xref: /illumos-gate/usr/src/lib/smbsrv/libsmb/common/libsmb.h (revision fc724630b14603e4c1147df68b7bf45f7de7431f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef	_LIBSMB_H
27 #define	_LIBSMB_H
28 
29 #ifdef	__cplusplus
30 extern "C" {
31 #endif
32 
33 #include <sys/types.h>
34 #include <sys/list.h>
35 #include <arpa/inet.h>
36 #include <net/if.h>
37 #include <inet/tcp.h>
38 #include <netdb.h>
39 #include <stdlib.h>
40 #include <libscf.h>
41 #include <libshare.h>
42 #include <sqlite/sqlite.h>
43 
44 #include <smbsrv/string.h>
45 #include <smbsrv/smb_idmap.h>
46 #include <smbsrv/netbios.h>
47 #include <smbsrv/smb_share.h>
48 #include <smbsrv/ntstatus.h>
49 #include <smbsrv/smb_door_svc.h>
50 #include <smbsrv/alloc.h>
51 #include <smbsrv/codepage.h>
52 #include <smbsrv/ctype.h>
53 #include <smbsrv/hash_table.h>
54 #include <smbsrv/msgbuf.h>
55 #include <smbsrv/oem.h>
56 #include <smbsrv/smb_i18n.h>
57 #include <smbsrv/wintypes.h>
58 #include <smbsrv/smb_xdr.h>
59 #include <smbsrv/smbinfo.h>
60 
61 #define	SMB_VARRUN_DIR "/var/run/smb"
62 #define	SMB_CCACHE_FILE "ccache"
63 #define	SMB_CCACHE_PATH SMB_VARRUN_DIR "/" SMB_CCACHE_FILE
64 
65 
66 
67 /* Max value length of all SMB properties */
68 #define	MAX_VALUE_BUFLEN	512
69 
70 #define	SMBD_FMRI_PREFIX		"network/smb/server"
71 #define	SMBD_DEFAULT_INSTANCE_FMRI	"svc:/network/smb/server:default"
72 #define	SMBD_PG_NAME			"smbd"
73 #define	SMBD_PROTECTED_PG_NAME		"read"
74 
75 #define	SMBD_SMF_OK		0
76 #define	SMBD_SMF_NO_MEMORY	1	/* no memory for data structures */
77 #define	SMBD_SMF_SYSTEM_ERR	2	/* system error, use errno */
78 #define	SMBD_SMF_NO_PERMISSION	3	/* no permission for operation */
79 #define	SMBD_SMF_INVALID_ARG	4
80 
81 #define	SCH_STATE_UNINIT	0
82 #define	SCH_STATE_INITIALIZING	1
83 #define	SCH_STATE_INIT		2
84 
85 typedef struct smb_scfhandle {
86 	scf_handle_t		*scf_handle;
87 	int			scf_state;
88 	scf_service_t		*scf_service;
89 	scf_scope_t		*scf_scope;
90 	scf_transaction_t	*scf_trans;
91 	scf_transaction_entry_t	*scf_entry;
92 	scf_propertygroup_t	*scf_pg;
93 	scf_instance_t		*scf_instance;
94 	scf_iter_t		*scf_inst_iter;
95 	scf_iter_t		*scf_pg_iter;
96 } smb_scfhandle_t;
97 
98 /*
99  * CIFS Configuration Management
100  */
101 typedef enum {
102 	SMB_CI_OPLOCK_ENABLE = 0,
103 
104 	SMB_CI_AUTOHOME_MAP,
105 
106 	SMB_CI_DOMAIN_SID,
107 	SMB_CI_DOMAIN_MEMB,
108 	SMB_CI_DOMAIN_NAME,
109 	SMB_CI_DOMAIN_FQDN,
110 	SMB_CI_DOMAIN_FOREST,
111 	SMB_CI_DOMAIN_GUID,
112 	SMB_CI_DOMAIN_SRV,
113 
114 	SMB_CI_WINS_SRV1,
115 	SMB_CI_WINS_SRV2,
116 	SMB_CI_WINS_EXCL,
117 
118 	SMB_CI_SRVSVC_SHRSET_ENABLE,
119 
120 	SMB_CI_MAX_WORKERS,
121 	SMB_CI_MAX_CONNECTIONS,
122 	SMB_CI_KEEPALIVE,
123 	SMB_CI_RESTRICT_ANON,
124 
125 	SMB_CI_SIGNING_ENABLE,
126 	SMB_CI_SIGNING_REQD,
127 
128 	SMB_CI_SYNC_ENABLE,
129 
130 	SMB_CI_SECURITY,
131 	SMB_CI_NBSCOPE,
132 	SMB_CI_SYS_CMNT,
133 	SMB_CI_LM_LEVEL,
134 
135 	SMB_CI_ADS_SITE,
136 
137 	SMB_CI_DYNDNS_ENABLE,
138 
139 	SMB_CI_MACHINE_PASSWD,
140 	SMB_CI_KPASSWD_SRV,
141 	SMB_CI_KPASSWD_DOMAIN,
142 	SMB_CI_KPASSWD_SEQNUM,
143 	SMB_CI_NETLOGON_SEQNUM,
144 	SMB_CI_IPV6_ENABLE,
145 	SMB_CI_MAX
146 } smb_cfg_id_t;
147 
148 /* SMF helper functions */
149 extern smb_scfhandle_t *smb_smf_scf_init(char *);
150 extern void smb_smf_scf_fini(smb_scfhandle_t *);
151 extern int smb_smf_start_transaction(smb_scfhandle_t *);
152 extern int smb_smf_end_transaction(smb_scfhandle_t *);
