source4/auth/credentials/credentials.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    User credentials handling
   5
   6    Copyright (C) Jelmer Vernooij 2005
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
  26 #include "auth/credentials/credentials.h"
  27 #include "auth/credentials/credentials_krb5.h"
  28 #include "libcli/auth/libcli_auth.h"
  29 #include "lib/events/events.h"
  30 #include "param/param.h"
  31
  32 /**
  33  * Create a new credentials structure
  34  * @param mem_ctx TALLOC_CTX parent for credentials structure
  35  */
  36 _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
  37 {
  38         struct cli_credentials *cred = talloc(mem_ctx, struct cli_credentials);
  39         if (!cred) {
  40                 return cred;
  41         }
  42
  43         cred->netlogon_creds = NULL;
  44         cred->machine_account_pending = false;
  45         cred->workstation_obtained = CRED_UNINITIALISED;
  46         cred->username_obtained = CRED_UNINITIALISED;
  47         cred->password_obtained = CRED_UNINITIALISED;
  48         cred->domain_obtained = CRED_UNINITIALISED;
  49         cred->realm_obtained = CRED_UNINITIALISED;
  50         cred->ccache_obtained = CRED_UNINITIALISED;
  51         cred->client_gss_creds_obtained = CRED_UNINITIALISED;
  52         cred->server_gss_creds_obtained = CRED_UNINITIALISED;
  53         cred->keytab_obtained = CRED_UNINITIALISED;
  54         cred->principal_obtained = CRED_UNINITIALISED;
  55
  56         cred->ccache_threshold = CRED_UNINITIALISED;
  57         cred->client_gss_creds_threshold = CRED_UNINITIALISED;
  58
  59         cred->old_password = NULL;
  60         cred->smb_krb5_context = NULL;
  61         cred->salt_principal = NULL;
  62         cred->machine_account = false;
  63
  64         cred->bind_dn = NULL;
  65
  66         cred->tries = 3;
  67         cred->callback_running = false;
  68
  69         cli_credentials_set_kerberos_state(cred, CRED_AUTO_USE_KERBEROS);
  70         cli_credentials_set_gensec_features(cred, 0);
  71
  72         return cred;
  73 }
  74
  75 /**
  76  * Create a new anonymous credential
  77  * @param mem_ctx TALLOC_CTX parent for credentials structure
  78  */
  79 _PUBLIC_ struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx)
  80 {
  81         struct cli_credentials *anon_credentials;
  82
  83         anon_credentials = cli_credentials_init(mem_ctx);
  84         cli_credentials_set_anonymous(anon_credentials);
  85
  86         return anon_credentials;
  87 }
  88
  89 _PUBLIC_ void cli_credentials_set_kerberos_state(struct cli_credentials *creds,
  90                                         enum credentials_use_kerberos use_kerberos)
  91 {
  92         creds->use_kerberos = use_kerberos;
  93 }
  94
  95 _PUBLIC_ enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
  96 {
  97         return creds->use_kerberos;
  98 }
  99
 100 _PUBLIC_ void cli_credentials_set_gensec_features(struct cli_credentials *creds, uint32_t gensec_features)
 101 {
 102         creds->gensec_features = gensec_features;
 103 }
 104
 105 _PUBLIC_ uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds)
 106 {
 107         return creds->gensec_features;
 108 }
 109
 110
 111 /**
 112  * Obtain the username for this credentials context.
 113  * @param cred credentials context
 114  * @retval The username set on this context.
 115  * @note Return value will never be NULL except by programmer error.
