2 Unix SMB/CIFS implementation.
4 User credentials handling
6 Copyright (C) Jelmer Vernooij 2005
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/util/util_file.h"
26 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
27 #include "auth/credentials/credentials.h"
28 #include "auth/credentials/credentials_internal.h"
29 #include "auth/gensec/gensec.h"
30 #include "libcli/auth/libcli_auth.h"
32 #include "param/param.h"
33 #include "system/filesys.h"
34 #include "system/passwd.h"
37 * Create a new credentials structure
38 * @param mem_ctx TALLOC_CTX parent for credentials structure
40 _PUBLIC_
struct cli_credentials
*cli_credentials_init(TALLOC_CTX
*mem_ctx
)
42 struct cli_credentials
*cred
= talloc_zero(mem_ctx
, struct cli_credentials
);
47 cred
->winbind_separator
= '\\';
49 cred
->kerberos_state
= CRED_USE_KERBEROS_DESIRED
;
51 cred
->signing_state
= SMB_SIGNING_DEFAULT
;
54 * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use
55 * the same value here.
57 cred
->ipc_signing_state
= SMB_SIGNING_REQUIRED
;
58 cred
->encryption_state
= SMB_ENCRYPTION_DEFAULT
;
64 struct cli_credentials
*cli_credentials_init_server(TALLOC_CTX
*mem_ctx
,
65 struct loadparm_context
*lp_ctx
)
67 struct cli_credentials
*server_creds
= NULL
;
71 server_creds
= cli_credentials_init(mem_ctx
);
72 if (server_creds
== NULL
) {
76 ok
= cli_credentials_set_conf(server_creds
, lp_ctx
);
78 TALLOC_FREE(server_creds
);
82 status
= cli_credentials_set_machine_account(server_creds
, lp_ctx
);
83 if (!NT_STATUS_IS_OK(status
)) {
84 DEBUG(1, ("Failed to obtain server credentials: %s\n",
86 TALLOC_FREE(server_creds
);
93 _PUBLIC_
void cli_credentials_set_callback_data(struct cli_credentials
*cred
,
96 cred
->priv_data
= callback_data
;
99 _PUBLIC_
void *_cli_credentials_callback_data(struct cli_credentials
*cred
)
101 return cred
->priv_data
;
105 * Create a new anonymous credential
106 * @param mem_ctx TALLOC_CTX parent for credentials structure
108 _PUBLIC_
struct cli_credentials
*cli_credentials_init_anon(TALLOC_CTX
*mem_ctx
)
110 struct cli_credentials
*anon_credentials
;
112 anon_credentials
= cli_credentials_init(mem_ctx
);
113 cli_credentials_set_anonymous(anon_credentials
);
115 return anon_credentials
;
118 _PUBLIC_
bool cli_credentials_set_kerberos_state(struct cli_credentials
*creds
,
119 enum credentials_use_kerberos kerberos_state
,
120 enum credentials_obtained obtained
)
122 if (obtained
>= creds
->kerberos_state_obtained
) {
123 creds
->kerberos_state
= kerberos_state
;
124 creds
->kerberos_state_obtained
= obtained
;
132 _PUBLIC_
void cli_credentials_set_forced_sasl_mech(struct cli_credentials
*creds
,
133 const char *sasl_mech
)
135 TALLOC_FREE(creds
->forced_sasl_mech
);
136 creds
->forced_sasl_mech
= talloc_strdup(creds
, sasl_mech
);
139 _PUBLIC_
void cli_credentials_set_krb_forwardable(struct cli_credentials
*creds
,
140 enum credentials_krb_forwardable krb_forwardable
)
142 creds
->krb_forwardable
= krb_forwardable
;
145 _PUBLIC_
enum credentials_use_kerberos
cli_credentials_get_kerberos_state(struct cli_credentials
*creds
)
147 return creds
->kerberos_state
;
150 _PUBLIC_
const char *cli_credentials_get_forced_sasl_mech(struct cli_credentials
*creds
)
152 return creds
->forced_sasl_mech
;
155 _PUBLIC_
enum credentials_krb_forwardable
cli_credentials_get_krb_forwardable(struct cli_credentials
*creds
)
157 return creds
->krb_forwardable
;
160 _PUBLIC_
bool cli_credentials_set_gensec_features(struct cli_credentials
*creds
,
161 uint32_t gensec_features
,
162 enum credentials_obtained obtained
)
164 if (obtained
>= creds
->gensec_features_obtained
) {
165 creds
->gensec_features_obtained
= obtained
;
166 creds
->gensec_features
= gensec_features
;
174 _PUBLIC_
uint32_t cli_credentials_get_gensec_features(struct cli_credentials
*creds
)
176 return creds
->gensec_features
;
181 * Obtain the username for this credentials context.
182 * @param cred credentials context
183 * @retval The username set on this context.
184 * @note Return value will never be NULL except by programmer error.
186 _PUBLIC_
const char *cli_credentials_get_username(struct cli_credentials
*cred
)
188 if (cred
->machine_account_pending
) {
189 cli_credentials_set_machine_account(cred
,
190 cred
->machine_account_pending_lp_ctx
);
193 if (cred
->username_obtained
== CRED_CALLBACK
&&
194 !cred
->callback_running
) {
195 cred
->callback_running
= true;
196 cred
->username
= cred
->username_cb(cred
);
197 cred
->callback_running
= false;
198 if (cred
->username_obtained
== CRED_CALLBACK
) {
199 cred
->username_obtained
= CRED_CALLBACK_RESULT
;
200 cli_credentials_invalidate_ccache(cred
, cred
->username_obtained
);
204 return cred
->username
;
208 * @brief Obtain the username for this credentials context.
210 * @param[in] cred The credential context.
212 * @param[in] obtained A pointer to store the obtained information.
214 * return The user name or NULL if an error occurred.
216 _PUBLIC_
const char *
217 cli_credentials_get_username_and_obtained(struct cli_credentials
*cred
,
218 enum credentials_obtained
*obtained
)
220 if (obtained
!= NULL
) {
221 *obtained
= cred
->username_obtained
;
224 return cli_credentials_get_username(cred
);
227 _PUBLIC_
bool cli_credentials_set_username(struct cli_credentials
*cred
,
228 const char *val
, enum credentials_obtained obtained
)
230 if (obtained
>= cred
->username_obtained
) {
231 cred
->username
= talloc_strdup(cred
, val
);
232 cred
->username_obtained
= obtained
;
233 cli_credentials_invalidate_ccache(cred
, cred
->username_obtained
);
240 _PUBLIC_
bool cli_credentials_set_username_callback(struct cli_credentials
*cred
,
241 const char *(*username_cb
) (struct cli_credentials
*))
243 if (cred
->username_obtained
< CRED_CALLBACK
) {
244 cred
->username_cb
= username_cb
;
245 cred
->username_obtained
= CRED_CALLBACK
;
252 _PUBLIC_
bool cli_credentials_set_bind_dn(struct cli_credentials
*cred
,
255 cred
->bind_dn
= talloc_strdup(cred
, bind_dn
);
260 * Obtain the BIND DN for this credentials context.
261 * @param cred credentials context
262 * @retval The username set on this context.
263 * @note Return value will be NULL if not specified explicitly
265 _PUBLIC_
const char *cli_credentials_get_bind_dn(struct cli_credentials
*cred
)
267 return cred
->bind_dn
;
272 * @brief Find out how the principal was obtained.
