2 Unix SMB/CIFS implementation.
4 User credentials handling
6 Copyright (C) Jelmer Vernooij 2005
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/util/util_file.h"
26 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
27 #include "auth/credentials/credentials.h"
28 #include "auth/credentials/credentials_internal.h"
29 #include "auth/gensec/gensec.h"
30 #include "libcli/auth/libcli_auth.h"
32 #include "param/param.h"
33 #include "system/filesys.h"
34 #include "system/passwd.h"
37 * Create a new credentials structure
38 * @param mem_ctx TALLOC_CTX parent for credentials structure
40 _PUBLIC_
struct cli_credentials
*cli_credentials_init(TALLOC_CTX
*mem_ctx
)
42 struct cli_credentials
*cred
= talloc_zero(mem_ctx
, struct cli_credentials
);
47 cred
->winbind_separator
= '\\';
49 cred
->kerberos_state
= CRED_USE_KERBEROS_DESIRED
;
51 cred
->signing_state
= SMB_SIGNING_DEFAULT
;
54 * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use
55 * the same value here.
57 cred
->ipc_signing_state
= SMB_SIGNING_REQUIRED
;
58 cred
->encryption_state
= SMB_ENCRYPTION_DEFAULT
;
64 struct cli_credentials
*cli_credentials_init_server(TALLOC_CTX
*mem_ctx
,
65 struct loadparm_context
*lp_ctx
)
67 struct cli_credentials
*server_creds
= NULL
;
71 server_creds
= cli_credentials_init(mem_ctx
);
72 if (server_creds
== NULL
) {
76 ok
= cli_credentials_set_conf(server_creds
, lp_ctx
);
78 TALLOC_FREE(server_creds
);
82 status
= cli_credentials_set_machine_account(server_creds
, lp_ctx
);
83 if (!NT_STATUS_IS_OK(status
)) {
84 DEBUG(1, ("Failed to obtain server credentials: %s\n",
86 TALLOC_FREE(server_creds
);
93 _PUBLIC_
void cli_credentials_set_callback_data(struct cli_credentials
*cred
,
96 cred
->priv_data
= callback_data
;
99 _PUBLIC_
void *_cli_credentials_callback_data(struct cli_credentials
*cred
)
101 return cred
->priv_data
;
105 * Create a new anonymous credential
106 * @param mem_ctx TALLOC_CTX parent for credentials structure
108 _PUBLIC_
struct cli_credentials
*cli_credentials_init_anon(TALLOC_CTX
*mem_ctx
)
110 struct cli_credentials
*anon_credentials
;
112 anon_credentials
= cli_credentials_init(mem_ctx
);
113 cli_credentials_set_anonymous(anon_credentials
);
115 return anon_credentials
;
118 _PUBLIC_
bool cli_credentials_set_kerberos_state(struct cli_credentials
*creds
,
119 enum credentials_use_kerberos kerberos_state
,
120 enum credentials_obtained obtained
)
122 if (obtained
>= creds
->kerberos_state_obtained
) {
123 creds
->kerberos_state
= kerberos_state
;
124 creds
->kerberos_state_obtained
= obtained
;
132 _PUBLIC_
void cli_credentials_set_forced_sasl_mech(struct cli_credentials
*creds
,
133 const char *sasl_mech
)
135 TALLOC_FREE(creds
->forced_sasl_mech
);
136 creds
->forced_sasl_mech
= talloc_strdup(creds
, sasl_mech
);
139 _PUBLIC_
void cli_credentials_set_krb_forwardable(struct cli_credentials
*creds
,
140 enum credentials_krb_forwardable krb_forwardable
)
142 creds
->krb_forwardable
= krb_forwardable
;
145 _PUBLIC_
enum credentials_use_kerberos
cli_credentials_get_kerberos_state(struct cli_credentials
*creds
)
147 return creds
->kerberos_state
;
150 _PUBLIC_
enum credentials_obtained
cli_credentials_get_kerberos_state_obtained(struct cli_credentials
*creds
)
152 return creds
->kerberos_state_obtained
;
155 _PUBLIC_
const char *cli_credentials_get_forced_sasl_mech(struct cli_credentials
*creds
)
157 return creds
->forced_sasl_mech
;
160 _PUBLIC_
enum credentials_krb_forwardable
cli_credentials_get_krb_forwardable(struct cli_credentials
*creds
)
162 return creds
->krb_forwardable
;
165 _PUBLIC_
bool cli_credentials_set_gensec_features(struct cli_credentials
*creds
,
166 uint32_t gensec_features
,
167 enum credentials_obtained obtained
)
169 if (obtained
>= creds
->gensec_features_obtained
) {
170 creds
->gensec_features_obtained
= obtained
;
171 creds
->gensec_features
= gensec_features
;
179 _PUBLIC_
bool cli_credentials_add_gensec_features(
180 struct cli_credentials
*creds
,
181 uint32_t gensec_features
,
182 enum credentials_obtained obtained
)
184 return cli_credentials_set_gensec_features(
185 creds
, creds
->gensec_features
| gensec_features
, obtained
);
188 _PUBLIC_
uint32_t cli_credentials_get_gensec_features(struct cli_credentials
*creds
)
190 return creds
->gensec_features
;
194 * @brief Find out how the username was obtained.
196 * @param cred A credentials context.
198 * @return The obtained information for the username.
200 _PUBLIC_
enum credentials_obtained
201 cli_credentials_get_username_obtained(struct cli_credentials
*cred
)
203 return cred
->username_obtained
;
207 * Obtain the username for this credentials context.
208 * @param cred credentials context
209 * @retval The username set on this context.
210 * @note Return value will never be NULL except by programmer error.
212 _PUBLIC_
const char *cli_credentials_get_username(struct cli_credentials
*cred
)
214 if (cred
->machine_account_pending
) {
215 cli_credentials_set_machine_account(cred
,
216 cred
->machine_account_pending_lp_ctx
);
219 if (cred
->username_obtained
== CRED_CALLBACK
&&
220 !cred
->callback_running
) {
221 cred
->callback_running
= true;
222 cred
->username
= cred
->username_cb(cred
);
223 cred
->callback_running
= false;
224 if (cred
->username_obtained
== CRED_CALLBACK
) {
225 cred
->username_obtained
= CRED_CALLBACK_RESULT
;
226 cli_credentials_invalidate_ccache(cred
, cred
->username_obtained
);
230 return cred
->username
;
234 * @brief Obtain the username for this credentials context.
236 * @param[in] cred The credential context.
238 * @param[in] obtained A pointer to store the obtained information.
240 * return The user name or NULL if an error occurred.
242 _PUBLIC_
const char *
243 cli_credentials_get_username_and_obtained(struct cli_credentials
*cred
,
244 enum credentials_obtained
*obtained
)
246 if (obtained
!= NULL
) {
247 *obtained
= cred
->username_obtained
;
250 return cli_credentials_get_username(cred
);
253 _PUBLIC_
bool cli_credentials_set_username(struct cli_credentials
*cred
,
254 const char *val
, enum credentials_obtained obtained
)
256 if (obtained
>= cred
->username_obtained
) {
257 cred
->username
= talloc_strdup(cred
, val
);
258 cred
->username_obtained
= obtained
;
259 cli_credentials_invalidate_ccache(cred
, cred
->username_obtained
);
266 _PUBLIC_
bool cli_credentials_set_username_callback(struct cli_credentials
*cred
,
267 const char *(*username_cb
) (struct cli_credentials
*))
269 if (cred
->username_obtained
< CRED_CALLBACK
) {
270 cred
->username_cb
= username_cb
;
271 cred
->username_obtained
= CRED_CALLBACK
;
278 _PUBLIC_
bool cli_credentials_set_bind_dn(struct cli_credentials
*cred
,
281 cred
->bind_dn
= talloc_strdup(cred
, bind_dn
);
286 * Obtain the BIND DN for this credentials context.
