xref: /titanic_44/usr/src/uts/common/smbsrv/ndl/lsarpc.ndl (revision a60349c89adffc0902b2353230891d8e7f2b24d9)
1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25#ifndef _MLSVC_LSA_NDL_
26#define _MLSVC_LSA_NDL_
27
28/*
29 * Local Security Authority RPC (LSARPC) interface definition.
30 *
31 * Names containing a backslash ('\') are known as qualified or composite
32 * names.  The string preceding the backslash is assumed to be the domain
33 * name and the string following the slash is assumed to be name to be
34 * resolved within that domain.
35 *
36 * Names that do not contain a backslash are known as isolated names.
37 * An isolated name may be a single label, such as john, or may be in
38 * user principal name (UPN) form, such as john@example.com.
39 */
40
41#include "ndrtypes.ndl"
42
43
44#define	LSARPC_OPNUM_CloseHandle			0x00
45#define	LSARPC_OPNUM_Delete				0x01
46#define	LSARPC_OPNUM_EnumPrivileges			0x02
47#define	LSARPC_OPNUM_QuerySecurityObject		0x03
48#define	LSARPC_OPNUM_SetSecurityObject			0x04
49#define	LSARPC_OPNUM_ChangePassword			0x05
50#define	LSARPC_OPNUM_OpenPolicy				0x06
51#define	LSARPC_OPNUM_QueryInfoPolicy			0x07
52#define	LSARPC_OPNUM_SetInfoPolicy			0x08
53#define	LSARPC_OPNUM_ClearAuditLog			0x09
54#define	LSARPC_OPNUM_CreateAccount			0x0a
55#define	LSARPC_OPNUM_EnumerateAccounts			0x0b
56#define	LSARPC_OPNUM_CreateTrustedDomain		0x0c
57#define	LSARPC_OPNUM_EnumTrustedDomain			0x0d
58#define	LSARPC_OPNUM_LookupNames			0x0e
59#define	LSARPC_OPNUM_LookupSids				0x0f
60#define	LSARPC_OPNUM_CreateSecret			0x10
61#define	LSARPC_OPNUM_OpenAccount			0x11
62#define	LSARPC_OPNUM_EnumPrivsAccount			0x12
63#define	LSARPC_OPNUM_AddAccountPrivs			0x13
64#define	LSARPC_OPNUM_RemoveAccountPrivs			0x14
65#define	LSARPC_OPNUM_GetAccountQuota			0x15
66#define	LSARPC_OPNUM_SetAccountQuota			0x16
67#define	LSARPC_OPNUM_GetSystemAccessAccount		0x17
68#define	LSARPC_OPNUM_SetSystemAccessAccount		0x18
69#define	LSARPC_OPNUM_OpenTrustedDomain			0x19
70#define	LSARPC_OPNUM_QueryInfoTrustedDomain		0x1a
71#define	LSARPC_OPNUM_SetinfoTrustedDomain		0x1b
72#define	LSARPC_OPNUM_OpenSecret				0x1c
73#define	LSARPC_OPNUM_SetSecret				0x1d
74#define	LSARPC_OPNUM_QuerySecret			0x1e
75#define	LSARPC_OPNUM_LookupPrivValue			0x1f
76#define	LSARPC_OPNUM_LookupPrivName			0x20
77#define	LSARPC_OPNUM_LookupPrivDisplayName		0x21
78#define	LSARPC_OPNUM_DeleteObject			0x22
79#define	LSARPC_OPNUM_EnumAccountsWithUserRight		0x23
80#define	LSARPC_OPNUM_EnumAccountRights			0x24
81#define	LSARPC_OPNUM_AddAccountRights			0x25
82#define	LSARPC_OPNUM_RemoveAccountRights		0x26
83#define	LSARPC_OPNUM_QueryTrustedDomainInfo		0x27
84#define	LSARPC_OPNUM_SetTrustedDomainInfo		0x28
85
86/* Windows 2000 */
87#define	LSARPC_OPNUM_DeleteTrustedDomain		0x29
88#define	LSARPC_OPNUM_StorePrivateData			0x2a
89#define	LSARPC_OPNUM_RetrievePrivateData		0x2b
90#define	LSARPC_OPNUM_OpenPolicy2			0x2c
91#define	LSARPC_OPNUM_GetConnectedUser			0x2d
92#define	LSARPC_OPNUM_QueryInfoPolicy2			0x2e
93#define	LSARPC_OPNUM_SetInfoPolicy2			0x2f
94#define	LSARPC_OPNUM_QueryTrustedDomainInfoByName	0x30
95#define	LSARPC_OPNUM_SetTrustedDomainInfoByName		0x31
96#define	LSARPC_OPNUM_EnumTrustedDomainsEx		0x32
97#define	LSARPC_OPNUM_CreateTrustedDomainEx		0x33
98#define	LSARPC_OPNUM_CloseTrustedDomainEx		0x34
99#define	LSARPC_OPNUM_QueryDomainInfoPolicy		0x35
100#define	LSARPC_OPNUM_SetDomainInfoPolicy		0x36
