/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
*/
#ifndef _LIBSMB_H
#define _LIBSMB_H
#ifdef __cplusplus
extern "C" {
#endif
#include <netdb.h>
#include <stdlib.h>
#include <libscf.h>
#include <synch.h>
#include <fcntl.h>
#include <thread.h>
#include <smbsrv/smb_idmap.h>
#include <smbsrv/smb_share.h>
#include <smb/ntstatus.h>
#include <smbsrv/smb_door.h>
#include <smb/wintypes.h>
#include <smbsrv/netrauth.h>
/* Max value length of all SMB properties */
#define SMBD_SMF_OK 0
#define SCH_STATE_UNINIT 0
typedef struct smb_scfhandle {
int scf_state;
/*
* SMB Configuration Management
*/
typedef enum {
SMB_CI_VERSION = 0,
} smb_cfg_id_t;
/* SMF helper functions */
extern smb_scfhandle_t *smb_smf_scf_init(char *);
extern void smb_smf_scf_fini(smb_scfhandle_t *);
extern int smb_smf_start_transaction(smb_scfhandle_t *);
extern int smb_smf_end_transaction(smb_scfhandle_t *);
extern int smb_smf_set_string_property(smb_scfhandle_t *, char *, char *);
extern int smb_smf_get_string_property(smb_scfhandle_t *, char *,
char *, size_t);
extern int smb_smf_set_opaque_property(smb_scfhandle_t *, char *,
void *, size_t);
extern int smb_smf_get_opaque_property(smb_scfhandle_t *, char *,
void *, size_t);
extern int smb_smf_create_service_pgroup(smb_scfhandle_t *, char *);
extern int smb_smf_instance_create(smb_scfhandle_t *, char *, char *);
extern int smb_smf_instance_delete(smb_scfhandle_t *, char *);
extern int smb_smf_create_instance_pgroup(smb_scfhandle_t *, char *);
extern int smb_smf_delete_instance_pgroup(smb_scfhandle_t *, char *);
extern int smb_smf_delete_property(smb_scfhandle_t *, char *);
extern int smb_smf_restart_service(void);
extern int smb_smf_maintenance_mode(void);
/* ZFS interface */
int smb_getdataset(const char *, char *, size_t);
int smb_getmountpoint(const char *, char *, size_t);
/* Configuration management functions */
extern int smb_config_get(smb_cfg_id_t, char *, int);
extern char *smb_config_getname(smb_cfg_id_t);
extern int smb_config_getstr(smb_cfg_id_t, char *, int);
extern int smb_config_set(const char *, const char *);
extern int smb_config_setstr(smb_cfg_id_t, char *);
extern char *smb_config_get_localsid(void);
extern int smb_config_secmode_fromstr(char *);
extern char *smb_config_secmode_tostr(int);
extern int smb_config_get_secmode(void);
extern int smb_config_set_secmode(int);
extern int smb_config_set_idmap_domain(char *);
extern void smb_config_get_version(smb_version_t *);
extern boolean_t smb_match_netlogon_seqnum(void);
extern int smb_setdomainprops(char *, char *, char *);
extern int smb_set_machine_passwd(char *);
extern int smb_get_machine_passwd(char *, size_t);
extern void smb_update_netlogon_seqnum(void);
/* maximum password length on Windows 2000 and above */
/*
* Machine trust account
*
* m_flags - values for machine account flags are:
*
* SMB_MACHINE_ACCT_PRECREATED: Machine account is manually created on
* the DC by an admin.
* SMB_MACHINE_ACCT_AUTO_CREATED: Machine account is automatically created
* by the domain join operation
* SMB_MACHINE_ACCT_PASSWD_PROTECTED: Machine password has been set on the
* account.
* SMB_MACHINE_CRED_READY: Operations can be performed using
* system's credentials.
*
* m_dn - distinguished name for the machiine account
* m_passwd - machine account password
*/
typedef struct smb_machine_acct {
/*
* Results from locating machine account
*
* l_status - SMB_JOIN_ERR_XXX error code
*/
typedef struct smb_locate_acct_res {
/* possible values for j_nameformat field of smb_joininfo_t */
#define SMB_NAME_NETBIOS 0
/*
* smb_joininfo_t contains information that is needed for smbd to process the
* following requests:
*
* (1) DC discovery
* (2) Joining the local host to a workgroup
* (3) Joining the local host to a domain
*
* j_mode: security mode (workgroup vs domain) [for (2) and (3)]
* j_name_format: indicates which name format (NETBIOS or FQDN) the user
* specified at domain join time.