287 * @param cred credentials context
288 * @retval The username set on this context.
289 * @note Return value will be NULL if not specified explicitly
291 _PUBLIC_
const char *cli_credentials_get_bind_dn(struct cli_credentials
*cred
)
293 return cred
->bind_dn
;
298 * @brief Find out how the principal was obtained.
300 * @param cred A credentials context.
302 * @return The obtained information for the principal.
304 _PUBLIC_
enum credentials_obtained
305 cli_credentials_get_principal_obtained(struct cli_credentials
*cred
)
307 if (cred
->machine_account_pending
) {
308 cli_credentials_set_machine_account(cred
,
309 cred
->machine_account_pending_lp_ctx
);
312 if (cred
->principal_obtained
< cred
->username_obtained
313 || cred
->principal_obtained
< MAX(cred
->domain_obtained
, cred
->realm_obtained
)) {
314 const char *effective_username
= NULL
;
315 const char *effective_realm
= NULL
;
316 enum credentials_obtained effective_obtained
;
319 * We don't want to trigger a callbacks in
320 * cli_credentials_get_username()
321 * cli_credentials_get_domain()
323 * cli_credentials_get_realm()
326 effective_username
= cred
->username
;
327 if (effective_username
== NULL
|| strlen(effective_username
) == 0) {
328 return cred
->username_obtained
;
331 if (cred
->domain_obtained
> cred
->realm_obtained
) {
332 effective_realm
= cred
->domain
;
333 effective_obtained
= MIN(cred
->domain_obtained
,
334 cred
->username_obtained
);
336 effective_realm
= cred
->realm
;
337 effective_obtained
= MIN(cred
->realm_obtained
,
338 cred
->username_obtained
);
341 if (effective_realm
== NULL
|| strlen(effective_realm
) == 0) {
342 effective_realm
= cred
->domain
;
343 effective_obtained
= MIN(cred
->domain_obtained
,
344 cred
->username_obtained
);
347 if (effective_realm
!= NULL
&& strlen(effective_realm
) != 0) {
348 return effective_obtained
;
352 return cred
->principal_obtained
;
356 * Obtain the client principal for this credentials context.
357 * @param cred credentials context
358 * @retval The username set on this context.
359 * @note Return value will never be NULL except by programmer error.
361 _PUBLIC_
char *cli_credentials_get_principal_and_obtained(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
, enum credentials_obtained
*obtained
)
363 if (cred
->machine_account_pending
) {
364 cli_credentials_set_machine_account(cred
,
365 cred
->machine_account_pending_lp_ctx
);
368 if (cred
->principal_obtained
== CRED_CALLBACK
&&
369 !cred
->callback_running
) {
370 cred
->callback_running
= true;
371 cred
->principal
= cred
->principal_cb(cred
);
372 cred
->callback_running
= false;
373 if (cred
->principal_obtained
== CRED_CALLBACK
) {
374 cred
->principal_obtained
= CRED_CALLBACK_RESULT
;
375 cli_credentials_invalidate_ccache(cred
, cred
->principal_obtained
);
379 if (cred
->principal_obtained
< cred
->username_obtained
380 || cred
->principal_obtained
< MAX(cred
->domain_obtained
, cred
->realm_obtained
)) {
381 const char *effective_username
= NULL
;
382 const char *effective_realm
= NULL
;
383 enum credentials_obtained effective_obtained
;
385 effective_username
= cli_credentials_get_username(cred
);
386 if (effective_username
== NULL
|| strlen(effective_username
) == 0) {
387 *obtained
= cred
->username_obtained
;
391 if (cred
->domain_obtained
> cred
->realm_obtained
) {
392 effective_realm
= cli_credentials_get_domain(cred
);
393 effective_obtained
= MIN(cred
->domain_obtained
,
394 cred
->username_obtained
);
396 effective_realm
= cli_credentials_get_realm(cred
);
397 effective_obtained
= MIN(cred
->realm_obtained
,
398 cred
->username_obtained
);
401 if (effective_realm
== NULL
|| strlen(effective_realm
) == 0) {
402 effective_realm
= cli_credentials_get_domain(cred
);
403 effective_obtained
= MIN(cred
->domain_obtained
,
404 cred
->username_obtained
);
407 if (effective_realm
!= NULL
&& strlen(effective_realm
) != 0) {
408 *obtained
= effective_obtained
;
409 return talloc_asprintf(mem_ctx
, "%s@%s",
414 *obtained
= cred
->principal_obtained
;
415 return talloc_strdup(mem_ctx
, cred
->principal
);
419 * Obtain the client principal for this credentials context.
420 * @param cred credentials context
421 * @retval The username set on this context.
422 * @note Return value will never be NULL except by programmer error.
424 _PUBLIC_
char *cli_credentials_get_principal(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
)
426 enum credentials_obtained obtained
;
427 return cli_credentials_get_principal_and_obtained(cred
, mem_ctx
, &obtained
);
430 _PUBLIC_
bool cli_credentials_set_principal(struct cli_credentials
*cred
,
432 enum credentials_obtained obtained
)
434 if (obtained
>= cred
->principal_obtained
) {
435 cred
->principal
= talloc_strdup(cred
, val
);
436 if (cred
->principal
== NULL
) {
439 cred
->principal_obtained
= obtained
;
441 cli_credentials_invalidate_ccache(cred
, cred
->principal_obtained
);
448 /* Set a callback to get the principal. This could be a popup dialog,
449 * a terminal prompt or similar. */
450 _PUBLIC_
bool cli_credentials_set_principal_callback(struct cli_credentials
*cred
,
451 const char *(*principal_cb
) (struct cli_credentials
*))
453 if (cred
->principal_obtained
< CRED_CALLBACK
) {
454 cred
->principal_cb
= principal_cb
;
455 cred
->principal_obtained
= CRED_CALLBACK
;
462 /* Some of our tools are 'anonymous by default'. This is a single
463 * function to determine if authentication has been explicitly
466 _PUBLIC_
bool cli_credentials_authentication_requested(struct cli_credentials
*cred
)
468 uint32_t gensec_features
= 0;
475 * If we forced the mech we clearly want authentication. E.g. to use
476 * SASL/EXTERNAL which has no credentials.
478 if (cred
->forced_sasl_mech
) {
482 if (cli_credentials_is_anonymous(cred
)){
486 if (cred
->principal_obtained
>= CRED_SPECIFIED
) {
489 if (cred
->username_obtained
>= CRED_SPECIFIED
) {
493 if (cli_credentials_get_kerberos_state(cred
) == CRED_USE_KERBEROS_REQUIRED
) {
497 gensec_features
= cli_credentials_get_gensec_features(cred
);
498 if (gensec_features
& GENSEC_FEATURE_NTLM_CCACHE
) {
502 if (gensec_features
& GENSEC_FEATURE_SIGN
) {
506 if (gensec_features
& GENSEC_FEATURE_SEAL
) {
514 * Obtain the password for this credentials context.
