source3/libsmb/cliconnect.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client connect/disconnect routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Andrew Bartlett 2001-2003
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23 #include "../libcli/auth/spnego.h"
  24 #include "smb_krb5.h"
  25
  26 static const struct {
  27         int prot;
  28         const char name[24];
  29 } prots[10] = {
  30         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
  31         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
  32         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
  33         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
  34         {PROTOCOL_LANMAN2,      "LM1.2X002"},
  35         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
  36         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
  37         {PROTOCOL_LANMAN2,      "Samba"},
  38         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
  39         {PROTOCOL_NT1,          "NT LM 0.12"},
  40 };
  41
  42 #define STAR_SMBSERVER "*SMBSERVER"
  43
  44 /**
  45  * Set the user session key for a connection
  46  * @param cli The cli structure to add it too
  47  * @param session_key The session key used.  (A copy of this is taken for the cli struct)
  48  *
  49  */
  50
  51 static void cli_set_session_key (struct cli_state *cli, const DATA_BLOB session_key)
  52 {
  53         cli->user_session_key = data_blob(session_key.data, session_key.length);
  54 }
  55
  56 /****************************************************************************
  57  Do an old lanman2 style session setup.
  58 ****************************************************************************/
  59
  60 static NTSTATUS cli_session_setup_lanman2(struct cli_state *cli,
  61                                           const char *user,
  62                                           const char *pass, size_t passlen,
  63                                           const char *workgroup)
  64 {
  65         DATA_BLOB session_key = data_blob_null;
  66         DATA_BLOB lm_response = data_blob_null;
  67         NTSTATUS status;
  68         fstring pword;
  69         char *p;
  70
  71         if (passlen > sizeof(pword)-1) {
  72                 return NT_STATUS_INVALID_PARAMETER;
  73         }
  74
  75         /* LANMAN servers predate NT status codes and Unicode and ignore those
  76            smb flags so we must disable the corresponding default capabilities
  77            that would otherwise cause the Unicode and NT Status flags to be
  78            set (and even returned by the server) */
  79
  80         cli->capabilities &= ~(CAP_UNICODE | CAP_STATUS32);
  81
  82         /* if in share level security then don't send a password now */
  83         if (!(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL))
  84                 passlen = 0;
  85
  86         if (passlen > 0 && (cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen != 24) {
  87                 /* Encrypted mode needed, and non encrypted password supplied. */
  88                 lm_response = data_blob(NULL, 24);
  89                 if (!SMBencrypt(pass, cli->secblob.data,(uchar *)lm_response.data)) {
  90                         DEBUG(1, ("Password is > 14 chars in length, and is therefore incompatible with Lanman authentication\n"));
  91                         return NT_STATUS_ACCESS_DENIED;
  92                 }
  93         } else if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && passlen == 24) {
  94                 /* Encrypted mode needed, and encrypted password supplied. */
  95                 lm_response = data_blob(pass, passlen);
  96         } else if (passlen > 0) {
  97                 /* Plaintext mode needed, assume plaintext supplied. */
  98                 passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE);
  99                 lm_response = data_blob(pass, passlen);
 100         }
 101
 102         /* send a session setup command */
 103         memset(cli->outbuf,'\0',smb_size);
 104         cli_set_message(cli->outbuf,10, 0, True);
 105         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 106         cli_setup_packet(cli);
 107
 108         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 109         SSVAL(cli->outbuf,smb_vwv2,cli->max_xmit);
 110         SSVAL(cli->outbuf,smb_vwv3,2);
 111         SSVAL(cli->outbuf,smb_vwv4,1);
 112         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 113         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 114
 115         p = smb_buf(cli->outbuf);
 116         memcpy(p,lm_response.data,lm_response.length);
 117         p += lm_response.length;
 118         p += clistr_push(cli, p, user, -1, STR_TERMINATE|STR_UPPER);
 119         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 120         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 121         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 122         cli_setup_bcc(cli, p);
 123
 124         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 125                 return cli_nt_error(cli);
 126         }
 127
 128         show_msg(cli->inbuf);
 129
 130         if (cli_is_error(cli)) {
 131                 return cli_nt_error(cli);
 132         }
 133
 134         /* use the returned vuid from now on */
 135         cli->vuid = SVAL(cli->inbuf,smb_uid);
 136         status = cli_set_username(cli, user);
 137         if (!NT_STATUS_IS_OK(status)) {
 138                 return status;
 139         }
 140
 141         if (session_key.data) {
 142                 /* Have plaintext orginal */
 143                 cli_set_session_key(cli, session_key);
 144         }
 145
 146         return NT_STATUS_OK;
 147 }
 148
 149 /****************************************************************************
 150  Work out suitable capabilities to offer the server.
 151 ****************************************************************************/
 152
 153 static uint32 cli_session_setup_capabilities(struct cli_state *cli)
 154 {
 155         uint32 capabilities = CAP_NT_SMBS;
 156
 157         if (!cli->force_dos_errors)
 158                 capabilities |= CAP_STATUS32;
 159
 160         if (cli->use_level_II_oplocks)
 161                 capabilities |= CAP_LEVEL_II_OPLOCKS;
 162
 163         capabilities |= (cli->capabilities & (CAP_UNICODE|CAP_LARGE_FILES|CAP_LARGE_READX|CAP_LARGE_WRITEX|CAP_DFS));
 164         return capabilities;
 165 }
 166
 167 /****************************************************************************
 168  Do a NT1 guest session setup.
 169 ****************************************************************************/
 170
 171 struct cli_session_setup_guest_state {
 172         struct cli_state *cli;
 173         uint16_t vwv[16];
 174         struct iovec bytes;
 175 };
 176
 177 static void cli_session_setup_guest_done(struct tevent_req *subreq);
 178
 179 struct tevent_req *cli_session_setup_guest_create(TALLOC_CTX *mem_ctx,
 180                                                   struct event_context *ev,
 181                                                   struct cli_state *cli,
 182                                                   struct tevent_req **psmbreq)
 183 {
 184         struct tevent_req *req, *subreq;
 185         struct cli_session_setup_guest_state *state;
 186         uint16_t *vwv;
 187         uint8_t *bytes;
 188
 189         req = tevent_req_create(mem_ctx, &state,
 190                                 struct cli_session_setup_guest_state);
 191         if (req == NULL) {
 192                 return NULL;
 193         }
 194         state->cli = cli;
 195         vwv = state->vwv;
 196
 197         SCVAL(vwv+0, 0, 0xFF);
 198         SCVAL(vwv+0, 1, 0);
 199         SSVAL(vwv+1, 0, 0);
 200         SSVAL(vwv+2, 0, CLI_BUFFER_SIZE);
 201         SSVAL(vwv+3, 0, 2);
 202         SSVAL(vwv+4, 0, cli->pid);
 203         SIVAL(vwv+5, 0, cli->sesskey);
 204         SSVAL(vwv+7, 0, 0);
 205         SSVAL(vwv+8, 0, 0);
 206         SSVAL(vwv+9, 0, 0);
 207         SSVAL(vwv+10, 0, 0);
 208         SIVAL(vwv+11, 0, cli_session_setup_capabilities(cli));
 209
 210         bytes = talloc_array(state, uint8_t, 0);
 211
 212         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "",  1, /* username */
 213                                    NULL);
 214         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "", 1, /* workgroup */
 215                                    NULL);
 216         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Unix", 5, NULL);
 217         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), "Samba", 6, NULL);
 218
 219         if (bytes == NULL) {
 220                 TALLOC_FREE(req);
 221                 return NULL;
 222         }
 223
 224         state->bytes.iov_base = (void *)bytes;
 225         state->bytes.iov_len = talloc_get_size(bytes);
 226
 227         subreq = cli_smb_req_create(state, ev, cli, SMBsesssetupX, 0, 13, vwv,
 228                                     1, &state->bytes);
 229         if (subreq == NULL) {
 230                 TALLOC_FREE(req);
 231                 return NULL;
 232         }
 233         tevent_req_set_callback(subreq, cli_session_setup_guest_done, req);
 234         *psmbreq = subreq;
 235         return req;
 236 }
 237
 238 struct tevent_req *cli_session_setup_guest_send(TALLOC_CTX *mem_ctx,
 239                                                 struct event_context *ev,
 240                                                 struct cli_state *cli)
 241 {
 242         struct tevent_req *req, *subreq;
 243         NTSTATUS status;
 244
 245         req = cli_session_setup_guest_create(mem_ctx, ev, cli, &subreq);
 246         if (req == NULL) {
 247                 return NULL;
 248         }
 249
 250         status = cli_smb_req_send(subreq);
 251         if (NT_STATUS_IS_OK(status)) {
 252                 tevent_req_nterror(req, status);
 253                 return tevent_req_post(req, ev);
 254         }
 255         return req;
 256 }
 257
 258 static void cli_session_setup_guest_done(struct tevent_req *subreq)
 259 {
 260         struct tevent_req *req = tevent_req_callback_data(
 261                 subreq, struct tevent_req);
 262         struct cli_session_setup_guest_state *state = tevent_req_data(
 263                 req, struct cli_session_setup_guest_state);
 264         struct cli_state *cli = state->cli;
 265         uint32_t num_bytes;
 266         char *inbuf;
 267         uint8_t *bytes;
 268         uint8_t *p;
 269         NTSTATUS status;
 270
 271         status = cli_smb_recv(subreq, 0, NULL, NULL, &num_bytes, &bytes);
 272         if (!NT_STATUS_IS_OK(status)) {
 273                 TALLOC_FREE(subreq);
 274                 tevent_req_nterror(req, status);
 275                 return;
 276         }
 277
 278         inbuf = (char *)cli_smb_inbuf(subreq);
 279         p = bytes;
 280
 281         cli->vuid = SVAL(inbuf, smb_uid);
 282
 283         p += clistr_pull(inbuf, cli->server_os, (char *)p, sizeof(fstring),
 284                          bytes+num_bytes-p, STR_TERMINATE);
 285         p += clistr_pull(inbuf, cli->server_type, (char *)p, sizeof(fstring),
 286                          bytes+num_bytes-p, STR_TERMINATE);
 287         p += clistr_pull(inbuf, cli->server_domain, (char *)p, sizeof(fstring),
 288                          bytes+num_bytes-p, STR_TERMINATE);
 289
 290         if (strstr(cli->server_type, "Samba")) {
 291                 cli->is_samba = True;
 292         }
 293
 294         TALLOC_FREE(subreq);
 295
 296         status = cli_set_username(cli, "");
 297         if (!NT_STATUS_IS_OK(status)) {
 298                 tevent_req_nterror(req, status);
 299                 return;
 300         }
 301         tevent_req_done(req);
 302 }
 303
 304 NTSTATUS cli_session_setup_guest_recv(struct tevent_req *req)
 305 {
 306         return tevent_req_simple_recv_ntstatus(req);
 307 }
 308
 309 static NTSTATUS cli_session_setup_guest(struct cli_state *cli)
 310 {
 311         TALLOC_CTX *frame = talloc_stackframe();
 312         struct event_context *ev;
 313         struct tevent_req *req;
 314         NTSTATUS status = NT_STATUS_OK;
 315
 316         if (cli_has_async_calls(cli)) {
 317                 /*
 318                  * Can't use sync call while an async call is in flight
 319                  */
 320                 status = NT_STATUS_INVALID_PARAMETER;
 321                 goto fail;
 322         }
 323
 324         ev = event_context_init(frame);
 325         if (ev == NULL) {
 326                 status = NT_STATUS_NO_MEMORY;
 327                 goto fail;
 328         }
 329
 330         req = cli_session_setup_guest_send(frame, ev, cli);
 331         if (req == NULL) {
 332                 status = NT_STATUS_NO_MEMORY;
 333                 goto fail;
 334         }
 335
 336         if (!tevent_req_poll(req, ev)) {
 337                 status = map_nt_error_from_unix(errno);
 338                 goto fail;
 339         }
 340
 341         status = cli_session_setup_guest_recv(req);
 342  fail:
 343         TALLOC_FREE(frame);
 344         if (!NT_STATUS_IS_OK(status)) {
 345                 cli_set_error(cli, status);
 346         }
 347         return status;
 348 }
 349
 350 /****************************************************************************
