auth/credentials/credentials.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    User credentials handling
   5
   6    Copyright (C) Jelmer Vernooij 2005
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
  26 #include "auth/credentials/credentials.h"
  27 #include "auth/credentials/credentials_internal.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "libcli/auth/libcli_auth.h"
  30 #include "tevent.h"
  31 #include "param/param.h"
  32 #include "system/filesys.h"
  33
  34 /**
  35  * Create a new credentials structure
  36  * @param mem_ctx TALLOC_CTX parent for credentials structure
  37  */
  38 _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
  39 {
  40         struct cli_credentials *cred = talloc_zero(mem_ctx, struct cli_credentials);
  41         if (cred == NULL) {
  42                 return cred;
  43         }
  44
  45         cred->winbind_separator = '\\';
  46
  47         cred->use_kerberos = CRED_USE_KERBEROS_DESIRED;
  48
  49         cred->signing_state = SMB_SIGNING_DEFAULT;
  50
  51         /*
  52          * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use
  53          * the same value here.
  54          */
  55         cred->ipc_signing_state = SMB_SIGNING_REQUIRED;
  56         cred->encryption_state = SMB_ENCRYPTION_DEFAULT;
  57
  58         return cred;
  59 }
  60
  61 _PUBLIC_
  62 struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx,
  63                                                     struct loadparm_context *lp_ctx)
  64 {
  65         struct cli_credentials *server_creds = NULL;
  66         NTSTATUS status;
  67
  68         server_creds = cli_credentials_init(mem_ctx);
  69         if (server_creds == NULL) {
  70                 return NULL;
  71         }
  72
  73         cli_credentials_set_conf(server_creds, lp_ctx);
  74
  75         status = cli_credentials_set_machine_account(server_creds, lp_ctx);
  76         if (!NT_STATUS_IS_OK(status)) {
  77                 DEBUG(1, ("Failed to obtain server credentials: %s\n",
  78                           nt_errstr(status)));
  79                 TALLOC_FREE(server_creds);
  80                 return NULL;
  81         }
  82
  83         return server_creds;
  84 }
  85
  86 _PUBLIC_ void cli_credentials_set_callback_data(struct cli_credentials *cred,
  87                                                 void *callback_data)
  88 {
  89         cred->priv_data = callback_data;
  90 }
  91
  92 _PUBLIC_ void *_cli_credentials_callback_data(struct cli_credentials *cred)
  93 {
  94         return cred->priv_data;
  95 }
  96
  97 /**
  98  * Create a new anonymous credential
  99  * @param mem_ctx TALLOC_CTX parent for credentials structure
 100  */
 101 _PUBLIC_ struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx)
 102 {
 103         struct cli_credentials *anon_credentials;
 104
 105         anon_credentials = cli_credentials_init(mem_ctx);
 106         cli_credentials_set_anonymous(anon_credentials);
 107
 108         return anon_credentials;
 109 }
 110
 111 _PUBLIC_ void cli_credentials_set_kerberos_state(struct cli_credentials *creds,
 112                                         enum credentials_use_kerberos use_kerberos)
 113 {
 114         creds->use_kerberos = use_kerberos;
 115 }
 116
 117 _PUBLIC_ void cli_credentials_set_forced_sasl_mech(struct cli_credentials *creds,
 118                                                    const char *sasl_mech)
 119 {
 120         TALLOC_FREE(creds->forced_sasl_mech);
 121         creds->forced_sasl_mech = talloc_strdup(creds, sasl_mech);
 122 }
 123
 124 _PUBLIC_ void cli_credentials_set_krb_forwardable(struct cli_credentials *creds,
 125                                                   enum credentials_krb_forwardable krb_forwardable)
 126 {
 127         creds->krb_forwardable = krb_forwardable;
 128 }
 129
 130 _PUBLIC_ enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
 131 {
 132         return creds->use_kerberos;
 133 }
 134
 135 _PUBLIC_ const char *cli_credentials_get_forced_sasl_mech(struct cli_credentials *creds)
 136 {
 137         return creds->forced_sasl_mech;
 138 }
 139
 140 _PUBLIC_ enum credentials_krb_forwardable cli_credentials_get_krb_forwardable(struct cli_credentials *creds)
 141 {
 142         return creds->krb_forwardable;
 143 }
 144
 145 _PUBLIC_ void cli_credentials_set_gensec_features(struct cli_credentials *creds, uint32_t gensec_features)
 146 {
 147         creds->gensec_features = gensec_features;
 148 }
 149
 150 _PUBLIC_ uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds)
 151 {
 152         return creds->gensec_features;
 153 }
 154
 155
 156 /**
 157  * Obtain the username for this credentials context.
 158  * @param cred credentials context
 159  * @retval The username set on this context.
 160  * @note Return value will never be NULL except by programmer error.
 161  */
 162 _PUBLIC_ const char *cli_credentials_get_username(struct cli_credentials *cred)
 163 {
 164         if (cred->machine_account_pending) {
 165                 cli_credentials_set_machine_account(cred,
 166                                         cred->machine_account_pending_lp_ctx);
 167         }
 168
 169         if (cred->username_obtained == CRED_CALLBACK &&
 170             !cred->callback_running) {
 171                 cred->callback_running = true;
 172                 cred->username = cred->username_cb(cred);
 173                 cred->callback_running = false;
 174                 if (cred->username_obtained == CRED_CALLBACK) {
 175                         cred->username_obtained = CRED_CALLBACK_RESULT;
 176                         cli_credentials_invalidate_ccache(cred, cred->username_obtained);
 177                 }
 178         }
 179
 180         return cred->username;
 181 }
 182
 183 _PUBLIC_ bool cli_credentials_set_username(struct cli_credentials *cred,
 184                                   const char *val, enum credentials_obtained obtained)
 185 {
 186         if (obtained >= cred->username_obtained) {
 187                 cred->username = talloc_strdup(cred, val);
 188                 cred->username_obtained = obtained;
 189                 cli_credentials_invalidate_ccache(cred, cred->username_obtained);
 190                 return true;
 191         }
 192
 193         return false;
 194 }
 195
 196 _PUBLIC_ bool cli_credentials_set_username_callback(struct cli_credentials *cred,
 197                                   const char *(*username_cb) (struct cli_credentials *))
 198 {
 199         if (cred->username_obtained < CRED_CALLBACK) {
 200                 cred->username_cb = username_cb;
 201                 cred->username_obtained = CRED_CALLBACK;
 202                 return true;
 203         }
 204
 205         return false;
 206 }
 207
 208 _PUBLIC_ bool cli_credentials_set_bind_dn(struct cli_credentials *cred,
 209                                  const char *bind_dn)
 210 {
 211         cred->bind_dn = talloc_strdup(cred, bind_dn);
 212         return true;
 213 }
 214
 215 /**
 216  * Obtain the BIND DN for this credentials context.
