source4/lib/credentials.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Jelmer Vernooij 2005
   5    Copyright (C) Tim Potter 2001
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/filesys.h"
  25 #include "include/secrets.h"
  26 #include "lib/ldb/include/ldb.h"
  27 #include "librpc/gen_ndr/ndr_samr.h" /* for struct samrPassword */
  28 #include "system/kerberos.h"
  29 #include "auth/kerberos/kerberos.h"
  30
  31
  32 /**
  33  * Create a new credentials structure
  34  * @param mem_ctx TALLOC_CTX parent for credentials structure
  35  */
  36 struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
  37 {
  38         struct cli_credentials *cred = talloc(mem_ctx, struct cli_credentials);
  39         if (!cred) {
  40                 return cred;
  41         }
  42
  43         cred->netlogon_creds = NULL;
  44         cred->machine_account_pending = False;
  45         cred->workstation_obtained = CRED_UNINITIALISED;
  46         cred->username_obtained = CRED_UNINITIALISED;
  47         cred->password_obtained = CRED_UNINITIALISED;
  48         cred->domain_obtained = CRED_UNINITIALISED;
  49         cred->realm_obtained = CRED_UNINITIALISED;
  50         cred->ccache_obtained = CRED_UNINITIALISED;
  51         cred->principal_obtained = CRED_UNINITIALISED;
  52         return cred;
  53 }
  54
  55 /**
  56  * Obtain the username for this credentials context.
  57  * @param cred credentials context
  58  * @retval The username set on this context.
  59  * @note Return value will never be NULL except by programmer error.
  60  */
  61 const char *cli_credentials_get_username(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
  62 {
  63         if (cred->machine_account_pending) {
  64                 cli_credentials_set_machine_account(cred);
  65         }
  66
  67         /* If we have a principal set on this, we want to login with "" domain and user@realm */
  68         if (cred->username_obtained < cred->principal_obtained) {
  69                 return cli_credentials_get_principal(cred, mem_ctx);
  70         }
  71
  72         if (cred->username_obtained == CRED_CALLBACK) {
  73                 cred->username = cred->username_cb(cred);
  74                 cred->username_obtained = CRED_SPECIFIED;
  75         }
  76
  77         return talloc_reference(mem_ctx, cred->username);
  78 }
  79
  80 BOOL cli_credentials_set_username(struct cli_credentials *cred, const char *val, enum credentials_obtained obtained)
  81 {
  82         if (obtained >= cred->username_obtained) {
  83                 cred->username = talloc_strdup(cred, val);
  84                 cred->username_obtained = obtained;
  85                 return True;
  86         }
  87
  88         return False;
  89 }
  90
  91 /**
  92  * Obtain the client principal for this credentials context.
  93  * @param cred credentials context
  94  * @retval The username set on this context.
  95  * @note Return value will never be NULL except by programmer error.
  96  */
  97 const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
  98 {
  99         if (cred->machine_account_pending) {
 100                 cli_credentials_set_machine_account(cred);
 101         }
 102
 103         if (cred->principal_obtained == CRED_CALLBACK) {
 104                 cred->principal = cred->principal_cb(cred);
 105                 cred->principal_obtained = CRED_SPECIFIED;
 106         }
 107
 108         if (cred->principal_obtained < cred->username_obtained) {
 109                 return talloc_asprintf(mem_ctx, "%s@%s",
 110                                        cli_credentials_get_username(cred, mem_ctx),
 111                                        cli_credentials_get_realm(cred));
 112         }
 113         return talloc_reference(mem_ctx, cred->principal);
 114 }
 115
 116 BOOL cli_credentials_set_principal(struct cli_credentials *cred, const char *val, enum credentials_obtained obtained)
 117 {
 118         if (obtained >= cred->principal_obtained) {
 119                 cred->principal = talloc_strdup(cred, val);
 120                 cred->principal_obtained = obtained;
 121                 return True;
 122         }
 123
 124         return False;
 125 }
 126
 127 BOOL cli_credentials_authentication_requested(struct cli_credentials *cred)
 128 {
 129         if (cred->principal_obtained >= CRED_SPECIFIED) {
 130                 return True;
 131         }
 132         if (cred->username_obtained >= CRED_SPECIFIED) {
 133                 return True;
 134         }
 135         return False;
 136 }
 137
 138 /**
 139  * Obtain the password for this credentials context.
