source/include/rpc_lsa.h

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    SMB parameters and setup
   5    Copyright (C) Andrew Tridgell 1992-1997
   6    Copyright (C) Luke Kenneth Casson Leighton 1996-1997
   7    Copyright (C) Paul Ashton 1997
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #ifndef _RPC_LSA_H /* _RPC_LSA_H */
  25 #define _RPC_LSA_H
  26
  27 #include "rpc_misc.h"
  28
  29 enum SID_NAME_USE
  30 {
  31         SID_NAME_USER    = 1, /* user */
  32         SID_NAME_DOM_GRP = 2, /* domain group */
  33         SID_NAME_DOMAIN  = 3, /* domain: don't know what this is */
  34         SID_NAME_ALIAS   = 4, /* local group */
  35         SID_NAME_WKN_GRP = 5, /* well-known group */
  36         SID_NAME_DELETED = 6, /* deleted account: needed for c2 rating */
  37         SID_NAME_INVALID = 7, /* invalid account */
  38         SID_NAME_UNKNOWN = 8  /* oops. */
  39 };
  40
  41 /* LSA ACE permissions */
  42
  43 #define POLICY_VIEW_LOCAL_INFORMATION    0x00000001
  44 #define POLICY_VIEW_AUDIT_INFORMATION    0x00000002
  45 #define POLICY_GET_PRIVATE_INFORMATION   0x00000004
  46 #define POLICY_TRUST_ADMIN               0x00000008
  47 #define POLICY_CREATE_ACCOUNT            0x00000010
  48 #define POLICY_CREATE_SECRET             0x00000020
  49 #define POLICY_CREATE_PRIVILEGE          0x00000040
  50 #define POLICY_SET_DEFAULT_QUOTA_LIMITS  0x00000080
  51 #define POLICY_SET_AUDIT_REQUIREMENTS    0x00000100
  52 #define POLICY_AUDIT_LOG_ADMIN           0x00000200
  53 #define POLICY_SERVER_ADMIN              0x00000400
  54 #define POLICY_LOOKUP_NAMES              0x00000800
  55
  56 #define POLICY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED          |\
  57                             POLICY_VIEW_LOCAL_INFORMATION    |\
  58                             POLICY_VIEW_AUDIT_INFORMATION    |\
  59                             POLICY_GET_PRIVATE_INFORMATION   |\
  60                             POLICY_TRUST_ADMIN               |\
  61                             POLICY_CREATE_ACCOUNT            |\
  62                             POLICY_CREATE_SECRET             |\
  63                             POLICY_CREATE_PRIVILEGE          |\
  64                             POLICY_SET_DEFAULT_QUOTA_LIMITS  |\
  65                             POLICY_SET_AUDIT_REQUIREMENTS    |\
  66                             POLICY_AUDIT_LOG_ADMIN           |\
  67                             POLICY_SERVER_ADMIN              |\
  68                             POLICY_LOOKUP_NAMES )
  69
  70
  71 #define POLICY_READ       (STANDARD_RIGHTS_READ              |\
  72                             POLICY_VIEW_AUDIT_INFORMATION    |\
  73                             POLICY_GET_PRIVATE_INFORMATION)
  74
  75 #define POLICY_WRITE      (STANDARD_RIGHTS_WRITE             |\
  76                             POLICY_TRUST_ADMIN               |\
  77                             POLICY_CREATE_ACCOUNT            |\
  78                             POLICY_CREATE_SECRET             |\
  79                             POLICY_CREATE_PRIVILEGE          |\
  80                             POLICY_SET_DEFAULT_QUOTA_LIMITS  |\
  81                             POLICY_SET_AUDIT_REQUIREMENTS    |\
