source4/auth/credentials/credentials.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    User credentials handling
   5
   6    Copyright (C) Jelmer Vernooij 2005
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
  27 #include "auth/gensec/gensec.h"
  28 #include "libcli/auth/libcli_auth.h"
  29
  30 /**
  31  * Create a new credentials structure
  32  * @param mem_ctx TALLOC_CTX parent for credentials structure
  33  */
  34 struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
  35 {
  36         struct cli_credentials *cred = talloc(mem_ctx, struct cli_credentials);
  37         if (!cred) {
  38                 return cred;
  39         }
  40
  41         cred->netlogon_creds = NULL;
  42         cred->machine_account_pending = False;
  43         cred->workstation_obtained = CRED_UNINITIALISED;
  44         cred->username_obtained = CRED_UNINITIALISED;
  45         cred->password_obtained = CRED_UNINITIALISED;
  46         cred->domain_obtained = CRED_UNINITIALISED;
  47         cred->realm_obtained = CRED_UNINITIALISED;
  48         cred->ccache_obtained = CRED_UNINITIALISED;
  49         cred->client_gss_creds_obtained = CRED_UNINITIALISED;
  50         cred->server_gss_creds_obtained = CRED_UNINITIALISED;
  51         cred->keytab_obtained = CRED_UNINITIALISED;
  52         cred->principal_obtained = CRED_UNINITIALISED;
  53
  54         cred->old_password = NULL;
  55         cred->smb_krb5_context = NULL;
  56         cred->salt_principal = NULL;
  57         cred->machine_account = False;
  58
  59         cred->bind_dn = NULL;
  60
  61         cred->tries = 3;
  62         cred->callback_running = False;
  63
  64         cli_credentials_set_kerberos_state(cred, CRED_AUTO_USE_KERBEROS);
  65
  66         return cred;
  67 }
  68
  69 void cli_credentials_set_kerberos_state(struct cli_credentials *creds,
  70                                         enum credentials_use_kerberos use_kerberos)
  71 {
  72         creds->use_kerberos = use_kerberos;
  73 }
  74
  75 enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
  76 {
  77         return creds->use_kerberos;
  78 }
  79
  80
  81 /**
  82  * Obtain the username for this credentials context.
  83  * @param cred credentials context
  84  * @retval The username set on this context.
  85  * @note Return value will never be NULL except by programmer error.
  86  */
  87 const char *cli_credentials_get_username(struct cli_credentials *cred)
  88 {
  89         if (cred->machine_account_pending) {
  90                 cli_credentials_set_machine_account(cred);
  91         }
  92
  93         if (cred->username_obtained == CRED_CALLBACK &&
  94             !cred->callback_running) {
  95                 cred->callback_running = True;
  96                 cred->username = cred->username_cb(cred);
  97                 cred->callback_running = False;
  98                 cred->username_obtained = CRED_SPECIFIED;
  99         }
 100
 101         return cred->username;
 102 }
 103
 104 BOOL cli_credentials_set_username(struct cli_credentials *cred,
 105                                   const char *val, enum credentials_obtained obtained)
 106 {
 107         if (obtained >= cred->username_obtained) {
 108                 cred->username = talloc_strdup(cred, val);
 109                 cred->username_obtained = obtained;
 110                 return True;
 111         }
 112
 113         return False;
 114 }
 115
 116 BOOL cli_credentials_set_username_callback(struct cli_credentials *cred,
 117                                   const char *(*username_cb) (struct cli_credentials *))
 118 {
 119         if (cred->username_obtained < CRED_CALLBACK) {
 120                 cred->username_cb = username_cb;
 121                 cred->username_obtained = CRED_CALLBACK;
 122                 return True;
 123         }
 124
 125         return False;
 126 }
 127
 128 BOOL cli_credentials_set_bind_dn(struct cli_credentials *cred,
 129                                  const char *bind_dn)
 130 {
 131         cred->bind_dn = talloc_strdup(cred, bind_dn);
 132         return True;
 133 }
 134
 135 /**
 136  * Obtain the BIND DN for this credentials context.