* j_wkgrp: If joining the system to a workgroup, the domain join
* utility should set j_wkgrp to be the name of the
* workgroup. If joining the system to an AD domain, the
* domain join utility should set j_wkgrp to be the name
* of the previously configured workgroup.
*
* This is for restoring nb_domain property upon a domain
* join failure. [for (2) and (3)]
* j_nbdomain: NetBIOS name of a domain [for all three requests]
* j_fqdomain: Fully qualified name of a domain [for all three
* requests]
* j_username: user account used for domain join [for (1) and (3)]
* j_passwd: password for the specified user [for (1) and (3)]
* j_dc: fully-qualified name of the selected domain controller
* [for (3)]
* j_adjoin: AD-style vs NT-style domain join [for (3)]
* j_ou: distinguished name of the specified OU
* j_account: points to the smb_machine_acct_t object returned by
* smb_locate_machine_account().
* j_ctx: Not pass through Solaris door (used only by smbd)
* TODO: we may consider to make this a union when
* adding the NT-style domain join support.
*/
typedef struct smb_joininfo {
void *j_ctx;
/*
* The possible return status of the adjoin routine.
*/
typedef enum smb_join_status {
SMB_JOIN_SUCCESS = 0,
/*
* DC discovery results
*
* r_ntstatus: status of the DC discovery. If the DC discovery is successful,
* NT_STATUS_SUCCESS will be returned along with the following
* discovery results.
* r_nbdomain: the NetBIOS name of the domain which the discovered DC is
* serving
* r_fqdomain: the fully-qualified name of the domain which the discovered DC
* is serving
* r_dc: discovered DC
*/
typedef struct smb_discovery_res {
/*
* APIs to communicate with SMB daemon via door calls
*
* Consumers:
* 1) smbadm CLI
*/
extern int smb_locate_machine_account(const smb_joininfo_t *,
extern int smb_join_start(void);
extern int smb_join_end(void);
extern void smb_joininfo_init_wkgrp(const char *, smb_joininfo_t *);
extern void smb_joininfo_update_domain(smb_joininfo_t *,
const smb_discovery_res_t *);
/* For ZFSSA only */
extern boolean_t smb_find_ads_server(char *, char *, int);
uint32_t smb_share_publish_admin(const char *);
/* supported namespace types */
#define SMB_NS_ANY 0
int smb_ns_create(const char *, const char *, int);
int smb_ns_destroy(const char *, int);
extern void smb_config_getdomaininfo(char *, char *, char *, char *, char *);
extern void smb_config_setdomaininfo(char *, char *, char *, char *, char *);
int smb_config_getdc(char *, size_t);
int smb_config_setdc(char *);
int smb_config_getdsattr(const char *, int64_t *);
void smb_config_setdsattr(const char *, int64_t);
void smb_idmap_check(const char *, idmap_stat);
/*
* The DC failover service will ensure an alternative DC is reachable before
* setting it as the newly selected DC. However, the newly selected DC may
* have gone down between the time the DC failover service checks for aliveness
* and the time that the DC failure reporter makes its request.
*
* A DC failure reporter should account for the specified number of DC failures
* and retry an outgoing request as needed.
*/
void smb_dc_info_init(void);
void smb_dc_report_failure(char *, char *);
void smb_dc_await_failure(void);
boolean_t smb_dc_need_reselection(void);
void smb_dc_ignore_failure(void);
void smb_dc_reselecting(void);
void smb_dc_reselected(boolean_t);
void smb_dc_await_reselection(void);
/* Miscellaneous functions */
extern boolean_t smb_strcaseendswith(const char *, const char *);
extern void hexdump(unsigned char *, int);
extern char *strstrip(char *, const char *);
extern char *strtrim(char *, const char *);
extern char *trim_whitespace(char *);
extern void randomize(char *, unsigned);
extern int smb_get_dns_suffix(char *, size_t);
extern int smb_getdomainname_nb(char *, size_t);
extern int smb_getdomainname_ad(char *, size_t);
extern int smb_getdomainname_resolv(char *, size_t);
extern int smb_getdomainname_dns(char *, size_t);
typedef enum smb_caseconv {
SMB_CASE_PRESERVE = 0,
extern int smb_getfqhostname(char *, size_t);
extern int smb_getnetbiosname(char *, size_t);
extern struct hostent *smb_gethostbyname(const char *, int *);
extern struct hostent *smb_gethostbyaddr(const char *, int *);
extern int smb_getsamaccount(char *, size_t);
extern boolean_t smb_is_samaccount(char *);
extern int smb_get_nameservers(smb_inaddr_t *, int);
extern void smb_tonetbiosname(char *, char *, char);
extern int smb_chk_hostaccess(smb_inaddr_t *, char *);
extern int smb_getnameinfo(smb_inaddr_t *, char *, int, int);
void smb_trace(const char *s);
void smb_tracef(const char *fmt, ...);
const char *xlate_nt_status(unsigned int);
/*
* Authentication
*/
/*
* session response user session key. It shouldn't be used to represent the
* length of any Kerberos session key, since that varies in length depending
* upon which cryptographical algorithm is used.