  82                             POLICY_AUDIT_LOG_ADMIN           |\
  83                             POLICY_SERVER_ADMIN)
  84
  85 #define POLICY_EXECUTE    (STANDARD_RIGHTS_EXECUTE           |\
  86                             POLICY_VIEW_LOCAL_INFORMATION    |\
  87                             POLICY_LOOKUP_NAMES )
  88
  89 /* ntlsa pipe */
  90 #define LSA_CLOSE              0x00
  91 #define LSA_OPENPOLICY         0x06
  92 #define LSA_QUERYINFOPOLICY    0x07
  93 #define LSA_QUERYSECOBJECT     0x03
  94 #define LSA_ENUMTRUSTDOM       0x0d
  95 #define LSA_LOOKUPNAMES        0x0e
  96 #define LSA_LOOKUPSIDS         0x0f
  97 #define LSA_CREATESECRET       0x10
  98 #define LSA_OPENSECRET         0x1c
  99 #define LSA_SETSECRET          0x1d
 100 #define LSA_QUERYSECRET        0x1e
 101 #define LSA_OPENPOLICY2        0x2c
 102
 103 #define LSA_MAX_GROUPS 32
 104 #define LSA_MAX_SIDS 32
 105
 106 /* DOM_QUERY - info class 3 and 5 LSA Query response */
 107 typedef struct dom_query_info
 108 {
 109   uint16 uni_dom_max_len; /* domain name string length * 2 */
 110   uint16 uni_dom_str_len; /* domain name string length * 2 */
 111   uint32 buffer_dom_name; /* undocumented domain name string buffer pointer */
 112   uint32 buffer_dom_sid; /* undocumented domain SID string buffer pointer */
 113   UNISTR2 uni_domain_name; /* domain name (unicode string) */
 114   DOM_SID2 dom_sid; /* domain SID */
 115
 116 } DOM_QUERY;
 117
 118 /* level 5 is same as level 3.  we hope. */
 119 typedef DOM_QUERY DOM_QUERY_3;
 120 typedef DOM_QUERY DOM_QUERY_5;
 121
 122 typedef struct seq_qos_info
 123 {
 124         uint32 len; /* 12 */
 125         uint16 sec_imp_level; /* 0x02 - impersonation level */
 126         uint8  sec_ctxt_mode; /* 0x01 - context tracking mode */
 127         uint8  effective_only; /* 0x00 - effective only */
 128         uint32 unknown;        /* 0x2000 0000 - not known */
 129
 130 } LSA_SEC_QOS;
 131
 132 typedef struct obj_attr_info
 133 {
 134         uint32 len;          /* 0x18 - length (in bytes) inc. the length field. */
 135         uint32 ptr_root_dir; /* 0 - root directory (pointer) */
 136         uint32 ptr_obj_name; /* 0 - object name (pointer) */
 137         uint32 attributes;   /* 0 - attributes (undocumented) */
 138         uint32 ptr_sec_desc; /* 0 - security descriptior (pointer) */
 139         uint32 ptr_sec_qos;  /* security quality of service */
 140         LSA_SEC_QOS *sec_qos;
 141
 142 } LSA_OBJ_ATTR;
 143
 144 /* LSA_Q_OPEN_POL - LSA Query Open Policy */
 145 typedef struct lsa_q_open_pol_info
 146 {
 147         uint32 ptr;         /* undocumented buffer pointer */
 148         uint16 system_name; /* system name BUG!!! (should be \\server!) */
 149         LSA_OBJ_ATTR attr ; /* object attributes */
 150
 151         uint32 des_access; /* desired access attributes */
 152
 153 } LSA_Q_OPEN_POL;
 154
 155 /* LSA_R_OPEN_POL - response to LSA Open Policy */
 156 typedef struct lsa_r_open_pol_info
 157 {
 158         POLICY_HND pol; /* policy handle */
 159         uint32 status; /* return code */
 160
 161 } LSA_R_OPEN_POL;
 162
 163 /* LSA_Q_OPEN_POL2 - LSA Query Open Policy */
 164 typedef struct lsa_q_open_pol2_info
 165 {
