1/* 2 Unix SMB/CIFS implementation. 3 4 Winbind daemon for ntdom nss module 5 6 Copyright (C) Tim Potter 2000 7 Copyright (C) Gerald Carter 2006 8 9 You are free to use this interface definition in any way you see 10 fit, including without restriction, using this header in your own 11 products. You do not need to give any attribution. 12*/ 13 14#ifndef SAFE_FREE 15#define SAFE_FREE(x) do { if(x) {free(x); x=NULL;} } while(0) 16#endif 17 18#ifndef FSTRING_LEN 19#define FSTRING_LEN 256 20typedef char fstring[FSTRING_LEN]; 21#endif 22 23#ifndef _WINBINDD_NTDOM_H 24#define _WINBINDD_NTDOM_H 25 26#define WINBINDD_SOCKET_NAME "pipe" /* Name of PF_UNIX socket */ 27 28/* Let the build environment override the public winbindd socket location. This 29 * is needed for launchd support -- jpeach. 30 */ 31#ifndef WINBINDD_SOCKET_DIR 32#define WINBINDD_SOCKET_DIR "/tmp/.winbindd" /* Name of PF_UNIX dir */ 33#endif 34 35/* 36 * when compiled with socket_wrapper support 37 * the location of the WINBINDD_SOCKET_DIR 38 * can be overwritten via an environment variable 39 */ 40#define WINBINDD_SOCKET_DIR_ENVVAR "WINBINDD_SOCKET_DIR" 41 42#define WINBINDD_PRIV_SOCKET_SUBDIR "winbindd_privileged" /* name of subdirectory of lp_lockdir() to hold the 'privileged' pipe */ 43#define WINBINDD_DOMAIN_ENV "WINBINDD_DOMAIN" /* Environment variables */ 44#define WINBINDD_DONT_ENV "_NO_WINBINDD" 45#define WINBINDD_LOCATOR_KDC_ADDRESS "WINBINDD_LOCATOR_KDC_ADDRESS" 46 47/* Update this when you change the interface. 48 * 21: added WINBINDD_GETPWSID 49 * added WINBINDD_GETSIDALIASES 50 * 22: added WINBINDD_PING_DC 51 * 23: added session_key to ccache_ntlm_auth response 52 * added WINBINDD_CCACHE_SAVE 53 */ 54#define WINBIND_INTERFACE_VERSION 23 55 56/* Have to deal with time_t being 4 or 8 bytes due to structure alignment. 57 On a 64bit Linux box, we have to support a constant structure size 58 between /lib/libnss_winbind.so.2 and /li64/libnss_winbind.so.2. 59 The easiest way to do this is to always use 8byte values for time_t. */ 60 61#define SMB_TIME_T int64_t 62 63/* Socket commands */ 64 65enum winbindd_cmd { 66 67 WINBINDD_INTERFACE_VERSION, /* Always a well known value */ 68 69 /* Get users and groups */ 70 71 WINBINDD_GETPWNAM, 72 WINBINDD_GETPWUID, 73 WINBINDD_GETPWSID, 74 WINBINDD_GETGRNAM, 75 WINBINDD_GETGRGID, 76 WINBINDD_GETGROUPS, 77 78 /* Enumerate users and groups */ 79 80 WINBINDD_SETPWENT, 81 WINBINDD_ENDPWENT, 82 WINBINDD_GETPWENT, 83 WINBINDD_SETGRENT, 84 WINBINDD_ENDGRENT, 85 WINBINDD_GETGRENT, 86 87 /* PAM authenticate and password change */ 88 89 WINBINDD_PAM_AUTH, 90 WINBINDD_PAM_AUTH_CRAP, 91 WINBINDD_PAM_CHAUTHTOK, 92 WINBINDD_PAM_LOGOFF, 93 WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP, 94 95 /* List various things */ 96 97 WINBINDD_LIST_USERS, /* List w/o rid->id mapping */ 98 WINBINDD_LIST_GROUPS, /* Ditto */ 99 WINBINDD_LIST_TRUSTDOM, 100 101 /* SID conversion */ 102 103 WINBINDD_LOOKUPSID, 104 WINBINDD_LOOKUPNAME, 105 WINBINDD_LOOKUPRIDS, 106 107 /* Lookup functions */ 108 109 WINBINDD_SID_TO_UID, 110 WINBINDD_SID_TO_GID, 111 WINBINDD_SIDS_TO_XIDS, 112 WINBINDD_UID_TO_SID, 113 WINBINDD_GID_TO_SID, 114 115 WINBINDD_ALLOCATE_UID, 116 WINBINDD_ALLOCATE_GID, 117 WINBINDD_SET_MAPPING, 118 WINBINDD_REMOVE_MAPPING, 119 WINBINDD_SET_HWM, 120 121 /* Miscellaneous other stuff */ 122 123 WINBINDD_CHECK_MACHACC, /* Check machine account pw works */ 124 WINBINDD_CHANGE_MACHACC, /* Change machine account pw */ 125 WINBINDD_PING_DC, /* Ping the DC through NETLOGON */ 126 WINBINDD_PING, /* Just tell me winbind is