1/* 2 Unix SMB/CIFS implementation. 3 4 Winbind daemon for ntdom nss module 5 6 Copyright (C) Tim Potter 2000 7 Copyright (C) Gerald Carter 2006 8 9 You are free to use this interface definition in any way you see 10 fit, including without restriction, using this header in your own 11 products. You do not need to give any attribution. 12*/ 13 14 15#ifndef CONST_DISCARD 16#define CONST_DISCARD(type, ptr) ((type) ((void *) (ptr))) 17#endif 18 19#ifndef CONST_ADD 20#define CONST_ADD(type, ptr) ((type) ((const void *) (ptr))) 21#endif 22 23#ifndef SAFE_FREE 24#define SAFE_FREE(x) do { if(x) {free(x); x=NULL;} } while(0) 25#endif 26 27#ifndef _WINBINDD_NTDOM_H 28#define _WINBINDD_NTDOM_H 29 30#define WINBINDD_SOCKET_NAME "pipe" /* Name of PF_UNIX socket */ 31#define WINBINDD_SOCKET_DIR "/tmp/.winbindd" /* Name of PF_UNIX dir */ 32#define WINBINDD_PRIV_SOCKET_SUBDIR "winbindd_privileged" /* name of subdirectory of lp_lockdir() to hold the 'privileged' pipe */ 33#define WINBINDD_DOMAIN_ENV "WINBINDD_DOMAIN" /* Environment variables */ 34#define WINBINDD_DONT_ENV "_NO_WINBINDD" 35 36/* Update this when you change the interface. */ 37 38#define WINBIND_INTERFACE_VERSION 18 39 40/* Have to deal with time_t being 4 or 8 bytes due to structure alignment. 41 On a 64bit Linux box, we have to support a constant structure size 42 between /lib/libnss_winbind.so.2 and /li64/libnss_winbind.so.2. 43 The easiest way to do this is to always use 8byte values for time_t. */ 44 45#if defined(int64) 46# define SMB_TIME_T int64 47#else 48# define SMB_TIME_T time_t 49#endif 50 51/* Socket commands */ 52 53enum winbindd_cmd { 54 55 WINBINDD_INTERFACE_VERSION, /* Always a well known value */ 56 57 /* Get users and groups */ 58 59 WINBINDD_GETPWNAM, 60 WINBINDD_GETPWUID, 61 WINBINDD_GETGRNAM, 62 WINBINDD_GETGRGID, 63 WINBINDD_GETGROUPS, 64 65 /* Enumerate users and groups */ 66 67 WINBINDD_SETPWENT, 68 WINBINDD_ENDPWENT, 69 WINBINDD_GETPWENT, 70 WINBINDD_SETGRENT, 71 WINBINDD_ENDGRENT, 72 WINBINDD_GETGRENT, 73 74 /* PAM authenticate and password change */ 75 76 WINBINDD_PAM_AUTH, 77 WINBINDD_PAM_AUTH_CRAP, 78 WINBINDD_PAM_CHAUTHTOK, 79 WINBINDD_PAM_LOGOFF, 80 WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, 81 82 /* List various things */ 83 84 WINBINDD_LIST_USERS, /* List w/o rid->id mapping */ 85 WINBINDD_LIST_GROUPS, /* Ditto */ 86 WINBINDD_LIST_TRUSTDOM, 87 88 /* SID conversion */ 89 90 WINBINDD_LOOKUPSID, 91 WINBINDD_LOOKUPNAME, 92 WINBINDD_LOOKUPRIDS, 93 94 /* Lookup functions */ 95 96 WINBINDD_SID_TO_UID, 97 WINBINDD_SID_TO_GID, 98 WINBINDD_SIDS_TO_XIDS, 99 WINBINDD_UID_TO_SID, 100 WINBINDD_GID_TO_SID, 101 102 WINBINDD_ALLOCATE_UID, 103 WINBINDD_ALLOCATE_GID, 104 WINBINDD_SET_MAPPING, 105 WINBINDD_SET_HWM, 106 107 /* Miscellaneous other stuff */ 108 109 WINBINDD_DUMP_MAPS, 110 111 WINBINDD_CHECK_MACHACC, /* Check machine account pw works */ 112 WINBINDD_PING, /* Just tell me winbind is running */ 113 WINBINDD_INFO, /* Various bit of info. Currently just tidbits */ 114 WINBINDD_DOMAIN_NAME, /* The domain this winbind server is a member of (lp_workgroup()) */ 115 116 WINBINDD_DOMAIN_INFO, /* Most of what we know from 117 struct winbindd_domain */ 118 WINBINDD_GETDCNAME, /* Issue a GetDCName Request */ 119 120 WINBINDD_SHOW_SEQUENCE, /* display sequence numbers of