 116  */
 117 _PUBLIC_ const char *cli_credentials_get_username(struct cli_credentials *cred)
 118 {
 119         if (cred->machine_account_pending) {
 120                 cli_credentials_set_machine_account(cred,
 121                                         cred->machine_account_pending_lp_ctx);
 122         }
 123
 124         if (cred->username_obtained == CRED_CALLBACK &&
 125             !cred->callback_running) {
 126                 cred->callback_running = true;
 127                 cred->username = cred->username_cb(cred);
 128                 cred->callback_running = false;
 129                 cred->username_obtained = CRED_SPECIFIED;
 130                 cli_credentials_invalidate_ccache(cred, cred->username_obtained);
 131         }
 132
 133         return cred->username;
 134 }
 135
 136 _PUBLIC_ bool cli_credentials_set_username(struct cli_credentials *cred,
 137                                   const char *val, enum credentials_obtained obtained)
 138 {
 139         if (obtained >= cred->username_obtained) {
 140                 cred->username = talloc_strdup(cred, val);
 141                 cred->username_obtained = obtained;
 142                 cli_credentials_invalidate_ccache(cred, cred->username_obtained);
 143                 return true;
 144         }
 145
 146         return false;
 147 }
 148
 149 bool cli_credentials_set_username_callback(struct cli_credentials *cred,
 150                                   const char *(*username_cb) (struct cli_credentials *))
 151 {
 152         if (cred->username_obtained < CRED_CALLBACK) {
 153                 cred->username_cb = username_cb;
 154                 cred->username_obtained = CRED_CALLBACK;
 155                 return true;
 156         }
 157
 158         return false;
 159 }
 160
 161 _PUBLIC_ bool cli_credentials_set_bind_dn(struct cli_credentials *cred,
 162                                  const char *bind_dn)
 163 {
 164         cred->bind_dn = talloc_strdup(cred, bind_dn);
 165         return true;
 166 }
 167
 168 /**
 169  * Obtain the BIND DN for this credentials context.
 170  * @param cred credentials context
 171  * @retval The username set on this context.
 172  * @note Return value will be NULL if not specified explictly
 173  */
 174 _PUBLIC_ const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
 175 {
 176         return cred->bind_dn;
 177 }
 178
 179
 180 /**
 181  * Obtain the client principal for this credentials context.
 182  * @param cred credentials context
 183  * @retval The username set on this context.
 184  * @note Return value will never be NULL except by programmer error.
 185  */
 186 _PUBLIC_ const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
 187 {
 188         if (cred->machine_account_pending) {
 189                 cli_credentials_set_machine_account(cred,
 190                                         cred->machine_account_pending_lp_ctx);
 191         }
 192
 193         if (cred->principal_obtained == CRED_CALLBACK &&
 194             !cred->callback_running) {
 195                 cred->callback_running = true;
 196                 cred->principal = cred->principal_cb(cred);
 197                 cred->callback_running = false;
 198                 cred->principal_obtained = CRED_SPECIFIED;
 199                 cli_credentials_invalidate_ccache(cred, cred->principal_obtained);
 200         }
 201
 202         if (cred->principal_obtained < cred->username_obtained) {
 203                 if (cred->domain_obtained > cred->realm_obtained) {
 204                         return talloc_asprintf(mem_ctx, "%s@%s",
 205                                                cli_credentials_get_username(cred),
 206                                                cli_credentials_get_domain(cred));
 207                 } else {
 208                         return talloc_asprintf(mem_ctx, "%s@%s",
 209                                                cli_credentials_get_username(cred),
 210                                                cli_credentials_get_realm(cred));
 211                 }
 212         }
 213         return talloc_reference(mem_ctx, cred->principal);
 214 }
 215
 216 bool cli_credentials_set_principal(struct cli_credentials *cred,
 217                                    const char *val,
 218                                    enum credentials_obtained obtained)
 219 {
 220         if (obtained >= cred->principal_obtained) {
 221                 cred->principal = talloc_strdup(cred, val);
 222                 cred->principal_obtained = obtained;
 223                 cli_credentials_invalidate_ccache(cred, cred->principal_obtained);
 224                 return true;
 225         }
 226
 227         return false;
 228 }
 229
 230 /* Set a callback to get the principal.  This could be a popup dialog,
 231  * a terminal prompt or similar.  */
 232 bool cli_credentials_set_principal_callback(struct cli_credentials *cred,
 233                                   const char *(*principal_cb) (struct cli_credentials *))
 234 {
 235         if (cred->principal_obtained < CRED_CALLBACK) {
 236                 cred->principal_cb = principal_cb;
 237                 cred->principal_obtained = CRED_CALLBACK;
 238                 return true;
 239         }
 240
 241         return false;
 242 }
 243
 244 /* Some of our tools are 'anonymous by default'.  This is a single
 245  * function to determine if authentication has been explicitly
 246  * requested */
 247
 248 _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *cred)
 249 {
 250         if (cred->bind_dn) {
 251                 return true;
 252         }
 253
 254         if (cli_credentials_is_anonymous(cred)){
 255                 return false;
 256         }
 257
 258         if (cred->principal_obtained >= CRED_SPECIFIED) {
 259                 return true;
 260         }
 261         if (cred->username_obtained >= CRED_SPECIFIED) {
 262                 return true;
 263         }
 264
 265         if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) {
 266                 return true;
 267         }
 268
 269         return false;
 270 }
 271
 272 /**
 273  * Obtain the password for this credentials context.