running */ 127 WINBINDD_INFO, /* Various bit of info. Currently just tidbits */ 128 WINBINDD_DOMAIN_NAME, /* The domain this winbind server is a member of (lp_workgroup()) */ 129 130 WINBINDD_DOMAIN_INFO, /* Most of what we know from 131 struct winbindd_domain */ 132 WINBINDD_GETDCNAME, /* Issue a GetDCName Request */ 133 WINBINDD_DSGETDCNAME, /* Issue a DsGetDCName Request */ 134 135 WINBINDD_SHOW_SEQUENCE, /* display sequence numbers of domains */ 136 137 /* WINS commands */ 138 139 WINBINDD_WINS_BYIP, 140 WINBINDD_WINS_BYNAME, 141 142 /* this is like GETGRENT but gives an empty group list */ 143 WINBINDD_GETGRLST, 144 145 WINBINDD_NETBIOS_NAME, /* The netbios name of the server */ 146 147 /* find the location of our privileged pipe */ 148 WINBINDD_PRIV_PIPE_DIR, 149 150 /* return a list of group sids for a user sid */ 151 WINBINDD_GETUSERSIDS, 152 153 /* Various group queries */ 154 WINBINDD_GETUSERDOMGROUPS, 155 156 /* lookup local groups */ 157 WINBINDD_GETSIDALIASES, 158 159 /* Initialize connection in a child */ 160 WINBINDD_INIT_CONNECTION, 161 162 /* Blocking calls that are not allowed on the main winbind pipe, only 163 * between parent and children */ 164 WINBINDD_DUAL_SID2UID, 165 WINBINDD_DUAL_SID2GID, 166 WINBINDD_DUAL_SIDS2XIDS, 167 WINBINDD_DUAL_UID2SID, 168 WINBINDD_DUAL_GID2SID, 169 WINBINDD_DUAL_SET_MAPPING, 170 WINBINDD_DUAL_REMOVE_MAPPING, 171 WINBINDD_DUAL_SET_HWM, 172 173 /* Wrapper around possibly blocking unix nss calls */ 174 WINBINDD_DUAL_USERINFO, 175 WINBINDD_DUAL_GETSIDALIASES, 176 177 WINBINDD_DUAL_NDRCMD, 178 179 /* Complete the challenge phase of the NTLM authentication 180 protocol using cached password. */ 181 WINBINDD_CCACHE_NTLMAUTH, 182 WINBINDD_CCACHE_SAVE, 183 184 WINBINDD_NUM_CMDS 185}; 186 187typedef struct winbindd_pw { 188 fstring pw_name; 189 fstring pw_passwd; 190 uid_t pw_uid; 191 gid_t pw_gid; 192 fstring pw_gecos; 193 fstring pw_dir; 194 fstring pw_shell; 195} WINBINDD_PW; 196 197 198typedef struct winbindd_gr { 199 fstring gr_name; 200 fstring gr_passwd; 201 gid_t gr_gid; 202 uint32_t num_gr_mem; 203 uint32_t gr_mem_ofs; /* offset to group membership */ 204} WINBINDD_GR; 205 206/* PAM specific request flags */ 207#define WBFLAG_PAM_INFO3_NDR 0x00000001 208#define WBFLAG_PAM_INFO3_TEXT 0x00000002 209#define WBFLAG_PAM_USER_SESSION_KEY 0x00000004 210#define WBFLAG_PAM_LMKEY 0x00000008 211#define WBFLAG_PAM_CONTACT_TRUSTDOM 0x00000010 212#define WBFLAG_PAM_UNIX_NAME 0x00000080 213#define WBFLAG_PAM_AFS_TOKEN 0x00000100 214#define WBFLAG_PAM_NT_STATUS_SQUASH 0x00000200 215#define WBFLAG_PAM_KRB5 0x00001000 216#define WBFLAG_PAM_FALLBACK_AFTER_KRB5 0x00002000 217#define WBFLAG_PAM_CACHED_LOGIN 0x00004000 218#define WBFLAG_PAM_GET_PWD_POLICY 0x00008000 219 220/* generic request flags */ 221#define WBFLAG_QUERY_ONLY 0x00000020 /* not used */ 222/* This is a flag that can only be sent from parent to child */ 223#define WBFLAG_IS_PRIVILEGED 0x00000400 /* not used */ 224/* Flag to say this is a winbindd internal send - don't recurse. */ 225#define WBFLAG_RECURSE 0x00000800 226/* Flag to tell winbind the NTLMv2 blob is too big for the struct and is in the 227 * extra_data field */ 228#define WBFLAG_BIG_NTLMV2_BLOB 0x00010000 229 230#define WINBINDD_MAX_EXTRA_DATA (128*1024) 231 232/* Winbind request structure */ 233 234/******************************************************************************* 235 * This structure MUST be the same size in the 32bit and 64bit builds 236 * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so 237 * 238 * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST 239 * A 64BIT WINBINDD --jerry 240 ******************************************************************************/ 241 242struct winbindd_request { 243 uint32_t length; 244 enum winbindd_cmd cmd; /* Winbindd command to execute */ 245 enum winbindd_cmd original_cmd; /* Original Winbindd command 246 issued to parent process */ 247 pid_t pid; /* pid of calling process */ 248 uint32_t wb_flags; /* generic flags */ 249 uint32_t flags; /* flags relevant *only* to a given request */ 250 fstring domain_name; /* name of domain for which the request applies */ 251 252 union { 253 fstring winsreq; /* WINS request */ 254 fstring username; /* getpwnam */ 255 fstring groupname; /* getgrnam */ 256 uid_t uid; /* getpwuid, uid_to_sid */ 257 gid_t gid; /* getgrgid, gid_to_sid */ 258 uint32_t ndrcmd; 259 struct { 260 /* We deliberatedly don't split into domain/user to 261 avoid having the client know what the separator 262 character is. */ 263 fstring user; 264 fstring pass; 265 char require_membership_of_sid[1024]; 266 fstring krb5_cc_type; 267 uid_t uid; 268 } auth; /* pam_winbind auth module */ 269 struct { 270 uint8_t chal[8]; 271 uint32_t logon_parameters; 272 fstring user; 273 fstring domain; 274 fstring lm_resp; 275 uint32_t lm_resp_len; 276 fstring nt_resp; 277 uint32_t nt_resp_len; 278 fstring workstation; 279 fstring require_membership_of_sid; 280 } auth_crap; 281 struct { 282 fstring user; 283 fstring oldpass; 284 fstring newpass; 285 } chauthtok; /* pam_winbind passwd module */ 286 struct { 287 fstring user; 288 fstring domain; 289 uint8_t new_nt_pswd[516]; 290 uint16_t new_nt_pswd_len; 291 uint8_t old_nt_hash_enc[16]; 292 uint16_t old_nt_hash_enc_len; 293 uint8_t new_lm_pswd[516]; 294 uint16_t new_lm_pswd_len; 295 uint8_t old_lm_hash_enc[16]; 296 uint16_t old_lm_hash_enc_len; 297 } chng_pswd_auth_crap;/* pam_winbind passwd module */ 298 struct { 299 fstring user; 300 fstring krb5ccname; 301 uid_t uid; 302 } logoff; /* pam_winbind session module */ 303 fstring sid; /* lookupsid, sid_to_[ug]id */ 304 struct { 305 fstring dom_name; /* lookupname */ 306 fstring name; 307 } name; 308 uint32_t num_entries; /* getpwent, getgrent */ 309 struct { 310 fstring username; 311 fstring groupname; 312 } acct_mgt; 313 struct { 314 bool is_primary; 315 fstring dcname; 316 } init_conn; 317 struct { 318 fstring sid; 319 fstring name; 320 } dual_sid2id; 321 struct { 322 fstring sid; 323 uint32_t type; 324 uint32_t id; 325 } dual_idmapset; 326 bool list_all_domains; 327 328 struct { 329 uid_t uid; 330 fstring user; 331 /* the effective uid of the client, must be the uid for 'user'. 332 This is checked by the main daemon, trusted by children. */ 333 /* if the blobs are length zero, then this doesn't 334 produce an actual challenge response. It merely 335 succeeds if there are cached credentials available 336 that could be used. */ 337 uint32_t initial_blob_len; /* blobs in extra_data */ 338 uint32_t challenge_blob_len; 339 } ccache_ntlm_auth; 340 struct { 341 uid_t uid; 342 fstring user; 343 fstring pass; 344 } ccache_save; 345 struct { 346 fstring domain_name; 347 fstring domain_guid; 348 fstring site_name; 349 uint32_t flags; 350 } dsgetdcname; 351 352 /* padding -- needed to fix alignment between 32bit and 64bit libs. 353 The size is the sizeof the union without the padding aligned on 354 an 8 byte boundary. --jerry */ 355 356 char padding[1800]; 357 } data; 358 union { 359 SMB_TIME_T padding; 360 char *data; 361 } extra_data; 362 uint32_t extra_len; 363 char null_term; 364}; 365 366/* Response