153 extern int smb_smf_set_string_property(smb_scfhandle_t *, char *, char *);
154 extern int smb_smf_get_string_property(smb_scfhandle_t *, char *,
155     char *, size_t);
156 extern int smb_smf_set_integer_property(smb_scfhandle_t *, char *, int64_t);
157 extern int smb_smf_get_integer_property(smb_scfhandle_t *, char *, int64_t *);
158 extern int smb_smf_set_boolean_property(smb_scfhandle_t *, char *, uint8_t);
159 extern int smb_smf_get_boolean_property(smb_scfhandle_t *, char *, uint8_t *);
160 extern int smb_smf_set_opaque_property(smb_scfhandle_t *, char *,
161     void *, size_t);
162 extern int smb_smf_get_opaque_property(smb_scfhandle_t *, char *,
163     void *, size_t);
164 extern int smb_smf_create_service_pgroup(smb_scfhandle_t *, char *);
165 extern int smb_smf_restart_service(void);
166 extern int smb_smf_maintenance_mode(void);
167 
168 /* ZFS interface */
169 int smb_getdataset(const char *, char *, size_t);
170 
171 /* Configuration management functions  */
172 extern int smb_config_get(smb_cfg_id_t, char *, int);
173 extern char *smb_config_getname(smb_cfg_id_t);
174 extern int smb_config_getstr(smb_cfg_id_t, char *, int);
175 extern int smb_config_getnum(smb_cfg_id_t, int64_t *);
176 extern boolean_t smb_config_getbool(smb_cfg_id_t);
177 
178 extern int smb_config_set(smb_cfg_id_t, char *);
179 extern int smb_config_setstr(smb_cfg_id_t, char *);
180 extern int smb_config_setnum(smb_cfg_id_t, int64_t);
181 extern int smb_config_setbool(smb_cfg_id_t, boolean_t);
182 
183 extern uint8_t smb_config_get_fg_flag(void);
184 extern char *smb_config_get_localsid(void);
185 extern int smb_config_secmode_fromstr(char *);
186 extern char *smb_config_secmode_tostr(int);
187 extern int smb_config_get_secmode(void);
188 extern int smb_config_set_secmode(int);
189 extern int smb_config_set_idmap_domain(char *);
190 extern int smb_config_refresh_idmap(void);
191 extern int smb_config_getip(smb_cfg_id_t, smb_inaddr_t *);
192 
193 extern void smb_load_kconfig(smb_kmod_cfg_t *kcfg);
194 extern uint32_t smb_crc_gen(uint8_t *, size_t);
195 
196 extern boolean_t smb_match_netlogon_seqnum(void);
197 extern int smb_setdomainprops(char *, char *, char *);
198 extern void smb_update_netlogon_seqnum(void);
199 
200 /* maximum password length on Windows 2000 and above */
201 #define	SMB_PASSWD_MAXLEN	127
202 #define	SMB_USERNAME_MAXLEN	40
203 
204 typedef struct smb_joininfo {
205 	char domain_name[MAXHOSTNAMELEN];
206 	char domain_username[SMB_USERNAME_MAXLEN + 1];
207 	char domain_passwd[SMB_PASSWD_MAXLEN + 1];
208 	uint32_t mode;
209 } smb_joininfo_t;
210 
211 /* APIs to communicate with SMB daemon via door calls */
212 extern uint32_t smb_join(smb_joininfo_t *info);
213 extern bool_t xdr_smb_dr_joininfo_t(XDR *, smb_joininfo_t *);
214 
215 
216 #define	SMB_DOMAIN_NOMACHINE_SID	-1
217 #define	SMB_DOMAIN_NODOMAIN_SID		-2
218 
219 extern int nt_domain_init(char *, uint32_t);
220 extern void nt_domain_save(void);
221 extern void nt_domain_show(void);
222 extern void nt_domain_unlink(void);
223 
224 extern void smb_config_getdomaininfo(char *domain, char *fqdn, char *forest,
225     char *guid);
226 extern void smb_config_setdomaininfo(char *domain, char *fqdn, char *forest,
227     char *guid);
228 extern uint32_t smb_get_dcinfo(char *, uint32_t, smb_inaddr_t *);
229 
230 /*
231  * buffer context structure. This is used to keep track of the buffer
232  * context.