 140  * @param cred credentials context
 141  * @retval If set, the cleartext password, otherwise NULL
 142  */
 143 const char *cli_credentials_get_password(struct cli_credentials *cred)
 144 {
 145         if (cred->machine_account_pending) {
 146                 cli_credentials_set_machine_account(cred);
 147         }
 148
 149         if (cred->password_obtained == CRED_CALLBACK) {
 150                 cred->password = cred->password_cb(cred);
 151                 cred->password_obtained = CRED_SPECIFIED;
 152         }
 153
 154         return cred->password;
 155 }
 156
 157 BOOL cli_credentials_set_password(struct cli_credentials *cred, const char *val, enum credentials_obtained obtained)
 158 {
 159         if (obtained >= cred->password_obtained) {
 160                 cred->password = talloc_strdup(cred, val);
 161                 cred->password_obtained = obtained;
 162
 163                 cred->nt_hash = NULL;
 164                 return True;
 165         }
 166
 167         return False;
 168 }
 169
 170 /**
 171  * Obtain the password for this credentials context.
 172  * @param cred credentials context
 173  * @retval If set, the cleartext password, otherwise NULL
 174  */
 175 const struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred,
 176                                                         TALLOC_CTX *mem_ctx)
 177 {
 178         const char *password = cli_credentials_get_password(cred);
 179
 180         if (password) {
 181                 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
 182                 if (!nt_hash) {
 183                         return NULL;
 184                 }
 185
 186                 E_md4hash(password, nt_hash->hash);
 187
 188                 return nt_hash;
 189         } else {
 190                 return cred->nt_hash;
 191         }
 192 }
 193
 194 BOOL cli_credentials_set_nt_hash(struct cli_credentials *cred,
 195                                  const struct samr_Password *nt_hash,
 196                                  enum credentials_obtained obtained)
 197 {
 198         if (obtained >= cred->password_obtained) {
 199                 cli_credentials_set_password(cred, NULL, obtained);
 200                 cred->nt_hash = talloc(cred, struct samr_Password);
 201                 *cred->nt_hash = *nt_hash;
 202                 return True;
 203         }
 204
 205         return False;
 206 }
 207
 208 int cli_credentials_set_from_ccache(struct cli_credentials *cred,
 209                                     enum credentials_obtained obtained)
 210 {
 211
 212         krb5_principal princ;
 213         krb5_error_code ret;
 214         char *name;
 215         char **realm;
 216
 217         ret = krb5_cc_get_principal(cred->ccache->smb_krb5_context->krb5_context,
 218                                     cred->ccache->ccache, &princ);
 219
 220         if (ret) {
 221                 char *err_mess = smb_get_krb5_error_message(cred->ccache->smb_krb5_context->krb5_context, ret, cred);
 222                 DEBUG(1,("failed to get principal from ccache: %s\n",
 223                          err_mess));
 224                 talloc_free(err_mess);
 225                 return ret;
 226         }
 227
 228         ret = krb5_unparse_name(cred->ccache->smb_krb5_context->krb5_context, princ, &name);
 229         if (ret) {
 230                 char *err_mess = smb_get_krb5_error_message(cred->ccache->smb_krb5_context->krb5_context, ret, cred);
 231                 DEBUG(1,("failed to unparse principal from ccache: %s\n",
 232                          err_mess));
 233                 talloc_free(err_mess);
 234                 return ret;
 235         }
 236
 237         realm = krb5_princ_realm(cred->ccache->smb_krb5_context->krb5_context, princ);
 238
 239         cli_credentials_set_realm(cred, *realm, obtained);
 240         cli_credentials_set_principal(cred, name, obtained);
 241
 242         free(name);
 243
 244         krb5_free_principal(cred->ccache->smb_krb5_context->krb5_context, princ);
 245
 246         cred->ccache_obtained = obtained;
 247
 248         return 0;
 249 }
 250
 251
 252 static int free_mccache(void *ptr) {
