_PRESENT));
+		NDR_CHECK(ndr_push_security_ace_object_type(ndr, NDR_SCALARS, &r->type));
+		NDR_CHECK(ndr_push_set_switch_value(ndr, &r->inherited_type, r->flags&SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT));
+		NDR_CHECK(ndr_push_security_ace_object_inherited_type(ndr, NDR_SCALARS, &r->inherited_type));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		NDR_CHECK(ndr_push_security_ace_object_type(ndr, NDR_BUFFERS, &r->type));
+		NDR_CHECK(ndr_push_security_ace_object_inherited_type(ndr, NDR_BUFFERS, &r->inherited_type));
+	}
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ndr_pull_security_ace_object(struct ndr_pull *ndr, int ndr_flags, struct security_ace_object *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_pull_align(ndr, 4));
+		NDR_CHECK(ndr_pull_security_ace_object_flags(ndr, NDR_SCALARS, &r->flags));
+		NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->type, r->flags&SEC_ACE_OBJECT_TYPE_PRESENT));
+		NDR_CHECK(ndr_pull_security_ace_object_type(ndr, NDR_SCALARS, &r->type));
+		NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->inherited_type, r->flags&SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT));
+		NDR_CHECK(ndr_pull_security_ace_object_inherited_type(ndr, NDR_SCALARS, &r->inherited_type));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		NDR_CHECK(ndr_pull_security_ace_object_type(ndr, NDR_BUFFERS, &r->type));
+		NDR_CHECK(ndr_pull_security_ace_object_inherited_type(ndr, NDR_BUFFERS, &r->inherited_type));
+	}
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_ace_object(struct ndr_print *ndr, const char *name, const struct security_ace_object *r)
+{
+	ndr_print_struct(ndr, name, "security_ace_object");
+	ndr->depth++;
+	ndr_print_security_ace_object_flags(ndr, "flags", r->flags);
+	ndr_print_set_switch_value(ndr, &r->type, r->flags&SEC_ACE_OBJECT_TYPE_PRESENT);
+	ndr_print_security_ace_object_type(ndr, "type", &r->type);
+	ndr_print_set_switch_value(ndr, &r->inherited_type, r->flags&SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT);
+	ndr_print_security_ace_object_inherited_type(ndr, "inherited_type", &r->inherited_type);
+	ndr->depth--;
+}
+
+static NTSTATUS ndr_push_security_ace_object_ctr(struct ndr_push *ndr, int ndr_flags, const union security_ace_object_ctr *r)
+{
+	int level;
+	level = ndr_push_get_switch_value(ndr, r);
+	if (ndr_flags & NDR_SCALARS) {
+		switch (level) {
+			case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break;
+
+			default:
+			break;
+
+		}
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		switch (level) {
+			case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
+				NDR_CHECK(ndr_push_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			default:
+			break;
+
+		}
+	}
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ndr_pull_security_ace_object_ctr(struct ndr_pull *ndr, int ndr_flags, union security_ace_object_ctr *r)
+{
+	int level;
+	level = ndr_pull_get_switch_value(ndr, r);
+	if (ndr_flags & NDR_SCALARS) {
+		switch (level) {
+			case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT: {
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break; }
+
+			case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT: {
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break; }
+
+			case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT: {
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break; }
+
+			case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT: {