233  *
234  * basep:  points to the beginning of the buffer
235  * curp:   points to the current offset
236  * endp:   points to the limit of the buffer
237  */
238 typedef struct {
239 	unsigned char *basep;
240 	unsigned char *curp;
241 	unsigned char *endp;
242 } smb_ctxbuf_t;
243 
244 extern int smb_ctxbuf_init(smb_ctxbuf_t *ctx, unsigned char *buf,
245     size_t buflen);
246 extern int smb_ctxbuf_len(smb_ctxbuf_t *ctx);
247 extern int smb_ctxbuf_printf(smb_ctxbuf_t *ctx, const char *fmt, ...);
248 
249 /* Functions to handle SMB daemon communications with idmap service */
250 extern int smb_idmap_start(void);
251 extern void smb_idmap_stop(void);
252 extern int smb_idmap_restart(void);
253 
254 /* Miscellaneous functions */
255 extern void hexdump(unsigned char *, int);
256 extern size_t bintohex(const char *, size_t, char *, size_t);
257 extern size_t hextobin(const char *, size_t, char *, size_t);
258 extern char *strstrip(char *, const char *);
259 extern char *strtrim(char *, const char *);
260 extern char *trim_whitespace(char *);
261 extern void randomize(char *, unsigned);
262 extern void rand_hash(unsigned char *, size_t, unsigned char *, size_t);
263 
264 extern int smb_getdomainname(char *, size_t);
265 extern int smb_getfqdomainname(char *, size_t);
266 extern int smb_gethostname(char *, size_t, int);
267 extern int smb_getfqhostname(char *, size_t);
268 extern int smb_getnetbiosname(char *, size_t);
269 extern struct hostent *smb_gethostbyname(const char *, int *);
270 extern struct hostent *smb_gethostbyaddr(const char *, int, int, int *);
271 extern boolean_t smb_ishostname(const char *);
272 
273 #define	SMB_SAMACCT_MAXLEN	(NETBIOS_NAME_SZ + 1)
274 extern int smb_getsamaccount(char *, size_t);
275 
276 extern smb_sid_t *smb_getdomainsid(void);
277 
278 extern int smb_get_nameservers(smb_inaddr_t *, int);
279 extern void smb_tonetbiosname(char *, char *, char);
280 
281 extern int smb_chk_hostaccess(smb_inaddr_t *, char *);
282 
283 void smb_trace(const char *s);
284 void smb_tracef(const char *fmt, ...);
285 
286 /*
287  * Authentication
288  */
289 
290 #define	SMBAUTH_LM_MAGIC_STR	"KGS!@#$%"
291 
292 #define	SMBAUTH_HASH_SZ		16	/* also LM/NTLM/NTLMv2 Hash size */
293 #define	SMBAUTH_LM_RESP_SZ	24	/* also NTLM Response size */
294 #define	SMBAUTH_LM_PWD_SZ	14	/* LM password size */
295 #define	SMBAUTH_V2_CLNT_CHALLENGE_SZ 8	/* both LMv2 and NTLMv2 */
296 #define	SMBAUTH_SESSION_KEY_SZ	SMBAUTH_HASH_SZ
297 #define	SMBAUTH_HEXHASH_SZ	(SMBAUTH_HASH_SZ * 2)
298 
299 #define	SMBAUTH_FAILURE		1
300 #define	SMBAUTH_SUCCESS		0
301 #define	MD_DIGEST_LEN		16
302 
303 /*
304  * Name Types
305  *
306  * The list of names near the end of the data blob (i.e. the ndb_names
307  * field of the smb_auth_data_blob_t data structure) can be classify into
308  * the following types:
309  *
310  * 0x0000 Indicates the end of the list.
311  * 0x0001 The name is a NetBIOS machine name (e.g. server name)
312  * 0x0002 The name is an NT Domain NetBIOS name.
