nsswitch/winbind_struct_protocol.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon for ntdom nss module
   5
   6    Copyright (C) Tim Potter 2000
   7    Copyright (C) Gerald Carter 2006
   8
   9    You are free to use this interface definition in any way you see
  10    fit, including without restriction, using this header in your own
  11    products. You do not need to give any attribution.
  12 */
  13
  14 #ifndef SAFE_FREE
  15 #define SAFE_FREE(x) do { if(x) {free(x); x=NULL;} } while(0)
  16 #endif
  17
  18 #ifndef FSTRING_LEN
  19 #define FSTRING_LEN 256
  20 typedef char fstring[FSTRING_LEN];
  21 #endif
  22
  23 #ifndef _WINBINDD_NTDOM_H
  24 #define _WINBINDD_NTDOM_H
  25
  26 #define WINBINDD_SOCKET_NAME "pipe"            /* Name of PF_UNIX socket */
  27
  28 /* Let the build environment override the public winbindd socket location. This
  29  * is needed for launchd support -- jpeach.
  30  */
  31 #ifndef WINBINDD_SOCKET_DIR
  32 #define WINBINDD_SOCKET_DIR  "/tmp/.winbindd"  /* Name of PF_UNIX dir */
  33 #endif
  34
  35 /*
  36  * when compiled with socket_wrapper support
  37  * the location of the WINBINDD_SOCKET_DIR
  38  * can be overwritten via an environment variable
  39  */
  40 #define WINBINDD_SOCKET_DIR_ENVVAR "WINBINDD_SOCKET_DIR"
  41
  42 #define WINBINDD_PRIV_SOCKET_SUBDIR "winbindd_privileged" /* name of subdirectory of lp_lockdir() to hold the 'privileged' pipe */
  43 #define WINBINDD_DOMAIN_ENV  "WINBINDD_DOMAIN" /* Environment variables */
  44 #define WINBINDD_DONT_ENV    "_NO_WINBINDD"
  45 #define WINBINDD_LOCATOR_KDC_ADDRESS "WINBINDD_LOCATOR_KDC_ADDRESS"
  46
  47 /* Update this when you change the interface.
  48  * 21: added WINBINDD_GETPWSID
  49  *     added WINBINDD_GETSIDALIASES
  50  */
  51 #define WINBIND_INTERFACE_VERSION 21
  52
  53 /* Have to deal with time_t being 4 or 8 bytes due to structure alignment.
  54    On a 64bit Linux box, we have to support a constant structure size
  55    between /lib/libnss_winbind.so.2 and /li64/libnss_winbind.so.2.
  56    The easiest way to do this is to always use 8byte values for time_t. */
  57
  58 #define SMB_TIME_T int64_t
  59
  60 /* Socket commands */
  61
  62 enum winbindd_cmd {
  63
  64         WINBINDD_INTERFACE_VERSION,    /* Always a well known value */
  65
  66         /* Get users and groups */
  67
  68         WINBINDD_GETPWNAM,
  69         WINBINDD_GETPWUID,
  70         WINBINDD_GETPWSID,
  71         WINBINDD_GETGRNAM,
  72         WINBINDD_GETGRGID,
  73         WINBINDD_GETGROUPS,
  74
  75         /* Enumerate users and groups */
  76
  77         WINBINDD_SETPWENT,
  78         WINBINDD_ENDPWENT,
  79         WINBINDD_GETPWENT,
  80         WINBINDD_SETGRENT,
  81         WINBINDD_ENDGRENT,
  82         WINBINDD_GETGRENT,
  83
  84         /* PAM authenticate and password change */
  85
  86         WINBINDD_PAM_AUTH,
  87         WINBINDD_PAM_AUTH_CRAP,
  88         WINBINDD_PAM_CHAUTHTOK,
  89         WINBINDD_PAM_LOGOFF,
  90         WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP,
  91
  92         /* List various things */
  93
  94         WINBINDD_LIST_USERS,         /* List w/o rid->id mapping */
  95         WINBINDD_LIST_GROUPS,        /* Ditto */
  96         WINBINDD_LIST_TRUSTDOM,
  97
  98         /* SID conversion */
  99
 100         WINBINDD_LOOKUPSID,
 101         WINBINDD_LOOKUPNAME,
 102         WINBINDD_LOOKUPRIDS,
 103
 104         /* Lookup functions */
 105
 106         WINBINDD_SID_TO_UID,
 107         WINBINDD_SID_TO_GID,
 108         WINBINDD_SIDS_TO_XIDS,
 109         WINBINDD_UID_TO_SID,
 110         WINBINDD_GID_TO_SID,
 111
 112         WINBINDD_ALLOCATE_UID,
 113         WINBINDD_ALLOCATE_GID,
 114         WINBINDD_SET_MAPPING,
 115         WINBINDD_REMOVE_MAPPING,
 116         WINBINDD_SET_HWM,
 117
 118         /* Miscellaneous other stuff */
 119
 120         WINBINDD_CHECK_MACHACC,     /* Check machine account pw works */
 121         WINBINDD_PING,              /* Just tell me winbind is running */
 122         WINBINDD_INFO,              /* Various bit of info.  Currently just tidbits */