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_SCALARS, &r->object));
+			break; }
+
+			default: {
+			break; }
+
+		}
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		switch (level) {
+			case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
+				NDR_CHECK(ndr_pull_security_ace_object(ndr, NDR_BUFFERS, &r->object));
+			break;
+
+			default:
+			break;
+
+		}
+	}
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_ace_object_ctr(struct ndr_print *ndr, const char *name, const union security_ace_object_ctr *r)
+{
+	int level;
+	level = ndr_print_get_switch_value(ndr, r);
+	ndr_print_union(ndr, name, level, "security_ace_object_ctr");
+	switch (level) {
+		case SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT:
+			ndr_print_security_ace_object(ndr, "object", &r->object);
+		break;
+
+		case SEC_ACE_TYPE_ACCESS_DENIED_OBJECT:
+			ndr_print_security_ace_object(ndr, "object", &r->object);
+		break;
+
+		case SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT:
+			ndr_print_security_ace_object(ndr, "object", &r->object);
+		break;
+
+		case SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT:
+			ndr_print_security_ace_object(ndr, "object", &r->object);
+		break;
+
+		default:
+		break;
+
+	}
+}
+
+NTSTATUS ndr_push_security_ace(struct ndr_push *ndr, int ndr_flags, const struct security_ace *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_security_ace_type(ndr, NDR_SCALARS, r->type));
+		NDR_CHECK(ndr_push_security_ace_flags(ndr, NDR_SCALARS, r->flags));
+		NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, ndr_size_security_ace(r,ndr->flags)));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->access_mask));
+		NDR_CHECK(ndr_push_set_switch_value(ndr, &r->object, r->type));
+		NDR_CHECK(ndr_push_security_ace_object_ctr(ndr, NDR_SCALARS, &r->object));
+		NDR_CHECK(ndr_push_dom_sid(ndr, NDR_SCALARS, &r->trustee));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		NDR_CHECK(ndr_push_security_ace_object_ctr(ndr, NDR_BUFFERS, &r->object));
+	}
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_security_ace(struct ndr_pull *ndr, int ndr_flags, struct security_ace *r)
+{
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_pull_align(ndr, 4));
+		NDR_CHECK(ndr_pull_security_ace_type(ndr, NDR_SCALARS, &r->type));
+		NDR_CHECK(ndr_pull_security_ace_flags(ndr, NDR_SCALARS, &r->flags));
+		NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->size));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->access_mask));
+		NDR_CHECK(ndr_pull_set_switch_value(ndr, &r->object, r->type));
+		NDR_CHECK(ndr_pull_security_ace_object_ctr(ndr, NDR_SCALARS, &r->object));
+		NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, &r->trustee));
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		NDR_CHECK(ndr_pull_security_ace_object_ctr(ndr, NDR_BUFFERS, &r->object));
+	}
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_ace(struct ndr_print *ndr, const char *name, const struct security_ace *r)
+{
+	ndr_print_struct(ndr, name, "security_ace");
+	ndr->depth++;
+	ndr_print_security_ace_type(ndr, "type", r->type);
+	ndr_print_security_ace_flags(ndr, "flags", r->flags);
+	ndr_print_uint16(ndr, "size", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?ndr_size_security_ace(r,ndr->flags):r->size);
+	ndr_print_uint32(ndr, "access_mask", r->access_mask);
+	ndr_print_set_switch_value(ndr, &r->object, r->type);
+	ndr_print_security_ace_object_ctr(ndr, "object", &r->object);