 137  * @param cred credentials context
 138  * @retval The username set on this context.
 139  * @note Return value will be NULL if not specified explictly
 140  */
 141 const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
 142 {
 143         return cred->bind_dn;
 144 }
 145
 146
 147 /**
 148  * Obtain the client principal for this credentials context.
 149  * @param cred credentials context
 150  * @retval The username set on this context.
 151  * @note Return value will never be NULL except by programmer error.
 152  */
 153 const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
 154 {
 155         if (cred->machine_account_pending) {
 156                 cli_credentials_set_machine_account(cred);
 157         }
 158
 159         if (cred->principal_obtained == CRED_CALLBACK &&
 160             !cred->callback_running) {
 161                 cred->callback_running = True;
 162                 cred->principal = cred->principal_cb(cred);
 163                 cred->callback_running = False;
 164                 cred->principal_obtained = CRED_SPECIFIED;
 165         }
 166
 167         if (cred->principal_obtained < cred->username_obtained) {
 168                 if (cred->domain_obtained > cred->realm_obtained) {
 169                         return talloc_asprintf(mem_ctx, "%s@%s",
 170                                                cli_credentials_get_username(cred),
 171                                                cli_credentials_get_domain(cred));
 172                 } else {
 173                         return talloc_asprintf(mem_ctx, "%s@%s",
 174                                                cli_credentials_get_username(cred),
 175                                                cli_credentials_get_realm(cred));
 176                 }
 177         }
 178         return talloc_reference(mem_ctx, cred->principal);
 179 }
 180
 181 BOOL cli_credentials_set_principal(struct cli_credentials *cred,
 182                                    const char *val,
 183                                    enum credentials_obtained obtained)
 184 {
 185         if (obtained >= cred->principal_obtained) {
 186                 cred->principal = talloc_strdup(cred, val);
 187                 cred->principal_obtained = obtained;
 188                 return True;
 189         }
 190
 191         return False;
 192 }
 193
 194 /* Set a callback to get the principal.  This could be a popup dialog,
 195  * a terminal prompt or similar.  */
 196
 197 BOOL cli_credentials_set_principal_callback(struct cli_credentials *cred,
 198                                   const char *(*principal_cb) (struct cli_credentials *))
 199 {
 200         if (cred->principal_obtained < CRED_CALLBACK) {
 201                 cred->principal_cb = principal_cb;
 202                 cred->principal_obtained = CRED_CALLBACK;
 203                 return True;
 204         }
 205
 206         return False;
 207 }
 208
 209 /* Some of our tools are 'anonymous by default'.  This is a single
 210  * function to determine if authentication has been explicitly
 211  * requested */
 212
 213 BOOL cli_credentials_authentication_requested(struct cli_credentials *cred)
 214 {
 215         if (cred->bind_dn) {
 216                 return True;
 217         }
 218
 219         if (cli_credentials_is_anonymous(cred)){
 220                 return False;
 221         }
 222
 223         if (cred->principal_obtained >= CRED_SPECIFIED) {
 224                 return True;
 225         }
 226         if (cred->username_obtained >= CRED_SPECIFIED) {
 227                 return True;
 228         }
 229         return False;
 230 }
 231
 232 /**
 233  * Obtain the password for this credentials context.
