sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code
d52f727906
samba-mirror/librpc/idl/named_pipe_auth.idl

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

59 lines
1.5 KiB
Plaintext
Raw Normal View History

librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
#include "idl_types.h"
/*
miscellaneous IDL structures
*/
libcli/named_pipe_auth Change from 'info3' to auth_session_info_transport This changes the structure being used to convey the current user state from the netlogon-derived 'netr_SamInfo3' structure to a purpose-built structure that matches the internals of the Samba auth subsystem and contains the final group list, as well as the final privilege set and session key. These previously had to be re-created on the server side of the pipe each time. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-02-09 06:22:16 +03:00
import "netlogon.idl", "security.idl", "auth.idl";
librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
[
pointer_default(unique)
]
interface named_pipe_auth
{
const char *NAMED_PIPE_AUTH_MAGIC = "NPAM";
tstream_npa: Return named_pipe_auth_req_info4 from accept_existing Callers might want the full picture. We need to make named_pipe_auth_req_info4 public for that. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-01-18 19:30:42 +03:00
typedef [public] struct {
librpc: Add named_pipe_auth_req_info5->transport This will serve as a check to make sure that in particular a SAMR client is really root. This is for example used in get_user_info_18() handing out a machine password. The unix domain sockets for NCACN_NP can only be contacted by root, the "np\" subdirectory for those sockets is root/root 0700. Connecting to such a socket is done in two situations: First, local real root processes connecting and smbd on behalf of SMB clients connecting to \\pipe\name, smbd does become_root() there. Via the named_pipe_auth_req_info4 smbd hands over the SMB session information that the RPC server blindly trusts. The session information (i.e. the NT token) is heavily influenced by external sources like the KDC. It is highly unlikely that we get a system token via SMB, but who knows, this is information not fully controlled by smbd. This is where this additional field in named_pipe_auth_req_info5 makes a difference: This field is set to NCACN_NP by smbd's code, not directly controlled by the clients. Other clients directly connecting to a socket in "np\" is root anyway (only smbd can do become_root()) and can set this field to NCALRPC. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-11-27 18:38:38 +03:00
uint8 transport;
named_pipe_auth: Rename client -> remote_client and server -> local_server While these names may have been clear, much of Samba uses remote_address and local_address, and this difference has hidden bugs. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-03-10 01:37:56 +03:00
[charset(UTF8),string] uint8 *remote_client_name;
[charset(DOS),string] uint8 *remote_client_addr;
uint16 remote_client_port;
[charset(UTF8),string] uint8 *local_server_name;
[charset(DOS),string] uint8 *local_server_addr;
uint16 local_server_port;
libcli/named_pipe_auth Change from 'info3' to auth_session_info_transport This changes the structure being used to convey the current user state from the netlogon-derived 'netr_SamInfo3' structure to a purpose-built structure that matches the internals of the Samba auth subsystem and contains the final group list, as well as the final privilege set and session key. These previously had to be re-created on the server side of the pipe each time. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-02-09 06:22:16 +03:00
auth_session_info_transport *session_info;
s3:rpc: bump named_pipe_auth_req_info version number This is because commit f893cf85cc387b66c496661e11073b1215270022 changed the security token in secuirty.idl, and bumping the version was missed. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-08 00:35:51 +03:00
} named_pipe_auth_req_info8;
named_pipe_auth.idl: add infrastructure to pass delegated credentials metze
2009-09-17 20:26:57 +04:00
librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
typedef [switch_type(uint32)] union {
s3:rpc: bump named_pipe_auth_req_info version number This is because commit f893cf85cc387b66c496661e11073b1215270022 changed the security token in secuirty.idl, and bumping the version was missed. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-08 00:35:51 +03:00
[case(8)] named_pipe_auth_req_info8 info8;
librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
} named_pipe_auth_req_info;
typedef [public,gensize] struct {
[flag(NDR_BIG_ENDIAN),
Finish removal of iconv_convenience in public API's.
2010-05-09 19:20:01 +04:00
value(ndr_size_named_pipe_auth_req(r,ndr->flags)-4)]
librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
uint32 length;
[charset(DOS),value(NAMED_PIPE_AUTH_MAGIC)] uint8 magic[4];
uint32 level;
[switch_is(level)] named_pipe_auth_req_info info;
} named_pipe_auth_req;
named_pipe_auth.idl: add infrastructure to pass delegated credentials metze
2009-09-17 20:26:57 +04:00
typedef struct {
uint16 file_type;
uint16 device_state;
hyper allocation_size;
s3:rpc: bump named_pipe_auth_req_info version number This is because commit f893cf85cc387b66c496661e11073b1215270022 changed the security token in secuirty.idl, and bumping the version was missed. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-08 00:35:51 +03:00
} named_pipe_auth_rep_info8;
named_pipe_auth.idl: add infrastructure to pass delegated credentials metze
2009-09-17 20:26:57 +04:00
librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
typedef [switch_type(uint32)] union {
s3:rpc: bump named_pipe_auth_req_info version number This is because commit f893cf85cc387b66c496661e11073b1215270022 changed the security token in secuirty.idl, and bumping the version was missed. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-08 00:35:51 +03:00
[case(8)] named_pipe_auth_rep_info8 info8;
librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
} named_pipe_auth_rep_info;
typedef [public,gensize] struct {
[flag(NDR_BIG_ENDIAN),
Finish removal of iconv_convenience in public API's.
2010-05-09 19:20:01 +04:00
value(ndr_size_named_pipe_auth_rep(r,ndr->flags)-4)]
librpc/idl: Add named_pipe_auth.idl to Samba4 metze
2008-10-29 14:05:10 +03:00
uint32 length;
[charset(DOS),value(NAMED_PIPE_AUTH_MAGIC)] uint8 magic[4];
uint32 level;
[switch_is(level)] named_pipe_auth_rep_info info;
NTSTATUS status;
} named_pipe_auth_rep;
}
Copy Permalink