2 Unix SMB/CIFS implementation.
4 User credentials handling
6 Copyright (C) Jelmer Vernooij 2005
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
26 #include "auth/credentials/credentials.h"
27 #include "auth/credentials/credentials_internal.h"
28 #include "auth/gensec/gensec.h"
29 #include "libcli/auth/libcli_auth.h"
31 #include "param/param.h"
32 #include "system/filesys.h"
33 #include "system/passwd.h"
36 * Create a new credentials structure
37 * @param mem_ctx TALLOC_CTX parent for credentials structure
39 _PUBLIC_
struct cli_credentials
*cli_credentials_init(TALLOC_CTX
*mem_ctx
)
41 struct cli_credentials
*cred
= talloc_zero(mem_ctx
, struct cli_credentials
);
46 cred
->winbind_separator
= '\\';
48 cred
->kerberos_state
= CRED_USE_KERBEROS_DESIRED
;
50 cred
->signing_state
= SMB_SIGNING_DEFAULT
;
53 * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use
54 * the same value here.
56 cred
->ipc_signing_state
= SMB_SIGNING_REQUIRED
;
57 cred
->encryption_state
= SMB_ENCRYPTION_DEFAULT
;
63 struct cli_credentials
*cli_credentials_init_server(TALLOC_CTX
*mem_ctx
,
64 struct loadparm_context
*lp_ctx
)
66 struct cli_credentials
*server_creds
= NULL
;
70 server_creds
= cli_credentials_init(mem_ctx
);
71 if (server_creds
== NULL
) {
75 ok
= cli_credentials_set_conf(server_creds
, lp_ctx
);
77 TALLOC_FREE(server_creds
);
81 status
= cli_credentials_set_machine_account(server_creds
, lp_ctx
);
82 if (!NT_STATUS_IS_OK(status
)) {
83 DEBUG(1, ("Failed to obtain server credentials: %s\n",
85 TALLOC_FREE(server_creds
);
92 _PUBLIC_
void cli_credentials_set_callback_data(struct cli_credentials
*cred
,
95 cred
->priv_data
= callback_data
;
98 _PUBLIC_
void *_cli_credentials_callback_data(struct cli_credentials
*cred
)
100 return cred
->priv_data
;
104 * Create a new anonymous credential
105 * @param mem_ctx TALLOC_CTX parent for credentials structure
107 _PUBLIC_
struct cli_credentials
*cli_credentials_init_anon(TALLOC_CTX
*mem_ctx
)
109 struct cli_credentials
*anon_credentials
;
111 anon_credentials
= cli_credentials_init(mem_ctx
);
112 cli_credentials_set_anonymous(anon_credentials
);
114 return anon_credentials
;
117 _PUBLIC_
bool cli_credentials_set_kerberos_state(struct cli_credentials
*creds
,
118 enum credentials_use_kerberos kerberos_state
,
119 enum credentials_obtained obtained
)
121 if (obtained
>= creds
->kerberos_state_obtained
) {
122 creds
->kerberos_state
= kerberos_state
;
123 creds
->kerberos_state_obtained
= obtained
;
131 _PUBLIC_
void cli_credentials_set_forced_sasl_mech(struct cli_credentials
*creds
,
132 const char *sasl_mech
)
134 TALLOC_FREE(creds
->forced_sasl_mech
);
135 creds
->forced_sasl_mech
= talloc_strdup(creds
, sasl_mech
);
138 _PUBLIC_
void cli_credentials_set_krb_forwardable(struct cli_credentials
*creds
,
139 enum credentials_krb_forwardable krb_forwardable
)
141 creds
->krb_forwardable
= krb_forwardable
;
144 _PUBLIC_
enum credentials_use_kerberos
cli_credentials_get_kerberos_state(struct cli_credentials
*creds
)
146 return creds
->kerberos_state
;
149 _PUBLIC_
const char *cli_credentials_get_forced_sasl_mech(struct cli_credentials
*creds
)
151 return creds
->forced_sasl_mech
;
154 _PUBLIC_
enum credentials_krb_forwardable
cli_credentials_get_krb_forwardable(struct cli_credentials
*creds
)
156 return creds
->krb_forwardable
;
159 _PUBLIC_
bool cli_credentials_set_gensec_features(struct cli_credentials
*creds
,
160 uint32_t gensec_features
,
161 enum credentials_obtained obtained
)
163 if (obtained
>= creds
->gensec_features_obtained
) {
164 creds
->gensec_features_obtained
= obtained
;
165 creds
->gensec_features
= gensec_features
;
173 _PUBLIC_
uint32_t cli_credentials_get_gensec_features(struct cli_credentials
*creds
)
175 return creds
->gensec_features
;
180 * Obtain the username for this credentials context.
181 * @param cred credentials context
182 * @retval The username set on this context.
183 * @note Return value will never be NULL except by programmer error.
185 _PUBLIC_
const char *cli_credentials_get_username(struct cli_credentials
*cred
)
187 if (cred
->machine_account_pending
) {
188 cli_credentials_set_machine_account(cred
,
189 cred
->machine_account_pending_lp_ctx
);
192 if (cred
->username_obtained
== CRED_CALLBACK
&&
193 !cred
->callback_running
) {
194 cred
->callback_running
= true;
195 cred
->username
= cred
->username_cb(cred
);
196 cred
->callback_running
= false;
197 if (cred
->username_obtained
== CRED_CALLBACK
) {
198 cred
->username_obtained
= CRED_CALLBACK_RESULT
;
199 cli_credentials_invalidate_ccache(cred
, cred
->username_obtained
);
203 return cred
->username
;
207 * @brief Obtain the username for this credentials context.
209 * @param[in] cred The credential context.
211 * @param[in] obtained A pointer to store the obtained information.
213 * return The user name or NULL if an error occurred.
215 _PUBLIC_
const char *
216 cli_credentials_get_username_and_obtained(struct cli_credentials
*cred
,
217 enum credentials_obtained
*obtained
)
219 if (obtained
!= NULL
) {
220 *obtained
= cred
->username_obtained
;
223 return cli_credentials_get_username(cred
);
226 _PUBLIC_
bool cli_credentials_set_username(struct cli_credentials
*cred
,
227 const char *val
, enum credentials_obtained obtained
)
229 if (obtained
>= cred
->username_obtained
) {
230 cred
->username
= talloc_strdup(cred
, val
);
231 cred
->username_obtained
= obtained
;
232 cli_credentials_invalidate_ccache(cred
, cred
->username_obtained
);
239 _PUBLIC_
bool cli_credentials_set_username_callback(struct cli_credentials
*cred
,
240 const char *(*username_cb
) (struct cli_credentials
*))
242 if (cred
->username_obtained
< CRED_CALLBACK
) {
243 cred
->username_cb
= username_cb
;
244 cred
->username_obtained
= CRED_CALLBACK
;
251 _PUBLIC_
bool cli_credentials_set_bind_dn(struct cli_credentials
*cred
,
254 cred
->bind_dn
= talloc_strdup(cred
, bind_dn
);
259 * Obtain the BIND DN for this credentials context.