515 * @param cred credentials context
516 * @retval If set, the cleartext password, otherwise NULL
518 _PUBLIC_
const char *cli_credentials_get_password(struct cli_credentials
*cred
)
520 if (cred
->machine_account_pending
) {
521 cli_credentials_set_machine_account(cred
,
522 cred
->machine_account_pending_lp_ctx
);
525 if (cred
->password_obtained
== CRED_CALLBACK
&&
526 !cred
->callback_running
&&
527 !cred
->password_will_be_nt_hash
) {
528 cred
->callback_running
= true;
529 cred
->password
= cred
->password_cb(cred
);
530 cred
->callback_running
= false;
531 if (cred
->password_obtained
== CRED_CALLBACK
) {
532 cred
->password_obtained
= CRED_CALLBACK_RESULT
;
533 cli_credentials_invalidate_ccache(cred
, cred
->password_obtained
);
537 return cred
->password
;
541 * @brief Find out how the password was obtained.
543 * @param cred A credentials context.
545 * @return The obtained information for the password.
547 _PUBLIC_
enum credentials_obtained
548 cli_credentials_get_password_obtained(struct cli_credentials
*cred
)
550 return cred
->password_obtained
;
554 * @brief Obtain the password for this credentials context.
556 * @param[in] cred The credential context.
558 * @param[in] obtained A pointer to store the obtained information.
560 * return The user name or NULL if an error occurred.
562 _PUBLIC_
const char *
563 cli_credentials_get_password_and_obtained(struct cli_credentials
*cred
,
564 enum credentials_obtained
*obtained
)
566 const char *password
= cli_credentials_get_password(cred
);
568 if (obtained
!= NULL
) {
569 *obtained
= cred
->password_obtained
;
575 /* Set a password on the credentials context, including an indication
576 * of 'how' the password was obtained */
578 _PUBLIC_
bool cli_credentials_set_password(struct cli_credentials
*cred
,
580 enum credentials_obtained obtained
)
582 if (obtained
>= cred
->password_obtained
) {
584 cred
->lm_response
= data_blob_null
;
585 cred
->nt_response
= data_blob_null
;
586 cred
->nt_hash
= NULL
;
587 cred
->password
= NULL
;
589 cli_credentials_invalidate_ccache(cred
, obtained
);
591 cred
->password_tries
= 0;
594 cred
->password_obtained
= obtained
;
598 if (cred
->password_will_be_nt_hash
) {
599 struct samr_Password
*nt_hash
= NULL
;
600 size_t val_len
= strlen(val
);
603 nt_hash
= talloc(cred
, struct samr_Password
);
604 if (nt_hash
== NULL
) {
607 talloc_keep_secret(nt_hash
);
609 converted
= strhex_to_str((char *)nt_hash
->hash
,
610 sizeof(nt_hash
->hash
),
612 if (converted
!= sizeof(nt_hash
->hash
)) {
613 TALLOC_FREE(nt_hash
);
617 cred
->nt_hash
= nt_hash
;
618 cred
->password_obtained
= obtained
;
622 cred
->password
= talloc_strdup(cred
, val
);
623 if (cred
->password
== NULL
) {
627 /* Don't print the actual password in talloc memory dumps */
628 talloc_set_name_const(cred
->password
,
629 "password set via cli_credentials_set_password");
630 cred
->password_obtained
= obtained
;
638 _PUBLIC_
bool cli_credentials_set_password_callback(struct cli_credentials
*cred
,
639 const char *(*password_cb
) (struct cli_credentials
*))
641 if (cred
->password_obtained
< CRED_CALLBACK
) {
642 cred
->password_tries
= 3;
643 cred
->password_cb
= password_cb
;
644 cred
->password_obtained
= CRED_CALLBACK
;
645 cli_credentials_invalidate_ccache(cred
, cred
->password_obtained
);
653 * Obtain the 'old' password for this credentials context (used for join accounts).
654 * @param cred credentials context
655 * @retval If set, the cleartext password, otherwise NULL
657 _PUBLIC_
const char *cli_credentials_get_old_password(struct cli_credentials
*cred
)
659 if (cred
->machine_account_pending
) {
660 cli_credentials_set_machine_account(cred
,
661 cred
->machine_account_pending_lp_ctx
);
664 return cred
->old_password
;
667 _PUBLIC_
bool cli_credentials_set_old_password(struct cli_credentials
*cred
,
669 enum credentials_obtained obtained
)
671 cred
->old_password
= talloc_strdup(cred
, val
);
672 if (cred
->old_password
) {
673 /* Don't print the actual password in talloc memory dumps */
674 talloc_set_name_const(cred
->old_password
, "password set via cli_credentials_set_old_password");
676 cred
->old_nt_hash
= NULL
;
681 * Obtain the password, in the form MD4(unicode(password)) for this credentials context.
683 * Sometimes we only have this much of the password, while the rest of
684 * the time this call avoids calling E_md4hash themselves.
686 * @param cred credentials context
687 * @retval If set, the cleartext password, otherwise NULL
689 _PUBLIC_
struct samr_Password
*cli_credentials_get_nt_hash(struct cli_credentials
*cred
,
692 enum credentials_obtained password_obtained
;
693 enum credentials_obtained ccache_threshold
;
694 enum credentials_obtained client_gss_creds_threshold
;
695 bool password_is_nt_hash
;
696 const char *password
= NULL
;
697 struct samr_Password
*nt_hash
= NULL
;
699 if (cred
->nt_hash
!= NULL
) {
701 * If we already have a hash it's easy.
707 * This is a bit tricky, with password_will_be_nt_hash
708 * we still need to get the value via the password_callback
709 * but if we did that we should not remember it's state
710 * in the long run so we need to undo it.
713 password_obtained
= cred
->password_obtained
;
714 ccache_threshold
= cred
->ccache_threshold
;
715 client_gss_creds_threshold
= cred
->client_gss_creds_threshold
;
716 password_is_nt_hash
= cred
->password_will_be_nt_hash
;
718 cred
->password_will_be_nt_hash
= false;
719 password
= cli_credentials_get_password(cred
);
721 cred
->password_will_be_nt_hash
= password_is_nt_hash
;
722 if (password_is_nt_hash
&& password_obtained
== CRED_CALLBACK
) {
724 * We got the nt_hash as string via the callback,
725 * so we need to undo the state change.
727 * And also don't remember it as plaintext password.
729 cred
->client_gss_creds_threshold
= client_gss_creds_threshold
;
730 cred
->ccache_threshold
= ccache_threshold
;
731 cred
->password_obtained
= password_obtained
;
732 cred
->password
= NULL
;
735 if (password
== NULL
) {
739 nt_hash
= talloc(cred
, struct samr_Password
);
740 if (nt_hash
== NULL
) {
743 talloc_keep_secret(nt_hash
);
745 if (password_is_nt_hash
) {
746 size_t password_len
= strlen(password
);
749 converted
= strhex_to_str((char *)nt_hash
->hash
,
750 sizeof(nt_hash
->hash
),
751 password
, password_len
);
752 if (converted
!= sizeof(nt_hash
->hash
)) {
753 TALLOC_FREE(nt_hash
);
757 E_md4hash(password
, nt_hash
->hash
);
760 cred
->nt_hash
= nt_hash
;
764 nt_hash
= talloc(mem_ctx
, struct samr_Password
);
765 if (nt_hash
== NULL
) {
768 talloc_keep_secret(nt_hash
);
770 *nt_hash
= *cred
->nt_hash
;
776 * Obtain the old password, in the form MD4(unicode(password)) for this credentials context.