+	ndr_print_dom_sid(ndr, "trustee", &r->trustee);
+	ndr->depth--;
+}
+
+static NTSTATUS ndr_push_security_acl_revision(struct ndr_push *ndr, int ndr_flags, enum security_acl_revision r)
+{
+	NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r));
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ndr_pull_security_acl_revision(struct ndr_pull *ndr, int ndr_flags, enum security_acl_revision *r)
+{
+	uint16_t v;
+	NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_acl_revision(struct ndr_print *ndr, const char *name, enum security_acl_revision r)
+{
+	const char *val = NULL;
+
+	switch (r) {
+		case SECURITY_ACL_REVISION_NT4: val = "SECURITY_ACL_REVISION_NT4"; break;
+		case SECURITY_ACL_REVISION_ADS: val = "SECURITY_ACL_REVISION_ADS"; break;
+	}
+	ndr_print_enum(ndr, name, "ENUM", val, r);
+}
+
+NTSTATUS ndr_push_security_acl(struct ndr_push *ndr, int ndr_flags, const struct security_acl *r)
 {
-	uint32_t old_offset;
-	uint32_t padding;
+	uint32_t cntr_aces_0;
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_push_align(ndr, 4));
+		NDR_CHECK(ndr_push_security_acl_revision(ndr, NDR_SCALARS, r->revision));
+		NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, ndr_size_security_acl(r,ndr->flags)));
+		NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->num_aces));
+		for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) {
+			NDR_CHECK(ndr_push_security_ace(ndr, NDR_SCALARS, &r->aces[cntr_aces_0]));
+		}
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) {
+			NDR_CHECK(ndr_push_security_ace(ndr, NDR_BUFFERS, &r->aces[cntr_aces_0]));
+		}
+	}
+	return NT_STATUS_OK;
+}
 
-	if (!(ndr_flags & NDR_SCALARS)) {
-		return NT_STATUS_OK;
+NTSTATUS ndr_pull_security_acl(struct ndr_pull *ndr, int ndr_flags, struct security_acl *r)
+{
+	uint32_t cntr_aces_0;
+	TALLOC_CTX *_mem_save_aces_0;
+	if (ndr_flags & NDR_SCALARS) {
+		NDR_CHECK(ndr_pull_align(ndr, 4));
+		NDR_CHECK(ndr_pull_security_acl_revision(ndr, NDR_SCALARS, &r->revision));
+		NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->size));
+		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->num_aces));
+		if (r->num_aces < 0 || r->num_aces > 1000) {
+			return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
+		}
+		NDR_PULL_ALLOC_N(ndr, r->aces, r->num_aces);
+		_mem_save_aces_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->aces, 0);
+		for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) {
+			NDR_CHECK(ndr_pull_security_ace(ndr, NDR_SCALARS, &r->aces[cntr_aces_0]));
+		}
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_aces_0, 0);
+	}
+	if (ndr_flags & NDR_BUFFERS) {
+		_mem_save_aces_0 = NDR_PULL_GET_MEM_CTX(ndr);
+		NDR_PULL_SET_MEM_CTX(ndr, r->aces, 0);
+		for (cntr_aces_0 = 0; cntr_aces_0 < r->num_aces; cntr_aces_0++) {
+			NDR_CHECK(ndr_pull_security_ace(ndr, NDR_BUFFERS, &r->aces[cntr_aces_0]));
+		}
+		NDR_PULL_SET_MEM_CTX(ndr, _mem_save_aces_0, 0);
 	}
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_acl(struct ndr_print *ndr, const char *name, const struct security_acl *r)
+{
+	uint32_t cntr_aces_0;
+	ndr_print_struct(ndr, name, "security_acl");
+	ndr->depth++;
+	ndr_print_security_acl_revision(ndr, "revision", r->revision);
+	ndr_print_uint16(ndr, "size", (ndr->flags & LIBNDR_PRINT_SET_VALUES)?ndr_size_security_acl(r,ndr->flags):r->size);
+	ndr_print_uint32(ndr, "num_aces", r->num_aces);
+	ndr->print(ndr, "%s: ARRAY(%d)", "aces", r->num_aces);
+	ndr->depth++;
+	for (cntr_aces_0=0;cntr_aces_0<r->num_aces;cntr_aces_0++) {