 351  Do a NT1 plaintext session setup.
 352 ****************************************************************************/
 353
 354 static NTSTATUS cli_session_setup_plaintext(struct cli_state *cli,
 355                                             const char *user, const char *pass,
 356                                             const char *workgroup)
 357 {
 358         uint32 capabilities = cli_session_setup_capabilities(cli);
 359         char *p;
 360         NTSTATUS status;
 361         fstring lanman;
 362
 363         fstr_sprintf( lanman, "Samba %s", samba_version_string());
 364
 365         memset(cli->outbuf, '\0', smb_size);
 366         cli_set_message(cli->outbuf,13,0,True);
 367         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 368         cli_setup_packet(cli);
 369
 370         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 371         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 372         SSVAL(cli->outbuf,smb_vwv3,2);
 373         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 374         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 375         SSVAL(cli->outbuf,smb_vwv8,0);
 376         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 377         p = smb_buf(cli->outbuf);
 378
 379         /* check wether to send the ASCII or UNICODE version of the password */
 380
 381         if ( (capabilities & CAP_UNICODE) == 0 ) {
 382                 p += clistr_push(cli, p, pass, -1, STR_TERMINATE); /* password */
 383                 SSVAL(cli->outbuf,smb_vwv7,PTR_DIFF(p, smb_buf(cli->outbuf)));
 384         }
 385         else {
 386                 /* For ucs2 passwords clistr_push calls ucs2_align, which causes
 387                  * the space taken by the unicode password to be one byte too
 388                  * long (as we're on an odd byte boundary here). Reduce the
 389                  * count by 1 to cope with this. Fixes smbclient against NetApp
 390                  * servers which can't cope. Fix from
 391                  * bryan.kolodziej@allenlund.com in bug #3840.
 392                  */
 393                 p += clistr_push(cli, p, pass, -1, STR_UNICODE|STR_TERMINATE); /* unicode password */
 394                 SSVAL(cli->outbuf,smb_vwv8,PTR_DIFF(p, smb_buf(cli->outbuf))-1);
 395         }
 396
 397         p += clistr_push(cli, p, user, -1, STR_TERMINATE); /* username */
 398         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE); /* workgroup */
 399         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 400         p += clistr_push(cli, p, lanman, -1, STR_TERMINATE);
 401         cli_setup_bcc(cli, p);
 402
 403         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 404                 return cli_nt_error(cli);
 405         }
 406
 407         show_msg(cli->inbuf);
 408
 409         if (cli_is_error(cli)) {
 410                 return cli_nt_error(cli);
 411         }
 412
 413         cli->vuid = SVAL(cli->inbuf,smb_uid);
 414         p = smb_buf(cli->inbuf);
 415         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 416                          -1, STR_TERMINATE);
 417         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 418                          -1, STR_TERMINATE);
 419         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 420                          -1, STR_TERMINATE);
 421         status = cli_set_username(cli, user);
 422         if (!NT_STATUS_IS_OK(status)) {
 423                 return status;
 424         }
 425         if (strstr(cli->server_type, "Samba")) {
 426                 cli->is_samba = True;
 427         }
 428
 429         return NT_STATUS_OK;
 430 }
 431
 432 /****************************************************************************
 433    do a NT1 NTLM/LM encrypted session setup - for when extended security
 434    is not negotiated.
 435    @param cli client state to create do session setup on
 436    @param user username
 437    @param pass *either* cleartext password (passlen !=24) or LM response.
 438    @param ntpass NT response, implies ntpasslen >=24, implies pass is not clear
 439    @param workgroup The user's domain.
 440 ****************************************************************************/
 441
 442 static NTSTATUS cli_session_setup_nt1(struct cli_state *cli, const char *user,
 443                                       const char *pass, size_t passlen,
 444                                       const char *ntpass, size_t ntpasslen,
 445                                       const char *workgroup)
 446 {
 447         uint32 capabilities = cli_session_setup_capabilities(cli);
 448         DATA_BLOB lm_response = data_blob_null;
 449         DATA_BLOB nt_response = data_blob_null;
 450         DATA_BLOB session_key = data_blob_null;
 451         NTSTATUS result;
 452         char *p;
 453         bool ok;
 454
 455         if (passlen == 0) {
 456                 /* do nothing - guest login */
 457         } else if (passlen != 24) {
 458                 if (lp_client_ntlmv2_auth()) {
 459                         DATA_BLOB server_chal;
 460                         DATA_BLOB names_blob;
 461                         server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
 462
 463                         /* note that the 'workgroup' here is a best guess - we don't know
 464                            the server's domain at this point.  The 'server name' is also
 465                            dodgy...
 466                         */
 467                         names_blob = NTLMv2_generate_names_blob(NULL, cli->called.name, workgroup);
 468
 469                         if (!SMBNTLMv2encrypt(NULL, user, workgroup, pass, &server_chal,
 470                                               &names_blob,
 471                                               &lm_response, &nt_response, NULL, &session_key)) {
 472                                 data_blob_free(&names_blob);
 473                                 data_blob_free(&server_chal);
 474                                 return NT_STATUS_ACCESS_DENIED;
 475                         }
 476                         data_blob_free(&names_blob);
 477                         data_blob_free(&server_chal);
 478
 479                 } else {
 480                         uchar nt_hash[16];
 481                         E_md4hash(pass, nt_hash);
 482
 483 #ifdef LANMAN_ONLY
 484                         nt_response = data_blob_null;
 485 #else
 486                         nt_response = data_blob(NULL, 24);
 487                         SMBNTencrypt(pass,cli->secblob.data,nt_response.data);
 488 #endif
 489                         /* non encrypted password supplied. Ignore ntpass. */
 490                         if (lp_client_lanman_auth()) {
 491                                 lm_response = data_blob(NULL, 24);
 492                                 if (!SMBencrypt(pass,cli->secblob.data, lm_response.data)) {
 493                                         /* Oops, the LM response is invalid, just put
 494                                            the NT response there instead */
 495                                         data_blob_free(&lm_response);
 496                                         lm_response = data_blob(nt_response.data, nt_response.length);
 497                                 }
 498                         } else {
 499                                 /* LM disabled, place NT# in LM field instead */
 500                                 lm_response = data_blob(nt_response.data, nt_response.length);
 501                         }
 502
 503                         session_key = data_blob(NULL, 16);
 504 #ifdef LANMAN_ONLY
 505                         E_deshash(pass, session_key.data);
 506                         memset(&session_key.data[8], '\0', 8);
 507 #else
 508                         SMBsesskeygen_ntv1(nt_hash, session_key.data);
 509 #endif
 510                 }
 511                 cli_temp_set_signing(cli);
 512         } else {
 513                 /* pre-encrypted password supplied.  Only used for
 514                    security=server, can't do
 515                    signing because we don't have original key */
 516
 517                 lm_response = data_blob(pass, passlen);
 518                 nt_response = data_blob(ntpass, ntpasslen);
 519         }
 520
 521         /* send a session setup command */
 522         memset(cli->outbuf,'\0',smb_size);
 523
 524         cli_set_message(cli->outbuf,13,0,True);
 525         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 526         cli_setup_packet(cli);
 527
 528         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 529         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 530         SSVAL(cli->outbuf,smb_vwv3,2);
 531         SSVAL(cli->outbuf,smb_vwv4,cli->pid);
 532         SIVAL(cli->outbuf,smb_vwv5,cli->sesskey);
 533         SSVAL(cli->outbuf,smb_vwv7,lm_response.length);
 534         SSVAL(cli->outbuf,smb_vwv8,nt_response.length);
 535         SIVAL(cli->outbuf,smb_vwv11,capabilities);
 536         p = smb_buf(cli->outbuf);
 537         if (lm_response.length) {
 538                 memcpy(p,lm_response.data, lm_response.length); p += lm_response.length;
 539         }
 540         if (nt_response.length) {
 541                 memcpy(p,nt_response.data, nt_response.length); p += nt_response.length;
 542         }
 543         p += clistr_push(cli, p, user, -1, STR_TERMINATE);
 544
 545         /* Upper case here might help some NTLMv2 implementations */
 546         p += clistr_push(cli, p, workgroup, -1, STR_TERMINATE|STR_UPPER);
 547         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 548         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 549         cli_setup_bcc(cli, p);
 550
 551         if (!cli_send_smb(cli) || !cli_receive_smb(cli)) {
 552                 result = cli_nt_error(cli);
 553                 goto end;
 554         }
 555
 556         /* show_msg(cli->inbuf); */
 557
 558         if (cli_is_error(cli)) {
 559                 result = cli_nt_error(cli);
 560                 goto end;
 561         }
 562
 563 #ifdef LANMAN_ONLY
 564         ok = cli_simple_set_signing(cli, session_key, lm_response);
 565 #else
 566         ok = cli_simple_set_signing(cli, session_key, nt_response);
 567 #endif
 568         if (ok) {
 569                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 570                         result = NT_STATUS_ACCESS_DENIED;
 571                         goto end;
 572                 }
 573         }
 574
 575         /* use the returned vuid from now on */
 576         cli->vuid = SVAL(cli->inbuf,smb_uid);
 577
 578         p = smb_buf(cli->inbuf);
 579         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 580                          -1, STR_TERMINATE);
 581         p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 582                          -1, STR_TERMINATE);
 583         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 584                          -1, STR_TERMINATE);
 585
 586         if (strstr(cli->server_type, "Samba")) {
 587                 cli->is_samba = True;
 588         }
 589
 590         result = cli_set_username(cli, user);
 591         if (!NT_STATUS_IS_OK(result)) {
 592                 goto end;
 593         }
 594
 595         if (session_key.data) {
 596                 /* Have plaintext orginal */
 597                 cli_set_session_key(cli, session_key);
 598         }
 599
 600         result = NT_STATUS_OK;
 601 end:
 602         data_blob_free(&lm_response);
 603         data_blob_free(&nt_response);
 604         data_blob_free(&session_key);
 605         return result;
 606 }
 607
 608 /****************************************************************************
 609  Send a extended security session setup blob
 610 ****************************************************************************/
 611
 612 static bool cli_session_setup_blob_send(struct cli_state *cli, DATA_BLOB blob)
 613 {
 614         uint32 capabilities = cli_session_setup_capabilities(cli);
 615         char *p;
 616
 617         capabilities |= CAP_EXTENDED_SECURITY;
 618
 619         /* send a session setup command */
 620         memset(cli->outbuf,'\0',smb_size);
 621
 622         cli_set_message(cli->outbuf,12,0,True);
 623         SCVAL(cli->outbuf,smb_com,SMBsesssetupX);
 624
 625         cli_setup_packet(cli);
 626
 627         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 628         SSVAL(cli->outbuf,smb_vwv2,CLI_BUFFER_SIZE);
 629         SSVAL(cli->outbuf,smb_vwv3,2);
 630         SSVAL(cli->outbuf,smb_vwv4,1);
 631         SIVAL(cli->outbuf,smb_vwv5,0);
 632         SSVAL(cli->outbuf,smb_vwv7,blob.length);
 633         SIVAL(cli->outbuf,smb_vwv10,capabilities);
 634         p = smb_buf(cli->outbuf);
 635         memcpy(p, blob.data, blob.length);
 636         p += blob.length;
 637         p += clistr_push(cli, p, "Unix", -1, STR_TERMINATE);
 638         p += clistr_push(cli, p, "Samba", -1, STR_TERMINATE);
 639         cli_setup_bcc(cli, p);
 640         return cli_send_smb(cli);
 641 }
 642
 643 /****************************************************************************
 644  Send a extended security session setup blob, returning a reply blob.
 645 ****************************************************************************/
 646
 647 static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli)
 648 {
 649         DATA_BLOB blob2 = data_blob_null;
 650         char *p;
 651         size_t len;
 652
 653         if (!cli_receive_smb(cli))
 654                 return blob2;
 655
 656         show_msg(cli->inbuf);
 657
 658         if (cli_is_error(cli) && !NT_STATUS_EQUAL(cli_nt_error(cli),
 659                                                   NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 660                 return blob2;
 661         }
 662
 663         /* use the returned vuid from now on */
 664         cli->vuid = SVAL(cli->inbuf,smb_uid);
 665
 666         p = smb_buf(cli->inbuf);
 667
 668         blob2 = data_blob(p, SVAL(cli->inbuf, smb_vwv3));
 669
 670         p += blob2.length;
 671         p += clistr_pull(cli->inbuf, cli->server_os, p, sizeof(fstring),
 672                          -1, STR_TERMINATE);
 673
 674         /* w2k with kerberos doesn't properly null terminate this field */
 675         len = smb_bufrem(cli->inbuf, p);
 676         if (p + len < cli->inbuf + cli->bufsize+SAFETY_MARGIN - 2) {
 677                 char *end_of_buf = p + len;
 678
 679                 SSVAL(p, len, 0);
 680                 /* Now it's null terminated. */
 681                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 682                         -1, STR_TERMINATE);
 683                 /*
 684                  * See if there's another string. If so it's the
 685                  * server domain (part of the 'standard' Samba
 686                  * server signature).