domains */ 121 122 /* WINS commands */ 123 124 WINBINDD_WINS_BYIP, 125 WINBINDD_WINS_BYNAME, 126 127 /* this is like GETGRENT but gives an empty group list */ 128 WINBINDD_GETGRLST, 129 130 WINBINDD_NETBIOS_NAME, /* The netbios name of the server */ 131 132 /* find the location of our privileged pipe */ 133 WINBINDD_PRIV_PIPE_DIR, 134 135 /* return a list of group sids for a user sid */ 136 WINBINDD_GETUSERSIDS, 137 138 /* Various group queries */ 139 WINBINDD_GETUSERDOMGROUPS, 140 141 /* Initialize connection in a child */ 142 WINBINDD_INIT_CONNECTION, 143 144 /* Blocking calls that are not allowed on the main winbind pipe, only 145 * between parent and children */ 146 WINBINDD_DUAL_SID2UID, 147 WINBINDD_DUAL_SID2GID, 148 WINBINDD_DUAL_SIDS2XIDS, 149 WINBINDD_DUAL_UID2SID, 150 WINBINDD_DUAL_GID2SID, 151 WINBINDD_DUAL_SET_MAPPING, 152 WINBINDD_DUAL_SET_HWM, 153 WINBINDD_DUAL_DUMP_MAPS, 154 155 /* Wrapper around possibly blocking unix nss calls */ 156 WINBINDD_DUAL_UID2NAME, 157 WINBINDD_DUAL_NAME2UID, 158 WINBINDD_DUAL_GID2NAME, 159 WINBINDD_DUAL_NAME2GID, 160 161 WINBINDD_DUAL_USERINFO, 162 WINBINDD_DUAL_GETSIDALIASES, 163 164 /* Complete the challenge phase of the NTLM authentication 165 protocol using cached password. */ 166 WINBINDD_CCACHE_NTLMAUTH, 167 168 WINBINDD_NUM_CMDS 169}; 170 171typedef struct winbindd_pw { 172 fstring pw_name; 173 fstring pw_passwd; 174 uid_t pw_uid; 175 gid_t pw_gid; 176 fstring pw_gecos; 177 fstring pw_dir; 178 fstring pw_shell; 179} WINBINDD_PW; 180 181 182typedef struct winbindd_gr { 183 fstring gr_name; 184 fstring gr_passwd; 185 gid_t gr_gid; 186 uint32 num_gr_mem; 187 uint32 gr_mem_ofs; /* offset to group membership */ 188} WINBINDD_GR; 189 190 191#define WBFLAG_PAM_INFO3_NDR 0x0001 192#define WBFLAG_PAM_INFO3_TEXT 0x0002 193#define WBFLAG_PAM_USER_SESSION_KEY 0x0004 194#define WBFLAG_PAM_LMKEY 0x0008 195#define WBFLAG_PAM_CONTACT_TRUSTDOM 0x0010 196#define WBFLAG_QUERY_ONLY 0x0020 197#define WBFLAG_PAM_UNIX_NAME 0x0080 198#define WBFLAG_PAM_AFS_TOKEN 0x0100 199#define WBFLAG_PAM_NT_STATUS_SQUASH 0x0200 200 201/* This is a flag that can only be sent from parent to child */ 202#define WBFLAG_IS_PRIVILEGED 0x0400 203/* Flag to say this is a winbindd internal send - don't recurse. */ 204#define WBFLAG_RECURSE 0x0800 205 206#define WBFLAG_PAM_KRB5 0x1000 207#define WBFLAG_PAM_FALLBACK_AFTER_KRB5 0x2000 208#define WBFLAG_PAM_CACHED_LOGIN 0x4000 209#define WBFLAG_PAM_GET_PWD_POLICY 0x8000 /* not used */ 210 211#define WINBINDD_MAX_EXTRA_DATA (128*1024) 212 213/* Winbind request structure */ 214 215/******************************************************************************* 216 * This structure MUST be the same size in the 32bit and 64bit builds 217 * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so 218 * 219 * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST 220 * A 64BIT WINBINDD --jerry 221 ******************************************************************************/ 222 223struct winbindd_request { 224 uint32 length; 225 enum winbindd_cmd cmd; /* Winbindd command to execute */ 226 pid_t pid; /* pid of calling process */ 227 uint32 flags; /* flags relavant to a given request */ 228 fstring domain_name; /* name of domain for which the request applies */ 229 230 union { 231 fstring winsreq; /* WINS