*/
#define SMBAUTH_SUCCESS 0
/* Default revision number (common between client and server) */
/* SMB client's revisions */
/* SMB server's revisions */
int smb_revision_cmp(char *, smb_cfg_id_t);
/*
* Name Types
*
* The list of names near the end of the data blob (i.e. the ndb_names
* field of the smb_auth_data_blob_t data structure) can be classify into
* the following types:
*
* 0x0000 Indicates the end of the list.
* 0x0001 The name is a NetBIOS machine name (e.g. server name)
* 0x0002 The name is an NT Domain NetBIOS name.
* 0x0003 The name is the server's DNS hostname.
* 0x0004 The name is a W2K Domain name (a DNS name).
*/
/*
* smb_auth_name_entry_t
*
* Each name entry in the data blob consists of the following 3 fields:
*
* nne_type - name type
* nne_len - the length of the name
* nne_name - the name, in uppercase UCS-2LE Unicode format
*/
typedef struct smb_auth_name_entry {
unsigned short nne_type;
unsigned short nne_len;
/*
* smb_auth_data_blob
*
* The format of this NTLMv2 data blob structure is as follow:
*
* - Blob Signature 0x01010000 (4 bytes)
* - Reserved (0x00000000) (4 bytes)
* - Timestamp Little-endian, 64-bit signed value representing
* the number of tenths of a microsecond since January 1, 1601.
* (8 bytes)
* - Client Challenge (8 bytes)
* - Unknown1 (4 bytes)
* - List of Target Information (variable length)
* - Unknown2 (4 bytes)
*/
typedef struct smb_auth_data_blob {
/*
* smb_auth_info_t
*
* The structure contains all the authentication information
* needed for the preparaton of the SMBSessionSetupAndx request
* and the user session key.
*
* hash - NTLM hash
* hash_v2 - NTLMv2 hash
* ci_len - the length of the case-insensitive password
* ci - case-insensitive password
* (If NTLMv2 authentication mechanism is used, it
* represents the LMv2 response. Otherwise, it
* is empty.)
* cs_len - the length of the case-sensitive password
* cs - case-sensitive password
* (If NTLMv2 authentication mechanism is used, it
* represents the NTLMv2 response. Otherwise, it
* represents the NTLM response.)
* data_blob - NTLMv2 data blob
*/
typedef struct smb_auth_info {
unsigned short ci_len;
unsigned short cs_len;
int lmcompatibility_lvl;
/*
* SMB password management
*/
typedef struct smb_passwd {
} smb_passwd_t;
/*
* Control flags passed to smb_pwd_setcntl
*/
#define SMB_PWE_SUCCESS 0
typedef struct smb_pwditer {
void *spi_next;
typedef struct smb_luser {
char *su_name;
char *su_fullname;
char *su_desc;
} smb_luser_t;
extern void smb_pwd_init(boolean_t);
extern void smb_pwd_fini(void);
extern int smb_pwd_setpasswd(const char *, const char *);
extern int smb_pwd_setcntl(const char *, int);
extern int smb_pwd_iteropen(smb_pwditer_t *);
extern void smb_pwd_iterclose(smb_pwditer_t *);
/*
* A variation on HMAC-MD5 known as HMACT64 is used by Windows systems.
* The HMACT64() function is the same as the HMAC-MD5() except that
* it truncates the input key to 64 bytes rather than hashing it down
* to 16 bytes using the MD5() function.