 234  * @param cred credentials context
 235  * @retval If set, the cleartext password, otherwise NULL
 236  */
 237 const char *cli_credentials_get_password(struct cli_credentials *cred)
 238 {
 239         if (cred->machine_account_pending) {
 240                 cli_credentials_set_machine_account(cred);
 241         }
 242
 243         if (cred->password_obtained == CRED_CALLBACK &&
 244             !cred->callback_running) {
 245                 cred->callback_running = True;
 246                 cred->password = cred->password_cb(cred);
 247                 cred->callback_running = False;
 248                 cred->password_obtained = CRED_CALLBACK_RESULT;
 249         }
 250
 251         return cred->password;
 252 }
 253
 254 /* Set a password on the credentials context, including an indication
 255  * of 'how' the password was obtained */
 256
 257 BOOL cli_credentials_set_password(struct cli_credentials *cred,
 258                                   const char *val,
 259                                   enum credentials_obtained obtained)
 260 {
 261         if (obtained >= cred->password_obtained) {
 262                 cred->password = talloc_strdup(cred, val);
 263                 cred->password_obtained = obtained;
 264
 265                 cred->nt_hash = NULL;
 266                 return True;
 267         }
 268
 269         return False;
 270 }
 271
 272 BOOL cli_credentials_set_password_callback(struct cli_credentials *cred,
 273                                            const char *(*password_cb) (struct cli_credentials *))
 274 {
 275         if (cred->password_obtained < CRED_CALLBACK) {
 276                 cred->password_cb = password_cb;
 277                 cred->password_obtained = CRED_CALLBACK;
 278                 return True;
 279         }
 280
 281         return False;
 282 }
 283
 284 /**
 285  * Obtain the 'old' password for this credentials context (used for join accounts).
 286  * @param cred credentials context
 287  * @retval If set, the cleartext password, otherwise NULL
 288  */
 289 const char *cli_credentials_get_old_password(struct cli_credentials *cred)
 290 {
 291         if (cred->machine_account_pending) {
 292                 cli_credentials_set_machine_account(cred);
 293         }
 294
 295         return cred->old_password;
 296 }
 297
 298 BOOL cli_credentials_set_old_password(struct cli_credentials *cred,
 299                                       const char *val,
 300                                       enum credentials_obtained obtained)
 301 {
 302         cred->old_password = talloc_strdup(cred, val);
 303         return True;
 304 }
 305
 306 /**
 307  * Obtain the password, in the form MD4(unicode(password)) for this credentials context.
 308  *
 309  * Sometimes we only have this much of the password, while the rest of
 310  * the time this call avoids calling E_md4hash themselves.
 311  *
 312  * @param cred credentials context
 313  * @retval If set, the cleartext password, otherwise NULL
 314  */
 315 const struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred,
 316                                                         TALLOC_CTX *mem_ctx)
 317 {
 318         const char *password = cli_credentials_get_password(cred);
 319
 320         if (password) {
 321                 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
 322                 if (!nt_hash) {
 323                         return NULL;
 324                 }
 325
 326                 E_md4hash(password, nt_hash->hash);
 327
 328                 return nt_hash;
 329         } else {
 330                 return cred->nt_hash;
 331         }
 332 }
 333
 334 BOOL cli_credentials_set_nt_hash(struct cli_credentials *cred,
 335                                  const struct samr_Password *nt_hash,
 336                                  enum credentials_obtained obtained)
 337 {
 338         if (obtained >= cred->password_obtained) {
 339                 cli_credentials_set_password(cred, NULL, obtained);
 340                 cred->nt_hash = talloc(cred, struct samr_Password);
 341                 *cred->nt_hash = *nt_hash;
 342                 return True;
 343         }
 344
 345         return False;
 346 }
 347
 348 /**
 349  * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
 350  * @param cred credentials context
 351  * @retval The domain set on this context.
 352  * @note Return value will never be NULL except by programmer error.