 274  * @param cred credentials context
 275  * @retval If set, the cleartext password, otherwise NULL
 276  */
 277 _PUBLIC_ const char *cli_credentials_get_password(struct cli_credentials *cred)
 278 {
 279         if (cred->machine_account_pending) {
 280                 cli_credentials_set_machine_account(cred,
 281                                                     cred->machine_account_pending_lp_ctx);
 282         }
 283
 284         if (cred->password_obtained == CRED_CALLBACK &&
 285             !cred->callback_running) {
 286                 cred->callback_running = true;
 287                 cred->password = cred->password_cb(cred);
 288                 cred->callback_running = false;
 289                 cred->password_obtained = CRED_CALLBACK_RESULT;
 290                 cli_credentials_invalidate_ccache(cred, cred->password_obtained);
 291         }
 292
 293         return cred->password;
 294 }
 295
 296 /* Set a password on the credentials context, including an indication
 297  * of 'how' the password was obtained */
 298
 299 _PUBLIC_ bool cli_credentials_set_password(struct cli_credentials *cred,
 300                                   const char *val,
 301                                   enum credentials_obtained obtained)
 302 {
 303         if (obtained >= cred->password_obtained) {
 304                 cred->password = talloc_strdup(cred, val);
 305                 cred->password_obtained = obtained;
 306                 cli_credentials_invalidate_ccache(cred, cred->password_obtained);
 307
 308                 cred->nt_hash = NULL;
 309                 return true;
 310         }
 311
 312         return false;
 313 }
 314
 315 _PUBLIC_ bool cli_credentials_set_password_callback(struct cli_credentials *cred,
 316                                            const char *(*password_cb) (struct cli_credentials *))
 317 {
 318         if (cred->password_obtained < CRED_CALLBACK) {
 319                 cred->password_cb = password_cb;
 320                 cred->password_obtained = CRED_CALLBACK;
 321                 cli_credentials_invalidate_ccache(cred, cred->password_obtained);
 322                 return true;
 323         }
 324
 325         return false;
 326 }
 327
 328 /**
 329  * Obtain the 'old' password for this credentials context (used for join accounts).
 330  * @param cred credentials context
 331  * @retval If set, the cleartext password, otherwise NULL
 332  */
 333 const char *cli_credentials_get_old_password(struct cli_credentials *cred)
 334 {
 335         if (cred->machine_account_pending) {
 336                 cli_credentials_set_machine_account(cred,
 337                                                     cred->machine_account_pending_lp_ctx);
 338         }
 339
 340         return cred->old_password;
 341 }
 342
 343 bool cli_credentials_set_old_password(struct cli_credentials *cred,
 344                                       const char *val,
 345                                       enum credentials_obtained obtained)
 346 {
 347         cred->old_password = talloc_strdup(cred, val);
 348         return true;
 349 }
 350
 351 /**
 352  * Obtain the password, in the form MD4(unicode(password)) for this credentials context.
 353  *
 354  * Sometimes we only have this much of the password, while the rest of
 355  * the time this call avoids calling E_md4hash themselves.
 356  *
 357  * @param cred credentials context
 358  * @retval If set, the cleartext password, otherwise NULL
 359  */
 360 _PUBLIC_ const struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred,
 361                                                         TALLOC_CTX *mem_ctx)
 362 {
 363         const char *password = cli_credentials_get_password(cred);
 364
 365         if (password) {
 366                 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
 367                 if (!nt_hash) {
 368                         return NULL;
 369                 }
 370
 371                 E_md4hash(password, nt_hash->hash);
 372
 373                 return nt_hash;
 374         } else {
 375                 return cred->nt_hash;
 376         }
 377 }
 378
 379 _PUBLIC_ bool cli_credentials_set_nt_hash(struct cli_credentials *cred,
 380                                  const struct samr_Password *nt_hash,
 381                                  enum credentials_obtained obtained)
 382 {
 383         if (obtained >= cred->password_obtained) {
 384                 cli_credentials_set_password(cred, NULL, obtained);
 385                 if (nt_hash) {
 386                         cred->nt_hash = talloc(cred, struct samr_Password);
 387                         *cred->nt_hash = *nt_hash;
 388                 } else {
 389                         cred->nt_hash = NULL;
 390                 }
 391                 return true;
 392         }
 393
 394         return false;
 395 }
 396
 397 /**
 398  * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
 399  * @param cred credentials context
 400  * @retval The domain set on this context.