101#define	LSARPC_OPNUM_OpenTrustedDomainByName		0x37
102#define	LSARPC_OPNUM_TestCall				0x38
103#define	LSARPC_OPNUM_LookupSids2			0x39
104#define	LSARPC_OPNUM_LookupNames2			0x3a
105#define	LSARPC_OPNUM_CreateTrustedDomainEx2		0x3b
106
107/* Windows 2000 SP3 */
108#define	LSARPC_OPNUM_CredWrite				0x3c
109#define	LSARPC_OPNUM_CredRead				0x3d
110#define	LSARPC_OPNUM_CredEnumerate			0x3e
111#define	LSARPC_OPNUM_CredWriteDomainCreds		0x3f
112#define	LSARPC_OPNUM_CredReadDomainCreds		0x40
113#define	LSARPC_OPNUM_CredDelete				0x41
114#define	LSARPC_OPNUM_CredGetTargetInfo			0x42
115#define	LSARPC_OPNUM_CredProfileLoaded			0x43
116#define	LSARPC_OPNUM_LookupNames3			0x44
117#define	LSARPC_OPNUM_CredGetSessionTypes		0x45
118#define	LSARPC_OPNUM_RegisterAuditEvent			0x46
119#define	LSARPC_OPNUM_GenAuditEvent			0x47
120#define	LSARPC_OPNUM_UnregisterAuditEvent		0x48
121#define	LSARPC_OPNUM_QueryForestTrustInfo		0x49
122#define	LSARPC_OPNUM_SetForestTrustInfo			0x4a
123#define	LSARPC_OPNUM_CredRename				0x4b
124#define	LSARPC_OPNUM_LookupSids3			0x4c
125#define	LSARPC_OPNUM_LookupNames4			0x4d
126#define	LSARPC_OPNUM_OpenPolicySce			0x4e
127
128/* Windows Server 2003 */
129#define	LSARPC_OPNUM_AdtRegisterSecurityEventSource	0x4f
130#define	LSARPC_OPNUM_AdtUnregisterSecurityEventSource	0x50
131#define	LSARPC_OPNUM_AdtReportSecurityEvent		0x51
132
133/* Windows Vista */
134#define	LSARPC_OPNUM_CredFindBestCredential		0x52
135#define	LSARPC_OPNUM_SetAuditPolicy			0x53
136#define	LSARPC_OPNUM_QueryAuditPolicy			0x54
137#define	LSARPC_OPNUM_EnumerateAuditPolicy		0x55
138#define	LSARPC_OPNUM_EnumerateAuditCategories		0x56
139#define	LSARPC_OPNUM_EnumerateAuditSubCategories	0x57
140#define	LSARPC_OPNUM_LookupAuditCategoryName		0x58
141#define	LSARPC_OPNUM_LookupAuditSubCategoryName		0x59
142#define	LSARPC_OPNUM_SetAuditSecurity			0x5a
143#define	LSARPC_OPNUM_QueryAuditSecurity			0x5b
144#define	LSARPC_OPNUM_CredReadByTokenHandle		0x5c
145#define	LSARPC_OPNUM_CredRestoreCredentials		0x5d
146#define	LSARPC_OPNUM_CredBackupCredentials		0x5e
147
148/*
149 * Lookup levels.  Level 1 appears to mean only look on the local host and
150 * level 2 means forward the request to the PDC.  On the PDC it probably
151 * doesn't matter which level you use but on a BDC a level 1 lookup will
152 * fail if the BDC doesn't have the info whereas a level 2 lookup will also
153 * check with the PDC.
154 */
155#define	LSA_LOOKUP_WKSTA			1	/* Windows NT 3.1 */
156#define	LSA_LOOKUP_PDC				2
157#define	LSA_LOOKUP_TDL				3
158#define	LSA_LOOKUP_GC				4	/* Windows 2000 */
159#define	LSA_LOOKUP_XFORESTREFERRAL		5	/* Windows XP */
160#define	LSA_LOOKUP_XFORESTRESOLVE		6
161#define	LSA_LOOKUP_RODCREFERRALTOFULLDC		7	/* Windows Vista */
162
163/*
164 * Name/SID lookup flags
165 */
166#define	LSA_LOOKUP_NAME_NOT_SPN			0x00000001
167#define	LSA_LOOKUP_NAME_MAYBE_XFOREST		0x00000002
168#define	LSA_LOOKUP_NAME_IN_DBVIEW		0x00000004
169
170/*
171 * Name/SID lookup options
172 *
173 * 0x00000000	Lookup isolated names both locally and in domains/forests.
174 * 0x80000000	Lookup isolated names (except for UPNs) only in the local
175 *		account database.  Do not lookup UPNs.
176 */
177#define	LSA_LOOKUP_OPT_ALL			0x00000000
178#define	LSA_LOOKUP_OPT_LOCAL			0x80000000
179
180/*
181 * Client revision
182 *
183 * 0x00000001	Client does not understand DNS names or forests.
184 * 0x00000002	Client understands DNS names and forests.