 687                  */
 688                 if (p < end_of_buf) {
 689                         p += clistr_pull(cli->inbuf, cli->server_domain, p, sizeof(fstring),
 690                                 -1, STR_TERMINATE);
 691                 }
 692         } else {
 693                 /*
 694                  * No room to null terminate so we can't see if there
 695                  * is another string (server_domain) afterwards.
 696                  */
 697                 p += clistr_pull(cli->inbuf, cli->server_type, p, sizeof(fstring),
 698                                  len, 0);
 699         }
 700         return blob2;
 701 }
 702
 703 #ifdef HAVE_KRB5
 704 /****************************************************************************
 705  Send a extended security session setup blob, returning a reply blob.
 706 ****************************************************************************/
 707
 708 /* The following is calculated from :
 709  * (smb_size-4) = 35
 710  * (smb_wcnt * 2) = 24 (smb_wcnt == 12 in cli_session_setup_blob_send() )
 711  * (strlen("Unix") + 1 + strlen("Samba") + 1) * 2 = 22 (unicode strings at
 712  * end of packet.
 713  */
 714
 715 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 716
 717 static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 718 {
 719         int32 remaining = blob.length;
 720         int32 cur = 0;
 721         DATA_BLOB send_blob = data_blob_null;
 722         int32 max_blob_size = 0;
 723         DATA_BLOB receive_blob = data_blob_null;
 724
 725         if (cli->max_xmit < BASE_SESSSETUP_BLOB_PACKET_SIZE + 1) {
 726                 DEBUG(0,("cli_session_setup_blob: cli->max_xmit too small "
 727                         "(was %u, need minimum %u)\n",
 728                         (unsigned int)cli->max_xmit,
 729                         BASE_SESSSETUP_BLOB_PACKET_SIZE));
 730                 cli_set_nt_error(cli, NT_STATUS_INVALID_PARAMETER);
 731                 return False;
 732         }
 733
 734         max_blob_size = cli->max_xmit - BASE_SESSSETUP_BLOB_PACKET_SIZE;
 735
 736         while ( remaining > 0) {
 737                 if (remaining >= max_blob_size) {
 738                         send_blob.length = max_blob_size;
 739                         remaining -= max_blob_size;
 740                 } else {
 741                         send_blob.length = remaining;
 742                         remaining = 0;
 743                 }
 744
 745                 send_blob.data =  &blob.data[cur];
 746                 cur += send_blob.length;
 747
 748                 DEBUG(10, ("cli_session_setup_blob: Remaining (%u) sending (%u) current (%u)\n",
 749                         (unsigned int)remaining,
 750                         (unsigned int)send_blob.length,
 751                         (unsigned int)cur ));
 752
 753                 if (!cli_session_setup_blob_send(cli, send_blob)) {
 754                         DEBUG(0, ("cli_session_setup_blob: send failed\n"));
 755                         return False;
 756                 }
 757
 758                 receive_blob = cli_session_setup_blob_receive(cli);
 759                 data_blob_free(&receive_blob);
 760
 761                 if (cli_is_error(cli) &&
 762                                 !NT_STATUS_EQUAL( cli_get_nt_error(cli),
 763                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 764                         DEBUG(0, ("cli_session_setup_blob: receive failed "
 765                                   "(%s)\n", nt_errstr(cli_get_nt_error(cli))));
 766                         cli->vuid = 0;
 767                         return False;
 768                 }
 769         }
 770
 771         return True;
 772 }
 773
 774 /****************************************************************************
 775  Use in-memory credentials cache
 776 ****************************************************************************/
 777
 778 static void use_in_memory_ccache(void) {
 779         setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1);
 780 }
 781
 782 /****************************************************************************
 783  Do a spnego/kerberos encrypted session setup.
 784 ****************************************************************************/
 785
 786 static ADS_STATUS cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup)
 787 {
 788         DATA_BLOB negTokenTarg;
 789         DATA_BLOB session_key_krb5;
 790         NTSTATUS nt_status;
 791         int rc;
 792
 793         cli_temp_set_signing(cli);
 794
 795         DEBUG(2,("Doing kerberos session setup\n"));
 796
 797         /* generate the encapsulated kerberos5 ticket */
 798         rc = spnego_gen_negTokenTarg(principal, 0, &negTokenTarg, &session_key_krb5, 0, NULL);
 799
 800         if (rc) {
 801                 DEBUG(1, ("cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: %s\n",
 802                         error_message(rc)));
 803                 return ADS_ERROR_KRB5(rc);
 804         }
 805
 806 #if 0
 807         file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length);
 808 #endif
 809
 810         if (!cli_session_setup_blob(cli, negTokenTarg)) {
 811                 nt_status = cli_nt_error(cli);
 812                 goto nt_error;
 813         }
 814
 815         if (cli_is_error(cli)) {
 816                 nt_status = cli_nt_error(cli);
 817                 if (NT_STATUS_IS_OK(nt_status)) {
 818                         nt_status = NT_STATUS_UNSUCCESSFUL;
 819                 }
 820                 goto nt_error;
 821         }
 822
 823         cli_set_session_key(cli, session_key_krb5);
 824
 825         if (cli_simple_set_signing(
 826                     cli, session_key_krb5, data_blob_null)) {
 827
 828                 if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 829                         nt_status = NT_STATUS_ACCESS_DENIED;
 830                         goto nt_error;
 831                 }
 832         }
 833
 834         data_blob_free(&negTokenTarg);
 835         data_blob_free(&session_key_krb5);
 836
 837         return ADS_ERROR_NT(NT_STATUS_OK);
 838
 839 nt_error:
 840         data_blob_free(&negTokenTarg);
 841         data_blob_free(&session_key_krb5);
 842         cli->vuid = 0;
 843         return ADS_ERROR_NT(nt_status);
 844 }
 845 #endif  /* HAVE_KRB5 */
 846
 847
 848 /****************************************************************************
 849  Do a spnego/NTLMSSP encrypted session setup.
 850 ****************************************************************************/
 851
 852 static NTSTATUS cli_session_setup_ntlmssp(struct cli_state *cli, const char *user,
 853                                           const char *pass, const char *domain)
 854 {
 855         struct ntlmssp_state *ntlmssp_state;
 856         NTSTATUS nt_status;
 857         int turn = 1;
 858         DATA_BLOB msg1;
 859         DATA_BLOB blob = data_blob_null;
 860         DATA_BLOB blob_in = data_blob_null;
 861         DATA_BLOB blob_out = data_blob_null;
 862
 863         cli_temp_set_signing(cli);
 864
 865         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
 866                 return nt_status;
 867         }
 868         ntlmssp_want_feature(ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
 869
 870         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, user))) {
 871                 return nt_status;
 872         }
 873         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_domain(ntlmssp_state, domain))) {
 874                 return nt_status;
 875         }
 876         if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_password(ntlmssp_state, pass))) {
 877                 return nt_status;
 878         }
 879
 880         do {
 881                 nt_status = ntlmssp_update(ntlmssp_state,
 882                                                   blob_in, &blob_out);
 883                 data_blob_free(&blob_in);
 884                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) || NT_STATUS_IS_OK(nt_status)) {
 885                         if (turn == 1) {
 886                                 /* and wrap it in a SPNEGO wrapper */
 887                                 msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out);
 888                         } else {
 889                                 /* wrap it in SPNEGO */
 890                                 msg1 = spnego_gen_auth(blob_out);
 891                         }
 892
 893                         /* now send that blob on its way */
 894                         if (!cli_session_setup_blob_send(cli, msg1)) {
 895                                 DEBUG(3, ("Failed to send NTLMSSP/SPNEGO blob to server!\n"));
 896                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 897                         } else {
 898                                 blob = cli_session_setup_blob_receive(cli);
 899
 900                                 nt_status = cli_nt_error(cli);
 901                                 if (cli_is_error(cli) && NT_STATUS_IS_OK(nt_status)) {
 902                                         if (cli->smb_rw_error == SMB_READ_BAD_SIG) {
 903                                                 nt_status = NT_STATUS_ACCESS_DENIED;
 904                                         } else {
 905                                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 906                                         }
 907                                 }
 908                         }
 909                         data_blob_free(&msg1);
 910                 }
 911
 912                 if (!blob.length) {
 913                         if (NT_STATUS_IS_OK(nt_status)) {
 914                                 nt_status = NT_STATUS_UNSUCCESSFUL;
 915                         }
 916                 } else if ((turn == 1) &&
 917                            NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 918                         DATA_BLOB tmp_blob = data_blob_null;
 919                         /* the server might give us back two challenges */
 920                         if (!spnego_parse_challenge(blob, &blob_in,
 921                                                     &tmp_blob)) {
 922                                 DEBUG(3,("Failed to parse challenges\n"));
 923                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 924                         }
 925                         data_blob_free(&tmp_blob);
 926                 } else {
 927                         if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP,
 928                                                         &blob_in)) {
 929                                 DEBUG(3,("Failed to parse auth response\n"));
 930                                 if (NT_STATUS_IS_OK(nt_status)
 931                                     || NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 932                                         nt_status = NT_STATUS_INVALID_PARAMETER;
 933                         }
 934                 }
 935                 data_blob_free(&blob);
 936                 data_blob_free(&blob_out);
 937                 turn++;
 938         } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED));
 939
 940         data_blob_free(&blob_in);
 941
 942         if (NT_STATUS_IS_OK(nt_status)) {
 943
 944                 if (cli->server_domain[0] == '\0') {
 945                         fstrcpy(cli->server_domain, ntlmssp_state->server_domain);
 946                 }
 947                 cli_set_session_key(cli, ntlmssp_state->session_key);
 948
 949                 if (cli_simple_set_signing(
 950                             cli, ntlmssp_state->session_key, data_blob_null)) {
 951
 952                         if (!cli_check_sign_mac(cli, cli->inbuf, 1)) {
 953                                 nt_status = NT_STATUS_ACCESS_DENIED;
 954                         }
 955                 }
 956         }
 957
 958         /* we have a reference conter on ntlmssp_state, if we are signing
 959            then the state will be kept by the signing engine */
 960
 961         ntlmssp_end(&ntlmssp_state);
 962
 963         if (!NT_STATUS_IS_OK(nt_status)) {
 964                 cli->vuid = 0;
 965         }
 966         return nt_status;
 967 }
 968
 969 /****************************************************************************
 970  Do a spnego encrypted session setup.
 971
 972  user_domain: The shortname of the domain the user/machine is a member of.