 401  * @note Return value will never be NULL except by programmer error.
 402  */
 403 _PUBLIC_ const char *cli_credentials_get_domain(struct cli_credentials *cred)
 404 {
 405         if (cred->machine_account_pending) {
 406                 cli_credentials_set_machine_account(cred,
 407                                                     cred->machine_account_pending_lp_ctx);
 408         }
 409
 410         if (cred->domain_obtained == CRED_CALLBACK &&
 411             !cred->callback_running) {
 412                 cred->callback_running = true;
 413                 cred->domain = cred->domain_cb(cred);
 414                 cred->callback_running = false;
 415                 cred->domain_obtained = CRED_SPECIFIED;
 416                 cli_credentials_invalidate_ccache(cred, cred->domain_obtained);
 417         }
 418
 419         return cred->domain;
 420 }
 421
 422
 423 _PUBLIC_ bool cli_credentials_set_domain(struct cli_credentials *cred,
 424                                 const char *val,
 425                                 enum credentials_obtained obtained)
 426 {
 427         if (obtained >= cred->domain_obtained) {
 428                 /* it is important that the domain be in upper case,
 429                  * particularly for the sensitive NTLMv2
 430                  * calculations */
 431                 cred->domain = strupper_talloc(cred, val);
 432                 cred->domain_obtained = obtained;
 433                 cli_credentials_invalidate_ccache(cred, cred->domain_obtained);
 434                 return true;
 435         }
 436
 437         return false;
 438 }
 439
 440 bool cli_credentials_set_domain_callback(struct cli_credentials *cred,
 441                                          const char *(*domain_cb) (struct cli_credentials *))
 442 {
 443         if (cred->domain_obtained < CRED_CALLBACK) {
 444                 cred->domain_cb = domain_cb;
 445                 cred->domain_obtained = CRED_CALLBACK;
 446                 return true;
 447         }
 448
 449         return false;
 450 }
 451
 452 /**
 453  * Obtain the Kerberos realm for this credentials context.
 454  * @param cred credentials context
 455  * @retval The realm set on this context.
 456  * @note Return value will never be NULL except by programmer error.
 457  */
 458 _PUBLIC_ const char *cli_credentials_get_realm(struct cli_credentials *cred)
 459 {
 460         if (cred->machine_account_pending) {
 461                 cli_credentials_set_machine_account(cred,
 462                                                     cred->machine_account_pending_lp_ctx);
 463         }
 464
 465         if (cred->realm_obtained == CRED_CALLBACK &&
 466             !cred->callback_running) {
 467                 cred->callback_running = true;
 468                 cred->realm = cred->realm_cb(cred);
 469                 cred->callback_running = false;
 470                 cred->realm_obtained = CRED_SPECIFIED;
 471                 cli_credentials_invalidate_ccache(cred, cred->realm_obtained);
 472         }
 473
 474         return cred->realm;
 475 }
 476
 477 /**
 478  * Set the realm for this credentials context, and force it to
 479  * uppercase for the sainity of our local kerberos libraries
 480  */
 481 _PUBLIC_ bool cli_credentials_set_realm(struct cli_credentials *cred,
 482                                const char *val,
 483                                enum credentials_obtained obtained)
 484 {
 485         if (obtained >= cred->realm_obtained) {
 486                 cred->realm = strupper_talloc(cred, val);
 487                 cred->realm_obtained = obtained;
 488                 cli_credentials_invalidate_ccache(cred, cred->realm_obtained);
 489                 return true;
 490         }
 491
 492         return false;
 493 }
 494
 495 bool cli_credentials_set_realm_callback(struct cli_credentials *cred,
 496                                         const char *(*realm_cb) (struct cli_credentials *))
 497 {
 498         if (cred->realm_obtained < CRED_CALLBACK) {
 499                 cred->realm_cb = realm_cb;
 500                 cred->realm_obtained = CRED_CALLBACK;
 501                 return true;
 502         }
 503
 504         return false;
 505 }
 506
 507 /**
 508  * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
 509  *
 510  * @param cred credentials context
 511  * @retval The workstation name set on this context.
 512  * @note Return value will never be NULL except by programmer error.