 253         struct ccache_container *ccc = ptr;
 254         krb5_cc_destroy(ccc->smb_krb5_context->krb5_context, ccc->ccache);
 255
 256         return 0;
 257 }
 258
 259 static int free_dccache(void *ptr) {
 260         struct ccache_container *ccc = ptr;
 261         krb5_cc_close(ccc->smb_krb5_context->krb5_context, ccc->ccache);
 262
 263         return 0;
 264 }
 265
 266 static int cli_credentials_set_ccache(struct cli_credentials *cred,
 267                                       const char *name,
 268                                       enum credentials_obtained obtained)
 269 {
 270         krb5_error_code ret;
 271         krb5_principal princ;
 272         struct ccache_container *ccc = talloc(cred, struct ccache_container);
 273         if (!ccc) {
 274                 return ENOMEM;
 275         }
 276
 277         ret = smb_krb5_init_context(ccc, &ccc->smb_krb5_context);
 278         if (ret) {
 279                 talloc_free(ccc);
 280                 return ret;
 281         }
 282         if (name) {
 283                 ret = krb5_cc_resolve(ccc->smb_krb5_context->krb5_context, name, &ccc->ccache);
 284                 if (ret) {
 285                         DEBUG(1,("failed to read krb5 ccache: %s: %s\n",
 286                                  name,
 287                                  smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
 288                         talloc_free(ccc);
 289                         return ret;
 290                 }
 291         } else {
 292                 ret = krb5_cc_default(ccc->smb_krb5_context->krb5_context, &ccc->ccache);
 293                 if (ret) {
 294                         DEBUG(1,("failed to read default krb5 ccache: %s\n",
 295                                  smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
 296                         talloc_free(ccc);
 297                         return ret;
 298                 }
 299         }
 300
 301         talloc_set_destructor(ccc, free_dccache);
 302
 303         ret = krb5_cc_get_principal(ccc->smb_krb5_context->krb5_context, ccc->ccache, &princ);
 304
 305         if (ret) {
 306                 DEBUG(1,("failed to get principal from default ccache: %s\n",
 307                          smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
 308                 talloc_free(ccc);
 309                 return ret;
 310         }
 311
 312         krb5_free_principal(ccc->smb_krb5_context->krb5_context, princ);
 313
 314         cred->ccache = ccc;
 315         talloc_steal(cred, ccc);
 316
 317         ret = cli_credentials_set_from_ccache(cred, obtained);
 318
 319         if (ret) {
 320                 return ret;
 321         }
 322
 323         return 0;
 324 }
 325
 326
 327 int cli_credentials_new_ccache(struct cli_credentials *cred)
 328 {
 329         krb5_error_code ret;
 330         char *rand_string;
 331         struct ccache_container *ccc = talloc(cred, struct ccache_container);
 332         char *ccache_name;
 333         if (!ccc) {
 334                 return ENOMEM;
 335         }
 336
 337         rand_string = generate_random_str(NULL, 16);
 338         if (!rand_string) {
 339                 talloc_free(ccc);
 340                 return ENOMEM;
 341         }
 342
 343         ccache_name = talloc_asprintf(ccc, "MEMORY:%s",
 344                               rand_string);
 345         talloc_free(rand_string);
 346
 347         if (!ccache_name) {
 348                 talloc_free(ccc);
 349                 return ENOMEM;
 350         }
 351
 352         ret = smb_krb5_init_context(ccc, &ccc->smb_krb5_context);
 353         if (ret) {
 354                 talloc_free(ccache_name);
 355                 talloc_free(ccc);
 356                 return ret;
 357         }
 358
 359         ret = krb5_cc_resolve(ccc->smb_krb5_context->krb5_context, ccache_name, &ccc->ccache);
 360         if (ret) {
 361                 DEBUG(1,("failed to generate a new krb5 ccache (%s): %s\n",
 362                          ccache_name,
 363                          smb_get_krb5_error_message(ccc->smb_krb5_context->krb5_context, ret, ccc)));