 353  */
 354 const char *cli_credentials_get_domain(struct cli_credentials *cred)
 355 {
 356         if (cred->machine_account_pending) {
 357                 cli_credentials_set_machine_account(cred);
 358         }
 359
 360         if (cred->domain_obtained == CRED_CALLBACK &&
 361             !cred->callback_running) {
 362                 cred->callback_running = True;
 363                 cred->domain = cred->domain_cb(cred);
 364                 cred->callback_running = False;
 365                 cred->domain_obtained = CRED_SPECIFIED;
 366         }
 367
 368         return cred->domain;
 369 }
 370
 371
 372 BOOL cli_credentials_set_domain(struct cli_credentials *cred,
 373                                 const char *val,
 374                                 enum credentials_obtained obtained)
 375 {
 376         if (obtained >= cred->domain_obtained) {
 377                 /* it is important that the domain be in upper case,
 378                  * particularly for the sensitive NTLMv2
 379                  * calculations */
 380                 cred->domain = strupper_talloc(cred, val);
 381                 cred->domain_obtained = obtained;
 382                 return True;
 383         }
 384
 385         return False;
 386 }
 387
 388 BOOL cli_credentials_set_domain_callback(struct cli_credentials *cred,
 389                                          const char *(*domain_cb) (struct cli_credentials *))
 390 {
 391         if (cred->domain_obtained < CRED_CALLBACK) {
 392                 cred->domain_cb = domain_cb;
 393                 cred->domain_obtained = CRED_CALLBACK;
 394                 return True;
 395         }
 396
 397         return False;
 398 }
 399
 400 /**
 401  * Obtain the Kerberos realm for this credentials context.
 402  * @param cred credentials context
 403  * @retval The realm set on this context.
 404  * @note Return value will never be NULL except by programmer error.
 405  */
 406 const char *cli_credentials_get_realm(struct cli_credentials *cred)
 407 {
 408         if (cred->machine_account_pending) {
 409                 cli_credentials_set_machine_account(cred);
 410         }
 411
 412         if (cred->realm_obtained == CRED_CALLBACK &&
 413             !cred->callback_running) {
 414                 cred->callback_running = True;
 415                 cred->realm = cred->realm_cb(cred);
 416                 cred->callback_running = False;
 417                 cred->realm_obtained = CRED_SPECIFIED;
 418         }
 419
 420         return cred->realm;
 421 }
 422
 423 /**
 424  * Set the realm for this credentials context, and force it to
 425  * uppercase for the sainity of our local kerberos libraries
 426  */
 427 BOOL cli_credentials_set_realm(struct cli_credentials *cred,
 428                                const char *val,
 429                                enum credentials_obtained obtained)
 430 {
 431         if (obtained >= cred->realm_obtained) {
 432                 cred->realm = strupper_talloc(cred, val);
 433                 cred->realm_obtained = obtained;
 434                 return True;
 435         }
 436
 437         return False;
 438 }
 439
 440 BOOL cli_credentials_set_realm_callback(struct cli_credentials *cred,
 441                                         const char *(*realm_cb) (struct cli_credentials *))
 442 {
 443         if (cred->realm_obtained < CRED_CALLBACK) {
 444                 cred->realm_cb = realm_cb;
 445                 cred->realm_obtained = CRED_CALLBACK;
 446                 return True;
 447         }
 448
 449         return False;
 450 }
 451
 452 /**
 453  * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
 454  *
 455  * @param cred credentials context
 456  * @retval The workstation name set on this context.
 457  * @note Return value will never be NULL except by programmer error.