 166         uint32       ptr;             /* undocumented buffer pointer */
 167         UNISTR2      uni_server_name; /* server name, starting with two '\'s */
 168         LSA_OBJ_ATTR attr           ; /* object attributes */
 169
 170         uint32 des_access; /* desired access attributes */
 171
 172 } LSA_Q_OPEN_POL2;
 173
 174 /* LSA_R_OPEN_POL2 - response to LSA Open Policy */
 175 typedef struct lsa_r_open_pol2_info
 176 {
 177         POLICY_HND pol; /* policy handle */
 178         uint32 status; /* return code */
 179
 180 } LSA_R_OPEN_POL2;
 181
 182 /* LSA_Q_QUERY_SEC_OBJ - LSA query security */
 183 typedef struct lsa_query_sec_obj_info
 184 {
 185         POLICY_HND pol; /* policy handle */
 186         uint32 sec_info;
 187
 188 } LSA_Q_QUERY_SEC_OBJ;
 189
 190 /* LSA_R_QUERY_SEC_OBJ - probably an open */
 191 typedef struct r_lsa_query_sec_obj_info
 192 {
 193         uint32 ptr;
 194         SEC_DESC_BUF buf;
 195
 196         uint32 status;         /* return status */
 197
 198 } LSA_R_QUERY_SEC_OBJ;
 199
 200 /* LSA_Q_QUERY_INFO - LSA query info policy */
 201 typedef struct lsa_query_info
 202 {
 203         POLICY_HND pol; /* policy handle */
 204         uint16 info_class; /* info class */
 205
 206 } LSA_Q_QUERY_INFO;
 207
 208 /* LSA_R_QUERY_INFO - response to LSA query info policy */
 209 typedef struct lsa_r_query_info
 210 {
 211         uint32 undoc_buffer; /* undocumented buffer pointer */
 212         uint16 info_class; /* info class (same as info class in request) */
 213
 214         union
 215         {
 216                 DOM_QUERY_3 id3;
 217                 DOM_QUERY_5 id5;
 218
 219         } dom;
 220
 221         uint32 status; /* return code */
 222
 223 } LSA_R_QUERY_INFO;
 224
 225 /* LSA_Q_CREATE_SECRET - LSA Create Secret */
 226 typedef struct lsa_q_create_secret_info
 227 {
 228         POLICY_HND pol;
 229         UNIHDR hdr_secret;
 230         UNISTR2 uni_secret;
 231
 232         uint32 des_access; /* desired access attributes */
 233
 234 } LSA_Q_CREATE_SECRET;
 235
 236 /* LSA_R_CREATE_SECRET - response to LSA Open Secret */
 237 typedef struct lsa_r_create_secret_info
 238 {
 239         POLICY_HND pol;
 240         uint32 status;
 241
 242 } LSA_R_CREATE_SECRET;
 243
 244 /* LSA_Q_OPEN_SECRET - LSA Open Secret */
 245 typedef struct lsa_q_open_secret_info
 246 {
 247         POLICY_HND pol;
 248         UNIHDR hdr_secret;
 249         UNISTR2 uni_secret;
 250
 251         uint32 des_access; /* desired access attributes */
 252
 253 } LSA_Q_OPEN_SECRET;
 254
 255 /* LSA_R_OPEN_SECRET - response to LSA Open Secret */
 256 typedef struct lsa_r_open_secret_info
 257 {
 258         POLICY_HND pol;
 259         uint32 status;
 260
 261 } LSA_R_OPEN_SECRET;
 262
 263 typedef struct lsa_secret_value_info
 264 {
 265         uint32 ptr_secret;
 266         STRHDR2 hdr_secret;
 267         STRING2 enc_secret; /* encrypted, see nt_encrypt_string2 */
 268
 269 } LSA_SECRET_VALUE;
 270
 271 typedef struct lsa_secret_info_info
 272 {
 273         uint32 ptr_value;
 274         LSA_SECRET_VALUE value;
 275
 276         uint32 ptr_update;
 277         NTTIME last_update; /* N.B. 64-bit alignment? */
 278
 279 } LSA_SECRET_INFO;
 280
 281 /* LSA_SECRET - LSA Secret */