 123         WINBINDD_DOMAIN_NAME,       /* The domain this winbind server is a member of (lp_workgroup()) */
 124
 125         WINBINDD_DOMAIN_INFO,   /* Most of what we know from
 126                                    struct winbindd_domain */
 127         WINBINDD_GETDCNAME,     /* Issue a GetDCName Request */
 128         WINBINDD_DSGETDCNAME,   /* Issue a DsGetDCName Request */
 129
 130         WINBINDD_SHOW_SEQUENCE, /* display sequence numbers of domains */
 131
 132         /* WINS commands */
 133
 134         WINBINDD_WINS_BYIP,
 135         WINBINDD_WINS_BYNAME,
 136
 137         /* this is like GETGRENT but gives an empty group list */
 138         WINBINDD_GETGRLST,
 139
 140         WINBINDD_NETBIOS_NAME,       /* The netbios name of the server */
 141
 142         /* find the location of our privileged pipe */
 143         WINBINDD_PRIV_PIPE_DIR,
 144
 145         /* return a list of group sids for a user sid */
 146         WINBINDD_GETUSERSIDS,
 147
 148         /* Various group queries */
 149         WINBINDD_GETUSERDOMGROUPS,
 150
 151         /* lookup local groups */
 152         WINBINDD_GETSIDALIASES,
 153
 154         /* Initialize connection in a child */
 155         WINBINDD_INIT_CONNECTION,
 156
 157         /* Blocking calls that are not allowed on the main winbind pipe, only
 158          * between parent and children */
 159         WINBINDD_DUAL_SID2UID,
 160         WINBINDD_DUAL_SID2GID,
 161         WINBINDD_DUAL_SIDS2XIDS,
 162         WINBINDD_DUAL_UID2SID,
 163         WINBINDD_DUAL_GID2SID,
 164         WINBINDD_DUAL_SET_MAPPING,
 165         WINBINDD_DUAL_REMOVE_MAPPING,
 166         WINBINDD_DUAL_SET_HWM,
 167
 168         /* Wrapper around possibly blocking unix nss calls */
 169         WINBINDD_DUAL_USERINFO,
 170         WINBINDD_DUAL_GETSIDALIASES,
 171
 172         /* Complete the challenge phase of the NTLM authentication
 173            protocol using cached password. */
 174         WINBINDD_CCACHE_NTLMAUTH,
 175
 176         WINBINDD_NUM_CMDS
 177 };
 178
 179 typedef struct winbindd_pw {
 180         fstring pw_name;
 181         fstring pw_passwd;
 182         uid_t pw_uid;
 183         gid_t pw_gid;
 184         fstring pw_gecos;
 185         fstring pw_dir;
 186         fstring pw_shell;
 187 } WINBINDD_PW;
 188
 189
 190 typedef struct winbindd_gr {
 191         fstring gr_name;
 192         fstring gr_passwd;
 193         gid_t gr_gid;
 194         uint32_t num_gr_mem;
 195         uint32_t gr_mem_ofs;   /* offset to group membership */
 196 } WINBINDD_GR;
 197
 198 /* PAM specific request flags */
 199 #define WBFLAG_PAM_INFO3_NDR            0x00000001
 200 #define WBFLAG_PAM_INFO3_TEXT           0x00000002
 201 #define WBFLAG_PAM_USER_SESSION_KEY     0x00000004
 202 #define WBFLAG_PAM_LMKEY                0x00000008
 203 #define WBFLAG_PAM_CONTACT_TRUSTDOM     0x00000010
 204 #define WBFLAG_PAM_UNIX_NAME            0x00000080
 205 #define WBFLAG_PAM_AFS_TOKEN            0x00000100
 206 #define WBFLAG_PAM_NT_STATUS_SQUASH     0x00000200
 207 #define WBFLAG_PAM_KRB5                 0x00001000
 208 #define WBFLAG_PAM_FALLBACK_AFTER_KRB5  0x00002000
 209 #define WBFLAG_PAM_CACHED_LOGIN         0x00004000
 210 #define WBFLAG_PAM_GET_PWD_POLICY       0x00008000
 211
 212 /* generic request flags */
 213 #define WBFLAG_QUERY_ONLY               0x00000020      /* not used */
 214 /* This is a flag that can only be sent from parent to child */
 215 #define WBFLAG_IS_PRIVILEGED            0x00000400      /* not used */
 216 /* Flag to say this is a winbindd internal send - don't recurse. */
 217 #define WBFLAG_RECURSE                  0x00000800
 218 /* Flag to tell winbind the NTLMv2 blob is too big for the struct and is in the
 219  * extra_data field */
 220 #define WBFLAG_BIG_NTLMV2_BLOB          0x00010000
 221
 222 #define WINBINDD_MAX_EXTRA_DATA (128*1024)
 223
 224 /* Winbind request structure */
 225
 226 /*******************************************************************************
 227  * This structure MUST be the same size in the 32bit and 64bit builds