values */ 367 368enum winbindd_result { 369 WINBINDD_ERROR, 370 WINBINDD_PENDING, 371 WINBINDD_OK 372}; 373 374/* Winbind response structure */ 375 376/******************************************************************************* 377 * This structure MUST be the same size in the 32bit and 64bit builds 378 * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so 379 * 380 * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST 381 * A 64BIT WINBINDD --jerry 382 ******************************************************************************/ 383 384struct winbindd_response { 385 386 /* Header information */ 387 388 uint32_t length; /* Length of response */ 389 enum winbindd_result result; /* Result code */ 390 391 /* Fixed length return data */ 392 393 union { 394 int interface_version; /* Try to ensure this is always in the same spot... */ 395 396 fstring winsresp; /* WINS response */ 397 398 /* getpwnam, getpwuid */ 399 400 struct winbindd_pw pw; 401 402 /* getgrnam, getgrgid */ 403 404 struct winbindd_gr gr; 405 406 uint32_t num_entries; /* getpwent, getgrent */ 407 struct winbindd_sid { 408 fstring sid; /* lookupname, [ug]id_to_sid */ 409 int type; 410 } sid; 411 struct winbindd_name { 412 fstring dom_name; /* lookupsid */ 413 fstring name; 414 int type; 415 } name; 416 uid_t uid; /* sid_to_uid */ 417 gid_t gid; /* sid_to_gid */ 418 struct winbindd_info { 419 char winbind_separator; 420 fstring samba_version; 421 } info; 422 fstring domain_name; 423 fstring netbios_name; 424 fstring dc_name; 425 426 struct auth_reply { 427 uint32_t nt_status; 428 fstring nt_status_string; 429 fstring error_string; 430 int pam_error; 431 char user_session_key[16]; 432 char first_8_lm_hash[8]; 433 fstring krb5ccname; 434 uint32_t reject_reason; 435 uint32_t padding; 436 struct policy_settings { 437 uint32_t min_length_password; 438 uint32_t password_history; 439 uint32_t password_properties; 440 uint32_t padding; 441 SMB_TIME_T expire; 442 SMB_TIME_T min_passwordage; 443 } policy; 444 struct info3_text { 445 SMB_TIME_T logon_time; 446 SMB_TIME_T logoff_time; 447 SMB_TIME_T kickoff_time; 448 SMB_TIME_T pass_last_set_time; 449 SMB_TIME_T pass_can_change_time; 450 SMB_TIME_T pass_must_change_time; 451 uint32_t logon_count; 452 uint32_t bad_pw_count; 453 uint32_t user_rid; 454 uint32_t group_rid; 455 uint32_t num_groups; 456 uint32_t user_flgs; 457 uint32_t acct_flags; 458 uint32_t num_other_sids; 459 fstring dom_sid; 460 fstring user_name; 461 fstring full_name; 462 fstring logon_script; 463 fstring profile_path; 464 fstring home_dir; 465 fstring dir_drive; 466 fstring logon_srv; 467 fstring logon_dom; 468 } info3; 469 fstring unix_username; 470 } auth; 471 struct { 472 fstring name; 473 fstring alt_name; 474 fstring sid; 475 bool native_mode; 476 bool active_directory; 477 bool primary; 478 } domain_info; 479 uint32_t sequence_number; 480 struct { 481 fstring acct_name; 482 fstring full_name; 483 fstring homedir; 484 fstring shell; 485 uint32_t primary_gid; 486 uint32_t group_rid; 487 } user_info; 488 struct { 489 uint8_t session_key[16]; 490 uint32_t auth_blob_len; /* blob in extra_data */ 491 } ccache_ntlm_auth; 492 struct { 493 fstring dc_unc; 494 fstring dc_address; 495 uint32_t dc_address_type; 496 fstring domain_guid; 497 fstring domain_name; 498 fstring forest_name; 499 uint32_t dc_flags; 500 fstring dc_site_name; 501 fstring client_site_name; 502 } dsgetdcname; 503 } data; 504 505 /* Variable length return data */ 506 507 union { 508 SMB_TIME_T padding; 509 void *data; 510 } extra_data; 511}; 512 513#endif 514