path: root/private/inc/logonmsv.h

/*++

Copyright (c) 1987-1991  Microsoft Corporation

Module Name:

    logonmsv.h

Abstract:

    Definition of API's to the Netlogon service which are callable
    by the MSV1_0 authentication package.

Author:

    Cliff Van Dyke (cliffv) 23-Jun-1991

Environment:

    User mode only.
    Contains NT-specific code.
    Requires ANSI C extensions: slash-slash comments, long external names.

Revision History:

--*/

#ifndef __LOGONMSV_H__
#define __LOGONMSV_H__
#include <lsass.h>  // OLD_LARGE_INTEGER

//
// Name of secret in LSA secret storage where account passwords are kept.
//

#define SSI_SECRET_PREFIX L"$"
#define SSI_SECRET_PREFIX_LENGTH 1
#define SSI_SECRET_POSTFIX L"MACHINE.ACC"
#define SSI_SECRET_NAME L"$MACHINE.ACC"

//
// Name of the event used to synchronize between the security process and
// the service controller.
//

#define SECURITY_SERVICES_STARTED L"SECURITY_SERVICES_STARTED"


//
// The structures supporting remote logon APIs
//

typedef CYPHER_BLOCK NETLOGON_CREDENTIAL, *PNETLOGON_CREDENTIAL ;

typedef struct _NETLOGON_AUTHENTICATOR {
    NETLOGON_CREDENTIAL Credential;
    DWORD timestamp;
} NETLOGON_AUTHENTICATOR, *PNETLOGON_AUTHENTICATOR ;

typedef struct _NETLOGON_SESSION_KEY {
    BYTE Key[CRYPT_TXT_LEN * 2];
} NETLOGON_SESSION_KEY, *PNETLOGON_SESSION_KEY;

typedef enum _NETLOGON_SECURE_CHANNEL_TYPE {
    NullSecureChannel = 0,
    MsvApSecureChannel,
    WorkstationSecureChannel,
    Beta2ServerSecureChannel, // NOT USED (since before NT 1.0 shipped)
    TrustedDomainSecureChannel,
    UasServerSecureChannel,
    ServerSecureChannel
} NETLOGON_SECURE_CHANNEL_TYPE;


//
// Input information to NetLogonSamLogon.
//
// begin_ntsubauth

typedef enum _NETLOGON_LOGON_INFO_CLASS {
    NetlogonInteractiveInformation = 1,
    NetlogonNetworkInformation,
    NetlogonServiceInformation
} NETLOGON_LOGON_INFO_CLASS;

#pragma pack(4)
typedef struct _NETLOGON_LOGON_IDENTITY_INFO {
    UNICODE_STRING LogonDomainName;
    ULONG ParameterControl;
    OLD_LARGE_INTEGER  LogonId;
    UNICODE_STRING UserName;
    UNICODE_STRING Workstation;
} NETLOGON_LOGON_IDENTITY_INFO,
 *PNETLOGON_LOGON_IDENTITY_INFO;
#pragma pack()

#pragma pack(4)
typedef struct _NETLOGON_INTERACTIVE_INFO {
    NETLOGON_LOGON_IDENTITY_INFO Identity;
    LM_OWF_PASSWORD LmOwfPassword;
    NT_OWF_PASSWORD NtOwfPassword;
} NETLOGON_INTERACTIVE_INFO,
 *PNETLOGON_INTERACTIVE_INFO;
#pragma pack()

#pragma pack(4)
typedef struct _NETLOGON_SERVICE_INFO {
    NETLOGON_LOGON_IDENTITY_INFO Identity;
    LM_OWF_PASSWORD LmOwfPassword;
    NT_OWF_PASSWORD NtOwfPassword;
} NETLOGON_SERVICE_INFO, *PNETLOGON_SERVICE_INFO;
#pragma pack()

#pragma pack(4)
typedef struct _NETLOGON_NETWORK_INFO {
    NETLOGON_LOGON_IDENTITY_INFO Identity;
    LM_CHALLENGE LmChallenge;
    STRING NtChallengeResponse;
    STRING LmChallengeResponse;
} NETLOGON_NETWORK_INFO, *PNETLOGON_NETWORK_INFO;
#pragma pack()
// end_ntsubauth

//
// Structure to pass a SID_AND_ATTRIBUTES over the network.
//

typedef struct _NETLOGON_SID_AND_ATTRIBUTES {
#if defined(MIDL_PASS) || defined(RPC_SERVER)
    PISID Sid;
#else
    PSID Sid;
#endif
    ULONG Attributes;
} NETLOGON_SID_AND_ATTRIBUTES, *PNETLOGON_SID_AND_ATTRIBUTES;

//
// Values of ParameterControl
//
// (Obsolete: Use the ParameterControl values from ntmsv1_0.h)

#define CLEARTEXT_PASSWORD_ALLOWED 0x02     // Challenge response fields may
                                            // actually be clear text passwords.