 364                 talloc_free(ccache_name);
 365                 talloc_free(ccc);
 366                 return ret;
 367         }
 368
 369         talloc_set_destructor(ccc, free_mccache);
 370
 371         cred->ccache = ccc;
 372         talloc_steal(cred, ccc);
 373         talloc_free(ccache_name);
 374
 375         return ret;
 376 }
 377
 378 int cli_credentials_get_ccache(struct cli_credentials *cred, struct ccache_container **ccc)
 379 {
 380         krb5_error_code ret;
 381
 382         if (cred->ccache_obtained >= (MAX(cred->principal_obtained,
 383                                           cred->username_obtained))) {
 384                 *ccc = cred->ccache;
 385                 return 0;
 386         }
 387         if (cli_credentials_is_anonymous(cred)) {
 388                 return EINVAL;
 389         }
 390
 391         ret = cli_credentials_new_ccache(cred);
 392         if (ret) {
 393                 return ret;
 394         }
 395         ret = kinit_to_ccache(cred, cred, cred->ccache->smb_krb5_context, cred->ccache->ccache);
 396         if (ret) {
 397                 return ret;
 398         }
 399         ret = cli_credentials_set_from_ccache(cred, cred->principal_obtained);
 400
 401         if (ret) {
 402                 return ret;
 403         }
 404         *ccc = cred->ccache;
 405         return ret;
 406 }
 407
 408
 409 /**
 410  * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
 411  * @param cred credentials context
 412  * @retval The domain set on this context.
 413  * @note Return value will never be NULL except by programmer error.
 414  */
 415 const char *cli_credentials_get_domain(struct cli_credentials *cred)
 416 {
 417         if (cred->machine_account_pending) {
 418                 cli_credentials_set_machine_account(cred);
 419         }
 420
 421         /* If we have a principal set on this, we want to login with "" domain and user@realm */
 422         if (cred->domain_obtained < cred->principal_obtained) {
 423                 return "";
 424         }
 425
 426         if (cred->domain_obtained == CRED_CALLBACK) {
 427                 cred->domain = cred->domain_cb(cred);
 428                 cred->domain_obtained = CRED_SPECIFIED;
 429         }
 430
 431         return cred->domain;
 432 }
 433
 434
 435 BOOL cli_credentials_set_domain(struct cli_credentials *cred, const char *val, enum credentials_obtained obtained)
 436 {
 437         if (obtained >= cred->domain_obtained) {
 438                 cred->domain = talloc_strdup(cred, val);
 439                 cred->domain_obtained = obtained;
 440                 return True;
 441         }
 442
 443         return False;
 444 }
 445
 446 /**
 447  * Obtain the Kerberos realm for this credentials context.
 448  * @param cred credentials context
 449  * @retval The realm set on this context.
 450  * @note Return value will never be NULL except by programmer error.
 451  */
 452 const char *cli_credentials_get_realm(struct cli_credentials *cred)
 453 {
 454         if (cred->machine_account_pending) {
 455                 cli_credentials_set_machine_account(cred);
 456         }
 457
 458         if (cred->realm_obtained == CRED_CALLBACK) {
 459                 cred->realm = cred->realm_cb(cred);
 460                 cred->realm_obtained = CRED_SPECIFIED;
 461         }
 462
 463         return cred->realm;
 464 }
 465
 466 /**
 467  * Set the realm for this credentials context, and force it to
 468  * uppercase for the sainity of our local kerberos libraries
 469  */
 470 BOOL cli_credentials_set_realm(struct cli_credentials *cred, const char *val, enum credentials_obtained obtained)
 471 {
 472         if (obtained >= cred->realm_obtained) {
 473                 cred->realm = strupper_talloc(cred, val);
 474                 cred->realm_obtained = obtained;
 475                 return True;
 476         }
 477
 478         return False;
 479 }
 480
 481 /**
 482  * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
 483  *
 484  * @param cred credentials context
 485  * @retval The workstation name set on this context.
 486  * @note Return value will never be NULL except by programmer error.