185 *
186 * Notes:
187 *	0 means the same as 1
188 *	Anything greater than 2 means the same as 2
189 */
190#define	LSA_CLIENT_REVISION_NT			0x00000001
191#define	LSA_CLIENT_REVISION_AD			0x00000002
192
193/*
194 * Definition for a SID. The ndl compiler won't allow a typedef of
195 * a structure containing variable size members.
196 */
197struct mslsa_sid {
198	BYTE		Revision;
199	BYTE		SubAuthCount;
200	BYTE		Authority[6];
201  SIZE_IS(SubAuthCount)
202	DWORD		SubAuthority[ANY_SIZE_ARRAY];
203};
204
205struct mslsa_string_desc {
206	WORD		length;
207	WORD		allosize;
208	LPTSTR		str;
209};
210typedef struct mslsa_string_desc mslsa_string_t;
211
212CONTEXT_HANDLE(mslsa_handle) mslsa_handle_t;
213
214struct mslsa_luid {
215	DWORD low_part;
216	DWORD high_part;
217};
218typedef struct mslsa_luid mslsa_luid_t;
219
220struct mslsa_guid {
221	DWORD	data1;
222	WORD	data2;
223	WORD	data3;
224	BYTE	data4[8];
225};
226typedef struct mslsa_guid mslsa_guid_t;
227
228/*
229 ***********************************************************************
230 * OpenPolicy2 obtains a handle for a remote LSA. This handle is
231 * required for all subsequent LSA requests.
232 *
233 * The server name should be the name of the target PDC or BDC, with
234 * the double backslash prefix.
235 *
236 * As far as I can tell, the mslsa_object_attributes structure can be
237 * all zero except for the length, which should be set to sizeof(struct
238 * mslsa_object_attributes).
239 *
240 * For read access, the desired access mask should contain the
241 * READ_CONTROL standard right and whatever policy rights are required.
242 * I haven't tried any update operations but if you get the access mask
243 * wrong you can crash the domain controller.
244 ***********************************************************************
245 */
246
247
248/*
249 * From netmon:
250 *	length = 12
251 *	impersonation_level = 2
252 *	context_tracking_mode = 1
253 *	effective_only = 0
254 */
255struct mslsa_quality_of_service {
256	DWORD length;
257	WORD impersonation_level;
258	BYTE context_tracking_mode;
259	BYTE effective_only;
260};
261
262
263struct mslsa_object_attributes {
264	DWORD length;
265	DWORD rootDirectory;
266	DWORD objectName;
267	DWORD attributes;
268	DWORD securityDescriptor;
269	struct mslsa_quality_of_service *qualityOfService;
270};
271
272
273OPERATION(LSARPC_OPNUM_OpenPolicy)
274struct mslsa_OpenPolicy {
275	IN	DWORD	*servername;
276	IN	struct mslsa_object_attributes attributes;
277	IN	DWORD desiredAccess;
278	OUT	mslsa_handle_t domain_handle;
279	OUT	DWORD status;
280};
281
282OPERATION(LSARPC_OPNUM_OpenPolicy2)
283struct mslsa_OpenPolicy2 {
284	IN	LPTSTR servername;
285	IN	struct mslsa_object_attributes attributes;
286	IN	DWORD desiredAccess;
287	OUT	mslsa_handle_t domain_handle;
288	OUT	DWORD status;
289};
290
291
292/*
293 ***********************************************************************
294 * CloseHandle closes an association with the LSA. The returned handle
295 * will be all zero.
296 ***********************************************************************
297 */
298OPERATION(LSARPC_OPNUM_CloseHandle)
299struct mslsa_CloseHandle {
300	IN	mslsa_handle_t handle;
301	OUT	mslsa_handle_t result_handle;
302	OUT	DWORD status;
303};
304
305
306/*
307 ***********************************************************************
308 * EnumPrivileges
309 *
310 * Obtain a list of privilege names. This interface is not implemented
311 * yet The definition below has not been tested. This is a guess based
312 * on data available from netmon.
313 ***********************************************************************
314 */
315struct mslsa_PrivDef {
316	mslsa_string_t name;
317	mslsa_luid_t luid;
318};
319
320
321struct mslsa_PrivEnumBuf {
322	DWORD entries_read;
323  SIZE_IS(entries_read)
324	struct mslsa_PrivDef *def;
325};
326
327
328OPERATION(LSARPC_OPNUM_EnumPrivileges)
329struct mslsa_EnumPrivileges {
330	IN	mslsa_handle_t handle;
331	INOUT	DWORD enum_context;
332	IN	DWORD max_length;
333	OUT	REFERENCE struct mslsa_PrivEnumBuf *enum_buf;
334	OUT	DWORD status;
335};
336
337
338/*
339 ***********************************************************************
340 * QuerySecurityObject. I'm not entirely sure how to set this up yet.
341 * I used the discovery RPC to scope it out. The structures are set up
342 * according to netmon and the assumption that a security descriptor
343 * on the wire looks like the regular user level security descriptor.