778 * Sometimes we only have this much of the password, while the rest of
779 * the time this call avoids calling E_md4hash themselves.
781 * @param cred credentials context
782 * @retval If set, the cleartext password, otherwise NULL
784 _PUBLIC_
struct samr_Password
*cli_credentials_get_old_nt_hash(struct cli_credentials
*cred
,
787 const char *old_password
= NULL
;
789 if (cred
->old_nt_hash
!= NULL
) {
790 struct samr_Password
*nt_hash
= talloc(mem_ctx
, struct samr_Password
);
794 talloc_keep_secret(nt_hash
);
796 *nt_hash
= *cred
->old_nt_hash
;
801 old_password
= cli_credentials_get_old_password(cred
);
803 struct samr_Password
*nt_hash
= talloc(mem_ctx
, struct samr_Password
);
807 talloc_keep_secret(nt_hash
);
809 E_md4hash(old_password
, nt_hash
->hash
);
818 * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
819 * @param cred credentials context
820 * @retval The domain set on this context.
821 * @note Return value will never be NULL except by programmer error.
823 _PUBLIC_
const char *cli_credentials_get_domain(struct cli_credentials
*cred
)
825 if (cred
->machine_account_pending
) {
826 cli_credentials_set_machine_account(cred
,
827 cred
->machine_account_pending_lp_ctx
);
830 if (cred
->domain_obtained
== CRED_CALLBACK
&&
831 !cred
->callback_running
) {
832 cred
->callback_running
= true;
833 cred
->domain
= cred
->domain_cb(cred
);
834 cred
->callback_running
= false;
835 if (cred
->domain_obtained
== CRED_CALLBACK
) {
836 cred
->domain_obtained
= CRED_CALLBACK_RESULT
;
837 cli_credentials_invalidate_ccache(cred
, cred
->domain_obtained
);
845 * @brief Obtain the domain for this credential context.
847 * @param[in] cred The credential context.
849 * @param[out] obtained A pointer to store the obtained information.
851 * @return The domain name or NULL if an error occurred.
853 _PUBLIC_
const char *cli_credentials_get_domain_and_obtained(
854 struct cli_credentials
*cred
,
855 enum credentials_obtained
*obtained
)
857 const char *domain
= cli_credentials_get_domain(cred
);
859 if (obtained
!= NULL
) {
860 *obtained
= cred
->domain_obtained
;
867 _PUBLIC_
bool cli_credentials_set_domain(struct cli_credentials
*cred
,
869 enum credentials_obtained obtained
)
871 if (obtained
>= cred
->domain_obtained
) {
872 /* it is important that the domain be in upper case,
873 * particularly for the sensitive NTLMv2
875 cred
->domain
= strupper_talloc(cred
, val
);
876 cred
->domain_obtained
= obtained
;
877 /* setting domain does not mean we have to invalidate ccache
878 * because domain in not used for Kerberos operations.
879 * If ccache invalidation is required, one will anyway specify
880 * a password to kinit, and that will force invalidation of the ccache
888 bool cli_credentials_set_domain_callback(struct cli_credentials
*cred
,
889 const char *(*domain_cb
) (struct cli_credentials
*))
891 if (cred
->domain_obtained
< CRED_CALLBACK
) {
892 cred
->domain_cb
= domain_cb
;
893 cred
->domain_obtained
= CRED_CALLBACK
;
901 * Obtain the Kerberos realm for this credentials context.
902 * @param cred credentials context
903 * @retval The realm set on this context.
904 * @note Return value will never be NULL except by programmer error.
906 _PUBLIC_
const char *cli_credentials_get_realm(struct cli_credentials
*cred
)
908 if (cred
->machine_account_pending
) {
909 cli_credentials_set_machine_account(cred
,
910 cred
->machine_account_pending_lp_ctx
);
913 if (cred
->realm_obtained
== CRED_CALLBACK
&&
914 !cred
->callback_running
) {
915 cred
->callback_running
= true;
916 cred
->realm
= cred
->realm_cb(cred
);
917 cred
->callback_running
= false;
918 if (cred
->realm_obtained
== CRED_CALLBACK
) {
919 cred
->realm_obtained
= CRED_CALLBACK_RESULT
;
920 cli_credentials_invalidate_ccache(cred
, cred
->realm_obtained
);
928 * Set the realm for this credentials context, and force it to
929 * uppercase for the sanity of our local kerberos libraries
931 _PUBLIC_
bool cli_credentials_set_realm(struct cli_credentials
*cred
,
933 enum credentials_obtained obtained
)
935 if (obtained
>= cred
->realm_obtained
) {
936 cred
->realm
= strupper_talloc(cred
, val
);
937 cred
->realm_obtained
= obtained
;
938 cli_credentials_invalidate_ccache(cred
, cred
->realm_obtained
);
945 bool cli_credentials_set_realm_callback(struct cli_credentials
*cred
,
946 const char *(*realm_cb
) (struct cli_credentials
*))
948 if (cred
->realm_obtained
< CRED_CALLBACK
) {
949 cred
->realm_cb
= realm_cb
;
950 cred
->realm_obtained
= CRED_CALLBACK
;
958 * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
960 * @param cred credentials context
961 * @retval The workstation name set on this context.
962 * @note Return value will never be NULL except by programmer error.
964 _PUBLIC_
const char *cli_credentials_get_workstation(struct cli_credentials
*cred
)
966 if (cred
->workstation_obtained
== CRED_CALLBACK
&&
967 !cred
->callback_running
) {
968 cred
->callback_running
= true;
969 cred
->workstation
= cred
->workstation_cb(cred
);
970 cred
->callback_running
= false;
971 if (cred
->workstation_obtained
== CRED_CALLBACK
) {
972 cred
->workstation_obtained
= CRED_CALLBACK_RESULT
;
976 return cred
->workstation
;
979 _PUBLIC_
bool cli_credentials_set_workstation(struct cli_credentials
*cred
,
981 enum credentials_obtained obtained
)
983 if (obtained
>= cred
->workstation_obtained
) {
984 cred
->workstation
= talloc_strdup(cred
, val
);
985 cred
->workstation_obtained
= obtained
;
992 bool cli_credentials_set_workstation_callback(struct cli_credentials
*cred
,
993 const char *(*workstation_cb
) (struct cli_credentials
*))
995 if (cred
->workstation_obtained
< CRED_CALLBACK
) {
996 cred
->workstation_cb
= workstation_cb
;
997 cred
->workstation_obtained
= CRED_CALLBACK
;
1005 * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
1007 * The format accepted is [domain\\]user[%password] or user[@realm][%password]
1009 * @param credentials Credentials structure on which to set the password
1010 * @param data the string containing the username, password etc
1011 * @param obtained This enum describes how 'specified' this password is
1014 _PUBLIC_
void cli_credentials_parse_string(struct cli_credentials
*credentials
, const char *data
, enum credentials_obtained obtained
)
1017 char *uname_free
= NULL
;
1019 if (strcmp("%",data
) == 0) {
1020 cli_credentials_set_anonymous(credentials
);
1024 uname
= talloc_strdup(credentials
, data
);
1027 if ((p
= strchr_m(uname
,'%'))) {
1029 cli_credentials_set_password(credentials
, p
+1, obtained
);
1032 if ((p
= strchr_m(uname
,'@'))) {
1034 * We also need to set username and domain
1035 * in order to undo the effect of
1036 * cli_credentials_guess().