+		char *idx_0=NULL;
+		asprintf(&idx_0, "[%d]", cntr_aces_0);
+		if (idx_0) {
+			ndr_print_security_ace(ndr, "aces", &r->aces[cntr_aces_0]);
+			free(idx_0);
+		}
+	}
+	ndr->depth--;
+	ndr->depth--;
+}
+
+static NTSTATUS ndr_push_security_descriptor_revision(struct ndr_push *ndr, int ndr_flags, enum security_descriptor_revision r)
+{
+	NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, r));
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ndr_pull_security_descriptor_revision(struct ndr_pull *ndr, int ndr_flags, enum security_descriptor_revision *r)
+{
+	uint8_t v;
+	NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NT_STATUS_OK;
+}
 
-	if (sid->num_auths > 5) {
-		return ndr_push_error(ndr, NDR_ERR_RANGE, 
-				      "dom_sid28 allows only upto 5 sub auth [%u]", 
-				      sid->num_auths);
+void ndr_print_security_descriptor_revision(struct ndr_print *ndr, const char *name, enum security_descriptor_revision r)
+{
+	const char *val = NULL;
+
+	switch (r) {
+		case SECURITY_DESCRIPTOR_REVISION_1: val = "SECURITY_DESCRIPTOR_REVISION_1"; break;
 	}
+	ndr_print_enum(ndr, name, "ENUM", val, r);
+}
+
+static NTSTATUS ndr_push_security_descriptor_type(struct ndr_push *ndr, int ndr_flags, uint16_t r)
+{
+	NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r));
+	return NT_STATUS_OK;
+}
 
-	old_offset = ndr->offset;
-	NDR_CHECK(ndr_push_dom_sid(ndr, ndr_flags, sid));
+static NTSTATUS ndr_pull_security_descriptor_type(struct ndr_pull *ndr, int ndr_flags, uint16_t *r)
+{
+	uint16_t v;
+	NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_descriptor_type(struct ndr_print *ndr, const char *name, uint16_t r)
+{
+	ndr_print_uint16(ndr, name, r);
+	ndr->depth++;
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_OWNER_DEFAULTED", SEC_DESC_OWNER_DEFAULTED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_GROUP_DEFAULTED", SEC_DESC_GROUP_DEFAULTED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_PRESENT", SEC_DESC_DACL_PRESENT, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_DEFAULTED", SEC_DESC_DACL_DEFAULTED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_PRESENT", SEC_DESC_SACL_PRESENT, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_DEFAULTED", SEC_DESC_SACL_DEFAULTED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_TRUSTED", SEC_DESC_DACL_TRUSTED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SERVER_SECURITY", SEC_DESC_SERVER_SECURITY, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_AUTO_INHERIT_REQ", SEC_DESC_DACL_AUTO_INHERIT_REQ, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_AUTO_INHERIT_REQ", SEC_DESC_SACL_AUTO_INHERIT_REQ, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_AUTO_INHERITED", SEC_DESC_DACL_AUTO_INHERITED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_AUTO_INHERITED", SEC_DESC_SACL_AUTO_INHERITED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_DACL_PROTECTED", SEC_DESC_DACL_PROTECTED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SACL_PROTECTED", SEC_DESC_SACL_PROTECTED, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_RM_CONTROL_VALID", SEC_DESC_RM_CONTROL_VALID, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint16_t), "SEC_DESC_SELF_RELATIVE", SEC_DESC_SELF_RELATIVE, r);
+	ndr->depth--;
+}
 
-	padding = 28 - (ndr->offset - old_offset);
+NTSTATUS ndr_push_security_descriptor(struct ndr_push *ndr, int ndr_flags, const struct security_descriptor *r)
+{
+	{
+		uint32_t _flags_save_STRUCT = ndr->flags;