 217  * @param cred credentials context
 218  * @retval The username set on this context.
 219  * @note Return value will be NULL if not specified explictly
 220  */
 221 _PUBLIC_ const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
 222 {
 223         return cred->bind_dn;
 224 }
 225
 226
 227 /**
 228  * Obtain the client principal for this credentials context.
 229  * @param cred credentials context
 230  * @retval The username set on this context.
 231  * @note Return value will never be NULL except by programmer error.
 232  */
 233 _PUBLIC_ char *cli_credentials_get_principal_and_obtained(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, enum credentials_obtained *obtained)
 234 {
 235         if (cred->machine_account_pending) {
 236                 cli_credentials_set_machine_account(cred,
 237                                         cred->machine_account_pending_lp_ctx);
 238         }
 239
 240         if (cred->principal_obtained == CRED_CALLBACK &&
 241             !cred->callback_running) {
 242                 cred->callback_running = true;
 243                 cred->principal = cred->principal_cb(cred);
 244                 cred->callback_running = false;
 245                 if (cred->principal_obtained == CRED_CALLBACK) {
 246                         cred->principal_obtained = CRED_CALLBACK_RESULT;
 247                         cli_credentials_invalidate_ccache(cred, cred->principal_obtained);
 248                 }
 249         }
 250
 251         if (cred->principal_obtained < cred->username_obtained
 252             || cred->principal_obtained < MAX(cred->domain_obtained, cred->realm_obtained)) {
 253                 const char *effective_username = NULL;
 254                 const char *effective_realm = NULL;
 255                 enum credentials_obtained effective_obtained;
 256
 257                 effective_username = cli_credentials_get_username(cred);
 258                 if (effective_username == NULL || strlen(effective_username) == 0) {
 259                         *obtained = cred->username_obtained;
 260                         return NULL;
 261                 }
 262
 263                 if (cred->domain_obtained > cred->realm_obtained) {
 264                         effective_realm = cli_credentials_get_domain(cred);
 265                         effective_obtained = MIN(cred->domain_obtained,
 266                                                  cred->username_obtained);
 267                 } else {
 268                         effective_realm = cli_credentials_get_realm(cred);
 269                         effective_obtained = MIN(cred->realm_obtained,
 270                                                  cred->username_obtained);
 271                 }
 272
 273                 if (effective_realm == NULL || strlen(effective_realm) == 0) {
 274                         effective_realm = cli_credentials_get_domain(cred);
 275                         effective_obtained = MIN(cred->domain_obtained,
 276                                                  cred->username_obtained);
 277                 }
 278
 279                 if (effective_realm != NULL && strlen(effective_realm) != 0) {
 280                         *obtained = effective_obtained;
 281                         return talloc_asprintf(mem_ctx, "%s@%s",
 282                                                effective_username,
 283                                                effective_realm);
 284                 }
 285         }
 286         *obtained = cred->principal_obtained;
 287         return talloc_strdup(mem_ctx, cred->principal);
 288 }
 289
 290 /**
 291  * Obtain the client principal for this credentials context.
 292  * @param cred credentials context
 293  * @retval The username set on this context.
 294  * @note Return value will never be NULL except by programmer error.
 295  */
 296 _PUBLIC_ char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
 297 {
 298         enum credentials_obtained obtained;
 299         return cli_credentials_get_principal_and_obtained(cred, mem_ctx, &obtained);
 300 }
 301
 302 _PUBLIC_ bool cli_credentials_set_principal(struct cli_credentials *cred,
 303                                    const char *val,
 304                                    enum credentials_obtained obtained)
 305 {
 306         if (obtained >= cred->principal_obtained) {
 307                 cred->principal = talloc_strdup(cred, val);
 308                 if (cred->principal == NULL) {
 309                         return false;
 310                 }
 311                 cred->principal_obtained = obtained;
 312
 313                 cli_credentials_invalidate_ccache(cred, cred->principal_obtained);
 314                 return true;
 315         }
 316
 317         return false;
 318 }
 319
 320 /* Set a callback to get the principal.  This could be a popup dialog,
 321  * a terminal prompt or similar.  */
 322 _PUBLIC_ bool cli_credentials_set_principal_callback(struct cli_credentials *cred,
 323                                   const char *(*principal_cb) (struct cli_credentials *))
 324 {
 325         if (cred->principal_obtained < CRED_CALLBACK) {
 326                 cred->principal_cb = principal_cb;
 327                 cred->principal_obtained = CRED_CALLBACK;
 328                 return true;
 329         }
 330
 331         return false;
 332 }
 333
 334 /* Some of our tools are 'anonymous by default'.  This is a single
 335  * function to determine if authentication has been explicitly
 336  * requested */
 337
 338 _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *cred)
 339 {
 340         uint32_t gensec_features = 0;
 341
 342         if (cred->bind_dn) {
 343                 return true;
 344         }
 345
 346         /*
 347          * If we forced the mech we clearly want authentication. E.g. to use
 348          * SASL/EXTERNAL which has no credentials.
 349          */
 350         if (cred->forced_sasl_mech) {
 351                 return true;
 352         }
 353
 354         if (cli_credentials_is_anonymous(cred)){
 355                 return false;
 356         }
 357
 358         if (cred->principal_obtained >= CRED_SPECIFIED) {
 359                 return true;
 360         }
 361         if (cred->username_obtained >= CRED_SPECIFIED) {
 362                 return true;
 363         }
 364
 365         if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) {
 366                 return true;
 367         }
 368
 369         gensec_features = cli_credentials_get_gensec_features(cred);
 370         if (gensec_features & GENSEC_FEATURE_NTLM_CCACHE) {
 371                 return true;
 372         }
 373
 374         if (gensec_features & GENSEC_FEATURE_SIGN) {
 375                 return true;
 376         }
 377
 378         if (gensec_features & GENSEC_FEATURE_SEAL) {
 379                 return true;
 380         }
 381
 382         return false;
 383 }
 384
 385 /**
 386  * Obtain the password for this credentials context.