313  * 0x0003 The name is the server's DNS hostname.
314  * 0x0004 The name is a W2K Domain name (a DNS name).
315  */
316 #define	SMBAUTH_NAME_TYPE_LIST_END		0x0000
317 #define	SMBAUTH_NAME_TYPE_SERVER_NETBIOS 	0x0001
318 #define	SMBAUTH_NAME_TYPE_DOMAIN_NETBIOS 	0x0002
319 #define	SMBAUTH_NAME_TYPE_SERVER_DNS		0x0003
320 #define	SMBAUTH_NAME_TYPE_DOMAIN_DNS 		0x0004
321 
322 /*
323  * smb_auth_name_entry_t
324  *
325  * Each name entry in the data blob consists of the following 3 fields:
326  *
327  * nne_type - name type
328  * nne_len  - the length of the name
329  * nne_name - the name, in uppercase UCS-2LE Unicode format
330  */
331 typedef struct smb_auth_name_entry {
332 	unsigned short nne_type;
333 	unsigned short nne_len;
334 	mts_wchar_t nne_name[SMB_PI_MAX_DOMAIN * 2];
335 } smb_auth_name_entry_t;
336 
337 /*
338  * smb_auth_data_blob
339  *
340  * The format of this NTLMv2 data blob structure is as follow:
341  *
342  *	- Blob Signature 0x01010000 (4 bytes)
343  * - Reserved (0x00000000) (4 bytes)
344  * - Timestamp Little-endian, 64-bit signed value representing
345  *   the number of tenths of a microsecond since January 1, 1601.
346  *   (8 bytes)
347  * - Client Challenge (8 bytes)
348  * - Unknown1 (4 bytes)
349  * - List of Target Information (variable length)
350  * - Unknown2 (4 bytes)
351  */
352 typedef struct smb_auth_data_blob {
353 	unsigned char ndb_signature[4];
354 	unsigned char ndb_reserved[4];
355 	uint64_t ndb_timestamp;
356 	unsigned char ndb_clnt_challenge[SMBAUTH_V2_CLNT_CHALLENGE_SZ];
357 	unsigned char ndb_unknown[4];
358 	smb_auth_name_entry_t ndb_names[2];
359 	unsigned char ndb_unknown2[4];
360 } smb_auth_data_blob_t;
361 
362 #define	SMBAUTH_BLOB_MAXLEN (sizeof (smb_auth_data_blob_t))
363 #define	SMBAUTH_CI_MAXLEN   SMBAUTH_LM_RESP_SZ
364 #define	SMBAUTH_CS_MAXLEN   (SMBAUTH_BLOB_MAXLEN + SMBAUTH_HASH_SZ)
365 
366 /*
367  * smb_auth_info_t
368  *
369  * The structure contains all the authentication information
370  * needed for the preparaton of the SMBSessionSetupAndx request
371  * and the user session key.
372  *
373  * hash      - NTLM hash
374  * hash_v2   - NTLMv2 hash
375  * ci_len    - the length of the case-insensitive password
376  * ci        - case-insensitive password
377  *             (If NTLMv2 authentication mechanism is used, it
378  *              represents the LMv2 response. Otherwise, it
379  *              is empty.)
380  * cs_len    - the length of the case-sensitive password
381  * cs        - case-sensitive password
382  *             (If NTLMv2 authentication mechanism is used, it
383  *              represents the NTLMv2 response. Otherwise, it
384  *              represents the NTLM response.)