1038 cli_credentials_set_username(credentials
, uname
, obtained
);
1039 cli_credentials_set_domain(credentials
, "", obtained
);
1041 cli_credentials_set_principal(credentials
, uname
, obtained
);
1043 cli_credentials_set_realm(credentials
, p
+1, obtained
);
1044 TALLOC_FREE(uname_free
);
1046 } else if ((p
= strchr_m(uname
,'\\'))
1047 || (p
= strchr_m(uname
, '/'))
1048 || (p
= strchr_m(uname
, credentials
->winbind_separator
)))
1050 const char *domain
= NULL
;
1056 if (obtained
== credentials
->realm_obtained
&&
1057 !strequal_m(credentials
->domain
, domain
))
1060 * We need to undo a former set with the same level
1061 * in order to get the expected result from
1062 * cli_credentials_get_principal().
1064 * But we only need to do that if the domain
1067 cli_credentials_set_realm(credentials
, domain
, obtained
);
1069 cli_credentials_set_domain(credentials
, domain
, obtained
);
1071 if (obtained
== credentials
->principal_obtained
&&
1072 !strequal_m(credentials
->username
, uname
))
1075 * We need to undo a former set with the same level
1076 * in order to get the expected result from
1077 * cli_credentials_get_principal().
1079 * But we only need to do that if the username
1082 credentials
->principal_obtained
= CRED_UNINITIALISED
;
1083 credentials
->principal
= NULL
;
1085 cli_credentials_set_username(credentials
, uname
, obtained
);
1087 TALLOC_FREE(uname_free
);
1091 * Given a a credentials structure, print it as a string
1093 * The format output is [domain\\]user[%password] or user[@realm][%password]
1095 * @param credentials Credentials structure on which to set the password
1096 * @param mem_ctx The memory context to place the result on
1099 _PUBLIC_
char *cli_credentials_get_unparsed_name(struct cli_credentials
*credentials
, TALLOC_CTX
*mem_ctx
)
1101 const char *bind_dn
= cli_credentials_get_bind_dn(credentials
);
1102 const char *domain
= NULL
;
1103 const char *username
= NULL
;
1107 name
= talloc_strdup(mem_ctx
, bind_dn
);
1109 cli_credentials_get_ntlm_username_domain(credentials
, mem_ctx
, &username
, &domain
);
1110 if (domain
&& domain
[0]) {
1111 name
= talloc_asprintf(mem_ctx
, "%s\\%s",
1114 name
= talloc_asprintf(mem_ctx
, "%s",
1123 * Specifies default values for domain, workstation and realm
1124 * from the smb.conf configuration file
1126 * @param cred Credentials structure to fill in
1128 * @return true on success, false on error.
1130 _PUBLIC_
bool cli_credentials_set_conf(struct cli_credentials
*cred
,
1131 struct loadparm_context
*lp_ctx
)
1133 const char *sep
= NULL
;
1134 const char *realm
= lpcfg_realm(lp_ctx
);
1135 enum credentials_client_protection protection
=
1136 lpcfg_client_protection(lp_ctx
);
1137 const char *workgroup
= lpcfg_workgroup(lp_ctx
);
1138 const char *netbios_name
= lpcfg_netbios_name(lp_ctx
);
1141 (void)cli_credentials_set_username(cred
, "", CRED_UNINITIALISED
);
1143 if (workgroup
!= NULL
&& strlen(workgroup
) == 0) {
1147 if (workgroup
!= NULL
) {
1148 if (lpcfg_parm_is_cmdline(lp_ctx
, "workgroup")) {
1149 ok
= cli_credentials_set_domain(cred
,
1153 DBG_ERR("Failed to set domain!\n");
1157 (void)cli_credentials_set_domain(cred
,
1163 if (netbios_name
!= NULL
&& strlen(netbios_name
) == 0) {
1164 netbios_name
= NULL
;
1167 if (netbios_name
!= NULL
) {
1168 if (lpcfg_parm_is_cmdline(lp_ctx
, "netbios name")) {
1169 ok
= cli_credentials_set_workstation(cred
,
1173 DBG_ERR("Failed to set workstation!\n");
1177 (void)cli_credentials_set_workstation(cred
,
1183 if (realm
!= NULL
&& strlen(realm
) == 0) {
1187 if (realm
!= NULL
) {
1188 if (lpcfg_parm_is_cmdline(lp_ctx
, "realm")) {
1189 ok
= cli_credentials_set_realm(cred
,
1193 DBG_ERR("Failed to set realm!\n");
1197 (void)cli_credentials_set_realm(cred
,
1203 sep
= lpcfg_winbind_separator(lp_ctx
);
1204 if (sep
!= NULL
&& sep
[0] != '\0') {
1205 cred
->winbind_separator
= *lpcfg_winbind_separator(lp_ctx
);
1208 if (cred
->signing_state_obtained
<= CRED_SMB_CONF
) {
1209 /* Will be set to default for invalid smb.conf values */
1210 cred
->signing_state
= lpcfg_client_signing(lp_ctx
);
1211 if (cred
->signing_state
== SMB_SIGNING_DEFAULT
) {
1212 switch (protection
) {
1213 case CRED_CLIENT_PROTECTION_DEFAULT
:
1215 case CRED_CLIENT_PROTECTION_PLAIN
:
1216 cred
->signing_state
= SMB_SIGNING_OFF
;
1218 case CRED_CLIENT_PROTECTION_SIGN
:
1219 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1220 cred
->signing_state
= SMB_SIGNING_REQUIRED
;
1225 cred
->signing_state_obtained
= CRED_SMB_CONF
;
1228 if (cred
->ipc_signing_state_obtained
<= CRED_SMB_CONF
) {
1229 /* Will be set to required for invalid smb.conf values */
1230 cred
->ipc_signing_state
= lpcfg_client_ipc_signing(lp_ctx
);
1231 cred
->ipc_signing_state_obtained
= CRED_SMB_CONF
;
1234 if (cred
->encryption_state_obtained
<= CRED_SMB_CONF
) {
1235 /* Will be set to default for invalid smb.conf values */
1236 cred
->encryption_state
= lpcfg_client_smb_encrypt(lp_ctx
);
1237 if (cred
->encryption_state
== SMB_ENCRYPTION_DEFAULT
) {
1238 switch (protection
) {
1239 case CRED_CLIENT_PROTECTION_DEFAULT
:
1241 case CRED_CLIENT_PROTECTION_PLAIN
:
1242 case CRED_CLIENT_PROTECTION_SIGN
:
1243 cred
->encryption_state
= SMB_ENCRYPTION_OFF
;
1245 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1246 cred
->encryption_state
= SMB_ENCRYPTION_REQUIRED
;
1252 if (cred
->kerberos_state_obtained
<= CRED_SMB_CONF
) {
1253 /* Will be set to default for invalid smb.conf values */
1254 cred
->kerberos_state
= lpcfg_client_use_kerberos(lp_ctx
);
1255 cred
->kerberos_state_obtained
= CRED_SMB_CONF
;
1258 if (cred
->gensec_features_obtained
<= CRED_SMB_CONF
) {
1259 switch (protection
) {
1260 case CRED_CLIENT_PROTECTION_DEFAULT
:
1262 case CRED_CLIENT_PROTECTION_PLAIN
:
1263 cred
->gensec_features
= 0;
1265 case CRED_CLIENT_PROTECTION_SIGN
:
1266 cred
->gensec_features
= GENSEC_FEATURE_SIGN
;
1268 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1269 cred
->gensec_features
=
1270 GENSEC_FEATURE_SIGN
|GENSEC_FEATURE_SEAL
;
1273 cred
->gensec_features_obtained
= CRED_SMB_CONF
;
1280 * Guess defaults for credentials from environment variables,
1281 * and from the configuration file
1283 * @param cred Credentials structure to fill in