 387  * @param cred credentials context
 388  * @retval If set, the cleartext password, otherwise NULL
 389  */
 390 _PUBLIC_ const char *cli_credentials_get_password(struct cli_credentials *cred)
 391 {
 392         if (cred->machine_account_pending) {
 393                 cli_credentials_set_machine_account(cred,
 394                                                     cred->machine_account_pending_lp_ctx);
 395         }
 396
 397         if (cred->password_obtained == CRED_CALLBACK &&
 398             !cred->callback_running &&
 399             !cred->password_will_be_nt_hash) {
 400                 cred->callback_running = true;
 401                 cred->password = cred->password_cb(cred);
 402                 cred->callback_running = false;
 403                 if (cred->password_obtained == CRED_CALLBACK) {
 404                         cred->password_obtained = CRED_CALLBACK_RESULT;
 405                         cli_credentials_invalidate_ccache(cred, cred->password_obtained);
 406                 }
 407         }
 408
 409         return cred->password;
 410 }
 411
 412 /* Set a password on the credentials context, including an indication
 413  * of 'how' the password was obtained */
 414
 415 _PUBLIC_ bool cli_credentials_set_password(struct cli_credentials *cred,
 416                                   const char *val,
 417                                   enum credentials_obtained obtained)
 418 {
 419         if (obtained >= cred->password_obtained) {
 420
 421                 cred->lm_response = data_blob_null;
 422                 cred->nt_response = data_blob_null;
 423                 cred->nt_hash = NULL;
 424                 cred->password = NULL;
 425
 426                 cli_credentials_invalidate_ccache(cred, obtained);
 427
 428                 cred->password_tries = 0;
 429
 430                 if (val == NULL) {
 431                         cred->password_obtained = obtained;
 432                         return true;
 433                 }
 434
 435                 if (cred->password_will_be_nt_hash) {
 436                         struct samr_Password *nt_hash = NULL;
 437                         size_t val_len = strlen(val);
 438                         size_t converted;
 439
 440                         nt_hash = talloc(cred, struct samr_Password);
 441                         if (nt_hash == NULL) {
 442                                 return false;
 443                         }
 444
 445                         converted = strhex_to_str((char *)nt_hash->hash,
 446                                                   sizeof(nt_hash->hash),
 447                                                   val, val_len);
 448                         if (converted != sizeof(nt_hash->hash)) {
 449                                 TALLOC_FREE(nt_hash);
 450                                 return false;
 451                         }
 452
 453                         cred->nt_hash = nt_hash;
 454                         cred->password_obtained = obtained;
 455                         return true;
 456                 }
 457
 458                 cred->password = talloc_strdup(cred, val);
 459                 if (cred->password == NULL) {
 460                         return false;
 461                 }
 462
 463                 /* Don't print the actual password in talloc memory dumps */
 464                 talloc_set_name_const(cred->password,
 465                         "password set via cli_credentials_set_password");
 466                 cred->password_obtained = obtained;
 467
 468                 return true;
 469         }
 470
 471         return false;
 472 }
 473
 474 _PUBLIC_ bool cli_credentials_set_password_callback(struct cli_credentials *cred,
 475                                            const char *(*password_cb) (struct cli_credentials *))
 476 {
 477         if (cred->password_obtained < CRED_CALLBACK) {
 478                 cred->password_tries = 3;
 479                 cred->password_cb = password_cb;
 480                 cred->password_obtained = CRED_CALLBACK;
 481                 cli_credentials_invalidate_ccache(cred, cred->password_obtained);
 482                 return true;
 483         }
 484
 485         return false;
 486 }
 487
 488 /**
 489  * Obtain the 'old' password for this credentials context (used for join accounts).
 490  * @param cred credentials context
 491  * @retval If set, the cleartext password, otherwise NULL
 492  */
 493 _PUBLIC_ const char *cli_credentials_get_old_password(struct cli_credentials *cred)
 494 {
 495         if (cred->machine_account_pending) {
 496                 cli_credentials_set_machine_account(cred,
 497                                                     cred->machine_account_pending_lp_ctx);
 498         }
 499
 500         return cred->old_password;
 501 }
 502
 503 _PUBLIC_ bool cli_credentials_set_old_password(struct cli_credentials *cred,
 504                                       const char *val,
 505                                       enum credentials_obtained obtained)
 506 {
 507         cred->old_password = talloc_strdup(cred, val);
 508         if (cred->old_password) {
 509                 /* Don't print the actual password in talloc memory dumps */
 510                 talloc_set_name_const(cred->old_password, "password set via cli_credentials_set_old_password");
 511         }
 512         cred->old_nt_hash = NULL;
 513         return true;
 514 }
 515
 516 /**
 517  * Obtain the password, in the form MD4(unicode(password)) for this credentials context.
 518  *
 519  * Sometimes we only have this much of the password, while the rest of
 520  * the time this call avoids calling E_md4hash themselves.
 521  *
 522  * @param cred credentials context
 523  * @retval If set, the cleartext password, otherwise NULL
 524  */
 525 _PUBLIC_ struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred,
 526                                                            TALLOC_CTX *mem_ctx)
 527 {
 528         enum credentials_obtained password_obtained;
 529         enum credentials_obtained ccache_threshold;
 530         enum credentials_obtained client_gss_creds_threshold;
 531         bool password_is_nt_hash;
 532         const char *password = NULL;
 533         struct samr_Password *nt_hash = NULL;
 534
 535         if (cred->nt_hash != NULL) {
 536                 /*
 537                  * If we already have a hash it's easy.
 538                  */
 539                 goto return_hash;
 540         }
 541
 542         /*
 543          * This is a bit tricky, with password_will_be_nt_hash
 544          * we still need to get the value via the password_callback
 545          * but if we did that we should not remember it's state
 546          * in the long run so we need to undo it.
 547          */
 548
 549         password_obtained = cred->password_obtained;
 550         ccache_threshold = cred->ccache_threshold;
 551         client_gss_creds_threshold = cred->client_gss_creds_threshold;
 552         password_is_nt_hash = cred->password_will_be_nt_hash;
 553
 554         cred->password_will_be_nt_hash = false;
 555         password = cli_credentials_get_password(cred);
 556
 557         cred->password_will_be_nt_hash = password_is_nt_hash;
 558         if (password_is_nt_hash && password_obtained == CRED_CALLBACK) {
 559                 /*
 560                  * We got the nt_hash as string via the callback,
 561                  * so we need to undo the state change.