274 * @param cred A credentials context.
276 * @return The obtained information for the principal.
278 _PUBLIC_
enum credentials_obtained
279 cli_credentials_get_principal_obtained(struct cli_credentials
*cred
)
281 if (cred
->machine_account_pending
) {
282 cli_credentials_set_machine_account(cred
,
283 cred
->machine_account_pending_lp_ctx
);
286 if (cred
->principal_obtained
< cred
->username_obtained
287 || cred
->principal_obtained
< MAX(cred
->domain_obtained
, cred
->realm_obtained
)) {
288 const char *effective_username
= NULL
;
289 const char *effective_realm
= NULL
;
290 enum credentials_obtained effective_obtained
;
293 * We don't want to trigger a callbacks in
294 * cli_credentials_get_username()
295 * cli_credentials_get_domain()
297 * cli_credentials_get_realm()
300 effective_username
= cred
->username
;
301 if (effective_username
== NULL
|| strlen(effective_username
) == 0) {
302 return cred
->username_obtained
;
305 if (cred
->domain_obtained
> cred
->realm_obtained
) {
306 effective_realm
= cred
->domain
;
307 effective_obtained
= MIN(cred
->domain_obtained
,
308 cred
->username_obtained
);
310 effective_realm
= cred
->realm
;
311 effective_obtained
= MIN(cred
->realm_obtained
,
312 cred
->username_obtained
);
315 if (effective_realm
== NULL
|| strlen(effective_realm
) == 0) {
316 effective_realm
= cred
->domain
;
317 effective_obtained
= MIN(cred
->domain_obtained
,
318 cred
->username_obtained
);
321 if (effective_realm
!= NULL
&& strlen(effective_realm
) != 0) {
322 return effective_obtained
;
326 return cred
->principal_obtained
;
330 * Obtain the client principal for this credentials context.
331 * @param cred credentials context
332 * @retval The username set on this context.
333 * @note Return value will never be NULL except by programmer error.
335 _PUBLIC_
char *cli_credentials_get_principal_and_obtained(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
, enum credentials_obtained
*obtained
)
337 if (cred
->machine_account_pending
) {
338 cli_credentials_set_machine_account(cred
,
339 cred
->machine_account_pending_lp_ctx
);
342 if (cred
->principal_obtained
== CRED_CALLBACK
&&
343 !cred
->callback_running
) {
344 cred
->callback_running
= true;
345 cred
->principal
= cred
->principal_cb(cred
);
346 cred
->callback_running
= false;
347 if (cred
->principal_obtained
== CRED_CALLBACK
) {
348 cred
->principal_obtained
= CRED_CALLBACK_RESULT
;
349 cli_credentials_invalidate_ccache(cred
, cred
->principal_obtained
);
353 if (cred
->principal_obtained
< cred
->username_obtained
354 || cred
->principal_obtained
< MAX(cred
->domain_obtained
, cred
->realm_obtained
)) {
355 const char *effective_username
= NULL
;
356 const char *effective_realm
= NULL
;
357 enum credentials_obtained effective_obtained
;
359 effective_username
= cli_credentials_get_username(cred
);
360 if (effective_username
== NULL
|| strlen(effective_username
) == 0) {
361 *obtained
= cred
->username_obtained
;
365 if (cred
->domain_obtained
> cred
->realm_obtained
) {
366 effective_realm
= cli_credentials_get_domain(cred
);
367 effective_obtained
= MIN(cred
->domain_obtained
,
368 cred
->username_obtained
);
370 effective_realm
= cli_credentials_get_realm(cred
);
371 effective_obtained
= MIN(cred
->realm_obtained
,
372 cred
->username_obtained
);
375 if (effective_realm
== NULL
|| strlen(effective_realm
) == 0) {
376 effective_realm
= cli_credentials_get_domain(cred
);
377 effective_obtained
= MIN(cred
->domain_obtained
,
378 cred
->username_obtained
);
381 if (effective_realm
!= NULL
&& strlen(effective_realm
) != 0) {
382 *obtained
= effective_obtained
;
383 return talloc_asprintf(mem_ctx
, "%s@%s",
388 *obtained
= cred
->principal_obtained
;
389 return talloc_strdup(mem_ctx
, cred
->principal
);
393 * Obtain the client principal for this credentials context.
394 * @param cred credentials context
395 * @retval The username set on this context.
396 * @note Return value will never be NULL except by programmer error.
398 _PUBLIC_
char *cli_credentials_get_principal(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
)
400 enum credentials_obtained obtained
;
401 return cli_credentials_get_principal_and_obtained(cred
, mem_ctx
, &obtained
);
404 _PUBLIC_
bool cli_credentials_set_principal(struct cli_credentials
*cred
,
406 enum credentials_obtained obtained
)
408 if (obtained
>= cred
->principal_obtained
) {
409 cred
->principal
= talloc_strdup(cred
, val
);
410 if (cred
->principal
== NULL
) {
413 cred
->principal_obtained
= obtained
;
415 cli_credentials_invalidate_ccache(cred
, cred
->principal_obtained
);
422 /* Set a callback to get the principal. This could be a popup dialog,
423 * a terminal prompt or similar. */
424 _PUBLIC_
bool cli_credentials_set_principal_callback(struct cli_credentials
*cred
,
425 const char *(*principal_cb
) (struct cli_credentials
*))
427 if (cred
->principal_obtained
< CRED_CALLBACK
) {
428 cred
->principal_cb
= principal_cb
;
429 cred
->principal_obtained
= CRED_CALLBACK
;
436 /* Some of our tools are 'anonymous by default'. This is a single
437 * function to determine if authentication has been explicitly
440 _PUBLIC_
bool cli_credentials_authentication_requested(struct cli_credentials
*cred
)
442 uint32_t gensec_features
= 0;
449 * If we forced the mech we clearly want authentication. E.g. to use
450 * SASL/EXTERNAL which has no credentials.
452 if (cred
->forced_sasl_mech
) {
456 if (cli_credentials_is_anonymous(cred
)){
460 if (cred
->principal_obtained
>= CRED_SPECIFIED
) {
463 if (cred
->username_obtained
>= CRED_SPECIFIED
) {
467 if (cli_credentials_get_kerberos_state(cred
) == CRED_USE_KERBEROS_REQUIRED
) {
471 gensec_features
= cli_credentials_get_gensec_features(cred
);
472 if (gensec_features
& GENSEC_FEATURE_NTLM_CCACHE
) {
476 if (gensec_features
& GENSEC_FEATURE_SIGN
) {
480 if (gensec_features
& GENSEC_FEATURE_SEAL
) {
488 * Obtain the password for this credentials context.
489 * @param cred credentials context
490 * @retval If set, the cleartext password, otherwise NULL
492 _PUBLIC_
const char *cli_credentials_get_password(struct cli_credentials
*cred
)
494 if (cred
->machine_account_pending
) {
495 cli_credentials_set_machine_account(cred
,
496 cred
->machine_account_pending_lp_ctx
);
499 if (cred
->password_obtained
== CRED_CALLBACK
&&
500 !cred
->callback_running
&&
501 !cred
->password_will_be_nt_hash
) {
502 cred
->callback_running
= true;
503 cred
->password
= cred
->password_cb(cred
);
504 cred
->callback_running
= false;
505 if (cred
->password_obtained
== CRED_CALLBACK
) {
506 cred
->password_obtained
= CRED_CALLBACK_RESULT
;
507 cli_credentials_invalidate_ccache(cred
, cred
->password_obtained
);
511 return cred
->password
;
515 * @brief Find out how the password was obtained.