//
// Output information to NetLogonSamLogon.
//

typedef enum _NETLOGON_VALIDATION_INFO_CLASS {
     NetlogonValidationUasInfo = 1,
     NetlogonValidationSamInfo,
     NetlogonValidationSamInfo2,
     NetlogonValidationPacInfo,
     NetlogonValidationPacInfo2
} NETLOGON_VALIDATION_INFO_CLASS;

#pragma pack(4)
typedef struct _NETLOGON_VALIDATION_SAM_INFO {
    //
    // Information retrieved from SAM.
    //
    OLD_LARGE_INTEGER LogonTime;            // 0 for Network logon
    OLD_LARGE_INTEGER LogoffTime;
    OLD_LARGE_INTEGER KickOffTime;
    OLD_LARGE_INTEGER PasswordLastSet;      // 0 for Network logon
    OLD_LARGE_INTEGER PasswordCanChange;    // 0 for Network logon
    OLD_LARGE_INTEGER PasswordMustChange;   // 0 for Network logon
    UNICODE_STRING EffectiveName;       // 0 for Network logon
    UNICODE_STRING FullName;            // 0 for Network logon
    UNICODE_STRING LogonScript;         // 0 for Network logon
    UNICODE_STRING ProfilePath;         // 0 for Network logon
    UNICODE_STRING HomeDirectory;       // 0 for Network logon
    UNICODE_STRING HomeDirectoryDrive;  // 0 for Network logon
    USHORT LogonCount;                  // 0 for Network logon
    USHORT BadPasswordCount;            // 0 for Network logon
    ULONG UserId;
    ULONG PrimaryGroupId;
    ULONG GroupCount;
#ifdef MIDL_PASS
    [size_is(GroupCount)]
#endif // MIDL_PASS
    PGROUP_MEMBERSHIP GroupIds;

    //
    // Information supplied by the MSV AP/Netlogon service.
    //
    ULONG UserFlags;
    USER_SESSION_KEY UserSessionKey;
    UNICODE_STRING LogonServer;
    UNICODE_STRING LogonDomainName;
#if defined(MIDL_PASS) || defined(RPC_SERVER)
    PISID LogonDomainId;
#else
    PSID LogonDomainId;
#endif
    //
    // The First two longwords (8 bytes) of ExpansionRoom are reserved for the
    // LanManSession Key.
    //
#define SAMINFO_LM_SESSION_KEY 0
#define SAMINFO_LM_SESSION_KEY_EXT 1
#define SAMINFO_LM_SESSION_KEY_SIZE (2*sizeof(ULONG))

    ULONG    ExpansionRoom[10];        // Put new fields here
} NETLOGON_VALIDATION_SAM_INFO, *PNETLOGON_VALIDATION_SAM_INFO ;

//
// New output information for NetLogonSamLogon. This structure is identical
// to the above structure with some new fields added at the end.
//


typedef struct _NETLOGON_VALIDATION_SAM_INFO2 {
    //
    // Information retrieved from SAM.
    //
    OLD_LARGE_INTEGER LogonTime;            // 0 for Network logon
    OLD_LARGE_INTEGER LogoffTime;
    OLD_LARGE_INTEGER KickOffTime;
    OLD_LARGE_INTEGER PasswordLastSet;      // 0 for Network logon
    OLD_LARGE_INTEGER PasswordCanChange;    // 0 for Network logon
    OLD_LARGE_INTEGER PasswordMustChange;   // 0 for Network logon
    UNICODE_STRING EffectiveName;       // 0 for Network logon
    UNICODE_STRING FullName;            // 0 for Network logon
    UNICODE_STRING LogonScript;         // 0 for Network logon
    UNICODE_STRING ProfilePath;         // 0 for Network logon
    UNICODE_STRING HomeDirectory;       // 0 for Network logon
    UNICODE_STRING HomeDirectoryDrive;  // 0 for Network logon
    USHORT LogonCount;                  // 0 for Network logon
    USHORT BadPasswordCount;            // 0 for Network logon
    ULONG UserId;
    ULONG PrimaryGroupId;
    ULONG GroupCount;
#ifdef MIDL_PASS
    [size_is(GroupCount)]
#endif // MIDL_PASS
    PGROUP_MEMBERSHIP GroupIds;