385  * data_blob - NTLMv2 data blob
386  */
387 typedef struct smb_auth_info {
388 	unsigned char hash[SMBAUTH_HASH_SZ];
389 	unsigned char hash_v2[SMBAUTH_HASH_SZ];
390 	unsigned short ci_len;
391 	unsigned char ci[SMBAUTH_CI_MAXLEN];
392 	unsigned short cs_len;
393 	unsigned char cs[SMBAUTH_CS_MAXLEN];
394 	int lmcompatibility_lvl;
395 	smb_auth_data_blob_t data_blob;
396 } smb_auth_info_t;
397 
398 /*
399  * SMB password management
400  */
401 
402 #define	SMB_PWF_LM	0x01	/* LM hash is present */
403 #define	SMB_PWF_NT	0x02	/* NT hash is present */
404 #define	SMB_PWF_DISABLE	0x04	/* Account is disabled */
405 
406 typedef struct smb_passwd {
407 	uid_t		pw_uid;
408 	uint32_t	pw_flags;
409 	char		pw_name[SMB_USERNAME_MAXLEN];
410 	uint8_t		pw_lmhash[SMBAUTH_HASH_SZ];
411 	uint8_t		pw_nthash[SMBAUTH_HASH_SZ];
412 } smb_passwd_t;
413 
414 /*
415  * Control flags passed to smb_pwd_setcntl
416  */
417 #define	SMB_PWC_DISABLE	0x01
418 #define	SMB_PWC_ENABLE	0x02
419 #define	SMB_PWC_NOLM	0x04
420 
421 #define	SMB_PWE_SUCCESS		0
422 #define	SMB_PWE_USER_UNKNOWN	1
423 #define	SMB_PWE_USER_DISABLE	2
424 #define	SMB_PWE_CLOSE_FAILED	3
425 #define	SMB_PWE_OPEN_FAILED	4
426 #define	SMB_PWE_WRITE_FAILED	6
427 #define	SMB_PWE_UPDATE_FAILED	7
428 #define	SMB_PWE_STAT_FAILED	8
429 #define	SMB_PWE_BUSY		9
430 #define	SMB_PWE_DENIED		10
431 #define	SMB_PWE_SYSTEM_ERROR	11
432 #define	SMB_PWE_INVALID_PARAM	12
433 #define	SMB_PWE_NO_MEMORY	13
434 #define	SMB_PWE_MAX		14
435 
436 typedef struct smb_pwditer {
437 	void *spi_next;
438 } smb_pwditer_t;
439 
440 typedef struct smb_luser {
441 	char *su_name;
442 	char *su_fullname;
443 	char *su_desc;
444 	uint32_t su_rid;
445 	uint32_t su_ctrl;
446 } smb_luser_t;
447 
448 extern void smb_pwd_init(boolean_t);
449 extern void smb_pwd_fini(void);
450 extern smb_passwd_t *smb_pwd_getpwnam(const char *, smb_passwd_t *);
451 extern smb_passwd_t *smb_pwd_getpwuid(uid_t, smb_passwd_t *);
452 extern int smb_pwd_setpasswd(const char *, const char *);
453 extern int smb_pwd_setcntl(const char *, int);
454 
455 extern int smb_pwd_iteropen(smb_pwditer_t *);
456 extern smb_luser_t *smb_pwd_iterate(smb_pwditer_t *);
457 extern void smb_pwd_iterclose(smb_pwditer_t *);
458 
459 extern int smb_auth_qnd_unicode(mts_wchar_t *dst, char *src, int length);
460 extern int smb_auth_hmac_md5(unsigned char *data, int data_len,
461     unsigned char *key, int key_len, unsigned char *digest);
462 
463 /*
464  * A variation on HMAC-MD5 known as HMACT64 is used by Windows systems.
465  * The HMACT64() function is the same as the HMAC-MD5() except that
466  * it truncates the input key to 64 bytes rather than hashing it down
467  * to 16 bytes using the MD5() function.
468  */
469 #define	SMBAUTH_HMACT64(D, Ds, K, Ks, digest) \
470 	smb_auth_hmac_md5(D, Ds, K, (Ks > 64) ? 64 : Ks, digest)
471 
472 extern int smb_auth_DES(unsigned char *, int, unsigned char *, int,
473     unsigned char *, int);
474 
475 extern int smb_auth_md4(unsigned char *, unsigned char *, int);
476 extern int smb_auth_lm_hash(char *, unsigned char *);
477 extern int smb_auth_ntlm_hash(char *, unsigned char *);
478 
479 extern int smb_auth_set_info(char *, char *,
480     unsigned char *, char *, unsigned char *,
481     int, int, smb_auth_info_t *);
482 
483 extern int smb_auth_ntlmv2_hash(unsigned char *,
484 	char *, char *, unsigned char *);
485 
486 extern int smb_auth_gen_session_key(smb_auth_info_t *, unsigned char *);
487 
488 boolean_t smb_auth_validate_lm(unsigned char *, uint32_t, smb_passwd_t *,
489     unsigned char *, int, char *, char *);
490 boolean_t smb_auth_validate_nt(unsigned char *, uint32_t, smb_passwd_t *,
491     unsigned char *, int, char *, char *, uchar_t *);
492 
493 /*
494  * SMB MAC Signing
495  */
496 
497 #define	SMB_MAC_KEY_SZ	(SMBAUTH_SESSION_KEY_SZ + SMBAUTH_CS_MAXLEN)
498 #define	SMB_SIG_OFFS	14	/* signature field offset within header */
499 #define	SMB_SIG_SIZE	8	/* SMB signature size */
500 
501 /*
502  * Signing flags:
503  *
504  * SMB_SCF_ENABLE                 Signing is enabled.
