xref: /illumos-gate/usr/src/uts/common/smbsrv/netrauth.h (revision 0ccfe5834c3b867c1b6c273cae02ec8922bc0fd2)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  *
25  * Copyright 2020 Tintri by DDN, Inc. All rights reserved.
26  * Copyright 2023 RackTop Systems, Inc.
27  */
28 
29 #ifndef _SMBSRV_NETRAUTH_H
30 #define	_SMBSRV_NETRAUTH_H
31 
32 /*
33  * NETR remote authentication and logon services.
34  */
35 
36 #include <sys/types.h>
37 #include <smb/wintypes.h>
38 #include <smbsrv/netbios.h>
39 #include <smbsrv/smbinfo.h>
40 #include <netdb.h>
41 
42 #ifdef __cplusplus
43 extern "C" {
44 #endif
45 
46 /*
47  * See also netlogon.ndl.
48  */
49 #define	NETR_WKSTA_TRUST_ACCOUNT_TYPE		0x02
50 #define	NETR_DOMAIN_TRUST_ACCOUNT_TYPE		0x04
51 
52 /*
53  * Negotiation flags for challenge/response authentication.
54  */
55 #define	NETR_NEGO_UNUSED_A_FLAG			0x00000001
56 #define	NETR_NEGO_BDC_UPDATE_FLAG		0x00000002
57 #define	NETR_NEGO_RC4_ENCRYPT_FLAG		0x00000004
58 #define	NETR_NEGO_UNUSED_D_FLAG			0x00000008
59 
60 #define	NETR_NEGO_BDC_CHANGELOG_FLAG		0x00000010
61 #define	NETR_NEGO_DC_RESTART_SYNC_FLAG		0x00000020
62 #define	NETR_NEGO_VALID2_NOTREQUIRED_FLAG	0x00000040
63 #define	NETR_NEGO_OPNUM17_FLAG			0x00000080
64 
65 #define	NETR_NEGO_PWCHANGE_REFUSE_FLAG		0x00000100
66 #define	NETR_NEGO_OPNUM32_FLAG			0x00000200
67 #define	NETR_NEGO_GENERIC_PASSTHRU_FLAG		0x00000400
68 #define	NETR_NEGO_CONCURRENT_RPC_FLAG		0x00000800
69 
70 #define	NETR_NEGO_AVOID_USERDB_REPL_FLAG	0x00001000
71 #define	NETR_NEGO_AVOID_SECURITYDB_REPL_FLAG	0x00002000
72 #define	NETR_NEGO_STRONGKEY_FLAG		0x00004000
73 #define	NETR_NEGO_TRANSITIVE_TRUSTFLAG		0x00008000
74 
75 #define	NETR_NEGO_UNUSED_Q_FLAG			0x00010000
76 #define	NETR_NEGO_PASSWORDSET2_FLAG		0x00020000
77 #define	NETR_NEGO_GETDOMAININFO_FLAG		0x00040000
78 #define	NETR_NEGO_CROSS_FOREST_TRUST_FLAG	0x00080000
79 
80 #define	NETR_NEGO_IGNORE_NT4EMULATOR_FLAG	0x00100000
81 #define	NETR_NEGO_RODC_PASSTHRU_FLAG		0x00200000
82 #define	NETR_NEGO_UNDEFINED_9_FLAG		0x00400000
83 #define	NETR_NEGO_UNDEFINED_8_FLAG		0x00800000
84 
85 #define	NETR_NEGO_AES_SHA2_FLAG			0x01000000
86 #define	NETR_NEGO_UNDEFINED_6_FLAG		0x02000000
87 #define	NETR_NEGO_UNDEFINED_5_FLAG		0x04000000
88 #define	NETR_NEGO_UNDEFINED_4_FLAG		0x08000000
89 
90 #define	NETR_NEGO_UNDEFINED_3_FLAG		0x10000000
91 #define	NETR_NEGO_UNUSED_X_FLAG			0x20000000
92 #define	NETR_NEGO_SECURE_RPC_FLAG		0x40000000
93 #define	NETR_NEGO_UNDEFINED_0_FLAG		0x80000000
94 
95 /*
96  * TODO: This needs review - some of these are inappropriate.
97  * I.E. BDC_UPDATE, BDC_CHANGELOG, and DC_RESTART_SYNC are
98  * server-to-server only, but we implement a client.
99  */
100 #define	NETR_NEGO_BASE_FLAGS	(		\
101 	NETR_NEGO_UNUSED_A_FLAG	|		\
102 	NETR_NEGO_BDC_UPDATE_FLAG |		\
103 	NETR_NEGO_RC4_ENCRYPT_FLAG |		\
104 	NETR_NEGO_UNUSED_D_FLAG |		\
105 	NETR_NEGO_BDC_CHANGELOG_FLAG |		\
106 	NETR_NEGO_DC_RESTART_SYNC_FLAG |	\
107 	NETR_NEGO_VALID2_NOTREQUIRED_FLAG |	\
108 	NETR_NEGO_OPNUM17_FLAG |		\
109 	NETR_NEGO_PWCHANGE_REFUSE_FLAG)		\
110 
111 #define	NETR_SESSKEY64_SZ			8
112 #define	NETR_SESSKEY128_SZ			16
113 #define	NETR_SESSKEY_MAXSZ			NETR_SESSKEY128_SZ
114 #define	NETR_CRED_DATA_SZ			8
115 #define	NETR_OWF_PASSWORD_SZ			16
116 
117 /*
118  * SAM logon levels: interactive and network.
