1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2012 Nexenta Systems, Inc. All rights reserved. 23 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 * 26 * Copyright 2015 Nexenta Systems, Inc. All rights reserved. 27 */ 28 29 #ifndef _SMB_TOKEN_H 30 #define _SMB_TOKEN_H 31 32 #include <smbsrv/netrauth.h> 33 #include <smbsrv/smb_privilege.h> 34 #include <smbsrv/smb_sid.h> 35 36 #ifdef __cplusplus 37 extern "C" { 38 #endif 39 40 /* 41 * 32-bit opaque buffer (non-null terminated strings) 42 * See also: smb_buf32_xdr() 43 */ 44 typedef struct smb_buf32 { 45 uint32_t len; 46 uint8_t *val; 47 } smb_buf32_t; 48 49 /* 50 * Access Token 51 * 52 * An access token identifies a user, the user's privileges and the 53 * list of groups of which the user is a member. This information is 54 * used when access is requested to an object by comparing this 55 * information with the DACL in the object's security descriptor. 56 * 57 * There should be one unique token per user per session per client. 58 * 59 * Access Token Flags 60 * 61 * SMB_ATF_GUEST Token belongs to guest user 62 * SMB_ATF_ANON Token belongs to anonymous user 63 * and it's only good for IPC Connection. 64 * SMB_ATF_POWERUSER Token belongs to a Power User member 65 * SMB_ATF_BACKUPOP Token belongs to a Power User member 66 * SMB_ATF_ADMIN Token belongs to a Domain Admins member 67 */ 68 #define SMB_ATF_GUEST 0x00000001 69 #define SMB_ATF_ANON 0x00000002 70 #define SMB_ATF_POWERUSER 0x00000004 71 #define SMB_ATF_BACKUPOP 0x00000008 72 #define SMB_ATF_ADMIN 0x00000010 73 74 #define SMB_POSIX_GRPS_SIZE(n) \ 75 (sizeof (smb_posix_grps_t) + (n - 1) * sizeof (gid_t)) 76 /* 77 * It consists of the primary and supplementary POSIX groups. 78 */ 79 typedef struct smb_posix_grps { 80 uint32_t pg_ngrps; 81 gid_t pg_grps[ANY_SIZE_ARRAY]; 82 } smb_posix_grps_t; 83 84 typedef struct smb_token { 85 smb_id_t tkn_user; 86 smb_id_t tkn_owner; 87 smb_id_t tkn_primary_grp; 88 smb_ids_t tkn_win_grps; 89 smb_privset_t *tkn_privileges; 90 char *tkn_account_name; 91 char *tkn_domain_name; 92 uint32_t tkn_flags; 93 uint32_t tkn_audit_sid; 94 smb_buf32_t tkn_ssnkey; 95 smb_posix_grps_t *tkn_posix_grps; 96 } smb_token_t; 97 98 /* 99 * Details required to authenticate a user. 100 */ 101 typedef struct smb_logon { 102 uint16_t lg_level; 103 char *lg_username; /* requested username */ 104 char *lg_domain; /* requested domain */ 105 char *lg_e_username; /* effective username */ 106 char *lg_e_domain; /* effective domain */ 107 char *lg_workstation; 108 smb_inaddr_t lg_clnt_ipaddr; 109 smb_inaddr_t lg_local_ipaddr; 110 uint16_t lg_local_port; 111 smb_buf32_t lg_challenge_key; 112 smb_buf32_t lg_nt_password; 113 smb_buf32_t lg_lm_password; 114 uint32_t lg_ntlm_flags; 115 int lg_native_os; 116 int lg_native_lm; 117 uint32_t lg_flags; 118 uint32_t lg_logon_id; /* filled in user space */ 119 uint32_t lg_domain_type; /* filled in user space */ 120 uint32_t lg_secmode; /* filled in user space */ 121 uint32_t lg_status; /* filled in user space */ 122 } smb_logon_t; 123 124 /* 125 * This is the name of the local (AF_UNIX) socket 126 * where the SMB auth. service listens. 127 */ 128 #define SMB_AUTHSVC_SOCKNAME "/var/smb/lipc/smbauth" 129 130 /* 131 * Maximum number of authentcation conversations at one time. 132 * Note this is _NOT_ the max. number of logged on users, 133 * which can be much larger. 134 */ 135 #define SMB_AUTHSVC_MAXTHREAD 256 136 137 /* 138 * Messages to and from the local security authority 139 * Type codes: 140 */ 141 typedef enum smb_lsa_mtype { 142 /* reply types */ 143 LSA_MTYPE_OK = 0, 144 LSA_MTYPE_ERROR, 145 LSA_MTYPE_ES_DONE, /* ext. sec: authenticated */ 146 LSA_MTYPE_ES_CONT, /* more processing required */ 147 LSA_MTYPE_TOKEN, /* smb_token_t */ 148 149 /* request types */ 150 LSA_MTYPE_OLDREQ, /* non-ext. sec. session setup */ 151 LSA_MTYPE_CLINFO, /* client info sent at start of ES */ 152 LSA_MTYPE_ESFIRST, /* spnego initial message */ 153 LSA_MTYPE_ESNEXT, /* spnego continuation */ 154 LSA_MTYPE_GETTOK /* after ES auth, get token */ 155 } smb_lsa_mtype_t; 156 157 /* 158 * msg: header common to all message types 159 */ 160 typedef struct smb_lsa_msg_hdr { 161 uint32_t lmh_msgtype; /* smb_lsa_mtype_t */ 162 uint32_t lmh_msglen; /* size of what follows */ 163 } smb_lsa_msg_hdr_t; 164 165 /* 166 * eresp: error response 167 * msgtype: LSA_MTYPE_ERESP 168 */ 169 typedef struct smb_lsa_eresp { 170 uint32_t ler_ntstatus; 171 uint16_t ler_errclass; 172 uint16_t ler_errcode; 173 } smb_lsa_eresp_t; 174 175 /* 176 * Message for LSA_MTYPE_CLINFO 177 */ 178 typedef struct smb_lsa_clinfo { 179 smb_inaddr_t lci_clnt_ipaddr; 180 unsigned char lci_challenge_key[8]; 181 int lci_native_os; 182 int lci_native_lm; 183 } smb_lsa_clinfo_t; 184 185 struct XDR; 186 int smb_logon_xdr(struct XDR *, smb_logon_t *); 187 int smb_token_xdr(struct XDR *, smb_token_t *); 188 189 #if defined(_KERNEL) || defined(_FAKE_KERNEL) 190 void smb_token_free(smb_token_t *); 191 #else /* _KERNEL */ 192 smb_token_t *smb_logon(smb_logon_t *); 193 void smb_logon_abort(void); 194 void smb_token_destroy(smb_token_t *); 195 uint8_t *smb_token_encode(smb_token_t *, uint32_t *); 196 void smb_token_log(smb_token_t *); 197 smb_logon_t *smb_logon_decode(uint8_t *, uint32_t); 198 void smb_logon_free(smb_logon_t *); 199 #endif /* _KERNEL */ 200 201 int smb_token_query_privilege(smb_token_t *token, int priv_id); 202 boolean_t smb_token_valid(smb_token_t *); 203 204 #ifdef __cplusplus 205 } 206 #endif 207 208 #endif /* _SMB_TOKEN_H */ 209