source: trunk-3.0/source/nsswitch/winbindd_nss.h@ 103

Last change on this file since 103 was 1, checked in by Paul Smedley, 19 years ago

Initial code import
File size: 12.7 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon for ntdom nss module
5
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Gerald Carter 2006
8
9 You are free to use this interface definition in any way you see
10 fit, including without restriction, using this header in your own
11 products. You do not need to give any attribution.
12*/
13
14
15#ifndef CONST_DISCARD
16#define CONST_DISCARD(type, ptr) ((type) ((void *) (ptr)))
17#endif
18
19#ifndef CONST_ADD
20#define CONST_ADD(type, ptr) ((type) ((const void *) (ptr)))
21#endif
22
23#ifndef SAFE_FREE
24#define SAFE_FREE(x) do { if(x) {free(x); x=NULL;} } while(0)
25#endif
26
27#ifndef _WINBINDD_NTDOM_H
28#define _WINBINDD_NTDOM_H
29
30#define WINBINDD_SOCKET_NAME "pipe" /* Name of PF_UNIX socket */
31#define WINBINDD_SOCKET_DIR "/tmp/.winbindd" /* Name of PF_UNIX dir */
32#define WINBINDD_PRIV_SOCKET_SUBDIR "winbindd_privileged" /* name of subdirectory of lp_lockdir() to hold the 'privileged' pipe */
33#define WINBINDD_DOMAIN_ENV "WINBINDD_DOMAIN" /* Environment variables */
34#define WINBINDD_DONT_ENV "_NO_WINBINDD"
35
36/* Update this when you change the interface. */
37
38#define WINBIND_INTERFACE_VERSION 18
39
40/* Have to deal with time_t being 4 or 8 bytes due to structure alignment.
41 On a 64bit Linux box, we have to support a constant structure size
42 between /lib/libnss_winbind.so.2 and /li64/libnss_winbind.so.2.
43 The easiest way to do this is to always use 8byte values for time_t. */
44
45#if defined(int64)
46# define SMB_TIME_T int64
47#else
48# define SMB_TIME_T time_t
49#endif
50
51/* Socket commands */
52
53enum winbindd_cmd {
54
55 WINBINDD_INTERFACE_VERSION, /* Always a well known value */
56
57 /* Get users and groups */
58
59 WINBINDD_GETPWNAM,
60 WINBINDD_GETPWUID,
61 WINBINDD_GETGRNAM,
62 WINBINDD_GETGRGID,
63 WINBINDD_GETGROUPS,
64
65 /* Enumerate users and groups */
66
67 WINBINDD_SETPWENT,
68 WINBINDD_ENDPWENT,
69 WINBINDD_GETPWENT,
70 WINBINDD_SETGRENT,
71 WINBINDD_ENDGRENT,
72 WINBINDD_GETGRENT,
73
74 /* PAM authenticate and password change */
75
76 WINBINDD_PAM_AUTH,
77 WINBINDD_PAM_AUTH_CRAP,
78 WINBINDD_PAM_CHAUTHTOK,
79 WINBINDD_PAM_LOGOFF,
80 WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP,
81
82 /* List various things */
83
84 WINBINDD_LIST_USERS, /* List w/o rid->id mapping */
85 WINBINDD_LIST_GROUPS, /* Ditto */
86 WINBINDD_LIST_TRUSTDOM,
87
88 /* SID conversion */
89
90 WINBINDD_LOOKUPSID,
91 WINBINDD_LOOKUPNAME,
92 WINBINDD_LOOKUPRIDS,
93
94 /* Lookup functions */
95
96 WINBINDD_SID_TO_UID,
97 WINBINDD_SID_TO_GID,
98 WINBINDD_SIDS_TO_XIDS,
99 WINBINDD_UID_TO_SID,
100 WINBINDD_GID_TO_SID,
101
102 WINBINDD_ALLOCATE_UID,
103 WINBINDD_ALLOCATE_GID,
104 WINBINDD_SET_MAPPING,
105 WINBINDD_SET_HWM,
106
107 /* Miscellaneous other stuff */
108
109 WINBINDD_DUMP_MAPS,
110
111 WINBINDD_CHECK_MACHACC, /* Check machine account pw works */