+		ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN);
+		if (ndr_flags & NDR_SCALARS) {
+			NDR_CHECK(ndr_push_align(ndr, 4));
+			NDR_CHECK(ndr_push_security_descriptor_revision(ndr, NDR_SCALARS, r->revision));
+			NDR_CHECK(ndr_push_security_descriptor_type(ndr, NDR_SCALARS, r->type));
+			NDR_CHECK(ndr_push_relative_ptr1(ndr, r->owner_sid));
+			NDR_CHECK(ndr_push_relative_ptr1(ndr, r->group_sid));
+			NDR_CHECK(ndr_push_relative_ptr1(ndr, r->sacl));
+			NDR_CHECK(ndr_push_relative_ptr1(ndr, r->dacl));
+		}
+		if (ndr_flags & NDR_BUFFERS) {
+			if (r->owner_sid) {
+				NDR_CHECK(ndr_push_relative_ptr2(ndr, r->owner_sid));
+				NDR_CHECK(ndr_push_dom_sid(ndr, NDR_SCALARS, r->owner_sid));
+			}
+			if (r->group_sid) {
+				NDR_CHECK(ndr_push_relative_ptr2(ndr, r->group_sid));
+				NDR_CHECK(ndr_push_dom_sid(ndr, NDR_SCALARS, r->group_sid));
+			}
+			if (r->sacl) {
+				NDR_CHECK(ndr_push_relative_ptr2(ndr, r->sacl));
+				NDR_CHECK(ndr_push_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->sacl));
+			}
+			if (r->dacl) {
+				NDR_CHECK(ndr_push_relative_ptr2(ndr, r->dacl));
+				NDR_CHECK(ndr_push_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->dacl));
+			}
+		}
+		ndr->flags = _flags_save_STRUCT;
+	}
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_security_descriptor(struct ndr_pull *ndr, int ndr_flags, struct security_descriptor *r)
+{
+	uint32_t _ptr_owner_sid;
+	TALLOC_CTX *_mem_save_owner_sid_0;
+	uint32_t _ptr_group_sid;
+	TALLOC_CTX *_mem_save_group_sid_0;
+	uint32_t _ptr_sacl;
+	TALLOC_CTX *_mem_save_sacl_0;
+	uint32_t _ptr_dacl;
+	TALLOC_CTX *_mem_save_dacl_0;
+	{
+		uint32_t _flags_save_STRUCT = ndr->flags;
+		ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN);
+		if (ndr_flags & NDR_SCALARS) {
+			NDR_CHECK(ndr_pull_align(ndr, 4));
+			NDR_CHECK(ndr_pull_security_descriptor_revision(ndr, NDR_SCALARS, &r->revision));
+			NDR_CHECK(ndr_pull_security_descriptor_type(ndr, NDR_SCALARS, &r->type));
+			NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_owner_sid));
+			if (_ptr_owner_sid) {
+				NDR_PULL_ALLOC(ndr, r->owner_sid);
+				NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->owner_sid, _ptr_owner_sid));
+			} else {
+				r->owner_sid = NULL;
+			}
+			NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_group_sid));
+			if (_ptr_group_sid) {
+				NDR_PULL_ALLOC(ndr, r->group_sid);
+				NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->group_sid, _ptr_group_sid));
+			} else {
+				r->group_sid = NULL;
+			}
+			NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_sacl));
+			if (_ptr_sacl) {
+				NDR_PULL_ALLOC(ndr, r->sacl);
+				NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->sacl, _ptr_sacl));
+			} else {
+				r->sacl = NULL;
+			}
+			NDR_CHECK(ndr_pull_generic_ptr(ndr, &_ptr_dacl));
+			if (_ptr_dacl) {
+				NDR_PULL_ALLOC(ndr, r->dacl);
+				NDR_CHECK(ndr_pull_relative_ptr1(ndr, r->dacl, _ptr_dacl));
+			} else {
+				r->dacl = NULL;
+			}
+		}
+		if (ndr_flags & NDR_BUFFERS) {
+			if (r->owner_sid) {
+				struct ndr_pull_save _relative_save;
+				ndr_pull_save(ndr, &_relative_save);
+				NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->owner_sid));
+				_mem_save_owner_sid_0 = NDR_PULL_GET_MEM_CTX(ndr);
+				NDR_PULL_SET_MEM_CTX(ndr, r->owner_sid, 0);
+				NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, r->owner_sid));
+				NDR_PULL_SET_MEM_CTX(ndr, _mem_save_owner_sid_0, 0);
+				ndr_pull_restore(ndr, &_relative_save);