 973  dest_realm: The realm we're connecting to, if NULL we use our default realm.
 974 ****************************************************************************/
 975
 976 ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
 977                               const char *pass, const char *user_domain,
 978                               const char * dest_realm)
 979 {
 980         char *principal = NULL;
 981         char *OIDs[ASN1_MAX_OIDS];
 982         int i;
 983         DATA_BLOB blob;
 984         const char *p = NULL;
 985         char *account = NULL;
 986         NTSTATUS status;
 987
 988         DEBUG(3,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length));
 989
 990         /* the server might not even do spnego */
 991         if (cli->secblob.length <= 16) {
 992                 DEBUG(3,("server didn't supply a full spnego negprot\n"));
 993                 goto ntlmssp;
 994         }
 995
 996 #if 0
 997         file_save("negprot.dat", cli->secblob.data, cli->secblob.length);
 998 #endif
 999
1000         /* there is 16 bytes of GUID before the real spnego packet starts */
1001         blob = data_blob(cli->secblob.data+16, cli->secblob.length-16);
1002
1003         /* The server sent us the first part of the SPNEGO exchange in the
1004          * negprot reply. It is WRONG to depend on the principal sent in the
1005          * negprot reply, but right now we do it. If we don't receive one,
1006          * we try to best guess, then fall back to NTLM.  */
1007         if (!spnego_parse_negTokenInit(blob, OIDs, &principal)) {
1008                 data_blob_free(&blob);
1009                 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
1010         }
1011         data_blob_free(&blob);
1012
1013         /* make sure the server understands kerberos */
1014         for (i=0;OIDs[i];i++) {
1015                 if (i == 0)
1016                         DEBUG(3,("got OID=%s\n", OIDs[i]));
1017                 else
1018                         DEBUGADD(3,("got OID=%s\n", OIDs[i]));
1019                 if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
1020                     strcmp(OIDs[i], OID_KERBEROS5) == 0) {
1021                         cli->got_kerberos_mechanism = True;
1022                 }
1023                 talloc_free(OIDs[i]);
1024         }
1025
1026         DEBUG(3,("got principal=%s\n", principal ? principal : "<null>"));
1027
1028         status = cli_set_username(cli, user);
1029         if (!NT_STATUS_IS_OK(status)) {
1030                 return ADS_ERROR_NT(status);
1031         }
1032
1033 #ifdef HAVE_KRB5
1034         /* If password is set we reauthenticate to kerberos server
1035          * and do not store results */
1036
1037         if (cli->got_kerberos_mechanism && cli->use_kerberos) {
1038                 ADS_STATUS rc;
1039
1040                 if (pass && *pass) {
1041                         int ret;
1042
1043                         use_in_memory_ccache();
1044                         ret = kerberos_kinit_password(user, pass, 0 /* no time correction for now */, NULL);
1045
1046                         if (ret){
1047                                 TALLOC_FREE(principal);
1048                                 DEBUG(0, ("Kinit failed: %s\n", error_message(ret)));
1049                                 if (cli->fallback_after_kerberos)
1050                                         goto ntlmssp;
1051                                 return ADS_ERROR_KRB5(ret);
1052                         }
1053                 }
1054
1055                 /* If we get a bad principal, try to guess it if
1056                    we have a valid host NetBIOS name.
1057                  */
1058                 if (strequal(principal, ADS_IGNORE_PRINCIPAL)) {
1059                         TALLOC_FREE(principal);
1060                 }
1061
1062                 if (principal == NULL &&
1063                         !is_ipaddress(cli->desthost) &&
1064                         !strequal(STAR_SMBSERVER,
1065                                 cli->desthost)) {
1066                         char *realm = NULL;
1067                         char *machine = NULL;
1068                         char *host = NULL;
1069                         DEBUG(3,("cli_session_setup_spnego: got a "
1070                                 "bad server principal, trying to guess ...\n"));
1071
1072                         host = strchr_m(cli->desthost, '.');
1073                         if (host) {
1074                                 machine = SMB_STRNDUP(cli->desthost,
1075                                         host - cli->desthost);
1076                         } else {
1077                                 machine = SMB_STRDUP(cli->desthost);
1078                         }
1079                         if (machine == NULL) {
1080                                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1081                         }
1082
1083                         if (dest_realm) {
1084                                 realm = SMB_STRDUP(dest_realm);
1085                                 strupper_m(realm);
1086                         } else {
1087                                 realm = kerberos_get_default_realm_from_ccache();
1088                         }
1089                         if (realm && *realm) {
1090                                 principal = talloc_asprintf(NULL, "%s$@%s",
1091                                                         machine, realm);
1092                                 if (!principal) {
1093                                         SAFE_FREE(machine);
1094                                         SAFE_FREE(realm);
1095                                         return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1096                                 }
1097                                 DEBUG(3,("cli_session_setup_spnego: guessed "
1098                                         "server principal=%s\n",
1099                                         principal ? principal : "<null>"));
1100                         }
1101                         SAFE_FREE(machine);
1102                         SAFE_FREE(realm);
1103                 }
1104
1105                 if (principal) {
1106                         rc = cli_session_setup_kerberos(cli, principal,
1107                                 dest_realm);
1108                         if (ADS_ERR_OK(rc) || !cli->fallback_after_kerberos) {
1109                                 TALLOC_FREE(principal);
1110                                 return rc;
1111                         }
1112                 }
1113         }
1114 #endif
1115
1116         TALLOC_FREE(principal);
1117
1118 ntlmssp:
1119
1120         account = talloc_strdup(talloc_tos(), user);
1121         if (!account) {
1122                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
1123         }
1124
1125         /* when falling back to ntlmssp while authenticating with a machine
1126          * account strip off the realm - gd */
1127
1128         if ((p = strchr_m(user, '@')) != NULL) {
1129                 account[PTR_DIFF(p,user)] = '\0';
1130         }
1131
1132         return ADS_ERROR_NT(cli_session_setup_ntlmssp(cli, account, pass, user_domain));
1133 }
1134
1135 /****************************************************************************
1136  Send a session setup. The username and workgroup is in UNIX character
1137  format and must be converted to DOS codepage format before sending. If the
1138  password is in plaintext, the same should be done.
1139 ****************************************************************************/
1140
1141 NTSTATUS cli_session_setup(struct cli_state *cli,
1142                            const char *user,
1143                            const char *pass, int passlen,
1144                            const char *ntpass, int ntpasslen,
1145                            const char *workgroup)
1146 {
1147         char *p;
1148         fstring user2;
1149
1150         if (user) {
1151                 fstrcpy(user2, user);
1152         } else {
1153                 user2[0] ='\0';
1154         }
1155
1156         if (!workgroup) {
1157                 workgroup = "";
1158         }
1159
1160         /* allow for workgroups as part of the username */
1161         if ((p=strchr_m(user2,'\\')) || (p=strchr_m(user2,'/')) ||
1162             (p=strchr_m(user2,*lp_winbind_separator()))) {
1163                 *p = 0;
1164                 user = p+1;
1165                 workgroup = user2;
1166         }
1167
1168         if (cli->protocol < PROTOCOL_LANMAN1) {
1169                 return NT_STATUS_OK;
1170         }
1171
1172         /* now work out what sort of session setup we are going to
1173            do. I have split this into separate functions to make the
1174            flow a bit easier to understand (tridge) */
1175
1176         /* if its an older server then we have to use the older request format */
1177
1178         if (cli->protocol < PROTOCOL_NT1) {
1179                 if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) {
1180                         DEBUG(1, ("Server requested LM password but 'client lanman auth'"
1181                                   " is disabled\n"));
1182                         return NT_STATUS_ACCESS_DENIED;
1183                 }
1184
1185                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 &&
1186                     !lp_client_plaintext_auth() && (*pass)) {
1187                         DEBUG(1, ("Server requested plaintext password but "
1188                                   "'client plaintext auth' is disabled\n"));
1189                         return NT_STATUS_ACCESS_DENIED;
1190                 }
1191
1192                 return cli_session_setup_lanman2(cli, user, pass, passlen,
1193                                                  workgroup);
1194         }
1195
1196         /* if no user is supplied then we have to do an anonymous connection.
1197            passwords are ignored */
1198
1199         if (!user || !*user)
1200                 return cli_session_setup_guest(cli);
1201
1202         /* if the server is share level then send a plaintext null
1203            password at this point. The password is sent in the tree
1204            connect */
1205
1206         if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0)
1207                 return cli_session_setup_plaintext(cli, user, "", workgroup);
1208
1209         /* if the server doesn't support encryption then we have to use
1210            plaintext. The second password is ignored */
1211
1212         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
1213                 if (!lp_client_plaintext_auth() && (*pass)) {
1214                         DEBUG(1, ("Server requested plaintext password but "
1215                                   "'client plaintext auth' is disabled\n"));
1216                         return NT_STATUS_ACCESS_DENIED;
1217                 }
1218                 return cli_session_setup_plaintext(cli, user, pass, workgroup);
1219         }
1220
1221         /* if the server supports extended security then use SPNEGO */
1222
1223         if (cli->capabilities & CAP_EXTENDED_SECURITY) {
1224                 ADS_STATUS status = cli_session_setup_spnego(cli, user, pass,
1225                                                              workgroup, NULL);
1226                 if (!ADS_ERR_OK(status)) {
1227                         DEBUG(3, ("SPNEGO login failed: %s\n", ads_errstr(status)));
1228                         return ads_ntstatus(status);
1229                 }
1230         } else {
1231                 NTSTATUS status;
1232
1233                 /* otherwise do a NT1 style session setup */
1234                 status = cli_session_setup_nt1(cli, user, pass, passlen,
1235                                                ntpass, ntpasslen, workgroup);
1236                 if (!NT_STATUS_IS_OK(status)) {
1237                         DEBUG(3,("cli_session_setup: NT1 session setup "
1238                                  "failed: %s\n", nt_errstr(status)));
1239                         return status;
1240                 }
1241         }
1242
1243         if (strstr(cli->server_type, "Samba")) {
1244                 cli->is_samba = True;
1245         }
1246
1247         return NT_STATUS_OK;
1248 }
1249
1250 /****************************************************************************
1251  Send a uloggoff.
1252 *****************************************************************************/
1253
1254 bool cli_ulogoff(struct cli_state *cli)
1255 {
1256         memset(cli->outbuf,'\0',smb_size);
1257         cli_set_message(cli->outbuf,2,0,True);
1258         SCVAL(cli->outbuf,smb_com,SMBulogoffX);
1259         cli_setup_packet(cli);
1260         SSVAL(cli->outbuf,smb_vwv0,0xFF);
1261         SSVAL(cli->outbuf,smb_vwv2,0);  /* no additional info */
1262
1263         cli_send_smb(cli);
1264         if (!cli_receive_smb(cli))
1265                 return False;
1266
1267         if (cli_is_error(cli)) {
1268                 return False;
1269         }
1270
1271         cli->vuid = -1;
1272         return True;
1273 }
1274
1275 /****************************************************************************
1276  Send a tconX.
1277 ****************************************************************************/
1278
1279 struct cli_tcon_andx_state {
1280         struct cli_state *cli;
1281         uint16_t vwv[4];
1282         struct iovec bytes;
1283 };
1284
1285 static void cli_tcon_andx_done(struct tevent_req *subreq);
1286
1287 struct tevent_req *cli_tcon_andx_create(TALLOC_CTX *mem_ctx,
1288                                         struct event_context *ev,
1289                                         struct cli_state *cli,
1290                                         const char *share, const char *dev,
1291                                         const char *pass, int passlen,
1292                                         struct tevent_req **psmbreq)
1293 {
1294         struct tevent_req *req, *subreq;
1295         struct cli_tcon_andx_state *state;
1296         fstring pword;
1297         uint16_t *vwv;
1298         char *tmp = NULL;
1299         uint8_t *bytes;
1300
1301         req = tevent_req_create(mem_ctx, &state, struct cli_tcon_andx_state);
1302         if (req == NULL) {
1303                 return NULL;
1304         }
1305         state->cli = cli;
1306         vwv = state->vwv;
1307
1308         fstrcpy(cli->share, share);
1309
1310         /* in user level security don't send a password now */
1311         if (cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) {
1312                 passlen = 1;
1313                 pass = "";
1314         } else if (pass == NULL) {
1315                 DEBUG(1, ("Server not using user level security and no "
1316                           "password supplied.\n"));
1317                 goto access_denied;
1318         }
1319
1320         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) &&
1321             *pass && passlen != 24) {
1322                 if (!lp_client_lanman_auth()) {
1323                         DEBUG(1, ("Server requested LANMAN password "
1324                                   "(share-level security) but "
1325                                   "'client lanman auth' is disabled\n"));
1326                         goto access_denied;
1327                 }
1328
1329                 /*
1330                  * Non-encrypted passwords - convert to DOS codepage before
1331                  * encryption.