505  *
506  * SMB_SCF_REQUIRED               Signing is enabled and required.
507  *                                This flag shouldn't be set if
508  *                                SMB_SCF_ENABLE isn't set.
509  *
510  * SMB_SCF_STARTED                Signing will start after receiving
511  *                                the first non-anonymous SessionSetup
512  *                                request.
513  *
514  * SMB_SCF_KEY_ISSET_THIS_LOGON   Indicates whether the MAC key has just
515  *                                been set for this logon. (prior to
516  *                                sending the SMBSessionSetup request)
517  *
518  */
519 #define	SMB_SCF_ENABLE		0x01
520 #define	SMB_SCF_REQUIRED	0x02
521 #define	SMB_SCF_STARTED		0x04
522 #define	SMB_SCF_KEY_ISSET_THIS_LOGON	0x08
523 
524 /*
525  * smb_sign_ctx
526  *
527  * SMB signing context.
528  *
529  *	ssc_seqnum				sequence number
530  *	ssc_keylen				mac key length
531  *	ssc_mid					multiplex id - reserved
532  *	ssc_flags				flags
533  *	ssc_mackey				mac key
534  *	ssc_sign				mac signature
535  *
536  */
537 typedef struct smb_sign_ctx {
538 	unsigned int ssc_seqnum;
539 	unsigned short ssc_keylen;
540 	unsigned short ssc_mid;
541 	unsigned int ssc_flags;
542 	unsigned char ssc_mackey[SMB_MAC_KEY_SZ];
543 	unsigned char ssc_sign[SMB_SIG_SIZE];
544 } smb_sign_ctx_t;
545 
546 extern int smb_mac_init(smb_sign_ctx_t *sign_ctx, smb_auth_info_t *auth);
547 extern int smb_mac_calc(smb_sign_ctx_t *sign_ctx,
548     const unsigned char *buf, size_t buf_len, unsigned char *mac_sign);
549 extern int smb_mac_chk(smb_sign_ctx_t *sign_ctx,
550     const unsigned char *buf, size_t buf_len);
551 extern int smb_mac_sign(smb_sign_ctx_t *sign_ctx,
552     unsigned char *buf, size_t buf_len);
553 extern void smb_mac_inc_seqnum(smb_sign_ctx_t *sign_ctx);
554 extern void smb_mac_dec_seqnum(smb_sign_ctx_t *sign_ctx);
555 
556 /*
557  * Each domain is categorized using the enum values below.
558  * The local domain refers to the local machine and is named
559  * after the local hostname. The primary domain is the domain
560  * that the system joined. All other domains are either
561  * trusted or untrusted, as defined by the primary domain PDC.
562  *
563  * This enum must be kept in step with the table of strings
564  * in ntdomain.c.
565  */
566 typedef enum nt_domain_type {
567 	NT_DOMAIN_NULL,
568 	NT_DOMAIN_BUILTIN,
569 	NT_DOMAIN_LOCAL,
570 	NT_DOMAIN_PRIMARY,
571 	NT_DOMAIN_ACCOUNT,
572 	NT_DOMAIN_TRUSTED,
573 	NT_DOMAIN_UNTRUSTED,
574 	NT_DOMAIN_NUM_TYPES
575 } nt_domain_type_t;
576 
577 
578 /*
579  * This is the information that is held about each domain. The database
580  * is a linked list that is threaded through the domain structures. As
581  * the number of domains in the database should be small (32 max), this
582  * should be sufficient.