request */ 232 fstring username; /* getpwnam */ 233 fstring groupname; /* getgrnam */ 234 uid_t uid; /* getpwuid, uid_to_sid */ 235 gid_t gid; /* getgrgid, gid_to_sid */ 236 struct { 237 /* We deliberatedly don't split into domain/user to 238 avoid having the client know what the separator 239 character is. */ 240 fstring user; 241 fstring pass; 242 pstring require_membership_of_sid; 243 fstring krb5_cc_type; 244 uid_t uid; 245 } auth; /* pam_winbind auth module */ 246 struct { 247 unsigned char chal[8]; 248 uint32 logon_parameters; 249 fstring user; 250 fstring domain; 251 fstring lm_resp; 252 uint32 lm_resp_len; 253 fstring nt_resp; 254 uint32 nt_resp_len; 255 fstring workstation; 256 fstring require_membership_of_sid; 257 } auth_crap; 258 struct { 259 fstring user; 260 fstring oldpass; 261 fstring newpass; 262 } chauthtok; /* pam_winbind passwd module */ 263 struct { 264 fstring user; 265 fstring domain; 266 unsigned char new_nt_pswd[516]; 267 uint16 new_nt_pswd_len; 268 unsigned char old_nt_hash_enc[16]; 269 uint16 old_nt_hash_enc_len; 270 unsigned char new_lm_pswd[516]; 271 uint16 new_lm_pswd_len; 272 unsigned char old_lm_hash_enc[16]; 273 uint16 old_lm_hash_enc_len; 274 } chng_pswd_auth_crap;/* pam_winbind passwd module */ 275 struct { 276 fstring user; 277 fstring krb5ccname; 278 uid_t uid; 279 } logoff; /* pam_winbind session module */ 280 fstring sid; /* lookupsid, sid_to_[ug]id */ 281 struct { 282 fstring dom_name; /* lookupname */ 283 fstring name; 284 } name; 285 uint32 num_entries; /* getpwent, getgrent */ 286 struct { 287 fstring username; 288 fstring groupname; 289 } acct_mgt; 290 struct { 291 BOOL is_primary; 292 fstring dcname; 293 } init_conn; 294 struct { 295 fstring sid; 296 fstring name; 297 } dual_sid2id; 298 struct { 299 fstring sid; 300 uint32 type; 301 uint32 id; 302 } dual_idmapset; 303 BOOL list_all_domains; 304 305 struct { 306 uid_t uid; 307 fstring user; 308 /* the effective uid of the client, must be the uid for 'user'. 309 This is checked by the main daemon, trusted by children. */ 310 /* if the blobs are length zero, then this doesn't 311 produce an actual challenge response. It merely 312 succeeds if there are cached credentials available 313 that could be used. */ 314 uint32 initial_blob_len; /* blobs in extra_data */ 315 uint32 challenge_blob_len; 316 } ccache_ntlm_auth; 317 318 /* padding -- needed to fix alignment between 32bit and 64bit libs. 319 The size is the sizeof the union without the padding aligned on 320 an 8 byte boundary. --jerry */ 321 322 char padding[1560]; 323 } data; 324 union { 325 SMB_TIME_T padding; 326 char *data; 327 } extra_data; 328 uint32 extra_len; 329 char null_term; 330}; 331 332/* Response values */ 333 334enum winbindd_result { 335 WINBINDD_ERROR, 336 WINBINDD_PENDING, 337 WINBINDD_OK 338}; 339 340/* Winbind response structure */ 341 342/******************************************************************************* 343 * This structure MUST be the same size in the 32bit and 64bit builds 344 * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so 345 * 346 * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST 347 * A 64BIT WINBINDD --jerry 348 ******************************************************************************/ 349 350struct winbindd_response { 351 352 /* Header