517 * @param cred A credentials context.
519 * @return The obtained information for the password.
521 _PUBLIC_
enum credentials_obtained
522 cli_credentials_get_password_obtained(struct cli_credentials
*cred
)
524 return cred
->password_obtained
;
528 * @brief Obtain the password for this credentials context.
530 * @param[in] cred The credential context.
532 * @param[in] obtained A pointer to store the obtained information.
534 * return The user name or NULL if an error occurred.
536 _PUBLIC_
const char *
537 cli_credentials_get_password_and_obtained(struct cli_credentials
*cred
,
538 enum credentials_obtained
*obtained
)
540 const char *password
= cli_credentials_get_password(cred
);
542 if (obtained
!= NULL
) {
543 *obtained
= cred
->password_obtained
;
549 /* Set a password on the credentials context, including an indication
550 * of 'how' the password was obtained */
552 _PUBLIC_
bool cli_credentials_set_password(struct cli_credentials
*cred
,
554 enum credentials_obtained obtained
)
556 if (obtained
>= cred
->password_obtained
) {
558 cred
->lm_response
= data_blob_null
;
559 cred
->nt_response
= data_blob_null
;
560 cred
->nt_hash
= NULL
;
561 cred
->password
= NULL
;
563 cli_credentials_invalidate_ccache(cred
, obtained
);
565 cred
->password_tries
= 0;
568 cred
->password_obtained
= obtained
;
572 if (cred
->password_will_be_nt_hash
) {
573 struct samr_Password
*nt_hash
= NULL
;
574 size_t val_len
= strlen(val
);
577 nt_hash
= talloc(cred
, struct samr_Password
);
578 if (nt_hash
== NULL
) {
582 converted
= strhex_to_str((char *)nt_hash
->hash
,
583 sizeof(nt_hash
->hash
),
585 if (converted
!= sizeof(nt_hash
->hash
)) {
586 TALLOC_FREE(nt_hash
);
590 cred
->nt_hash
= nt_hash
;
591 cred
->password_obtained
= obtained
;
595 cred
->password
= talloc_strdup(cred
, val
);
596 if (cred
->password
== NULL
) {
600 /* Don't print the actual password in talloc memory dumps */
601 talloc_set_name_const(cred
->password
,
602 "password set via cli_credentials_set_password");
603 cred
->password_obtained
= obtained
;
611 _PUBLIC_
bool cli_credentials_set_password_callback(struct cli_credentials
*cred
,
612 const char *(*password_cb
) (struct cli_credentials
*))
614 if (cred
->password_obtained
< CRED_CALLBACK
) {
615 cred
->password_tries
= 3;
616 cred
->password_cb
= password_cb
;
617 cred
->password_obtained
= CRED_CALLBACK
;
618 cli_credentials_invalidate_ccache(cred
, cred
->password_obtained
);
626 * Obtain the 'old' password for this credentials context (used for join accounts).
627 * @param cred credentials context
628 * @retval If set, the cleartext password, otherwise NULL
630 _PUBLIC_
const char *cli_credentials_get_old_password(struct cli_credentials
*cred
)
632 if (cred
->machine_account_pending
) {
633 cli_credentials_set_machine_account(cred
,
634 cred
->machine_account_pending_lp_ctx
);
637 return cred
->old_password
;
640 _PUBLIC_
bool cli_credentials_set_old_password(struct cli_credentials
*cred
,
642 enum credentials_obtained obtained
)
644 cred
->old_password
= talloc_strdup(cred
, val
);
645 if (cred
->old_password
) {
646 /* Don't print the actual password in talloc memory dumps */
647 talloc_set_name_const(cred
->old_password
, "password set via cli_credentials_set_old_password");
649 cred
->old_nt_hash
= NULL
;
654 * Obtain the password, in the form MD4(unicode(password)) for this credentials context.
656 * Sometimes we only have this much of the password, while the rest of
657 * the time this call avoids calling E_md4hash themselves.
659 * @param cred credentials context
660 * @retval If set, the cleartext password, otherwise NULL
662 _PUBLIC_
struct samr_Password
*cli_credentials_get_nt_hash(struct cli_credentials
*cred
,
665 enum credentials_obtained password_obtained
;
666 enum credentials_obtained ccache_threshold
;
667 enum credentials_obtained client_gss_creds_threshold
;
668 bool password_is_nt_hash
;
669 const char *password
= NULL
;
670 struct samr_Password
*nt_hash
= NULL
;
672 if (cred
->nt_hash
!= NULL
) {
674 * If we already have a hash it's easy.
680 * This is a bit tricky, with password_will_be_nt_hash
681 * we still need to get the value via the password_callback
682 * but if we did that we should not remember it's state
683 * in the long run so we need to undo it.
686 password_obtained
= cred
->password_obtained
;
687 ccache_threshold
= cred
->ccache_threshold
;
688 client_gss_creds_threshold
= cred
->client_gss_creds_threshold
;
689 password_is_nt_hash
= cred
->password_will_be_nt_hash
;
691 cred
->password_will_be_nt_hash
= false;
692 password
= cli_credentials_get_password(cred
);
694 cred
->password_will_be_nt_hash
= password_is_nt_hash
;
695 if (password_is_nt_hash
&& password_obtained
== CRED_CALLBACK
) {
697 * We got the nt_hash as string via the callback,
698 * so we need to undo the state change.
700 * And also don't remember it as plaintext password.
702 cred
->client_gss_creds_threshold
= client_gss_creds_threshold
;
703 cred
->ccache_threshold
= ccache_threshold
;
704 cred
->password_obtained
= password_obtained
;
705 cred
->password
= NULL
;
708 if (password
== NULL
) {
712 nt_hash
= talloc(cred
, struct samr_Password
);
713 if (nt_hash
== NULL
) {
717 if (password_is_nt_hash
) {
718 size_t password_len
= strlen(password
);
721 converted
= strhex_to_str((char *)nt_hash
->hash
,
722 sizeof(nt_hash
->hash
),
723 password
, password_len
);
724 if (converted
!= sizeof(nt_hash
->hash
)) {
725 TALLOC_FREE(nt_hash
);
729 E_md4hash(password
, nt_hash
->hash
);
732 cred
->nt_hash
= nt_hash
;
736 nt_hash
= talloc(mem_ctx
, struct samr_Password
);
737 if (nt_hash
== NULL
) {
741 *nt_hash
= *cred
->nt_hash
;
747 * Obtain the old password, in the form MD4(unicode(password)) for this credentials context.
749 * Sometimes we only have this much of the password, while the rest of
750 * the time this call avoids calling E_md4hash themselves.
752 * @param cred credentials context
753 * @retval If set, the cleartext password, otherwise NULL
755 _PUBLIC_
struct samr_Password
*cli_credentials_get_old_nt_hash(struct cli_credentials
*cred
,
758 const char *old_password
= NULL
;
760 if (cred
->old_nt_hash
!= NULL
) {
761 struct samr_Password
*nt_hash
= talloc(mem_ctx
, struct samr_Password
);
766 *nt_hash
= *cred
->old_nt_hash
;
771 old_password
= cli_credentials_get_old_password(cred
);
773 struct samr_Password
*nt_hash
= talloc(mem_ctx
, struct samr_Password
);
778 E_md4hash(old_password
, nt_hash
->hash
);
787 * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
788 * @param cred credentials context
789 * @retval The domain set on this context.