583  */
584 typedef struct nt_domain {
585 	struct nt_domain *next;
586 	nt_domain_type_t type;
587 	char *name;
588 	smb_sid_t *sid;
589 } nt_domain_t;
590 
591 nt_domain_t *nt_domain_new(nt_domain_type_t type, char *name, smb_sid_t *sid);
592 void nt_domain_delete(nt_domain_t *domain);
593 nt_domain_t *nt_domain_add(nt_domain_t *new_domain);
594 void nt_domain_remove(nt_domain_t *domain);
595 void nt_domain_flush(nt_domain_type_t domain_type);
596 void nt_domain_sync(void);
597 char *nt_domain_xlat_type(nt_domain_type_t domain_type);
598 nt_domain_type_t nt_domain_xlat_type_name(char *type_name);
599 nt_domain_t *nt_domain_lookup_name(char *domain_name);
600 nt_domain_t *nt_domain_lookup_sid(smb_sid_t *domain_sid);
601 nt_domain_t *nt_domain_lookupbytype(nt_domain_type_t type);
602 smb_sid_t *nt_domain_local_sid(void);
603 
604 typedef enum {
605 	SMB_LGRP_BUILTIN = 1,
606 	SMB_LGRP_LOCAL
607 } smb_gdomain_t;
608 
609 typedef struct smb_gsid {
610 	smb_sid_t *gs_sid;
611 	uint16_t gs_type;
612 } smb_gsid_t;
613 
614 typedef struct smb_giter {
615 	sqlite_vm	*sgi_vm;
616 	sqlite		*sgi_db;
617 } smb_giter_t;
618 
619 typedef struct smb_group {
620 	char			*sg_name;
621 	char			*sg_cmnt;
622 	uint32_t		sg_attr;
623 	uint32_t		sg_rid;
624 	smb_gsid_t		sg_id;
625 	smb_gdomain_t		sg_domain;
626 	smb_privset_t		*sg_privs;
627 	uint32_t		sg_nmembers;
628 	smb_gsid_t		*sg_members;
629 } smb_group_t;
630 
631 int smb_lgrp_start(void);
632 void smb_lgrp_stop(void);
633 int smb_lgrp_add(char *, char *);
634 int smb_lgrp_rename(char *, char *);
635 int smb_lgrp_delete(char *);
636 int smb_lgrp_setcmnt(char *, char *);
637 int smb_lgrp_getcmnt(char *, char **);
638 int smb_lgrp_getpriv(char *, uint8_t, boolean_t *);
639 int smb_lgrp_setpriv(char *, uint8_t, boolean_t);
640 int smb_lgrp_add_member(char *, smb_sid_t *, uint16_t);
641 int smb_lgrp_del_member(char *, smb_sid_t *, uint16_t);
642 int smb_lgrp_getbyname(char *, smb_group_t *);
643 int smb_lgrp_getbyrid(uint32_t, smb_gdomain_t, smb_group_t *);
644 void smb_lgrp_free(smb_group_t *);
645 boolean_t smb_lgrp_is_member(smb_group_t *, smb_sid_t *);
646 char *smb_lgrp_strerror(int);
647 int smb_lgrp_iteropen(smb_giter_t *);
648 void smb_lgrp_iterclose(smb_giter_t *);
649 int smb_lgrp_iterate(smb_giter_t *, smb_group_t *);
650 
651 int smb_lookup_sid(smb_sid_t *, char *buf, int buflen);
652 int smb_lookup_name(char *, smb_gsid_t *);
653 
654 #define	SMB_LGRP_SUCCESS		0
655 #define	SMB_LGRP_INVALID_ARG		1
656 #define	SMB_LGRP_INVALID_MEMBER		2
657 #define	SMB_LGRP_INVALID_NAME		3
658 #define	SMB_LGRP_NOT_FOUND		4
659 #define	SMB_LGRP_EXISTS			5
660 #define	SMB_LGRP_NO_SID			6
661 #define	SMB_LGRP_NO_LOCAL_SID		7
662 #define	SMB_LGRP_SID_NOTLOCAL		8
663 #define	SMB_LGRP_WKSID			9
664 #define	SMB_LGRP_NO_MEMORY		10
665 #define	SMB_LGRP_DB_ERROR		11
666 #define	SMB_LGRP_DBINIT_ERROR		12
667 #define	SMB_LGRP_INTERNAL_ERROR		13
668 #define	SMB_LGRP_MEMBER_IN_GROUP	14
669 #define	SMB_LGRP_MEMBER_NOT_IN_GROUP	15
670 #define	SMB_LGRP_NO_SUCH_PRIV		16
671 #define	SMB_LGRP_NO_SUCH_DOMAIN		17
672 #define	SMB_LGRP_PRIV_HELD		18
673 #define	SMB_LGRP_PRIV_NOT_HELD		19
674 #define	SMB_LGRP_BAD_DATA		20
675 #define	SMB_LGRP_NO_MORE		21
676 #define	SMB_LGRP_DBOPEN_FAILED		22
677 #define	SMB_LGRP_DBEXEC_FAILED		23
678 #define	SMB_LGRP_DBINIT_FAILED		24
679 #define	SMB_LGRP_DOMLKP_FAILED		25
680 #define	SMB_LGRP_DOMINS_FAILED		26
681 #define	SMB_LGRP_INSERT_FAILED		27
682 #define	SMB_LGRP_DELETE_FAILED		28
683 #define	SMB_LGRP_UPDATE_FAILED		29