+			}
+			if (r->group_sid) {
+				struct ndr_pull_save _relative_save;
+				ndr_pull_save(ndr, &_relative_save);
+				NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->group_sid));
+				_mem_save_group_sid_0 = NDR_PULL_GET_MEM_CTX(ndr);
+				NDR_PULL_SET_MEM_CTX(ndr, r->group_sid, 0);
+				NDR_CHECK(ndr_pull_dom_sid(ndr, NDR_SCALARS, r->group_sid));
+				NDR_PULL_SET_MEM_CTX(ndr, _mem_save_group_sid_0, 0);
+				ndr_pull_restore(ndr, &_relative_save);
+			}
+			if (r->sacl) {
+				struct ndr_pull_save _relative_save;
+				ndr_pull_save(ndr, &_relative_save);
+				NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->sacl));
+				_mem_save_sacl_0 = NDR_PULL_GET_MEM_CTX(ndr);
+				NDR_PULL_SET_MEM_CTX(ndr, r->sacl, 0);
+				NDR_CHECK(ndr_pull_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->sacl));
+				NDR_PULL_SET_MEM_CTX(ndr, _mem_save_sacl_0, 0);
+				ndr_pull_restore(ndr, &_relative_save);
+			}
+			if (r->dacl) {
+				struct ndr_pull_save _relative_save;
+				ndr_pull_save(ndr, &_relative_save);
+				NDR_CHECK(ndr_pull_relative_ptr2(ndr, r->dacl));
+				_mem_save_dacl_0 = NDR_PULL_GET_MEM_CTX(ndr);
+				NDR_PULL_SET_MEM_CTX(ndr, r->dacl, 0);
+				NDR_CHECK(ndr_pull_security_acl(ndr, NDR_SCALARS|NDR_BUFFERS, r->dacl));
+				NDR_PULL_SET_MEM_CTX(ndr, _mem_save_dacl_0, 0);
+				ndr_pull_restore(ndr, &_relative_save);
+			}
+		}
+		ndr->flags = _flags_save_STRUCT;
+	}
+	return NT_STATUS_OK;
+}
 
-	if (padding > 0) {
-		NDR_CHECK(ndr_push_zero(ndr, padding));
+void ndr_print_security_descriptor(struct ndr_print *ndr, const char *name, const struct security_descriptor *r)
+{
+	ndr_print_struct(ndr, name, "security_descriptor");
+	{
+		uint32_t _flags_save_STRUCT = ndr->flags;
+		ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN);
+		ndr->depth++;
+		ndr_print_security_descriptor_revision(ndr, "revision", r->revision);
+		ndr_print_security_descriptor_type(ndr, "type", r->type);
+		ndr_print_ptr(ndr, "owner_sid", r->owner_sid);
+		ndr->depth++;
+		if (r->owner_sid) {
+			ndr_print_dom_sid(ndr, "owner_sid", r->owner_sid);
+		}
+		ndr->depth--;
+		ndr_print_ptr(ndr, "group_sid", r->group_sid);
+		ndr->depth++;
+		if (r->group_sid) {
+			ndr_print_dom_sid(ndr, "group_sid", r->group_sid);
+		}
+		ndr->depth--;
+		ndr_print_ptr(ndr, "sacl", r->sacl);
+		ndr->depth++;
+		if (r->sacl) {
+			ndr_print_security_acl(ndr, "sacl", r->sacl);
+		}
+		ndr->depth--;
+		ndr_print_ptr(ndr, "dacl", r->dacl);
+		ndr->depth++;
+		if (r->dacl) {
+			ndr_print_security_acl(ndr, "dacl", r->dacl);
+		}
+		ndr->depth--;
+		ndr->depth--;
+		ndr->flags = _flags_save_STRUCT;
 	}
+}
 
+NTSTATUS ndr_push_security_secinfo(struct ndr_push *ndr, int ndr_flags, uint32_t r)
+{
+	NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r));
 	return NT_STATUS_OK;
 }
 
+NTSTATUS ndr_pull_security_secinfo(struct ndr_pull *ndr, int ndr_flags, uint32_t *r)
+{
+	uint32_t v;
+	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
+	*r = v;
+	return NT_STATUS_OK;
+}
+
+void ndr_print_security_secinfo(struct ndr_print *ndr, const char *name, uint32_t r)
+{
+	ndr_print_uint32(ndr, name, r);
+	ndr->depth++;
+	ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_OWNER", SECINFO_OWNER, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_GROUP", SECINFO_GROUP, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_DACL", SECINFO_DACL, r);
+	ndr_print_bitmap_flag(ndr, sizeof(uint32_t), "SECINFO_SACL", SECINFO_SACL, r);
+	ndr->depth--;
+}
+