 458  */
 459 const char *cli_credentials_get_workstation(struct cli_credentials *cred)
 460 {
 461         if (cred->workstation_obtained == CRED_CALLBACK &&
 462             !cred->callback_running) {
 463                 cred->callback_running = True;
 464                 cred->workstation = cred->workstation_cb(cred);
 465                 cred->callback_running = False;
 466                 cred->workstation_obtained = CRED_SPECIFIED;
 467         }
 468
 469         return cred->workstation;
 470 }
 471
 472 BOOL cli_credentials_set_workstation(struct cli_credentials *cred,
 473                                      const char *val,
 474                                      enum credentials_obtained obtained)
 475 {
 476         if (obtained >= cred->workstation_obtained) {
 477                 cred->workstation = talloc_strdup(cred, val);
 478                 cred->workstation_obtained = obtained;
 479                 return True;
 480         }
 481
 482         return False;
 483 }
 484
 485 BOOL cli_credentials_set_workstation_callback(struct cli_credentials *cred,
 486                                               const char *(*workstation_cb) (struct cli_credentials *))
 487 {
 488         if (cred->workstation_obtained < CRED_CALLBACK) {
 489                 cred->workstation_cb = workstation_cb;
 490                 cred->workstation_obtained = CRED_CALLBACK;
 491                 return True;
 492         }
 493
 494         return False;
 495 }
 496
 497 /**
 498  * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
 499  *
 500  * The format accepted is [domain\\]user[%password] or user[@realm][%password]
 501  *
 502  * @param credentials Credentials structure on which to set the password
 503  * @param data the string containing the username, password etc
 504  * @param obtained This enum describes how 'specified' this password is
 505  */
 506
 507 void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained)
 508 {
 509         char *uname, *p;
 510
 511         if (strcmp("%",data) == 0) {
 512                 cli_credentials_set_anonymous(credentials);
 513                 return;
 514         }
 515
 516         uname = talloc_strdup(credentials, data);
 517         if ((p = strchr_m(uname,'%'))) {
 518                 *p = 0;
 519                 cli_credentials_set_password(credentials, p+1, obtained);
 520         }
 521
 522         if ((p = strchr_m(uname,'@'))) {
 523                 cli_credentials_set_principal(credentials, uname, obtained);
 524                 *p = 0;
 525                 cli_credentials_set_realm(credentials, p+1, obtained);
 526                 return;
 527         } else if ((p = strchr_m(uname,'\\')) || (p = strchr_m(uname, '/'))) {
 528                 *p = 0;
 529                 cli_credentials_set_domain(credentials, uname, obtained);
 530                 uname = p+1;
 531         }
 532         cli_credentials_set_username(credentials, uname, obtained);
 533 }
 534
 535 /**
 536  * Given a a credentials structure, print it as a string
 537  *
 538  * The format output is [domain\\]user[%password] or user[@realm][%password]
 539  *
 540  * @param credentials Credentials structure on which to set the password
 541  * @param mem_ctx The memory context to place the result on
 542  */
 543
 544 const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
 545 {
 546         const char *bind_dn = cli_credentials_get_bind_dn(credentials);
 547         const char *domain;
 548         const char *username;
 549         const char *name;
 550
 551         if (bind_dn) {
 552                 name = talloc_reference(mem_ctx, bind_dn);
 553         } else {
 554                 cli_credentials_get_ntlm_username_domain(credentials, mem_ctx, &username, &domain);
 555                 if (domain && domain[0]) {
 556                         name = talloc_asprintf(mem_ctx, "%s\\%s",
 557                                                domain, username);
 558                 } else {
 559                         name = talloc_asprintf(mem_ctx, "%s",
 560                                                username);
 561                 }
 562         }
 563         return name;
 564 }
 565
 566 /**
 567  * Specifies default values for domain, workstation and realm
 568  * from the smb.conf configuration file
 569  *
 570  * @param cred Credentials structure to fill in
 571  */
 572 void cli_credentials_set_conf(struct cli_credentials *cred)
 573 {
 574         cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
 575         cli_credentials_set_domain(cred, lp_workgroup(), CRED_UNINITIALISED);