790 * @note Return value will never be NULL except by programmer error.
792 _PUBLIC_
const char *cli_credentials_get_domain(struct cli_credentials
*cred
)
794 if (cred
->machine_account_pending
) {
795 cli_credentials_set_machine_account(cred
,
796 cred
->machine_account_pending_lp_ctx
);
799 if (cred
->domain_obtained
== CRED_CALLBACK
&&
800 !cred
->callback_running
) {
801 cred
->callback_running
= true;
802 cred
->domain
= cred
->domain_cb(cred
);
803 cred
->callback_running
= false;
804 if (cred
->domain_obtained
== CRED_CALLBACK
) {
805 cred
->domain_obtained
= CRED_CALLBACK_RESULT
;
806 cli_credentials_invalidate_ccache(cred
, cred
->domain_obtained
);
814 * @brief Obtain the domain for this credential context.
816 * @param[in] cred The credential context.
818 * @param[out] obtained A pointer to store the obtained information.
820 * @return The domain name or NULL if an error occurred.
822 _PUBLIC_
const char *cli_credentials_get_domain_and_obtained(
823 struct cli_credentials
*cred
,
824 enum credentials_obtained
*obtained
)
826 const char *domain
= cli_credentials_get_domain(cred
);
828 if (obtained
!= NULL
) {
829 *obtained
= cred
->domain_obtained
;
836 _PUBLIC_
bool cli_credentials_set_domain(struct cli_credentials
*cred
,
838 enum credentials_obtained obtained
)
840 if (obtained
>= cred
->domain_obtained
) {
841 /* it is important that the domain be in upper case,
842 * particularly for the sensitive NTLMv2
844 cred
->domain
= strupper_talloc(cred
, val
);
845 cred
->domain_obtained
= obtained
;
846 /* setting domain does not mean we have to invalidate ccache
847 * because domain in not used for Kerberos operations.
848 * If ccache invalidation is required, one will anyway specify
849 * a password to kinit, and that will force invalidation of the ccache
857 bool cli_credentials_set_domain_callback(struct cli_credentials
*cred
,
858 const char *(*domain_cb
) (struct cli_credentials
*))
860 if (cred
->domain_obtained
< CRED_CALLBACK
) {
861 cred
->domain_cb
= domain_cb
;
862 cred
->domain_obtained
= CRED_CALLBACK
;
870 * Obtain the Kerberos realm for this credentials context.
871 * @param cred credentials context
872 * @retval The realm set on this context.
873 * @note Return value will never be NULL except by programmer error.
875 _PUBLIC_
const char *cli_credentials_get_realm(struct cli_credentials
*cred
)
877 if (cred
->machine_account_pending
) {
878 cli_credentials_set_machine_account(cred
,
879 cred
->machine_account_pending_lp_ctx
);
882 if (cred
->realm_obtained
== CRED_CALLBACK
&&
883 !cred
->callback_running
) {
884 cred
->callback_running
= true;
885 cred
->realm
= cred
->realm_cb(cred
);
886 cred
->callback_running
= false;
887 if (cred
->realm_obtained
== CRED_CALLBACK
) {
888 cred
->realm_obtained
= CRED_CALLBACK_RESULT
;
889 cli_credentials_invalidate_ccache(cred
, cred
->realm_obtained
);
897 * Set the realm for this credentials context, and force it to
898 * uppercase for the sanity of our local kerberos libraries
900 _PUBLIC_
bool cli_credentials_set_realm(struct cli_credentials
*cred
,
902 enum credentials_obtained obtained
)
904 if (obtained
>= cred
->realm_obtained
) {
905 cred
->realm
= strupper_talloc(cred
, val
);
906 cred
->realm_obtained
= obtained
;
907 cli_credentials_invalidate_ccache(cred
, cred
->realm_obtained
);
914 bool cli_credentials_set_realm_callback(struct cli_credentials
*cred
,
915 const char *(*realm_cb
) (struct cli_credentials
*))
917 if (cred
->realm_obtained
< CRED_CALLBACK
) {
918 cred
->realm_cb
= realm_cb
;
919 cred
->realm_obtained
= CRED_CALLBACK
;
927 * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
929 * @param cred credentials context
930 * @retval The workstation name set on this context.
931 * @note Return value will never be NULL except by programmer error.
933 _PUBLIC_
const char *cli_credentials_get_workstation(struct cli_credentials
*cred
)
935 if (cred
->workstation_obtained
== CRED_CALLBACK
&&
936 !cred
->callback_running
) {
937 cred
->callback_running
= true;
938 cred
->workstation
= cred
->workstation_cb(cred
);
939 cred
->callback_running
= false;
940 if (cred
->workstation_obtained
== CRED_CALLBACK
) {
941 cred
->workstation_obtained
= CRED_CALLBACK_RESULT
;
945 return cred
->workstation
;
948 _PUBLIC_
bool cli_credentials_set_workstation(struct cli_credentials
*cred
,
950 enum credentials_obtained obtained
)
952 if (obtained
>= cred
->workstation_obtained
) {
953 cred
->workstation
= talloc_strdup(cred
, val
);
954 cred
->workstation_obtained
= obtained
;
961 bool cli_credentials_set_workstation_callback(struct cli_credentials
*cred
,
962 const char *(*workstation_cb
) (struct cli_credentials
*))
964 if (cred
->workstation_obtained
< CRED_CALLBACK
) {
965 cred
->workstation_cb
= workstation_cb
;
966 cred
->workstation_obtained
= CRED_CALLBACK
;
974 * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
976 * The format accepted is [domain\\]user[%password] or user[@realm][%password]
978 * @param credentials Credentials structure on which to set the password
979 * @param data the string containing the username, password etc
980 * @param obtained This enum describes how 'specified' this password is
983 _PUBLIC_
void cli_credentials_parse_string(struct cli_credentials
*credentials
, const char *data
, enum credentials_obtained obtained
)
986 char *uname_free
= NULL
;
988 if (strcmp("%",data
) == 0) {
989 cli_credentials_set_anonymous(credentials
);
993 uname
= talloc_strdup(credentials
, data
);
996 if ((p
= strchr_m(uname
,'%'))) {
998 cli_credentials_set_password(credentials
, p
+1, obtained
);
1001 if ((p
= strchr_m(uname
,'@'))) {
1003 * We also need to set username and domain
1004 * in order to undo the effect of
1005 * cli_credentials_guess().
1007 cli_credentials_set_username(credentials
, uname
, obtained
);
1008 cli_credentials_set_domain(credentials
, "", obtained
);
1010 cli_credentials_set_principal(credentials
, uname
, obtained
);
1012 cli_credentials_set_realm(credentials
, p
+1, obtained
);
1013 TALLOC_FREE(uname_free
);
1015 } else if ((p
= strchr_m(uname
,'\\'))
1016 || (p
= strchr_m(uname
, '/'))
1017 || (p
= strchr_m(uname
, credentials
->winbind_separator
)))
1019 const char *domain
= NULL
;
1025 if (obtained
== credentials
->realm_obtained
&&
1026 !strequal_m(credentials
->domain
, domain
))
1029 * We need to undo a former set with the same level
1030 * in order to get the expected result from
1031 * cli_credentials_get_principal().