260 * @param cred credentials context
261 * @retval The username set on this context.
262 * @note Return value will be NULL if not specified explicitly
264 _PUBLIC_
const char *cli_credentials_get_bind_dn(struct cli_credentials
*cred
)
266 return cred
->bind_dn
;
271 * Obtain the client principal for this credentials context.
272 * @param cred credentials context
273 * @retval The username set on this context.
274 * @note Return value will never be NULL except by programmer error.
276 _PUBLIC_
char *cli_credentials_get_principal_and_obtained(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
, enum credentials_obtained
*obtained
)
278 if (cred
->machine_account_pending
) {
279 cli_credentials_set_machine_account(cred
,
280 cred
->machine_account_pending_lp_ctx
);
283 if (cred
->principal_obtained
== CRED_CALLBACK
&&
284 !cred
->callback_running
) {
285 cred
->callback_running
= true;
286 cred
->principal
= cred
->principal_cb(cred
);
287 cred
->callback_running
= false;
288 if (cred
->principal_obtained
== CRED_CALLBACK
) {
289 cred
->principal_obtained
= CRED_CALLBACK_RESULT
;
290 cli_credentials_invalidate_ccache(cred
, cred
->principal_obtained
);
294 if (cred
->principal_obtained
< cred
->username_obtained
295 || cred
->principal_obtained
< MAX(cred
->domain_obtained
, cred
->realm_obtained
)) {
296 const char *effective_username
= NULL
;
297 const char *effective_realm
= NULL
;
298 enum credentials_obtained effective_obtained
;
300 effective_username
= cli_credentials_get_username(cred
);
301 if (effective_username
== NULL
|| strlen(effective_username
) == 0) {
302 *obtained
= cred
->username_obtained
;
306 if (cred
->domain_obtained
> cred
->realm_obtained
) {
307 effective_realm
= cli_credentials_get_domain(cred
);
308 effective_obtained
= MIN(cred
->domain_obtained
,
309 cred
->username_obtained
);
311 effective_realm
= cli_credentials_get_realm(cred
);
312 effective_obtained
= MIN(cred
->realm_obtained
,
313 cred
->username_obtained
);
316 if (effective_realm
== NULL
|| strlen(effective_realm
) == 0) {
317 effective_realm
= cli_credentials_get_domain(cred
);
318 effective_obtained
= MIN(cred
->domain_obtained
,
319 cred
->username_obtained
);
322 if (effective_realm
!= NULL
&& strlen(effective_realm
) != 0) {
323 *obtained
= effective_obtained
;
324 return talloc_asprintf(mem_ctx
, "%s@%s",
329 *obtained
= cred
->principal_obtained
;
330 return talloc_strdup(mem_ctx
, cred
->principal
);
334 * Obtain the client principal for this credentials context.
335 * @param cred credentials context
336 * @retval The username set on this context.
337 * @note Return value will never be NULL except by programmer error.
339 _PUBLIC_
char *cli_credentials_get_principal(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
)
341 enum credentials_obtained obtained
;
342 return cli_credentials_get_principal_and_obtained(cred
, mem_ctx
, &obtained
);
345 _PUBLIC_
bool cli_credentials_set_principal(struct cli_credentials
*cred
,
347 enum credentials_obtained obtained
)
349 if (obtained
>= cred
->principal_obtained
) {
350 cred
->principal
= talloc_strdup(cred
, val
);
351 if (cred
->principal
== NULL
) {
354 cred
->principal_obtained
= obtained
;
356 cli_credentials_invalidate_ccache(cred
, cred
->principal_obtained
);
363 /* Set a callback to get the principal. This could be a popup dialog,
364 * a terminal prompt or similar. */
365 _PUBLIC_
bool cli_credentials_set_principal_callback(struct cli_credentials
*cred
,
366 const char *(*principal_cb
) (struct cli_credentials
*))
368 if (cred
->principal_obtained
< CRED_CALLBACK
) {
369 cred
->principal_cb
= principal_cb
;
370 cred
->principal_obtained
= CRED_CALLBACK
;
377 /* Some of our tools are 'anonymous by default'. This is a single
378 * function to determine if authentication has been explicitly
381 _PUBLIC_
bool cli_credentials_authentication_requested(struct cli_credentials
*cred
)
383 uint32_t gensec_features
= 0;
390 * If we forced the mech we clearly want authentication. E.g. to use
391 * SASL/EXTERNAL which has no credentials.
393 if (cred
->forced_sasl_mech
) {
397 if (cli_credentials_is_anonymous(cred
)){
401 if (cred
->principal_obtained
>= CRED_SPECIFIED
) {
404 if (cred
->username_obtained
>= CRED_SPECIFIED
) {
408 if (cli_credentials_get_kerberos_state(cred
) == CRED_USE_KERBEROS_REQUIRED
) {
412 gensec_features
= cli_credentials_get_gensec_features(cred
);
413 if (gensec_features
& GENSEC_FEATURE_NTLM_CCACHE
) {
417 if (gensec_features
& GENSEC_FEATURE_SIGN
) {
421 if (gensec_features
& GENSEC_FEATURE_SEAL
) {
429 * Obtain the password for this credentials context.
430 * @param cred credentials context
431 * @retval If set, the cleartext password, otherwise NULL
433 _PUBLIC_
const char *cli_credentials_get_password(struct cli_credentials
*cred
)
435 if (cred
->machine_account_pending
) {
436 cli_credentials_set_machine_account(cred
,
437 cred
->machine_account_pending_lp_ctx
);
440 if (cred
->password_obtained
== CRED_CALLBACK
&&
441 !cred
->callback_running
&&
442 !cred
->password_will_be_nt_hash
) {
443 cred
->callback_running
= true;
444 cred
->password
= cred
->password_cb(cred
);
445 cred
->callback_running
= false;
446 if (cred
->password_obtained
== CRED_CALLBACK
) {
447 cred
->password_obtained
= CRED_CALLBACK_RESULT
;
448 cli_credentials_invalidate_ccache(cred
, cred
->password_obtained
);
452 return cred
->password
;
456 * @brief Obtain the password for this credentials context.
458 * @param[in] cred The credential context.
460 * @param[in] obtained A pointer to store the obtained information.
462 * return The user name or NULL if an error occurred.