344 ***********************************************************************
345 */
346struct mslsa_SecurityDescriptor {
347	BYTE revision;
348	BYTE sbz1;
349	WORD control;
350	DWORD owner;
351	DWORD group;
352	DWORD sacl;
353	DWORD dacl;
354};
355
356
357struct mslsa_SecurityDescInfo {
358	DWORD length;
359  SIZE_IS(length)
360  	BYTE *desc; /* temporary */
361	/* struct mslsa_SecurityDescriptor *desc; */
362};
363
364
365OPERATION(LSARPC_OPNUM_QuerySecurityObject)
366struct mslsa_QuerySecurityObject {
367	IN	mslsa_handle_t handle;
368	IN	DWORD security_info;
369	OUT	struct mslsa_SecurityDescInfo *desc_info;
370	OUT	DWORD status;
371};
372
373
374/*
375 ***********************************************************************
376 * EnumerateAccounts and EnumerateTrustedDomain.
377 ***********************************************************************
378 */
379struct mslsa_AccountInfo {
380	struct mslsa_sid *sid;
381};
382
383
384struct mslsa_EnumAccountBuf {
385	DWORD entries_read;
386  SIZE_IS(entries_read)
387	struct mslsa_AccountInfo *info;
388};
389
390
391OPERATION(LSARPC_OPNUM_EnumerateAccounts)
392struct mslsa_EnumerateAccounts {
393	IN	mslsa_handle_t handle;
394	INOUT	DWORD enum_context;
395	IN	DWORD max_length;
396	OUT	REFERENCE struct mslsa_EnumAccountBuf *enum_buf;
397	OUT	DWORD status;
398};
399
400
401struct mslsa_TrustedDomainInfo {
402	mslsa_string_t name;
403	struct mslsa_sid *sid;
404};
405
406
407struct mslsa_EnumTrustedDomainBuf {
408	DWORD entries_read;
409  SIZE_IS(entries_read)
410	struct mslsa_TrustedDomainInfo *info;
411};
412
413
414OPERATION(LSARPC_OPNUM_EnumTrustedDomain)
415struct mslsa_EnumTrustedDomain {
416	IN	mslsa_handle_t handle;
417	INOUT	DWORD enum_context;
418	IN	DWORD max_length;
419	OUT REFERENCE	struct mslsa_EnumTrustedDomainBuf *enum_buf;
420	OUT	DWORD status;
421};
422
423struct mslsa_TrustedDomainInfoEx {
424	mslsa_string_t		dns_name;
425	mslsa_string_t		nb_name;
426	struct mslsa_sid	*sid;
427	DWORD			trust_direction;
428	DWORD			trust_type;
429	DWORD			trust_attrs;
430};
431
432struct mslsa_EnumTrustedDomainBufEx {
433	DWORD entries_read;
434  SIZE_IS(entries_read)
435	struct mslsa_TrustedDomainInfoEx *info;
436};
437
438OPERATION(LSARPC_OPNUM_EnumTrustedDomainsEx)
439struct mslsa_EnumTrustedDomainEx {
440	IN	mslsa_handle_t handle;
441	INOUT	DWORD enum_context;
442	IN	DWORD max_length;
443	OUT REFERENCE	struct mslsa_EnumTrustedDomainBufEx *enum_buf;
444	OUT	DWORD status;
445};
446
447/*
448 ***********************************************************************
449 * Definitions common to both LookupSids and LookupNames. Both return
450 * an mslsa_domain_table[]. Each interface also returns a specific
451 * table with entries which index the mslsa_domain_table[].
452 ***********************************************************************
453 */
454struct mslsa_domain_entry {
455	mslsa_string_t domain_name;
456	struct mslsa_sid *domain_sid;
457};
458typedef struct mslsa_domain_entry mslsa_domain_entry_t;
459
460
461struct mslsa_domain_table {
462	DWORD		n_entry;
463  SIZE_IS(n_entry)
464  	mslsa_domain_entry_t *entries;
465	DWORD		max_n_entry;
466};
467
468
469/*
470 ***********************************************************************
471 * Definitions for LookupSids.
472 *
473 * The input parameters are:
474 *
475 *	A valid LSA handle obtained from an LsarOpenPolicy.
476 *	The table of SIDs to be looked up.
477 *	A table of names (probably empty).
478 *	The lookup level (local=1 or PDC=2).
479 *	An enumeration counter (used for continuation operations).
480 *
481 * The output results are:
482 *
483 *	A table of referenced domains.
484 *	A table of usernames.
485 *	The updated value of the enumeration counter.
486 *	The result status.
487 ***********************************************************************
488 */
489
490struct mslsa_lup_sid_entry {
491	struct mslsa_sid *psid;
492};
493
494struct mslsa_lup_sid_table {
495	DWORD		n_entry;
496    SIZE_IS(n_entry)
497	struct mslsa_lup_sid_entry *entries;
498};
499
500struct mslsa_name_entry {
501	WORD		sid_name_use;
502	WORD		unknown_flags;
503	mslsa_string_t	name;
504	DWORD		domain_ix;		/* -1 means none */
505};
506
507struct mslsa_name_table {
508	DWORD		n_entry;
509    SIZE_IS(n_entry)
510	struct mslsa_name_entry *entries;
511};
512
513OPERATION(LSARPC_OPNUM_LookupSids)
514struct mslsa_LookupSids {
515	IN	mslsa_handle_t	handle;
516	IN	struct mslsa_lup_sid_table lup_sid_table;
517
518	OUT	struct mslsa_domain_table *domain_table;
519	INOUT	struct mslsa_name_table name_table;
520
521	IN	WORD lookup_level;
522	INOUT	DWORD mapped_count;
523 	OUT	DWORD status;
524};
525
526OPERATION(LSARPC_OPNUM_CreateSecret)
527struct mslsa_CreateSecret {
528	IN	mslsa_handle_t handle;
529	IN	mslsa_string_t name;
530	IN	DWORD access_mask;
531	OUT	mslsa_handle_t secret_handle;
532	OUT	DWORD status;
533};
534
535/*
536 ***********************************************************************
537 * Definitions for LookupNames.