112 WINBINDD_PING, /* Just tell me winbind is running */
113 WINBINDD_INFO, /* Various bit of info. Currently just tidbits */
114 WINBINDD_DOMAIN_NAME, /* The domain this winbind server is a member of (lp_workgroup()) */
115
116 WINBINDD_DOMAIN_INFO, /* Most of what we know from
117 struct winbindd_domain */
118 WINBINDD_GETDCNAME, /* Issue a GetDCName Request */
119
120 WINBINDD_SHOW_SEQUENCE, /* display sequence numbers of domains */
121
122 /* WINS commands */
123
124 WINBINDD_WINS_BYIP,
125 WINBINDD_WINS_BYNAME,
126
127 /* this is like GETGRENT but gives an empty group list */
128 WINBINDD_GETGRLST,
129
130 WINBINDD_NETBIOS_NAME, /* The netbios name of the server */
131
132 /* find the location of our privileged pipe */
133 WINBINDD_PRIV_PIPE_DIR,
134
135 /* return a list of group sids for a user sid */
136 WINBINDD_GETUSERSIDS,
137
138 /* Various group queries */
139 WINBINDD_GETUSERDOMGROUPS,
140
141 /* Initialize connection in a child */
142 WINBINDD_INIT_CONNECTION,
143
144 /* Blocking calls that are not allowed on the main winbind pipe, only
145 * between parent and children */
146 WINBINDD_DUAL_SID2UID,
147 WINBINDD_DUAL_SID2GID,
148 WINBINDD_DUAL_SIDS2XIDS,
149 WINBINDD_DUAL_UID2SID,
150 WINBINDD_DUAL_GID2SID,
151 WINBINDD_DUAL_SET_MAPPING,
152 WINBINDD_DUAL_SET_HWM,
153 WINBINDD_DUAL_DUMP_MAPS,
154
155 /* Wrapper around possibly blocking unix nss calls */
156 WINBINDD_DUAL_UID2NAME,
157 WINBINDD_DUAL_NAME2UID,
158 WINBINDD_DUAL_GID2NAME,
159 WINBINDD_DUAL_NAME2GID,
160
161 WINBINDD_DUAL_USERINFO,
162 WINBINDD_DUAL_GETSIDALIASES,
163
164 /* Complete the challenge phase of the NTLM authentication
165 protocol using cached password. */
166 WINBINDD_CCACHE_NTLMAUTH,
167
168 WINBINDD_NUM_CMDS
169};
170
171typedef struct winbindd_pw {
172 fstring pw_name;
173 fstring pw_passwd;
174 uid_t pw_uid;
175 gid_t pw_gid;
176 fstring pw_gecos;
177 fstring pw_dir;
178 fstring pw_shell;
179} WINBINDD_PW;
180
181
182typedef struct winbindd_gr {
183 fstring gr_name;
184 fstring gr_passwd;
185 gid_t gr_gid;
186 uint32 num_gr_mem;
187 uint32 gr_mem_ofs; /* offset to group membership */
188} WINBINDD_GR;
189
190
191#define WBFLAG_PAM_INFO3_NDR 0x0001
192#define WBFLAG_PAM_INFO3_TEXT 0x0002
193#define WBFLAG_PAM_USER_SESSION_KEY 0x0004
194#define WBFLAG_PAM_LMKEY 0x0008
195#define WBFLAG_PAM_CONTACT_TRUSTDOM 0x0010
196#define WBFLAG_QUERY_ONLY 0x0020
197#define WBFLAG_PAM_UNIX_NAME 0x0080
198#define WBFLAG_PAM_AFS_TOKEN 0x0100
199#define WBFLAG_PAM_NT_STATUS_SQUASH 0x0200
200
201/* This is a flag that can only be sent from parent to child */
202#define WBFLAG_IS_PRIVILEGED 0x0400
203/* Flag to say this is a winbindd internal send - don't recurse. */
204#define WBFLAG_RECURSE 0x0800
205
206#define WBFLAG_PAM_KRB5 0x1000
207#define WBFLAG_PAM_FALLBACK_AFTER_KRB5 0x2000
208#define WBFLAG_PAM_CACHED_LOGIN 0x4000
209#define WBFLAG_PAM_GET_PWD_POLICY 0x8000 /* not used */
210
211#define WINBINDD_MAX_EXTRA_DATA (128*1024)
212
213/* Winbind request structure */
214
215/*******************************************************************************