464 _PUBLIC_
const char *
465 cli_credentials_get_password_and_obtained(struct cli_credentials
*cred
,
466 enum credentials_obtained
*obtained
)
468 const char *password
= cli_credentials_get_password(cred
);
470 if (obtained
!= NULL
) {
471 *obtained
= cred
->password_obtained
;
477 /* Set a password on the credentials context, including an indication
478 * of 'how' the password was obtained */
480 _PUBLIC_
bool cli_credentials_set_password(struct cli_credentials
*cred
,
482 enum credentials_obtained obtained
)
484 if (obtained
>= cred
->password_obtained
) {
486 cred
->lm_response
= data_blob_null
;
487 cred
->nt_response
= data_blob_null
;
488 cred
->nt_hash
= NULL
;
489 cred
->password
= NULL
;
491 cli_credentials_invalidate_ccache(cred
, obtained
);
493 cred
->password_tries
= 0;
496 cred
->password_obtained
= obtained
;
500 if (cred
->password_will_be_nt_hash
) {
501 struct samr_Password
*nt_hash
= NULL
;
502 size_t val_len
= strlen(val
);
505 nt_hash
= talloc(cred
, struct samr_Password
);
506 if (nt_hash
== NULL
) {
510 converted
= strhex_to_str((char *)nt_hash
->hash
,
511 sizeof(nt_hash
->hash
),
513 if (converted
!= sizeof(nt_hash
->hash
)) {
514 TALLOC_FREE(nt_hash
);
518 cred
->nt_hash
= nt_hash
;
519 cred
->password_obtained
= obtained
;
523 cred
->password
= talloc_strdup(cred
, val
);
524 if (cred
->password
== NULL
) {
528 /* Don't print the actual password in talloc memory dumps */
529 talloc_set_name_const(cred
->password
,
530 "password set via cli_credentials_set_password");
531 cred
->password_obtained
= obtained
;
539 _PUBLIC_
bool cli_credentials_set_password_callback(struct cli_credentials
*cred
,
540 const char *(*password_cb
) (struct cli_credentials
*))
542 if (cred
->password_obtained
< CRED_CALLBACK
) {
543 cred
->password_tries
= 3;
544 cred
->password_cb
= password_cb
;
545 cred
->password_obtained
= CRED_CALLBACK
;
546 cli_credentials_invalidate_ccache(cred
, cred
->password_obtained
);
554 * Obtain the 'old' password for this credentials context (used for join accounts).
555 * @param cred credentials context
556 * @retval If set, the cleartext password, otherwise NULL
558 _PUBLIC_
const char *cli_credentials_get_old_password(struct cli_credentials
*cred
)
560 if (cred
->machine_account_pending
) {
561 cli_credentials_set_machine_account(cred
,
562 cred
->machine_account_pending_lp_ctx
);
565 return cred
->old_password
;
568 _PUBLIC_
bool cli_credentials_set_old_password(struct cli_credentials
*cred
,
570 enum credentials_obtained obtained
)
572 cred
->old_password
= talloc_strdup(cred
, val
);
573 if (cred
->old_password
) {
574 /* Don't print the actual password in talloc memory dumps */
575 talloc_set_name_const(cred
->old_password
, "password set via cli_credentials_set_old_password");
577 cred
->old_nt_hash
= NULL
;
582 * Obtain the password, in the form MD4(unicode(password)) for this credentials context.
584 * Sometimes we only have this much of the password, while the rest of
585 * the time this call avoids calling E_md4hash themselves.
587 * @param cred credentials context
588 * @retval If set, the cleartext password, otherwise NULL
590 _PUBLIC_
struct samr_Password
*cli_credentials_get_nt_hash(struct cli_credentials
*cred
,
593 enum credentials_obtained password_obtained
;
594 enum credentials_obtained ccache_threshold
;
595 enum credentials_obtained client_gss_creds_threshold
;
596 bool password_is_nt_hash
;
597 const char *password
= NULL
;
598 struct samr_Password
*nt_hash
= NULL
;
600 if (cred
->nt_hash
!= NULL
) {
602 * If we already have a hash it's easy.
608 * This is a bit tricky, with password_will_be_nt_hash
609 * we still need to get the value via the password_callback
610 * but if we did that we should not remember it's state
611 * in the long run so we need to undo it.
614 password_obtained
= cred
->password_obtained
;
615 ccache_threshold
= cred
->ccache_threshold
;
616 client_gss_creds_threshold
= cred
->client_gss_creds_threshold
;
617 password_is_nt_hash
= cred
->password_will_be_nt_hash
;
619 cred
->password_will_be_nt_hash
= false;
620 password
= cli_credentials_get_password(cred
);
622 cred
->password_will_be_nt_hash
= password_is_nt_hash
;
623 if (password_is_nt_hash
&& password_obtained
== CRED_CALLBACK
) {
625 * We got the nt_hash as string via the callback,
626 * so we need to undo the state change.
628 * And also don't remember it as plaintext password.
630 cred
->client_gss_creds_threshold
= client_gss_creds_threshold
;
631 cred
->ccache_threshold
= ccache_threshold
;
632 cred
->password_obtained
= password_obtained
;
633 cred
->password
= NULL
;
636 if (password
== NULL
) {
640 nt_hash
= talloc(cred
, struct samr_Password
);
641 if (nt_hash
== NULL
) {
645 if (password_is_nt_hash
) {
646 size_t password_len
= strlen(password
);
649 converted
= strhex_to_str((char *)nt_hash
->hash
,
650 sizeof(nt_hash
->hash
),
651 password
, password_len
);
652 if (converted
!= sizeof(nt_hash
->hash
)) {
653 TALLOC_FREE(nt_hash
);
657 E_md4hash(password
, nt_hash
->hash
);
660 cred
->nt_hash
= nt_hash
;
664 nt_hash
= talloc(mem_ctx
, struct samr_Password
);
665 if (nt_hash
== NULL
) {
669 *nt_hash
= *cred
->nt_hash
;
675 * Obtain the old password, in the form MD4(unicode(password)) for this credentials context.
677 * Sometimes we only have this much of the password, while the rest of
678 * the time this call avoids calling E_md4hash themselves.
680 * @param cred credentials context
681 * @retval If set, the cleartext password, otherwise NULL
683 _PUBLIC_
struct samr_Password
*cli_credentials_get_old_nt_hash(struct cli_credentials
*cred
,
686 const char *old_password
= NULL
;
688 if (cred
->old_nt_hash
!= NULL
) {
689 struct samr_Password
*nt_hash
= talloc(mem_ctx
, struct samr_Password
);
694 *nt_hash
= *cred
->old_nt_hash
;
699 old_password
= cli_credentials_get_old_password(cred
);
701 struct samr_Password
*nt_hash
= talloc(mem_ctx
, struct samr_Password
);
706 E_md4hash(old_password
, nt_hash
->hash
);
715 * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
716 * @param cred credentials context
717 * @retval The domain set on this context.
718 * @note Return value will never be NULL except by programmer error.