information */ 353 354 uint32 length; /* Length of response */ 355 enum winbindd_result result; /* Result code */ 356 357 /* Fixed length return data */ 358 359 union { 360 int interface_version; /* Try to ensure this is always in the same spot... */ 361 362 fstring winsresp; /* WINS response */ 363 364 /* getpwnam, getpwuid */ 365 366 struct winbindd_pw pw; 367 368 /* getgrnam, getgrgid */ 369 370 struct winbindd_gr gr; 371 372 uint32 num_entries; /* getpwent, getgrent */ 373 struct winbindd_sid { 374 fstring sid; /* lookupname, [ug]id_to_sid */ 375 int type; 376 } sid; 377 struct winbindd_name { 378 fstring dom_name; /* lookupsid */ 379 fstring name; 380 int type; 381 } name; 382 uid_t uid; /* sid_to_uid */ 383 gid_t gid; /* sid_to_gid */ 384 struct winbindd_info { 385 char winbind_separator; 386 fstring samba_version; 387 } info; 388 fstring domain_name; 389 fstring netbios_name; 390 fstring dc_name; 391 392 struct auth_reply { 393 uint32 nt_status; 394 fstring nt_status_string; 395 fstring error_string; 396 int pam_error; 397 char user_session_key[16]; 398 char first_8_lm_hash[8]; 399 fstring krb5ccname; 400 uint32 reject_reason; 401 uint32 padding; 402 struct policy_settings { 403 uint32 min_length_password; 404 uint32 password_history; 405 uint32 password_properties; 406 uint32 padding; 407 SMB_TIME_T expire; 408 SMB_TIME_T min_passwordage; 409 } policy; 410 struct info3_text { 411 SMB_TIME_T logon_time; 412 SMB_TIME_T logoff_time; 413 SMB_TIME_T kickoff_time; 414 SMB_TIME_T pass_last_set_time; 415 SMB_TIME_T pass_can_change_time; 416 SMB_TIME_T pass_must_change_time; 417 uint32 logon_count; 418 uint32 bad_pw_count; 419 uint32 user_rid; 420 uint32 group_rid; 421 uint32 num_groups; 422 uint32 user_flgs; 423 uint32 acct_flags; 424 uint32 num_other_sids; 425 fstring dom_sid; 426 fstring user_name; 427 fstring full_name; 428 fstring logon_script; 429 fstring profile_path; 430 fstring home_dir; 431 fstring dir_drive; 432 fstring logon_srv; 433 fstring logon_dom; 434 } info3; 435 } auth; 436 struct { 437 fstring name; 438 fstring alt_name; 439 fstring sid; 440 BOOL native_mode; 441 BOOL active_directory; 442 BOOL primary; 443 uint32 sequence_number; 444 } domain_info; 445 struct { 446 fstring acct_name; 447 fstring full_name; 448 fstring homedir; 449 fstring shell; 450 uint32 primary_gid; 451 uint32 group_rid; 452 } user_info; 453 struct { 454 uint32 auth_blob_len; /* blob in extra_data */ 455 } ccache_ntlm_auth; 456 } data; 457 458 /* Variable length return data */ 459 460 union { 461 SMB_TIME_T padding; 462 void *data; 463 } extra_data; 464}; 465 466struct WINBINDD_MEMORY_CREDS { 467 struct WINBINDD_MEMORY_CREDS *next, *prev; 468 const char *username; /* lookup key. */ 469 uid_t uid; 470 int ref_count; 471 size_t len; 472 unsigned char *nt_hash; /* Base pointer for the following 2 */ 473 unsigned char *lm_hash; 474 char *pass; 475}; 476 477struct WINBINDD_CCACHE_ENTRY { 478 struct WINBINDD_CCACHE_ENTRY *next, *prev; 479 const char *principal_name; 480 const char *ccname; 481 const char *service; 482 const char *username; 483 const char *realm; 484 struct WINBINDD_MEMORY_CREDS *cred_ptr; 485 int ref_count; 486 uid_t uid; 487 time_t create_time; 488 time_t renew_until; 489 time_t refresh_time; 490 struct timed_event *event; 491}; 492 493#endif 494