1285 _PUBLIC_
bool cli_credentials_guess(struct cli_credentials
*cred
,
1286 struct loadparm_context
*lp_ctx
)
1288 const char *error_string
;
1289 const char *env
= NULL
;
1290 struct passwd
*pwd
= NULL
;
1293 if (lp_ctx
!= NULL
) {
1294 ok
= cli_credentials_set_conf(cred
, lp_ctx
);
1300 pwd
= getpwuid(getuid());
1302 size_t len
= strlen(pwd
->pw_name
);
1304 if (len
> 0 && len
<= 1024) {
1305 (void)cli_credentials_parse_string(cred
,
1311 env
= getenv("LOGNAME");
1313 size_t len
= strlen(env
);
1315 if (len
> 0 && len
<= 1024) {
1316 (void)cli_credentials_set_username(cred
,
1322 env
= getenv("USER");
1324 size_t len
= strlen(env
);
1326 if (len
> 0 && len
<= 1024) {
1329 (void)cli_credentials_parse_string(cred
,
1332 if ((p
= strchr_m(env
, '%'))) {
1333 memset(p
, '\0', strlen(cred
->password
));
1338 env
= getenv("PASSWD");
1340 size_t len
= strlen(env
);
1342 if (len
> 0 && len
<= 1024) {
1343 (void)cli_credentials_set_password(cred
,
1349 env
= getenv("PASSWD_FD");
1351 size_t len
= strlen(env
);
1353 if (len
> 0 && len
<= 1024) {
1356 (void)cli_credentials_parse_password_fd(cred
,
1362 env
= getenv("PASSWD_FILE");
1364 size_t len
= strlen(env
);
1366 if (len
> 0 && len
<= 4096) {
1367 (void)cli_credentials_parse_password_file(cred
,
1373 if (lp_ctx
!= NULL
&&
1374 cli_credentials_get_kerberos_state(cred
) != CRED_USE_KERBEROS_DISABLED
) {
1375 (void)cli_credentials_set_ccache(cred
,
1386 * Attach NETLOGON credentials for use with SCHANNEL
1389 _PUBLIC_
void cli_credentials_set_netlogon_creds(
1390 struct cli_credentials
*cred
,
1391 const struct netlogon_creds_CredentialState
*netlogon_creds
)
1393 TALLOC_FREE(cred
->netlogon_creds
);
1394 if (netlogon_creds
== NULL
) {
1397 cred
->netlogon_creds
= netlogon_creds_copy(cred
, netlogon_creds
);
1401 * Return attached NETLOGON credentials
1404 _PUBLIC_
struct netlogon_creds_CredentialState
*cli_credentials_get_netlogon_creds(struct cli_credentials
*cred
)
1406 return cred
->netlogon_creds
;
1410 * Set NETLOGON secure channel type
1413 _PUBLIC_
void cli_credentials_set_secure_channel_type(struct cli_credentials
*cred
,
1414 enum netr_SchannelType secure_channel_type
)
1416 cred
->secure_channel_type
= secure_channel_type
;
1420 * Return NETLOGON secure channel type
1423 _PUBLIC_
time_t cli_credentials_get_password_last_changed_time(struct cli_credentials
*cred
)
1425 return cred
->password_last_changed_time
;
1429 * Set NETLOGON secure channel type
1432 _PUBLIC_
void cli_credentials_set_password_last_changed_time(struct cli_credentials
*cred
,
1433 time_t last_changed_time
)
1435 cred
->password_last_changed_time
= last_changed_time
;
1439 * Return NETLOGON secure channel type
1442 _PUBLIC_
enum netr_SchannelType
cli_credentials_get_secure_channel_type(struct cli_credentials
*cred
)
1444 return cred
->secure_channel_type
;
1448 * Fill in a credentials structure as the anonymous user
1450 _PUBLIC_
void cli_credentials_set_anonymous(struct cli_credentials
*cred
)
1452 cli_credentials_set_username(cred
, "", CRED_SPECIFIED
);
1453 cli_credentials_set_domain(cred
, "", CRED_SPECIFIED
);
1454 cli_credentials_set_password(cred
, NULL
, CRED_SPECIFIED
);
1455 cli_credentials_set_principal(cred
, NULL
, CRED_SPECIFIED
);
1456 cli_credentials_set_realm(cred
, NULL
, CRED_SPECIFIED
);
1457 cli_credentials_set_workstation(cred
, "", CRED_UNINITIALISED
);
1458 cli_credentials_set_kerberos_state(cred
,
1459 CRED_USE_KERBEROS_DISABLED
,
1464 * Describe a credentials context as anonymous or authenticated
1465 * @retval true if anonymous, false if a username is specified
1468 _PUBLIC_
bool cli_credentials_is_anonymous(struct cli_credentials
*cred
)
1470 const char *username
;
1472 /* if bind dn is set it's not anonymous */
1473 if (cred
->bind_dn
) {
1477 if (cred
->machine_account_pending
) {
1478 cli_credentials_set_machine_account(cred
,
1479 cred
->machine_account_pending_lp_ctx
);
1482 /* if principal is set, it's not anonymous */
1483 if ((cred
->principal
!= NULL
) && cred
->principal_obtained
>= cred
->username_obtained
) {
1487 username
= cli_credentials_get_username(cred
);
1489 /* Yes, it is deliberate that we die if we have a NULL pointer
1490 * here - anonymous is "", not NULL, which is 'never specified,
1491 * never guessed', ie programmer bug */
1500 * Mark the current password for a credentials struct as wrong. This will
1501 * cause the password to be prompted again (if a callback is set).
1503 * This will decrement the number of times the password can be tried.
1505 * @retval whether the credentials struct is finished
1507 _PUBLIC_
bool cli_credentials_wrong_password(struct cli_credentials
*cred
)
1509 if (cred
->password_obtained
!= CRED_CALLBACK_RESULT
) {
1513 if (cred
->password_tries
== 0) {
1517 cred
->password_tries
--;
1519 if (cred
->password_tries
== 0) {
1523 cred
->password_obtained
= CRED_CALLBACK
;
1527 _PUBLIC_
void cli_credentials_get_ntlm_username_domain(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
,
1528 const char **username
,
1529 const char **domain
)
1531 if (cred
->principal_obtained
>= cred
->username_obtained
) {
1532 *domain
= talloc_strdup(mem_ctx
, "");
1533 *username
= cli_credentials_get_principal(cred
, mem_ctx
);
1535 *domain
= cli_credentials_get_domain(cred
);
1536 *username
= cli_credentials_get_username(cred
);
1541 * Read a named file, and parse it for username, domain, realm and password
1543 * @param credentials Credentials structure on which to set the password
1544 * @param file a named file to read the details from
1545 * @param obtained This enum describes how 'specified' this password is
1548 _PUBLIC_
bool cli_credentials_parse_file(struct cli_credentials
*cred
, const char *file
, enum credentials_obtained obtained
)
1551 char *ptr
, *val
, *param
;
1554 const char *realm
= NULL
;
1555 const char *domain
= NULL
;
1556 const char *password
= NULL
;
1557 const char *username
= NULL
;
1559 lines
= file_lines_load(file
, &numlines
, 0, NULL
);
1563 /* fail if we can't open the credentials file */
1564 d_printf("ERROR: Unable to open credentials file!\n");
1568 for (i
= 0; i
< numlines
; i
++) {
1569 len
= strlen(lines
[i
]);
1574 /* break up the line into parameter & value.