 562                  *
 563                  * And also don't remember it as plaintext password.
 564                  */
 565                 cred->client_gss_creds_threshold = client_gss_creds_threshold;
 566                 cred->ccache_threshold = ccache_threshold;
 567                 cred->password_obtained = password_obtained;
 568                 cred->password = NULL;
 569         }
 570
 571         if (password == NULL) {
 572                 return NULL;
 573         }
 574
 575         nt_hash = talloc(cred, struct samr_Password);
 576         if (nt_hash == NULL) {
 577                 return NULL;
 578         }
 579
 580         if (password_is_nt_hash) {
 581                 size_t password_len = strlen(password);
 582                 size_t converted;
 583
 584                 converted = strhex_to_str((char *)nt_hash->hash,
 585                                           sizeof(nt_hash->hash),
 586                                           password, password_len);
 587                 if (converted != sizeof(nt_hash->hash)) {
 588                         TALLOC_FREE(nt_hash);
 589                         return NULL;
 590                 }
 591         } else {
 592                 E_md4hash(password, nt_hash->hash);
 593         }
 594
 595         cred->nt_hash = nt_hash;
 596         nt_hash = NULL;
 597
 598 return_hash:
 599         nt_hash = talloc(mem_ctx, struct samr_Password);
 600         if (nt_hash == NULL) {
 601                 return NULL;
 602         }
 603
 604         *nt_hash = *cred->nt_hash;
 605
 606         return nt_hash;
 607 }
 608
 609 /**
 610  * Obtain the old password, in the form MD4(unicode(password)) for this credentials context.
 611  *
 612  * Sometimes we only have this much of the password, while the rest of
 613  * the time this call avoids calling E_md4hash themselves.
 614  *
 615  * @param cred credentials context
 616  * @retval If set, the cleartext password, otherwise NULL
 617  */
 618 _PUBLIC_ struct samr_Password *cli_credentials_get_old_nt_hash(struct cli_credentials *cred,
 619                                                                TALLOC_CTX *mem_ctx)
 620 {
 621         const char *old_password = NULL;
 622
 623         if (cred->old_nt_hash != NULL) {
 624                 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
 625                 if (!nt_hash) {
 626                         return NULL;
 627                 }
 628
 629                 *nt_hash = *cred->old_nt_hash;
 630
 631                 return nt_hash;
 632         }
 633
 634         old_password = cli_credentials_get_old_password(cred);
 635         if (old_password) {
 636                 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
 637                 if (!nt_hash) {
 638                         return NULL;
 639                 }
 640
 641                 E_md4hash(old_password, nt_hash->hash);
 642
 643                 return nt_hash;
 644         }
 645
 646         return NULL;
 647 }
 648
 649 /**
 650  * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
 651  * @param cred credentials context
 652  * @retval The domain set on this context.
 653  * @note Return value will never be NULL except by programmer error.
 654  */
 655 _PUBLIC_ const char *cli_credentials_get_domain(struct cli_credentials *cred)
 656 {
 657         if (cred->machine_account_pending) {
 658                 cli_credentials_set_machine_account(cred,
 659                                                     cred->machine_account_pending_lp_ctx);
 660         }
 661
 662         if (cred->domain_obtained == CRED_CALLBACK &&
 663             !cred->callback_running) {
 664                 cred->callback_running = true;
 665                 cred->domain = cred->domain_cb(cred);
 666                 cred->callback_running = false;
 667                 if (cred->domain_obtained == CRED_CALLBACK) {
 668                         cred->domain_obtained = CRED_CALLBACK_RESULT;
 669                         cli_credentials_invalidate_ccache(cred, cred->domain_obtained);
 670                 }
 671         }
 672
 673         return cred->domain;
 674 }
 675
 676
 677 _PUBLIC_ bool cli_credentials_set_domain(struct cli_credentials *cred,
 678                                 const char *val,
 679                                 enum credentials_obtained obtained)
 680 {
 681         if (obtained >= cred->domain_obtained) {
 682                 /* it is important that the domain be in upper case,
 683                  * particularly for the sensitive NTLMv2
 684                  * calculations */
 685                 cred->domain = strupper_talloc(cred, val);
 686                 cred->domain_obtained = obtained;
 687                 /* setting domain does not mean we have to invalidate ccache
 688                  * because domain in not used for Kerberos operations.
 689                  * If ccache invalidation is required, one will anyway specify
 690                  * a password to kinit, and that will force invalidation of the ccache
 691                  */
 692                 return true;
 693         }
 694
 695         return false;
 696 }
 697
 698 bool cli_credentials_set_domain_callback(struct cli_credentials *cred,
 699                                          const char *(*domain_cb) (struct cli_credentials *))
 700 {
 701         if (cred->domain_obtained < CRED_CALLBACK) {
 702                 cred->domain_cb = domain_cb;
 703                 cred->domain_obtained = CRED_CALLBACK;
 704                 return true;
 705         }
 706
 707         return false;
 708 }
 709
 710 /**
 711  * Obtain the Kerberos realm for this credentials context.
 712  * @param cred credentials context
 713  * @retval The realm set on this context.
 714  * @note Return value will never be NULL except by programmer error.
 715  */
 716 _PUBLIC_ const char *cli_credentials_get_realm(struct cli_credentials *cred)
 717 {
 718         if (cred->machine_account_pending) {
 719                 cli_credentials_set_machine_account(cred,
 720                                                     cred->machine_account_pending_lp_ctx);
 721         }
 722
 723         if (cred->realm_obtained == CRED_CALLBACK &&
 724             !cred->callback_running) {
 725                 cred->callback_running = true;
 726                 cred->realm = cred->realm_cb(cred);
 727                 cred->callback_running = false;
 728                 if (cred->realm_obtained == CRED_CALLBACK) {
 729                         cred->realm_obtained = CRED_CALLBACK_RESULT;
 730                         cli_credentials_invalidate_ccache(cred, cred->realm_obtained);
 731                 }
 732         }
 733
 734         return cred->realm;
 735 }
 736
 737 /**
 738  * Set the realm for this credentials context, and force it to
 739  * uppercase for the sanity of our local kerberos libraries
 740  */
 741 _PUBLIC_ bool cli_credentials_set_realm(struct cli_credentials *cred,
 742                                const char *val,
 743                                enum credentials_obtained obtained)
 744 {
 745         if (obtained >= cred->realm_obtained) {
 746                 cred->realm = strupper_talloc(cred, val);
 747                 cred->realm_obtained = obtained;
 748                 cli_credentials_invalidate_ccache(cred, cred->realm_obtained);
 749                 return true;
 750         }
 751
 752         return false;
 753 }
 754
 755 bool cli_credentials_set_realm_callback(struct cli_credentials *cred,
 756                                         const char *(*realm_cb) (struct cli_credentials *))
 757 {
 758         if (cred->realm_obtained < CRED_CALLBACK) {
 759                 cred->realm_cb = realm_cb;
 760                 cred->realm_obtained = CRED_CALLBACK;
 761                 return true;
 762         }
 763
 764         return false;
 765 }
 766
 767 /**
 768  * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
 769  *
 770  * @param cred credentials context
 771  * @retval The workstation name set on this context.