538 *
539 * LookupNames requires the following input parameters.
540 *
541 *	A valid LSA handle obtained from an LsarOpenPolicy.
542 *	The table of names to be looked up.
543 *	A table of translated sids (probably empty).
544 *	The lookup level (local=1 or PDC=2).
545 *	An enumeration counter (used for continuation operations).
546 *
547 * The outputs are as follows.
548 *
549 *	A table of referenced domains.
550 *	A table of translated sids (actually rids).
551 *	The updated value of the enumeration counter.
552 *	The result status.
553 ***********************************************************************
554 */
555struct mslsa_lup_name_table {
556	DWORD n_entry;
557  SIZE_IS(n_entry)
558	mslsa_string_t names[ANY_SIZE_ARRAY];
559};
560
561
562struct mslsa_rid_entry {
563	WORD sid_name_use;
564	WORD pad;
565	DWORD rid;
566	DWORD domain_index;
567};
568
569
570struct mslsa_rid_table {
571	DWORD n_entry;
572  SIZE_IS(n_entry)
573	struct mslsa_rid_entry *rids;
574};
575
576
577OPERATION(LSARPC_OPNUM_LookupNames)
578struct mslsa_LookupNames {
579	IN	mslsa_handle_t handle;
580	IN	REFERENCE	struct mslsa_lup_name_table *name_table;
581
582	OUT	struct mslsa_domain_table *domain_table;
583	INOUT	struct mslsa_rid_table translated_sids;
584
585	IN	WORD lookup_level;
586	INOUT	DWORD mapped_count;
587	OUT	DWORD status;
588};
589
590
591/*
592 ***********************************************************************
593 * QueryInfoPolicy returns various pieces of policy information. The
594 * desired information is specified using a class value, as defined
595 * below.
596 ***********************************************************************
597 */
598#define MSLSA_POLICY_AUDIT_LOG_INFO		1
599#define MSLSA_POLICY_AUDIT_EVENTS_INFO		2
600#define MSLSA_POLICY_PRIMARY_DOMAIN_INFO	3
601#define MSLSA_POLICY_UNKNOWN_4_INFO		4
602#define MSLSA_POLICY_ACCOUNT_DOMAIN_INFO	5
603#define MSLSA_POLICY_SERVER_ROLE_INFO		6
604#define MSLSA_POLICY_REPLICA_SOURCE_INFO	7
605#define MSLSA_POLICY_DEFAULT_QUOTA_INFO		8
606#define MSLSA_POLICY_DB_INFO			9
607#define MSLSA_POLICY_AUDIT_SET_INFO		10
608#define MSLSA_POLICY_AUDIT_QUERY_INFO		11
609#define MSLSA_POLICY_DNS_DOMAIN_INFO		12
610
611#define	LSA_ROLE_STANDALONE_WORKSTATION		0
612#define	LSA_ROLE_MEMBER_WORKSTATION		1
613#define	LSA_ROLE_STANDALONE_SERVER		2
614#define	LSA_ROLE_MEMBER_SERVER			3
615#define	LSA_ROLE_BACKUP_DC			4
616#define	LSA_ROLE_PRIMARY_DC			5
617
618/*
619 * MSLSA_POLICY_AUDIT_EVENTS_INFO
620 */
621struct mslsa_AuditEventsInfo {
622	DWORD enabled;
623    SIZE_IS (count)
624	DWORD *settings;
625	DWORD count;
626};
627
628/*
629 * MSLSA_POLICY_PRIMARY_DOMAIN_INFO
630 */
631struct mslsa_PrimaryDomainInfo {
632	struct mslsa_string_desc name;
633	struct mslsa_sid *sid;
634};
635
636/*
637 * MSLSA_POLICY_ACCOUNT_DOMAIN_INFO
638 */
639struct mslsa_AccountDomainInfo {
640	struct mslsa_string_desc name;
641	struct mslsa_sid *sid;
642};
643
644/*
645 * MSLSA_POLICY_SERVER_ROLE_INFO
646 */
647struct mslsa_ServerRoleInfo {
648	DWORD role;
649	DWORD pad;
650};
651
652struct mslsa_DnsDomainInfo {
653	struct mslsa_string_desc nb_domain;
654	struct mslsa_string_desc dns_domain;
655	struct mslsa_string_desc forest;
656	struct mslsa_guid guid;
657	struct mslsa_sid *sid;
658};
659
660union mslsa_PolicyInfoResUnion {
661	CASE(2) struct mslsa_AuditEventsInfo audit_events;
662	CASE(3) struct mslsa_PrimaryDomainInfo pd_info;
663	CASE(5) struct mslsa_AccountDomainInfo ad_info;
664	CASE(6) struct mslsa_ServerRoleInfo server_role;
665	CASE(12) struct mslsa_DnsDomainInfo dns_info;
666	DEFAULT	char *nullptr;
667};
668
669/*
670 * This structure needs to be declared, even though it can't be used in
671 * mslsa_QueryInfoPolicy, in order to get the appropriate size to calculate
672 * the correct fixup offsets.  If ndrgen did the right thing,
673 * mslsa_PolicyInfoRes would be one of the out parameters.  However, if
674 * we do it that way, the switch_value isn't known early enough to do
675 * the fixup calculation.  So it all has to go in mslsa_QueryInfoPolicy.