 228  * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so
 229  *
 230  * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST
 231  * A 64BIT WINBINDD    --jerry
 232  ******************************************************************************/
 233
 234 struct winbindd_request {
 235         uint32_t length;
 236         enum winbindd_cmd cmd;   /* Winbindd command to execute */
 237         enum winbindd_cmd original_cmd;   /* Original Winbindd command
 238                                              issued to parent process */
 239         pid_t pid;               /* pid of calling process */
 240         uint32_t wb_flags;       /* generic flags */
 241         uint32_t flags;          /* flags relevant *only* to a given request */
 242         fstring domain_name;    /* name of domain for which the request applies */
 243
 244         union {
 245                 fstring winsreq;     /* WINS request */
 246                 fstring username;    /* getpwnam */
 247                 fstring groupname;   /* getgrnam */
 248                 uid_t uid;           /* getpwuid, uid_to_sid */
 249                 gid_t gid;           /* getgrgid, gid_to_sid */
 250                 struct {
 251                         /* We deliberatedly don't split into domain/user to
 252                            avoid having the client know what the separator
 253                            character is. */
 254                         fstring user;
 255                         fstring pass;
 256                         char require_membership_of_sid[1024];
 257                         fstring krb5_cc_type;
 258                         uid_t uid;
 259                 } auth;              /* pam_winbind auth module */
 260                 struct {
 261                         uint8_t chal[8];
 262                         uint32_t logon_parameters;
 263                         fstring user;
 264                         fstring domain;
 265                         fstring lm_resp;
 266                         uint32_t lm_resp_len;
 267                         fstring nt_resp;
 268                         uint32_t nt_resp_len;
 269                         fstring workstation;
 270                         fstring require_membership_of_sid;
 271                 } auth_crap;
 272                 struct {
 273                     fstring user;
 274                     fstring oldpass;
 275                     fstring newpass;
 276                 } chauthtok;         /* pam_winbind passwd module */
 277                 struct {
 278                         fstring user;
 279                         fstring domain;
 280                         uint8_t new_nt_pswd[516];
 281                         uint16_t new_nt_pswd_len;
 282                         uint8_t old_nt_hash_enc[16];
 283                         uint16_t old_nt_hash_enc_len;
 284                         uint8_t new_lm_pswd[516];
 285                         uint16_t new_lm_pswd_len;
 286                         uint8_t old_lm_hash_enc[16];
 287                         uint16_t old_lm_hash_enc_len;
 288                 } chng_pswd_auth_crap;/* pam_winbind passwd module */
 289                 struct {
 290                         fstring user;
 291                         fstring krb5ccname;
 292                         uid_t uid;
 293                 } logoff;              /* pam_winbind session module */
 294                 fstring sid;         /* lookupsid, sid_to_[ug]id */
 295                 struct {
 296                         fstring dom_name;       /* lookupname */
 297                         fstring name;
 298                 } name;
 299                 uint32_t num_entries;  /* getpwent, getgrent */
 300                 struct {
 301                         fstring username;
 302                         fstring groupname;
 303                 } acct_mgt;
 304                 struct {
 305                         bool is_primary;
 306                         fstring dcname;
 307                 } init_conn;
 308                 struct {
 309                         fstring sid;