    //
    // Information supplied by the MSV AP/Netlogon service.
    //
    ULONG UserFlags;
    USER_SESSION_KEY UserSessionKey;
    UNICODE_STRING LogonServer;
    UNICODE_STRING LogonDomainName;
#if defined(MIDL_PASS) || defined(RPC_SERVER)
    PISID LogonDomainId;
#else
    PSID LogonDomainId;
#endif
    //
    // The First two longwords (8 bytes) of ExpansionRoom are reserved for the
    // LanManSession Key.
    //
#define SAMINFO_LM_SESSION_KEY 0
#define SAMINFO_LM_SESSION_KEY_EXT 1
#define SAMINFO_LM_SESSION_KEY_SIZE (2*sizeof(ULONG))

    ULONG    ExpansionRoom[10];        // Put new fields here

    //
    // The new fields in this structure are a count and a pointer to
    // an array of SIDs and attributes.
    //

    ULONG SidCount;

#ifdef MIDL_PASS
    [size_is(SidCount)]
#endif // MIDL_PASS
    PNETLOGON_SID_AND_ATTRIBUTES ExtraSids;

} NETLOGON_VALIDATION_SAM_INFO2, *PNETLOGON_VALIDATION_SAM_INFO2 ;


//
// PAC info level
//

typedef struct _NETLOGON_VALIDATION_PAC_INFO {
    ULONG   cbPacSize;
#ifdef MIDL_PASS
    [size_is(cbPacSize),unique]
#endif //MIDL_PASS
    PUCHAR pbPacData;
    UNICODE_STRING LogonDomain;
    UNICODE_STRING LogonServer;
    UNICODE_STRING PrincipalName;
    ULONG cbAuthData;
#ifdef MIDL_PASS
    [size_is(cbAuthData),unique]
#endif //MIDL_PASS
    PUCHAR pbAuthData;
    USER_SESSION_KEY UserSessionKey;

    ULONG    ExpansionRoom[10];        // First two are the LanmanSessionKey
    UNICODE_STRING DummyString1;       // Not used yet
    UNICODE_STRING DummyString2;       // Not used yet
    UNICODE_STRING DummyString3;       // Not used yet
    UNICODE_STRING DummyString4;       // Not used yet

} NETLOGON_VALIDATION_PAC_INFO, *PNETLOGON_VALIDATION_PAC_INFO;

#pragma pack()

//
// Status codes that indicate the password is bad and the call should
// be passed through to the PDC of the domain.
//

#define BAD_PASSWORD( _x ) \
    ((_x) == STATUS_WRONG_PASSWORD || \
     (_x) == STATUS_PASSWORD_EXPIRED || \
     (_x) == STATUS_PASSWORD_MUST_CHANGE || \
     (_x) == STATUS_ACCOUNT_LOCKED_OUT )

//
// The actual logon and logoff routines.
//

// The following 2 procedure definitions must match
NTSTATUS
I_NetLogonSamLogon(
    IN LPWSTR LogonServer OPTIONAL,
    IN LPWSTR ComputerName OPTIONAL,
    IN PNETLOGON_AUTHENTICATOR Authenticator OPTIONAL,
    OUT PNETLOGON_AUTHENTICATOR ReturnAuthenticator OPTIONAL,
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN LPBYTE LogonInformation,
    IN NETLOGON_VALIDATION_INFO_CLASS ValidationLevel,
    OUT LPBYTE * ValidationInformation,
    OUT PBOOLEAN Authoritative
    );

typedef NTSTATUS
(*PNETLOGON_SAM_LOGON_PROCEDURE)(
    IN LPWSTR LogonServer OPTIONAL,
    IN LPWSTR ComputerName OPTIONAL,
    IN PNETLOGON_AUTHENTICATOR Authenticator OPTIONAL,
    OUT PNETLOGON_AUTHENTICATOR ReturnAuthenticator OPTIONAL,
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN LPBYTE LogonInformation,
    IN NETLOGON_VALIDATION_INFO_CLASS ValidationLevel,
    OUT LPBYTE * ValidationInformation,
    OUT PBOOLEAN Authoritative
    );