676 */
677struct mslsa_PolicyInfoRes {
678	DWORD address;
679	WORD switch_value;
680    SWITCH(switch_value)
681	union mslsa_PolicyInfoResUnion ru;
682};
683
684OPERATION(LSARPC_OPNUM_QueryInfoPolicy)
685struct mslsa_QueryInfoPolicy {
686	IN	mslsa_handle_t handle;
687	IN	WORD info_class;
688	/*
689	 * Can't use this form because we need to include members explicitly.
690	 * OUT	struct mslsa_PolicyInfoRes result;
691	 */
692	OUT	DWORD address;
693	OUT	WORD switch_value;
694    SWITCH(switch_value)
695	OUT	union mslsa_PolicyInfoResUnion ru;
696	OUT	DWORD status;
697};
698
699
700
701/*
702 ***********************************************************************
703 * OpenAccount.
704 *
705 * Returns a handle that can be used to access the account specified
706 * by a SID. This handle can be used to enumerate account privileges.
707 ***********************************************************************
708 */
709OPERATION(LSARPC_OPNUM_OpenAccount)
710struct mslsa_OpenAccount {
711	IN  mslsa_handle_t handle;
712	IN REFERENCE	struct mslsa_sid *sid;
713	IN	DWORD access_mask;
714	OUT mslsa_handle_t account_handle;
715	OUT DWORD status;
716};
717
718
719
720 /*
721 ***********************************************************************
722 * EnumPrivilegesAccount.
723 *
724 * Enumerate the list of privileges held by the specified account. The
725 * handle must be a valid account handle obtained via OpenAccount. The
726 * luid values returned will be probably only be relevant on the domain
727 * controller so we'll need to find a way to convert them to the
728 * actual privilege names.
729 ***********************************************************************
730 */
731struct mslsa_LuidAndAttributes {
732	struct mslsa_luid luid;
733	DWORD attributes;
734};
735
736
737struct mslsa_PrivilegeSet {
738	DWORD privilege_count;
739	DWORD control;
740  SIZE_IS(privilege_count)
741	struct mslsa_LuidAndAttributes privilege[ANY_SIZE_ARRAY];
742};
743
744
745OPERATION(LSARPC_OPNUM_EnumPrivsAccount)
746	struct mslsa_EnumPrivsAccount {
747	IN	mslsa_handle_t account_handle;
748	OUT	struct mslsa_PrivilegeSet *privileges;
749	OUT	DWORD status;
750};
751
752OPERATION(LSARPC_OPNUM_OpenSecret)
753struct mslsa_OpenSecret {
754	IN	mslsa_handle_t handle;
755	IN	mslsa_string_t name;
756	IN	DWORD access_mask;
757	OUT	mslsa_handle_t secret_handle;
758	OUT	DWORD status;
759};
760
761
762/*
763 ***********************************************************************
764 * LookupPrivValue
765 *
766 * Map a privilege name to a local unique id (LUID). Privilege names
767 * are consistent across the network. LUIDs are machine specific.
768 * The privilege list is provided as a set of LUIDs so the privilege
769 * lookup functions must be used to identify which the privilege to
770 * which each LUID refers. The handle here is a policy handle.
771 ***********************************************************************
772 */
773OPERATION(LSARPC_OPNUM_LookupPrivValue)
774struct mslsa_LookupPrivValue {
775	IN	mslsa_handle_t handle;
776	IN	mslsa_string_t name;
777	OUT	struct mslsa_luid luid;
778	OUT	DWORD status;
779};
780
781
782/*
783 ***********************************************************************
784 * LookupPrivName
785 *
786 * Map a privilege value (LUID) to a privilege name. Privilege names
787 * are consistent across the network. LUIDs are machine specific.
788 * The privilege list is provided as a set of LUIDs so the privilege
789 * lookup functions must be used to identify which the privilege to
790 * which each LUID refers. The handle here is a policy handle.
791 ***********************************************************************
792 */
793OPERATION(LSARPC_OPNUM_LookupPrivName)
794struct mslsa_LookupPrivName {
795	IN	mslsa_handle_t handle;
796	IN	struct mslsa_luid luid;
797	OUT	mslsa_string_t *name;
798	OUT	DWORD status;
799};
800
801
802/*
803 ***********************************************************************
804 * LookupPrivDisplayName
805 *
806 * Map a privilege name to a local unique id (LUID). Privilege names
807 * are consistent across the network. LUIDs are machine specific.