 487  */
 488 const char *cli_credentials_get_workstation(struct cli_credentials *cred)
 489 {
 490         if (cred->workstation_obtained == CRED_CALLBACK) {
 491                 cred->workstation = cred->workstation_cb(cred);
 492                 cred->workstation_obtained = CRED_SPECIFIED;
 493         }
 494
 495         return cred->workstation;
 496 }
 497
 498 BOOL cli_credentials_set_workstation(struct cli_credentials *cred, const char *val, enum credentials_obtained obtained)
 499 {
 500         if (obtained >= cred->workstation_obtained) {
 501                 cred->workstation = talloc_strdup(cred, val);
 502                 cred->workstation_obtained = obtained;
 503                 return True;
 504         }
 505
 506         return False;
 507 }
 508
 509 /**
 510  * Read a file descriptor, and parse it for a password (eg from a file or stdin)
 511  *
 512  * @param credentials Credentials structure on which to set the password
 513  * @param fd open file descriptor to read the password from
 514  * @param obtained This enum describes how 'specified' this password is
 515  */
 516
 517 BOOL cli_credentials_parse_password_fd(struct cli_credentials *credentials, int fd, enum credentials_obtained obtained)
 518 {
 519         char *p;
 520         char pass[128];
 521
 522         for(p = pass, *p = '\0'; /* ensure that pass is null-terminated */
 523                 p && p - pass < sizeof(pass);) {
 524                 switch (read(fd, p, 1)) {
 525                 case 1:
 526                         if (*p != '\n' && *p != '\0') {
 527                                 *++p = '\0'; /* advance p, and null-terminate pass */
 528                                 break;
 529                         }
 530                 case 0:
 531                         if (p - pass) {
 532                                 *p = '\0'; /* null-terminate it, just in case... */
 533                                 p = NULL; /* then force the loop condition to become false */
 534                                 break;
 535                         } else {
 536                                 fprintf(stderr, "Error reading password from file descriptor %d: %s\n", fd, "empty password\n");
 537                                 return False;
 538                         }
 539
 540                 default:
 541                         fprintf(stderr, "Error reading password from file descriptor %d: %s\n",
 542                                         fd, strerror(errno));
 543                         return False;
 544                 }
 545         }
 546
 547         cli_credentials_set_password(credentials, pass, obtained);
 548         return True;
 549 }
 550
 551 /**
 552  * Read a named file, and parse it for a password
 553  *
 554  * @param credentials Credentials structure on which to set the password
 555  * @param file a named file to read the password from
 556  * @param obtained This enum describes how 'specified' this password is
 557  */
 558
 559 BOOL cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained)
 560 {
 561         int fd = open(file, O_RDONLY, 0);
 562         BOOL ret;
 563
 564         if (fd < 0) {
 565                 fprintf(stderr, "Error opening PASSWD_FILE %s: %s\n",
 566                                 file, strerror(errno));
 567                 return False;
 568         }
 569
 570         ret = cli_credentials_parse_password_fd(credentials, fd, obtained);
 571
 572         close(fd);
 573
 574         return ret;
 575 }
 576
 577 /**
 578  * Read a named file, and parse it for username, domain, realm and password
 579  *
 580  * @param credentials Credentials structure on which to set the password
 581  * @param file a named file to read the details from
 582  * @param obtained This enum describes how 'specified' this password is
 583  */
 584
 585 BOOL cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained)
 586 {
 587         XFILE *auth;
 588         char buf[128];
 589         uint16_t len = 0;
 590         char *ptr, *val, *param;
 591
 592         if ((auth=x_fopen(file, O_RDONLY, 0)) == NULL)
 593         {
 594                 /* fail if we can't open the credentials file */
 595                 d_printf("ERROR: Unable to open credentials file!\n");
 596                 return False;
 597         }
 598
 599         while (!x_feof(auth))
 600         {
 601                 /* get a line from the file */
 602                 if (!x_fgets(buf, sizeof(buf), auth))
 603                         continue;
 604                 len = strlen(buf);
 605
 606                 if ((len) && (buf[len-1]=='\n'))
 607                 {
 608                         buf[len-1] = '\0';
 609                         len--;
 610                 }
 611                 if (len == 0)
 612                         continue;
 613
 614                 /* break up the line into parameter & value.