216 * This structure MUST be the same size in the 32bit and 64bit builds
217 * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so
218 *
219 * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST
220 * A 64BIT WINBINDD --jerry
221 ******************************************************************************/
222
223struct winbindd_request {
224 uint32 length;
225 enum winbindd_cmd cmd; /* Winbindd command to execute */
226 pid_t pid; /* pid of calling process */
227 uint32 flags; /* flags relavant to a given request */
228 fstring domain_name; /* name of domain for which the request applies */
229
230 union {
231 fstring winsreq; /* WINS request */
232 fstring username; /* getpwnam */
233 fstring groupname; /* getgrnam */
234 uid_t uid; /* getpwuid, uid_to_sid */
235 gid_t gid; /* getgrgid, gid_to_sid */
236 struct {
237 /* We deliberatedly don't split into domain/user to
238 avoid having the client know what the separator
239 character is. */
240 fstring user;
241 fstring pass;
242 pstring require_membership_of_sid;
243 fstring krb5_cc_type;
244 uid_t uid;
245 } auth; /* pam_winbind auth module */
246 struct {
247 unsigned char chal[8];
248 uint32 logon_parameters;
249 fstring user;
250 fstring domain;
251 fstring lm_resp;
252 uint32 lm_resp_len;
253 fstring nt_resp;
254 uint32 nt_resp_len;
255 fstring workstation;
256 fstring require_membership_of_sid;
257 } auth_crap;
258 struct {
259 fstring user;
260 fstring oldpass;
261 fstring newpass;
262 } chauthtok; /* pam_winbind passwd module */
263 struct {
264 fstring user;
265 fstring domain;
266 unsigned char new_nt_pswd[516];
267 uint16 new_nt_pswd_len;
268 unsigned char old_nt_hash_enc[16];
269 uint16 old_nt_hash_enc_len;
270 unsigned char new_lm_pswd[516];
271 uint16 new_lm_pswd_len;
272 unsigned char old_lm_hash_enc[16];
273 uint16 old_lm_hash_enc_len;
274 } chng_pswd_auth_crap;/* pam_winbind passwd module */
275 struct {
276 fstring user;
277 fstring krb5ccname;
278 uid_t uid;
279 } logoff; /* pam_winbind session module */
280 fstring sid; /* lookupsid, sid_to_[ug]id */
281 struct {
282 fstring dom_name; /* lookupname */
283 fstring name;
284 } name;
285 uint32 num_entries; /* getpwent, getgrent */
286 struct {
287 fstring username;
288 fstring groupname;
289 } acct_mgt;
290 struct {
291 BOOL is_primary;
292 fstring dcname;
293 } init_conn;
294 struct {
295 fstring sid;
296 fstring name;
297 } dual_sid2id;
298 struct {
299 fstring sid;
300 uint32 type;
301 uint32 id;
302 } dual_idmapset;
303 BOOL list_all_domains;
304
305 struct {
306 uid_t uid;
307 fstring user;
308 /* the effective uid of the client, must be the uid for 'user'.
309 This is checked by the main daemon, trusted by children. */
310 /* if the blobs are length zero, then this doesn't
311 produce an actual challenge response. It merely
312 succeeds if there are cached credentials available
313 that could be used. */
314 uint32 initial_blob_len; /* blobs in extra_data */
315 uint32 challenge_blob_len;
316 } ccache_ntlm_auth;
317
318 /* padding -- needed to fix alignment between 32bit and 64bit libs.