// The following 2 procedure definitions must match
NTSTATUS
I_NetLogonSamLogoff (
    IN LPWSTR LogonServer OPTIONAL,
    IN LPWSTR ComputerName OPTIONAL,
    IN PNETLOGON_AUTHENTICATOR Authenticator OPTIONAL,
    OUT PNETLOGON_AUTHENTICATOR ReturnAuthenticator OPTIONAL,
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN LPBYTE LogonInformation
);

typedef NTSTATUS
(*PNETLOGON_SAM_LOGOFF_PROCEDURE) (
    IN LPWSTR LogonServer OPTIONAL,
    IN LPWSTR ComputerName OPTIONAL,
    IN PNETLOGON_AUTHENTICATOR Authenticator OPTIONAL,
    OUT PNETLOGON_AUTHENTICATOR ReturnAuthenticator OPTIONAL,
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN LPBYTE LogonInformation
);

//
// Actual logon/logoff routines for Cairo
//

NET_API_STATUS
NetlogonInitialize(
    PVOID Context
    );

NTSTATUS
NetlogonSamLogon (
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN LPBYTE LogonInformation,
    IN NETLOGON_VALIDATION_INFO_CLASS ValidationLevel,
    OUT LPBYTE *ValidationInformation,
    OUT PBOOLEAN Authoritative
    );

//
// Routine to get a list of NT DC's in the specified domain.
//
NET_API_STATUS NET_API_FUNCTION
I_NetGetDCList (
    IN  LPTSTR ServerName OPTIONAL,
    IN  LPTSTR TrustedDomainName,
    OUT PULONG DCCount,
    OUT PUNICODE_STRING * DCNames
    );

//
// Validation routine which lives in msv1_0.dll
//
NTSTATUS
MsvSamValidate (
    IN SAM_HANDLE DomainHandle,
    IN BOOLEAN UasCompatibilityRequired,
    IN NETLOGON_SECURE_CHANNEL_TYPE SecureChannelType,
    IN PUNICODE_STRING LogonServer,
    IN PUNICODE_STRING LogonDomainName,
    IN PSID LogonDomainId,
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN PVOID LogonInformation,
    IN NETLOGON_VALIDATION_INFO_CLASS ValidationLevel,
    OUT PVOID * ValidationInformation,
    OUT PBOOLEAN Authoritative,
    OUT PBOOLEAN BadPasswordCountZeroed,
    IN DWORD AccountsToTry
);

//
// Routine to get running number of logon attempts which lives in msv1_0.dll
//
ULONG
MsvGetLogonAttemptCount (
    VOID
);

// Values for AccountsToTry
#define MSVSAM_SPECIFIED 0x01        // Try specified account
#define MSVSAM_GUEST     0x02        // Try guest account

NTSTATUS
MsvSamLogoff (
    IN SAM_HANDLE DomainHandle,
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN PVOID LogonInformation
);

// begin_ntsubauth

// Values for Flags
#define MSV1_0_PASSTHRU     0x01
#define MSV1_0_GUEST_LOGON  0x02

NTSTATUS NTAPI
Msv1_0SubAuthenticationRoutine(
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN PVOID LogonInformation,
    IN ULONG Flags,
    IN PUSER_ALL_INFORMATION UserAll,
    OUT PULONG WhichFields,
    OUT PULONG UserFlags,
    OUT PBOOLEAN Authoritative,
    OUT PLARGE_INTEGER LogoffTime,
    OUT PLARGE_INTEGER KickoffTime
);

NTSTATUS NTAPI
Msv1_0SubAuthenticationFilter(
    IN NETLOGON_LOGON_INFO_CLASS LogonLevel,
    IN PVOID LogonInformation,
    IN ULONG Flags,
    IN PUSER_ALL_INFORMATION UserAll,
    OUT PULONG WhichFields,
    OUT PULONG UserFlags,
    OUT PBOOLEAN Authoritative,
    OUT PLARGE_INTEGER LogoffTime,
    OUT PLARGE_INTEGER KickoffTime
);

// end_ntsubauth

#endif // __LOGONMSV_H__