 615                  * will need to eat a little whitespace possibly */
 616                 param = buf;
 617                 if (!(ptr = strchr_m (buf, '=')))
 618                         continue;
 619
 620                 val = ptr+1;
 621                 *ptr = '\0';
 622
 623                 /* eat leading white space */
 624                 while ((*val!='\0') && ((*val==' ') || (*val=='\t')))
 625                         val++;
 626
 627                 if (strwicmp("password", param) == 0) {
 628                         cli_credentials_set_password(cred, val, obtained);
 629                 } else if (strwicmp("username", param) == 0) {
 630                         cli_credentials_set_username(cred, val, obtained);
 631                 } else if (strwicmp("domain", param) == 0) {
 632                         cli_credentials_set_domain(cred, val, obtained);
 633                 } else if (strwicmp("realm", param) == 0) {
 634                         cli_credentials_set_realm(cred, val, obtained);
 635                 }
 636                 memset(buf, 0, sizeof(buf));
 637         }
 638
 639         x_fclose(auth);
 640         return True;
 641 }
 642
 643
 644 /**
 645  * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
 646  *
 647  * The format accepted is [domain\\]user[%password] or user[@realm][%password]
 648  *
 649  * @param credentials Credentials structure on which to set the password
 650  * @param data the string containing the username, password etc
 651  * @param obtained This enum describes how 'specified' this password is
 652  */
 653
 654 void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained)
 655 {
 656         char *uname, *p;
 657
 658         if (strcmp("%",data) == 0) {
 659                 cli_credentials_set_anonymous(credentials);
 660                 return;
 661         }
 662
 663         uname = talloc_strdup(credentials, data);
 664         if ((p = strchr_m(uname,'%'))) {
 665                 *p = 0;
 666                 cli_credentials_set_password(credentials, p+1, obtained);
 667         }
 668
 669         if ((p = strchr_m(uname,'@'))) {
 670                 cli_credentials_set_principal(credentials, uname, obtained);
 671                 *p = 0;
 672                 cli_credentials_set_realm(credentials, p+1, obtained);
 673                 return;
 674         } else if ((p = strchr_m(uname,'\\')) || (p = strchr_m(uname, '/'))) {
 675                 *p = 0;
 676                 cli_credentials_set_domain(credentials, uname, obtained);
 677                 uname = p+1;
 678         }
 679         cli_credentials_set_username(credentials, uname, obtained);
 680 }
 681
 682 /**
 683  * Specifies default values for domain, workstation and realm
 684  * from the smb.conf configuration file
 685  *
 686  * @param cred Credentials structure to fill in
 687  */
 688 void cli_credentials_set_conf(struct cli_credentials *cred)
 689 {
 690         cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
 691         cli_credentials_set_domain(cred, lp_workgroup(), CRED_UNINITIALISED);
 692         cli_credentials_set_workstation(cred, lp_netbios_name(), CRED_UNINITIALISED);
 693         cli_credentials_set_realm(cred, lp_realm(), CRED_UNINITIALISED);
 694 }
 695
 696 /**
 697  * Guess defaults for credentials from environment variables,
 698  * and from the configuration file
 699  *
 700  * @param cred Credentials structure to fill in
 701  */
 702 void cli_credentials_guess(struct cli_credentials *cred)
 703 {
 704         char *p;
 705
 706         cli_credentials_set_conf(cred);
 707
 708         if (getenv("LOGNAME")) {
 709                 cli_credentials_set_username(cred, getenv("LOGNAME"), CRED_GUESS_ENV);
 710         }
 711
 712         if (getenv("USER")) {
 713                 cli_credentials_parse_string(cred, getenv("USER"), CRED_GUESS_ENV);
 714                 if ((p = strchr_m(getenv("USER"),'%'))) {
 715                         memset(p,0,strlen(cred->password));
 716                 }
 717         }
 718
 719         if (getenv("DOMAIN")) {
 720                 cli_credentials_set_domain(cred, getenv("DOMAIN"), CRED_GUESS_ENV);
 721         }
 722
 723         if (getenv("PASSWD")) {
 724                 cli_credentials_set_password(cred, getenv("PASSWD"), CRED_GUESS_ENV);
 725         }
 726
 727         if (getenv("PASSWD_FD")) {
 728                 cli_credentials_parse_password_fd(cred, atoi(getenv("PASSWD_FD")), CRED_GUESS_FILE);
 729         }
 730
 731         if (getenv("PASSWD_FILE")) {
 732                 cli_credentials_parse_password_file(cred, getenv("PASSWD_FILE"), CRED_GUESS_FILE);
 733         }
 734
 735         cli_credentials_set_ccache(cred, NULL, CRED_GUESS_FILE);
 736 }
 737
 738 /**
 739  * Fill in credentials for the machine trust account, from the secrets database.