 310                         fstring name;
 311                 } dual_sid2id;
 312                 struct {
 313                         fstring sid;
 314                         uint32_t type;
 315                         uint32_t id;
 316                 } dual_idmapset;
 317                 bool list_all_domains;
 318
 319                 struct {
 320                         uid_t uid;
 321                         fstring user;
 322                         /* the effective uid of the client, must be the uid for 'user'.
 323                            This is checked by the main daemon, trusted by children. */
 324                         /* if the blobs are length zero, then this doesn't
 325                            produce an actual challenge response. It merely
 326                            succeeds if there are cached credentials available
 327                            that could be used. */
 328                         uint32_t initial_blob_len; /* blobs in extra_data */
 329                         uint32_t challenge_blob_len;
 330                 } ccache_ntlm_auth;
 331                 struct {
 332                         fstring domain_name;
 333                         fstring domain_guid;
 334                         fstring site_name;
 335                         uint32_t flags;
 336                 } dsgetdcname;
 337
 338                 /* padding -- needed to fix alignment between 32bit and 64bit libs.
 339                    The size is the sizeof the union without the padding aligned on
 340                    an 8 byte boundary.   --jerry */
 341
 342                 char padding[1800];
 343         } data;
 344         union {
 345                 SMB_TIME_T padding;
 346                 char *data;
 347         } extra_data;
 348         uint32_t extra_len;
 349         char null_term;
 350 };
 351
 352 /* Response values */
 353
 354 enum winbindd_result {
 355         WINBINDD_ERROR,
 356         WINBINDD_PENDING,
 357         WINBINDD_OK
 358 };
 359
 360 /* Winbind response structure */
 361
 362 /*******************************************************************************
 363  * This structure MUST be the same size in the 32bit and 64bit builds
 364  * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so
 365  *
 366  * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST
 367  * A 64BIT WINBINDD    --jerry
 368  ******************************************************************************/
 369
 370 struct winbindd_response {
 371
 372         /* Header information */
 373
 374         uint32_t length;                      /* Length of response */
 375         enum winbindd_result result;          /* Result code */
 376
 377         /* Fixed length return data */
 378
 379         union {
 380                 int interface_version;  /* Try to ensure this is always in the same spot... */
 381
 382                 fstring winsresp;               /* WINS response */
 383
 384                 /* getpwnam, getpwuid */
 385
 386                 struct winbindd_pw pw;
 387
 388                 /* getgrnam, getgrgid */
 389
 390                 struct winbindd_gr gr;
 391
 392                 uint32_t num_entries; /* getpwent, getgrent */
 393                 struct winbindd_sid {
 394                         fstring sid;        /* lookupname, [ug]id_to_sid */
 395                         int type;
 396                 } sid;
 397                 struct winbindd_name {
 398                         fstring dom_name;       /* lookupsid */
 399                         fstring name;
 400                         int type;
 401                 } name;
 402                 uid_t uid;          /* sid_to_uid */
 403                 gid_t gid;          /* sid_to_gid */
 404                 struct winbindd_info {
 405                         char winbind_separator;
 406                         fstring samba_version;
 407                 } info;
 408                 fstring domain_name;
 409                 fstring netbios_name;
 410                 fstring dc_name;
 411