1033 * But we only need to do that if the domain
1036 cli_credentials_set_realm(credentials
, domain
, obtained
);
1038 cli_credentials_set_domain(credentials
, domain
, obtained
);
1040 if (obtained
== credentials
->principal_obtained
&&
1041 !strequal_m(credentials
->username
, uname
))
1044 * We need to undo a former set with the same level
1045 * in order to get the expected result from
1046 * cli_credentials_get_principal().
1048 * But we only need to do that if the username
1051 credentials
->principal_obtained
= CRED_UNINITIALISED
;
1052 credentials
->principal
= NULL
;
1054 cli_credentials_set_username(credentials
, uname
, obtained
);
1056 TALLOC_FREE(uname_free
);
1060 * Given a a credentials structure, print it as a string
1062 * The format output is [domain\\]user[%password] or user[@realm][%password]
1064 * @param credentials Credentials structure on which to set the password
1065 * @param mem_ctx The memory context to place the result on
1068 _PUBLIC_
char *cli_credentials_get_unparsed_name(struct cli_credentials
*credentials
, TALLOC_CTX
*mem_ctx
)
1070 const char *bind_dn
= cli_credentials_get_bind_dn(credentials
);
1071 const char *domain
= NULL
;
1072 const char *username
= NULL
;
1076 name
= talloc_strdup(mem_ctx
, bind_dn
);
1078 cli_credentials_get_ntlm_username_domain(credentials
, mem_ctx
, &username
, &domain
);
1079 if (domain
&& domain
[0]) {
1080 name
= talloc_asprintf(mem_ctx
, "%s\\%s",
1083 name
= talloc_asprintf(mem_ctx
, "%s",
1092 * Specifies default values for domain, workstation and realm
1093 * from the smb.conf configuration file
1095 * @param cred Credentials structure to fill in
1097 * @return true on success, false on error.
1099 _PUBLIC_
bool cli_credentials_set_conf(struct cli_credentials
*cred
,
1100 struct loadparm_context
*lp_ctx
)
1102 const char *sep
= NULL
;
1103 const char *realm
= lpcfg_realm(lp_ctx
);
1104 enum credentials_client_protection protection
=
1105 lpcfg_client_protection(lp_ctx
);
1106 const char *workgroup
= lpcfg_workgroup(lp_ctx
);
1107 const char *netbios_name
= lpcfg_netbios_name(lp_ctx
);
1110 (void)cli_credentials_set_username(cred
, "", CRED_UNINITIALISED
);
1112 if (workgroup
!= NULL
&& strlen(workgroup
) == 0) {
1116 if (workgroup
!= NULL
) {
1117 if (lpcfg_parm_is_cmdline(lp_ctx
, "workgroup")) {
1118 ok
= cli_credentials_set_domain(cred
,
1122 DBG_ERR("Failed to set domain!\n");
1126 (void)cli_credentials_set_domain(cred
,
1132 if (netbios_name
!= NULL
&& strlen(netbios_name
) == 0) {
1133 netbios_name
= NULL
;
1136 if (netbios_name
!= NULL
) {
1137 if (lpcfg_parm_is_cmdline(lp_ctx
, "netbios name")) {
1138 ok
= cli_credentials_set_workstation(cred
,
1142 DBG_ERR("Failed to set workstation!\n");
1146 (void)cli_credentials_set_workstation(cred
,
1152 if (realm
!= NULL
&& strlen(realm
) == 0) {
1156 if (realm
!= NULL
) {
1157 if (lpcfg_parm_is_cmdline(lp_ctx
, "realm")) {
1158 ok
= cli_credentials_set_realm(cred
,
1162 DBG_ERR("Failed to set realm!\n");
1166 (void)cli_credentials_set_realm(cred
,
1172 sep
= lpcfg_winbind_separator(lp_ctx
);
1173 if (sep
!= NULL
&& sep
[0] != '\0') {
1174 cred
->winbind_separator
= *lpcfg_winbind_separator(lp_ctx
);
1177 if (cred
->signing_state_obtained
<= CRED_SMB_CONF
) {
1178 /* Will be set to default for invalid smb.conf values */
1179 cred
->signing_state
= lpcfg_client_signing(lp_ctx
);
1180 if (cred
->signing_state
== SMB_SIGNING_DEFAULT
) {
1181 switch (protection
) {
1182 case CRED_CLIENT_PROTECTION_DEFAULT
:
1184 case CRED_CLIENT_PROTECTION_PLAIN
:
1185 cred
->signing_state
= SMB_SIGNING_OFF
;
1187 case CRED_CLIENT_PROTECTION_SIGN
:
1188 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1189 cred
->signing_state
= SMB_SIGNING_REQUIRED
;
1194 cred
->signing_state_obtained
= CRED_SMB_CONF
;
1197 if (cred
->ipc_signing_state_obtained
<= CRED_SMB_CONF
) {
1198 /* Will be set to required for invalid smb.conf values */
1199 cred
->ipc_signing_state
= lpcfg_client_ipc_signing(lp_ctx
);
1200 cred
->ipc_signing_state_obtained
= CRED_SMB_CONF
;
1203 if (cred
->encryption_state_obtained
<= CRED_SMB_CONF
) {
1204 /* Will be set to default for invalid smb.conf values */
1205 cred
->encryption_state
= lpcfg_client_smb_encrypt(lp_ctx
);
1206 if (cred
->encryption_state
== SMB_ENCRYPTION_DEFAULT
) {
1207 switch (protection
) {
1208 case CRED_CLIENT_PROTECTION_DEFAULT
:
1210 case CRED_CLIENT_PROTECTION_PLAIN
:
1211 case CRED_CLIENT_PROTECTION_SIGN
:
1212 cred
->encryption_state
= SMB_ENCRYPTION_OFF
;
1214 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1215 cred
->encryption_state
= SMB_ENCRYPTION_REQUIRED
;
1221 if (cred
->kerberos_state_obtained
<= CRED_SMB_CONF
) {
1222 /* Will be set to default for invalid smb.conf values */
1223 cred
->kerberos_state
= lpcfg_client_use_kerberos(lp_ctx
);
1224 cred
->kerberos_state_obtained
= CRED_SMB_CONF
;
1227 if (cred
->gensec_features_obtained
<= CRED_SMB_CONF
) {
1228 switch (protection
) {
1229 case CRED_CLIENT_PROTECTION_DEFAULT
:
1231 case CRED_CLIENT_PROTECTION_PLAIN
:
1232 cred
->gensec_features
= 0;
1234 case CRED_CLIENT_PROTECTION_SIGN
:
1235 cred
->gensec_features
= GENSEC_FEATURE_SIGN
;
1237 case CRED_CLIENT_PROTECTION_ENCRYPT
:
1238 cred
->gensec_features
=
1239 GENSEC_FEATURE_SIGN
|GENSEC_FEATURE_SEAL
;
1242 cred
->gensec_features_obtained
= CRED_SMB_CONF
;
1249 * Guess defaults for credentials from environment variables,
1250 * and from the configuration file
1252 * @param cred Credentials structure to fill in
1254 _PUBLIC_
bool cli_credentials_guess(struct cli_credentials
*cred
,
1255 struct loadparm_context
*lp_ctx
)
1257 const char *error_string
;
1258 const char *env
= NULL
;
1259 struct passwd
*pwd
= NULL
;
1262 if (lp_ctx
!= NULL
) {
1263 ok
= cli_credentials_set_conf(cred
, lp_ctx
);
1269 pwd
= getpwuid(getuid());
1271 size_t len
= strlen(pwd
->pw_name
);