 740  *
 741  * @param cred Credentials structure to fill in
 742  * @retval NTSTATUS error detailing any failure
 743  */
 744 NTSTATUS cli_credentials_set_machine_account(struct cli_credentials *cred)
 745 {
 746         TALLOC_CTX *mem_ctx;
 747
 748         struct ldb_context *ldb;
 749         int ldb_ret;
 750         struct ldb_message **msgs;
 751         const char *attrs[] = {
 752                 "secret",
 753                 "samAccountName",
 754                 "flatname",
 755                 "realm",
 756                 "secureChannelType",
 757                 "ntPwdHash",
 758                 "msDS-KeyVersionNumber",
 759                 NULL
 760         };
 761
 762         const char *machine_account;
 763         const char *password;
 764         const char *domain;
 765         const char *realm;
 766         enum netr_SchannelType sct;
 767
 768         /* ok, we are going to get it now, don't recurse back here */
 769         cred->machine_account_pending = False;
 770
 771         mem_ctx = talloc_named(cred, 0, "cli_credentials fetch machine password");
 772         /* Local secrets are stored in secrets.ldb */
 773         ldb = secrets_db_connect(mem_ctx);
 774         if (!ldb) {
 775                 DEBUG(1, ("Could not open secrets.ldb\n"));
 776                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 777         }
 778
 779         /* search for the secret record */
 780         ldb_ret = gendb_search(ldb,
 781                                mem_ctx, ldb_dn_explode(mem_ctx, SECRETS_PRIMARY_DOMAIN_DN),
 782                                &msgs, attrs,
 783                                SECRETS_PRIMARY_DOMAIN_FILTER,
 784                                cli_credentials_get_domain(cred));
 785         if (ldb_ret == 0) {
 786                 DEBUG(1, ("Could not find join record to domain: %s\n",
 787                           cli_credentials_get_domain(cred)));
 788                 talloc_free(mem_ctx);
 789                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 790         } else if (ldb_ret != 1) {
 791                 DEBUG(1, ("Found more than one (%d) join records to domain: %s\n",
 792                           ldb_ret, cli_credentials_get_domain(cred)));
 793                 talloc_free(mem_ctx);
 794                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 795         }
 796
 797         password = ldb_msg_find_string(msgs[0], "secret", NULL);
 798
 799         machine_account = ldb_msg_find_string(msgs[0], "samAccountName", NULL);
 800
 801         if (!machine_account) {
 802                 DEBUG(1, ("Could not find 'samAccountName' in join record to domain: %s\n",
 803                           cli_credentials_get_domain(cred)));
 804                 talloc_free(mem_ctx);
 805                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 806         }
 807
 808         sct = ldb_msg_find_int(msgs[0], "secureChannelType", 0);
 809         if (!sct) {
 810                 DEBUG(1, ("Domain join for acocunt %s did not have a secureChannelType set!\n",
 811                           machine_account));
 812                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 813         }
 814
 815         if (!password) {
 816                 const struct ldb_val *nt_password_hash = ldb_msg_find_ldb_val(msgs[0], "ntPwdHash");
 817                 struct samr_Password hash;
 818                 ZERO_STRUCT(hash);
 819                 if (nt_password_hash) {
 820                         memcpy(hash.hash, nt_password_hash->data,
 821                                MIN(nt_password_hash->length, sizeof(hash.hash)));
 822
 823                         cli_credentials_set_nt_hash(cred, &hash, CRED_SPECIFIED);
 824                 } else {
 825
 826                         DEBUG(1, ("Could not find 'secret' in join record to domain: %s\n",
 827                                   cli_credentials_get_domain(cred)));
 828                         talloc_free(mem_ctx);
 829                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 830                 }
 831         }
 832
 833         cli_credentials_set_secure_channel_type(cred, sct);
 834
 835         domain = ldb_msg_find_string(msgs[0], "flatname", NULL);
 836         if (domain) {
 837                 cli_credentials_set_domain(cred, domain, CRED_SPECIFIED);
 838         }
 839
 840         realm = ldb_msg_find_string(msgs[0], "realm", NULL);
 841         if (realm) {
 842                 cli_credentials_set_realm(cred, realm, CRED_SPECIFIED);
 843         }
 844
 845         cli_credentials_set_username(cred, machine_account, CRED_SPECIFIED);
 846         if (password) {
 847                 cli_credentials_set_password(cred, password, CRED_SPECIFIED);
 848         }
 849
 850         cli_credentials_set_kvno(cred, ldb_msg_find_int(msgs[0], "msDS-KeyVersionNumber", 0));
 851
 852         talloc_free(mem_ctx);
 853
 854         return NT_STATUS_OK;
 855 }
 856
 857 /**
 858  * Ask that when required, the credentials system will be filled with
 859  * machine trust account, from the secrets database.