1332                  */
1333                 passlen = 24;
1334                 SMBencrypt(pass, cli->secblob.data, (uchar *)pword);
1335         } else {
1336                 if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL
1337                                      |NEGOTIATE_SECURITY_CHALLENGE_RESPONSE))
1338                    == 0) {
1339                         if (!lp_client_plaintext_auth() && (*pass)) {
1340                                 DEBUG(1, ("Server requested plaintext "
1341                                           "password but 'client plaintext "
1342                                           "auth' is disabled\n"));
1343                                 goto access_denied;
1344                         }
1345
1346                         /*
1347                          * Non-encrypted passwords - convert to DOS codepage
1348                          * before using.
1349                          */
1350                         passlen = clistr_push(cli, pword, pass, sizeof(pword),
1351                                               STR_TERMINATE);
1352                         if (passlen == -1) {
1353                                 DEBUG(1, ("clistr_push(pword) failed\n"));
1354                                 goto access_denied;
1355                         }
1356                 } else {
1357                         if (passlen) {
1358                                 memcpy(pword, pass, passlen);
1359                         }
1360                 }
1361         }
1362
1363         SCVAL(vwv+0, 0, 0xFF);
1364         SCVAL(vwv+0, 1, 0);
1365         SSVAL(vwv+1, 0, 0);
1366         SSVAL(vwv+2, 0, TCONX_FLAG_EXTENDED_RESPONSE);
1367         SSVAL(vwv+3, 0, passlen);
1368
1369         if (passlen) {
1370                 bytes = (uint8_t *)talloc_memdup(state, pword, passlen);
1371         } else {
1372                 bytes = talloc_array(state, uint8_t, 0);
1373         }
1374
1375         /*
1376          * Add the sharename
1377          */
1378         tmp = talloc_asprintf_strupper_m(talloc_tos(), "\\\\%s\\%s",
1379                                          cli->desthost, share);
1380         if (tmp == NULL) {
1381                 TALLOC_FREE(req);
1382                 return NULL;
1383         }
1384         bytes = smb_bytes_push_str(bytes, cli_ucs2(cli), tmp, strlen(tmp)+1,
1385                                    NULL);
1386         TALLOC_FREE(tmp);
1387
1388         /*
1389          * Add the devicetype
1390          */
1391         tmp = talloc_strdup_upper(talloc_tos(), dev);
1392         if (tmp == NULL) {
1393                 TALLOC_FREE(req);
1394                 return NULL;
1395         }
1396         bytes = smb_bytes_push_str(bytes, false, tmp, strlen(tmp)+1, NULL);
1397         TALLOC_FREE(tmp);
1398
1399         if (bytes == NULL) {
1400                 TALLOC_FREE(req);
1401                 return NULL;
1402         }
1403
1404         state->bytes.iov_base = (void *)bytes;
1405         state->bytes.iov_len = talloc_get_size(bytes);
1406
1407         subreq = cli_smb_req_create(state, ev, cli, SMBtconX, 0, 4, vwv,
1408                                     1, &state->bytes);
1409         if (subreq == NULL) {
1410                 TALLOC_FREE(req);
1411                 return NULL;
1412         }
1413         tevent_req_set_callback(subreq, cli_tcon_andx_done, req);
1414         *psmbreq = subreq;
1415         return req;
1416
1417  access_denied:
1418         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1419         return tevent_req_post(req, ev);
1420 }
1421
1422 struct tevent_req *cli_tcon_andx_send(TALLOC_CTX *mem_ctx,
1423                                       struct event_context *ev,
1424                                       struct cli_state *cli,
1425                                       const char *share, const char *dev,
1426                                       const char *pass, int passlen)
1427 {
1428         struct tevent_req *req, *subreq;
1429         NTSTATUS status;
1430
1431         req = cli_tcon_andx_create(mem_ctx, ev, cli, share, dev, pass, passlen,
1432                                    &subreq);
1433         if (req == NULL) {
1434                 return NULL;
1435         }
1436         status = cli_smb_req_send(subreq);
1437         if (!NT_STATUS_IS_OK(status)) {
1438                 tevent_req_nterror(req, status);
1439                 return tevent_req_post(req, ev);
1440         }
1441         return req;
1442 }
1443
1444 static void cli_tcon_andx_done(struct tevent_req *subreq)
1445 {
1446         struct tevent_req *req = tevent_req_callback_data(
1447                 subreq, struct tevent_req);
1448         struct cli_tcon_andx_state *state = tevent_req_data(
1449                 req, struct cli_tcon_andx_state);
1450         struct cli_state *cli = state->cli;
1451         char *inbuf = (char *)cli_smb_inbuf(subreq);
1452         uint8_t wct;
1453         uint16_t *vwv;
1454         uint32_t num_bytes;
1455         uint8_t *bytes;
1456         NTSTATUS status;
1457
1458         status = cli_smb_recv(subreq, 0, &wct, &vwv, &num_bytes, &bytes);
1459         if (!NT_STATUS_IS_OK(status)) {
1460                 TALLOC_FREE(subreq);
1461                 tevent_req_nterror(req, status);
1462                 return;
1463         }
1464
1465         clistr_pull(inbuf, cli->dev, bytes, sizeof(fstring), num_bytes,
1466                     STR_TERMINATE|STR_ASCII);
1467
1468         if ((cli->protocol >= PROTOCOL_NT1) && (num_bytes == 3)) {
1469                 /* almost certainly win95 - enable bug fixes */
1470                 cli->win95 = True;
1471         }
1472
1473         /*
1474          * Make sure that we have the optional support 16-bit field. WCT > 2.
1475          * Avoids issues when connecting to Win9x boxes sharing files
1476          */
1477
1478         cli->dfsroot = false;
1479
1480         if ((wct > 2) && (cli->protocol >= PROTOCOL_LANMAN2)) {
1481                 cli->dfsroot = ((SVAL(vwv+2, 0) & SMB_SHARE_IN_DFS) != 0);
1482         }
1483
1484         cli->cnum = SVAL(inbuf,smb_tid);
1485         tevent_req_done(req);
1486 }
1487
1488 NTSTATUS cli_tcon_andx_recv(struct tevent_req *req)
1489 {
1490         return tevent_req_simple_recv_ntstatus(req);
1491 }
1492
1493 NTSTATUS cli_tcon_andx(struct cli_state *cli, const char *share,
1494                        const char *dev, const char *pass, int passlen)
1495 {
1496         TALLOC_CTX *frame = talloc_stackframe();
1497         struct event_context *ev;
1498         struct tevent_req *req;
1499         NTSTATUS status = NT_STATUS_OK;
1500
1501         if (cli_has_async_calls(cli)) {
1502                 /*
1503                  * Can't use sync call while an async call is in flight
1504                  */
1505                 status = NT_STATUS_INVALID_PARAMETER;
1506                 goto fail;
1507         }
1508
1509         ev = event_context_init(frame);
1510         if (ev == NULL) {
1511                 status = NT_STATUS_NO_MEMORY;
1512                 goto fail;
1513         }
1514
1515         req = cli_tcon_andx_send(frame, ev, cli, share, dev, pass, passlen);
1516         if (req == NULL) {
1517                 status = NT_STATUS_NO_MEMORY;
1518                 goto fail;
1519         }
1520
1521         if (!tevent_req_poll(req, ev)) {
1522                 status = map_nt_error_from_unix(errno);
1523                 goto fail;
1524         }
1525
1526         status = cli_tcon_andx_recv(req);
1527  fail:
1528         TALLOC_FREE(frame);
1529         if (!NT_STATUS_IS_OK(status)) {
1530                 cli_set_error(cli, status);
1531         }
1532         return status;
1533 }
1534
1535 /****************************************************************************
1536  Send a tree disconnect.
1537 ****************************************************************************/
1538
1539 bool cli_tdis(struct cli_state *cli)
1540 {
1541         memset(cli->outbuf,'\0',smb_size);
1542         cli_set_message(cli->outbuf,0,0,True);
1543         SCVAL(cli->outbuf,smb_com,SMBtdis);
1544         SSVAL(cli->outbuf,smb_tid,cli->cnum);
1545         cli_setup_packet(cli);
1546
1547         cli_send_smb(cli);
1548         if (!cli_receive_smb(cli))
1549                 return False;
1550
1551         if (cli_is_error(cli)) {
1552                 return False;
1553         }
1554
1555         cli->cnum = -1;
1556         return True;
1557 }
1558
1559 /****************************************************************************
1560  Send a negprot command.
1561 ****************************************************************************/
1562
1563 void cli_negprot_sendsync(struct cli_state *cli)
1564 {
1565         char *p;
1566         int numprots;
1567
1568         if (cli->protocol < PROTOCOL_NT1)
1569                 cli->use_spnego = False;
1570
1571         memset(cli->outbuf,'\0',smb_size);
1572
1573         /* setup the protocol strings */
1574         cli_set_message(cli->outbuf,0,0,True);
1575
1576         p = smb_buf(cli->outbuf);
1577         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1578                 if (prots[numprots].prot > cli->protocol) {
1579                         break;
1580                 }
1581                 *p++ = 2;
1582                 p += clistr_push(cli, p, prots[numprots].name, -1, STR_TERMINATE);
1583         }
1584
1585         SCVAL(cli->outbuf,smb_com,SMBnegprot);
1586         cli_setup_bcc(cli, p);
1587         cli_setup_packet(cli);
1588
1589         SCVAL(smb_buf(cli->outbuf),0,2);
1590
1591         cli_send_smb(cli);
1592 }
1593
1594 /****************************************************************************