1273 if (len
> 0 && len
<= 1024) {
1274 (void)cli_credentials_parse_string(cred
,
1280 env
= getenv("LOGNAME");
1282 size_t len
= strlen(env
);
1284 if (len
> 0 && len
<= 1024) {
1285 (void)cli_credentials_set_username(cred
,
1291 env
= getenv("USER");
1293 size_t len
= strlen(env
);
1295 if (len
> 0 && len
<= 1024) {
1298 (void)cli_credentials_parse_string(cred
,
1301 if ((p
= strchr_m(env
, '%'))) {
1302 memset(p
, '\0', strlen(cred
->password
));
1307 env
= getenv("PASSWD");
1309 size_t len
= strlen(env
);
1311 if (len
> 0 && len
<= 1024) {
1312 (void)cli_credentials_set_password(cred
,
1318 env
= getenv("PASSWD_FD");
1320 size_t len
= strlen(env
);
1322 if (len
> 0 && len
<= 1024) {
1325 (void)cli_credentials_parse_password_fd(cred
,
1331 env
= getenv("PASSWD_FILE");
1333 size_t len
= strlen(env
);
1335 if (len
> 0 && len
<= 4096) {
1336 (void)cli_credentials_parse_password_file(cred
,
1342 if (lp_ctx
!= NULL
&&
1343 cli_credentials_get_kerberos_state(cred
) != CRED_USE_KERBEROS_DISABLED
) {
1344 (void)cli_credentials_set_ccache(cred
,
1355 * Attach NETLOGON credentials for use with SCHANNEL
1358 _PUBLIC_
void cli_credentials_set_netlogon_creds(
1359 struct cli_credentials
*cred
,
1360 const struct netlogon_creds_CredentialState
*netlogon_creds
)
1362 TALLOC_FREE(cred
->netlogon_creds
);
1363 if (netlogon_creds
== NULL
) {
1366 cred
->netlogon_creds
= netlogon_creds_copy(cred
, netlogon_creds
);
1370 * Return attached NETLOGON credentials
1373 _PUBLIC_
struct netlogon_creds_CredentialState
*cli_credentials_get_netlogon_creds(struct cli_credentials
*cred
)
1375 return cred
->netlogon_creds
;
1379 * Set NETLOGON secure channel type
1382 _PUBLIC_
void cli_credentials_set_secure_channel_type(struct cli_credentials
*cred
,
1383 enum netr_SchannelType secure_channel_type
)
1385 cred
->secure_channel_type
= secure_channel_type
;
1389 * Return NETLOGON secure channel type
1392 _PUBLIC_
time_t cli_credentials_get_password_last_changed_time(struct cli_credentials
*cred
)
1394 return cred
->password_last_changed_time
;
1398 * Set NETLOGON secure channel type
1401 _PUBLIC_
void cli_credentials_set_password_last_changed_time(struct cli_credentials
*cred
,
1402 time_t last_changed_time
)
1404 cred
->password_last_changed_time
= last_changed_time
;
1408 * Return NETLOGON secure channel type
1411 _PUBLIC_
enum netr_SchannelType
cli_credentials_get_secure_channel_type(struct cli_credentials
*cred
)
1413 return cred
->secure_channel_type
;
1417 * Fill in a credentials structure as the anonymous user
1419 _PUBLIC_
void cli_credentials_set_anonymous(struct cli_credentials
*cred
)
1421 cli_credentials_set_username(cred
, "", CRED_SPECIFIED
);
1422 cli_credentials_set_domain(cred
, "", CRED_SPECIFIED
);
1423 cli_credentials_set_password(cred
, NULL
, CRED_SPECIFIED
);
1424 cli_credentials_set_principal(cred
, NULL
, CRED_SPECIFIED
);
1425 cli_credentials_set_realm(cred
, NULL
, CRED_SPECIFIED
);
1426 cli_credentials_set_workstation(cred
, "", CRED_UNINITIALISED
);
1427 cli_credentials_set_kerberos_state(cred
,
1428 CRED_USE_KERBEROS_DISABLED
,
1433 * Describe a credentials context as anonymous or authenticated
1434 * @retval true if anonymous, false if a username is specified
1437 _PUBLIC_
bool cli_credentials_is_anonymous(struct cli_credentials
*cred
)
1439 const char *username
;
1441 /* if bind dn is set it's not anonymous */
1442 if (cred
->bind_dn
) {
1446 if (cred
->machine_account_pending
) {
1447 cli_credentials_set_machine_account(cred
,
1448 cred
->machine_account_pending_lp_ctx
);
1451 /* if principal is set, it's not anonymous */
1452 if ((cred
->principal
!= NULL
) && cred
->principal_obtained
>= cred
->username_obtained
) {
1456 username
= cli_credentials_get_username(cred
);
1458 /* Yes, it is deliberate that we die if we have a NULL pointer
1459 * here - anonymous is "", not NULL, which is 'never specified,
1460 * never guessed', ie programmer bug */
1469 * Mark the current password for a credentials struct as wrong. This will
1470 * cause the password to be prompted again (if a callback is set).
1472 * This will decrement the number of times the password can be tried.
1474 * @retval whether the credentials struct is finished
1476 _PUBLIC_
bool cli_credentials_wrong_password(struct cli_credentials
*cred
)
1478 if (cred
->password_obtained
!= CRED_CALLBACK_RESULT
) {
1482 if (cred
->password_tries
== 0) {
1486 cred
->password_tries
--;
1488 if (cred
->password_tries
== 0) {
1492 cred
->password_obtained
= CRED_CALLBACK
;
1496 _PUBLIC_
void cli_credentials_get_ntlm_username_domain(struct cli_credentials
*cred
, TALLOC_CTX
*mem_ctx
,
1497 const char **username
,
1498 const char **domain
)
1500 if (cred
->principal_obtained
>= cred
->username_obtained
) {
1501 *domain
= talloc_strdup(mem_ctx
, "");
1502 *username
= cli_credentials_get_principal(cred
, mem_ctx
);
1504 *domain
= cli_credentials_get_domain(cred
);
1505 *username
= cli_credentials_get_username(cred
);
1510 * Read a named file, and parse it for username, domain, realm and password
1512 * @param credentials Credentials structure on which to set the password
1513 * @param file a named file to read the details from
1514 * @param obtained This enum describes how 'specified' this password is
1517 _PUBLIC_
bool cli_credentials_parse_file(struct cli_credentials
*cred
, const char *file
, enum credentials_obtained obtained
)
1520 char *ptr
, *val
, *param
;
1523 const char *realm
= NULL
;
1524 const char *domain
= NULL
;
1525 const char *password
= NULL
;
1526 const char *username
= NULL
;
1528 lines
= file_lines_load(file
, &numlines
, 0, NULL
);
1532 /* fail if we can't open the credentials file */
1533 d_printf("ERROR: Unable to open credentials file!\n");
1537 for (i
= 0; i
< numlines
; i
++) {
1538 len
= strlen(lines
[i
]);
1543 /* break up the line into parameter & value.