*/
extern int smb_auth_DES(unsigned char *, int, unsigned char *, int,
unsigned char *, int);
extern int smb_auth_md4(unsigned char *, const unsigned char *, int);
extern int smb_auth_md5(unsigned char *, const unsigned char *, int);
extern int smb_auth_hmac_md5(const unsigned char *, int, const unsigned char *,
int, unsigned char *);
extern int smb_auth_lm_hash(const char *, unsigned char *);
extern int smb_auth_ntlm_hash(const char *, unsigned char *);
extern int smb_auth_ntlmv2_hash(unsigned char *, char *, char *,
unsigned char *);
extern int
smb_auth_ntlm2_session_response(unsigned char *, int, const unsigned char *,
int, unsigned char *, int);
extern int
smb_auth_ntlm2_usr_ssn_key(const unsigned char *, const unsigned char *,
unsigned char *);
extern int smb_auth_set_info(char *, char *,
unsigned char *, char *, unsigned char *,
int, int, smb_auth_info_t *);
extern int smb_auth_gen_session_key(smb_auth_info_t *, unsigned char *);
unsigned char *, int, char *, char *);
unsigned char *, int, char *, char *, unsigned char *, int, uchar_t *);
extern int smb_auth_qnd_unicode(smb_wchar_t *, const char *, int);
/*
* SMB authenticated IPC
*/
extern void smb_ipc_commit(void);
extern void smb_ipc_get_user(char *, size_t);
extern void smb_ipc_init(void);
extern void smb_ipc_rollback(void);
extern int smb_ipc_set(const char *, const char *);
extern boolean_t smb_ipc_get_ctx(void);
extern void smb_ipc_set_ctx(boolean_t);
/*
* SMB MAC Signing
*/
/*
* SMB_MAC_KEY_MAXLEN - maximum length of a MAC key
*
* The length of a MAC key varies depending upon which authentication
* mechanism is used.
*
* key (16 bytes) and the challenge response.
*
* For Kerberos, the MAC key is basically the session key that can be
* extracted from the GSS context. The maximum length is 32 bytes if
* the associated enctype is AES-256.
*/
/*
* Signing flags:
*
* SMB_SCF_ENABLE Signing is enabled.
*
* SMB_SCF_REQUIRED Signing is enabled and required.
* This flag shouldn't be set if
* SMB_SCF_ENABLE isn't set.
*
* SMB_SCF_STARTED Signing will start after receiving
* the first non-anonymous SessionSetup
* request.
*
* SMB_SCF_KEY_ISSET_THIS_LOGON Indicates whether the MAC key has just
* been set for this logon. (prior to
* sending the SMBSessionSetup request)
*
*/
/*
* smb_sign_ctx
*
* SMB signing context.
*
* ssc_seqnum sequence number
* ssc_keylen mac key length
* ssc_mid multiplex id - reserved
* ssc_flags flags
* ssc_mackey mac key
* ssc_sign mac signature
*
*/
typedef struct smb_sign_ctx {
unsigned int ssc_seqnum;
unsigned short ssc_keylen;
unsigned short ssc_mid;
unsigned int ssc_flags;
/*
* Each domain is categorized using the enum values below.
* The local domain refers to the local machine and is named
* after the local hostname. The primary domain is the domain
* that the system joined. All other domains are either
* trusted or untrusted, as defined by the primary domain PDC.
*/
typedef enum smb_domain_type {
/*
* Information specific to trusted domains
*/
typedef struct smb_domain_trust {
/*
* DNS information for domain types that this info is
* for the primary domain.
*/
typedef struct smb_domain_dns {
/*
* This is the information that is held about each domain.
*/
typedef struct smb_domain {
union {
} di_u;
} smb_domain_t;
typedef struct smb_trusted_domains {
#define SMB_DOMAIN_SUCCESS 0
/*
* This structure could contain information about
* the primary domain the name of selected domain controller
* for the primary domain and a list of trusted domains if
* any. The "ex" in the structure name stands for extended.
* This is to differentiate this structure from smb_domain_t
* which only contains information about a single domain.
*/
typedef struct smb_domainex {
void smb_domain_init(void);
void smb_domain_fini(void);
boolean_t smb_domain_setdc(char *);
void smb_domain_update(smb_domainex_t *);
void smb_domain_end_read_delay(void);
uint32_t smb_domain_start_update(void);
void smb_domain_end_update(void);
void smb_domain_set_basic_info(char *, char *, char *, smb_domain_t *);
void smb_domain_set_dns_info(char *, char *, char *, char *, char *,
smb_domain_t *);
void smb_domain_set_trust_info(char *, char *, char *,
void smb_domains_info_free(list_t *);
void smb_domainjoin_start(void);
void smb_domainjoin_end(void);
typedef struct smb_gsid {
} smb_gsid_t;
/*
* This is opaque group iterator handle for SMB local group iteration. The
* implementation of this handle can be found in struct smb_giter in smb_lgrp.c.