319 The size is the sizeof the union without the padding aligned on
320 an 8 byte boundary. --jerry */
321
322 char padding[1560];
323 } data;
324 union {
325 SMB_TIME_T padding;
326 char *data;
327 } extra_data;
328 uint32 extra_len;
329 char null_term;
330};
331
332/* Response values */
333
334enum winbindd_result {
335 WINBINDD_ERROR,
336 WINBINDD_PENDING,
337 WINBINDD_OK
338};
339
340/* Winbind response structure */
341
342/*******************************************************************************
343 * This structure MUST be the same size in the 32bit and 64bit builds
344 * for compatibility between /lib64/libnss_winbind.so and /lib/libnss_winbind.so
345 *
346 * DO NOT CHANGE THIS STRUCTURE WITHOUT TESTING THE 32BIT NSS LIB AGAINST
347 * A 64BIT WINBINDD --jerry
348 ******************************************************************************/
349
350struct winbindd_response {
351
352 /* Header information */
353
354 uint32 length; /* Length of response */
355 enum winbindd_result result; /* Result code */
356
357 /* Fixed length return data */
358
359 union {
360 int interface_version; /* Try to ensure this is always in the same spot... */
361
362 fstring winsresp; /* WINS response */
363
364 /* getpwnam, getpwuid */
365
366 struct winbindd_pw pw;
367
368 /* getgrnam, getgrgid */
369
370 struct winbindd_gr gr;
371
372 uint32 num_entries; /* getpwent, getgrent */
373 struct winbindd_sid {
374 fstring sid; /* lookupname, [ug]id_to_sid */
375 int type;
376 } sid;
377 struct winbindd_name {
378 fstring dom_name; /* lookupsid */
379 fstring name;
380 int type;
381 } name;
382 uid_t uid; /* sid_to_uid */
383 gid_t gid; /* sid_to_gid */
384 struct winbindd_info {
385 char winbind_separator;
386 fstring samba_version;
387 } info;
388 fstring domain_name;
389 fstring netbios_name;
390 fstring dc_name;
391
392 struct auth_reply {
393 uint32 nt_status;
394 fstring nt_status_string;
395 fstring error_string;
396 int pam_error;
397 char user_session_key[16];
398 char first_8_lm_hash[8];
399 fstring krb5ccname;
400 uint32 reject_reason;
401 uint32 padding;
402 struct policy_settings {
403 uint32 min_length_password;
404 uint32 password_history;
405 uint32 password_properties;
406 uint32 padding;
407 SMB_TIME_T expire;
408 SMB_TIME_T min_passwordage;
409 } policy;
410 struct info3_text {
411 SMB_TIME_T logon_time;
412 SMB_TIME_T logoff_time;
413 SMB_TIME_T kickoff_time;
414 SMB_TIME_T pass_last_set_time;
415 SMB_TIME_T pass_can_change_time;
416 SMB_TIME_T pass_must_change_time;
417 uint32 logon_count;
418 uint32 bad_pw_count;
419 uint32 user_rid;
420 uint32 group_rid;
421 uint32 num_groups;
422 uint32 user_flgs;
423 uint32 acct_flags;
424 uint32 num_other_sids;
425 fstring dom_sid;
426 fstring user_name;
427 fstring full_name;
428 fstring logon_script;
429 fstring profile_path;
430 fstring home_dir;
431 fstring dir_drive;
432 fstring logon_srv;
433 fstring logon_dom;
434 } info3;
435 } auth;
436 struct {
437 fstring name;
438 fstring alt_name;
439 fstring sid;
440 BOOL native_mode;
441 BOOL active_directory;
442 BOOL primary;
443 uint32 sequence_number;
444 } domain_info;
445 struct {
446 fstring acct_name;
447 fstring full_name;
448 fstring homedir;
449 fstring shell;
450 uint32 primary_gid;
451 uint32 group_rid;
452 } user_info;
453 struct {
454 uint32 auth_blob_len; /* blob in extra_data */
455 } ccache_ntlm_auth;
456 } data;
457
458 /* Variable length return data */
459
460 union {
461 SMB_TIME_T padding;
462 void *data;
463 } extra_data;
464};
465
466struct WINBINDD_MEMORY_CREDS {
467 struct WINBINDD_MEMORY_CREDS *next, *prev;
468 const char *username; /* lookup key. */
469 uid_t uid;
470 int ref_count;
471 size_t len;
472 unsigned char *nt_hash; /* Base pointer for the following 2 */
473 unsigned char *lm_hash;
474 char *pass;
475};
476
477struct WINBINDD_CCACHE_ENTRY {
478 struct WINBINDD_CCACHE_ENTRY *next, *prev;
479 const char *principal_name;
480 const char *ccname;
481 const char *service;
482 const char *username;
483 const char *realm;
484 struct WINBINDD_MEMORY_CREDS *cred_ptr;
485 int ref_count;
486 uid_t uid;
487 time_t create_time;
488 time_t renew_until;
489 time_t refresh_time;
490 struct timed_event *event;
491};
492
493#endif
Note: See TracBrowser for help on using the repository browser.