 513  */
 514 _PUBLIC_ const char *cli_credentials_get_workstation(struct cli_credentials *cred)
 515 {
 516         if (cred->workstation_obtained == CRED_CALLBACK &&
 517             !cred->callback_running) {
 518                 cred->callback_running = true;
 519                 cred->workstation = cred->workstation_cb(cred);
 520                 cred->callback_running = false;
 521                 cred->workstation_obtained = CRED_SPECIFIED;
 522         }
 523
 524         return cred->workstation;
 525 }
 526
 527 _PUBLIC_ bool cli_credentials_set_workstation(struct cli_credentials *cred,
 528                                      const char *val,
 529                                      enum credentials_obtained obtained)
 530 {
 531         if (obtained >= cred->workstation_obtained) {
 532                 cred->workstation = talloc_strdup(cred, val);
 533                 cred->workstation_obtained = obtained;
 534                 return true;
 535         }
 536
 537         return false;
 538 }
 539
 540 bool cli_credentials_set_workstation_callback(struct cli_credentials *cred,
 541                                               const char *(*workstation_cb) (struct cli_credentials *))
 542 {
 543         if (cred->workstation_obtained < CRED_CALLBACK) {
 544                 cred->workstation_cb = workstation_cb;
 545                 cred->workstation_obtained = CRED_CALLBACK;
 546                 return true;
 547         }
 548
 549         return false;
 550 }
 551
 552 /**
 553  * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
 554  *
 555  * The format accepted is [domain\\]user[%password] or user[@realm][%password]
 556  *
 557  * @param credentials Credentials structure on which to set the password
 558  * @param data the string containing the username, password etc
 559  * @param obtained This enum describes how 'specified' this password is
 560  */
 561
 562 _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained)
 563 {
 564         char *uname, *p;
 565
 566         if (strcmp("%",data) == 0) {
 567                 cli_credentials_set_anonymous(credentials);
 568                 return;
 569         }
 570
 571         uname = talloc_strdup(credentials, data);
 572         if ((p = strchr_m(uname,'%'))) {
 573                 *p = 0;
 574                 cli_credentials_set_password(credentials, p+1, obtained);
 575         }
 576
 577         if ((p = strchr_m(uname,'@'))) {
 578                 cli_credentials_set_principal(credentials, uname, obtained);
 579                 *p = 0;
 580                 cli_credentials_set_realm(credentials, p+1, obtained);
 581                 return;
 582         } else if ((p = strchr_m(uname,'\\')) || (p = strchr_m(uname, '/'))) {
 583                 *p = 0;
 584                 cli_credentials_set_domain(credentials, uname, obtained);
 585                 uname = p+1;
 586         }
 587         cli_credentials_set_username(credentials, uname, obtained);
 588 }
 589
 590 /**
 591  * Given a a credentials structure, print it as a string
 592  *
 593  * The format output is [domain\\]user[%password] or user[@realm][%password]
 594  *
 595  * @param credentials Credentials structure on which to set the password
 596  * @param mem_ctx The memory context to place the result on
 597  */
 598
 599 _PUBLIC_ const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
 600 {
 601         const char *bind_dn = cli_credentials_get_bind_dn(credentials);
 602         const char *domain;
 603         const char *username;
 604         const char *name;
 605
 606         if (bind_dn) {
 607                 name = talloc_reference(mem_ctx, bind_dn);
 608         } else {
 609                 cli_credentials_get_ntlm_username_domain(credentials, mem_ctx, &username, &domain);
 610                 if (domain && domain[0]) {
 611                         name = talloc_asprintf(mem_ctx, "%s\\%s",
 612                                                domain, username);
 613                 } else {
 614                         name = talloc_asprintf(mem_ctx, "%s",
 615                                                username);
 616                 }
 617         }
 618         return name;
 619 }
 620
 621 /**
 622  * Specifies default values for domain, workstation and realm
 623  * from the smb.conf configuration file
 624  *
 625  * @param cred Credentials structure to fill in
 626  */
 627 _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
 628                               struct loadparm_context *lp_ctx)
 629 {
 630         cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
 631         cli_credentials_set_domain(cred, lp_workgroup(lp_ctx), CRED_UNINITIALISED);
 632         cli_credentials_set_workstation(cred, lp_netbios_name(lp_ctx), CRED_UNINITIALISED);
 633         cli_credentials_set_realm(cred, lp_realm(lp_ctx), CRED_UNINITIALISED);