119  */
120 #define	NETR_INTERACTIVE_LOGON			0x01
121 #define	NETR_NETWORK_LOGON			0x02
122 
123 /*
124  * SAM logon validation levels.
125  */
126 #define	NETR_VALIDATION_LEVEL3			0x03
127 
128 /*
129  * Most of these are from: "MSV1_0_LM20_LOGON structure"
130  * http://msdn.microsoft.com/en-us/library/windows/desktop/aa378762
131  * and a few are from the ntddk (ntmsv1_0.h) found many places.
132  */
133 #define	MSV1_0_CLEARTEXT_PASSWORD_ALLOWED	0x00000002
134 #define	MSV1_0_UPDATE_LOGON_STATISTICS		0x00000004
135 #define	MSV1_0_RETURN_USER_PARAMETERS		0x00000008
136 #define	MSV1_0_DONT_TRY_GUEST_ACCOUNT		0x00000010
137 #define	MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT	0x00000020
138 #define	MSV1_0_RETURN_PASSWORD_EXPIRY		0x00000040
139 /*
140  * MSV1_0_USE_CLIENT_CHALLENGE means the LM response field contains the
141  * "client challenge" in the first 8 bytes instead of the LM response.
142  */
143 #define	MSV1_0_USE_CLIENT_CHALLENGE		0x00000080
144 #define	MSV1_0_TRY_GUEST_ACCOUNT_ONLY		0x00000100
145 #define	MSV1_0_RETURN_PROFILE_PATH		0x00000200
146 #define	MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY	0x00000400
147 #define	MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT	0x00000800
148 #define	MSV1_0_DISABLE_PERSONAL_FALLBACK	0x00001000
149 #define	MSV1_0_ALLOW_FORCE_GUEST		0x00002000
150 #define	MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED	0x00004000
151 #define	MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY	0x00008000
152 #define	MSV1_0_SUBAUTHENTICATION_DLL_EX		0x00100000
153 
154 /*
155  * This is a duplicate of the netr_credential
156  * from netlogon.ndl.
157  */
158 typedef struct netr_cred {
159 	BYTE data[NETR_CRED_DATA_SZ];
160 } netr_cred_t;
161 
162 typedef struct netr_session_key {
163 	BYTE key[NETR_SESSKEY_MAXSZ];
164 	short len;
165 } netr_session_key_t;
166 
167 #define	NETR_FLG_NULL		0x00000001
168 #define	NETR_FLG_VALID		0x00000001
169 #define	NETR_FLG_INIT		0x00000002
170 
171 /*
172  * 120-byte machine account password (null-terminated)
173  */
174 #define	NETR_MACHINE_ACCT_PASSWD_MAX	120 + 1
175 
176 typedef struct netr_info {
177 	DWORD flags;
178 	char server[MAXHOSTNAMELEN];		/* Current DC, FQDN */
179 	char hostname[NETBIOS_NAME_SZ * 2];	/* local "flat" name */
180 	char nb_domain[NETBIOS_NAME_SZ * 2];	/* Current NetBios domain */
181 	char fqdn_domain[MAXHOSTNAMELEN];	/* Current Domain */
182 	netr_cred_t client_challenge;
183 	netr_cred_t server_challenge;
184 	netr_cred_t client_credential;
185 	netr_cred_t server_credential;
186 	netr_session_key_t session_key;
187 	netr_session_key_t rpc_seal_key;
188 	BYTE password[NETR_MACHINE_ACCT_PASSWD_MAX];
189 	time_t timestamp;
190 	uint64_t clh_seqnum; /* Client SequenceNumber for Netlogon SSP */
191 	DWORD nego_flags; /* Negotiated flags returned from ServerAuthenciate */
192 	boolean_t use_secure_rpc; /* Use "SecureRPC" (RPC-level auth) */
193 	boolean_t use_logon_ex; /* Use SamLogonEx (instead of SamLogon) */
194 } netr_info_t;
195 
196 /*
197  * NETLOGON private interface.
198  */
199 int netr_gen_skey64(netr_info_t *);
200 int netr_gen_skey128(netr_info_t *);
201 
202 int netr_gen_credentials(BYTE *, netr_cred_t *, DWORD, netr_cred_t *,
203     boolean_t);
204 
205 void netlogon_init_global(uint32_t);
206 
207 #define	NETR_A2H(c) (isdigit(c)) ? ((c) - '0') : ((c) - 'A' + 10)
208 
209 #ifdef __cplusplus
210 }
211 #endif
212 
213 #endif /* _SMBSRV_NETRAUTH_H */
214