1595  Send a negprot command.
1596 ****************************************************************************/
1597
1598 struct cli_negprot_state {
1599         struct cli_state *cli;
1600 };
1601
1602 static void cli_negprot_done(struct tevent_req *subreq);
1603
1604 struct tevent_req *cli_negprot_send(TALLOC_CTX *mem_ctx,
1605                                     struct event_context *ev,
1606                                     struct cli_state *cli)
1607 {
1608         struct tevent_req *req, *subreq;
1609         struct cli_negprot_state *state;
1610         uint8_t *bytes = NULL;
1611         int numprots;
1612         uint16_t cnum;
1613
1614         req = tevent_req_create(mem_ctx, &state, struct cli_negprot_state);
1615         if (req == NULL) {
1616                 return NULL;
1617         }
1618         state->cli = cli;
1619
1620         if (cli->protocol < PROTOCOL_NT1)
1621                 cli->use_spnego = False;
1622
1623         /* setup the protocol strings */
1624         for (numprots=0; numprots < ARRAY_SIZE(prots); numprots++) {
1625                 uint8_t c = 2;
1626                 if (prots[numprots].prot > cli->protocol) {
1627                         break;
1628                 }
1629                 bytes = (uint8_t *)talloc_append_blob(
1630                         state, bytes, data_blob_const(&c, sizeof(c)));
1631                 if (tevent_req_nomem(bytes, req)) {
1632                         return tevent_req_post(req, ev);
1633                 }
1634                 bytes = smb_bytes_push_str(bytes, false,
1635                                            prots[numprots].name,
1636                                            strlen(prots[numprots].name)+1,
1637                                            NULL);
1638                 if (tevent_req_nomem(bytes, req)) {
1639                         return tevent_req_post(req, ev);
1640                 }
1641         }
1642
1643         cnum = cli->cnum;
1644
1645         cli->cnum = 0;
1646         subreq = cli_smb_send(state, ev, cli, SMBnegprot, 0, 0, NULL,
1647                               talloc_get_size(bytes), bytes);
1648         cli->cnum = cnum;
1649
1650         if (tevent_req_nomem(subreq, req)) {
1651                 return tevent_req_post(req, ev);
1652         }
1653         tevent_req_set_callback(subreq, cli_negprot_done, req);
1654         return req;
1655 }
1656
1657 static void cli_negprot_done(struct tevent_req *subreq)
1658 {
1659         struct tevent_req *req = tevent_req_callback_data(
1660                 subreq, struct tevent_req);
1661         struct cli_negprot_state *state = tevent_req_data(
1662                 req, struct cli_negprot_state);
1663         struct cli_state *cli = state->cli;
1664         uint8_t wct;
1665         uint16_t *vwv;
1666         uint32_t num_bytes;
1667         uint8_t *bytes;
1668         NTSTATUS status;
1669         uint16_t protnum;
1670
1671         status = cli_smb_recv(subreq, 1, &wct, &vwv, &num_bytes, &bytes);
1672         if (!NT_STATUS_IS_OK(status)) {
1673                 TALLOC_FREE(subreq);
1674                 return;
1675         }
1676
1677         protnum = SVAL(vwv, 0);
1678
1679         if ((protnum >= ARRAY_SIZE(prots))
1680             || (prots[protnum].prot > cli->protocol)) {
1681                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1682                 return;
1683         }
1684
1685         cli->protocol = prots[protnum].prot;
1686
1687         if ((cli->protocol < PROTOCOL_NT1) &&
1688             client_is_signing_mandatory(cli)) {
1689                 DEBUG(0,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n"));
1690                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
1691                 return;
1692         }
1693
1694         if (cli->protocol >= PROTOCOL_NT1) {
1695                 struct timespec ts;
1696                 bool negotiated_smb_signing = false;
1697
1698                 /* NT protocol */
1699                 cli->sec_mode = CVAL(vwv + 1, 0);
1700                 cli->max_mux = SVAL(vwv + 1, 1);
1701                 cli->max_xmit = IVAL(vwv + 3, 1);
1702                 cli->sesskey = IVAL(vwv + 7, 1);
1703                 cli->serverzone = SVALS(vwv + 15, 1);
1704                 cli->serverzone *= 60;
1705                 /* this time arrives in real GMT */
1706                 ts = interpret_long_date(((char *)(vwv+11))+1);
1707                 cli->servertime = ts.tv_sec;
1708                 cli->secblob = data_blob(bytes, num_bytes);
1709                 cli->capabilities = IVAL(vwv + 9, 1);
1710                 if (cli->capabilities & CAP_RAW_MODE) {
1711                         cli->readbraw_supported = True;
1712                         cli->writebraw_supported = True;
1713                 }
1714                 /* work out if they sent us a workgroup */
1715                 if (!(cli->capabilities & CAP_EXTENDED_SECURITY) &&
1716                     smb_buflen(cli->inbuf) > 8) {
1717                         clistr_pull(cli->inbuf, cli->server_domain,
1718                                     bytes+8, sizeof(cli->server_domain),
1719                                     num_bytes-8,
1720                                     STR_UNICODE|STR_NOALIGN);
1721                 }
1722
1723                 /*
1724                  * As signing is slow we only turn it on if either the client or
1725                  * the server require it. JRA.
1726                  */
1727
1728                 if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
1729                         /* Fail if server says signing is mandatory and we don't want to support it. */
1730                         if (!client_is_signing_allowed(cli)) {
1731                                 DEBUG(0,("cli_negprot: SMB signing is mandatory and we have disabled it.\n"));
1732                                 tevent_req_nterror(req,
1733                                                    NT_STATUS_ACCESS_DENIED);
1734                                 return;
1735                         }
1736                         negotiated_smb_signing = true;
1737                 } else if (client_is_signing_mandatory(cli) && client_is_signing_allowed(cli)) {
1738                         /* Fail if client says signing is mandatory and the server doesn't support it. */
1739                         if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) {
1740                                 DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n"));
1741                                 tevent_req_nterror(req,
1742                                                    NT_STATUS_ACCESS_DENIED);
1743                                 return;
1744                         }
1745                         negotiated_smb_signing = true;
1746                 } else if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
1747                         negotiated_smb_signing = true;
1748                 }
1749
1750                 if (negotiated_smb_signing) {
1751                         cli_set_signing_negotiated(cli);
1752                 }
1753
1754                 if (cli->capabilities & (CAP_LARGE_READX|CAP_LARGE_WRITEX)) {
1755                         SAFE_FREE(cli->outbuf);
1756                         SAFE_FREE(cli->inbuf);
1757                         cli->outbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1758                         cli->inbuf = (char *)SMB_MALLOC(CLI_SAMBA_MAX_LARGE_READX_SIZE+LARGE_WRITEX_HDR_SIZE+SAFETY_MARGIN);
1759                         cli->bufsize = CLI_SAMBA_MAX_LARGE_READX_SIZE + LARGE_WRITEX_HDR_SIZE;
1760                 }
1761
1762         } else if (cli->protocol >= PROTOCOL_LANMAN1) {
1763                 cli->use_spnego = False;
1764                 cli->sec_mode = SVAL(vwv + 1, 0);
1765                 cli->max_xmit = SVAL(vwv + 2, 0);
1766                 cli->max_mux = SVAL(vwv + 3, 0);
1767                 cli->sesskey = IVAL(vwv + 6, 0);
1768                 cli->serverzone = SVALS(vwv + 10, 0);
1769                 cli->serverzone *= 60;
1770                 /* this time is converted to GMT by make_unix_date */
1771                 cli->servertime = cli_make_unix_date(
1772                         cli, (char *)(vwv + 8));
1773                 cli->readbraw_supported = ((SVAL(vwv + 5, 0) & 0x1) != 0);
1774                 cli->writebraw_supported = ((SVAL(vwv + 5, 0) & 0x2) != 0);
1775                 cli->secblob = data_blob(bytes, num_bytes);
1776         } else {
1777                 /* the old core protocol */
1778                 cli->use_spnego = False;
1779                 cli->sec_mode = 0;
1780                 cli->serverzone = get_time_zone(time(NULL));
1781         }
1782
1783         cli->max_xmit = MIN(cli->max_xmit, CLI_BUFFER_SIZE);
1784
1785         /* a way to force ascii SMB */
1786         if (getenv("CLI_FORCE_ASCII"))
1787                 cli->capabilities &= ~CAP_UNICODE;
1788
1789         tevent_req_done(req);
1790 }
1791
1792 NTSTATUS cli_negprot_recv(struct tevent_req *req)
1793 {
1794         return tevent_req_simple_recv_ntstatus(req);
1795 }
1796
1797 NTSTATUS cli_negprot(struct cli_state *cli)
1798 {
1799         TALLOC_CTX *frame = talloc_stackframe();
1800         struct event_context *ev;
1801         struct tevent_req *req;
1802         NTSTATUS status = NT_STATUS_OK;
1803
1804         if (cli_has_async_calls(cli)) {
1805                 /*
1806                  * Can't use sync call while an async call is in flight
1807                  */
1808                 status = NT_STATUS_INVALID_PARAMETER;
1809                 goto fail;
1810         }
1811
1812         ev = event_context_init(frame);
1813         if (ev == NULL) {
1814                 status = NT_STATUS_NO_MEMORY;
1815                 goto fail;
1816         }
1817
1818         req = cli_negprot_send(frame, ev, cli);
1819         if (req == NULL) {
1820                 status = NT_STATUS_NO_MEMORY;
1821                 goto fail;
1822         }
1823
1824         if (!tevent_req_poll(req, ev)) {
1825                 status = map_nt_error_from_unix(errno);
1826                 goto fail;
1827         }
1828
1829         status = cli_negprot_recv(req);
1830  fail:
1831         TALLOC_FREE(frame);
1832         if (!NT_STATUS_IS_OK(status)) {
1833                 cli_set_error(cli, status);
1834         }
1835         return status;
1836 }
1837
1838 /****************************************************************************
1839  Send a session request. See rfc1002.txt 4.3 and 4.3.2.
1840 ****************************************************************************/
1841
1842 bool cli_session_request(struct cli_state *cli,
1843                          struct nmb_name *calling, struct nmb_name *called)
1844 {
1845         char *p;
1846         int len = 4;
1847         char *tmp;
1848
1849         /* 445 doesn't have session request */
1850         if (cli->port == 445)
1851                 return True;
1852
1853         memcpy(&(cli->calling), calling, sizeof(*calling));
1854         memcpy(&(cli->called ), called , sizeof(*called ));
1855
1856         /* put in the destination name */
1857
1858         tmp = name_mangle(talloc_tos(), cli->called.name,
1859                           cli->called.name_type);
1860         if (tmp == NULL) {
1861                 return false;
1862         }
1863
1864         p = cli->outbuf+len;
1865         memcpy(p, tmp, name_len(tmp));
1866         len += name_len(tmp);
1867         TALLOC_FREE(tmp);
1868
1869         /* and my name */
1870
1871         tmp = name_mangle(talloc_tos(), cli->calling.name,
1872                           cli->calling.name_type);
1873         if (tmp == NULL) {
1874                 return false;
1875         }
1876
1877         p = cli->outbuf+len;
1878         memcpy(p, tmp, name_len(tmp));
1879         len += name_len(tmp);
1880         TALLOC_FREE(tmp);
1881
1882         /* send a session request (RFC 1002) */
1883         /* setup the packet length
1884          * Remove four bytes from the length count, since the length
1885          * field in the NBT Session Service header counts the number
1886          * of bytes which follow.  The cli_send_smb() function knows
1887          * about this and accounts for those four bytes.
1888          * CRH.
1889          */
1890         len -= 4;
1891         _smb_setlen(cli->outbuf,len);
1892         SCVAL(cli->outbuf,0,0x81);
1893
1894         cli_send_smb(cli);
1895         DEBUG(5,("Sent session request\n"));
1896
1897         if (!cli_receive_smb(cli))
1898                 return False;
1899
1900         if (CVAL(cli->inbuf,0) == 0x84) {
1901                 /* C. Hoch  9/14/95 Start */
1902                 /* For information, here is the response structure.
1903                  * We do the byte-twiddling to for portability.