 282 typedef struct lsa_q_secret_info
 283 {
 284         LSA_SECRET_INFO curinfo;
 285         LSA_SECRET_INFO oldinfo;
 286
 287 } LSA_SECRET;
 288
 289 /* LSA_Q_QUERY_SECRET - LSA Query Secret */
 290 typedef struct lsa_q_query_secret_info
 291 {
 292         POLICY_HND pol;
 293
 294         LSA_SECRET sec;
 295
 296 } LSA_Q_QUERY_SECRET;
 297
 298 /* LSA_R_QUERY_SECRET - response to LSA Query Secret */
 299 typedef struct lsa_r_query_secret_info
 300 {
 301         LSA_SECRET sec;
 302
 303         uint32 status;
 304
 305 } LSA_R_QUERY_SECRET;
 306
 307 /* LSA_Q_SET_SECRET - LSA Set Secret */
 308 typedef struct lsa_q_set_secret_info
 309 {
 310         POLICY_HND pol;
 311
 312         LSA_SECRET_VALUE value;
 313         uint32 unknown;
 314
 315 } LSA_Q_SET_SECRET;
 316
 317 /* LSA_R_SET_SECRET - response to LSA Set Secret */
 318 typedef struct lsa_r_set_secret_info
 319 {
 320         uint32 status;
 321
 322 } LSA_R_SET_SECRET;
 323
 324 /* LSA_Q_ENUM_TRUST_DOM - LSA enumerate trusted domains */
 325 typedef struct lsa_enum_trust_dom_info
 326 {
 327         POLICY_HND pol; /* policy handle */
 328         uint32 enum_context; /* enumeration context handle */
 329         uint32 preferred_len; /* preferred maximum length */
 330
 331 } LSA_Q_ENUM_TRUST_DOM;
 332
 333 #define MAX_TRUSTED_DOMS 10
 334
 335 /* LSA_R_ENUM_TRUST_DOM - response to LSA enumerate trusted domains */
 336 typedef struct lsa_r_enum_trust_dom_info
 337 {
 338         uint32 enum_context; /* enumeration context handle */
 339         uint32 num_domains; /* number of domains */
 340         uint32 ptr_enum_domains; /* buffer pointer to num domains */
 341
 342         /* this lot is only added if ptr_enum_domains is non-NULL */
 343         uint32 num_domains2; /* number of domains */
 344         UNIHDR2 *hdr_domain_name;
 345         UNISTR2 *uni_domain_name;
 346         DOM_SID2 *domain_sid;
 347
 348         uint32 status; /* return code */
 349
 350 } LSA_R_ENUM_TRUST_DOM;
 351
 352 /* LSA_Q_CLOSE */
 353 typedef struct lsa_q_close_info
 354 {
 355         POLICY_HND pol; /* policy handle */
 356
 357 } LSA_Q_CLOSE;
 358
 359 /* LSA_R_CLOSE */
 360 typedef struct lsa_r_close_info
 361 {
 362         POLICY_HND pol; /* policy handle.  should be all zeros. */
 363
 364         uint32 status; /* return code */
 365
 366 } LSA_R_CLOSE;
 367
 368
 369 #define MAX_REF_DOMAINS 10
 370
 371 /* DOM_TRUST_HDR */
 372 typedef struct dom_trust_hdr
 373 {
 374         UNIHDR hdr_dom_name; /* referenced domain unicode string headers */
 375         uint32 ptr_dom_sid;
 376
 377 } DOM_TRUST_HDR;
 378
 379 /* DOM_TRUST_INFO */
 380 typedef struct dom_trust_info
 381 {
 382         UNISTR2  uni_dom_name; /* domain name unicode string */
 383         DOM_SID2 ref_dom     ; /* referenced domain SID */
 384
 385 } DOM_TRUST_INFO;
 386
 387 /* DOM_R_REF */
 388 typedef struct dom_ref_info
 389 {
 390         uint32 num_ref_doms_1; /* num referenced domains */
 391         uint32 ptr_ref_dom; /* pointer to referenced domains */
 392         uint32 max_entries; /* 32 - max number of entries */
 393         uint32 num_ref_doms_2; /* num referenced domains */
 394
 395         DOM_TRUST_HDR  hdr_ref_dom[MAX_REF_DOMAINS]; /* referenced domains */