684 #define	SMB_LGRP_LOOKUP_FAILED		30
685 #define	SMB_LGRP_NOT_SUPPORTED		31
686 
687 #define	SMB_LGRP_NAME_CHAR_MAX	32
688 #define	SMB_LGRP_COMMENT_MAX	256
689 #define	SMB_LGRP_NAME_MAX	(SMB_LGRP_NAME_CHAR_MAX * MTS_MB_CHAR_MAX + 1)
690 
691 /*
692  * values for smb_nic_t.smbflags
693  */
694 #define	SMB_NICF_NBEXCL		0x01	/* Excluded from Netbios activities */
695 #define	SMB_NICF_ALIAS		0x02	/* This is an alias */
696 
697 /*
698  * smb_nic_t
699  *     nic_host		actual host name
700  *     nic_nbname	16-byte NetBIOS host name
701  */
702 typedef struct {
703 	char		nic_host[MAXHOSTNAMELEN];
704 	char		nic_nbname[NETBIOS_NAME_SZ];
705 	char		nic_cmnt[SMB_PI_MAX_COMMENT];
706 	char		nic_ifname[LIFNAMSIZ];
707 	smb_inaddr_t	nic_ip;
708 	uint32_t	nic_mask;
709 	uint32_t	nic_bcast;
710 	uint32_t	nic_smbflags;
711 	uint64_t	nic_sysflags;
712 } smb_nic_t;
713 
714 typedef struct smb_niciter {
715 	smb_nic_t ni_nic;
716 	int ni_cookie;
717 	int ni_seqnum;
718 } smb_niciter_t;
719 
720 /* NIC config functions */
721 int smb_nic_init(void);
722 void smb_nic_fini(void);
723 int smb_nic_getnum(char *);
724 int smb_nic_addhost(const char *, const char *, int, const char **);
725 int smb_nic_delhost(const char *);
726 int smb_nic_getfirst(smb_niciter_t *);
727 int smb_nic_getnext(smb_niciter_t *);
728 boolean_t smb_nic_is_local(smb_inaddr_t *);
729 boolean_t smb_nic_is_same_subnet(smb_inaddr_t *);
730 
731 /* NIC Monitoring functions */
732 int smb_nicmon_start(const char *);
733 void smb_nicmon_stop(void);
734 
735 /*
736  * Well-known account structure
737  *
738  * A security identifier (SID) is a unique value of variable length that
739  * is used to identify a security principal or security group in
740  * Windows. Well-known SIDs are a group of SIDs that identify generic
741  * users or generic groups. Their values remain constant across all
742  * operating systems.
743  *
744  * This structure is defined to store these SIDs and other related
745  * information about them (e.g. account and domain names) in a
746  * predefined table.
747  */
748 typedef struct smb_wka {
749 	uint8_t		wka_domidx;
750 	char		*wka_sid;
751 	char		*wka_name;
752 	uint16_t	wka_type;
753 	uint16_t	wka_flags;
754 	char		*wka_desc;
755 	smb_sid_t	*wka_binsid;
756 } smb_wka_t;
757 
758 /*
759  * Defined values for smb_wka.wka_flags
760  *
761  * SMB_WKAFLG_LGRP_ENABLE		Can be added as local group
762  */
763 #define	SMB_WKAFLG_LGRP_ENABLE	0x1
764 
765 /*
766  * Well-known account interfaces
767  */
768 int smb_wka_init(void);
769 void smb_wka_fini(void);
770 smb_wka_t *smb_wka_lookup_name(char *);
771 smb_wka_t *smb_wka_lookup_sid(smb_sid_t *);
772 smb_sid_t *smb_wka_get_sid(char *);
773 char *smb_wka_get_domain(int);
774 uint32_t smb_wka_token_groups(boolean_t, smb_ids_t *);
775 
776 /*
777  * In memory account representation
778  */
779 typedef struct smb_account {
780 	char		*a_name;
781 	char		*a_domain;
782 	uint16_t	a_type;
783 	smb_sid_t	*a_sid;
784 	smb_sid_t	*a_domsid;
785 	uint32_t	a_rid;
786 } smb_account_t;
787 
788 uint32_t smb_sam_lookup_name(char *, char *, uint16_t, smb_account_t *);
789 uint32_t smb_sam_lookup_sid(smb_sid_t *, smb_account_t *);
790 int smb_sam_usr_cnt(void);
791 uint32_t smb_sam_usr_groups(smb_sid_t *, smb_ids_t *);
792 int smb_sam_grp_cnt(nt_domain_type_t);
793 void smb_account_free(smb_account_t *);
794 boolean_t smb_account_validate(smb_account_t *);
795 
796 #ifdef	__cplusplus
797 }
798 #endif
799 
800 #endif	/* _LIBSMB_H */
801