720 _PUBLIC_
const char *cli_credentials_get_domain(struct cli_credentials
*cred
)
722 if (cred
->machine_account_pending
) {
723 cli_credentials_set_machine_account(cred
,
724 cred
->machine_account_pending_lp_ctx
);
727 if (cred
->domain_obtained
== CRED_CALLBACK
&&
728 !cred
->callback_running
) {
729 cred
->callback_running
= true;
730 cred
->domain
= cred
->domain_cb(cred
);
731 cred
->callback_running
= false;
732 if (cred
->domain_obtained
== CRED_CALLBACK
) {
733 cred
->domain_obtained
= CRED_CALLBACK_RESULT
;
734 cli_credentials_invalidate_ccache(cred
, cred
->domain_obtained
);
742 _PUBLIC_
bool cli_credentials_set_domain(struct cli_credentials
*cred
,
744 enum credentials_obtained obtained
)
746 if (obtained
>= cred
->domain_obtained
) {
747 /* it is important that the domain be in upper case,
748 * particularly for the sensitive NTLMv2
750 cred
->domain
= strupper_talloc(cred
, val
);
751 cred
->domain_obtained
= obtained
;
752 /* setting domain does not mean we have to invalidate ccache
753 * because domain in not used for Kerberos operations.
754 * If ccache invalidation is required, one will anyway specify
755 * a password to kinit, and that will force invalidation of the ccache
763 bool cli_credentials_set_domain_callback(struct cli_credentials
*cred
,
764 const char *(*domain_cb
) (struct cli_credentials
*))
766 if (cred
->domain_obtained
< CRED_CALLBACK
) {
767 cred
->domain_cb
= domain_cb
;
768 cred
->domain_obtained
= CRED_CALLBACK
;
776 * Obtain the Kerberos realm for this credentials context.
777 * @param cred credentials context
778 * @retval The realm set on this context.
779 * @note Return value will never be NULL except by programmer error.
781 _PUBLIC_
const char *cli_credentials_get_realm(struct cli_credentials
*cred
)
783 if (cred
->machine_account_pending
) {
784 cli_credentials_set_machine_account(cred
,
785 cred
->machine_account_pending_lp_ctx
);
788 if (cred
->realm_obtained
== CRED_CALLBACK
&&
789 !cred
->callback_running
) {
790 cred
->callback_running
= true;
791 cred
->realm
= cred
->realm_cb(cred
);
792 cred
->callback_running
= false;
793 if (cred
->realm_obtained
== CRED_CALLBACK
) {
794 cred
->realm_obtained
= CRED_CALLBACK_RESULT
;
795 cli_credentials_invalidate_ccache(cred
, cred
->realm_obtained
);
803 * Set the realm for this credentials context, and force it to
804 * uppercase for the sanity of our local kerberos libraries
806 _PUBLIC_
bool cli_credentials_set_realm(struct cli_credentials
*cred
,
808 enum credentials_obtained obtained
)
810 if (obtained
>= cred
->realm_obtained
) {
811 cred
->realm
= strupper_talloc(cred
, val
);
812 cred
->realm_obtained
= obtained
;
813 cli_credentials_invalidate_ccache(cred
, cred
->realm_obtained
);
820 bool cli_credentials_set_realm_callback(struct cli_credentials
*cred
,
821 const char *(*realm_cb
) (struct cli_credentials
*))
823 if (cred
->realm_obtained
< CRED_CALLBACK
) {
824 cred
->realm_cb
= realm_cb
;
825 cred
->realm_obtained
= CRED_CALLBACK
;
833 * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
835 * @param cred credentials context
836 * @retval The workstation name set on this context.
837 * @note Return value will never be NULL except by programmer error.
839 _PUBLIC_
const char *cli_credentials_get_workstation(struct cli_credentials
*cred
)
841 if (cred
->workstation_obtained
== CRED_CALLBACK
&&
842 !cred
->callback_running
) {
843 cred
->callback_running
= true;
844 cred
->workstation
= cred
->workstation_cb(cred
);
845 cred
->callback_running
= false;
846 if (cred
->workstation_obtained
== CRED_CALLBACK
) {
847 cred
->workstation_obtained
= CRED_CALLBACK_RESULT
;
851 return cred
->workstation
;
854 _PUBLIC_
bool cli_credentials_set_workstation(struct cli_credentials
*cred
,
856 enum credentials_obtained obtained
)
858 if (obtained
>= cred
->workstation_obtained
) {
859 cred
->workstation
= talloc_strdup(cred
, val
);
860 cred
->workstation_obtained
= obtained
;
867 bool cli_credentials_set_workstation_callback(struct cli_credentials
*cred
,
868 const char *(*workstation_cb
) (struct cli_credentials
*))
870 if (cred
->workstation_obtained
< CRED_CALLBACK
) {
871 cred
->workstation_cb
= workstation_cb
;
872 cred
->workstation_obtained
= CRED_CALLBACK
;
880 * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
882 * The format accepted is [domain\\]user[%password] or user[@realm][%password]
884 * @param credentials Credentials structure on which to set the password
885 * @param data the string containing the username, password etc
886 * @param obtained This enum describes how 'specified' this password is
889 _PUBLIC_
void cli_credentials_parse_string(struct cli_credentials
*credentials
, const char *data
, enum credentials_obtained obtained
)
892 char *uname_free
= NULL
;
894 if (strcmp("%",data
) == 0) {
895 cli_credentials_set_anonymous(credentials
);
899 uname
= talloc_strdup(credentials
, data
);
902 if ((p
= strchr_m(uname
,'%'))) {
904 cli_credentials_set_password(credentials
, p
+1, obtained
);
907 if ((p
= strchr_m(uname
,'@'))) {
909 * We also need to set username and domain
910 * in order to undo the effect of
911 * cli_credentials_guess().
913 cli_credentials_set_username(credentials
, uname
, obtained
);
914 cli_credentials_set_domain(credentials
, "", obtained
);
916 cli_credentials_set_principal(credentials
, uname
, obtained
);
918 cli_credentials_set_realm(credentials
, p
+1, obtained
);
919 TALLOC_FREE(uname_free
);
921 } else if ((p
= strchr_m(uname
,'\\'))
922 || (p
= strchr_m(uname
, '/'))
923 || (p
= strchr_m(uname
, credentials
->winbind_separator
)))
925 const char *domain
= NULL
;
931 if (obtained
== credentials
->realm_obtained
&&
932 !strequal_m(credentials
->domain
, domain
))
935 * We need to undo a former set with the same level
936 * in order to get the expected result from
937 * cli_credentials_get_principal().
939 * But we only need to do that if the domain
942 cli_credentials_set_realm(credentials
, domain
, obtained
);
944 cli_credentials_set_domain(credentials
, domain
, obtained
);
946 if (obtained
== credentials
->principal_obtained
&&
947 !strequal_m(credentials
->username
, uname
))
950 * We need to undo a former set with the same level
951 * in order to get the expected result from
952 * cli_credentials_get_principal().