1575 * will need to eat a little whitespace possibly */
1577 if (!(ptr
= strchr_m (lines
[i
], '=')))
1583 /* eat leading white space */
1584 while ((*val
!='\0') && ((*val
==' ') || (*val
=='\t')))
1587 if (strwicmp("password", param
) == 0) {
1589 } else if (strwicmp("username", param
) == 0) {
1591 } else if (strwicmp("domain", param
) == 0) {
1593 } else if (strwicmp("realm", param
) == 0) {
1598 * We need to readd '=' in order to let
1599 * the strlen() work in the last loop
1600 * that clears the memory.
1605 if (realm
!= NULL
&& strlen(realm
) != 0) {
1607 * only overwrite with a valid string
1609 cli_credentials_set_realm(cred
, realm
, obtained
);
1612 if (domain
!= NULL
&& strlen(domain
) != 0) {
1614 * only overwrite with a valid string
1616 cli_credentials_set_domain(cred
, domain
, obtained
);
1619 if (password
!= NULL
) {
1623 cli_credentials_set_password(cred
, password
, obtained
);
1626 if (username
!= NULL
) {
1628 * The last "username" line takes preference
1629 * if the string also contains domain, realm or
1632 cli_credentials_parse_string(cred
, username
, obtained
);
1635 for (i
= 0; i
< numlines
; i
++) {
1636 len
= strlen(lines
[i
]);
1637 memset(lines
[i
], 0, len
);
1645 * Read a named file, and parse it for a password
1647 * @param credentials Credentials structure on which to set the password
1648 * @param file a named file to read the password from
1649 * @param obtained This enum describes how 'specified' this password is
1652 _PUBLIC_
bool cli_credentials_parse_password_file(struct cli_credentials
*credentials
, const char *file
, enum credentials_obtained obtained
)
1654 int fd
= open(file
, O_RDONLY
, 0);
1658 fprintf(stderr
, "Error opening password file %s: %s\n",
1659 file
, strerror(errno
));
1663 ret
= cli_credentials_parse_password_fd(credentials
, fd
, obtained
);
1672 * Read a file descriptor, and parse it for a password (eg from a file or stdin)
1674 * @param credentials Credentials structure on which to set the password
1675 * @param fd open file descriptor to read the password from
1676 * @param obtained This enum describes how 'specified' this password is
1679 _PUBLIC_
bool cli_credentials_parse_password_fd(struct cli_credentials
*credentials
,
1680 int fd
, enum credentials_obtained obtained
)
1685 if (credentials
->password_obtained
>= obtained
) {
1689 for(p
= pass
, *p
= '\0'; /* ensure that pass is null-terminated */
1690 p
&& p
- pass
< sizeof(pass
) - 1;) {
1691 switch (read(fd
, p
, 1)) {
1693 if (*p
!= '\n' && *p
!= '\0') {
1694 *++p
= '\0'; /* advance p, and null-terminate pass */
1701 *p
= '\0'; /* null-terminate it, just in case... */
1702 p
= NULL
; /* then force the loop condition to become false */
1707 "Error reading password from file descriptor "
1708 "%d: empty password\n",
1713 fprintf(stderr
, "Error reading password from file descriptor %d: %s\n",
1714 fd
, strerror(errno
));
1719 cli_credentials_set_password(credentials
, pass
, obtained
);
1724 * @brief Set the SMB signing state to request for a SMB connection.
1726 * @param[in] creds The credentials structure to update.
1728 * @param[in] signing_state The signing state to set.
1730 * @param obtained This way the described signing state was specified.
1732 * @return true if we could set the signing state, false otherwise.
1734 _PUBLIC_
bool cli_credentials_set_smb_signing(struct cli_credentials
*creds
,
1735 enum smb_signing_setting signing_state
,
1736 enum credentials_obtained obtained
)
1738 if (obtained
>= creds
->signing_state_obtained
) {
1739 creds
->signing_state_obtained
= obtained
;
1740 creds
->signing_state
= signing_state
;
1748 * @brief Obtain the SMB signing state from a credentials structure.
1750 * @param[in] creds The credential structure to obtain the SMB signing state
1753 * @return The SMB signing state.
1755 _PUBLIC_
enum smb_signing_setting
1756 cli_credentials_get_smb_signing(struct cli_credentials
*creds
)
1758 return creds
->signing_state
;
1762 * @brief Set the SMB IPC signing state to request for a SMB connection.
1764 * @param[in] creds The credentials structure to update.
1766 * @param[in] signing_state The signing state to set.
1768 * @param obtained This way the described signing state was specified.
1770 * @return true if we could set the signing state, false otherwise.
1773 cli_credentials_set_smb_ipc_signing(struct cli_credentials
*creds
,
1774 enum smb_signing_setting ipc_signing_state
,
1775 enum credentials_obtained obtained
)
1777 if (obtained
>= creds
->ipc_signing_state_obtained
) {
1778 creds
->ipc_signing_state_obtained
= obtained
;
1779 creds
->ipc_signing_state
= ipc_signing_state
;
1787 * @brief Obtain the SMB IPC signing state from a credentials structure.
1789 * @param[in] creds The credential structure to obtain the SMB IPC signing
1792 * @return The SMB signing state.
1794 _PUBLIC_
enum smb_signing_setting
1795 cli_credentials_get_smb_ipc_signing(struct cli_credentials
*creds
)
1797 return creds
->ipc_signing_state
;
1801 * @brief Set the SMB encryption state to request for a SMB connection.
1803 * @param[in] creds The credentials structure to update.
1805 * @param[in] encryption_state The encryption state to set.
1807 * @param obtained This way the described encryption state was specified.
1809 * @return true if we could set the encryption state, false otherwise.