 412                 struct auth_reply {
 413                         uint32_t nt_status;
 414                         fstring nt_status_string;
 415                         fstring error_string;
 416                         int pam_error;
 417                         char user_session_key[16];
 418                         char first_8_lm_hash[8];
 419                         fstring krb5ccname;
 420                         uint32_t reject_reason;
 421                         uint32_t padding;
 422                         struct policy_settings {
 423                                 uint32_t min_length_password;
 424                                 uint32_t password_history;
 425                                 uint32_t password_properties;
 426                                 uint32_t padding;
 427                                 SMB_TIME_T expire;
 428                                 SMB_TIME_T min_passwordage;
 429                         } policy;
 430                         struct info3_text {
 431                                 SMB_TIME_T logon_time;
 432                                 SMB_TIME_T logoff_time;
 433                                 SMB_TIME_T kickoff_time;
 434                                 SMB_TIME_T pass_last_set_time;
 435                                 SMB_TIME_T pass_can_change_time;
 436                                 SMB_TIME_T pass_must_change_time;
 437                                 uint32_t logon_count;
 438                                 uint32_t bad_pw_count;
 439                                 uint32_t user_rid;
 440                                 uint32_t group_rid;
 441                                 uint32_t num_groups;
 442                                 uint32_t user_flgs;
 443                                 uint32_t acct_flags;
 444                                 uint32_t num_other_sids;
 445                                 fstring dom_sid;
 446                                 fstring user_name;
 447                                 fstring full_name;
 448                                 fstring logon_script;
 449                                 fstring profile_path;
 450                                 fstring home_dir;
 451                                 fstring dir_drive;
 452                                 fstring logon_srv;
 453                                 fstring logon_dom;
 454                         } info3;
 455                         fstring unix_username;
 456                 } auth;
 457                 struct {
 458                         fstring name;
 459                         fstring alt_name;
 460                         fstring sid;
 461                         bool native_mode;
 462                         bool active_directory;
 463                         bool primary;
 464                 } domain_info;
 465                 uint32_t sequence_number;
 466                 struct {
 467                         fstring acct_name;
 468                         fstring full_name;
 469                         fstring homedir;
 470                         fstring shell;
 471                         uint32_t primary_gid;
 472                         uint32_t group_rid;
 473                 } user_info;
 474                 struct {
 475                         uint32_t auth_blob_len; /* blob in extra_data */
 476                 } ccache_ntlm_auth;
 477                 struct {
 478                         fstring dc_unc;
 479                         fstring dc_address;
 480                         uint32_t dc_address_type;
 481                         fstring domain_guid;
 482                         fstring domain_name;
 483                         fstring forest_name;
 484                         uint32_t dc_flags;
 485                         fstring dc_site_name;
 486                         fstring client_site_name;
 487                 } dsgetdcname;
 488         } data;
 489
 490         /* Variable length return data */
 491
 492         union {
 493                 SMB_TIME_T padding;
 494                 void *data;
 495         } extra_data;
 496 };
 497
 498 #endif