 860  *
 861  * @param cred Credentials structure to fill in
 862  * @note This function is used to call the above function after, rather
 863  *       than during, popt processing.
 864  *
 865  */
 866 void cli_credentials_set_machine_account_pending(struct cli_credentials *cred)
 867 {
 868         cred->machine_account_pending = True;
 869 }
 870
 871 /**
 872  * Attach NETLOGON credentials for use with SCHANNEL
 873  */
 874
 875 void cli_credentials_set_netlogon_creds(struct cli_credentials *cred,
 876                                         struct creds_CredentialState *netlogon_creds)
 877 {
 878         cred->netlogon_creds = talloc_reference(cred, netlogon_creds);
 879 }
 880
 881 /**
 882  * Return attached NETLOGON credentials
 883  */
 884
 885 struct creds_CredentialState *cli_credentials_get_netlogon_creds(struct cli_credentials *cred)
 886 {
 887         return cred->netlogon_creds;
 888 }
 889
 890 /**
 891  * Set NETLOGON secure channel type
 892  */
 893
 894 void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
 895                                              enum netr_SchannelType secure_channel_type)
 896 {
 897         cred->secure_channel_type = secure_channel_type;
 898 }
 899
 900 /**
 901  * Return NETLOGON secure chanel type
 902  */
 903
 904 enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred)
 905 {
 906         return cred->secure_channel_type;
 907 }
 908
 909 /**
 910  * Set Kerberos KVNO
 911  */
 912
 913 void cli_credentials_set_kvno(struct cli_credentials *cred,
 914                               int kvno)
 915 {
 916         cred->kvno = kvno;
 917 }
 918
 919 /**
 920  * Return Kerberos KVNO
 921  */
 922
 923 int cli_credentials_get_kvno(struct cli_credentials *cred)
 924 {
 925         return cred->kvno;
 926 }
 927
 928 /**
 929  * Fill in a credentials structure as the anonymous user
 930  */
 931 void cli_credentials_set_anonymous(struct cli_credentials *cred)
 932 {
 933         cli_credentials_set_username(cred, "", CRED_SPECIFIED);
 934         cli_credentials_set_domain(cred, "", CRED_SPECIFIED);
 935         cli_credentials_set_password(cred, NULL, CRED_SPECIFIED);
 936 }
 937
 938 /**
 939  * Describe a credentials context as anonymous or authenticated
 940  * @retval True if anonymous, False if a username is specified
 941  */
 942
 943 BOOL cli_credentials_is_anonymous(struct cli_credentials *cred)
 944 {
 945         TALLOC_CTX *tmp_ctx = talloc_new(cred);
 946         const char *username = cli_credentials_get_username(cred, tmp_ctx);
 947
 948         /* Yes, it is deliberate that we die if we have a NULL pointer
 949          * here - anonymous is "", not NULL, which is 'never specified,
 950          * never guessed', ie programmer bug */
 951         if (!username[0]) {
 952                 talloc_free(tmp_ctx);
 953                 return True;
 954         }
 955
 956         talloc_free(tmp_ctx);
 957         return False;
 958 }