 772  * @note Return value will never be NULL except by programmer error.
 773  */
 774 _PUBLIC_ const char *cli_credentials_get_workstation(struct cli_credentials *cred)
 775 {
 776         if (cred->workstation_obtained == CRED_CALLBACK &&
 777             !cred->callback_running) {
 778                 cred->callback_running = true;
 779                 cred->workstation = cred->workstation_cb(cred);
 780                 cred->callback_running = false;
 781                 if (cred->workstation_obtained == CRED_CALLBACK) {
 782                         cred->workstation_obtained = CRED_CALLBACK_RESULT;
 783                 }
 784         }
 785
 786         return cred->workstation;
 787 }
 788
 789 _PUBLIC_ bool cli_credentials_set_workstation(struct cli_credentials *cred,
 790                                      const char *val,
 791                                      enum credentials_obtained obtained)
 792 {
 793         if (obtained >= cred->workstation_obtained) {
 794                 cred->workstation = talloc_strdup(cred, val);
 795                 cred->workstation_obtained = obtained;
 796                 return true;
 797         }
 798
 799         return false;
 800 }
 801
 802 bool cli_credentials_set_workstation_callback(struct cli_credentials *cred,
 803                                               const char *(*workstation_cb) (struct cli_credentials *))
 804 {
 805         if (cred->workstation_obtained < CRED_CALLBACK) {
 806                 cred->workstation_cb = workstation_cb;
 807                 cred->workstation_obtained = CRED_CALLBACK;
 808                 return true;
 809         }
 810
 811         return false;
 812 }
 813
 814 /**
 815  * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
 816  *
 817  * The format accepted is [domain\\]user[%password] or user[@realm][%password]
 818  *
 819  * @param credentials Credentials structure on which to set the password
 820  * @param data the string containing the username, password etc
 821  * @param obtained This enum describes how 'specified' this password is
 822  */
 823
 824 _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained)
 825 {
 826         char *uname, *p;
 827
 828         if (strcmp("%",data) == 0) {
 829                 cli_credentials_set_anonymous(credentials);
 830                 return;
 831         }
 832
 833         uname = talloc_strdup(credentials, data);
 834         if ((p = strchr_m(uname,'%'))) {
 835                 *p = 0;
 836                 cli_credentials_set_password(credentials, p+1, obtained);
 837         }
 838
 839         if ((p = strchr_m(uname,'@'))) {
 840                 /*
 841                  * We also need to set username and domain
 842                  * in order to undo the effect of
 843                  * cli_credentials_guess().
 844                  */
 845                 cli_credentials_set_username(credentials, uname, obtained);
 846                 cli_credentials_set_domain(credentials, "", obtained);
 847
 848                 cli_credentials_set_principal(credentials, uname, obtained);
 849                 *p = 0;
 850                 cli_credentials_set_realm(credentials, p+1, obtained);
 851                 return;
 852         } else if ((p = strchr_m(uname,'\\'))
 853                    || (p = strchr_m(uname, '/'))
 854                    || (p = strchr_m(uname, credentials->winbind_separator)))
 855         {
 856                 const char *domain = NULL;
 857
 858                 domain = uname;
 859                 *p = 0;
 860                 uname = p+1;
 861
 862                 if (obtained == credentials->realm_obtained &&
 863                     !strequal_m(credentials->domain, domain))
 864                 {
 865                         /*
 866                          * We need to undo a former set with the same level
 867                          * in order to get the expected result from
 868                          * cli_credentials_get_principal().
 869                          *
 870                          * But we only need to do that if the domain
 871                          * actually changes.
 872                          */
 873                         cli_credentials_set_realm(credentials, domain, obtained);
 874                 }
 875                 cli_credentials_set_domain(credentials, domain, obtained);
 876         }
 877         if (obtained == credentials->principal_obtained &&
 878             !strequal_m(credentials->username, uname))
 879         {
 880                 /*
 881                  * We need to undo a former set with the same level
 882                  * in order to get the expected result from
 883                  * cli_credentials_get_principal().
 884                  *
 885                  * But we only need to do that if the username
 886                  * actually changes.