 634 }
 635
 636 /**
 637  * Guess defaults for credentials from environment variables,
 638  * and from the configuration file
 639  *
 640  * @param cred Credentials structure to fill in
 641  */
 642 _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred,
 643                            struct loadparm_context *lp_ctx)
 644 {
 645         char *p;
 646
 647         if (lp_ctx != NULL) {
 648                 cli_credentials_set_conf(cred, lp_ctx);
 649         }
 650
 651         if (getenv("LOGNAME")) {
 652                 cli_credentials_set_username(cred, getenv("LOGNAME"), CRED_GUESS_ENV);
 653         }
 654
 655         if (getenv("USER")) {
 656                 cli_credentials_parse_string(cred, getenv("USER"), CRED_GUESS_ENV);
 657                 if ((p = strchr_m(getenv("USER"),'%'))) {
 658                         memset(p,0,strlen(cred->password));
 659                 }
 660         }
 661
 662         if (getenv("PASSWD")) {
 663                 cli_credentials_set_password(cred, getenv("PASSWD"), CRED_GUESS_ENV);
 664         }
 665
 666         if (getenv("PASSWD_FD")) {
 667                 cli_credentials_parse_password_fd(cred, atoi(getenv("PASSWD_FD")),
 668                                                   CRED_GUESS_FILE);
 669         }
 670
 671         p = getenv("PASSWD_FILE");
 672         if (p && p[0]) {
 673                 cli_credentials_parse_password_file(cred, p, CRED_GUESS_FILE);
 674         }
 675
 676         if (cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) {
 677                 cli_credentials_set_ccache(cred, event_context_find(cred), lp_ctx, NULL, CRED_GUESS_FILE);
 678         }
 679 }
 680
 681 /**
 682  * Attach NETLOGON credentials for use with SCHANNEL
 683  */
 684
 685 _PUBLIC_ void cli_credentials_set_netlogon_creds(struct cli_credentials *cred,
 686                                         struct creds_CredentialState *netlogon_creds)
 687 {
 688         cred->netlogon_creds = talloc_reference(cred, netlogon_creds);
 689 }
 690
 691 /**
 692  * Return attached NETLOGON credentials
 693  */
 694
 695 struct creds_CredentialState *cli_credentials_get_netlogon_creds(struct cli_credentials *cred)
 696 {
 697         return cred->netlogon_creds;
 698 }
 699
 700 /**
 701  * Set NETLOGON secure channel type
 702  */
 703
 704 _PUBLIC_ void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
 705                                              enum netr_SchannelType secure_channel_type)
 706 {
 707         cred->secure_channel_type = secure_channel_type;
 708 }
 709
 710 /**
 711  * Return NETLOGON secure chanel type
 712  */
 713
 714 _PUBLIC_ enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred)
 715 {
 716         return cred->secure_channel_type;
 717 }
 718
 719 /**
 720  * Fill in a credentials structure as the anonymous user
 721  */
 722 _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred)
 723 {
 724         cli_credentials_set_username(cred, "", CRED_SPECIFIED);
 725         cli_credentials_set_domain(cred, "", CRED_SPECIFIED);
 726         cli_credentials_set_password(cred, NULL, CRED_SPECIFIED);
 727         cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED);
 728         cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED);
 729 }
 730
 731 /**
 732  * Describe a credentials context as anonymous or authenticated
 733  * @retval true if anonymous, false if a username is specified
 734  */
 735
 736 _PUBLIC_ bool cli_credentials_is_anonymous(struct cli_credentials *cred)
 737 {
 738         const char *username;
 739
 740         if (cred->machine_account_pending) {
 741                 cli_credentials_set_machine_account(cred,
 742                                                     cred->machine_account_pending_lp_ctx);
 743         }
 744
 745         username = cli_credentials_get_username(cred);
 746
 747         /* Yes, it is deliberate that we die if we have a NULL pointer
 748          * here - anonymous is "", not NULL, which is 'never specified,
 749          * never guessed', ie programmer bug */
 750         if (!username[0]) {
 751                 return true;
 752         }
 753
 754         return false;
 755 }
 756
 757 /**
 758  * Mark the current password for a credentials struct as wrong. This will
 759  * cause the password to be prompted again (if a callback is set).
 760  *
 761  * This will decrement the number of times the password can be tried.
 762  *
 763  * @retval whether the credentials struct is finished
 764  */
 765 _PUBLIC_ bool cli_credentials_wrong_password(struct cli_credentials *cred)
 766 {
 767         if (cred->password_obtained != CRED_CALLBACK_RESULT) {
 768                 return false;
 769         }
 770
 771         cred->password_obtained = CRED_CALLBACK;
 772
 773         cred->tries--;
 774
 775         return (cred->tries > 0);
 776 }