1811 _PUBLIC_
bool cli_credentials_set_smb_encryption(struct cli_credentials
*creds
,
1812 enum smb_encryption_setting encryption_state
,
1813 enum credentials_obtained obtained
)
1815 if (obtained
>= creds
->encryption_state_obtained
) {
1816 creds
->encryption_state_obtained
= obtained
;
1817 creds
->encryption_state
= encryption_state
;
1824 static const char *obtained_to_str(enum credentials_obtained obtained
)
1827 case CRED_UNINITIALISED
:
1828 return "CRED_UNINITIALISED";
1830 return "CRED_SMB_CONF";
1832 return "CRED_CALLBACK";
1833 case CRED_GUESS_ENV
:
1834 return "CRED_GUESS_ENV";
1835 case CRED_GUESS_FILE
:
1836 return "CRED_GUESS_FILE";
1837 case CRED_CALLBACK_RESULT
:
1838 return "CRED_CALLBACK_RESULT";
1839 case CRED_SPECIFIED
:
1840 return "CRED_SPECIFIED";
1847 static const char *krb5_state_to_str(enum credentials_use_kerberos krb5_state
)
1849 switch (krb5_state
) {
1850 case CRED_USE_KERBEROS_DISABLED
:
1851 return "CRED_USE_KERBEROS_DISABLED";
1852 case CRED_USE_KERBEROS_DESIRED
:
1853 return "CRED_USE_KERBEROS_DESIRED";
1854 case CRED_USE_KERBEROS_REQUIRED
:
1855 return "CRED_USE_KERBEROS_REQUIRED";
1862 static const char *krb5_fwd_to_str(enum credentials_krb_forwardable krb5_fwd
)
1865 case CRED_AUTO_KRB_FORWARDABLE
:
1866 return "CRED_AUTO_KRB_FORWARDABLE";
1867 case CRED_NO_KRB_FORWARDABLE
:
1868 return "CRED_NO_KRB_FORWARDABLE";
1869 case CRED_FORCE_KRB_FORWARDABLE
:
1870 return "CRED_FORCE_KRB_FORWARDABLE";
1877 static const char *signing_state_to_str(enum smb_signing_setting signing_state
)
1879 switch(signing_state
) {
1880 case SMB_SIGNING_IPC_DEFAULT
:
1881 return "SMB_SIGNING_IPC_DEFAULT";
1882 case SMB_SIGNING_DEFAULT
:
1883 return "SMB_SIGNING_DEFAULT";
1884 case SMB_SIGNING_OFF
:
1885 return "SMB_SIGNING_OFF";
1886 case SMB_SIGNING_IF_REQUIRED
:
1887 return "SMB_SIGNING_IF_REQUIRED";
1888 case SMB_SIGNING_DESIRED
:
1889 return "SMB_SIGNING_DESIRED";
1890 case SMB_SIGNING_REQUIRED
:
1891 return "SMB_SIGNING_REQUIRED";
1898 static const char *encryption_state_to_str(enum smb_encryption_setting encryption_state
)
1900 switch(encryption_state
) {
1901 case SMB_ENCRYPTION_DEFAULT
:
1902 return "SMB_ENCRYPTION_DEFAULT";
1903 case SMB_ENCRYPTION_OFF
:
1904 return "SMB_ENCRYPTION_OFF";
1905 case SMB_ENCRYPTION_IF_REQUIRED
:
1906 return "SMB_ENCRYPTION_IF_REQUIRED";
1907 case SMB_ENCRYPTION_DESIRED
:
1908 return "SMB_ENCRYPTION_DESIRED";
1909 case SMB_ENCRYPTION_REQUIRED
:
1910 return "SMB_ENCRYPTION_REQUIRED";
1917 _PUBLIC_
void cli_credentials_dump(struct cli_credentials
*creds
)
1919 DBG_ERR("CLI_CREDENTIALS:\n");
1921 DBG_ERR(" Username: %s - %s\n",
1923 obtained_to_str(creds
->username_obtained
));
1924 DBG_ERR(" Workstation: %s - %s\n",
1926 obtained_to_str(creds
->workstation_obtained
));
1927 DBG_ERR(" Domain: %s - %s\n",
1929 obtained_to_str(creds
->domain_obtained
));
1930 DBG_ERR(" Password: %s - %s\n",
1931 creds
->password
!= NULL
? "*SECRET*" : "NULL",
1932 obtained_to_str(creds
->password_obtained
));
1933 DBG_ERR(" Old password: %s\n",
1934 creds
->old_password
!= NULL
? "*SECRET*" : "NULL");
1935 DBG_ERR(" Password tries: %u\n",
1936 creds
->password_tries
);
1937 DBG_ERR(" Realm: %s - %s\n",
1939 obtained_to_str(creds
->realm_obtained
));
1940 DBG_ERR(" Principal: %s - %s\n",
1942 obtained_to_str(creds
->principal_obtained
));
1943 DBG_ERR(" Salt principal: %s\n",
1944 creds
->salt_principal
);
1945 DBG_ERR(" Impersonate principal: %s\n",
1946 creds
->impersonate_principal
);
1947 DBG_ERR(" Self service: %s\n",
1948 creds
->self_service
);
1949 DBG_ERR(" Target service: %s\n",
1950 creds
->target_service
);
1951 DBG_ERR(" Kerberos state: %s - %s\n",
1952 krb5_state_to_str(creds
->kerberos_state
),
1953 obtained_to_str(creds
->kerberos_state_obtained
));
1954 DBG_ERR(" Kerberos forwardable ticket: %s\n",
1955 krb5_fwd_to_str(creds
->krb_forwardable
));
1956 DBG_ERR(" Signing state: %s - %s\n",
1957 signing_state_to_str(creds
->signing_state
),
1958 obtained_to_str(creds
->signing_state_obtained
));
1959 DBG_ERR(" IPC signing state: %s - %s\n",
1960 signing_state_to_str(creds
->ipc_signing_state
),
1961 obtained_to_str(creds
->ipc_signing_state_obtained
));
1962 DBG_ERR(" Encryption state: %s - %s\n",
1963 encryption_state_to_str(creds
->encryption_state
),
1964 obtained_to_str(creds
->encryption_state_obtained
));
1965 DBG_ERR(" Gensec features: %#X\n",
1966 creds
->gensec_features
);
1967 DBG_ERR(" Forced sasl mech: %s\n",
1968 creds
->forced_sasl_mech
);
1969 DBG_ERR(" CCACHE: %p - %s\n",
1971 obtained_to_str(creds
->ccache_obtained
));
1972 DBG_ERR(" CLIENT_GSS_CREDS: %p - %s\n",
1973 creds
->client_gss_creds
,
1974 obtained_to_str(creds
->client_gss_creds_obtained
));
1975 DBG_ERR(" SERVER_GSS_CREDS: %p - %s\n",
1976 creds
->server_gss_creds
,
1977 obtained_to_str(creds
->server_gss_creds_obtained
));
1978 DBG_ERR(" KEYTAB: %p - %s\n",
1980 obtained_to_str(creds
->keytab_obtained
));
1981 DBG_ERR(" KVNO: %u\n",
1987 * @brief Obtain the SMB encryption state from a credentials structure.
1989 * @param[in] creds The credential structure to obtain the SMB encryption state
1992 * @return The SMB signing state.
1994 _PUBLIC_
enum smb_encryption_setting
1995 cli_credentials_get_smb_encryption(struct cli_credentials
*creds
)
1997 return creds
->encryption_state
;
2001 * Encrypt a data blob using the session key and the negotiated encryption
2004 * @param state Credential state, contains the session key and algorithm
2005 * @param data Data blob containing the data to be encrypted.
2008 _PUBLIC_ NTSTATUS
netlogon_creds_session_encrypt(
2009 struct netlogon_creds_CredentialState
*state
,
2014 if (data
.data
== NULL
|| data
.length
== 0) {
2015 DBG_ERR("Nothing to encrypt "
2016 "data.data == NULL or data.length == 0\n");
2017 return NT_STATUS_INVALID_PARAMETER
;
2020 * Don't crypt an all-zero password it will give away the
2021 * NETLOGON pipe session key .
2023 if (all_zero(data
.data
, data
.length
)) {
2024 DBG_ERR("Supplied data all zeros, could leak session key\n");
2025 return NT_STATUS_INVALID_PARAMETER
;
2027 if (state
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
2028 status
= netlogon_creds_aes_encrypt(state
,
2031 } else if (state
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
) {
2032 status
= netlogon_creds_arcfour_crypt(state
,
2036 DBG_ERR("Unsupported encryption option negotiated\n");
2037 status
= NT_STATUS_NOT_SUPPORTED
;
2039 if (!NT_STATUS_IS_OK(status
)) {
2042 return NT_STATUS_OK
;