 887                  */
 888                 credentials->principal_obtained = CRED_UNINITIALISED;
 889                 credentials->principal = NULL;
 890         }
 891         cli_credentials_set_username(credentials, uname, obtained);
 892 }
 893
 894 /**
 895  * Given a a credentials structure, print it as a string
 896  *
 897  * The format output is [domain\\]user[%password] or user[@realm][%password]
 898  *
 899  * @param credentials Credentials structure on which to set the password
 900  * @param mem_ctx The memory context to place the result on
 901  */
 902
 903 _PUBLIC_ char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
 904 {
 905         const char *bind_dn = cli_credentials_get_bind_dn(credentials);
 906         const char *domain = NULL;
 907         const char *username = NULL;
 908         char *name = NULL;
 909
 910         if (bind_dn) {
 911                 name = talloc_strdup(mem_ctx, bind_dn);
 912         } else {
 913                 cli_credentials_get_ntlm_username_domain(credentials, mem_ctx, &username, &domain);
 914                 if (domain && domain[0]) {
 915                         name = talloc_asprintf(mem_ctx, "%s\\%s",
 916                                                domain, username);
 917                 } else {
 918                         name = talloc_asprintf(mem_ctx, "%s",
 919                                                username);
 920                 }
 921         }
 922         return name;
 923 }
 924
 925 /**
 926  * Specifies default values for domain, workstation and realm
 927  * from the smb.conf configuration file
 928  *
 929  * @param cred Credentials structure to fill in
 930  */
 931 _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
 932                               struct loadparm_context *lp_ctx)
 933 {
 934         const char *sep = NULL;
 935         const char *realm = lpcfg_realm(lp_ctx);
 936
 937         cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
 938         if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) {
 939                 cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED);
 940         } else {
 941                 cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SMB_CONF);
 942         }
 943         if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) {
 944                 cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED);
 945         } else {
 946                 cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SMB_CONF);
 947         }
 948         if (realm != NULL && strlen(realm) == 0) {
 949                 realm = NULL;
 950         }
 951         if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) {
 952                 cli_credentials_set_realm(cred, realm, CRED_SPECIFIED);
 953         } else {
 954                 cli_credentials_set_realm(cred, realm, CRED_SMB_CONF);
 955         }
 956
 957         sep = lpcfg_winbind_separator(lp_ctx);
 958         if (sep != NULL && sep[0] != '\0') {
 959                 cred->winbind_separator = *lpcfg_winbind_separator(lp_ctx);
 960         }
 961
 962         if (cred->signing_state_obtained <= CRED_SMB_CONF) {
 963                 /* Will be set to default for invalid smb.conf values */
 964                 cred->signing_state = lpcfg_client_signing(lp_ctx);
 965                 cred->signing_state_obtained = CRED_SMB_CONF;
 966         }
 967
 968         if (cred->ipc_signing_state_obtained <= CRED_SMB_CONF) {
 969                 /* Will be set to required for invalid smb.conf values */
 970                 cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx);
 971                 cred->ipc_signing_state_obtained = CRED_SMB_CONF;
 972         }
 973
 974         if (cred->encryption_state_obtained <= CRED_SMB_CONF) {
 975                 /* Will be set to default for invalid smb.conf values */
 976                 cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx);
 977                 cred->encryption_state_obtained = CRED_SMB_CONF;
 978         }
 979 }
 980
 981 /**
 982  * Guess defaults for credentials from environment variables,
 983  * and from the configuration file
 984  *
 985  * @param cred Credentials structure to fill in
 986  */
 987 _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred,
 988                            struct loadparm_context *lp_ctx)
 989 {
 990         char *p;
 991         const char *error_string;
 992
 993         if (lp_ctx != NULL) {
 994                 cli_credentials_set_conf(cred, lp_ctx);
 995         }
 996
 997         if (getenv("LOGNAME")) {
 998                 cli_credentials_set_username(cred, getenv("LOGNAME"), CRED_GUESS_ENV);
 999         }
1000
1001         if (getenv("USER")) {
1002                 cli_credentials_parse_string(cred, getenv("USER"), CRED_GUESS_ENV);
1003                 if ((p = strchr_m(getenv("USER"),'%'))) {
1004                         memset(p,0,strlen(cred->password));
1005                 }
1006         }
1007
1008         if (getenv("PASSWD")) {
1009                 cli_credentials_set_password(cred, getenv("PASSWD"), CRED_GUESS_ENV);
1010         }
1011
1012         if (getenv("PASSWD_FD")) {
1013                 cli_credentials_parse_password_fd(cred, atoi(getenv("PASSWD_FD")),
1014                                                   CRED_GUESS_FILE);
1015         }
1016
1017         p = getenv("PASSWD_FILE");
1018         if (p && p[0]) {
1019                 cli_credentials_parse_password_file(cred, p, CRED_GUESS_FILE);
1020         }
1021
1022         if (lp_ctx != NULL &&
1023             cli_credentials_get_kerberos_state(cred) != CRED_USE_KERBEROS_DISABLED) {
1024                 cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE,
1025                                            &error_string);
1026         }
1027 }
1028
1029 /**
1030  * Attach NETLOGON credentials for use with SCHANNEL
1031  */
1032
1033 _PUBLIC_ void cli_credentials_set_netlogon_creds(
1034         struct cli_credentials *cred,
1035         const struct netlogon_creds_CredentialState *netlogon_creds)
1036 {
1037         TALLOC_FREE(cred->netlogon_creds);
1038         if (netlogon_creds == NULL) {
1039                 return;
1040         }
1041         cred->netlogon_creds = netlogon_creds_copy(cred, netlogon_creds);
1042 }
1043
1044 /**
1045  * Return attached NETLOGON credentials
1046  */
1047
1048 _PUBLIC_ struct netlogon_creds_CredentialState *cli_credentials_get_netlogon_creds(struct cli_credentials *cred)
1049 {
1050         return cred->netlogon_creds;
1051 }
1052
1053 /**
1054  * Set NETLOGON secure channel type
1055  */
1056
1057 _PUBLIC_ void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
1058                                              enum netr_SchannelType secure_channel_type)
1059 {
1060         cred->secure_channel_type = secure_channel_type;
1061 }
1062
1063 /**
1064  * Return NETLOGON secure chanel type
1065  */
1066
1067 _PUBLIC_ time_t cli_credentials_get_password_last_changed_time(struct cli_credentials *cred)
1068 {
1069         return cred->password_last_changed_time;
1070 }
1071
1072 /**
1073  * Set NETLOGON secure channel type
1074  */
1075
1076 _PUBLIC_ void cli_credentials_set_password_last_changed_time(struct cli_credentials *cred,
1077                                                              time_t last_changed_time)
1078 {
1079         cred->password_last_changed_time = last_changed_time;
1080 }
1081
1082 /**
1083  * Return NETLOGON secure chanel type
1084  */
1085
1086 _PUBLIC_ enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred)
1087 {
1088         return cred->secure_channel_type;
1089 }
1090
1091 /**
1092  * Fill in a credentials structure as the anonymous user
1093  */
1094 _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred)
1095 {
1096         cli_credentials_set_username(cred, "", CRED_SPECIFIED);
1097         cli_credentials_set_domain(cred, "", CRED_SPECIFIED);
1098         cli_credentials_set_password(cred, NULL, CRED_SPECIFIED);
1099         cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED);
1100         cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED);
1101         cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED);
1102         cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_DISABLED);
1103 }
1104
1105 /**
1106  * Describe a credentials context as anonymous or authenticated
1107  * @retval true if anonymous, false if a username is specified
1108  */
1109
1110 _PUBLIC_ bool cli_credentials_is_anonymous(struct cli_credentials *cred)
1111 {
1112         const char *username;
1113
1114         /* if bind dn is set it's not anonymous */
1115         if (cred->bind_dn) {
1116                 return false;
1117         }
1118
1119         if (cred->machine_account_pending) {
1120                 cli_credentials_set_machine_account(cred,
1121                                                     cred->machine_account_pending_lp_ctx);
1122         }
1123
1124         /* if principal is set, it's not anonymous */
1125         if ((cred->principal != NULL) && cred->principal_obtained >= cred->username_obtained) {
1126                 return false;
1127         }
1128
1129         username = cli_credentials_get_username(cred);
1130
1131         /* Yes, it is deliberate that we die if we have a NULL pointer
1132          * here - anonymous is "", not NULL, which is 'never specified,
1133          * never guessed', ie programmer bug */
1134         if (!username[0]) {
1135                 return true;
1136         }
1137
1138         return false;
1139 }
1140
1141 /**
1142  * Mark the current password for a credentials struct as wrong. This will
1143  * cause the password to be prompted again (if a callback is set).