*/
typedef struct smb_group {
char *sg_name;
char *sg_cmnt;
} smb_group_t;
int smb_lgrp_start(void);
void smb_lgrp_stop(void);
int smb_lgrp_add(char *, char *);
int smb_lgrp_rename(char *, char *);
int smb_lgrp_delete(char *);
int smb_lgrp_setcmnt(char *, char *);
int smb_lgrp_getcmnt(char *, char **);
int smb_lgrp_getbyname(char *, smb_group_t *);
void smb_lgrp_free(smb_group_t *);
char *smb_lgrp_strerror(int);
int smb_lgrp_iteropen(smb_giter_t **);
void smb_lgrp_iterclose(smb_giter_t *);
int smb_lookup_sid(const char *, lsa_account_t *);
#define SMB_LGRP_SUCCESS 0
/*
* values for smb_nic_t.smbflags
*/
/*
* smb_nic_t
* nic_host actual host name
* nic_nbname 16-byte NetBIOS host name
*/
typedef struct {
} smb_nic_t;
typedef struct smb_niciter {
int ni_cookie;
int ni_seqnum;
/* NIC config functions */
int smb_nic_init(void);
void smb_nic_fini(void);
int smb_nic_getnum(char *);
int smb_nic_addhost(const char *, const char *, int, const char **);
int smb_nic_delhost(const char *);
int smb_nic_getfirst(smb_niciter_t *);
int smb_nic_getnext(smb_niciter_t *);
#define SMB_NIC_SUCCESS 0
/*
* Well-known account structure
*
* A security identifier (SID) is a unique value of variable length that
* is used to identify a security principal or security group in
* Windows. Well-known SIDs are a group of SIDs that identify generic
* users or generic groups. Their values remain constant across all
* operating systems.
*
* This structure is defined to store these SIDs and other related
* information about them (e.g. account and domain names) in a
* predefined table.
*/
typedef struct smb_wka {
char *wka_sid;
char *wka_name;
char *wka_desc;
} smb_wka_t;
/*
* Defined values for smb_wka.wka_flags
*
* SMB_WKAFLG_LGRP_ENABLE Can be added as local group
*/
/*
* Well-known account interfaces
*/
smb_wka_t *smb_wka_lookup_builtin(const char *);
smb_wka_t *smb_wka_lookup_name(const char *);
smb_sid_t *smb_wka_get_sid(const char *);
char *smb_wka_get_domain(int);
/*
* In memory account representation
*/
typedef struct smb_account {
char *a_name;
char *a_domain;
int smb_sam_usr_cnt(void);
void smb_account_free(smb_account_t *);
/*
* Security Descriptor functions.
*/
/* Kernel Module Interface */
int smb_kmod_bind(void);
boolean_t smb_kmod_isbound(void);
int smb_kmod_setcfg(smb_kmod_cfg_t *);
int smb_kmod_setgmtoff(int32_t);
int smb_kmod_start(int, int);
void smb_kmod_online(void);
void smb_kmod_stop(void);
void smb_kmod_unbind(void);
int smb_kmod_get_open_num(smb_opennum_t *);
int smb_kmod_enum(smb_netsvc_t *);
void smb_kmod_enum_fini(smb_netsvc_t *);
int smb_kmod_session_close(const char *, const char *);
int smb_kmod_file_close(uint32_t);
int smb_kmod_share_lookup(const char *, int, smb_share_t *);
void smb_name_parse(char *, char **, char **);
uint32_t smb_name_validate_share(const char *);
uint32_t smb_name_validate_account(const char *);
uint32_t smb_name_validate_domain(const char *);
uint32_t smb_name_validate_nbdomain(const char *);
uint32_t smb_name_validate_workgroup(const char *);
uint32_t smb_name_validate_rpath(const char *);
/*
* Interposer library validation
*/
typedef struct smbex_version {
void *smb_dlopen(void);
void smb_dlclose(void *);
uint32_t smb_get_txid(void);
typedef struct smb_log_item {
typedef struct smb_log {
int l_cnt;
int l_max_cnt;
} smb_log_t;
typedef struct smb_loglist_item {
typedef struct smb_loglist {
smb_log_hdl_t smb_log_create(int, char *);
void smb_log(smb_log_hdl_t, int, const char *, ...);
void smb_log_dumpall(void);
typedef struct {
int l_fildes;
int smb_file_lock(char *, smb_lockinfo_t *);
int smb_file_unlock(smb_lockinfo_t *);
#ifdef __cplusplus
}
#endif
#endif /* _LIBSMB_H */