1904                 struct RetargetResponse{
1905                 unsigned char type;
1906                 unsigned char flags;
1907                 int16 length;
1908                 int32 ip_addr;
1909                 int16 port;
1910                 };
1911                 */
1912                 uint16_t port = (CVAL(cli->inbuf,8)<<8)+CVAL(cli->inbuf,9);
1913                 struct in_addr dest_ip;
1914                 NTSTATUS status;
1915
1916                 /* SESSION RETARGET */
1917                 putip((char *)&dest_ip,cli->inbuf+4);
1918                 in_addr_to_sockaddr_storage(&cli->dest_ss, dest_ip);
1919
1920                 status = open_socket_out(&cli->dest_ss, port,
1921                                          LONG_CONNECT_TIMEOUT, &cli->fd);
1922                 if (!NT_STATUS_IS_OK(status)) {
1923                         return False;
1924                 }
1925
1926                 DEBUG(3,("Retargeted\n"));
1927
1928                 set_socket_options(cli->fd, lp_socket_options());
1929
1930                 /* Try again */
1931                 {
1932                         static int depth;
1933                         bool ret;
1934                         if (depth > 4) {
1935                                 DEBUG(0,("Retarget recursion - failing\n"));
1936                                 return False;
1937                         }
1938                         depth++;
1939                         ret = cli_session_request(cli, calling, called);
1940                         depth--;
1941                         return ret;
1942                 }
1943         } /* C. Hoch 9/14/95 End */
1944
1945         if (CVAL(cli->inbuf,0) != 0x82) {
1946                 /* This is the wrong place to put the error... JRA. */
1947                 cli->rap_error = CVAL(cli->inbuf,4);
1948                 return False;
1949         }
1950         return(True);
1951 }
1952
1953 struct fd_struct {
1954         int fd;
1955 };
1956
1957 static void smb_sock_connected(struct tevent_req *req)
1958 {
1959         struct fd_struct *pfd = tevent_req_callback_data(
1960                 req, struct fd_struct);
1961         int fd;
1962         NTSTATUS status;
1963
1964         status = open_socket_out_defer_recv(req, &fd);
1965         if (NT_STATUS_IS_OK(status)) {
1966                 pfd->fd = fd;
1967         }
1968 }
1969
1970 static NTSTATUS open_smb_socket(const struct sockaddr_storage *pss,
1971                                 uint16_t *port, int timeout, int *pfd)
1972 {
1973         struct event_context *ev;
1974         struct tevent_req *r139, *r445;
1975         struct fd_struct *fd139, *fd445;
1976         NTSTATUS status = NT_STATUS_NO_MEMORY;
1977
1978         if (*port != 0) {
1979                 return open_socket_out(pss, *port, timeout, pfd);
1980         }
1981
1982         ev = event_context_init(talloc_tos());
1983         if (ev == NULL) {
1984                 return NT_STATUS_NO_MEMORY;
1985         }
1986
1987         fd139 = talloc(ev, struct fd_struct);
1988         if (fd139 == NULL) {
1989                 goto done;
1990         }
1991         fd139->fd = -1;
1992
1993         fd445 = talloc(ev, struct fd_struct);
1994         if (fd445 == NULL) {
1995                 goto done;
1996         }
1997         fd445->fd = -1;
1998
1999         r445 = open_socket_out_defer_send(ev, ev, timeval_set(0, 0),
2000                                           pss, 445, timeout);
2001         r139 = open_socket_out_defer_send(ev, ev, timeval_set(0, 3000),
2002                                           pss, 139, timeout);
2003         if ((r445 == NULL) || (r139 == NULL)) {
2004                 goto done;
2005         }
2006         tevent_req_set_callback(r445, smb_sock_connected, fd445);
2007         tevent_req_set_callback(r139, smb_sock_connected, fd139);
2008
2009         while ((fd445->fd == -1) && (fd139->fd == -1)
2010                && (tevent_req_is_in_progress(r139)
2011                    || tevent_req_is_in_progress(r445))) {
2012                 event_loop_once(ev);
2013         }
2014
2015         if ((fd139->fd != -1) && (fd445->fd != -1)) {
2016                 close(fd139->fd);
2017                 fd139->fd = -1;
2018         }
2019
2020         if (fd445->fd != -1) {
2021                 *port = 445;
2022                 *pfd = fd445->fd;
2023                 status = NT_STATUS_OK;
2024                 goto done;
2025         }
2026         if (fd139->fd != -1) {
2027                 *port = 139;
2028                 *pfd = fd139->fd;
2029                 status = NT_STATUS_OK;
2030                 goto done;
2031         }
2032
2033         status = open_socket_out_defer_recv(r445, &fd445->fd);
2034  done:
2035         TALLOC_FREE(ev);
2036         return status;
2037 }
2038
2039 /****************************************************************************
2040  Open the client sockets.
2041 ****************************************************************************/
2042
2043 NTSTATUS cli_connect(struct cli_state *cli,
2044                 const char *host,
2045                 struct sockaddr_storage *dest_ss)
2046
2047 {
2048         int name_type = 0x20;
2049         TALLOC_CTX *frame = talloc_stackframe();
2050         unsigned int num_addrs = 0;
2051         unsigned int i = 0;
2052         struct sockaddr_storage *ss_arr = NULL;
2053         char *p = NULL;
2054
2055         /* reasonable default hostname */
2056         if (!host) {
2057                 host = STAR_SMBSERVER;
2058         }
2059
2060         fstrcpy(cli->desthost, host);
2061
2062         /* allow hostnames of the form NAME#xx and do a netbios lookup */
2063         if ((p = strchr(cli->desthost, '#'))) {
2064                 name_type = strtol(p+1, NULL, 16);
2065                 *p = 0;
2066         }
2067
2068         if (!dest_ss || is_zero_addr((struct sockaddr *)dest_ss)) {
2069                 NTSTATUS status =resolve_name_list(frame,
2070                                         cli->desthost,
2071                                         name_type,
2072                                         &ss_arr,
2073                                         &num_addrs);
2074                 if (!NT_STATUS_IS_OK(status)) {
2075                         TALLOC_FREE(frame);
2076                         return NT_STATUS_BAD_NETWORK_NAME;
2077                 }
2078         } else {
2079                 num_addrs = 1;
2080                 ss_arr = TALLOC_P(frame, struct sockaddr_storage);
2081                 if (!ss_arr) {
2082                         TALLOC_FREE(frame);
2083                         return NT_STATUS_NO_MEMORY;
2084                 }
2085                 *ss_arr = *dest_ss;
2086         }
2087
2088         for (i = 0; i < num_addrs; i++) {
2089                 cli->dest_ss = ss_arr[i];
2090                 if (getenv("LIBSMB_PROG")) {
2091                         cli->fd = sock_exec(getenv("LIBSMB_PROG"));
2092                 } else {
2093                         uint16_t port = cli->port;
2094                         NTSTATUS status;
2095                         status = open_smb_socket(&cli->dest_ss, &port,
2096                                                  cli->timeout, &cli->fd);
2097                         if (NT_STATUS_IS_OK(status)) {
2098                                 cli->port = port;
2099                         }
2100                 }
2101                 if (cli->fd == -1) {
2102                         char addr[INET6_ADDRSTRLEN];
2103                         print_sockaddr(addr, sizeof(addr), &ss_arr[i]);
2104                         DEBUG(2,("Error connecting to %s (%s)\n",
2105                                  dest_ss?addr:host,strerror(errno)));
2106                 } else {
2107                         /* Exit from loop on first connection. */
2108                         break;
2109                 }
2110         }
2111
2112         if (cli->fd == -1) {
2113                 TALLOC_FREE(frame);
2114                 return map_nt_error_from_unix(errno);
2115         }
2116
2117         if (dest_ss) {
2118                 *dest_ss = cli->dest_ss;
2119         }
2120
2121         set_socket_options(cli->fd, lp_socket_options());
2122
2123         TALLOC_FREE(frame);
2124         return NT_STATUS_OK;
2125 }
2126
2127 /**
2128    establishes a connection to after the negprot.
2129    @param output_cli A fully initialised cli structure, non-null only on success
2130    @param dest_host The netbios name of the remote host
2131    @param dest_ss (optional) The the destination IP, NULL for name based lookup
2132    @param port (optional) The destination port (0 for default)
2133    @param retry bool. Did this connection fail with a retryable error ?
2134
2135 */
2136 NTSTATUS cli_start_connection(struct cli_state **output_cli,
2137                               const char *my_name,
2138                               const char *dest_host,
2139                               struct sockaddr_storage *dest_ss, int port,
2140                               int signing_state, int flags,
2141                               bool *retry)
2142 {
2143         NTSTATUS nt_status;
2144         struct nmb_name calling;
2145         struct nmb_name called;
2146         struct cli_state *cli;
2147         struct sockaddr_storage ss;
2148
2149         if (retry)
2150                 *retry = False;
2151
2152         if (!my_name)
2153                 my_name = global_myname();
2154
2155         if (!(cli = cli_initialise_ex(signing_state))) {
2156                 return NT_STATUS_NO_MEMORY;
2157         }
2158
2159         make_nmb_name(&calling, my_name, 0x0);
2160         make_nmb_name(&called , dest_host, 0x20);
2161
2162         cli_set_port(cli, port);
2163         cli_set_timeout(cli, 10000); /* 10 seconds. */
2164
2165         if (dest_ss) {
2166                 ss = *dest_ss;
2167         } else {
2168                 zero_sockaddr(&ss);
2169         }
2170
2171 again:
2172
2173         DEBUG(3,("Connecting to host=%s\n", dest_host));
2174
2175         nt_status = cli_connect(cli, dest_host, &ss);
2176         if (!NT_STATUS_IS_OK(nt_status)) {
2177                 char addr[INET6_ADDRSTRLEN];
2178                 print_sockaddr(addr, sizeof(addr), &ss);
2179                 DEBUG(1,("cli_start_connection: failed to connect to %s (%s). Error %s\n",
2180                          nmb_namestr(&called), addr, nt_errstr(nt_status) ));
2181                 cli_shutdown(cli);
2182                 return nt_status;
2183         }
2184
2185         if (retry)
2186                 *retry = True;
2187
2188         if (!cli_session_request(cli, &calling, &called)) {
2189                 char *p;
2190                 DEBUG(1,("session request to %s failed (%s)\n",
2191                          called.name, cli_errstr(cli)));
2192                 if ((p=strchr(called.name, '.')) && !is_ipaddress(called.name)) {
2193                         *p = 0;
2194                         goto again;
2195                 }
2196                 if (strcmp(called.name, STAR_SMBSERVER)) {
2197                         make_nmb_name(&called , STAR_SMBSERVER, 0x20);
2198                         goto again;
2199                 }
2200                 return NT_STATUS_BAD_NETWORK_NAME;
2201         }
2202
2203         if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO)
2204                 cli->use_spnego = False;
2205         else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS)
2206                 cli->use_kerberos = True;
2207
2208         if ((flags & CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS) &&
2209              cli->use_kerberos) {
2210                 cli->fallback_after_kerberos = true;
2211         }
2212
2213         nt_status = cli_negprot(cli);
2214         if (!NT_STATUS_IS_OK(nt_status)) {
2215                 DEBUG(1, ("failed negprot: %s\n", nt_errstr(nt_status)));
2216                 cli_shutdown(cli);
2217                 return nt_status;
2218         }
2219
2220         *output_cli = cli;
2221         return NT_STATUS_OK;
2222 }
2223
2224
2225 /**
2226    establishes a connection right up to doing tconX, password specified.
2227    @param output_cli A fully initialised cli structure, non-null only on success
2228    @param dest_host The netbios name of the remote host
2229    @param dest_ip (optional) The the destination IP, NULL for name based lookup
2230    @param port (optional) The destination port (0 for default)
2231    @param service (optional) The share to make the connection to.  Should be 'unqualified' in any way.
2232    @param service_type The 'type' of serivice.
2233    @param user Username, unix string
2234    @param domain User's domain
2235    @param password User's password, unencrypted unix string.
2236    @param retry bool. Did this connection fail with a retryable error ?
