1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * 25 * Copyright 2020 Tintri by DDN, Inc. All rights reserved. 26 * Copyright 2023 RackTop Systems, Inc. 27 */ 28 29 #ifndef _SMBSRV_NETRAUTH_H 30 #define _SMBSRV_NETRAUTH_H 31 32 /* 33 * NETR remote authentication and logon services. 34 */ 35 36 #include <sys/types.h> 37 #include <smb/wintypes.h> 38 #include <smbsrv/netbios.h> 39 #include <smbsrv/smbinfo.h> 40 #include <netdb.h> 41 42 #ifdef __cplusplus 43 extern "C" { 44 #endif 45 46 /* 47 * See also netlogon.ndl. 48 */ 49 #define NETR_WKSTA_TRUST_ACCOUNT_TYPE 0x02 50 #define NETR_DOMAIN_TRUST_ACCOUNT_TYPE 0x04 51 52 /* 53 * Negotiation flags for challenge/response authentication. 54 */ 55 #define NETR_NEGO_UNUSED_A_FLAG 0x00000001 56 #define NETR_NEGO_BDC_UPDATE_FLAG 0x00000002 57 #define NETR_NEGO_RC4_ENCRYPT_FLAG 0x00000004 58 #define NETR_NEGO_UNUSED_D_FLAG 0x00000008 59 60 #define NETR_NEGO_BDC_CHANGELOG_FLAG 0x00000010 61 #define NETR_NEGO_DC_RESTART_SYNC_FLAG 0x00000020 62 #define NETR_NEGO_VALID2_NOTREQUIRED_FLAG 0x00000040 63 #define NETR_NEGO_OPNUM17_FLAG 0x00000080 64 65 #define NETR_NEGO_PWCHANGE_REFUSE_FLAG 0x00000100 66 #define NETR_NEGO_OPNUM32_FLAG 0x00000200 67 #define NETR_NEGO_GENERIC_PASSTHRU_FLAG 0x00000400 68 #define NETR_NEGO_CONCURRENT_RPC_FLAG 0x00000800 69 70 #define NETR_NEGO_AVOID_USERDB_REPL_FLAG 0x00001000 71 #define NETR_NEGO_AVOID_SECURITYDB_REPL_FLAG 0x00002000 72 #define NETR_NEGO_STRONGKEY_FLAG 0x00004000 73 #define NETR_NEGO_TRANSITIVE_TRUSTFLAG 0x00008000 74 75 #define NETR_NEGO_UNUSED_Q_FLAG 0x00010000 76 #define NETR_NEGO_PASSWORDSET2_FLAG 0x00020000 77 #define NETR_NEGO_GETDOMAININFO_FLAG 0x00040000 78 #define NETR_NEGO_CROSS_FOREST_TRUST_FLAG 0x00080000 79 80 #define NETR_NEGO_IGNORE_NT4EMULATOR_FLAG 0x00100000 81 #define NETR_NEGO_RODC_PASSTHRU_FLAG 0x00200000 82 #define NETR_NEGO_UNDEFINED_9_FLAG 0x00400000 83 #define NETR_NEGO_UNDEFINED_8_FLAG 0x00800000 84 85 #define NETR_NEGO_AES_SHA2_FLAG 0x01000000 86 #define NETR_NEGO_UNDEFINED_6_FLAG 0x02000000 87 #define NETR_NEGO_UNDEFINED_5_FLAG 0x04000000 88 #define NETR_NEGO_UNDEFINED_4_FLAG 0x08000000 89 90 #define NETR_NEGO_UNDEFINED_3_FLAG 0x10000000 91 #define NETR_NEGO_UNUSED_X_FLAG 0x20000000 92 #define NETR_NEGO_SECURE_RPC_FLAG 0x40000000 93 #define NETR_NEGO_UNDEFINED_0_FLAG 0x80000000 94 95 /* 96 * TODO: This needs review - some of these are inappropriate. 97 * I.E. BDC_UPDATE, BDC_CHANGELOG, and DC_RESTART_SYNC are 98 * server-to-server only, but we implement a client. 99 */ 100 #define NETR_NEGO_BASE_FLAGS ( \ 101 NETR_NEGO_UNUSED_A_FLAG | \ 102 NETR_NEGO_BDC_UPDATE_FLAG | \ 103 NETR_NEGO_RC4_ENCRYPT_FLAG | \ 104 NETR_NEGO_UNUSED_D_FLAG | \ 105 NETR_NEGO_BDC_CHANGELOG_FLAG | \ 106 NETR_NEGO_DC_RESTART_SYNC_FLAG | \ 107 NETR_NEGO_VALID2_NOTREQUIRED_FLAG | \ 108 NETR_NEGO_OPNUM17_FLAG | \ 109 NETR_NEGO_PWCHANGE_REFUSE_FLAG) \ 110 111 #define NETR_SESSKEY64_SZ 8 112 #define NETR_SESSKEY128_SZ 16 113 #define NETR_SESSKEY_MAXSZ NETR_SESSKEY128_SZ 114 #define NETR_CRED_DATA_SZ 8 115 #define NETR_OWF_PASSWORD_SZ 16 116 117 /* 118 * SAM logon levels: interactive and network. 119 */ 120 #define NETR_INTERACTIVE_LOGON 0x01 121 #define NETR_NETWORK_LOGON 0x02 122 123 /* 124 * SAM logon validation levels. 