1544 * will need to eat a little whitespace possibly */
1546 if (!(ptr
= strchr_m (lines
[i
], '=')))
1552 /* eat leading white space */
1553 while ((*val
!='\0') && ((*val
==' ') || (*val
=='\t')))
1556 if (strwicmp("password", param
) == 0) {
1558 } else if (strwicmp("username", param
) == 0) {
1560 } else if (strwicmp("domain", param
) == 0) {
1562 } else if (strwicmp("realm", param
) == 0) {
1567 * We need to readd '=' in order to let
1568 * the strlen() work in the last loop
1569 * that clears the memory.
1574 if (realm
!= NULL
&& strlen(realm
) != 0) {
1576 * only overwrite with a valid string
1578 cli_credentials_set_realm(cred
, realm
, obtained
);
1581 if (domain
!= NULL
&& strlen(domain
) != 0) {
1583 * only overwrite with a valid string
1585 cli_credentials_set_domain(cred
, domain
, obtained
);
1588 if (password
!= NULL
) {
1592 cli_credentials_set_password(cred
, password
, obtained
);
1595 if (username
!= NULL
) {
1597 * The last "username" line takes preference
1598 * if the string also contains domain, realm or
1601 cli_credentials_parse_string(cred
, username
, obtained
);
1604 for (i
= 0; i
< numlines
; i
++) {
1605 len
= strlen(lines
[i
]);
1606 memset(lines
[i
], 0, len
);
1614 * Read a named file, and parse it for a password
1616 * @param credentials Credentials structure on which to set the password
1617 * @param file a named file to read the password from
1618 * @param obtained This enum describes how 'specified' this password is
1621 _PUBLIC_
bool cli_credentials_parse_password_file(struct cli_credentials
*credentials
, const char *file
, enum credentials_obtained obtained
)
1623 int fd
= open(file
, O_RDONLY
, 0);
1627 fprintf(stderr
, "Error opening password file %s: %s\n",
1628 file
, strerror(errno
));
1632 ret
= cli_credentials_parse_password_fd(credentials
, fd
, obtained
);
1641 * Read a file descriptor, and parse it for a password (eg from a file or stdin)
1643 * @param credentials Credentials structure on which to set the password
1644 * @param fd open file descriptor to read the password from
1645 * @param obtained This enum describes how 'specified' this password is
1648 _PUBLIC_
bool cli_credentials_parse_password_fd(struct cli_credentials
*credentials
,
1649 int fd
, enum credentials_obtained obtained
)
1654 if (credentials
->password_obtained
>= obtained
) {
1658 for(p
= pass
, *p
= '\0'; /* ensure that pass is null-terminated */
1659 p
&& p
- pass
< sizeof(pass
) - 1;) {
1660 switch (read(fd
, p
, 1)) {
1662 if (*p
!= '\n' && *p
!= '\0') {
1663 *++p
= '\0'; /* advance p, and null-terminate pass */
1670 *p
= '\0'; /* null-terminate it, just in case... */
1671 p
= NULL
; /* then force the loop condition to become false */
1676 "Error reading password from file descriptor "
1677 "%d: empty password\n",
1682 fprintf(stderr
, "Error reading password from file descriptor %d: %s\n",
1683 fd
, strerror(errno
));
1688 cli_credentials_set_password(credentials
, pass
, obtained
);
1693 * @brief Set the SMB signing state to request for a SMB connection.
1695 * @param[in] creds The credentials structure to update.
1697 * @param[in] signing_state The signing state to set.
1699 * @param obtained This way the described signing state was specified.
1701 * @return true if we could set the signing state, false otherwise.
1703 _PUBLIC_
bool cli_credentials_set_smb_signing(struct cli_credentials
*creds
,
1704 enum smb_signing_setting signing_state
,
1705 enum credentials_obtained obtained
)
1707 if (obtained
>= creds
->signing_state_obtained
) {
1708 creds
->signing_state_obtained
= obtained
;
1709 creds
->signing_state
= signing_state
;
1717 * @brief Obtain the SMB signing state from a credentials structure.
1719 * @param[in] creds The credential structure to obtain the SMB signing state
1722 * @return The SMB signing state.
1724 _PUBLIC_
enum smb_signing_setting
1725 cli_credentials_get_smb_signing(struct cli_credentials
*creds
)
1727 return creds
->signing_state
;
1731 * @brief Set the SMB IPC signing state to request for a SMB connection.
1733 * @param[in] creds The credentials structure to update.
1735 * @param[in] signing_state The signing state to set.
1737 * @param obtained This way the described signing state was specified.
1739 * @return true if we could set the signing state, false otherwise.
1742 cli_credentials_set_smb_ipc_signing(struct cli_credentials
*creds
,
1743 enum smb_signing_setting ipc_signing_state
,
1744 enum credentials_obtained obtained
)
1746 if (obtained
>= creds
->ipc_signing_state_obtained
) {
1747 creds
->ipc_signing_state_obtained
= obtained
;
1748 creds
->ipc_signing_state
= ipc_signing_state
;
1756 * @brief Obtain the SMB IPC signing state from a credentials structure.
1758 * @param[in] creds The credential structure to obtain the SMB IPC signing
1761 * @return The SMB signing state.
1763 _PUBLIC_
enum smb_signing_setting
1764 cli_credentials_get_smb_ipc_signing(struct cli_credentials
*creds
)
1766 return creds
->ipc_signing_state
;
1770 * @brief Set the SMB encryption state to request for a SMB connection.
1772 * @param[in] creds The credentials structure to update.
1774 * @param[in] encryption_state The encryption state to set.
1776 * @param obtained This way the described encryption state was specified.
1778 * @return true if we could set the encryption state, false otherwise.