 576         cli_credentials_set_workstation(cred, lp_netbios_name(), CRED_UNINITIALISED);
 577         cli_credentials_set_realm(cred, lp_realm(), CRED_UNINITIALISED);
 578 }
 579
 580 /**
 581  * Guess defaults for credentials from environment variables,
 582  * and from the configuration file
 583  *
 584  * @param cred Credentials structure to fill in
 585  */
 586 void cli_credentials_guess(struct cli_credentials *cred)
 587 {
 588         char *p;
 589
 590         cli_credentials_set_conf(cred);
 591
 592         if (getenv("LOGNAME")) {
 593                 cli_credentials_set_username(cred, getenv("LOGNAME"), CRED_GUESS_ENV);
 594         }
 595
 596         if (getenv("USER")) {
 597                 cli_credentials_parse_string(cred, getenv("USER"), CRED_GUESS_ENV);
 598                 if ((p = strchr_m(getenv("USER"),'%'))) {
 599                         memset(p,0,strlen(cred->password));
 600                 }
 601         }
 602
 603         if (getenv("DOMAIN")) {
 604                 cli_credentials_set_domain(cred, getenv("DOMAIN"), CRED_GUESS_ENV);
 605         }
 606
 607         if (getenv("PASSWD")) {
 608                 cli_credentials_set_password(cred, getenv("PASSWD"), CRED_GUESS_ENV);
 609         }
 610
 611         if (getenv("PASSWD_FD")) {
 612                 cli_credentials_parse_password_fd(cred, atoi(getenv("PASSWD_FD")), CRED_GUESS_FILE);
 613         }
 614
 615         if (getenv("PASSWD_FILE")) {
 616                 cli_credentials_parse_password_file(cred, getenv("PASSWD_FILE"), CRED_GUESS_FILE);
 617         }
 618
 619         if (cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) {
 620                 cli_credentials_set_ccache(cred, NULL, CRED_GUESS_FILE);
 621         }
 622 }
 623
 624 /**
 625  * Attach NETLOGON credentials for use with SCHANNEL
 626  */
 627
 628 void cli_credentials_set_netlogon_creds(struct cli_credentials *cred,
 629                                         struct creds_CredentialState *netlogon_creds)
 630 {
 631         cred->netlogon_creds = talloc_reference(cred, netlogon_creds);
 632 }
 633
 634 /**
 635  * Return attached NETLOGON credentials
 636  */
 637
 638 struct creds_CredentialState *cli_credentials_get_netlogon_creds(struct cli_credentials *cred)
 639 {
 640         return cred->netlogon_creds;
 641 }
 642
 643 /**
 644  * Set NETLOGON secure channel type
 645  */
 646
 647 void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
 648                                              enum netr_SchannelType secure_channel_type)
 649 {
 650         cred->secure_channel_type = secure_channel_type;
 651 }
 652
 653 /**
 654  * Return NETLOGON secure chanel type
 655  */
 656
 657 enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred)
 658 {
 659         return cred->secure_channel_type;
 660 }
 661
 662 /**
 663  * Fill in a credentials structure as the anonymous user
 664  */
 665 void cli_credentials_set_anonymous(struct cli_credentials *cred)
 666 {
 667         cli_credentials_set_username(cred, "", CRED_SPECIFIED);
 668         cli_credentials_set_domain(cred, "", CRED_SPECIFIED);
 669         cli_credentials_set_password(cred, NULL, CRED_SPECIFIED);
 670 }
 671
 672 /**
 673  * Describe a credentials context as anonymous or authenticated
 674  * @retval True if anonymous, False if a username is specified
 675  */
 676
 677 BOOL cli_credentials_is_anonymous(struct cli_credentials *cred)
 678 {
 679         const char *username;
 680
 681         if (cred->machine_account_pending) {
 682                 cli_credentials_set_machine_account(cred);
 683         }
 684
 685         username = cli_credentials_get_username(cred);
 686
 687         /* Yes, it is deliberate that we die if we have a NULL pointer
 688          * here - anonymous is "", not NULL, which is 'never specified,
 689          * never guessed', ie programmer bug */
 690         if (!username[0]) {
 691                 return True;
 692         }
 693
 694         return False;
 695 }
 696
 697 /**
 698  * Mark the current password for a credentials struct as wrong. This will
 699  * cause the password to be prompted again (if a callback is set).
 700  *
 701  * This will decrement the number of times the password can be tried.
 702  *
 703  * @retval whether the credentials struct is finished
 704  */
 705 BOOL cli_credentials_wrong_password(struct cli_credentials *cred)
 706 {
 707         if (cred->password_obtained != CRED_CALLBACK_RESULT) {
 708                 return False;
 709         }
 710
 711         cred->password_obtained = CRED_CALLBACK;
 712
 713         cred->tries--;
 714
 715         return (cred->tries > 0);
 716 }