1144  *
1145  * This will decrement the number of times the password can be tried.
1146  *
1147  * @retval whether the credentials struct is finished
1148  */
1149 _PUBLIC_ bool cli_credentials_wrong_password(struct cli_credentials *cred)
1150 {
1151         if (cred->password_obtained != CRED_CALLBACK_RESULT) {
1152                 return false;
1153         }
1154
1155         if (cred->password_tries == 0) {
1156                 return false;
1157         }
1158
1159         cred->password_tries--;
1160
1161         if (cred->password_tries == 0) {
1162                 return false;
1163         }
1164
1165         cred->password_obtained = CRED_CALLBACK;
1166         return true;
1167 }
1168
1169 _PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
1170                                               const char **username,
1171                                               const char **domain)
1172 {
1173         if (cred->principal_obtained >= cred->username_obtained) {
1174                 *domain = talloc_strdup(mem_ctx, "");
1175                 *username = cli_credentials_get_principal(cred, mem_ctx);
1176         } else {
1177                 *domain = cli_credentials_get_domain(cred);
1178                 *username = cli_credentials_get_username(cred);
1179         }
1180 }
1181
1182 /**
1183  * Read a named file, and parse it for username, domain, realm and password
1184  *
1185  * @param credentials Credentials structure on which to set the password
1186  * @param file a named file to read the details from
1187  * @param obtained This enum describes how 'specified' this password is
1188  */
1189
1190 _PUBLIC_ bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained)
1191 {
1192         uint16_t len = 0;
1193         char *ptr, *val, *param;
1194         char **lines;
1195         int i, numlines;
1196         const char *realm = NULL;
1197         const char *domain = NULL;
1198         const char *password = NULL;
1199         const char *username = NULL;
1200
1201         lines = file_lines_load(file, &numlines, 0, NULL);
1202
1203         if (lines == NULL)
1204         {
1205                 /* fail if we can't open the credentials file */
1206                 d_printf("ERROR: Unable to open credentials file!\n");
1207                 return false;
1208         }
1209
1210         for (i = 0; i < numlines; i++) {
1211                 len = strlen(lines[i]);
1212
1213                 if (len == 0)
1214                         continue;
1215
1216                 /* break up the line into parameter & value.
1217                  * will need to eat a little whitespace possibly */
1218                 param = lines[i];
1219                 if (!(ptr = strchr_m (lines[i], '=')))
1220                         continue;
1221
1222                 val = ptr+1;
1223                 *ptr = '\0';
1224
1225                 /* eat leading white space */
1226                 while ((*val!='\0') && ((*val==' ') || (*val=='\t')))
1227                         val++;
1228
1229                 if (strwicmp("password", param) == 0) {
1230                         password = val;
1231                 } else if (strwicmp("username", param) == 0) {
1232                         username = val;
1233                 } else if (strwicmp("domain", param) == 0) {
1234                         domain = val;
1235                 } else if (strwicmp("realm", param) == 0) {
1236                         realm = val;
1237                 }
1238
1239                 /*
1240                  * We need to readd '=' in order to let
1241                  * the strlen() work in the last loop
1242                  * that clears the memory.
1243                  */
1244                 *ptr = '=';
1245         }
1246
1247         if (realm != NULL && strlen(realm) != 0) {
1248                 /*
1249                  * only overwrite with a valid string
1250                  */
1251                 cli_credentials_set_realm(cred, realm, obtained);
1252         }
1253
1254         if (domain != NULL && strlen(domain) != 0) {
1255                 /*
1256                  * only overwrite with a valid string
1257                  */
1258                 cli_credentials_set_domain(cred, domain, obtained);
1259         }
1260
1261         if (password != NULL) {
1262                 /*
1263                  * Here we allow "".
1264                  */
1265                 cli_credentials_set_password(cred, password, obtained);
1266         }
1267
1268         if (username != NULL) {
1269                 /*
1270                  * The last "username" line takes preference
1271                  * if the string also contains domain, realm or
1272                  * password.
1273                  */
1274                 cli_credentials_parse_string(cred, username, obtained);
1275         }
1276
1277         for (i = 0; i < numlines; i++) {
1278                 len = strlen(lines[i]);
1279                 memset(lines[i], 0, len);
1280         }
1281         talloc_free(lines);
1282
1283         return true;
1284 }
1285
1286 /**
1287  * Read a named file, and parse it for a password
1288  *
1289  * @param credentials Credentials structure on which to set the password
1290  * @param file a named file to read the password from
1291  * @param obtained This enum describes how 'specified' this password is
1292  */
1293
1294 _PUBLIC_ bool cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained)
1295 {
1296         int fd = open(file, O_RDONLY, 0);
1297         bool ret;
1298
1299         if (fd < 0) {
1300                 fprintf(stderr, "Error opening password file %s: %s\n",
1301                                 file, strerror(errno));
1302                 return false;
1303         }
1304
1305         ret = cli_credentials_parse_password_fd(credentials, fd, obtained);
1306
1307         close(fd);
1308
1309         return ret;
1310 }
1311
1312
1313 /**
1314  * Read a file descriptor, and parse it for a password (eg from a file or stdin)
1315  *
1316  * @param credentials Credentials structure on which to set the password
1317  * @param fd open file descriptor to read the password from
1318  * @param obtained This enum describes how 'specified' this password is
1319  */
1320
1321 _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
1322                                        int fd, enum credentials_obtained obtained)
1323 {
1324         char *p;
1325         char pass[128];
1326
1327         for(p = pass, *p = '\0'; /* ensure that pass is null-terminated */
1328                 p && p - pass < sizeof(pass);) {
1329                 switch (read(fd, p, 1)) {
1330                 case 1:
1331                         if (*p != '\n' && *p != '\0') {
1332                                 *++p = '\0'; /* advance p, and null-terminate pass */
1333                                 break;
1334                         }
1335
1336                         FALL_THROUGH;
1337                 case 0:
1338                         if (p - pass) {
1339                                 *p = '\0'; /* null-terminate it, just in case... */
1340                                 p = NULL; /* then force the loop condition to become false */
1341                                 break;
1342                         }
1343
1344                         fprintf(stderr,
1345                                 "Error reading password from file descriptor "
1346                                 "%d: empty password\n",
1347                                 fd);
1348                         return false;
1349
1350                 default:
1351                         fprintf(stderr, "Error reading password from file descriptor %d: %s\n",
1352                                         fd, strerror(errno));
1353                         return false;
1354                 }
1355         }
1356
1357         cli_credentials_set_password(credentials, pass, obtained);
1358         return true;
1359 }
1360
1361 /**
1362  * @brief Set the SMB signing state to request for a SMB connection.