1780 _PUBLIC_
bool cli_credentials_set_smb_encryption(struct cli_credentials
*creds
,
1781 enum smb_encryption_setting encryption_state
,
1782 enum credentials_obtained obtained
)
1784 if (obtained
>= creds
->encryption_state_obtained
) {
1785 creds
->encryption_state_obtained
= obtained
;
1786 creds
->encryption_state
= encryption_state
;
1793 static const char *obtained_to_str(enum credentials_obtained obtained
)
1796 case CRED_UNINITIALISED
:
1797 return "CRED_UNINITIALISED";
1799 return "CRED_SMB_CONF";
1801 return "CRED_CALLBACK";
1802 case CRED_GUESS_ENV
:
1803 return "CRED_GUESS_ENV";
1804 case CRED_GUESS_FILE
:
1805 return "CRED_GUESS_FILE";
1806 case CRED_CALLBACK_RESULT
:
1807 return "CRED_CALLBACK_RESULT";
1808 case CRED_SPECIFIED
:
1809 return "CRED_SPECIFIED";
1816 static const char *krb5_state_to_str(enum credentials_use_kerberos krb5_state
)
1818 switch (krb5_state
) {
1819 case CRED_USE_KERBEROS_DISABLED
:
1820 return "CRED_USE_KERBEROS_DISABLED";
1821 case CRED_USE_KERBEROS_DESIRED
:
1822 return "CRED_USE_KERBEROS_DESIRED";
1823 case CRED_USE_KERBEROS_REQUIRED
:
1824 return "CRED_USE_KERBEROS_REQUIRED";
1831 static const char *krb5_fwd_to_str(enum credentials_krb_forwardable krb5_fwd
)
1834 case CRED_AUTO_KRB_FORWARDABLE
:
1835 return "CRED_AUTO_KRB_FORWARDABLE";
1836 case CRED_NO_KRB_FORWARDABLE
:
1837 return "CRED_NO_KRB_FORWARDABLE";
1838 case CRED_FORCE_KRB_FORWARDABLE
:
1839 return "CRED_FORCE_KRB_FORWARDABLE";
1846 static const char *signing_state_to_str(enum smb_signing_setting signing_state
)
1848 switch(signing_state
) {
1849 case SMB_SIGNING_IPC_DEFAULT
:
1850 return "SMB_SIGNING_IPC_DEFAULT";
1851 case SMB_SIGNING_DEFAULT
:
1852 return "SMB_SIGNING_DEFAULT";
1853 case SMB_SIGNING_OFF
:
1854 return "SMB_SIGNING_OFF";
1855 case SMB_SIGNING_IF_REQUIRED
:
1856 return "SMB_SIGNING_IF_REQUIRED";
1857 case SMB_SIGNING_DESIRED
:
1858 return "SMB_SIGNING_DESIRED";
1859 case SMB_SIGNING_REQUIRED
:
1860 return "SMB_SIGNING_REQUIRED";
1867 static const char *encryption_state_to_str(enum smb_encryption_setting encryption_state
)
1869 switch(encryption_state
) {
1870 case SMB_ENCRYPTION_DEFAULT
:
1871 return "SMB_ENCRYPTION_DEFAULT";
1872 case SMB_ENCRYPTION_OFF
:
1873 return "SMB_ENCRYPTION_OFF";
1874 case SMB_ENCRYPTION_IF_REQUIRED
:
1875 return "SMB_ENCRYPTION_IF_REQUIRED";
1876 case SMB_ENCRYPTION_DESIRED
:
1877 return "SMB_ENCRYPTION_DESIRED";
1878 case SMB_ENCRYPTION_REQUIRED
:
1879 return "SMB_ENCRYPTION_REQUIRED";
1886 _PUBLIC_
void cli_credentials_dump(struct cli_credentials
*creds
)
1888 DBG_ERR("CLI_CREDENTIALS:\n");
1890 DBG_ERR(" Username: %s - %s\n",
1892 obtained_to_str(creds
->username_obtained
));
1893 DBG_ERR(" Workstation: %s - %s\n",
1895 obtained_to_str(creds
->workstation_obtained
));
1896 DBG_ERR(" Domain: %s - %s\n",
1898 obtained_to_str(creds
->domain_obtained
));
1899 DBG_ERR(" Password: %s - %s\n",
1900 creds
->password
!= NULL
? "*SECRET*" : "NULL",
1901 obtained_to_str(creds
->password_obtained
));
1902 DBG_ERR(" Old password: %s\n",
1903 creds
->old_password
!= NULL
? "*SECRET*" : "NULL");
1904 DBG_ERR(" Password tries: %u\n",
1905 creds
->password_tries
);
1906 DBG_ERR(" Realm: %s - %s\n",
1908 obtained_to_str(creds
->realm_obtained
));
1909 DBG_ERR(" Principal: %s - %s\n",
1911 obtained_to_str(creds
->principal_obtained
));
1912 DBG_ERR(" Salt principal: %s\n",
1913 creds
->salt_principal
);
1914 DBG_ERR(" Impersonate principal: %s\n",
1915 creds
->impersonate_principal
);
1916 DBG_ERR(" Self service: %s\n",
1917 creds
->self_service
);
1918 DBG_ERR(" Target service: %s\n",
1919 creds
->target_service
);
1920 DBG_ERR(" Kerberos state: %s - %s\n",
1921 krb5_state_to_str(creds
->kerberos_state
),
1922 obtained_to_str(creds
->kerberos_state_obtained
));
1923 DBG_ERR(" Kerberos forwardable ticket: %s\n",
1924 krb5_fwd_to_str(creds
->krb_forwardable
));
1925 DBG_ERR(" Signing state: %s - %s\n",
1926 signing_state_to_str(creds
->signing_state
),
1927 obtained_to_str(creds
->signing_state_obtained
));
1928 DBG_ERR(" IPC signing state: %s - %s\n",
1929 signing_state_to_str(creds
->ipc_signing_state
),
1930 obtained_to_str(creds
->ipc_signing_state_obtained
));
1931 DBG_ERR(" Encryption state: %s - %s\n",
1932 encryption_state_to_str(creds
->encryption_state
),
1933 obtained_to_str(creds
->encryption_state_obtained
));
1934 DBG_ERR(" Gensec features: %#X\n",
1935 creds
->gensec_features
);
1936 DBG_ERR(" Forced sasl mech: %s\n",
1937 creds
->forced_sasl_mech
);
1938 DBG_ERR(" CCACHE: %p - %s\n",
1940 obtained_to_str(creds
->ccache_obtained
));
1941 DBG_ERR(" CLIENT_GSS_CREDS: %p - %s\n",
1942 creds
->client_gss_creds
,
1943 obtained_to_str(creds
->client_gss_creds_obtained
));
1944 DBG_ERR(" SERVER_GSS_CREDS: %p - %s\n",
1945 creds
->server_gss_creds
,
1946 obtained_to_str(creds
->server_gss_creds_obtained
));
1947 DBG_ERR(" KEYTAB: %p - %s\n",
1949 obtained_to_str(creds
->keytab_obtained
));
1950 DBG_ERR(" KVNO: %u\n",
1956 * @brief Obtain the SMB encryption state from a credentials structure.
1958 * @param[in] creds The credential structure to obtain the SMB encryption state
1961 * @return The SMB signing state.
1963 _PUBLIC_
enum smb_encryption_setting
1964 cli_credentials_get_smb_encryption(struct cli_credentials
*creds
)
1966 return creds
->encryption_state
;
1970 * Encrypt a data blob using the session key and the negotiated encryption
1973 * @param state Credential state, contains the session key and algorithm
1974 * @param data Data blob containing the data to be encrypted.
1977 _PUBLIC_ NTSTATUS
netlogon_creds_session_encrypt(
1978 struct netlogon_creds_CredentialState
*state
,
1983 if (data
.data
== NULL
|| data
.length
== 0) {
1984 DBG_ERR("Nothing to encrypt "
1985 "data.data == NULL or data.length == 0\n");
1986 return NT_STATUS_INVALID_PARAMETER
;
1989 * Don't crypt an all-zero password it will give away the
1990 * NETLOGON pipe session key .
1992 if (all_zero(data
.data
, data
.length
)) {
1993 DBG_ERR("Supplied data all zeros, could leak session key\n");
1994 return NT_STATUS_INVALID_PARAMETER
;
1996 if (state
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
1997 status
= netlogon_creds_aes_encrypt(state
,
2000 } else if (state
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
) {
2001 status
= netlogon_creds_arcfour_crypt(state
,
2005 DBG_ERR("Unsupported encryption option negotiated\n");
2006 status
= NT_STATUS_NOT_SUPPORTED
;
2008 if (!NT_STATUS_IS_OK(status
)) {
2011 return NT_STATUS_OK
;