954 * But we only need to do that if the username
957 credentials
->principal_obtained
= CRED_UNINITIALISED
;
958 credentials
->principal
= NULL
;
960 cli_credentials_set_username(credentials
, uname
, obtained
);
962 TALLOC_FREE(uname_free
);
966 * Given a a credentials structure, print it as a string
968 * The format output is [domain\\]user[%password] or user[@realm][%password]
970 * @param credentials Credentials structure on which to set the password
971 * @param mem_ctx The memory context to place the result on
974 _PUBLIC_
char *cli_credentials_get_unparsed_name(struct cli_credentials
*credentials
, TALLOC_CTX
*mem_ctx
)
976 const char *bind_dn
= cli_credentials_get_bind_dn(credentials
);
977 const char *domain
= NULL
;
978 const char *username
= NULL
;
982 name
= talloc_strdup(mem_ctx
, bind_dn
);
984 cli_credentials_get_ntlm_username_domain(credentials
, mem_ctx
, &username
, &domain
);
985 if (domain
&& domain
[0]) {
986 name
= talloc_asprintf(mem_ctx
, "%s\\%s",
989 name
= talloc_asprintf(mem_ctx
, "%s",
998 * Specifies default values for domain, workstation and realm
999 * from the smb.conf configuration file
1001 * @param cred Credentials structure to fill in
1003 * @return true on success, false on error.
1005 _PUBLIC_
bool cli_credentials_set_conf(struct cli_credentials
*cred
,
1006 struct loadparm_context
*lp_ctx
)
1008 const char *sep
= NULL
;
1009 const char *realm
= lpcfg_realm(lp_ctx
);
1010 enum credentials_client_protection protection
=
1011 lpcfg_client_protection(lp_ctx
);
1012 const char *workgroup
= lpcfg_workgroup(lp_ctx
);
1013 const char *netbios_name
= lpcfg_netbios_name(lp_ctx
);
1016 (void)cli_credentials_set_username(cred
, "", CRED_UNINITIALISED
);
1018 if (workgroup
!= NULL
&& strlen(workgroup
) == 0) {
1022 if (workgroup
!= NULL
) {
1023 if (lpcfg_parm_is_cmdline(lp_ctx
, "workgroup")) {
1024 ok
= cli_credentials_set_domain(cred
,
1028 DBG_ERR("Failed to set domain!\n");
1032 (void)cli_credentials_set_domain(cred
,
1038 if (netbios_name
!= NULL
&& strlen(netbios_name
) == 0) {
1039 netbios_name
= NULL
;
1042 if (netbios_name
!= NULL
) {
1043 if (lpcfg_parm_is_cmdline(lp_ctx
, "netbios name")) {
1044 ok
= cli_credentials_set_workstation(cred
,
1048 DBG_ERR("Failed to set workstation!\n");
1052 (void)cli_credentials_set_workstation(cred
,
1058 if (realm
!= NULL
&& strlen(realm
) == 0) {
1062 if (realm
!= NULL
) {
1063 if (lpcfg_parm_is_cmdline(lp_ctx
, "realm")) {
1064 ok
= cli_credentials_set_realm(cred
,
1068 DBG_ERR("Failed to set realm!\n");
1072 (void)cli_credentials_set_realm(cred
,
1078 sep
= lpcfg_winbind_separator(lp_ctx
);
1079 if (sep
!= NULL
&& sep
[0] != '\0') {
1080 cred
->winbind_separator
= *lpcfg_winbind_separator(lp_ctx
);
1083 if (cred
->signing_state_obtained
<= CRED_SMB_CONF
) {
1084 /* Will be set to default for invalid smb.conf values */
1085 cred
->signing_state
= lpcfg_client_signing(lp_ctx
);
1086 if (cred
->signing_state
== SMB_SIGNING_DEFAULT
) {
1087 switch (protection
) {
1088 case CRED_CLIENT_PROTECTION_DEFAULT
:
1090 case CRED_CLIENT_PROTECTION_PLAIN
:
1091 cred
->signing_state
= SMB_SIGNING_OFF
;
1093 case CRED_CLIENT_PROTECTION_SIGN
:
1094 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1095 cred
->signing_state
= SMB_SIGNING_REQUIRED
;
1100 cred
->signing_state_obtained
= CRED_SMB_CONF
;
1103 if (cred
->ipc_signing_state_obtained
<= CRED_SMB_CONF
) {
1104 /* Will be set to required for invalid smb.conf values */
1105 cred
->ipc_signing_state
= lpcfg_client_ipc_signing(lp_ctx
);
1106 cred
->ipc_signing_state_obtained
= CRED_SMB_CONF
;
1109 if (cred
->encryption_state_obtained
<= CRED_SMB_CONF
) {
1110 /* Will be set to default for invalid smb.conf values */
1111 cred
->encryption_state
= lpcfg_client_smb_encrypt(lp_ctx
);
1112 if (cred
->encryption_state
== SMB_ENCRYPTION_DEFAULT
) {
1113 switch (protection
) {
1114 case CRED_CLIENT_PROTECTION_DEFAULT
:
1116 case CRED_CLIENT_PROTECTION_PLAIN
:
1117 case CRED_CLIENT_PROTECTION_SIGN
:
1118 cred
->encryption_state
= SMB_ENCRYPTION_OFF
;
1120 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1121 cred
->encryption_state
= SMB_ENCRYPTION_REQUIRED
;
1127 if (cred
->kerberos_state_obtained
<= CRED_SMB_CONF
) {
1128 /* Will be set to default for invalid smb.conf values */
1129 cred
->kerberos_state
= lpcfg_client_use_kerberos(lp_ctx
);
1130 cred
->kerberos_state_obtained
= CRED_SMB_CONF
;
1133 if (cred
->gensec_features_obtained
<= CRED_SMB_CONF
) {
1134 switch (protection
) {
1135 case CRED_CLIENT_PROTECTION_DEFAULT
:
1137 case CRED_CLIENT_PROTECTION_PLAIN
:
1138 cred
->gensec_features
= 0;
1140 case CRED_CLIENT_PROTECTION_SIGN
:
1141 cred
->gensec_features
= GENSEC_FEATURE_SIGN
;
1143 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1144 cred
->gensec_features
=
1145 GENSEC_FEATURE_SIGN
|GENSEC_FEATURE_SEAL
;
1148 cred
->gensec_features_obtained
= CRED_SMB_CONF
;
1155 * Guess defaults for credentials from environment variables,
1156 * and from the configuration file
1158 * @param cred Credentials structure to fill in
1160 _PUBLIC_
bool cli_credentials_guess(struct cli_credentials
*cred
,
1161 struct loadparm_context
*lp_ctx
)
1163 const char *error_string
;
1164 const char *env
= NULL
;
1165 struct passwd
*pwd
= NULL
;
1168 if (lp_ctx
!= NULL
) {
1169 ok
= cli_credentials_set_conf(cred
, lp_ctx
);
1175 pwd
= getpwuid(getuid());
1177 size_t len
= strlen(pwd
->pw_name
);
1179 if (len
> 0 && len
<= 1024) {
1180 (void)cli_credentials_parse_string(cred
,
1186 env
= getenv("LOGNAME");
1188 size_t len
= strlen(env
);
1190 if (len
> 0 && len
<= 1024) {
1191 (void)cli_credentials_set_username(cred
,
1197 env
= getenv("USER");
1199 size_t len
= strlen(env
);
1201 if (len
> 0 && len
<= 1024) {
1204 (void)cli_credentials_parse_string(cred
,
1207 if ((p
= strchr_m(env
, '%'))) {
1208 memset(p
, '\0', strlen(cred
->password
));
1213 env
= getenv("PASSWD");