808 * The privilege list is provided as a set of LUIDs so the privilege
809 * lookup functions must be used to identify which the privilege to
810 * which each LUID refers. The handle here is a policy handle.
811 ***********************************************************************
812 */
813OPERATION(LSARPC_OPNUM_LookupPrivDisplayName)
814struct mslsa_LookupPrivDisplayName {
815	IN	mslsa_handle_t handle;
816	IN	mslsa_string_t name;
817	IN	WORD client_language;
818	IN	WORD default_language;
819	OUT	mslsa_string_t *display_name;
820	OUT	WORD language_ret;
821	OUT	DWORD status;
822};
823
824
825/*
826 ***********************************************************************
827 * GetConnectedUser
828 *
829 * Return the account name and NetBIOS domain name for the user making
830 * the request.  All input fields should be ignored by the server.
831 ***********************************************************************
832 */
833struct mslsa_DomainName {
834	struct mslsa_string_desc *name;
835};
836
837
838OPERATION(LSARPC_OPNUM_GetConnectedUser)
839struct mslsa_GetConnectedUser {
840	IN	LPTSTR hostname;
841	IN	BYTE *owner_in;
842	IN	BYTE *domain_in;
843	OUT	struct mslsa_string_desc *owner;
844	OUT	struct mslsa_DomainName *domain;
845	OUT	DWORD status;
846};
847
848
849/*
850 ***********************************************************************
851 * LSARPC_OPNUM_LookupSids2
852 *
853 * SID lookup function that appeared in Windows 2000. It appears to be
854 * very similar to the original SID lookup RPC. There are two extra IN
855 * parameters, which we don't care about. The OUT name structure has
856 * an extra field, in which zero seems to be okay.
857 ***********************************************************************
858 */
859struct lsar_name_entry2 {
860	WORD sid_name_use;
861	WORD padding;
862	mslsa_string_t name;
863	DWORD domain_ix;	/* -1 means none */
864	DWORD flags;
865};
866typedef struct lsar_name_entry2 lsar_translated_name_ex_t;
867
868struct lsar_name_table2 {
869	DWORD n_entry;
870  SIZE_IS(n_entry)
871	struct lsar_name_entry2 *entries;
872};
873typedef struct lsar_name_table2 lsar_translated_names_ex_t;
874
875OPERATION(LSARPC_OPNUM_LookupSids2)
876struct lsar_lookup_sids2 {
877	IN		mslsa_handle_t policy_handle;
878	IN		struct mslsa_lup_sid_table lup_sid_table;
879	OUT		struct mslsa_domain_table *domain_table;
880	INOUT	struct lsar_name_table2 name_table;
881	IN		WORD lookup_level;
882	INOUT	DWORD mapped_count;
883	IN		DWORD lookup_options;
884	IN		DWORD client_revision;
885 	OUT		DWORD status;
886};
887
888OPERATION(LSARPC_OPNUM_LookupSids3)
889struct lsar_lookup_sids3 {
890	IN		struct mslsa_lup_sid_table	lup_sid_table;
891	OUT		struct mslsa_domain_table	*domain_table;
892	INOUT		lsar_translated_names_ex_t	name_table;
893	IN		WORD				lookup_level;
894	INOUT		DWORD				mapped_count;
895	IN		DWORD				lookup_options;
896	IN		DWORD				client_revision;
897 	OUT		DWORD				status;
898};
899
900/*
901 ***********************************************************************
902 * LSARPC_OPNUM_LookupNames2
903 *
904 * Name lookup function that appeared in Windows 2000. It appears to be
905 * very similar to the original name lookup RPC. There are two extra IN
906 * parameters, which we don't care about. The lsar_rid_entry2 structure
907 * has an extra field, in which zero seems to be okay.