125 */ 126 #define NETR_VALIDATION_LEVEL3 0x03 127 128 /* 129 * Most of these are from: "MSV1_0_LM20_LOGON structure" 130 * http://msdn.microsoft.com/en-us/library/windows/desktop/aa378762 131 * and a few are from the ntddk (ntmsv1_0.h) found many places. 132 */ 133 #define MSV1_0_CLEARTEXT_PASSWORD_ALLOWED 0x00000002 134 #define MSV1_0_UPDATE_LOGON_STATISTICS 0x00000004 135 #define MSV1_0_RETURN_USER_PARAMETERS 0x00000008 136 #define MSV1_0_DONT_TRY_GUEST_ACCOUNT 0x00000010 137 #define MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT 0x00000020 138 #define MSV1_0_RETURN_PASSWORD_EXPIRY 0x00000040 139 /* 140 * MSV1_0_USE_CLIENT_CHALLENGE means the LM response field contains the 141 * "client challenge" in the first 8 bytes instead of the LM response. 142 */ 143 #define MSV1_0_USE_CLIENT_CHALLENGE 0x00000080 144 #define MSV1_0_TRY_GUEST_ACCOUNT_ONLY 0x00000100 145 #define MSV1_0_RETURN_PROFILE_PATH 0x00000200 146 #define MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY 0x00000400 147 #define MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0x00000800 148 #define MSV1_0_DISABLE_PERSONAL_FALLBACK 0x00001000 149 #define MSV1_0_ALLOW_FORCE_GUEST 0x00002000 150 #define MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED 0x00004000 151 #define MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY 0x00008000 152 #define MSV1_0_SUBAUTHENTICATION_DLL_EX 0x00100000 153 154 /* 155 * This is a duplicate of the netr_credential 156 * from netlogon.ndl. 157 */ 158 typedef struct netr_cred { 159 BYTE data[NETR_CRED_DATA_SZ]; 160 } netr_cred_t; 161 162 typedef struct netr_session_key { 163 BYTE key[NETR_SESSKEY_MAXSZ]; 164 short len; 165 } netr_session_key_t; 166 167 #define NETR_FLG_NULL 0x00000001 168 #define NETR_FLG_VALID 0x00000001 169 #define NETR_FLG_INIT 0x00000002 170 171 /* 172 * 120-byte machine account password (null-terminated) 173 */ 174 #define NETR_MACHINE_ACCT_PASSWD_MAX 120 + 1 175 176 typedef struct netr_info { 177 DWORD flags; 178 char server[MAXHOSTNAMELEN]; /* Current DC, FQDN */ 179 char hostname[NETBIOS_NAME_SZ * 2]; /* local "flat" name */ 180 char nb_domain[NETBIOS_NAME_SZ * 2]; /* Current NetBios domain */ 181 char fqdn_domain[MAXHOSTNAMELEN]; /* Current Domain */ 182 netr_cred_t client_challenge; 183 netr_cred_t server_challenge; 184 netr_cred_t client_credential; 185 netr_cred_t server_credential; 186 netr_session_key_t session_key; 187 netr_session_key_t rpc_seal_key; 188 BYTE password[NETR_MACHINE_ACCT_PASSWD_MAX]; 189 time_t timestamp; 190 uint64_t clh_seqnum; /* Client SequenceNumber for Netlogon SSP */ 191 DWORD nego_flags; /* Negotiated flags returned from ServerAuthenciate */ 192 boolean_t use_secure_rpc; /* Use "SecureRPC" (RPC-level auth) */ 193 boolean_t use_logon_ex; /* Use SamLogonEx (instead of SamLogon) */ 194 } netr_info_t; 195 196 /* 197 * NETLOGON private interface. 198 */ 199 int netr_gen_skey64(netr_info_t *); 200 int netr_gen_skey128(netr_info_t *); 201 202 int netr_gen_credentials(BYTE *, netr_cred_t *, DWORD, netr_cred_t *, 203 boolean_t); 204 205 void netlogon_init_global(uint32_t); 206 207 #define NETR_A2H(c) (isdigit(c)) ? ((c) - '0') : ((c) - 'A' + 10) 208 209 #ifdef __cplusplus 210 } 211 #endif 212 213 #endif /* _SMBSRV_NETRAUTH_H */ 214