1215 size_t len
= strlen(env
);
1217 if (len
> 0 && len
<= 1024) {
1218 (void)cli_credentials_set_password(cred
,
1224 env
= getenv("PASSWD_FD");
1226 size_t len
= strlen(env
);
1228 if (len
> 0 && len
<= 1024) {
1231 (void)cli_credentials_parse_password_fd(cred
,
1237 env
= getenv("PASSWD_FILE");
1239 size_t len
= strlen(env
);
1241 if (len
> 0 && len
<= 4096) {
1242 (void)cli_credentials_parse_password_file(cred
,
1248 if (lp_ctx
!= NULL
&&
1249 cli_credentials_get_kerberos_state(cred
) != CRED_USE_KERBEROS_DISABLED
) {
1250 (void)cli_credentials_set_ccache(cred
,
1261 * Attach NETLOGON credentials for use with SCHANNEL
1264 _PUBLIC_
void cli_credentials_set_netlogon_creds(
1265 struct cli_credentials
*cred
,
1266 const struct netlogon_creds_CredentialState
*netlogon_creds
)
1268 TALLOC_FREE(cred
->netlogon_creds
);
1269 if (netlogon_creds
== NULL
) {
1272 cred
->netlogon_creds
= netlogon_creds_copy(cred
, netlogon_creds
);
1276 * Return attached NETLOGON credentials
1279 _PUBLIC_
struct netlogon_creds_CredentialState
*cli_credentials_get_netlogon_creds(struct cli_credentials
*cred
)
1281 return cred
->netlogon_creds
;
1285 * Set NETLOGON secure channel type
1288 _PUBLIC_
void cli_credentials_set_secure_channel_type(struct cli_credentials
*cred
,
1289 enum netr_SchannelType secure_channel_type
)
1291 cred
->secure_channel_type
= secure_channel_type
;
1295 * Return NETLOGON secure channel type
1298 _PUBLIC_
time_t cli_credentials_get_password_last_changed_time(struct cli_credentials
*cred
)
1300 return cred
->password_last_changed_time
;
1304 * Set NETLOGON secure channel type
1307 _PUBLIC_
void cli_credentials_set_password_last_changed_time(struct cli_credentials
*cred
,
1308 time_t last_changed_time
)
1310 cred
->password_last_changed_time
= last_changed_time
;
1314 * Return NETLOGON secure channel type
1317 _PUBLIC_
enum netr_SchannelType
cli_credentials_get_secure_channel_type(struct cli_credentials
*cred
)
1319 return cred
->secure_channel_type
;
1323 * Fill in a credentials structure as the anonymous user
1325 _PUBLIC_
void cli_credentials_set_anonymous(struct cli_credentials
*cred
)
1327 cli_credentials_set_username(cred
, "", CRED_SPECIFIED
);
1328 cli_credentials_set_domain(cred
, "", CRED_SPECIFIED
);
1329 cli_credentials_set_password(cred
, NULL
, CRED_SPECIFIED
);
1330 cli_credentials_set_principal(cred
, NULL
, CRED_SPECIFIED
);
1331 cli_credentials_set_realm(cred
, NULL
, CRED_SPECIFIED
);
1332 cli_credentials_set_workstation(cred
, "", CRED_UNINITIALISED
);
1333 cli_credentials_set_kerberos_state(cred
,
1334 CRED_USE_KERBEROS_DISABLED
,
1339 * Describe a credentials context as anonymous or authenticated
1340 * @retval true if anonymous, false if a username is specified
1343 _PUBLIC_
bool cli_credentials_is_anonymous(struct cli_credentials
*cred
)
1345 const char *username
;
1347 /* if bind dn is set it's not anonymous */
1348 if (cred
->bind_dn
) {
1352 if (cred
->machine_account_pending
) {
1353 cli_credentials_set_machine_account(cred
,
1354 cred
->machine_account_pending_lp_ctx
);
1357 /* if principal is set, it's not anonymous */
1358 if ((cred
->principal
!= NULL
) && cred
->principal_obtained
>= cred
->username_obtained
) {
1362 username
= cli_credentials_get_username(cred
);
1364 /* Yes, it is deliberate that we die if we have a NULL pointer
1365 * here - anonymous is "", not NULL, which is 'never specified,
1366 * never guessed', ie programmer bug */
1375 * Mark the current password for a credentials struct as wrong. This will
1376 * cause the password to be prompted again (if a callback is set).
1378 * This will decrement the number of times the password can be tried.
1380 * @retval whether the credentials struct is finished
1382 _PUBLIC_
bool cli_credentials_wrong_password(struct cli_credentials
*cred
)
1384 if (cred
->password_obtained
!= CRED_CALLBACK_RESULT
) {
1388 if (cred
->password_tries
== 0) {
1392 cred
->password_tries
--;
1394 if (cred
->password_tries
== 0) {
1398 cred
->password_obtained
= CRED_CALLBACK
;
1402 _PUBLIC_
void cli_credentials_get_ntlm_username_domain(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
,
1403 const char **username
,
1404 const char **domain
)
1406 if (cred
->principal_obtained
>= cred
->username_obtained
) {
1407 *domain
= talloc_strdup(mem_ctx
, "");
1408 *username
= cli_credentials_get_principal(cred
, mem_ctx
);
1410 *domain
= cli_credentials_get_domain(cred
);
1411 *username
= cli_credentials_get_username(cred
);
1416 * Read a named file, and parse it for username, domain, realm and password
1418 * @param credentials Credentials structure on which to set the password
1419 * @param file a named file to read the details from
1420 * @param obtained This enum describes how 'specified' this password is
1423 _PUBLIC_
bool cli_credentials_parse_file(struct cli_credentials
*cred
, const char *file
, enum credentials_obtained obtained
)
1426 char *ptr
, *val
, *param
;
1429 const char *realm
= NULL
;
1430 const char *domain
= NULL
;
1431 const char *password
= NULL
;
1432 const char *username
= NULL
;
1434 lines
= file_lines_load(file
, &numlines
, 0, NULL
);
1438 /* fail if we can't open the credentials file */
1439 d_printf("ERROR: Unable to open credentials file!\n");
1443 for (i
= 0; i
< numlines
; i
++) {
1444 len
= strlen(lines
[i
]);
1449 /* break up the line into parameter & value.
1450 * will need to eat a little whitespace possibly */
1452 if (!(ptr
= strchr_m (lines
[i
], '=')))
1458 /* eat leading white space */
1459 while ((*val
!='\0') && ((*val
==' ') || (*val
=='\t')))
1462 if (strwicmp("password", param
) == 0) {
1464 } else if (strwicmp("username", param
) == 0) {
1466 } else if (strwicmp("domain", param
) == 0) {
1468 } else if (strwicmp("realm", param
) == 0) {
1473 * We need to readd '=' in order to let
1474 * the strlen() work in the last loop
1475 * that clears the memory.