1363  *
1364  * @param[in]  creds          The credentials structure to update.
1365  *
1366  * @param[in]  signing_state  The signing state to set.
1367  *
1368  * @param obtained            This way the described signing state was specified.
1369  *
1370  * @return true if we could set the signing state, false otherwise.
1371  */
1372 _PUBLIC_ bool cli_credentials_set_smb_signing(struct cli_credentials *creds,
1373                                               enum smb_signing_setting signing_state,
1374                                               enum credentials_obtained obtained)
1375 {
1376         if (obtained >= creds->signing_state_obtained) {
1377                 creds->signing_state_obtained = obtained;
1378                 creds->signing_state = signing_state;
1379                 return true;
1380         }
1381
1382         return false;
1383 }
1384
1385 /**
1386  * @brief Obtain the SMB signing state from a credentials structure.
1387  *
1388  * @param[in]  creds  The credential structure to obtain the SMB signing state
1389  *                    from.
1390  *
1391  * @return The SMB singing state.
1392  */
1393 _PUBLIC_ enum smb_signing_setting
1394 cli_credentials_get_smb_signing(struct cli_credentials *creds)
1395 {
1396         return creds->signing_state;
1397 }
1398
1399 /**
1400  * @brief Set the SMB IPC signing state to request for a SMB connection.
1401  *
1402  * @param[in]  creds          The credentials structure to update.
1403  *
1404  * @param[in]  signing_state  The signing state to set.
1405  *
1406  * @param obtained            This way the described signing state was specified.
1407  *
1408  * @return true if we could set the signing state, false otherwise.
1409  */
1410 _PUBLIC_ bool
1411 cli_credentials_set_smb_ipc_signing(struct cli_credentials *creds,
1412                                     enum smb_signing_setting ipc_signing_state,
1413                                     enum credentials_obtained obtained)
1414 {
1415         if (obtained >= creds->ipc_signing_state_obtained) {
1416                 creds->ipc_signing_state_obtained = obtained;
1417                 creds->ipc_signing_state = ipc_signing_state;
1418                 return true;
1419         }
1420
1421         return false;
1422 }
1423
1424 /**
1425  * @brief Obtain the SMB IPC signing state from a credentials structure.
1426  *
1427  * @param[in]  creds  The credential structure to obtain the SMB IPC signing
1428  *                    state from.
1429  *
1430  * @return The SMB singing state.
1431  */
1432 _PUBLIC_ enum smb_signing_setting
1433 cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds)
1434 {
1435         return creds->ipc_signing_state;
1436 }
1437
1438 /**
1439  * @brief Set the SMB encryption state to request for a SMB connection.
1440  *
1441  * @param[in]  creds  The credentials structure to update.
1442  *
1443  * @param[in]  encryption_state  The encryption state to set.
1444  *
1445  * @param obtained  This way the described encryption state was specified.
1446  *
1447  * @return true if we could set the encryption state, false otherwise.
1448  */
1449 _PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds,
1450                                                  enum smb_encryption_setting encryption_state,
1451                                                  enum credentials_obtained obtained)
1452 {
1453         if (obtained >= creds->encryption_state_obtained) {
1454                 creds->encryption_state_obtained = obtained;
1455                 creds->encryption_state = encryption_state;
1456                 return true;
1457         }
1458
1459         return false;
1460 }
1461
1462 /**
1463  * @brief Obtain the SMB encryption state from a credentials structure.
1464  *
1465  * @param[in]  creds  The credential structure to obtain the SMB encryption state
1466  *                    from.
1467  *
1468  * @return The SMB singing state.
1469  */
1470 _PUBLIC_ enum smb_encryption_setting
1471 cli_credentials_get_smb_encryption(struct cli_credentials *creds)
1472 {
1473         return creds->encryption_state;
1474 }
1475
1476 /**
1477  * Encrypt a data blob using the session key and the negotiated encryption
1478  * algorithm
1479  *
1480  * @param state Credential state, contains the session key and algorithm
1481  * @param data Data blob containing the data to be encrypted.
1482  *
1483  */
1484 _PUBLIC_ NTSTATUS netlogon_creds_session_encrypt(
1485         struct netlogon_creds_CredentialState *state,
1486         DATA_BLOB data)
1487 {
1488         NTSTATUS status;
1489
1490         if (data.data == NULL || data.length == 0) {
1491                 DBG_ERR("Nothing to encrypt "
1492                         "data.data == NULL or data.length == 0");
1493                 return NT_STATUS_INVALID_PARAMETER;
1494         }
1495         /*
1496          * Don't crypt an all-zero password it will give away the
1497          * NETLOGON pipe session key .
1498          */
1499         if (all_zero(data.data, data.length)) {
1500                 DBG_ERR("Supplied data all zeros, could leak session key");
1501                 return NT_STATUS_INVALID_PARAMETER;
1502         }
1503         if (state->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
1504                 status = netlogon_creds_aes_encrypt(state,
1505                                                     data.data,
1506                                                     data.length);
1507         } else if (state->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
1508                 status = netlogon_creds_arcfour_crypt(state,
1509                                                       data.data,
1510                                                       data.length);
1511         } else {
1512                 DBG_ERR("Unsupported encryption option negotiated");
1513                 status = NT_STATUS_NOT_SUPPORTED;
1514         }
1515         if (!NT_STATUS_IS_OK(status)) {
1516                 return status;
1517         }
1518         return NT_STATUS_OK;
1519 }
1520