 396         DOM_TRUST_INFO ref_dom    [MAX_REF_DOMAINS]; /* referenced domains */
 397
 398 } DOM_R_REF;
 399
 400 /* the domain_idx points to a SID associated with the name */
 401
 402 /* LSA_TRANS_NAME - translated name */
 403 typedef struct lsa_trans_name_info
 404 {
 405         uint32 sid_name_use; /* value is 5 for a well-known group; 2 for a domain group; 1 for a user... */
 406         UNIHDR hdr_name;
 407         uint32 domain_idx; /* index into DOM_R_REF array of SIDs */
 408
 409 } LSA_TRANS_NAME;
 410
 411 #define MAX_LOOKUP_SIDS 30
 412
 413 /* LSA_TRANS_NAME_ENUM - LSA Translated Name Enumeration container */
 414 typedef struct lsa_trans_name_enum_info
 415 {
 416         uint32 num_entries;
 417         uint32 ptr_trans_names;
 418         uint32 num_entries2;
 419
 420         LSA_TRANS_NAME name    [MAX_LOOKUP_SIDS]; /* translated names  */
 421         UNISTR2        uni_name[MAX_LOOKUP_SIDS];
 422
 423 } LSA_TRANS_NAME_ENUM;
 424
 425 /* LSA_SID_ENUM - LSA SID enumeration container */
 426 typedef struct lsa_sid_enum_info
 427 {
 428         uint32 num_entries;
 429         uint32 ptr_sid_enum;
 430         uint32 num_entries2;
 431
 432         uint32   ptr_sid[MAX_LOOKUP_SIDS]; /* domain SID pointers to be looked up. */
 433         DOM_SID2 sid    [MAX_LOOKUP_SIDS]; /* domain SIDs to be looked up. */
 434
 435 } LSA_SID_ENUM;
 436
 437 /* LSA_Q_LOOKUP_SIDS - LSA Lookup SIDs */
 438 typedef struct lsa_q_lookup_sids
 439 {
 440         POLICY_HND          pol; /* policy handle */
 441         LSA_SID_ENUM        sids;
 442         LSA_TRANS_NAME_ENUM names;
 443         LOOKUP_LEVEL        level;
 444         uint32              mapped_count;
 445
 446 } LSA_Q_LOOKUP_SIDS;
 447
 448 /* LSA_R_LOOKUP_SIDS - response to LSA Lookup SIDs */
 449 typedef struct lsa_r_lookup_sids
 450 {
 451         uint32              ptr_dom_ref;
 452         DOM_R_REF           *dom_ref; /* domain reference info */
 453
 454         LSA_TRANS_NAME_ENUM *names;
 455         uint32              mapped_count;
 456
 457         uint32              status; /* return code */
 458
 459 } LSA_R_LOOKUP_SIDS;
 460
 461
 462 /* LSA_Q_LOOKUP_NAMES - LSA Lookup NAMEs */
 463 typedef struct lsa_q_lookup_names
 464 {
 465     POLICY_HND pol; /* policy handle */
 466     uint32 num_entries;
 467     uint32 num_entries2;
 468     UNIHDR  hdr_name[MAX_LOOKUP_SIDS]; /* name buffer pointers */
 469     UNISTR2 uni_name[MAX_LOOKUP_SIDS]; /* names to be looked up */
 470
 471     uint32 num_trans_entries;
 472     uint32 ptr_trans_sids; /* undocumented domain SID buffer pointer */
 473     uint32 lookup_level;
 474     uint32 mapped_count;
 475
 476 } LSA_Q_LOOKUP_NAMES;
 477
 478 /* LSA_R_LOOKUP_NAMES - response to LSA Lookup NAMEs by name */
 479 typedef struct lsa_r_lookup_names
 480 {
 481         uint32 ptr_dom_ref;
 482         DOM_R_REF *dom_ref; /* domain reference info */
 483
 484         uint32 num_entries;
 485         uint32 ptr_entries;
 486         uint32 num_entries2;
 487         DOM_RID2 *dom_rid; /* domain RIDs being looked up */
 488
 489         uint32 mapped_count;
 490
 491         uint32 status; /* return code */
 492
 493 } LSA_R_LOOKUP_NAMES;
 494
 495
 496 #endif /* _RPC_LSA_H */
 497