2237 */
2238
2239 NTSTATUS cli_full_connection(struct cli_state **output_cli,
2240                              const char *my_name,
2241                              const char *dest_host,
2242                              struct sockaddr_storage *dest_ss, int port,
2243                              const char *service, const char *service_type,
2244                              const char *user, const char *domain,
2245                              const char *password, int flags,
2246                              int signing_state,
2247                              bool *retry)
2248 {
2249         NTSTATUS nt_status;
2250         struct cli_state *cli = NULL;
2251         int pw_len = password ? strlen(password)+1 : 0;
2252
2253         *output_cli = NULL;
2254
2255         if (password == NULL) {
2256                 password = "";
2257         }
2258
2259         nt_status = cli_start_connection(&cli, my_name, dest_host,
2260                                          dest_ss, port, signing_state,
2261                                          flags, retry);
2262
2263         if (!NT_STATUS_IS_OK(nt_status)) {
2264                 return nt_status;
2265         }
2266
2267         cli->use_oplocks = ((flags & CLI_FULL_CONNECTION_OPLOCKS) != 0);
2268         cli->use_level_II_oplocks =
2269                 ((flags & CLI_FULL_CONNECTION_LEVEL_II_OPLOCKS) != 0);
2270
2271         nt_status = cli_session_setup(cli, user, password, pw_len, password,
2272                                       pw_len, domain);
2273         if (!NT_STATUS_IS_OK(nt_status)) {
2274
2275                 if (!(flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK)) {
2276                         DEBUG(1,("failed session setup with %s\n",
2277                                  nt_errstr(nt_status)));
2278                         cli_shutdown(cli);
2279                         return nt_status;
2280                 }
2281
2282                 nt_status = cli_session_setup(cli, "", "", 0, "", 0, domain);
2283                 if (!NT_STATUS_IS_OK(nt_status)) {
2284                         DEBUG(1,("anonymous failed session setup with %s\n",
2285                                  nt_errstr(nt_status)));
2286                         cli_shutdown(cli);
2287                         return nt_status;
2288                 }
2289         }
2290
2291         if (service) {
2292                 nt_status = cli_tcon_andx(cli, service, service_type, password,
2293                                           pw_len);
2294                 if (!NT_STATUS_IS_OK(nt_status)) {
2295                         DEBUG(1,("failed tcon_X with %s\n", nt_errstr(nt_status)));
2296                         cli_shutdown(cli);
2297                         if (NT_STATUS_IS_OK(nt_status)) {
2298                                 nt_status = NT_STATUS_UNSUCCESSFUL;
2299                         }
2300                         return nt_status;
2301                 }
2302         }
2303
2304         nt_status = cli_init_creds(cli, user, domain, password);
2305         if (!NT_STATUS_IS_OK(nt_status)) {
2306                 cli_shutdown(cli);
2307                 return nt_status;
2308         }
2309
2310         *output_cli = cli;
2311         return NT_STATUS_OK;
2312 }
2313
2314 /****************************************************************************
2315  Attempt a NetBIOS session request, falling back to *SMBSERVER if needed.
2316 ****************************************************************************/
2317
2318 bool attempt_netbios_session_request(struct cli_state **ppcli, const char *srchost, const char *desthost,
2319                                      struct sockaddr_storage *pdest_ss)
2320 {
2321         struct nmb_name calling, called;
2322
2323         make_nmb_name(&calling, srchost, 0x0);
2324
2325         /*
2326          * If the called name is an IP address
2327          * then use *SMBSERVER immediately.
2328          */
2329
2330         if(is_ipaddress(desthost)) {
2331                 make_nmb_name(&called, STAR_SMBSERVER, 0x20);
2332         } else {
2333                 make_nmb_name(&called, desthost, 0x20);
2334         }
2335
2336         if (!cli_session_request(*ppcli, &calling, &called)) {
2337                 NTSTATUS status;
2338                 struct nmb_name smbservername;
2339
2340                 make_nmb_name(&smbservername, STAR_SMBSERVER, 0x20);
2341
2342                 /*
2343                  * If the name wasn't *SMBSERVER then
2344                  * try with *SMBSERVER if the first name fails.
2345                  */
2346
2347                 if (nmb_name_equal(&called, &smbservername)) {
2348
2349                         /*
2350                          * The name used was *SMBSERVER, don't bother with another name.
2351                          */
2352
2353                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for name *SMBSERVER \
2354 with error %s.\n", desthost, cli_errstr(*ppcli) ));
2355                         return False;
2356                 }
2357
2358                 /* Try again... */
2359                 cli_shutdown(*ppcli);
2360
2361                 *ppcli = cli_initialise();
2362                 if (!*ppcli) {
2363                         /* Out of memory... */
2364                         return False;
2365                 }
2366
2367                 status = cli_connect(*ppcli, desthost, pdest_ss);
2368                 if (!NT_STATUS_IS_OK(status) ||
2369                                 !cli_session_request(*ppcli, &calling, &smbservername)) {
2370                         DEBUG(0,("attempt_netbios_session_request: %s rejected the session for \
2371 name *SMBSERVER with error %s\n", desthost, cli_errstr(*ppcli) ));
2372                         return False;
2373                 }
2374         }
2375
2376         return True;
2377 }
2378
2379 /****************************************************************************
2380  Send an old style tcon.
2381 ****************************************************************************/
2382 NTSTATUS cli_raw_tcon(struct cli_state *cli,
2383                       const char *service, const char *pass, const char *dev,
2384                       uint16 *max_xmit, uint16 *tid)
2385 {
2386         char *p;
2387
2388         if (!lp_client_plaintext_auth() && (*pass)) {
2389                 DEBUG(1, ("Server requested plaintext password but 'client "
2390                           "plaintext auth' is disabled\n"));
2391                 return NT_STATUS_ACCESS_DENIED;
2392         }
2393
2394         memset(cli->outbuf,'\0',smb_size);
2395         memset(cli->inbuf,'\0',smb_size);
2396
2397         cli_set_message(cli->outbuf, 0, 0, True);
2398         SCVAL(cli->outbuf,smb_com,SMBtcon);
2399         cli_setup_packet(cli);
2400
2401         p = smb_buf(cli->outbuf);
2402         *p++ = 4; p += clistr_push(cli, p, service, -1, STR_TERMINATE | STR_NOALIGN);
2403         *p++ = 4; p += clistr_push(cli, p, pass, -1, STR_TERMINATE | STR_NOALIGN);
2404         *p++ = 4; p += clistr_push(cli, p, dev, -1, STR_TERMINATE | STR_NOALIGN);
2405
2406         cli_setup_bcc(cli, p);
2407
2408         cli_send_smb(cli);
2409         if (!cli_receive_smb(cli)) {
2410                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2411         }
2412
2413         if (cli_is_error(cli)) {
2414                 return cli_nt_error(cli);
2415         }
2416
2417         *max_xmit = SVAL(cli->inbuf, smb_vwv0);
2418         *tid = SVAL(cli->inbuf, smb_vwv1);
2419
2420         return NT_STATUS_OK;
2421 }
2422
2423 /* Return a cli_state pointing at the IPC$ share for the given server */
2424
2425 struct cli_state *get_ipc_connect(char *server,
2426                                 struct sockaddr_storage *server_ss,
2427                                 const struct user_auth_info *user_info)
2428 {
2429         struct cli_state *cli;
2430         NTSTATUS nt_status;
2431         uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK;
2432
2433         if (user_info->use_kerberos) {
2434                 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
2435         }
2436
2437         nt_status = cli_full_connection(&cli, NULL, server, server_ss, 0, "IPC$", "IPC",
2438                                         user_info->username ? user_info->username : "",
2439                                         lp_workgroup(),
2440                                         user_info->password ? user_info->password : "",
2441                                         flags,
2442                                         Undefined, NULL);
2443
2444         if (NT_STATUS_IS_OK(nt_status)) {
2445                 return cli;
2446         } else if (is_ipaddress(server)) {
2447             /* windows 9* needs a correct NMB name for connections */
2448             fstring remote_name;
2449
2450             if (name_status_find("*", 0, 0, server_ss, remote_name)) {
2451                 cli = get_ipc_connect(remote_name, server_ss, user_info);
2452                 if (cli)
2453                     return cli;
2454             }
2455         }
2456         return NULL;
2457 }
2458
2459 /*
2460  * Given the IP address of a master browser on the network, return its
2461  * workgroup and connect to it.
2462  *
2463  * This function is provided to allow additional processing beyond what
2464  * get_ipc_connect_master_ip_bcast() does, e.g. to retrieve the list of master
2465  * browsers and obtain each master browsers' list of domains (in case the
2466  * first master browser is recently on the network and has not yet
2467  * synchronized with other master browsers and therefore does not yet have the
2468  * entire network browse list)
2469  */
2470
2471 struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx,
2472                                 struct ip_service *mb_ip,
2473                                 const struct user_auth_info *user_info,
2474                                 char **pp_workgroup_out)
2475 {
2476         char addr[INET6_ADDRSTRLEN];
2477         fstring name;
2478         struct cli_state *cli;
2479         struct sockaddr_storage server_ss;
2480
2481         *pp_workgroup_out = NULL;
2482
2483         print_sockaddr(addr, sizeof(addr), &mb_ip->ss);
2484         DEBUG(99, ("Looking up name of master browser %s\n",
2485                    addr));
2486
2487         /*
2488          * Do a name status query to find out the name of the master browser.
2489          * We use <01><02>__MSBROWSE__<02>#01 if *#00 fails because a domain
2490          * master browser will not respond to a wildcard query (or, at least,
2491          * an NT4 server acting as the domain master browser will not).
2492          *
2493          * We might be able to use ONLY the query on MSBROWSE, but that's not
2494          * yet been tested with all Windows versions, so until it is, leave
2495          * the original wildcard query as the first choice and fall back to
2496          * MSBROWSE if the wildcard query fails.
2497          */
2498         if (!name_status_find("*", 0, 0x1d, &mb_ip->ss, name) &&
2499             !name_status_find(MSBROWSE, 1, 0x1d, &mb_ip->ss, name)) {
2500
2501                 DEBUG(99, ("Could not retrieve name status for %s\n",
2502                            addr));
2503                 return NULL;
2504         }
2505
2506         if (!find_master_ip(name, &server_ss)) {
2507                 DEBUG(99, ("Could not find master ip for %s\n", name));
2508                 return NULL;
2509         }
2510
2511         *pp_workgroup_out = talloc_strdup(ctx, name);
2512
2513         DEBUG(4, ("found master browser %s, %s\n", name, addr));
2514
2515         print_sockaddr(addr, sizeof(addr), &server_ss);
2516         cli = get_ipc_connect(addr, &server_ss, user_info);
2517
2518         return cli;
2519 }
2520
2521 /*
2522  * Return the IP address and workgroup of a master browser on the network, and
2523  * connect to it.
2524  */
2525
2526 struct cli_state *get_ipc_connect_master_ip_bcast(TALLOC_CTX *ctx,
2527                                         const struct user_auth_info *user_info,
2528                                         char **pp_workgroup_out)
2529 {
2530         struct ip_service *ip_list;
2531         struct cli_state *cli;
2532         int i, count;
2533
2534         *pp_workgroup_out = NULL;
2535
2536         DEBUG(99, ("Do broadcast lookup for workgroups on local network\n"));
2537
2538         /* Go looking for workgroups by broadcasting on the local network */
2539
2540         if (!NT_STATUS_IS_OK(name_resolve_bcast(MSBROWSE, 1, &ip_list,
2541                                                 &count))) {
2542                 DEBUG(99, ("No master browsers responded\n"));
2543                 return False;
2544         }
2545
2546         for (i = 0; i < count; i++) {
2547                 char addr[INET6_ADDRSTRLEN];
2548                 print_sockaddr(addr, sizeof(addr), &ip_list[i].ss);
2549                 DEBUG(99, ("Found master browser %s\n", addr));
2550
2551                 cli = get_ipc_connect_master_ip(ctx, &ip_list[i],
2552                                 user_info, pp_workgroup_out);
2553                 if (cli)
2554                         return(cli);
2555         }
2556
2557         return NULL;
2558 }