1480 if (realm
!= NULL
&& strlen(realm
) != 0) {
1482 * only overwrite with a valid string
1484 cli_credentials_set_realm(cred
, realm
, obtained
);
1487 if (domain
!= NULL
&& strlen(domain
) != 0) {
1489 * only overwrite with a valid string
1491 cli_credentials_set_domain(cred
, domain
, obtained
);
1494 if (password
!= NULL
) {
1498 cli_credentials_set_password(cred
, password
, obtained
);
1501 if (username
!= NULL
) {
1503 * The last "username" line takes preference
1504 * if the string also contains domain, realm or
1507 cli_credentials_parse_string(cred
, username
, obtained
);
1510 for (i
= 0; i
< numlines
; i
++) {
1511 len
= strlen(lines
[i
]);
1512 memset(lines
[i
], 0, len
);
1520 * Read a named file, and parse it for a password
1522 * @param credentials Credentials structure on which to set the password
1523 * @param file a named file to read the password from
1524 * @param obtained This enum describes how 'specified' this password is
1527 _PUBLIC_
bool cli_credentials_parse_password_file(struct cli_credentials
*credentials
, const char *file
, enum credentials_obtained obtained
)
1529 int fd
= open(file
, O_RDONLY
, 0);
1533 fprintf(stderr
, "Error opening password file %s: %s\n",
1534 file
, strerror(errno
));
1538 ret
= cli_credentials_parse_password_fd(credentials
, fd
, obtained
);
1547 * Read a file descriptor, and parse it for a password (eg from a file or stdin)
1549 * @param credentials Credentials structure on which to set the password
1550 * @param fd open file descriptor to read the password from
1551 * @param obtained This enum describes how 'specified' this password is
1554 _PUBLIC_
bool cli_credentials_parse_password_fd(struct cli_credentials
*credentials
,
1555 int fd
, enum credentials_obtained obtained
)
1560 if (credentials
->password_obtained
>= obtained
) {
1564 for(p
= pass
, *p
= '\0'; /* ensure that pass is null-terminated */
1565 p
&& p
- pass
< sizeof(pass
) - 1;) {
1566 switch (read(fd
, p
, 1)) {
1568 if (*p
!= '\n' && *p
!= '\0') {
1569 *++p
= '\0'; /* advance p, and null-terminate pass */
1576 *p
= '\0'; /* null-terminate it, just in case... */
1577 p
= NULL
; /* then force the loop condition to become false */
1582 "Error reading password from file descriptor "
1583 "%d: empty password\n",
1588 fprintf(stderr
, "Error reading password from file descriptor %d: %s\n",
1589 fd
, strerror(errno
));
1594 cli_credentials_set_password(credentials
, pass
, obtained
);
1599 * @brief Set the SMB signing state to request for a SMB connection.
1601 * @param[in] creds The credentials structure to update.
1603 * @param[in] signing_state The signing state to set.
1605 * @param obtained This way the described signing state was specified.
1607 * @return true if we could set the signing state, false otherwise.
1609 _PUBLIC_
bool cli_credentials_set_smb_signing(struct cli_credentials
*creds
,
1610 enum smb_signing_setting signing_state
,
1611 enum credentials_obtained obtained
)
1613 if (obtained
>= creds
->signing_state_obtained
) {
1614 creds
->signing_state_obtained
= obtained
;
1615 creds
->signing_state
= signing_state
;
1623 * @brief Obtain the SMB signing state from a credentials structure.
1625 * @param[in] creds The credential structure to obtain the SMB signing state
1628 * @return The SMB signing state.
1630 _PUBLIC_
enum smb_signing_setting
1631 cli_credentials_get_smb_signing(struct cli_credentials
*creds
)
1633 return creds
->signing_state
;
1637 * @brief Set the SMB IPC signing state to request for a SMB connection.
1639 * @param[in] creds The credentials structure to update.
1641 * @param[in] signing_state The signing state to set.
1643 * @param obtained This way the described signing state was specified.
1645 * @return true if we could set the signing state, false otherwise.
1648 cli_credentials_set_smb_ipc_signing(struct cli_credentials
*creds
,
1649 enum smb_signing_setting ipc_signing_state
,
1650 enum credentials_obtained obtained
)
1652 if (obtained
>= creds
->ipc_signing_state_obtained
) {
1653 creds
->ipc_signing_state_obtained
= obtained
;
1654 creds
->ipc_signing_state
= ipc_signing_state
;
1662 * @brief Obtain the SMB IPC signing state from a credentials structure.
1664 * @param[in] creds The credential structure to obtain the SMB IPC signing
1667 * @return The SMB signing state.
1669 _PUBLIC_
enum smb_signing_setting
1670 cli_credentials_get_smb_ipc_signing(struct cli_credentials
*creds
)
1672 return creds
->ipc_signing_state
;
1676 * @brief Set the SMB encryption state to request for a SMB connection.
1678 * @param[in] creds The credentials structure to update.
1680 * @param[in] encryption_state The encryption state to set.
1682 * @param obtained This way the described encryption state was specified.
1684 * @return true if we could set the encryption state, false otherwise.