908 ***********************************************************************
909 */
910struct lsar_rid_entry2 {
911	WORD sid_name_use;
912	WORD pad;
913	DWORD rid;
914	DWORD domain_index;	/* -1 means none */
915	DWORD flags;
916};
917
918
919struct lsar_rid_table2 {
920	DWORD n_entry;
921  SIZE_IS(n_entry)
922	struct lsar_rid_entry2 *rids;
923};
924
925
926OPERATION(LSARPC_OPNUM_LookupNames2)
927struct lsar_LookupNames2 {
928	IN		mslsa_handle_t policy_handle;
929	IN	REFERENCE	struct mslsa_lup_name_table *name_table;
930	OUT		struct mslsa_domain_table *domain_table;
931	INOUT	struct lsar_rid_table2 translated_sids;
932	IN		WORD lookup_level;
933	INOUT	DWORD mapped_count;
934	IN		DWORD lookup_options;
935	IN		DWORD client_revision;
936	OUT		DWORD status;
937};
938
939struct lsar_translated_sid_ex2 {
940	WORD			sid_name_use;
941	WORD			pad;
942	struct mslsa_sid	*sid;
943	DWORD			domain_index;	/* -1 means none */
944	DWORD			flags;
945};
946typedef struct lsar_translated_sid_ex2 lsar_translated_sid_ex2_t;
947
948struct lsar_sid_ex2_table {
949	DWORD			n_entry;
950  SIZE_IS(n_entry)
951	struct lsar_translated_sid_ex2	*sids;
952};
953typedef struct lsar_sid_ex2_table lsar_sid_ex2_table_t;
954
955OPERATION(LSARPC_OPNUM_LookupNames3)
956struct lsar_LookupNames3 {
957	IN		mslsa_handle_t			policy_handle;
958	IN REFERENCE	struct mslsa_lup_name_table	*name_table;
959	OUT		struct mslsa_domain_table	*domain_table;
960	INOUT		struct lsar_sid_ex2_table	translated_sids;
961	IN		WORD				lookup_level;
962	INOUT		DWORD				mapped_count;
963	IN		DWORD				lookup_options;
964	IN		DWORD				client_revision;
965	OUT		DWORD				status;
966};
967
968OPERATION(LSARPC_OPNUM_LookupNames4)
969struct lsar_LookupNames4 {
970	IN REFERENCE	struct mslsa_lup_name_table	*name_table;
971	OUT		struct mslsa_domain_table	*domain_table;
972	INOUT		struct lsar_sid_ex2_table	translated_sids;
973	IN		WORD				lookup_level;
974	INOUT		DWORD				mapped_count;
975	IN		DWORD				lookup_options;
976	IN		DWORD				client_revision;
977	OUT		DWORD				status;
978};
979
980/*
981 ***********************************************************************
982 * The LSARPC interface definition.
983 ***********************************************************************
984 */
985INTERFACE(0)
986union lsarpc_interface {
987	CASE(LSARPC_OPNUM_CloseHandle)
988		struct mslsa_CloseHandle		CloseHandle;
989	CASE(LSARPC_OPNUM_QuerySecurityObject)
990		struct mslsa_QuerySecurityObject	QuerySecurityObj;
991	CASE(LSARPC_OPNUM_EnumerateAccounts)
992		struct mslsa_EnumerateAccounts		EnumAccounts;
993	CASE(LSARPC_OPNUM_EnumTrustedDomainsEx)
994		struct mslsa_EnumTrustedDomainEx	EnumTrustedDomainEx;
995	CASE(LSARPC_OPNUM_EnumTrustedDomain)
996		struct mslsa_EnumTrustedDomain		EnumTrustedDomain;
997	CASE(LSARPC_OPNUM_OpenAccount)
998		struct mslsa_OpenAccount		OpenAccount;
999	CASE(LSARPC_OPNUM_EnumPrivsAccount)
1000		struct mslsa_EnumPrivsAccount		EnumPrivsAccount;
1001	CASE(LSARPC_OPNUM_LookupPrivValue)
1002		struct mslsa_LookupPrivValue		LookupPrivValue;
1003	CASE(LSARPC_OPNUM_LookupPrivName)
1004		struct mslsa_LookupPrivName		LookupPrivName;
1005	CASE(LSARPC_OPNUM_LookupPrivDisplayName)
1006		struct mslsa_LookupPrivDisplayName	LookupPrivDisplayName;
1007	CASE(LSARPC_OPNUM_CreateSecret)
1008		struct mslsa_CreateSecret		CreateSecret;
1009	CASE(LSARPC_OPNUM_OpenSecret)
1010		struct mslsa_OpenSecret			OpenSecret;
1011	CASE(LSARPC_OPNUM_QueryInfoPolicy)
1012		struct mslsa_QueryInfoPolicy		QueryInfoPolicy;
1013	CASE(LSARPC_OPNUM_OpenPolicy)
1014		struct mslsa_OpenPolicy			OpenPolicy;
1015	CASE(LSARPC_OPNUM_OpenPolicy2)
1016		struct mslsa_OpenPolicy2		OpenPolicy2;
1017	CASE(LSARPC_OPNUM_LookupSids)
1018		struct mslsa_LookupSids			LookupSids;
1019	CASE(LSARPC_OPNUM_LookupNames)
1020		struct mslsa_LookupNames		LookupNames;
1021	CASE(LSARPC_OPNUM_GetConnectedUser)
1022		struct mslsa_GetConnectedUser		GetConnectedUser;
1023	CASE(LSARPC_OPNUM_LookupSids2)
1024		struct lsar_lookup_sids2		LookupSids2;
1025	CASE(LSARPC_OPNUM_LookupSids3)
1026		struct lsar_lookup_sids3		LookupSids3;
1027	CASE(LSARPC_OPNUM_LookupNames2)
1028		struct lsar_LookupNames2		LookupNames2;
1029	CASE(LSARPC_OPNUM_LookupNames3)
1030		struct lsar_LookupNames3		LookupNames3;
1031	CASE(LSARPC_OPNUM_LookupNames4)
1032		struct lsar_LookupNames4		LookupNames4;
1033};
1034typedef union lsarpc_interface	lsarpc_interface_t;
1035EXTERNTYPEINFO(lsarpc_interface)
1036
1037#endif /* _MLSVC_LSA_NDL_ */
1038