1686 _PUBLIC_
bool cli_credentials_set_smb_encryption(struct cli_credentials
*creds
,
1687 enum smb_encryption_setting encryption_state
,
1688 enum credentials_obtained obtained
)
1690 if (obtained
>= creds
->encryption_state_obtained
) {
1691 creds
->encryption_state_obtained
= obtained
;
1692 creds
->encryption_state
= encryption_state
;
1699 static const char *obtained_to_str(enum credentials_obtained obtained
)
1702 case CRED_UNINITIALISED
:
1703 return "CRED_UNINITIALISED";
1705 return "CRED_SMB_CONF";
1707 return "CRED_CALLBACK";
1708 case CRED_GUESS_ENV
:
1709 return "CRED_GUESS_ENV";
1710 case CRED_GUESS_FILE
:
1711 return "CRED_GUESS_FILE";
1712 case CRED_CALLBACK_RESULT
:
1713 return "CRED_CALLBACK_RESULT";
1714 case CRED_SPECIFIED
:
1715 return "CRED_SPECIFIED";
1722 static const char *krb5_state_to_str(enum credentials_use_kerberos krb5_state
)
1724 switch (krb5_state
) {
1725 case CRED_USE_KERBEROS_DISABLED
:
1726 return "CRED_USE_KERBEROS_DISABLED";
1727 case CRED_USE_KERBEROS_DESIRED
:
1728 return "CRED_USE_KERBEROS_DESIRED";
1729 case CRED_USE_KERBEROS_REQUIRED
:
1730 return "CRED_USE_KERBEROS_REQUIRED";
1737 static const char *krb5_fwd_to_str(enum credentials_krb_forwardable krb5_fwd
)
1740 case CRED_AUTO_KRB_FORWARDABLE
:
1741 return "CRED_AUTO_KRB_FORWARDABLE";
1742 case CRED_NO_KRB_FORWARDABLE
:
1743 return "CRED_NO_KRB_FORWARDABLE";
1744 case CRED_FORCE_KRB_FORWARDABLE
:
1745 return "CRED_FORCE_KRB_FORWARDABLE";
1752 static const char *signing_state_to_str(enum smb_signing_setting signing_state
)
1754 switch(signing_state
) {
1755 case SMB_SIGNING_IPC_DEFAULT
:
1756 return "SMB_SIGNING_IPC_DEFAULT";
1757 case SMB_SIGNING_DEFAULT
:
1758 return "SMB_SIGNING_DEFAULT";
1759 case SMB_SIGNING_OFF
:
1760 return "SMB_SIGNING_OFF";
1761 case SMB_SIGNING_IF_REQUIRED
:
1762 return "SMB_SIGNING_IF_REQUIRED";
1763 case SMB_SIGNING_DESIRED
:
1764 return "SMB_SIGNING_DESIRED";
1765 case SMB_SIGNING_REQUIRED
:
1766 return "SMB_SIGNING_REQUIRED";
1773 static const char *encryption_state_to_str(enum smb_encryption_setting encryption_state
)
1775 switch(encryption_state
) {
1776 case SMB_ENCRYPTION_DEFAULT
:
1777 return "SMB_ENCRYPTION_DEFAULT";
1778 case SMB_ENCRYPTION_OFF
:
1779 return "SMB_ENCRYPTION_OFF";
1780 case SMB_ENCRYPTION_IF_REQUIRED
:
1781 return "SMB_ENCRYPTION_IF_REQUIRED";
1782 case SMB_ENCRYPTION_DESIRED
:
1783 return "SMB_ENCRYPTION_DESIRED";
1784 case SMB_ENCRYPTION_REQUIRED
:
1785 return "SMB_ENCRYPTION_REQUIRED";
1792 _PUBLIC_
void cli_credentials_dump(struct cli_credentials
*creds
)
1794 DBG_ERR("CLI_CREDENTIALS:\n");
1796 DBG_ERR(" Username: %s - %s\n",
1798 obtained_to_str(creds
->username_obtained
));
1799 DBG_ERR(" Workstation: %s - %s\n",
1801 obtained_to_str(creds
->workstation_obtained
));
1802 DBG_ERR(" Domain: %s - %s\n",
1804 obtained_to_str(creds
->domain_obtained
));
1805 DBG_ERR(" Password: %s - %s\n",
1806 creds
->password
!= NULL
? "*SECRET*" : "NULL",
1807 obtained_to_str(creds
->password_obtained
));
1808 DBG_ERR(" Old password: %s\n",
1809 creds
->old_password
!= NULL
? "*SECRET*" : "NULL");
1810 DBG_ERR(" Password tries: %u\n",
1811 creds
->password_tries
);
1812 DBG_ERR(" Realm: %s - %s\n",
1814 obtained_to_str(creds
->realm_obtained
));
1815 DBG_ERR(" Principal: %s - %s\n",
1817 obtained_to_str(creds
->principal_obtained
));
1818 DBG_ERR(" Salt principal: %s\n",
1819 creds
->salt_principal
);
1820 DBG_ERR(" Impersonate principal: %s\n",
1821 creds
->impersonate_principal
);
1822 DBG_ERR(" Self service: %s\n",
1823 creds
->self_service
);
1824 DBG_ERR(" Target service: %s\n",
1825 creds
->target_service
);
1826 DBG_ERR(" Kerberos state: %s - %s\n",
1827 krb5_state_to_str(creds
->kerberos_state
),
1828 obtained_to_str(creds
->kerberos_state_obtained
));
1829 DBG_ERR(" Kerberos forwardable ticket: %s\n",
1830 krb5_fwd_to_str(creds
->krb_forwardable
));
1831 DBG_ERR(" Signing state: %s - %s\n",
1832 signing_state_to_str(creds
->signing_state
),
1833 obtained_to_str(creds
->signing_state_obtained
));
1834 DBG_ERR(" IPC signing state: %s - %s\n",
1835 signing_state_to_str(creds
->ipc_signing_state
),
1836 obtained_to_str(creds
->ipc_signing_state_obtained
));
1837 DBG_ERR(" Encryption state: %s - %s\n",
1838 encryption_state_to_str(creds
->encryption_state
),
1839 obtained_to_str(creds
->encryption_state_obtained
));
1840 DBG_ERR(" Gensec features: %#X\n",
1841 creds
->gensec_features
);
1842 DBG_ERR(" Forced sasl mech: %s\n",
1843 creds
->forced_sasl_mech
);
1844 DBG_ERR(" CCACHE: %p - %s\n",
1846 obtained_to_str(creds
->ccache_obtained
));
1847 DBG_ERR(" CLIENT_GSS_CREDS: %p - %s\n",
1848 creds
->client_gss_creds
,
1849 obtained_to_str(creds
->client_gss_creds_obtained
));
1850 DBG_ERR(" SERVER_GSS_CREDS: %p - %s\n",
1851 creds
->server_gss_creds
,
1852 obtained_to_str(creds
->server_gss_creds_obtained
));
1853 DBG_ERR(" KEYTAB: %p - %s\n",
1855 obtained_to_str(creds
->keytab_obtained
));
1856 DBG_ERR(" KVNO: %u\n",
1862 * @brief Obtain the SMB encryption state from a credentials structure.
1864 * @param[in] creds The credential structure to obtain the SMB encryption state
1867 * @return The SMB signing state.
1869 _PUBLIC_
enum smb_encryption_setting
1870 cli_credentials_get_smb_encryption(struct cli_credentials
*creds
)
1872 return creds
->encryption_state
;
1876 * Encrypt a data blob using the session key and the negotiated encryption
1879 * @param state Credential state, contains the session key and algorithm
1880 * @param data Data blob containing the data to be encrypted.
1883 _PUBLIC_ NTSTATUS
netlogon_creds_session_encrypt(
1884 struct netlogon_creds_CredentialState
*state
,
1889 if (data
.data
== NULL
|| data
.length
== 0) {
1890 DBG_ERR("Nothing to encrypt "
1891 "data.data == NULL or data.length == 0\n");
1892 return NT_STATUS_INVALID_PARAMETER
;
1895 * Don't crypt an all-zero password it will give away the
1896 * NETLOGON pipe session key .
1898 if (all_zero(data
.data
, data
.length
)) {
1899 DBG_ERR("Supplied data all zeros, could leak session key\n");
1900 return NT_STATUS_INVALID_PARAMETER
;
1902 if (state
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
1903 status
= netlogon_creds_aes_encrypt(state
,
1906 } else if (state
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
) {
1907 status
= netlogon_creds_arcfour_crypt(state
,
1911 DBG_ERR("Unsupported encryption option negotiated\n");
1912 status
= NT_STATUS_NOT_SUPPORTED
;
1914 if (!NT_STATUS_IS_OK(status
)) {
1917 return NT_STATUS_OK
;